claude-smart 0.2.46 → 0.2.48

package/plugin/vendor/reflexio/reflexio/server/llm/model_defaults.py

@@ -195,12 +195,12 @@ _PROVIDER_DEFAULTS: dict[str, ProviderDefaults] = {
         extraction_agent="gpt-5.5",
     ),
     "anthropic": ProviderDefaults(
-        generation="claude-sonnet-4-6",
-        evaluation="claude-sonnet-4-6",
+        generation="claude-sonnet-5",
+        evaluation="claude-sonnet-5",
         should_run="claude-haiku-4-5-20251001",
         pre_retrieval="claude-haiku-4-5-20251001",
         embedding=None,
-        extraction_agent="claude-sonnet-4-6",
+        extraction_agent="claude-sonnet-5",
     ),
     "gemini": ProviderDefaults(
         generation="gemini/gemini-3-flash-preview",
@@ -229,7 +229,7 @@ _PROVIDER_DEFAULTS: dict[str, ProviderDefaults] = {
         should_run="minimax/MiniMax-M3",
         pre_retrieval="minimax/MiniMax-M3",
         embedding=None,
-        # Same M2.7 model handles resumable extraction. Surfaced by an
+        # Same M3 model handles resumable extraction. Surfaced by an
         # e2e run on a MiniMax-only VPS where publish printed
         # "No provider in ['minimax'] supports role=extraction_agent"
         # warnings and silently skipped profile creation. Without this,

package/plugin/vendor/reflexio/reflexio/server/llm/providers/claude_code_provider.py

@@ -62,14 +62,22 @@ _ENV_TIMEOUT = "CLAUDE_SMART_CLI_TIMEOUT"
 _ENV_MODEL = "CLAUDE_SMART_CLI_MODEL"
 _HOST_CODEX = "codex"
 _HOST_CLAUDE_CODE = "claude-code"
+
+
+def _is_windows() -> bool:
+    return os.name == "nt"
+
+
 _CODEX_COMPAT_SCRIPT_NAMES = (
     ("codex-claude-compat.cmd", "codex-claude-compat")
-    if os.name == "nt"
+    if _is_windows()
     else ("codex-claude-compat", "codex-claude-compat.cmd")
 )
 _CODEX_COMPAT_SCRIPT_NAME_SET = set(_CODEX_COMPAT_SCRIPT_NAMES)
 _DEFAULT_TIMEOUT_SECONDS = 120
-_DEFAULT_CLI_MODEL = "claude-sonnet-4-6"
+_DEFAULT_CLI_MODEL = "claude-sonnet-5"
+_WINDOWS_ARGV_SYSTEM_PROMPT_LIMIT = 3_000
+_WINDOWS_CLI_SUFFIXES = (".cmd", ".exe", ".bat")
 
 _TRUTHY_ENV_VALUES = {"1", "true", "yes"}
 _UNSUPPORTED_PARAMS_WARNED: set[str] = set()
@@ -116,6 +124,40 @@ def _candidate_codex_compat_path() -> Path | None:
     return None
 
 
+def _windows_cli_suffixes() -> tuple[str, ...]:
+    suffixes: list[str] = []
+    for suffix in os.environ.get("PATHEXT", "").split(";"):
+        suffix = suffix.strip().lower()
+        if not suffix:
+            continue
+        suffix = suffix if suffix.startswith(".") else f".{suffix}"
+        # PowerShell scripts require a PowerShell host; do not return them as
+        # directly executable CLI shims for subprocess.run([...]).
+        if suffix == ".ps1":
+            continue
+        suffixes.append(suffix)
+    for suffix in _WINDOWS_CLI_SUFFIXES:
+        if suffix not in suffixes:
+            suffixes.append(suffix)
+    return tuple(suffixes)
+
+
+def _resolve_cli_override_path(cli_path: str) -> str:
+    if not _is_windows():
+        return cli_path
+    path = Path(cli_path)
+    if path.suffix:
+        return cli_path
+
+    # Windows package managers expose extensioned shims while users often
+    # configure the extensionless binary name.
+    for suffix in _windows_cli_suffixes():
+        candidate = path.with_suffix(suffix)
+        if candidate.exists():
+            return str(candidate)
+    return cli_path
+
+
 def _resolve_cli_path() -> str | None:
     """Return the path to the active host CLI, or None if unavailable.
 
@@ -129,7 +171,7 @@ def _resolve_cli_path() -> str | None:
     """
     override = os.environ.get(_ENV_CLI_PATH)
     if override:
-        candidate = Path(override)
+        candidate = Path(_resolve_cli_override_path(override))
         if candidate.is_file() and os.access(candidate, os.X_OK):
             return str(candidate)
         _LOGGER.warning(
@@ -432,6 +474,9 @@ def _run_claude_stream(
 ) -> ParseResult:
     """Invoke ``claude -p --output-format stream-json`` and return a ParseResult."""
     model = os.environ.get(_ENV_MODEL) or _DEFAULT_CLI_MODEL
+    inline_system_prompt = (
+        _is_windows() and len(system_prompt) > _WINDOWS_ARGV_SYSTEM_PROMPT_LIMIT
+    )
     cmd = [
         cli_path,
         "-p",
@@ -442,8 +487,11 @@ def _run_claude_stream(
         "--model",
         model,
     ]
-    if system_prompt:
+    if system_prompt and not inline_system_prompt:
         cmd.extend(["--append-system-prompt", system_prompt])
+    stdin_text = dialogue
+    if inline_system_prompt:
+        stdin_text = f"{system_prompt}\n\n{dialogue}" if dialogue else system_prompt
 
     # Tag the child process so any hooks it fires (e.g. claude-smart's
     # Stop hook) can detect that this is a reflexio-internal invocation
@@ -460,9 +508,11 @@ def _run_claude_stream(
     try:
         proc = subprocess.run(  # noqa: S603 — cmd is constructed from validated parts.
             cmd,
-            input=dialogue,
+            input=stdin_text,
             capture_output=True,
             text=True,
+            encoding="utf-8",
+            errors="replace" if _is_windows() else "strict",
             timeout=timeout_seconds,
             check=False,
             env=env,
@@ -511,6 +561,8 @@ def _run_codex_stream(
             input=_codex_prompt(prompt=dialogue, system_prompt=system_prompt),
             capture_output=True,
             text=True,
+            encoding="utf-8",
+            errors="replace" if _is_windows() else "strict",
             timeout=timeout_seconds,
             check=False,
             env=env,

package/plugin/vendor/reflexio/reflexio/server/llm/rerank/cross_encoder_reranker.py

@@ -150,7 +150,18 @@ def score_pairs(query: str, docs: list[str]) -> list[float]:
         return []
     model = _get_model()
     pairs = [(query, doc) for doc in docs]
-    raw_scores = model.predict(pairs, show_progress_bar=False)
+    try:
+        from torch import nn
+    except ImportError as e:
+        raise CrossEncoderUnavailableError(
+            "torch is not installed; cannot use the cross-encoder reranker"
+        ) from e
+
+    raw_scores = model.predict(
+        pairs,
+        show_progress_bar=False,
+        activation_fn=nn.Identity(),
+    )
     # ``predict`` returns a numpy array; convert to plain Python floats so
     # the caller can serialise the result without numpy as a dependency.
     return [float(s) for s in raw_scores]

package/plugin/vendor/reflexio/reflexio/server/middleware.py

@@ -0,0 +1,244 @@
+"""HTTP middleware for the OSS FastAPI app (Tier3 A2 extraction from api.py).
+
+Holds the five middleware classes ``create_app`` wires in (in that order) plus
+the request-limit / CORS-origin helpers and their tunable constants. No
+middleware reads mutable module-global app state — every read is of an
+import-time constant or an env var — so this extraction is behavior-preserving.
+"""
+
+import asyncio
+import logging
+import os
+
+from anyio.to_thread import current_default_thread_limiter
+from fastapi import Request, status
+from starlette.middleware.base import BaseHTTPMiddleware, RequestResponseEndpoint
+from starlette.responses import Response
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+from reflexio.server.correlation import correlation_id_var, generate_correlation_id
+
+logger = logging.getLogger(__name__)
+
+# Bot protection configuration
+REQUEST_TIMEOUT_SECONDS = 60
+SYNC_REQUEST_TIMEOUT_SECONDS = (
+    600  # Longer timeout for synchronous processing (wait_for_response=true)
+)
+SUSPICIOUS_USER_AGENTS = ["bot", "crawler", "spider", "scraper", "curl", "wget"]
+ALLOWED_EMPTY_UA_PATHS = ["/health", "/"]  # Paths that allow empty user agents
+DEFAULT_MAX_BODY_BYTES = 10 * 1024 * 1024
+
+
+def _resolve_cors_origins() -> list[str]:
+    """Resolve browser origins allowed to make credentialed CORS requests."""
+    configured_origins = os.getenv("REFLEXIO_ALLOWED_ORIGINS", "").strip()
+    if configured_origins:
+        origins = [
+            origin.strip().rstrip("/")
+            for origin in configured_origins.split(",")
+            if origin.strip()
+        ]
+        return origins or ["http://localhost:8080"]
+
+    frontend_url = os.getenv("FRONTEND_URL", "").strip()
+    if frontend_url:
+        return [frontend_url.rstrip("/")]
+
+    return ["http://localhost:8080"]
+
+
+def _max_body_bytes_from_env() -> int:
+    raw_value = os.getenv("REFLEXIO_MAX_BODY_BYTES", str(DEFAULT_MAX_BODY_BYTES))
+    try:
+        max_bytes = int(raw_value)
+    except ValueError:
+        logger.warning(
+            "Ignoring invalid REFLEXIO_MAX_BODY_BYTES=%r; using %s",
+            raw_value,
+            DEFAULT_MAX_BODY_BYTES,
+        )
+        return DEFAULT_MAX_BODY_BYTES
+    if max_bytes <= 0:
+        logger.warning(
+            "Ignoring non-positive REFLEXIO_MAX_BODY_BYTES=%r; using %s",
+            raw_value,
+            DEFAULT_MAX_BODY_BYTES,
+        )
+        return DEFAULT_MAX_BODY_BYTES
+    return max_bytes
+
+
+class BotProtectionMiddleware(BaseHTTPMiddleware):
+    """Middleware to detect and block suspicious bot-like requests."""
+
+    async def dispatch(
+        self, request: Request, call_next: RequestResponseEndpoint
+    ) -> Response:
+        """Process request and block suspicious patterns.
+
+        Args:
+            request (Request): The incoming request
+            call_next (RequestResponseEndpoint): Next middleware/handler in chain
+
+        Returns:
+            Response: The response from the next handler or a 403 JSON response
+        """
+        from starlette.responses import JSONResponse
+
+        user_agent = request.headers.get("user-agent", "").lower()
+        path = request.url.path
+
+        # Allow health check and root without user agent
+        if path not in ALLOWED_EMPTY_UA_PATHS:
+            # Block requests with no user agent
+            if not user_agent:
+                return JSONResponse(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    content={"detail": "Forbidden: Missing user agent"},
+                )
+
+            # Block requests with suspicious user agents
+            for suspicious in SUSPICIOUS_USER_AGENTS:
+                if suspicious in user_agent:
+                    return JSONResponse(
+                        status_code=status.HTTP_403_FORBIDDEN,
+                        content={"detail": "Forbidden: Suspicious user agent"},
+                    )
+
+        return await call_next(request)
+
+
+class TimeoutMiddleware(BaseHTTPMiddleware):
+    """Middleware to enforce request timeout."""
+
+    async def dispatch(
+        self, request: Request, call_next: RequestResponseEndpoint
+    ) -> Response:
+        """Process request with timeout enforcement.
+
+        Args:
+            request (Request): The incoming request
+            call_next (RequestResponseEndpoint): Next middleware/handler in chain
+
+        Returns:
+            Response: The response from the next handler or a 504 JSON response
+        """
+        from starlette.responses import JSONResponse
+
+        # Use longer timeout for synchronous processing requests
+        timeout = REQUEST_TIMEOUT_SECONDS
+        if request.query_params.get("wait_for_response", "").lower() == "true":
+            timeout = SYNC_REQUEST_TIMEOUT_SECONDS
+
+        try:
+            return await asyncio.wait_for(call_next(request), timeout=timeout)
+        except TimeoutError:
+            return JSONResponse(
+                status_code=status.HTTP_504_GATEWAY_TIMEOUT,
+                content={"detail": "Request timeout"},
+            )
+
+
+class _RequestBodyTooLargeError(Exception):
+    """Raised when the streamed request body exceeds the configured limit."""
+
+
+class BodySizeLimitMiddleware:
+    """Reject requests whose declared or streamed body size exceeds the limit."""
+
+    def __init__(self, app: ASGIApp) -> None:
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        from starlette.responses import JSONResponse
+
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+
+        max_body_bytes = _max_body_bytes_from_env()
+        content_length = None
+        for name, value in scope.get("headers", []):
+            if name.lower() == b"content-length":
+                content_length = value.decode("latin-1")
+                break
+
+        if content_length is not None:
+            try:
+                body_bytes = int(content_length)
+            except ValueError:
+                body_bytes = 0
+            if body_bytes > max_body_bytes:
+                await JSONResponse(
+                    status_code=status.HTTP_413_CONTENT_TOO_LARGE,
+                    content={"detail": "Request body too large"},
+                )(scope, receive, send)
+                return
+
+        consumed_bytes = 0
+
+        async def limited_receive() -> Message:
+            nonlocal consumed_bytes
+            message = await receive()
+            if message["type"] == "http.request":
+                consumed_bytes += len(message.get("body", b""))
+                if consumed_bytes > max_body_bytes:
+                    raise _RequestBodyTooLargeError
+            return message
+
+        try:
+            await self.app(scope, limited_receive, send)
+        except _RequestBodyTooLargeError:
+            await JSONResponse(
+                status_code=status.HTTP_413_CONTENT_TOO_LARGE,
+                content={"detail": "Request body too large"},
+            )(scope, receive, send)
+
+
+class SecurityHeadersMiddleware(BaseHTTPMiddleware):
+    """Attach conservative browser security headers to every response."""
+
+    async def dispatch(
+        self, request: Request, call_next: RequestResponseEndpoint
+    ) -> Response:
+        response = await call_next(request)
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+        if (
+            request.url.scheme == "https"
+            or request.headers.get("x-forwarded-proto", "").lower() == "https"
+        ):
+            response.headers["Strict-Transport-Security"] = (
+                "max-age=31536000; includeSubDomains"
+            )
+        return response
+
+
+class CorrelationIdMiddleware(BaseHTTPMiddleware):
+    """Middleware that assigns a unique correlation ID to each request.
+
+    The ID is stored in a ContextVar so it propagates to log records
+    (via CorrelationIdFilter) and to ThreadPoolExecutor workers when
+    ``contextvars.copy_context()`` is used.
+    """
+
+    async def dispatch(
+        self, request: Request, call_next: RequestResponseEndpoint
+    ) -> Response:
+        cid = generate_correlation_id()
+        correlation_id_var.set(cid)
+        try:
+            stats = current_default_thread_limiter().statistics()
+            request.state.tp_borrowed = stats.borrowed_tokens
+            request.state.tp_total = stats.total_tokens
+            request.state.tp_waiting = stats.tasks_waiting
+        except Exception as exc:  # noqa: BLE001
+            logger.debug("Failed to snapshot threadpool limiter stats: %s", exc)
+            request.state.tp_borrowed = None
+            request.state.tp_total = None
+            request.state.tp_waiting = None
+        response = await call_next(request)
+        response.headers["X-Correlation-ID"] = cid
+        return response

package/plugin/vendor/reflexio/reflexio/server/operation_limiter.py

@@ -62,6 +62,11 @@ def _limit_for(operation: OperationName) -> int:
     return _DEFAULT_LIMITS[operation]
 
 
+def operation_limit_value(operation: OperationName) -> int:
+    """Return the configured concurrency limit for an operation."""
+    return _limit_for(operation)
+
+
 def _timeout_for(operation: OperationName) -> float:
     raw = os.getenv(_env_key(operation, "TIMEOUT_SECONDS"), "").strip()
     if raw:
@@ -403,6 +408,7 @@ def operation_limit(
     *,
     timeout_seconds: float | None = None,
     wait_forever: bool = False,
+    log_timeout: bool = True,
 ) -> Any:
     """Acquire the per-org limiter for an operation, recording wait metrics."""
     state = _state_for(org_id, operation)
@@ -448,7 +454,7 @@ def operation_limit(
                 limit=state.limit,
                 active=active,
             )
-            if operation == "publish":
+            if operation == "publish" and log_timeout:
                 logger.warning(
                     "publish_limiter_timeout org_id=%s limit=%s active=%s "
                     "waiting=%s wait_ms=%s timeout_seconds=%s hardware=%s",
@@ -504,12 +510,14 @@ def run_with_operation_limit[T](
     fn: Callable[[], T],
     timeout_seconds: float | None = None,
     wait_forever: bool = False,
+    log_timeout: bool = True,
 ) -> T:
     with operation_limit(
         org_id,
         operation,
         timeout_seconds=timeout_seconds,
         wait_forever=wait_forever,
+        log_timeout=log_timeout,
     ):
         return fn()
 

package/plugin/vendor/reflexio/reflexio/server/prompt/prompt_bank/playbook_extraction_context/v4.4.0.prompt.md

@@ -1,7 +1,7 @@
 ---
 active: true
 description: "Context setting prompt for resumable playbook extraction. Every claim must be grounded in the conversation and generalized to a reusable task context; both requirements apply jointly to Correction SOPs and Success Path Recipes."
-changelog: "v4.4.0: deliver the result as a native structured response — output the {{\"playbooks\": [...]}} JSON directly as the final assistant message instead of a finish_extraction tool call; ask_human/attach_pending_info_request remain real intermediate tools, and a plain (no-tool) final turn carrying the JSON is now the valid completion. No output schema change. v4.3.0: expands Correction SOP signals to include avoidable follow-ups, partial delivery, stalled conditional authorization, unverified claims, and incomplete coverage; requires Correction SOPs whenever correction signals are present; adds antecedent-not-reaction trigger guidance. (in-place 2026-06-18: make triggers future-user-query-like retrieval keys.) (in-place 2026-06-15: adds concise retrieve-general/action-specific guidance.) v4.2.3: strengthens strict tool-call discipline so plain-text/no-tool responses are explicitly invalid, including empty extraction outcomes. v4.2.2: replaces output examples with compact tool-call and JSON-shape guidance, while preserving the resumable extraction contract. v4.2.1: negative/avoid guidance cannot contradict the final verified implementation or final evaluation. v4.2.0: adds emergent skill-convention guidance for structuring multi-aspect playbook content as a small set of grouped do/avoid rules (no schema change). v4.1.7: adds resumable extraction guidance, names legacy fallback and malformed-input branches in boundary-change recipes, and avoids a polarity output field. (in-place 2026-05-30: tool-oriented finish_extraction output framing; deprecated and removed blocking_issue.) (in-place 2026-05-30: clarify in the Output Format section that finish_extraction may be preceded by ask_human/attach_pending_info_request; restructure examples into one no-tool example plus a worked ask_human and attach_pending_info_request example; stress that ask_human is rare and reserved for critical missing org-level facts — finish_extraction alone is the norm.) (in-place 2026-05-30: condense the resumable guidance — state finish-required/optional once, replace the duplicated Output Format block with a one-line pointer, and trim example prose.) (in-place 2026-06-03: consolidate and shorten the ask_human condition: ask only for missing shared context needed to know what to do, while still finishing extraction.) (in-place 2026-06-03: frame finish_extraction as the final completion tool and pending-info tools as intermediate.) (in-place 2026-06-03: clarify that empty finish_extraction alone must not replace ask_human when the ask_human condition applies.) (in-place 2026-06-04: clarify ask_human and attach_pending_info_request are alternatives for the same gap, not a sequence.)"
+changelog: "v4.4.0: deliver the result as a native structured response — output the {{\"playbooks\": [...]}} JSON directly as the final assistant message instead of a finish_extraction tool call; ask_human/attach_pending_info_request remain real intermediate tools, and a plain (no-tool) final turn carrying the JSON is now the valid completion. No output schema change. (in-place 2026-06-28: strengthen the ask_human decision boundary for cases where a correction proves a durable shared procedure exists but only avoidance is grounded.) v4.3.0: expands Correction SOP signals to include avoidable follow-ups, partial delivery, stalled conditional authorization, unverified claims, and incomplete coverage; requires Correction SOPs whenever correction signals are present; adds antecedent-not-reaction trigger guidance. (in-place 2026-06-18: make triggers future-user-query-like retrieval keys.) (in-place 2026-06-15: adds concise retrieve-general/action-specific guidance.) v4.2.3: strengthens strict tool-call discipline so plain-text/no-tool responses are explicitly invalid, including empty extraction outcomes. v4.2.2: replaces output examples with compact tool-call and JSON-shape guidance, while preserving the resumable extraction contract. v4.2.1: negative/avoid guidance cannot contradict the final verified implementation or final evaluation. v4.2.0: adds emergent skill-convention guidance for structuring multi-aspect playbook content as a small set of grouped do/avoid rules (no schema change). v4.1.7: adds resumable extraction guidance, names legacy fallback and malformed-input branches in boundary-change recipes, and avoids a polarity output field. (in-place 2026-05-30: tool-oriented finish_extraction output framing; deprecated and removed blocking_issue.) (in-place 2026-05-30: clarify in the Output Format section that finish_extraction may be preceded by ask_human/attach_pending_info_request; restructure examples into one no-tool example plus a worked ask_human and attach_pending_info_request example; stress that ask_human is rare and reserved for critical missing org-level facts — finish_extraction alone is the norm.) (in-place 2026-05-30: condense the resumable guidance — state finish-required/optional once, replace the duplicated Output Format block with a one-line pointer, and trim example prose.) (in-place 2026-06-03: consolidate and shorten the ask_human condition: ask only for missing shared context needed to know what to do, while still finishing extraction.) (in-place 2026-06-03: frame finish_extraction as the final completion tool and pending-info tools as intermediate.) (in-place 2026-06-03: clarify that empty finish_extraction alone must not replace ask_human when the ask_human condition applies.) (in-place 2026-06-04: clarify ask_human and attach_pending_info_request are alternatives for the same gap, not a sequence.)"
 variables:
   - agent_context_prompt
   - extraction_definition_prompt
@@ -26,6 +26,16 @@ Choose exactly one intermediate path per missing fact: use `attach_pending_info_
 
 Do not ask for user-scoped/private facts, context derivable from the trajectory, agent context, tool list, or Prior Knowledge, complete avoidance-only rules, or merely nice-to-have details.
 
+### Ask-human decision boundary
+
+Before finalizing any Correction SOP from a negative correction, run this check:
+
+1. Did the correction merely establish a complete avoidance rule, with no evidence that a shared positive procedure exists? If yes, emit the grounded avoidance rule and do not ask.
+2. Did the correction state or strongly imply that a shared policy, process, approval path, escalation route, canonical target, standard wording, or other durable positive procedure exists, while leaving the actual target/procedure unknown? If yes, the future playbook is incomplete: call `ask_human` (or `attach_pending_info_request` if Prior Knowledge already has the same pending question).
+3. Did the missing detail concern a single user, customer, client, assignment, record, or current factual lookup rather than a reusable agent/org rule? If yes, do not ask; emit only grounded guidance or no playbook.
+
+Phrases like "specific process", "required workflow", "approval path", "special route", "canonical path/target", "standard policy", "standard wording/script", or "do not know the exact name/text" are strong evidence of a shared positive procedure gap when the conversation does not provide the missing procedure. Avoidance-only playbooks are acceptable interim guidance, but they are not a substitute for `ask_human` when the conversation proves that future agents need a missing shared positive action to handle the class of task correctly. The question should ask for the smallest durable missing fact, such as the approved route, required procedure, canonical target, policy threshold, or standard wording.
+
 If an intermediate tool is needed, call exactly one of the two intermediate tools before delivering your final result. Then finalize the current run with any independently valid playbooks now, including avoidance rules; if none are valid without the answer, finalize with `{{"playbooks": []}}`.
 
 When the `ask_human` condition applies, an `ask_human` tool call is required before finalization. Do not replace the question with an empty `{{"playbooks": []}}` final response alone.
@@ -161,6 +171,8 @@ Grounding constrains the *source* of a claim (it must come from the conversation
 
 **When the agent doesn't know what to do:** Describe what to AVOID (the observed mistake) and state the limitation honestly. It is much better to say "do not fabricate order status — admit you cannot look it up" than to invent a specific alternative the agent may not actually have. If the missing "what to do" detail satisfies the `ask_human` condition above, use the tool; otherwise emit only the grounded avoidance rule or no playbook.
 
+If a user correction says there is a specific process, approval path, route, standard, or policy but does not provide it, the extractor does not know enough to produce the durable positive SOP. Do not silently downgrade that case to avoidance-only unless avoidance is the complete reusable lesson; ask for the missing shared procedure and still finalize any grounded interim playbooks.
+
 **Rule of thumb (both checks must pass):**
 1. *Grounded* — if you remove the conversation and only read the `content`, could someone verify every claim by re-reading the conversation? If not, you've hallucinated.
 2. *Generalized* — could a future agent in a similar task context, with no access to this conversation, apply the entry as written? If not, you've overfit — restate the pattern at the level of situation, artifact role, action sequence, verification, and detour.
@@ -175,7 +187,7 @@ For **Correction SOPs**:
 3. Identify the violated implicit expectation
 4. Draft the `trigger` (the problem or situation)
 5. Tautology Check (see above)
-6. Draft `content`: reason through what the agent did wrong and what the user's feedback tells us the agent should do differently. Ground every statement in evidence from the conversation. If the user told the agent what to do, capture that. If the user only told the agent what NOT to do, capture the avoidance. Do not guess what the right action is if the conversation doesn't tell you; use `ask_human` only when the condition above applies.
+6. Draft `content`: reason through what the agent did wrong and what the user's feedback tells us the agent should do differently. Ground every statement in evidence from the conversation. If the user told the agent what to do, capture that. If the user only told the agent what NOT to do, capture the avoidance. If the user indicated that a shared process/policy/route/approval/standard/canonical target exists but did not provide it, call `ask_human` or attach to matching Prior Knowledge before finalizing; the avoidance rule alone does not answer what a future agent should do. Do not guess what the right action is if the conversation doesn't tell you; use `ask_human` only when the condition above applies.
 
 For **Success Path Recipes**:
 1. Identify whether the agent completed the task successfully

package/plugin/vendor/reflexio/reflexio/server/rate_limit.py

@@ -0,0 +1,79 @@
+"""Shared slowapi rate limiter for the OSS FastAPI app (Tier3 A2).
+
+The ``limiter`` singleton and ``configure_rate_limiter`` live here so the domain
+route modules can decorate handlers with ``@limiter.limit(...)`` without importing
+from ``reflexio.server.api`` (which would be circular — ``api`` aggregates the
+route modules). ``reflexio.server.api`` re-exports ``limiter`` and
+``configure_rate_limiter`` so the existing enterprise imports keep resolving.
+"""
+
+from collections.abc import Callable
+from typing import Any
+
+from fastapi import Request
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+
+from reflexio.server.tracing import profile_step
+
+
+def get_rate_limit_key(request: Request) -> str:
+    """Get rate limit key based on IP address.
+
+    Args:
+        request (Request): The incoming request
+
+    Returns:
+        str: Rate limit key (IP address)
+    """
+    return get_remote_address(request)
+
+
+def _storage_backend_name(limiter_obj: Limiter) -> str:
+    storage = getattr(limiter_obj, "_storage", None)
+    if storage is None:
+        return "unknown"
+    return storage.__class__.__name__
+
+
+def _trace_external_rate_limit_backend(limiter_obj: Limiter) -> None:
+    """Trace rate-limit storage hits when the backend is an external service."""
+    backend = _storage_backend_name(limiter_obj)
+    if backend == "MemoryStorage":
+        return
+
+    strategy = getattr(limiter_obj, "limiter", None)
+    if strategy is None or getattr(strategy, "_reflexio_traced", False):
+        return
+
+    original_hit = strategy.hit
+
+    def traced_hit(item: Any, *identifiers: str, cost: int = 1) -> bool:
+        with profile_step(
+            "rate_limit.backend_hit",
+            storage_backend=backend,
+            strategy=strategy.__class__.__name__,
+            cost=cost,
+        ):
+            return original_hit(item, *identifiers, cost=cost)
+
+    strategy.hit = traced_hit
+    strategy._reflexio_traced = True
+
+
+# Initialize rate limiter
+limiter = Limiter(key_func=get_rate_limit_key)
+_trace_external_rate_limit_backend(limiter)
+
+
+def configure_rate_limiter(key_func: Callable[..., str]) -> None:
+    """
+    Replace the rate limiter's key function.
+
+    This is the supported way to override the default IP-based key function
+    (e.g. with an org-scoped or token-scoped variant in the enterprise layer).
+
+    Args:
+        key_func: A callable that accepts a Request and returns a string key.
+    """
+    limiter._key_func = key_func  # type: ignore[reportAttributeAccessIssue]

package/plugin/vendor/reflexio/reflexio/server/routes/__init__.py

@@ -0,0 +1,6 @@
+"""Domain route modules for the OSS FastAPI app (Tier3 A2 split of api.py).
+
+Each module owns its own ``APIRouter`` and is aggregated into
+``reflexio.server.api.core_router`` so the single ``core_router`` remains the
+data-plane router surface the enterprise composition mounts and iterates.
+"""

package/plugin/vendor/reflexio/reflexio/server/routes/_common.py

@@ -0,0 +1,25 @@
+"""Shared route helpers used across domain route modules (Tier3 A2)."""
+
+from collections.abc import Callable
+
+from reflexio.server.operation_limiter import (
+    OperationName,
+    limiter_http_exception,
+    run_with_operation_limit,
+)
+
+
+def _run_limited_api[T](
+    org_id: str,
+    operation: OperationName,
+    fn: Callable[[], T],
+) -> T:
+    try:
+        return run_with_operation_limit(
+            org_id=org_id,
+            operation=operation,
+            fn=fn,
+        )
+    except TimeoutError as exc:
+        http_exc = limiter_http_exception(operation)
+        raise http_exc from exc