protege 0.1.0.alpha.2 → 0.1.0.alpha.7

data/lib/protege/extensions/tool_mixin.rb

@@ -6,10 +6,12 @@ module Protege
   # their description and JSON Schema via the class-level DSL, and implement +#use(context:, **input)+.
   #
   # Registration is automatic: every +Tool+ subclass is discoverable via +Tool.registered+
-  # (resolved from +Tool.descendants+, so it survives Zeitwerk reloads), and the +Harness+
-  # enumerates that list to build the LLM-visible tool catalog. Tools have no +protege_id+ DSL — the
-  # id is derived from the class basename with the +Tool+ suffix stripped, then snake_cased
-  # (+SendEmailTool+ → +:send_email+, +HTTPFetchTool+ → +:http_fetch+).
+  # (resolved from +Tool.descendants+, so it survives Zeitwerk reloads). Availability is not — the
+  # +Harness+ builds the LLM-visible catalog from the agent's attached toolkits
+  # (+Agent#available_tools_for+, fail-closed), so a registered tool reaches the model only through a
+  # toolkit that contains it. Tools have no +protege_id+ DSL — the id is derived from the class
+  # basename with the +Tool+ suffix stripped, then snake_cased (+SendEmailTool+ → +:send_email+,
+  # +HTTPFetchTool+ → +:http_fetch+).
   #
   # Tools must return a +Protege::Result+ from +#use+ — construct one via +Result.success(**data)+ /
   # +Result.failure(reason:, **data)+ (or the +#success+/+#failure+ helpers). The +Harness+ serializes
@@ -81,17 +83,17 @@ module Protege
       #   +Protege::InvalidToolResultError+, rather than blowing up later when the +Harness+
       #   calls +#success?+ on the bad value.
       #
-      # Enforcement of tool scoping lives here: a call to any tool outside the persona's effective scope
-      # (its code grant minus +disabled_tool_ids+, read from +context.persona+) is refused before +#use+
-      # runs. Advertising a narrowed catalogue in the request isn't enough — a tool disabled mid-thread
-      # stays visible to the model in earlier turns and could still be called — so dispatch is the
-      # backstop.
+      # Enforcement of tool scoping lives here: a call to any tool outside the agent's effective scope
+      # for this run (the tools its attached toolkits expose to the run's sender, read from
+      # +context.agent+) is refused before +#use+ runs. Advertising a narrowed catalogue in the request
+      # isn't enough — a tool that left scope mid-thread stays visible to the model in earlier turns and
+      # could still be called — so dispatch is the backstop.
       #
       # @param tool_call [Object] the tool call carrying name and input
       # @param context [Protege::Orchestrator::Context] the per-delivery tool context
       # @return [Protege::ToolResult] the call paired with its result
       def invoke(tool_call, context:)
-        if context.persona.available_tool_ids.exclude?(tool_call.name.to_sym)
+        if context.agent.available_tool_ids_for(context:).exclude?(tool_call.name.to_sym)
           return failed_tool_result(tool_call:,
                                     error:     Protege::ToolNotAvailableError.new(name: tool_call.name))
         end
@@ -170,21 +172,11 @@ module Protege
       Result.failure(reason:, **data)
     end
 
-    # Class-level DSL mixed into every tool class via +Tool.included+.
+    # Class-level DSL mixed into every tool class via +Tool.included+. The tool's +id+, +description+, and
+    # +display_name+ come from the shared +Extensions::Manifested+ concern (a tool's +id+ is its class
+    # basename with the +Tool+ suffix stripped, e.g. +SendEmailTool → :send_email+); only +input_schema+,
+    # which describes call-time input rather than manifest metadata, lives here.
     module ClassMethods
-      # Declare or read the natural-language description shown to the LLM in the tool catalog.
-      #
-      # With an argument, sets the description; with no argument, returns the previously declared
-      # value.
-      #
-      # @param text [String, nil] the description to set, or nil to read
-      # @return [String, nil] the current description
-      def description(text = nil)
-        return @description if text.nil?
-
-        @description = text
-      end
-
       # Declare or read the JSON Schema describing this tool's input parameters.
       #
       # With an argument, sets the schema; with no argument, returns the previously declared value.
@@ -196,22 +188,6 @@ module Protege
 
         @input_schema = schema
       end
-
-      # Return the tool's symbolic identifier, derived from the class basename with the +Tool+
-      # suffix stripped and the rest snake_cased. Every concrete tool is named +<Purpose>Tool+ by
-      # convention (so tool classes never collide with same-named models), yet the id the agent sees
-      # stays clean. Memoized per class.
-      #
-      # @example
-      #   SendEmailTool   # => :send_email
-      #   HTTPFetchTool   # => :http_fetch
-      #   EchoTool        # => :echo
-      #   Read2Tool       # => :read2
-      #
-      # @return [Symbol] the tool id
-      def id
-        @id ||= name.demodulize.delete_suffix('Tool').underscore.to_sym
-      end
     end
   end
 end

data/lib/protege/gateway/access_control.rb

@@ -2,45 +2,45 @@
 
 module Protege
   module Gateway
-    # The inbound access guardrail: composes every access-policy *layer* that applies to a persona and
-    # answers the one question the Gateway asks — may this sender reach this persona? A gateway concern
+    # The inbound access guardrail: composes every access-policy *layer* that applies to an agent and
+    # answers the one question the Gateway asks — may this sender reach this agent? A gateway concern
     # (inbound mail authorization), it lives beside the other Gateway protocol pieces and is called from
     # the Gateway's inbound edge, +AgentMailbox+.
     #
     # Composition is by **intersection**: a sender is permitted only when *every* layer permits it
     # (logical AND). Because intersection is commutative there is no precedence to reason about — the
     # order of layers never changes the outcome — and the security property falls out for free: a layer
-    # can only *narrow* the set of admitted senders, never widen it. So a per-persona rule can tighten
+    # can only *narrow* the set of admitted senders, never widen it. So a per-agent rule can tighten
     # who reaches that agent but can never punch through the committed org-wide ceiling.
     #
     # Two layers exist today — the committed global policy (+Protege.configuration.inbound_access+) and
-    # the persona's runtime rules (+AccessRule.policy_for+). This composer is the single seam the rest of
-    # the engine calls; adding a layer later (e.g. a per-persona-class committed policy) is a one-line
+    # the agent's runtime rules (+AccessRule.policy_for+). This composer is the single seam the rest of
+    # the engine calls; adding a layer later (e.g. a per-agent-class committed policy) is a one-line
     # change to {#policies}, never a change at the call sites.
     #
     # @example Gate an inbound sender
-    #   Gateway::AccessControl.for(persona:).permits?(address: mail.from.first)
+    #   Gateway::AccessControl.for(agent:).permits?(address: mail.from.first)
     class AccessControl
-      # @return [Protege::Persona] the persona the inbound mail is addressed to
-      attr_reader :persona
+      # @return [Protege::Agent] the agent the inbound mail is addressed to
+      attr_reader :agent
 
       class << self
-        # Build the access control for a persona. Factory mirror of +.new+ reading as a lookup.
+        # Build the access control for an agent. Factory mirror of +.new+ reading as a lookup.
         #
-        # @param persona [Protege::Persona] the routed persona
+        # @param agent [Protege::Agent] the routed agent
         # @return [Protege::Gateway::AccessControl] the composed guardrail
-        def for(persona:)
-          new(persona:)
+        def for(agent:)
+          new(agent:)
         end
       end
 
-      # @param persona [Protege::Persona] the routed persona
+      # @param agent [Protege::Agent] the routed agent
       # @return [void]
-      def initialize(persona:)
-        @persona = persona
+      def initialize(agent:)
+        @agent = agent
       end
 
-      # Decide whether a sender may reach this persona, intersecting all applicable layers.
+      # Decide whether a sender may reach this agent, intersecting all applicable layers.
       #
       # @param address [String] the raw sender address
       # @return [Boolean] true only when every layer permits the sender
@@ -50,15 +50,15 @@ module Protege
 
       private
 
-      # The ordered (order-immaterial) list of policy layers that apply to this persona.
+      # The ordered (order-immaterial) list of policy layers that apply to this agent.
       #
       # Add a layer here — and only here — to extend the guardrail.
       #
-      # @return [Array<Protege::Gateway::AccessPolicy>] the global ceiling and the persona's runtime policy
+      # @return [Array<Protege::Gateway::AccessPolicy>] the global ceiling and the agent's runtime policy
       def policies
         [
           Protege.configuration.inbound_access,
-          AccessRule.policy_for(persona)
+          AccessRule.policy_for(agent)
         ]
       end
     end

data/lib/protege/gateway/access_policy.rb

@@ -6,7 +6,7 @@ module Protege
     # sender address is permitted, given an allow-list and a deny-list of address patterns. A Gateway
     # value type (inbound authorization) — built through the +Gateway.build_access_policy+ factory,
     # composed by +Gateway::AccessControl+, and assigned as the global ceiling via +config.inbound_access+
-    # or per-persona by +AccessRule.policy_for+:
+    # or per-agent by +AccessRule.policy_for+:
     #
     #   config.inbound_access = Protege::Gateway.build_access_policy(allow: ['*@company.co'])
     #
@@ -19,7 +19,7 @@ module Protege
     # Patterns are matched against the sender's tag-stripped, lowercased +local@domain+ routing key (so
     # +ceo+finance@Company.CO+ matches a +ceo@company.co+ rule), and support a single +*+ wildcard
     # (e.g. +*@company.co+). This object knows nothing about layering; composing several policies into
-    # the org→persona guardrail is +AccessControl+'s job.
+    # the org→agent guardrail is +AccessControl+'s job.
     #
     # @example The identity policy — a bare +build_access_policy+ permits everyone (empty lists derive a
     #   default-allow), so it drops out of the +AccessControl+ intersection as a no-op.

data/lib/protege/gateway/mail/outbound.rb

@@ -15,7 +15,7 @@ module Protege
       #
       # @example A threaded reply
       #   Outbound.build(
-      #     from:        persona.email_address,
+      #     from:        agent.email_address,
       #     to:          inbound.from_address,
       #     subject:     'Re: Hello',
       #     body:        'Thanks!',
@@ -37,6 +37,9 @@ module Protege
           #   Strings are split on whitespace, Arrays/References normalized per id.
           # @param attachments [Array<Mail::Attachment>] files to attach; when any are present the message
           #   is assembled as multipart with the body as a text part.
+          # @param hops [Integer, nil] the +X-Protege-Recursion+ hop count to stamp — agent-sent mail
+          #   passes it (see +Gateway::RECURSION_HEADER+); +nil+ (operator/console mail) leaves the
+          #   header off entirely.
           # @return [::Mail::Message] the assembled message.
           def build(
             from:,
@@ -47,7 +50,8 @@ module Protege
             bcc: [],
             in_reply_to: nil,
             references: nil,
-            attachments: []
+            attachments: [],
+            hops: nil
           )
             new(
               from:,
@@ -58,7 +62,8 @@ module Protege
               bcc:,
               in_reply_to:,
               references:,
-              attachments:
+              attachments:,
+              hops:
             ).message
           end
         end
@@ -75,7 +80,8 @@ module Protege
           bcc: [],
           in_reply_to: nil,
           references: nil,
-          attachments: []
+          attachments: [],
+          hops: nil
         )
           @from        = from
           @to          = to
@@ -86,6 +92,7 @@ module Protege
           @in_reply_to = in_reply_to
           @references  = references
           @attachments = attachments
+          @hops        = hops
         end
 
         # Assemble the +::Mail::Message+ from the stored inputs.
@@ -103,12 +110,22 @@ module Protege
             m.in_reply_to = parent_id if parent_id
             m.references  = reference_values if reference_values.any?
 
+            stamp_hops(m)
             assign_content(m)
           end
         end
 
         private
 
+        # Stamp the +X-Protege-Recursion+ hop count on agent-sent mail; a nil +hops+ (operator/console
+        # mail) leaves the header off so human-authored messages never look like an agent chain.
+        #
+        # @param mail [::Mail::Message] the message under construction
+        # @return [void]
+        def stamp_hops(mail)
+          mail.header[Gateway::RECURSION_HEADER] = @hops.to_s if @hops
+        end
+
         # Set the body on +mail+: a single +text/plain+ part when there are no attachments, otherwise a
         # multipart message whose first part is the plain-text body and whose remaining parts are the
         # attachments. Forcing a top-level +text/plain+ content type would break the multipart case, so
@@ -138,7 +155,7 @@ module Protege
 
         # The domain for the outbound Message-ID — the +From+ address's domain, so the id carries the
         # real sending domain (recipients like Gmail distrust a bogus domain and won't thread). A
-        # persona (or the console) always sends from a full address, so a From with no domain is a
+        # agent (or the console) always sends from a full address, so a From with no domain is a
         # caller bug rather than something to paper over.
         #
         # @return [String] the sending domain.

data/lib/protege/gateway.rb

@@ -17,6 +17,13 @@ module Protege
     autoload :AccessControl, 'protege/gateway/access_control'
     autoload :AttachmentPolicy, 'protege/gateway/attachment_policy'
 
+    # The hop-count header agent-sent mail carries so agent-to-agent reply loops stay bounded. Every
+    # email an agent sends is stamped: +1+ on fresh mail, the inbound value plus one on a reply. Human
+    # mail clients never echo a custom header back, so a conversation with a person always resets — only
+    # an unbroken chain of Protege-to-Protege replies accumulates hops, and the inbound edge
+    # (+AgentMailbox+) silently drops mail whose count reaches its limit.
+    RECURSION_HEADER = 'X-Protege-Recursion'
+
     extend self
 
     # Accept a message typed into the dashboard console.
@@ -27,18 +34,18 @@ module Protege
     # correlation id so events across the run can be traced.
     #
     # @param mail [::Mail::Message] the console-authored message.
-    # @param persona [Persona] the persona receiving the message.
+    # @param agent [Agent] the agent receiving the message.
     # @param attachments [Array<ActiveStorage::Blob, ActiveStorage::Attachment, #original_filename, Hash>]
-    #   files for the persona to read. Each entry is normalized to a blob (see {#blob_for}) and attached by
+    #   files for the agent to read. Each entry is normalized to a blob (see {#blob_for}) and attached by
     #   reference (mirroring +deliver+) — an already-stored blob/attachment reuses its blob, an uploaded
     #   file or a +{ filename:, content_type:, bytes: }+ Hash is uploaded once. Attached after +save!+ so
-    #   they are committed before the (delayed) job reads the message; the persona sees them via
+    #   they are committed before the (delayed) job reads the message; the agent sees them via
     #   +Message#content_parts+ / the +read_attachment+ tool.
     # @return [Message] the saved inbound message record.
-    def accept_console_message(mail:, persona:, attachments: [])
+    def accept_console_message(mail:, agent:, attachments: [])
       correlation_id            = Mail::MessageId.ensure(mail.message_id).value
-      thread                    = EmailThread.find_or_create_for(mail:, persona:)
-      message                   = Message.build_from_mail(mail:, direction: :inbound, thread:, persona:)
+      thread                    = EmailThread.find_or_create_for(mail:, agent:)
+      message                   = Message.build_from_mail(mail:, direction: :inbound, thread:, agent:)
       message.processing_status = :pending
       message.save!
 
@@ -52,13 +59,13 @@ module Protege
       ConsoleInferenceJob
         .set(wait: 1.second)
         .perform_later(message_id:     message.id,
-                       persona_id:     persona.id,
+                       agent_id:       agent.id,
                        correlation_id:)
 
       message
     end
 
-    # Send a message to a persona from the host application — the reverse of tools/resolvers.
+    # Send a message to an agent from the host application — the reverse of tools/resolvers.
     #
     # Where tools and resolvers let the agent reach *into* the app, this lets ordinary application code
     # (a service object, controller, or state machine) hand the agent something to act on:
@@ -68,12 +75,12 @@ module Protege
     #
     # It is a thin convenience over +build_outbound+ + +accept_console_message+ — the exact sequence the
     # dashboard console uses — so the brief flows through the same "inbound message starts a thread" path
-    # (+ReplyHarness+ and the persona's +message_resolvers+). +to+ is an address, not a record: it is
-    # resolved through +Persona.lookup+ (honouring case and +tag+ subaddressing), so a caller can pass a
-    # literal address or +persona.email_address+ without loading the record first.
+    # (+ReplyHarness+ and the agent's +message_resolvers+). +to+ is an address, not a record: it is
+    # resolved through +Agent.lookup+ (honouring case and +tag+ subaddressing), so a caller can pass a
+    # literal address or +agent.email_address+ without loading the record first.
     #
     # Fire-and-forget: it returns the persisted inbound +Message+ for reference/tracing, not an LLM
-    # response — the agent's actions (any mail it chooses to send) are the outcome. The persona reads it,
+    # response — the agent's actions (any mail it chooses to send) are the outcome. The agent reads it,
     # reasons, and uses its (scoped) tools; there is nothing it must reply to.
     #
     # Attachments meet the host where its file already is — a stored blob/attachment (e.g.
@@ -82,42 +89,42 @@ module Protege
     # generated bytes, uploaded once). So a caller never constructs a +Gateway::Mail::Attachment+ by hand.
     # See {#blob_for} for the full set of accepted shapes.
     #
-    # @param to [String] the recipient persona's address (or +persona.email_address+).
+    # @param to [String] the recipient agent's address (or +agent.email_address+).
     # @param subject [String, nil] the message subject (the thread's title).
-    # @param body [String] the brief the persona acts on.
-    # @param attachments [Array] files for the persona to read; see {#accept_console_message} / {#blob_for}.
+    # @param body [String] the brief the agent acts on.
+    # @param attachments [Array] files for the agent to read; see {#accept_console_message} / {#blob_for}.
     # @return [Message] the saved inbound message record.
-    # @raise [ArgumentError] when no active persona owns +to+, or an attachment is an unsupported shape.
+    # @raise [ArgumentError] when no active agent owns +to+, or an attachment is an unsupported shape.
     def message(to:, body:, subject: nil, attachments: [])
-      persona = Persona.lookup(to)
-      raise ArgumentError, "no active persona for address: #{to.inspect}" unless persona
+      agent = Agent.lookup(to)
+      raise ArgumentError, "no active agent for address: #{to.inspect}" unless agent
 
       mail = build_outbound(from:    Protege.configuration.console_address,
-                            to:      persona.email_address,
+                            to:      agent.email_address,
                             subject:,
                             body:)
 
-      accept_console_message(mail:, persona:, attachments:)
+      accept_console_message(mail:, agent:, attachments:)
     end
 
     # Accept an inbound email arriving via SMTP / Action Mailbox.
     #
     # Unlike the console path, ingestion (persisting the +Message+, building the thread) happens
-    # inside +InferenceJob+; this method only enqueues that job with the persona and the inbound
+    # inside +InferenceJob+; this method only enqueues that job with the agent and the inbound
     # email reference, carrying the mail's message id as the correlation id.
     #
     # @param inbound_email [ActionMailbox::InboundEmail] the ingress email record.
-    # @param persona [Persona] the persona the message was routed to.
+    # @param agent [Agent] the agent the message was routed to.
     # @return [void]
-    def accept_smtp_message(inbound_email:, persona:)
+    def accept_smtp_message(inbound_email:, agent:)
       InferenceJob.perform_later(
-        persona_id:       persona.id,
+        agent_id:         agent.id,
         inbound_email_id: inbound_email.id,
         correlation_id:   Mail::MessageId.ensure(inbound_email.mail.message_id).value
       )
     end
 
-    # Deliver an outbound message on behalf of a persona and record it.
+    # Deliver an outbound message on behalf of an agent and record it.
     #
     # Sends over SMTP via +mail.deliver!+ unless the recipient is the local console address, in
     # which case the conversation stays entirely in-app. Either way the message is persisted as an
@@ -129,18 +136,18 @@ module Protege
     # uploaded once and thereafter only referenced.
     #
     # @param mail [::Mail::Message] the outbound mail to deliver.
-    # @param persona [Persona] the sending persona.
+    # @param agent [Agent] the sending agent.
     # @param attachments [Array<ActiveStorage::Blob>] blobs to attach to the outbound record by reference.
     # @return [Message] the saved outbound message record.
-    def deliver(mail:, persona:, attachments: [])
+    def deliver(mail:, agent:, attachments: [])
       deliver_over_transport(mail) unless local_delivery?(mail)
 
-      thread = EmailThread.find_or_create_for(mail:, persona:)
+      thread = EmailThread.find_or_create_for(mail:, agent:)
 
       Message.build_from_mail(
         mail:,
         thread:,
-        persona:,
+        agent:,
         direction:        :outbound,
         attach_from_mail: false
       ).tap do |record|
@@ -162,7 +169,7 @@ module Protege
 
     # Build an inbound access policy — one layer of the sender-authorization guardrail. The public way
     # to construct an +AccessPolicy+, whether the global ceiling (+config.inbound_access+) or a
-    # per-persona layer (+AccessRule.policy_for+). +build_+ marks it as an instance factory, not a
+    # per-agent layer (+AccessRule.policy_for+). +build_+ marks it as an instance factory, not a
     # persisted record. Keyword arguments are forwarded (+allow:+, +deny:+, +default_decision:+).
     #
     # @return [Protege::Gateway::AccessPolicy] the composed policy layer
@@ -215,24 +222,28 @@ module Protege
       Mail::Address.parse(address).routing_key
     end
 
-    # Report whether a sender may reach a persona, per the persona's inbound access guardrail.
+    # Report whether a sender may reach an agent, per the agent's inbound access guardrail.
     #
-    # @param persona [Persona] the routed persona
+    # @param agent [Agent] the routed agent
     # @param address [String, nil] the sender's address
     # @return [Boolean] true when every access layer permits the sender
-    def permits?(persona:, address:)
-      AccessControl.for(persona:).permits?(address:)
+    def permits?(agent:, address:)
+      AccessControl.for(agent:).permits?(address:)
     end
 
     # Report whether an inbound email is addressed to a domain Protege receives for — the Action
     # Mailbox routing predicate. Domain-scoped on purpose: the engine claims only mail for its own
     # domains and leaves everything else to the host's own mailbox routing, so mounting Protege never
-    # hijacks a host's other inbound mail. Per-persona/subaddress validation stays in +AgentMailbox+.
+    # hijacks a host's other inbound mail. Per-agent/subaddress validation stays in +AgentMailbox+.
+    #
+    # Considers both To and Cc: an agent reached only as a Cc recipient (e.g. on a reply-all) is a
+    # legitimate participant and must be claimed, matching how the rest of the system treats Cc.
     #
     # @param inbound_email [ActionMailbox::InboundEmail] the received email
-    # @return [Boolean] true when any recipient's domain is one of ours
+    # @return [Boolean] true when any To/Cc recipient's domain is one of ours
     def claims?(inbound_email:)
-      Array(inbound_email.mail.to).any? { |address| EmailDomain.receives?(address) }
+      mail = inbound_email.mail
+      (Array(mail.to) + Array(mail.cc)).any? { |address| EmailDomain.receives?(address) }
     end
 
     # ── MTA provisioning (push) ────────────────────────────────────────────────

data/lib/protege/loop/scheduler.rb

@@ -23,7 +23,7 @@ module Protege
       #
       # @return [void]
       def dispatch
-        Protege::Responsibility.active.with_active_persona.find_each do |responsibility|
+        Protege::Responsibility.active.with_active_agent.find_each do |responsibility|
           responsibility.dispatch! if responsibility.due?(now)
         end
       end

data/lib/protege/orchestrator/context.rb

@@ -3,7 +3,7 @@
 module Protege
   module Orchestrator
     # Base context shared by both kinds of run. Carries the per-run runtime data every tool and
-    # resolver needs — persona, a frozen config snapshot, logger, correlation id — plus the
+    # resolver needs — agent, a frozen config snapshot, logger, correlation id — plus the
     # +#deliver+ affordance for sending mail through the Gateway, without exposing mutable framework
     # state. Frozen after construction so one instance is safely shared across every tool/resolver
     # invocation in a run.
@@ -13,19 +13,19 @@ module Protege
     # +#message+ (reactive, an inbound email) and +ResponsibilityContext+ sets +#responsibility+
     # (proactive, a scheduled Loop run). Tools and resolvers branch on whichever is present.
     class Context
-      # @return [Protege::Persona] the persona handling this run
+      # @return [Protege::Agent] the agent handling this run
       # @return [Protege::Configuration] the frozen process configuration snapshot
       # @return [Logger] the engine logger
       # @return [String, nil] the correlation id threaded through this run's events
-      attr_reader :persona, :config, :logger, :correlation_id
+      attr_reader :agent, :config, :logger, :correlation_id
 
       # Capture the shared runtime data and freeze. Subclasses set their own subject ivar *before*
       # calling +super+, since this constructor freezes the instance.
       #
-      # @param persona [Protege::Persona] the persona handling this run
+      # @param agent [Protege::Agent] the agent handling this run
       # @return [void]
-      def initialize(persona:)
-        @persona        = persona
+      def initialize(agent:)
+        @agent          = agent
         @logger         = Protege.configuration.logger
         # Snapshot a frozen *copy* so the context is immutable without freezing the process-wide
         # configuration (which boot-time code and tests still mutate).
@@ -51,14 +51,14 @@ module Protege
       end
 
       # Deliver an outbound mail via the Gateway, handling transport, thread resolution, and message
-      # persistence under the current persona. Any +attachments+ (blobs already in storage) are attached
+      # persistence under the current agent. Any +attachments+ (blobs already in storage) are attached
       # to the persisted outbound message by reference, so a file is never re-uploaded on send.
       #
       # @param mail [Object] the outbound mail to deliver
       # @param attachments [Array<ActiveStorage::Blob>] blobs to attach to the outbound message
       # @return [Object] the Gateway delivery outcome
       def deliver(mail:, attachments: [])
-        Gateway.deliver(mail:, persona:, attachments:)
+        Gateway.deliver(mail:, agent:, attachments:)
       end
     end
   end