docs(skill): use TOML inference profiles

Signed-off-by: Aaron Gonzales <aagonzales@nvidia.com>

Author: binaryaaron

skills/anonymizer/SKILL.md

@@ -48,7 +48,7 @@ regulatory and business context.
 - **`risk_tolerance` only applies to Rewrite mode**, not Replace.
 - **`PrivacyGoal.protect` and `.preserve` must each be 10–1000 chars and at least 3 words.** Be specific (categories, named identifiers, structural facets); avoid generic phrasing like "preserve meaning".
 - **Validator pool is the only model role with built-in load-spreading.** Set `entity_validator: [a, b, c]` in `models.yaml` if rate limits drop rows. Other roles (rewriter, evaluator, etc.) are single-alias.
-- **Self-hosted GLiNER:** When detection must not call `build.nvidia.com` (PHI on-prem, air-gapped, latency), use `tools/inference_service.py` from a **source checkout** to compile a native-GLiNER intent and launch its managed plan. The tool and native server are not installed by `pip install nemo-anonymizer`. Add a provider with `endpoint: http://localhost:8001/v1`, then route `entity_detector` through a `gliner-pii-detector` alias with `provider: local-gliner` and `skip_health_check: true`. Match the compiled host and port in the provider endpoint. `model_configs` is a **complete** model pool, not an overlay. Copy `src/anonymizer/config/default_model_configs/models.yaml` and change only the detector entry, keeping `gpt-oss-120b` and `nemotron-30b-thinking`. See [`docs/concepts/inference-services.md`](../../docs/concepts/inference-services.md) or the [published inference-services guide](https://nvidia-nemo.github.io/Anonymizer/dev/concepts/inference-services/), plus [`docs/concepts/self-hosting-gliner.md`](../../docs/concepts/self-hosting-gliner.md) or the [published self-hosting guide](https://nvidia-nemo.github.io/Anonymizer/dev/concepts/self-hosting-gliner/).
+- **Self-hosted GLiNER:** When detection must not call `build.nvidia.com` (PHI on-prem, air-gapped, latency), use `tools/inference_service.py` from a **source checkout** to compile the pinned `tools/inference_service_profiles/nvidia-gliner.toml` profile and launch its managed plan. The tool and native server are not installed by `pip install nemo-anonymizer`. Add a provider with `endpoint: http://localhost:8001/v1`, then route `entity_detector` through a `gliner-pii-detector` alias with `provider: local-gliner` and `skip_health_check: true`. Match the compiled host and port in the provider endpoint. `model_configs` is a **complete** model pool, not an overlay. Copy `src/anonymizer/config/default_model_configs/models.yaml` and change only the detector entry, keeping `gpt-oss-120b` and `nemotron-30b-thinking`. See [`docs/concepts/inference-services.md`](../../docs/concepts/inference-services.md) or the [published inference-services guide](https://nvidia-nemo.github.io/Anonymizer/dev/concepts/inference-services/), plus [`docs/concepts/self-hosting-gliner.md`](../../docs/concepts/self-hosting-gliner.md) or the [published self-hosting guide](https://nvidia-nemo.github.io/Anonymizer/dev/concepts/self-hosting-gliner/).
 - **The evaluation judges use their own model roles** (`entity_coverage_judge`, `detection_validity_judge`, `replace_type_fidelity_judge`, `replace_relational_consistency_judge`, `replace_attribute_fidelity_judge`, `rewrite_judge`), configured in the `evaluate` section of `models.yaml`. They are **not** consumed by `preview()` / `run()`, so a config that anonymizes fine can still fail validation at `evaluate()` if those roles are unset. Defaults ship in `src/anonymizer/config/default_model_configs/evaluate.yaml` (`entity_coverage_judge` defaults to `nemotron-super`).
 - **Verdict columns are null when the judge was unavailable** — `None` means "unscored", never a pass. `entity_coverage` is a `0–1` float (`1.0` = no missed candidate values or no PII found) or `None`; `missed_entities` lists unique candidate values the anonymizer failed to detect. Replace verdict columns (`type_fidelity_valid`, etc.) are `True` / `False` / `None`. Rewrite `detection_valid` is a `0–1` float fraction (or `None` if unscored). Inspect verdicts per record with `evaluated.display_record(i)`.
 - **`EvaluateConfig` has one knob today: `compute_detection_validity`** (default `False`). Plain `anonymizer.evaluate(result)` runs entity coverage + the mode's quality judges; pass `EvaluateConfig(compute_detection_validity=True)` only to additionally score detection validity (an internal-facing tag-precision metric).
@@ -73,7 +73,7 @@ read `docs/troubleshooting.md` or the
 - **`anonymizer` not installed:** Tell the user `nemo-anonymizer` is not in this Python environment (requires Python ≥ 3.11). Ask if they want you to install it (`pip install nemo-anonymizer`) or do it themselves. Do not install without permission.
 - **Model/provider setup:** Plain `Anonymizer()` ships with bundled `models.yaml` and `providers.yaml` (see `src/anonymizer/config/default_model_configs/`). For the default path, confirm `NVIDIA_API_KEY` is set. Pass custom `model_configs` or `model_providers` only for non-default endpoints or model pools. See `docs/concepts/models.md` or the [published models guide](https://nvidia-nemo.github.io/Anonymizer/dev/concepts/models/).
 - **LLM calls failing at preview:** Check for a missing or invalid API key, a network problem, or a wrong endpoint URL. See `docs/troubleshooting.md` "Validation passed but `preview` errors at LLM call" or the [published troubleshooting guide](https://nvidia-nemo.github.io/Anonymizer/dev/troubleshooting/).
-- **Local / on-prem GLiNER:** Clone the Anonymizer repository, compile and launch a native-GLiNER intent with `tools/inference_service.py`, add a provider with the plan's endpoint (normally `http://localhost:8001/v1`), and point `gliner-pii-detector` at `provider: local-gliner` with `skip_health_check: true`. Preflight errors about missing aliases usually mean `model_configs` lists only the detector. Include the full default pool. Use the launch receipt to inspect or cancel the managed process. See [`docs/concepts/inference-services.md`](../../docs/concepts/inference-services.md) or the [published inference-services guide](https://nvidia-nemo.github.io/Anonymizer/dev/concepts/inference-services/), plus [`docs/concepts/self-hosting-gliner.md`](../../docs/concepts/self-hosting-gliner.md) or the [published self-hosting guide](https://nvidia-nemo.github.io/Anonymizer/dev/concepts/self-hosting-gliner/).
+- **Local / on-prem GLiNER:** Clone the Anonymizer repository, compile and launch `tools/inference_service_profiles/nvidia-gliner.toml` with `tools/inference_service.py`, add a provider with the plan's endpoint (normally `http://localhost:8001/v1`), and point `gliner-pii-detector` at `provider: local-gliner` with `skip_health_check: true`. Preflight errors about missing aliases usually mean `model_configs` lists only the detector. Include the full default pool. Use the launch receipt to inspect or cancel the managed process. See [`docs/concepts/inference-services.md`](../../docs/concepts/inference-services.md) or the [published inference-services guide](https://nvidia-nemo.github.io/Anonymizer/dev/concepts/inference-services/), plus [`docs/concepts/self-hosting-gliner.md`](../../docs/concepts/self-hosting-gliner.md) or the [published self-hosting guide](https://nvidia-nemo.github.io/Anonymizer/dev/concepts/self-hosting-gliner/).
 
 # Output Template
 

skills/anonymizer/evals/evals.json

@@ -53,7 +53,7 @@
     "expected_skill": "anonymizer",
     "should_trigger": true,
     "expected_script": null,
-    "ground_truth": "The agent loads the anonymizer skill and explains the self-hosted GLiNER path: use tools/inference_service.py from a source checkout to compile a native-GLiNER intent and launch its managed plan, add an OpenAI-compatible provider at the plan endpoint (normally http://localhost:8001/v1), point the gliner-pii-detector/entity_detector alias at provider local-gliner with skip_health_check true, and keep model_configs as a complete model pool copied from defaults rather than a partial overlay.",
+    "ground_truth": "The agent loads the anonymizer skill and explains the self-hosted GLiNER path: use tools/inference_service.py from a source checkout to compile the pinned tools/inference_service_profiles/nvidia-gliner.toml profile and launch its managed plan, add an OpenAI-compatible provider at the plan endpoint (normally http://localhost:8001/v1), point the gliner-pii-detector/entity_detector alias at provider local-gliner with skip_health_check true, and keep model_configs as a complete model pool copied from defaults rather than a partial overlay.",
     "expected_behavior": [
       "The agent read skills/anonymizer/SKILL.md before answering",
       "The answer says the reference GLiNER server comes from a source checkout, not pip-installed package files",