legion-llm 0.15.0 → 0.15.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2620e9731075a26249c5f8bad24610953eac37892f17212d1275a0a66b2497d8
-  data.tar.gz: f13b135f8276958450683397e26defa62098c892ac50f40642593606e878960d
+  metadata.gz: 63f3720eceeff21e7c4d1ca9c13858256b93bd2744d0ae3fc1bd0c7452b40d1a
+  data.tar.gz: 686e8646720ba92310f58ab7e675d380003e89e465a7b02711b916b38ee89953
 SHA512:
-  metadata.gz: b3d6cd8d597e522fca27a92dc62e27ecbb4ca3237136110544a23bf5f94e2159290c24c9365252693674e4f5898d2bdf654f85a80eab9740bb6e72e010747ef2
-  data.tar.gz: 2fa40ab507a7725517d27143e8d78f985e67ebebd2314e0811c673f8b83d2d004ed051b98c5aa1aedbc6da04eed0e34ec152292d80c16cc7ffe2e112a235f2f4
+  metadata.gz: cf42fe3fc6d6128ca111f2d92488496079496357d03ddf5c8fdf45d1372d245fb19f997a941caff59b13a5c8c4ddf52ac1dcc28ad2aace7f5f5accd1fdb6c48d
+  data.tar.gz: be0e5fbd569a12eb65a0952c58ee91a42f06955858a073c52e83ae1e2165fec4f595dd2677b3287ffc1b5cf99fb53ed8f8905849876e93cbb21b100ea4f47d02

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Legion LLM Changelog
 
+## [0.15.2] - 2026-08-04
+
+### Fixed
+- **Runtime tool deadlines now terminate the process tree.** Replaced `Timeout.timeout` around `Open3.capture2e`, which raised a timeout but then blocked while Open3 joined the still-running child. Runtime tools now launch in a dedicated process group, send `TERM` at the deadline, wait the configured grace period, send `KILL` when needed, and reap the process before returning the timeout result.
+- **Codex Responses tool continuations preserve one assistant turn.** Codex orders a turn as function calls, assistant narration, then function-call outputs. The Responses normalizers previously split that into consecutive assistant messages and wedged narration between each call and its result, causing thinking-enabled providers to narrate and stop instead of issuing the next tool call. Assistant text and pending calls now stay on one canonical assistant message with adjacent tool results.
+
+### Changed
+- **Tool policy now has one settings subtree.** Added `Legion::LLM::Settings::Tools.defaults` at `llm.tools`, with runtime timeouts defaulting to 1 second, capped at 10 seconds, and a 1 second termination grace. Consolidated the existing tool loop, dispatch, trigger, sticky, confidence, logging, history, compaction, and Python environment policy under the same subtree, removing inline shadow defaults and operational constants from tool paths.
+
+## [0.15.1] - 2026-08-01
+
+### Fixed
+- **`rag_enabled?` shadow-default made setting un-disableable.** The `rag_setting(key, default)` helper used `Legion::Settings.dig(:llm, :rag, key) || default`, which evaluates `false || true` → `true` for any boolean setting. Setting `llm.rag.enabled = false` was silently ignored. Deleted `rag_setting`, `rag_settings`, `settings_value`, and `trivial_patterns` wrapper methods entirely. All call sites now use direct bracket access (`Legion::Settings[:llm][:rag][:key]`) per legionio-standards.md §3. Defaults live exclusively in `rag_defaults` in `settings.rb`.
+- **Circuit-breaker half-open starvation recovery.** When all providers tripped simultaneously, the half-open probe slot was never offered because the sweep only ran when a request arrived — but requests were already being rejected. Added a background sweep thread (`routing.health.circuit_breaker.sweep_interval_seconds`, default 30) that promotes one tripped provider to half-open regardless of inbound traffic.
+- **Provider connections not closed on shutdown (CLOSE_WAIT accumulation).** `Legion::LLM.shutdown` now iterates all registered provider connections and calls `disconnect`/`close`, preventing socket leak under container orchestration restarts.
+- **Client-side SSE write failures no longer trip the upstream provider's circuit breaker.** A dead client socket (`Puma::ConnectionError: Socket timeout writing data`, `Errno::EPIPE`/`ECONNRESET`, `StreamClosed`) mid- or end-stream was being counted as an upstream provider failure: it reported provider `:error`, tripped the vLLM lane's circuit, and escalated to `EscalationExhausted` — failing over because the *client* went away. Once both `gemma-4-31b` lanes tripped, every 31b request hit `NoLaneAvailable` until process restart, despite the upstream being healthy for weeks. Root cause: `Puma::ConnectionError` is a `RuntimeError`, not an `IOError`, so the `StreamAssembler`'s `rescue IOError, Errno::EPIPE` guards let it escape raw into the executor's escalation loop, whose failure path never consulted the existing `client_stream_error?` helper. The circuit breaker now answers only "is the upstream provider broken?": client-write/disconnect, SSE/canonical-parse/translation, and daemon/programming errors (`NoMethodError`/`ArgumentError`/`NotImplementedError`) never report provider health, trip a circuit, or escalate; a client disconnect converts to a clean cancellation that still emits its ledger event. Genuine provider errors (5xx, connection-refused-to-provider, provider 401) still trip and escalate exactly as before. Fix is provider-agnostic (no provider-name conditionals).
+
 ## [0.15.0] - 2026-07-24
 
 ### Changed

data/lib/legion/llm/api/client_translators/openai_responses.rb

@@ -592,8 +592,27 @@ module Legion
                 flush_pending_tool_calls(messages, pending_tool_calls)
                 messages << { role: 'tool', tool_call_id: item[:call_id], content: item[:output].to_s }
               else
-                flush_pending_tool_calls(messages, pending_tool_calls)
                 role = item[:role]&.to_s
+
+                # SSOT: an assistant `message` item that arrives while tool calls
+                # are still pending is the SAME assistant turn as those calls
+                # (Codex/Responses orders: function_call(s) → assistant message →
+                # function_call_output(s)). Merge the text as the assistant
+                # message's content and flush ONE combined assistant message
+                # (content + tool_calls), so the tool results that follow stay
+                # adjacent to their tool_calls. Emitting a separate assistant text
+                # message here splits one turn into two and wedges narration
+                # between a tool_call and its result — a malformed chat/completions
+                # history that makes thinking-enabled models narrate instead of
+                # calling the next tool (the "dead stop").
+                if role == 'assistant' && !pending_tool_calls.empty?
+                  content = item[:content]
+                  content = content.to_s if content && !content.is_a?(Array)
+                  flush_pending_tool_calls(messages, pending_tool_calls, assistant_content: content)
+                  next
+                end
+
+                flush_pending_tool_calls(messages, pending_tool_calls)
                 next unless role
 
                 role = 'system' if role == 'developer'
@@ -614,8 +633,13 @@ module Legion
           # ToolCall(name: nil) — provider translators then drop the call,
           # leaving an orphan tool_result that Bedrock rejects with
           # "unexpected tool_use_id in tool_result".
-          def flush_pending_tool_calls(messages, pending)
-            return if pending.empty?
+          def flush_pending_tool_calls(messages, pending, assistant_content: nil)
+            if pending.empty?
+              # No pending calls but an assistant text turn wants flushing — emit it
+              # so a trailing/standalone assistant message is never dropped.
+              messages << { role: 'assistant', content: assistant_content } if assistant_content
+              return
+            end
 
             tool_calls = pending.map do |tc|
               args = tc[:arguments]
@@ -630,8 +654,13 @@ module Legion
             last = messages.last
             if last && last[:role] == 'assistant' && !last.key?(:tool_calls)
               last[:tool_calls] = tool_calls
+              # Text arriving AFTER the calls (Codex order) belongs to this same turn.
+              last[:content] = assistant_content if assistant_content && last[:content].to_s.empty?
             else
-              messages << { role: 'assistant', content: '', tool_calls: tool_calls }
+              # assistant_content carries text that arrived AFTER the calls in the
+              # same turn — keep it ON the tool_calls message so the turn stays one
+              # message and the following tool results remain adjacent.
+              messages << { role: 'assistant', content: assistant_content.to_s, tool_calls: tool_calls }
             end
             pending.clear
           end

data/lib/legion/llm/api/namespaces/openai/responses.rb

@@ -214,8 +214,23 @@ module Legion
                   flush_pending(messages, pending)
                   messages << { role: 'tool', tool_call_id: item[:call_id], content: item[:output].to_s }
                 else
-                  flush_pending(messages, pending)
                   role = item[:role]&.to_s
+
+                  # SSOT: an assistant `message` arriving while calls are pending is
+                  # the SAME turn as those calls (Codex order: function_call(s) →
+                  # assistant message → function_call_output(s)). Merge its text onto
+                  # the flushed assistant tool_calls message so the turn stays ONE
+                  # message and the tool results that follow stay adjacent to their
+                  # calls. Splitting it out wedges narration between a tool_call and
+                  # its result — the malformed history behind the dead stop.
+                  if role == 'assistant' && !pending.empty?
+                    content = item[:content]
+                    content = content.to_s if content && !content.is_a?(Array)
+                    flush_pending(messages, pending, assistant_content: content)
+                    next
+                  end
+
+                  flush_pending(messages, pending)
                   next unless role
 
                   role = 'system' if role == 'developer'
@@ -229,12 +244,15 @@ module Legion
               messages
             end
 
-            def self.flush_pending(messages, pending)
-              return if pending.empty?
+            def self.flush_pending(messages, pending, assistant_content: nil)
+              if pending.empty?
+                messages << { role: 'assistant', content: assistant_content } if assistant_content
+                return
+              end
 
               messages << {
                 role:       'assistant',
-                content:    '',
+                content:    assistant_content.to_s,
                 tool_calls: pending.map do |tc|
                   { id: tc[:id], type: 'function', function: { name: tc[:name], arguments: tc[:arguments] } }
                 end

data/lib/legion/llm/api/native/helpers.rb

@@ -67,7 +67,7 @@ module Legion
             case ref
             when 'sh'
               cmd = kwargs[:command] || kwargs[:cmd] || kwargs.values.first.to_s
-              log.warn("[llm][native] client_tool=sh command=#{cmd[0, 120]}")
+              log.warn("[llm][native] client_tool=sh command=#{cmd[0, Legion::Settings[:llm][:tools][:command_log_chars]]}")
               output, status = ::Open3.capture2e(cmd, chdir: Dir.pwd)
               "exit=#{status.exitstatus}\n#{output}"
             when 'file_read'

data/lib/legion/llm/api/native/inference.rb

@@ -80,8 +80,9 @@ module Legion
               end
 
               client_tool_names = tool_declarations.map(&:name)
-              client_tool_summary = client_tool_names.empty? ? 'none' : client_tool_names.first(30).join(',')
-              client_tool_summary = "#{client_tool_summary},+#{client_tool_names.size - 30}more" if client_tool_names.size > 30
+              name_limit = Legion::Settings[:llm][:tools][:name_log_limit]
+              client_tool_summary = client_tool_names.empty? ? 'none' : client_tool_names.first(name_limit).join(',')
+              client_tool_summary = "#{client_tool_summary},+#{client_tool_names.size - name_limit}more" if client_tool_names.size > name_limit
               log.info(
                 "[llm][api][tools] action=client_tools_built request_id=#{request_id} " \
                 "conversation_id=#{conversation_id || 'none'} count=#{tool_declarations.size} names=#{client_tool_summary}"

data/lib/legion/llm/api/stream_assembler.rb

@@ -149,7 +149,9 @@ module Legion
           handle_text_delta(adapted.text) if adapted.text && !adapted.text.empty?
         rescue StreamClosed
           raise
-        rescue IOError, Errno::EPIPE => e
+        rescue StandardError => e
+          raise unless client_write_error?(e)
+
           mark_closed!(e)
           raise StreamClosed, e.message
         end
@@ -182,7 +184,9 @@ module Legion
           guard { @emitter.on_done(stop_reason: stop_reason, usage: usage, model: resolved_model(final_response)) }
           emit_failover_trailers!
           @phase = :finished
-        rescue IOError, Errno::EPIPE => e
+        rescue StandardError => e
+          raise unless client_write_error?(e)
+
           mark_closed!(e)
         end
 
@@ -195,7 +199,9 @@ module Legion
           start! unless @started
           guard { @emitter.on_error(message: error.message, type: type, status_code: status) }
           @phase = :finished
-        rescue IOError, Errno::EPIPE => e
+        rescue StandardError => e
+          raise unless client_write_error?(e)
+
           mark_closed!(e)
         end
 
@@ -253,7 +259,9 @@ module Legion
           @full_thinking_signature = nil
           @phase = :before_first_byte
           @failover_chain << :failover_marker
-        rescue IOError, Errno::EPIPE => e
+        rescue StandardError => e
+          raise unless client_write_error?(e)
+
           mark_closed!(e)
         end
 
@@ -287,7 +295,9 @@ module Legion
           return if @closed
 
           guard { @emitter.on_keep_alive }
-        rescue IOError, Errno::EPIPE => e
+        rescue StandardError => e
+          raise unless client_write_error?(e)
+
           mark_closed!(e)
         end
 
@@ -325,11 +335,29 @@ module Legion
         def guard
           yield
           true
-        rescue IOError, Errno::EPIPE => e
+        rescue StandardError => e
+          raise unless client_write_error?(e)
+
           mark_closed!(e)
           false
         end
 
+        # A failure writing the SSE response back to the HTTP client — the client socket
+        # died (disconnect / VPN bounce / timeout). NOT a provider failure. Puma::ConnectionError
+        # ("Socket timeout writing data") is a RuntimeError, NOT an IOError, so the historical
+        # `rescue IOError, Errno::EPIPE` guards let it escape into the executor, where it was
+        # misattributed to the upstream provider and tripped a healthy lane's circuit. Matched
+        # by class name so the assembler need not require puma. Everything else re-raises.
+        def client_write_error?(error)
+          name = error.class.name.to_s
+          name.include?('Puma::ConnectionError') ||
+            error.is_a?(Errno::EPIPE) ||
+            error.is_a?(Errno::ECONNRESET) ||
+            error.is_a?(Errno::ECONNABORTED) ||
+            error.is_a?(EOFError) ||
+            error.is_a?(IOError)
+        end
+
         def mark_closed!(error)
           return if @closed
 

data/lib/legion/llm/call/registry.rb

@@ -113,6 +113,24 @@ module Legion
           @mutex.synchronize { @registry.dup.freeze }
         end
 
+        def disconnect_all!
+          @mutex.synchronize do
+            count = 0
+            @registry.each_value do |entries|
+              entries.each_value do |entry|
+                adapter = entry[:adapter]
+                next unless adapter.respond_to?(:provider) && adapter.provider.respond_to?(:disconnect)
+
+                adapter.provider.disconnect
+                count += 1
+              rescue StandardError => e
+                log.warn("[llm][registry] disconnect failed: #{e.message}")
+              end
+            end
+            log.info("[llm][registry] disconnect_all count=#{count}")
+          end
+        end
+
         def reset!
           @mutex.synchronize do
             count = @registry.values.sum(&:size)

data/lib/legion/llm/call/structured_output.rb

@@ -125,12 +125,11 @@ module Legion
               .strip
           end
 
+          # -- substring check (each model
           def supports_response_format?(model)
-            # rubocop:disable Style/ArrayIntersect -- substring check (each model
             # fragment `include?`d in the model name), NOT array intersection.
             # `intersect?` raises TypeError on the String arg.
             SCHEMA_CAPABLE_MODELS.any? { |m| model.to_s.include?(m) }
-            # rubocop:enable Style/ArrayIntersect
           end
 
           def retry_enabled?

data/lib/legion/llm/context/curator.rb

@@ -619,13 +619,11 @@ module Legion
           clarification_signals = ['clarif', 'what do you mean', 'i see', 'understood', 'got it', 'correct', 'exactly', 'yes', 'right', 'agree']
           conclusion_signals    = ['in summary', 'to summarize', 'in conclusion', 'therefore', 'so to answer', 'the answer is']
 
-          # rubocop:disable Style/ArrayIntersect -- these are substring checks
+          # -- these are substring checks
           # (signal `include?` against a String), NOT array intersection. The
           # cop's `intersect?` suggestion raises TypeError on a String arg.
           has_clarification = contents.any? { |c| clarification_signals.any? { |s| c.include?(s) } }
           has_conclusion    = contents.last.length < 500 || conclusion_signals.any? { |s| contents.last.include?(s) }
-          # rubocop:enable Style/ArrayIntersect
-
           has_clarification && has_conclusion
         end
 

data/lib/legion/llm/inference/executor/context_window.rb

@@ -76,14 +76,16 @@ module Legion
 
             filtered = messages.reject do |msg|
               role = (msg[:role] || msg['role']).to_s
-              role == 'tool' && (msg[:content] || msg['content']).to_s.length > 500
+              role == 'tool' && (msg[:content] || msg['content']).to_s.length >
+                Legion::Settings[:llm][:tools][:context_compaction][:threshold_chars]
             end
             messages = filtered.map do |msg|
               role = (msg[:role] || msg['role']).to_s
               next msg unless role == 'tool'
 
               content = (msg[:content] || msg['content']).to_s
-              content.length > 200 ? msg.merge(content: "#{content[0, 200]}\n[compacted]") : msg
+              result_chars = Legion::Settings[:llm][:tools][:context_compaction][:result_chars]
+              content.length > result_chars ? msg.merge(content: "#{content[0, result_chars]}\n[compacted]") : msg
             end
 
             return messages if estimate_message_tokens(messages) <= target_tokens
@@ -183,7 +185,7 @@ module Legion
           # Pure oversized-tool-result trim. Shared by trim_oversized_tool_results
           # (which adds logging) and reduce_messages_for_dispatch.
           def trim_oversized_tool_results_pure(messages)
-            max_chars = Legion::Settings[:llm][:tool_result_max_dispatch_chars].to_i
+            max_chars = Legion::Settings[:llm][:tools][:result_max_dispatch_chars]
             return messages unless max_chars.positive?
 
             preserve_after = last_user_message_index(messages)
@@ -205,7 +207,7 @@ module Legion
             trimmed_count = messages.zip(result).count { |before, after| before != after }
             if trimmed_count.positive?
               log.info "[llm][executor] action=trim_tool_results request_id=#{@request.id} trimmed=#{trimmed_count} " \
-                       "max_chars=#{Legion::Settings[:llm][:tool_result_max_dispatch_chars].to_i}"
+                       "max_chars=#{Legion::Settings[:llm][:tools][:result_max_dispatch_chars]}"
             end
             result
           end

data/lib/legion/llm/inference/executor/escalation.rb

@@ -98,6 +98,17 @@ module Legion
               log.error "[llm][escalation] action=request_payload_error provider=#{resolution.provider} " \
                         "instance=#{resolution.instance || 'default'} model=#{resolution.model} " \
                         "error=#{err.message.to_s[0, 500]} daemon_side_payload_bug=true provider_health=false"
+            elsif non_provider_failure?(err)
+              # The circuit breaker answers ONE question: "is the upstream LLM provider
+              # itself broken/down?" Client-side write/disconnect (the client socket died),
+              # SSE/canonical parse/translation (LegionIO's own bugs), and daemon/programming
+              # errors are NOT provider failures. Never report provider health or trip a
+              # circuit for them — doing so misattributes a dead client socket (or our own
+              # bug) to a healthy upstream and trips its lane. This is the dominant field
+              # failure this method previously caused.
+              log.warn "[llm][escalation] action=non_provider_error provider=#{resolution.provider} " \
+                       "instance=#{resolution.instance || 'default'} model=#{resolution.model} " \
+                       "error=#{err.class}: #{err.message.to_s[0, 300]} provider_health=untouched"
             elsif account_specific_error?(err)
               # Account-scoped failure (credit balance, payment, quota). It is
               # deterministic — it will fail every call until the operator tops up —
@@ -222,7 +233,11 @@ module Legion
             emit_error_audit(error, status: status, provider: provider, model: model)
             return if request_payload_error?(error)
             return if context_overflow_error?(error)
-            return if client_stream_error?(error)
+            # Non-provider failures (client-write/disconnect, SSE/parse/translation, daemon
+            # programming errors) never reflect on provider health. The upstream is healthy;
+            # counting these as provider :error trips a live lane's circuit for a dead client
+            # socket or a LegionIO bug — the misattribution behind the field restart-cascade.
+            return if non_provider_failure?(error)
 
             if authentication_error?(error) || config_error?(error)
               Legion::LLM::Router.health_tracker.deny_model( # allowlist:write-side
@@ -400,10 +415,15 @@ module Legion
 
           # Detect client-side stream errors (disconnects, broken pipes, socket timeouts)
           # that originate from writing back to the HTTP client, not from the provider itself.
+          # Puma::ConnectionError is a RuntimeError (NOT an IOError), so it slips past the
+          # StreamAssembler's rescue IOError/EPIPE guards and reaches the executor raw — the
+          # exact class the production logs show tripping the vLLM circuit. StreamClosed is the
+          # assembler's own wrapper raised once the client socket is confirmed dead.
           def client_stream_error?(err)
             name = err.class.name.to_s
             msg  = err.message.to_s
             name.include?('Puma::ConnectionError') ||
+              name.include?('StreamAssembler::StreamClosed') ||
               name.include?('Errno::EPIPE') ||
               (name.include?('IOError') && msg.include?('closed')) ||
               (name.include?('IOError') && msg.include?('already closed')) ||
@@ -416,7 +436,37 @@ module Legion
           # shared daemon code — retrying on a different lane guarantees the same crash. Classified as
           # terminal: raise immediately, never retry, never trip circuits, never push to tried_lanes.
           def internal_error?(err)
-            err.is_a?(::NoMethodError) || err.is_a?(::ArgumentError)
+            err.is_a?(::NoMethodError) || err.is_a?(::ArgumentError) || err.is_a?(::NotImplementedError)
+          end
+
+          # SSE assembly / canonical parse / translation errors originate inside LegionIO's
+          # own stream-assembly and translation layer, not from the upstream provider. Like
+          # daemon/programming errors, they must never trip a provider circuit or escalate to
+          # another lane — the upstream is healthy; the bug is ours. Matched by class name so
+          # this stays provider-agnostic (N×N invariant) and does not couple to lex-llm gems.
+          def sse_translation_error?(err)
+            name = err.class.name.to_s
+            name.include?('JSON::ParseError') ||
+              name.include?('JSON::ParserError')
+          end
+
+          # The circuit breaker answers exactly one question: is the upstream LLM PROVIDER
+          # itself broken/down? These three families are NOT provider failures and must never
+          # trip a circuit, report provider health, or escalate to another lane:
+          #   (1) client-side write/disconnect (client socket died) — client_stream_error?
+          #   (2) SSE assembly / canonical parse / translation (LegionIO's own bugs)
+          #   (3) daemon/programming errors (NoMethodError/ArgumentError) — internal_error?
+          # Provider-agnostic: matches on exception family, never on provider name.
+          def non_provider_failure?(err)
+            client_stream_error?(err) || sse_translation_error?(err) || internal_error?(err)
+          end
+
+          # A client-side write/disconnect is a clean cancellation, not a provider failure.
+          # Distinguished from the broader non_provider_failure? set so the streaming loop can
+          # route it to a clean disconnect exit that STILL emits the ledger/metering event
+          # (invariant #6) while leaving provider health untouched.
+          def client_disconnect_error?(err)
+            client_stream_error?(err)
           end
 
           def larger_context_lane_available?(lane:, payload:, **)
@@ -442,7 +492,13 @@ module Legion
             return :context_overflow  if context_overflow_error?(error)
             return :payload_error     if request_payload_error?(error)
             return :policy_denied     if error.is_a?(Legion::LLM::ModelNotAllowed)
-            return :internal_error    if internal_error?(error) # terminal before account_specific
+            return :internal_error    if internal_error?(error) # daemon bug; terminal before account_specific (G25)
+            # non_provider (client-write/disconnect, SSE/parse/translation) is terminal and
+            # must be classified BEFORE account_specific/transient: a dead client socket or a
+            # LegionIO parse bug must never trip a provider circuit or escalate to another lane
+            # (senseless — the upstream is healthy). Checked after :internal_error so daemon
+            # programming errors keep their pre-existing, more-specific label (both are terminal).
+            return :non_provider      if non_provider_failure?(error)
             return :account_specific  if authentication_error?(error) ||
                                          config_error?(error) ||
                                          account_specific_error?(error)
@@ -460,7 +516,7 @@ module Legion
 
               payload[:tried_lanes] << lane[:id]
 
-            when :internal_error, :payload_error, :policy_denied
+            when :internal_error, :payload_error, :policy_denied, :non_provider
               raise error
             when :account_specific
               # Account/instance-scoped failure: trip the per-instance circuit.
@@ -479,6 +535,7 @@ module Legion
           rescue StandardError => e
             raise if request_payload_error?(e)
             raise if context_overflow_error?(e)
+            raise if non_provider_failure?(e) # client-write/disconnect + SSE/parse: terminal, never accumulate
 
             handle_exception(e, level: :warn, operation: 'llm.pipeline.classify_and_accumulate_exclusions',
                                 lane: lane[:id])

data/lib/legion/llm/inference/executor/tool_injection.rb

@@ -96,7 +96,7 @@ module Legion
               return value if [true, false].include?(value)
             end
 
-            Legion::Settings.dig(:llm, :tool_trigger, :client_tool_passthrough) == true
+            Legion::Settings.dig(:llm, :tools, :trigger, :client_tool_passthrough) == true
           end
 
           def client_tool_passthrough_allowed?(definition)
@@ -111,7 +111,7 @@ module Legion
           end
 
           def client_tool_passthrough_list(key)
-            Array(Legion::Settings.dig(:llm, :tool_trigger, key)).flat_map do |entry|
+            Array(Legion::Settings.dig(:llm, :tools, :trigger, key)).flat_map do |entry|
               client_tool_policy_variants(entry)
             end.uniq
           end

data/lib/legion/llm/inference/executor.rb

@@ -216,7 +216,7 @@ module Legion
         def registry_tool_limit
           return nil unless local_provider?
 
-          raw_limit = Legion::Settings.dig(:llm, :tool_trigger, :local_tool_limit)
+          raw_limit = Legion::Settings.dig(:llm, :tools, :trigger, :local_tool_limit)
           limit = raw_limit.to_i
           limit.positive? ? limit : nil
         end

data/lib/legion/llm/inference/native_tool_loop.rb

@@ -38,8 +38,7 @@ module Legion
 
         def execute_native_tool_loop # rubocop:disable Metrics/AbcSize
           messages = native_dispatch_messages.dup
-          max_rounds = Legion::Settings[:llm][:max_tool_rounds].to_i
-          max_rounds = 200 unless max_rounds.positive?
+          max_rounds = Legion::Settings[:llm][:tools][:max_rounds]
           round = 0
           # Track which (tool_name, args) pairs LegionIO executed,
           # and how many consecutive rounds ended in all Legion-tool failures.
@@ -69,7 +68,7 @@ module Legion
                         "result_text_length=#{result_text.to_s.length} " \
                         "result_text=#{result_text.to_s.inspect} " \
                         "thinking_length=#{result_thinking.to_s.length} " \
-                        "thinking_first_200=#{result_thinking.to_s[0, 200].inspect} " \
+                        "thinking_preview=#{result_thinking.to_s[0, Legion::Settings[:llm][:tools][:thinking_log_chars]].inspect} " \
                         "stop_reason=#{result.respond_to?(:stop_reason) ? result.stop_reason : 'n/a'}"
               log.debug "[llm][executor] action=native_tool_loop.complete rounds=#{round} reason=no_tool_calls"
               @last_tool_loop_messages = messages
@@ -135,7 +134,7 @@ module Legion
                 failed_names = round_results.map { |e| e[:tool_call][:name] }.join(',')
                 log.warn "[llm][native_tool_loop] action=all_legion_executed_tools_failed round=#{round} " \
                          "consecutive_failures=#{consecutive_failures} tools=#{failed_names}"
-                if consecutive_failures >= 2
+                if consecutive_failures >= Legion::Settings[:llm][:tools][:consecutive_failure_limit]
                   log.warn "[llm][native_tool_loop] action=legion_tool_failure_loop_broken consecutive_failures=#{consecutive_failures}"
                   return client_passthrough_tool_loop_result(result, client_calls, round)
                 end
@@ -156,8 +155,7 @@ module Legion
 
         def execute_native_streaming_tool_loop(&block) # rubocop:disable Metrics/AbcSize
           messages = native_dispatch_messages.dup
-          max_rounds = Legion::Settings[:llm][:max_tool_rounds].to_i
-          max_rounds = 200 unless max_rounds.positive?
+          max_rounds = Legion::Settings[:llm][:tools][:max_rounds]
           round = 0
           executed_calls = {}
           consecutive_failures = 0
@@ -187,7 +185,7 @@ module Legion
                         "result_text_length=#{result_text.to_s.length} " \
                         "result_text=#{result_text.to_s.inspect} " \
                         "thinking_length=#{result_thinking.to_s.length} " \
-                        "thinking_first_200=#{result_thinking.to_s[0, 200].inspect} " \
+                        "thinking_preview=#{result_thinking.to_s[0, Legion::Settings[:llm][:tools][:thinking_log_chars]].inspect} " \
                         "stop_reason=#{result.respond_to?(:stop_reason) ? result.stop_reason : 'n/a'}"
               log.debug "[llm][executor] action=native_streaming_tool_loop.complete rounds=#{round} reason=no_tool_calls"
               @last_tool_loop_messages = messages
@@ -244,7 +242,7 @@ module Legion
                 failed_names = round_results.map { |e| e[:tool_call][:name] }.join(',')
                 log.warn "[llm][native_tool_loop] action=all_legion_executed_tools_failed round=#{round} " \
                          "consecutive_failures=#{consecutive_failures} tools=#{failed_names}"
-                if consecutive_failures >= 2
+                if consecutive_failures >= Legion::Settings[:llm][:tools][:consecutive_failure_limit]
                   log.warn "[llm][native_tool_loop] action=legion_tool_failure_loop_broken consecutive_failures=#{consecutive_failures}"
                   return client_passthrough_tool_loop_result(result, client_calls, round)
                 end
@@ -267,7 +265,7 @@ module Legion
         # the provider adapter handles the wire format internally.
 
         def split_tool_calls_by_cap(tool_calls, round)
-          max_per_turn = Legion::Settings[:llm][:max_tool_calls_per_turn].to_i
+          max_per_turn = Legion::Settings[:llm][:tools][:max_calls_per_turn]
           return [tool_calls, []] unless max_per_turn.positive? && tool_calls.size > max_per_turn
 
           log.warn "[llm][native_tool_loop] action=cap_per_turn round=#{round} " \
@@ -326,7 +324,7 @@ module Legion
                         ext.translator.capabilities[:forced_tool_choice]
 
           text = latest_user_text.to_s.downcase
-          return if text.empty? || text.length > 500
+          return if text.empty? || text.length > Legion::Settings[:llm][:tools][:explicit_choice_max_chars]
 
           match = native_dispatch_tools.keys.map(&:to_s).sort_by { |tool_name| -tool_name.length }.find do |tool_name|
             explicit_tool_name_mentioned?(text, tool_name)

data/lib/legion/llm/inference/steps/classification.rb

@@ -110,11 +110,10 @@ module Legion
               patterns << name if text.match?(regex)
             end
 
-            # rubocop:disable Style/ArrayIntersect -- substring check (each keyword
+            # -- substring check (each keyword
             # `include?`d in the text), NOT array intersection. `intersect?` raises
             # TypeError on the String arg.
             phi_found = PHI_KEYWORDS.any? { |kw| text.downcase.include?(kw) }
-            # rubocop:enable Style/ArrayIntersect
             patterns << :phi_keyword if phi_found
             if text.match?(EMAIL_PATTERN) && (standalone_email_pii? || phi_found || patterns.any?)
               patterns.delete(:email)

data/lib/legion/llm/inference/steps/debate.rb

@@ -124,7 +124,7 @@ module Legion
             gaia_trigger = gaia_debate_trigger?(@enrichments)
             return true if gaia_trigger
 
-            settings_value(:debate, :enabled) == true
+            Legion::Settings[:llm][:debate][:enabled] == true
           end
 
           def gaia_debate_trigger?(enrichments)
@@ -193,22 +193,14 @@ module Legion
 
           private
 
-          def debate_settings
-            @debate_settings ||= settings_value(:debate) || {}
-          end
-
-          def debate_setting(key, default = nil)
-            Legion::Settings[:llm][:debate][key] || default
-          end
-
-          def settings_value(*keys, default: nil)
-            Legion::Settings.dig(:llm, *keys) || default
+          def debate_setting(key)
+            Legion::Settings[:llm][:debate][key]
           end
 
           def resolve_debate_rounds(request)
             requested = request.extra.is_a?(Hash) ? request.extra[:debate_rounds] : nil
-            default   = debate_setting(:default_rounds, 1)
-            max       = debate_setting(:max_rounds, 3)
+            default   = debate_setting(:default_rounds)
+            max       = debate_setting(:max_rounds)
 
             rounds = requested ? requested.to_i : default.to_i
             rounds = 1 if rounds < 1
@@ -217,7 +209,7 @@ module Legion
 
           def extract_question(request)
             request.messages.select { |m| m[:role].to_s == 'user' }
-                            .last&.dig(:content) || ''
+                   .last&.dig(:content) || ''
           end
 
           def extract_content(response)
@@ -238,8 +230,8 @@ module Legion
             explicit_challenger = debate_setting(:challenger_model)
             explicit_judge      = debate_setting(:judge_model)
 
-            request_model    = @resolved_model || (request.routing.is_a?(Hash) ? request.routing[:model] : nil) || settings_value(:default_model)
-            request_provider = @resolved_provider || (request.routing.is_a?(Hash) ? request.routing[:provider] : nil) || settings_value(:default_provider)
+            request_model    = @resolved_model || (request.routing.is_a?(Hash) ? request.routing[:model] : nil) || Legion::Settings[:llm][:default_model]
+            request_provider = @resolved_provider || (request.routing.is_a?(Hash) ? request.routing[:provider] : nil) || Legion::Settings[:llm][:default_provider]
 
             advocate_model = explicit_advocate || "#{request_provider}:#{request_model}"