protege 0.1.0.alpha.2 → 0.1.0.alpha.8

data/app/services/protege/system_toolkits.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Protege
+  # Maintains the engine's *system* toolkits — the two toolkit records the framework guarantees exist,
+  # identified by a stable +key+ (see +Toolkit+):
+  #
+  # * **All Tools** (+all_tools+) — always holds every registered tool. Its membership is engine-owned:
+  #   each sync rewrites it to the live tool manifest, so a tool added in code shows up automatically and
+  #   an operator's edits don't stick.
+  # * **Default Tools** (+default_tools+) — auto-attached to every new agent (see +Toolable+). The engine
+  #   only *seeds* it on first creation — with every engine built-in tool, so a fresh agent starts with
+  #   the full generic baseline (reply, search, web, files) — and thereafter its membership is the
+  #   operator's to curate, so later syncs leave it alone.
+  #
+  # Sync is idempotent and safe to run repeatedly. It runs like any other seed data — not at boot (writing
+  # to the DB from an initializer is an anti-pattern): the +protege:toolkits:sync+ rake task on deploy and
+  # the host's +db/seeds.rb+ in development. Both eager-load the app first so the tool manifest is complete
+  # (rake tasks don't eager-load by default), which is what makes All Tools capture every registered tool.
+  class SystemToolkits
+    class << self
+      # Ensure both system toolkits exist and refresh All Tools' membership.
+      #
+      # @return [void]
+      def sync!
+        new.sync!
+      end
+    end
+
+    # Ensure both system toolkits exist and refresh All Tools' membership.
+    #
+    # @return [void]
+    def sync!
+      sync_all_tools
+      ensure_default_tools
+    end
+
+    private
+
+    # Create or update the All Tools toolkit so it holds every registered tool.
+    #
+    # @return [void]
+    def sync_all_tools
+      toolkit = Toolkit.find_or_initialize_by(key: Toolkit::ALL_TOOLS_KEY)
+
+      toolkit.name            = 'All Tools'
+      toolkit.description     = 'Automatically managed — always contains every registered tool, refreshed ' \
+                                'on each deploy. Its members are not editable. Attach it to an agent to ' \
+                                'grant the full tool catalogue.'
+      toolkit.member_tool_ids = Manifest.registered(:tool).map { |entry| entry.id.to_s }
+      toolkit.save!
+    end
+
+    # Ensure the Default Tools toolkit exists. On first creation it is seeded with every engine built-in
+    # tool — the generic baseline (reply, search, web, files) that makes a new agent immediately useful,
+    # deliberately overlapping All Tools — while host-defined tools stay out of the seed (granting your
+    # own tools is an explicit act). On later syncs its membership is left untouched (operator-owned).
+    #
+    # @return [void]
+    def ensure_default_tools
+      toolkit = Toolkit.find_or_initialize_by(key: Toolkit::DEFAULT_TOOLS_KEY)
+      return unless toolkit.new_record?
+
+      toolkit.name            = 'Default Tools'
+      toolkit.description     = 'Attached to every new agent automatically. Curate its members to set the ' \
+                                'baseline tools an agent starts with.'
+      toolkit.member_tool_ids = engine_tool_ids
+      toolkit.save!
+    end
+
+    # The ids of the tools the engine itself ships — manifest entries whose class lives under the
+    # +Protege::+ namespace, distinguishing built-ins from host-defined tools.
+    #
+    # @return [Array<String>] the engine built-in tool ids
+    def engine_tool_ids
+      Manifest.registered(:tool)
+              .select { |entry| entry.klass.module_parent == Protege }
+              .map { |entry| entry.id.to_s }
+    end
+  end
+end

data/app/tools/protege/create_file_tool.rb

@@ -40,6 +40,8 @@ module Protege
       rows, for html/svg write the markup, for json write the JSON.
     DESC
 
+    summary 'Create a file (CSV, HTML, Markdown, JSON…) to attach to an email.'
+
     input_schema(
       type:                 'object',
       additionalProperties: false,

data/app/tools/protege/read_attachment_tool.rb

@@ -5,7 +5,7 @@ module Protege
   # publishes it in the LLM's tool catalog (id +:read_attachment+).
   #
   # The agent learns a file's blob id from the +ThreadHistoryResolver+/inbound note ("…, id: 123") or
-  # from +create_file+. Resolution is by blob id (see +Protege::StoredFile.find+); persona scoping is
+  # from +create_file+. Resolution is by blob id (see +Protege::StoredFile.find+); agent scoping is
   # deferred to a later pass (see the blob-currency spec §9), so any known blob id currently resolves.
   # Behaviour by type:
   #
@@ -23,6 +23,8 @@ module Protege
       shown to you directly to view. Other types (such as video or archives) can't be read.
     DESC
 
+    summary 'Read a file from the conversation by its id.'
+
     input_schema(
       type:                 'object',
       additionalProperties: false,

data/app/tools/protege/search_emails_tool.rb

@@ -6,8 +6,8 @@ module Protege
   # catalog (id +:search_emails+); when the model emits a +search_emails+ call, the harness routes the
   # arguments to +#use+.
   #
-  # The search is always scoped to the active persona's own messages (via +Persona#messages+) — an
-  # agent can never read another persona's mail. A single free-text query is matched, case-insensitively,
+  # The search is always scoped to the active agent's own messages (via +Agent#messages+) — an
+  # agent can never read another agent's mail. A single free-text query is matched, case-insensitively,
   # against both the participants (from/to/cc) and the content (subject/body); results come back newest
   # first. Each result carries the message's *full* body — a truncated body could cut the very text that
   # matched, so it is returned whole. The caller may cap the result count with +limit+ (default
@@ -41,6 +41,8 @@ module Protege
       rather than raising the limit when you get too many hits.
     DESC
 
+    summary 'Search the agent\'s own email archive for past messages.'
+
     input_schema(
       type:                 'object',
       additionalProperties: false,
@@ -58,9 +60,9 @@ module Protege
       }
     )
 
-    # Search the active persona's archive and return the matching messages as concise summaries.
+    # Search the active agent's archive and return the matching messages as concise summaries.
     #
-    # @param context [Protege::Orchestrator::Context] exposes the active +persona+
+    # @param context [Protege::Orchestrator::Context] exposes the active +agent+
     # @param query [String] the free-text query supplied by the model
     # @param limit [Integer, nil] optional result cap (defaults to {DEFAULT_LIMIT}, capped at {MAX_LIMIT})
     # @return [Protege::Result] success carrying +count+ and the shaped +results+, or a failure when
@@ -68,7 +70,7 @@ module Protege
     def use(context:, query:, limit: nil)
       return failure(reason: 'query cannot be empty') if query.to_s.strip.empty?
 
-      hits = matches(persona: context.persona, query:, limit:)
+      hits = matches(agent: context.agent, query:, limit:)
 
       success(count: hits.size, results: hits.map { result_hash(_1) })
     end
@@ -77,21 +79,21 @@ module Protege
 
     # Build and run the scoped, wildcard-escaped LIKE query, newest first.
     #
-    # @param persona [Protege::Persona] the persona whose messages are searched
+    # @param agent [Protege::Agent] the agent whose messages are searched
     # @param query [String] the raw query supplied by the model
     # @param limit [Integer, nil] the requested cap, clamped into 1..{MAX_LIMIT}
     # @return [Array<Protege::Message>] the matching messages, newest first
-    def matches(persona:, query:, limit:)
+    def matches(agent:, query:, limit:)
       count   = (limit || DEFAULT_LIMIT).to_i.clamp(1, MAX_LIMIT)
       escaped = ActiveRecord::Base.sanitize_sql_like(query.strip.downcase)
       clause  = SEARCHABLE_COLUMNS.map { "LOWER(#{_1}) LIKE :term" }.join(' OR ')
 
-      persona.messages
-             .with_attached_attachments
-             .where(clause, term: "%#{escaped}%")
-             .order(sent_at: :desc)
-             .limit(count)
-             .to_a
+      agent.messages
+           .with_attached_attachments
+           .where(clause, term: "%#{escaped}%")
+           .order(sent_at: :desc)
+           .limit(count)
+           .to_a
     end
 
     # Shape a single message into a result summary. The body is returned in full (never truncated) so

data/app/tools/protege/send_email_tool.rb

@@ -5,7 +5,7 @@ module Protege
   # +Protege::Tool+, so the harness publishes it in the LLM's tool catalog (id +:send_email+);
   # when the model emits a +send_email+ call, the harness routes the arguments to +#use+.
   #
-  # +From+ is always enforced to the persona's +email_address+ — the agent cannot impersonate another
+  # +From+ is always enforced to the agent's +email_address+ — the agent cannot impersonate another
   # sender. The +mode+ argument selects behavior:
   #
   # * +"reply"+ — continue the current conversation. +Subject+ and threading (+In-Reply-To+ +
@@ -19,7 +19,7 @@ module Protege
   # Assembly is delegated to +Protege::Gateway.build_outbound+. The agent may attach files by
   # referencing blob ids — the ids shown in the conversation history, or returned by +create_file+ —
   # resolved through +Protege::StoredFile.find+ and checked against the configured
-  # +Gateway::AttachmentPolicy+ limits. (Blob ids currently resolve unscoped; persona scoping is a
+  # +Gateway::AttachmentPolicy+ limits. (Blob ids currently resolve unscoped; agent scoping is a
   # deferred pass — see the blob-currency spec §9.)
   class SendEmailTool < Protege::Tool
     description <<~DESC.strip
@@ -38,6 +38,8 @@ module Protege
       create_file).
     DESC
 
+    summary 'Send an email — the agent\'s only way to reply to or reach someone.'
+
     input_schema(
       type:                 'object',
       additionalProperties: false,
@@ -78,7 +80,7 @@ module Protege
 
     # Build the outbound mail for the requested mode and hand it to the gateway for delivery.
     #
-    # @param context [Protege::Orchestrator::Context] exposes the inbound +message+, +persona+, and +deliver+
+    # @param context [Protege::Orchestrator::Context] exposes the inbound +message+, +agent+, and +deliver+
     # @param mode [String] +"reply"+ or +"new"+
     # @param body [String] plain-text body supplied by the model
     # @param to [Array<String>] recipients (required for +"new"+; additions for +"reply"+)
@@ -109,7 +111,7 @@ module Protege
 
     # Build the outbound mail for the requested mode.
     #
-    # @param context [Protege::Orchestrator::Context] supplies the inbound message and persona
+    # @param context [Protege::Orchestrator::Context] supplies the inbound message and agent
     # @param mode [String] +"reply"+ or +"new"+
     # @param to [Array<String>] recipients
     # @param cc [Array<String>] carbon-copy recipients
@@ -121,17 +123,20 @@ module Protege
     def build_mail(context:, mode:, to:, cc:, bcc:, subject:, body:, attachments:)
       case mode
       when 'reply' then reply_mail(context, to:, cc:, bcc:, body:, attachments:)
-      when 'new'   then new_thread_mail(context.persona, to:, cc:, bcc:, subject:, body:, attachments:)
+      when 'new'   then new_thread_mail(context.agent, to:, cc:, bcc:, subject:, body:, attachments:)
       else              failure(reason: %(unknown mode #{mode.inspect}; use "reply" or "new"))
       end
     end
 
-    # Construct a threaded reply: subject and threading from the inbound message, the original sender
-    # plus any added recipients.
+    # Construct a threaded reply: subject and threading from the inbound message, and a reply-all
+    # recipient set that keeps the whole conversation intact. The original sender and other To recipients
+    # go in To; the original Cc recipients stay in Cc; the model may add more via to/cc/bcc. The agent's
+    # own address is dropped (it is the sender, not a recipient), and every list is de-duplicated by
+    # routing key so no one is Cc'd who is already in To.
     #
-    # @param context [Protege::Orchestrator::Context] supplies the inbound message and persona
-    # @param to [Array<String>] recipients to add beyond the original sender
-    # @param cc [Array<String>] carbon-copy recipients
+    # @param context [Protege::Orchestrator::Context] supplies the inbound message and agent
+    # @param to [Array<String>] recipients to add beyond the carried-forward participants
+    # @param cc [Array<String>] carbon-copy recipients to add
     # @param bcc [Array<String>] blind-carbon-copy recipients
     # @param body [String] the plain-text body
     # @param attachments [Array<Gateway::Mail::Attachment>] the resolved mail attachments
@@ -140,22 +145,27 @@ module Protege
       inbound = context.message
       return failure(reason: 'there is no message to reply to; send a "new" email instead') unless inbound
 
+      own       = context.agent.email_address
+      reply_to  = merge_recipients([inbound.from_address, *inbound.to_addresses, *addresses(to)], excluding: [own])
+      reply_cc  = merge_recipients([*inbound.cc_addresses, *addresses(cc)], excluding: [own, *reply_to])
+
       Protege::Gateway.build_outbound(
-        from:        context.persona.email_address,
-        to:          ([inbound.from_address] + addresses(to)).uniq,
-        cc:          addresses(cc),
+        from:        own,
+        to:          reply_to,
+        cc:          reply_cc,
         bcc:         addresses(bcc),
         subject:     ensure_re_prefix(inbound.subject),
         body:,
         in_reply_to: inbound.message_id,
         references:  build_references(inbound),
-        attachments:
+        attachments:,
+        hops:        inbound.recursion_hops + 1
       )
     end
 
     # Construct a new-thread email: the model supplies the recipients and subject; no threading headers.
     #
-    # @param persona [Protege::Persona] the sending persona (enforced From)
+    # @param agent [Protege::Agent] the sending agent (enforced From)
     # @param to [Array<String>] recipients (at least one required)
     # @param cc [Array<String>] carbon-copy recipients
     # @param bcc [Array<String>] blind-carbon-copy recipients
@@ -163,19 +173,20 @@ module Protege
     # @param body [String] the plain-text body
     # @param attachments [Array<Gateway::Mail::Attachment>] the resolved mail attachments
     # @return [Mail::Message, Protege::Result] the assembled mail, or a failure when +to+/+subject+ is missing
-    def new_thread_mail(persona, to:, cc:, bcc:, subject:, body:, attachments:)
+    def new_thread_mail(agent, to:, cc:, bcc:, subject:, body:, attachments:)
       recipients = addresses(to)
       return failure(reason: 'a new email needs at least one "to" recipient') if recipients.empty?
       return failure(reason: 'a new email needs a subject')                   if subject.to_s.strip.empty?
 
       Protege::Gateway.build_outbound(
-        from:        persona.email_address,
+        from:        agent.email_address,
         to:          recipients,
         cc:          addresses(cc),
         bcc:         addresses(bcc),
         subject:,
         body:,
-        attachments:
+        attachments:,
+        hops:        1
       )
     end
 
@@ -187,6 +198,37 @@ module Protege
       Array(value).map { |address| address.to_s.strip }.reject(&:empty?)
     end
 
+    # Build a reply recipient list from several sources, preserving each address's original form but
+    # collapsing duplicates and dropping any excluded address — compared by routing key (tag-stripped,
+    # lowercased) so casing and plus-tags don't defeat the de-dupe. This is what carries the original
+    # thread's participants onto a reply without doubling anyone up. Unparseable entries are dropped.
+    #
+    # @param candidates [Array<String>] the addresses to include, in priority order
+    # @param excluding [Array<String>] addresses to omit (e.g. the agent itself, or the To list)
+    # @return [Array<String>] the de-duplicated recipients
+    def merge_recipients(candidates, excluding: [])
+      seen = excluding.filter_map { |address| routing_key(address) }
+
+      candidates.each_with_object([]) do |address, kept|
+        key = routing_key(address)
+        next if key.nil? || seen.include?(key)
+
+        seen << key
+        kept << address
+      end
+    end
+
+    # The routing key (tag-stripped, lowercased +local@domain+) for an address, or +nil+ when it can't be
+    # parsed — so de-duping treats an unparseable address as droppable rather than raising.
+    #
+    # @param address [String] the raw address
+    # @return [String, nil] the routing key, or nil
+    def routing_key(address)
+      Protege::Gateway.routing_key(address)
+    rescue ArgumentError
+      nil
+    end
+
     # Resolve blob ids to the stored files they name, limit-checked.
     #
     # @param ids [Array<Integer>] the requested blob ids

data/app/tools/protege/web_fetch_tool.rb

@@ -43,6 +43,8 @@ module Protege
       internal/private network addresses are refused.
     DESC
 
+    summary 'Fetch a web page or text file by URL and return its readable contents.'
+
     input_schema(
       type:                 'object',
       additionalProperties: false,

data/app/tools/protege/web_search_tool.rb

@@ -10,7 +10,7 @@ module Protege
   # It is a keyless, best-effort search: it scrapes DuckDuckGo's HTML endpoint and parses the results
   # page into a list of +{title, url, snippet}+ the agent can reason over and then +web_fetch+. Because
   # it scrapes an unofficial endpoint, it can change or be rate-limited — that trade-off buys a search
-  # that needs no API key and is safe to expose to every persona. Richer or keyed search (Tavily,
+  # that needs no API key and is safe to expose to every agent. Richer or keyed search (Tavily,
   # Perplexity, Brave, …) belongs in a host-app tool, keyed from the host's own config.
   class WebSearchTool < Protege::Tool
     # Result count when the caller does not specify a +limit+.
@@ -35,6 +35,8 @@ module Protege
       limit when results are off.
     DESC
 
+    summary 'Search the web and get back a list of matching pages.'
+
     input_schema(
       type:                 'object',
       additionalProperties: false,

data/app/views/layouts/mailer.text.erb

@@ -0,0 +1 @@
+<%= yield %>

data/app/views/protege/access_rules/create.turbo_stream.slim

@@ -1,6 +1,6 @@
 - if @access_rule.persisted?
-  = turbo_stream.append "access_rules", partial: "protege/personas/access_rule", locals: { access_rule: @access_rule }
+  = turbo_stream.append "access_rules", partial: "protege/agents/access_rule", locals: { access_rule: @access_rule }
   = turbo_stream.remove "access_rules_empty"
-  = turbo_stream.replace "access_rule_form", partial: "protege/personas/access_rule_form", locals: { persona: @persona, access_rule: @persona.access_rules.build }
+  = turbo_stream.replace "access_rule_form", partial: "protege/agents/access_rule_form", locals: { agent: @agent, access_rule: @agent.access_rules.build }
 - else
-  = turbo_stream.replace "access_rule_form", partial: "protege/personas/access_rule_form", locals: { persona: @persona, access_rule: @access_rule }
+  = turbo_stream.replace "access_rule_form", partial: "protege/agents/access_rule_form", locals: { agent: @agent, access_rule: @access_rule }

data/app/views/protege/agent_toolkit_rules/create.turbo_stream.slim

@@ -0,0 +1,6 @@
+- if @agent_toolkit_rule.persisted?
+  = turbo_stream.append "agent_toolkit_rules", partial: "protege/agent_toolkits/gate_rule", locals: { rule: @agent_toolkit_rule }
+  = turbo_stream.remove "agent_toolkit_rules_empty"
+  = turbo_stream.replace "gate_rule_form", partial: "protege/agent_toolkits/gate_rule_form", locals: { agent_toolkit: @agent_toolkit, rule: @agent_toolkit.agent_toolkit_rules.build }
+- else
+  = turbo_stream.replace "gate_rule_form", partial: "protege/agent_toolkits/gate_rule_form", locals: { agent_toolkit: @agent_toolkit, rule: @agent_toolkit_rule }

data/app/views/protege/agent_toolkits/_gate_rule.html.slim

@@ -0,0 +1,7 @@
+tr id=dom_id(rule) style="border-top: 1px solid var(--border)"
+  td class="py-3 pr-4 align-middle"
+    = badge(rule.kind, gate_rule_kind_color(rule))
+  td class="py-3 pr-4 align-middle"
+    code class="font-mono break-all" = rule.pattern
+  td class="py-3 align-middle"
+    = destructive_link("Remove", agent_toolkit_agent_toolkit_rule_path(rule.agent_toolkit, rule), confirm: "Remove this rule?")

data/app/views/protege/agent_toolkits/_gate_rule_form.html.slim

@@ -0,0 +1,8 @@
+#gate_rule_form
+  = form_with model: rule, url: agent_toolkit_agent_toolkit_rules_path(agent_toolkit), scope: :agent_toolkit_rule, class: "space-y-3" do |f|
+    = form_errors(rule)
+    .flex.items-end.gap-3
+      = form_select(f, :kind, Protege::AgentToolkitRule.kinds.keys.map { |k| [k.capitalize, k] }, label: "Kind")
+      .flex-1
+        = form_field(f, :pattern, label: "Pattern", placeholder: "*@company.co")
+      = button("Add rule", type: :submit, class: "h-9")

data/app/views/protege/agent_toolkits/_gate_rules.html.slim

@@ -0,0 +1,19 @@
+/ The grant's allow/deny sender gate — which correspondents may unlock this agent's copy of the
+/ toolkit's tools. Lists existing rules with a remove control and an add form; create/destroy update the
+/ table in place via Turbo Streams, falling back to a redirect for non-Turbo.
+
+= card do
+  .space-y-4
+    = heading_2("Sender gate")
+    = hint("Allow or deny senders from unlocking these tools. With no rules, every sender is permitted.")
+
+    = render "gate_rule_form", agent_toolkit: agent_toolkit, rule: agent_toolkit.agent_toolkit_rules.build
+
+    table class="w-full text-sm"
+      tbody id="agent_toolkit_rules"
+        - if agent_toolkit.agent_toolkit_rules.any?
+          = render partial: "gate_rule", collection: agent_toolkit.agent_toolkit_rules.order(:kind, :pattern), as: :rule
+        - else
+          tr id="agent_toolkit_rules_empty"
+            td colspan="3" class="py-6 text-center text-sm" style="color: var(--text-faint)"
+              | No rules — every sender can unlock these tools.

data/app/views/protege/agent_toolkits/show.html.slim

@@ -0,0 +1,17 @@
+= page_container do
+  = page_header(@agent_toolkit.name, "How #{@agent_toolkit.agent.name} may use this toolkit") do
+    .flex.items-center.gap-2
+      = ui_link("Edit toolkit", edit_toolkit_path(@agent_toolkit.toolkit), class: "px-3")
+      = ui_link("Back to agent", agent_path(@agent_toolkit.agent), class: "px-3")
+
+  .space-y-4
+    = info_card("Tools", toolkit_overview(@agent_toolkit.toolkit))
+
+    = card do
+      = heading_2("Scheduled runs")
+      = hint("Whether these tools may run on this agent's scheduled duties, where there is no sender to check.")
+      = form_with model: @agent_toolkit, url: agent_toolkit_path(@agent_toolkit), method: :patch, scope: :agent_toolkit, class: "mt-3 space-y-3" do |f|
+        = form_checkbox(f, :allow_proactive, label: "Allow on scheduled runs")
+        = button("Save", type: :submit)
+
+    = render("gate_rules", agent_toolkit: @agent_toolkit)

data/app/views/protege/{personas → agents}/_access_rule.html.slim

@@ -4,4 +4,4 @@ tr id=dom_id(access_rule) style="border-top: 1px solid var(--border)"
   td class="py-3 pr-4 align-middle"
     code class="font-mono break-all" = access_rule.pattern
   td class="py-3 align-middle"
-    = destructive_link("Remove", persona_access_rule_path(access_rule.persona, access_rule), confirm: "Remove this rule?")
+    = destructive_link("Remove", agent_access_rule_path(access_rule.agent, access_rule), confirm: "Remove this rule?")

data/app/views/protege/{personas → agents}/_access_rule_form.html.slim

@@ -1,5 +1,5 @@
 #access_rule_form
-  = form_with model: access_rule, url: persona_access_rules_path(persona), scope: :access_rule, class: "space-y-3" do |f|
+  = form_with model: access_rule, url: agent_access_rules_path(agent), scope: :access_rule, class: "space-y-3" do |f|
     = form_errors(access_rule)
     .flex.items-end.gap-3
       = form_select(f, :kind, Protege::AccessRule.kinds.keys.map { |k| [k.capitalize, k] }, label: "Kind")

data/app/views/protege/{personas → agents}/_access_rules.html.slim

@@ -1,18 +1,18 @@
-/ Inbound access rules for a persona — the dashboard-editable, narrowing layer of the access
+/ Inbound access rules for an agent — the dashboard-editable, narrowing layer of the access
 / guardrail. Lists existing rules with a remove control and an add form. Create/destroy update the
-/ table in place via Turbo Streams (the persona page survives), falling back to a redirect for non-Turbo.
+/ table in place via Turbo Streams (the agent page survives), falling back to a redirect for non-Turbo.
 
 = card do
   .space-y-4
     = heading_2("Inbound access rules")
     = hint("Allow or deny senders for this agent. Rules only narrow the global policy — they can never widen it.")
 
-    = render "access_rule_form", persona: persona, access_rule: persona.access_rules.build
+    = render "access_rule_form", agent: agent, access_rule: agent.access_rules.build
 
     table class="w-full text-sm"
       tbody id="access_rules"
-        - if persona.access_rules.any?
-          = render partial: "access_rule", collection: persona.access_rules.order(:kind, :pattern), as: :access_rule
+        - if agent.access_rules.any?
+          = render partial: "access_rule", collection: agent.access_rules.order(:kind, :pattern), as: :access_rule
         - else
           tr id="access_rules_empty"
             td colspan="3" class="py-6 text-center text-sm" style="color: var(--text-faint)"

data/app/views/protege/agents/_actions.html.slim

@@ -0,0 +1,15 @@
+/ The agent show page's action bar — Edit, Archive/Unarchive, and permanent Delete — plus an "Archived"
+/ badge when soft-removed. Wrapped in a dom_id so Archive/Unarchive can replace it in place over Turbo
+/ (see ArchivesController). The Delete button opens the confirm dialog rendered by the show template.
+div id=dom_id(agent, :actions) class="flex items-center gap-3"
+  - if agent.archived?
+    = badge("Archived")
+
+  = ui_link("Edit", edit_agent_path(agent))
+
+  - if agent.archived?
+    = action_button("Unarchive", agent_archive_path(agent), method: :delete)
+  - else
+    = action_button("Archive", agent_archive_path(agent), method: :post, variant: :secondary)
+
+  = button("Delete", type: "button", variant: :danger, onclick: show_dialog("delete-agent"))

data/app/views/protege/agents/_agent_sidebar_item.html.slim

@@ -0,0 +1,5 @@
+= sidebar_item(agent_label(agent), agent_path(agent),
+    detail: agent_status(agent),
+    subtitle: agent.email_address,
+    active: local_assigns[:active],
+    id: dom_id(agent))

data/app/views/protege/agents/_agent_toolkit.html.slim

@@ -0,0 +1,7 @@
+tr id=dom_id(agent_toolkit) style="border-top: 1px solid var(--border)"
+  td class="w-full py-3 pr-6 align-middle font-medium"
+    = agent_toolkit.name
+  td class="py-3 align-middle"
+    .flex.items-center.justify-end.gap-4
+      = ui_link("Configure Access Settings", agent_toolkit_path(agent_toolkit), class: "whitespace-nowrap")
+      = destructive_link("Detach", agent_agent_toolkit_path(agent_toolkit.agent, agent_toolkit), confirm: "Detach this toolkit?", class: "whitespace-nowrap")

data/app/views/protege/agents/_agent_toolkit_form.html.slim

@@ -0,0 +1,7 @@
+#agent_toolkit_form
+  = form_with model: agent_toolkit, url: agent_agent_toolkits_path(agent), scope: :agent_toolkit, class: "space-y-3" do |f|
+    = form_errors(agent_toolkit)
+    .flex.items-end.gap-3
+      .flex-1
+        = form_select(f, :toolkit_id, attachable_toolkits(agent).map { |t| [t.name, t.id] }, label: "Toolkit", prompt: "Choose a toolkit")
+      = button("Attach", type: :submit, class: "h-9")

data/app/views/protege/agents/_form.html.slim

@@ -0,0 +1,25 @@
+- url = agent.new_record? ? agents_path : agent_path(agent)
+- method = agent.new_record? ? :post : :patch
+
+= form_with url:, method:, scope: :agent, class: "space-y-5" do |f|
+  = form_errors(agent)
+
+  = form_field(f, :name, placeholder: "e.g. alice")
+
+  = form_email_address(agent, available_email_domains)
+
+  - unless agent.new_record?
+    = hint("Changing the address only affects new mail — messages to the old address will no longer reach this agent. Existing threads and history are unaffected.")
+
+  - if agent.new_record?
+    = form_select(f, :type, available_agent_types.map { |k| [k.display_name, k.name] }, label: "Type")
+
+  = form_text_area(f, :instructions, \
+                      label: "Instructions", \
+                      rows: 10, \
+                      hint: "The agent's system prompt — who it is and how it behaves. Only sent to the model when a resolver (such as LoadText) includes it in the agent's context.")
+
+  .flex.items-center.gap-3.pt-2
+    = button(agent.new_record? ? "Create agent" : "Save changes", type: :submit)
+
+    = ui_link("Cancel", agent.new_record? ? agents_path : agent_path(agent))

data/app/views/protege/agents/_sidebar.html.slim

@@ -0,0 +1,11 @@
+- pagy, agents = paginate(all_agents)
+
+= sidebar_content do
+  = sidebar_header("Agents (#{pagy.count})", new_path: new_agent_path)
+
+  = sidebar_stream("protege:agents", pagy: pagy)
+
+  = sidebar_body(agents, empty: "No agents yet", id: "agents_list") do |agent|
+    = render "agent_sidebar_item", agent: agent, active: local_assigns[:current] == agent
+
+  = sidebar_pagination(pagy)

data/app/views/protege/agents/_toolkits.html.slim

@@ -0,0 +1,19 @@
+/ Toolkits attached to an agent — the sender-gated tool bundles it exposes. Lists attached toolkits with
+/ a detach control and an attach form. Attach/detach update the table in place via Turbo Streams (the
+/ agent page survives), falling back to a redirect for non-Turbo.
+
+= card do
+  .space-y-4
+    = heading_2("Agent Toolkits")
+    = hint("Attach a toolkit to give this agent its tools, then use Configure Access Settings to set who may use them. Toolkits themselves are managed under Toolkits.")
+
+    = render "agent_toolkit_form", agent: agent, agent_toolkit: agent.agent_toolkits.build
+
+    table class="w-full text-sm"
+      tbody id="agent_toolkits"
+        - if agent.agent_toolkits.any?
+          = render partial: "agent_toolkit", collection: agent.agent_toolkits.includes(:toolkit), as: :agent_toolkit
+        - else
+          tr id="agent_toolkits_empty"
+            td colspan="2" class="py-6 text-center text-sm" style="color: var(--text-faint)"
+              | No toolkits attached — this agent has no tools yet.

data/app/views/protege/agents/agent_toolkits/create.turbo_stream.slim

@@ -0,0 +1,6 @@
+- if @agent_toolkit.persisted?
+  = turbo_stream.append "agent_toolkits", partial: "protege/agents/agent_toolkit", locals: { agent_toolkit: @agent_toolkit }
+  = turbo_stream.remove "agent_toolkits_empty"
+  = turbo_stream.replace "agent_toolkit_form", partial: "protege/agents/agent_toolkit_form", locals: { agent: @agent, agent_toolkit: @agent.agent_toolkits.build }
+- else
+  = turbo_stream.replace "agent_toolkit_form", partial: "protege/agents/agent_toolkit_form", locals: { agent: @agent, agent_toolkit: @agent_toolkit }

data/app/views/protege/agents/edit.html.slim

@@ -0,0 +1,7 @@
+- content_for :sidebar do
+  = render "sidebar", current: @agent
+
+= page_container do
+  = page_header("Edit #{@agent.name}")
+
+  = card { render "form", agent: @agent }

data/app/views/protege/agents/index.html.slim

@@ -0,0 +1,6 @@
+- content_for :sidebar do
+  = render "sidebar"
+
+= page_empty do
+  | Select an agent from the sidebar, or  
+  = ui_link("create a new one.", new_agent_path)

data/app/views/protege/agents/new.html.slim

@@ -0,0 +1,7 @@
+- content_for :sidebar do
+  = render "sidebar"
+
+= page_container do
+  = page_header("New agent", "Specify the email address this agent receives mail at. It must match your MX records.")
+
+  = card { render "form", agent: @agent }