RubyGems - legionio - Versions diffs - 1.9.43 → 1.9.50 - Mend

legionio 1.9.43 → 1.9.50

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (18) hide show

checksums.yaml +4 -4
data/CHANGELOG.md +30 -0
data/README.md +126 -569
data/legionio.gemspec +5 -2
data/lib/legion/api/auth_teams.rb +7 -4
data/lib/legion/api/extensions.rb +2 -2
data/lib/legion/api/health.rb +73 -0
data/lib/legion/api/middleware/auth.rb +4 -1
data/lib/legion/api/openapi.rb +8 -4
data/lib/legion/api.rb +6 -1
data/lib/legion/cli/chat/daemon_chat.rb +1 -1
data/lib/legion/cli/chat/tools/model_comparison.rb +1 -1
data/lib/legion/cli/chat_command.rb +1 -1
data/lib/legion/cli/connect_command.rb +34 -9
data/lib/legion/extensions/builders/routes.rb +1 -1
data/lib/legion/service.rb +29 -0
data/lib/legion/version.rb +1 -1
metadata +9 -4

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0c2e14e59941d157f3934d2defda8273c0d33e4d2ccc7c1cda305cdfd0c4a56d
-  data.tar.gz: f238dcc116658b5c35d4990531472f700b0504170af2ac80dff194cd388c0c9b
+  metadata.gz: 836093ff32350c705da43ab5a36cf9b0e5e135e24556bf5b2c10c50df421ee11
+  data.tar.gz: ac682d87908c360cc90409e9fa773a5a8937245104394dbcd940fea67ca10141
 SHA512:
-  metadata.gz: 3c10304ab55f3ffd752971ea184fb7917ab499adda804dcae7f92e9bcffd0c8b7860a36a79ba1110d27e02b72783660e1b4f77fb929b98d08b93ceff5cc20894
-  data.tar.gz: dc5f13d4b000a5d3949b65885af43fba4a041a7df9de37fc13ae9fb5e282b07a5e0cac7583ef4c77f44f7c1734308e20949704c2d7e4fa6e3df21ac3666edf67
+  metadata.gz: f350c4a919b2746bd5fcc72dfa22e03b4e30217a5d934a6fb50411903708473d394e8652b7bb09b27672ee1c93ed222c586a241d93f5aa40eaddae690521a312
+  data.tar.gz: e80c66310e5e90fc93c19cc3c672e4075dac237b27105a0ea3cc5c8cad5d295841bfeb0a893edaf34a1615b44b7fe843c6c060bdc69ef03086ccc200ced7e609

data/CHANGELOG.md CHANGED Viewed

@@ -1,5 +1,35 @@
 # Legion Changelog
+## [1.9.50] - 2026-07-15
+### Fixed
+- Backfill extension routes with API router after boot to fix /api/extensions/* 404s
+- Fix CLI daemon_client require path after legion-llm restructure
+## [1.9.48] - 2026-07-02
+### Security
+- API: fixed an authentication bypass in the auth middleware's `skip_path?` (CWE-284). It used bare prefix matching (`start_with?`), so any path sharing a prefix with an unauthenticated route bypassed auth — e.g. `/api/healthily_fake`, `/api/health/admin/export`, `/api/auth/tokens_dump` all matched `/api/health` / `/api/auth/token`. Now uses segment-bounded matching (exact path or `/`-delimited sub-path) via precompiled `SKIP_PATTERNS`, so only the intended paths and their legitimate sub-paths skip auth (fixes #209)
+## [1.9.47] - 2026-07-02
+### Fixed
+- API: `GET /api/health` now reflects subsystem health instead of always returning `200 ok`. It reports `degraded` with HTTP `503` when an **enabled and previously-healthy** subsystem (transport, cache, data) has broken — e.g. transport `session_open: false` after a connection recovery failure — and includes a per-component `components` breakdown (`enabled`/`healthy`/`detail`). A subsystem only degrades health if it was marked ready at boot (via `Legion::Readiness`); disabled or still-booting subsystems never fail the check. This makes the endpoint usable for load balancers and monitoring (fixes #194)
+## [1.9.46] - 2026-07-02
+### Fixed
+- API: `GET /api/extensions/tools` no longer 500s with `undefined method 'filter_tool_entries'`. The route block runs in the Sinatra instance context but `filter_tool_entries`/`serialize_tool_entry` are class methods on `Routes::Extensions`; they are now called on the explicit receiver, matching the pattern used by the other catalog routes. Added request specs for `/api/extensions/tools` (fixes #227)
+## [1.9.45] - 2026-07-02
+### Fixed
+- API: Teams delegated OAuth callback now forwards `tenant_id`/`client_id` to `Entra::Helpers::TokenManager.save_token(:delegated, …)` so browser-login tokens can be refreshed (previously omitted, forcing refresh to fall back to settings and silently fail for delegated-only logins). The unshipped `TokenCache` `require` that 500'd the callback was already removed in 1.9.43 (fixes #212)
+## [1.9.44] - 2026-07-01
+### Fixed
+- CLI: `connect status` now reads the Entra `TokenManager` (`token_data(:delegated)` + `expired?`) for the `microsoft` provider instead of the legacy `Legion::Auth::TokenManager` secret store, which the delegated/Teams login never writes to — previously always reported `microsoft: not connected` after a successful login (fixes #213)
+- CLI: `connect microsoft` now forwards `--tenant_id`/`--client_id`/`--scope` (as `--scopes`) explicitly to the Teams auth flow instead of dropping flag values via `ARGV.select`
 ## [1.9.43] - 2026-06-25
 ### Fixed

data/README.md CHANGED Viewed

@@ -1,621 +1,178 @@
 <h1 align="center">LegionIO</h1>
 <p align="center">
-  <b>One Ruby gem that is a distributed async job engine, an AI coding assistant, an MCP server,
-  and a cognitive-computing platform — and runs with zero required infrastructure.</b>
+  <b>A modular Ruby framework for async jobs and AI infrastructure.</b><br>
+  Start with a task engine that runs on zero infrastructure. Add LLM routing with
+  measured context curation, an MCP server, RBAC, a knowledge store, or an experimental
+  cognitive layer. Each is an independent gem. All of it is open source. Nothing is gated.
 </p>
 <p align="center">
   <a href="https://rubygems.org/gems/legionio"><img alt="Gem Version" src="https://img.shields.io/gem/v/legionio.svg"></a>
   <img alt="Ruby" src="https://img.shields.io/badge/ruby-%3E%3D%203.4-CC342D.svg">
   <img alt="License" src="https://img.shields.io/badge/license-Apache--2.0-blue.svg">
-  <img alt="HA" src="https://img.shields.io/badge/HA-no%20paid%20tiers%20·%20no%20feature%20gates-success.svg">
 </p>
-```
-         ╭──────────────────────────────────────╮
-         │           L E G I O N I O            │
-         │                                      │
-         │   async jobs  ·  AI chat  ·  MCP     │
-         │   REST API  ·  HA  ·  cognitive AI   │
-         │   zero-infra lite mode  ·  Vault     │
-         ╰──────────────────────────────────────╯
-```
-> Schedule tasks, chain services into dependency graphs, run them concurrently across a RabbitMQ
-> fleet, and orchestrate AI-powered workflows — from a single `legion` command. Then run the whole
-> thing with **no RabbitMQ, no Redis, nothing** via lite mode.
-## Why LegionIO
-- 🧩 **Four products in one gem.** A RabbitMQ-backed async **job engine**, an **AI coding assistant** (chat, commit, review, PR, multi-agent), an **MCP server** that exposes your infrastructure to any agent, and a brain-modeled **cognitive platform** — all in one `gem install`.
-- 🪶 **Zero-infrastructure lite mode.** `LEGION_MODE=lite` swaps RabbitMQ for in-process pub/sub and Redis/Memcached for an in-memory cache. Every feature still works — `gem install` to a running daemon in seconds, no services to stand up.
-- 🔗 **Dependency-graph orchestration.** Chain tasks with JSON conditions and ERB transformations, fan out in parallel, and scale by simply launching more processes — RabbitMQ distributes the work automatically (tested to 100+ workers).
-- 🤖 **AI workflows built in.** `legion chat`, `commit`, `review`, `pr`, multi-agent `swarm`, persistent cross-session memory, and a shared knowledge store — powered by [legion-llm](https://github.com/LegionIO/legion-llm)'s any-client → any-provider routing.
-- 🧠 **Cognitive architecture.** 240+ brain-modeled extensions across 18 domains (emotion, reasoning, social, metacognition…), coordinated by a tick-cycle scheduler ([legion-gaia](https://github.com/LegionIO/legion-gaia)).
-- 🔌 **MCP-native.** Exposes itself as an MCP server (stdio or streamable HTTP), so Claude Desktop or any agent SDK can run tasks, manage extensions, and query your infrastructure directly.
-- 🛡️ **Operational from day one.** Vault secrets, AES-256 message encryption, RBAC, JWT / API-key auth, sliding-window rate limiting, Prometheus metrics, an OpenAPI 3.1 spec, and live `SIGHUP` reload. **No paid tiers, no feature gates, full HA out of the box.**
-## The Legion Ecosystem
-LegionIO is the orchestrator; the heavy lifting lives in a family of focused, independently-versioned gems. Here's the one-line version — follow a link to dig in:
-| Gem | What it is |
-|-----|-----------|
-| [legion-llm](https://github.com/LegionIO/legion-llm) | Universal LLM proxy — any client dialect → any provider, with routing, escalation, and metering |
-| [legion-gaia](https://github.com/LegionIO/legion-gaia) | Cognitive coordination layer — tick-cycle scheduler + weighted routing across cognitive modules |
-| [legion-apollo](https://github.com/LegionIO/legion-apollo) | Shared + local knowledge store — RAG retrieval, embeddings, and a knowledge graph |
-| [legion-data](https://github.com/LegionIO/legion-data) | Persistence — task history, scheduling, and chains over SQLite / PostgreSQL / MySQL |
-| [legion-transport](https://github.com/LegionIO/legion-transport) | Messaging abstraction — RabbitMQ AMQP plus the in-process lite adapter |
-| [legion-cache](https://github.com/LegionIO/legion-cache) | Caching abstraction — Redis / Memcached plus the in-memory lite adapter |
-| [legion-crypt](https://github.com/LegionIO/legion-crypt) | Secrets & encryption — Vault integration, AES-256, JWT auth |
-| [legion-rbac](https://github.com/LegionIO/legion-rbac) | Role-based access control with Vault-style flat policies |
-| [legion-mcp](https://github.com/LegionIO/legion-mcp) | Model Context Protocol server/client implementation |
-| [legion-settings](https://github.com/LegionIO/legion-settings) | Layered configuration + secret resolution (`vault://`, `env://`) |
-| [legion-logging](https://github.com/LegionIO/legion-logging) | Structured logging used across every gem |
-| [legion-tty](https://github.com/LegionIO/legion-tty) | Terminal UI components — spinners, tables, prompts |
-Capabilities (`lex-*` extensions) are a separate, much larger catalog — see [Extensions](#extensions) below.
-## What Does It Do?
-LegionIO routes work between services asynchronously. Tasks chain into dependency graphs with conditions and transformations controlling data flow:
-```
-Task A ──→ [condition] ──→ Task B ──→ [transform] ──→ Task C
-                                  └──→ Task D  (parallel)
-                                  └──→ Task E ──→ Task F
-```
-When A completes, B runs. B triggers C, D, and E in parallel. Conditions gate execution. Transformations reshape payloads between steps. Add more workers by running more processes — RabbitMQ handles distribution automatically.
-But that's just the foundation. LegionIO is also:
-- **An AI coding assistant** — interactive chat with tools, code review, commit messages, PR generation, and multi-agent workflows
-- **An MCP server** — 60 tools that let any AI agent run tasks, manage extensions, and query your infrastructure
-- **A cognitive computing platform** — 242 brain-modeled extensions across 18 cognitive domains
-- **A digital worker platform** — AI-as-labor with governance, risk tiers, and cost tracking
-## Quick Start
 ```bash
 gem install legionio
-legionio check            # verify subsystem connections
-legionio start            # start the daemon
-```
-For the AI features:
-```bash
-legion                    # launch the interactive TTY shell
-legion chat               # interactive AI REPL with 40 built-in tools
-legion commit             # AI-generated commit message from staged changes
-legion review             # AI code review of your code
-```
-### Two Binaries
-| Binary | Purpose |
-|--------|---------|
-| `legion` | Interactive TTY shell + dev-workflow commands (`chat`, `commit`, `review`, `plan`, `memory`, `init`) |
-| `legionio` | Daemon lifecycle + all operational commands (`start`, `stop`, `lex`, `task`, `config`, `mcp`, and 40+ more) |
-`legion` with no args drops into the interactive TTY shell. `legionio` is the full operational CLI.
-## Installation
-```bash
-gem install legionio
-```
-Or add to your Gemfile:
-```ruby
-gem 'legionio'
-```
-### Optional Capabilities
-| Gem | What It Unlocks |
-|-----|-----------------|
-| `legion-data` | Task history, scheduling, chains (SQLite/PostgreSQL/MySQL) |
-| `legion-llm` | AI chat, commit, review, agents, multi-provider LLM routing |
-| `legion-cache` | Redis/Memcached caching for extensions |
-| `legion-crypt` | Vault integration, encryption, JWT auth |
-| `legion-tty` | TTY UI components (spinners, tables, prompts) |
-## Zero-Infrastructure Mode (Lite)
-Run LegionIO without RabbitMQ, Redis, or Memcached:
-```bash
-LEGION_MODE=lite legion start     # environment variable
-legion start --lite               # CLI flag
-```
-In lite mode, `legion-transport` uses an in-process pub/sub adapter (no RabbitMQ required) and `legion-cache` uses a pure in-memory store with TTL (no Redis/Memcached required). All extensions and features work normally. Useful for single-machine development, CI, and trying LegionIO with no infrastructure.
-## Natural Language Intent Router
-```bash
-legion do "list all running tasks"
-legion do "start the email extension"
-```
-`legion do` routes free-text to the Capability Registry. Routes through the running daemon (MCP Tier 0 fast path) when available, or runs in-process otherwise.
-## Infrastructure
-| Component | Role | Required? |
-|-----------|------|-----------|
-| **RabbitMQ** | Task distribution (AMQP 0.9.1) | No (lite mode replaces with InProcess adapter) |
-| **SQLite/PostgreSQL/MySQL** | Persistence (tasks, scheduling, chains) | Optional |
-| **Redis/Memcached** | Extension caching | No (lite mode replaces with Memory adapter) |
-| **HashiCorp Vault** | Secrets, PKI, encrypted settings | Optional |
-## The CLI
-Operational commands run through `legionio`. Dev-workflow and AI commands run through `legion`.
-### Daemon & Health
-```bash
-legionio start                    # foreground
-legionio start -d                 # daemonize
-legionio start --http-port 8080   # custom API port
-legionio status                   # service status
-legionio stop                     # graceful shutdown
-legionio check                    # smoke-test all connections
-legionio check --extensions       # also verify extensions
-legionio check --full             # full boot including API
-```
-### Extensions (LEX)
-Extensions are gems named `lex-*`, auto-discovered at startup:
-```bash
-legion lex list                 # installed extensions
-legion lex info <name>          # runners, actors, dependencies
-legion lex create <name>        # scaffold a new extension
-legion lex enable <name>        # enable / disable
-```
-### Tasks
-```bash
-legion task run http.request.get url:https://example.com   # dot notation
-legion task run -e http -r request -f get                   # explicit flags
-legion task run                                             # interactive picker
-legion task list                                            # recent tasks
-legion task show <id>                                       # detail + logs
-```
-### AI Chat
-An interactive AI coding assistant with project awareness, persistent memory, tool use, and multi-agent coordination. Requires `legion-llm`.
-```bash
-legion chat                             # interactive REPL
-legion chat prompt "explain main.rb"    # single-prompt mode
-echo "fix the bug" | legion chat prompt - # pipe from stdin
-```
-**40 built-in tools**: read_file, write_file, edit_file, search_files, search_content, run_command, save_memory, search_memory, web_search, spawn_agent, search_traces, query_knowledge, ingest_knowledge, consolidate_memory, relate_knowledge, knowledge_maintenance, knowledge_stats, summarize_traces, list_extensions, manage_tasks, system_status, view_events, cost_summary, reflect, manage_schedules, worker_status, detect_anomalies, view_trends, trigger_dream, generate_insights, budget_status, provider_health, model_comparison, shadow_eval_status, entity_extract, arbitrage_status, escalation_status, graph_explore, scheduling_status, memory_status
-**Slash commands**: `/help` `/quit` `/cost` `/status` `/clear` `/new` `/save` `/load` `/sessions` `/compact` `/fetch URL` `/search QUERY` `/diff` `/copy` `/rewind` `/memory` `/agent` `/agents` `/plan` `/swarm` `/review` `/permissions` `/personality` `/model` `/edit` `/commit` `/workers` `/dream`
-**Bang commands**: `!ls -la` — run shell commands with output injected into context
-**At-mentions**: `@reviewer check main.rb` — delegate to custom agents in `.legion/agents/`
-### AI Workflows
-```bash
-legion commit                       # AI-generated commit message
-legion pr                           # AI-generated PR title + description
-legion pr --base develop --draft    # target branch, draft mode
-legion review                       # AI code review of staged changes
-legion review src/main.rb           # review specific files
-legion review --diff                # review uncommitted diff
-```
-### Multi-Agent Orchestration
-```bash
-legion plan                         # read-only exploration mode (AI reasons, no writes)
-legion swarm start deploy-pipeline  # run multi-agent workflow
-legion swarm list                   # available workflows
-```
-### Memory
-Persistent project and global memory that survives across sessions:
-```bash
-legion memory list                  # project memories
-legion memory add "always use rspec"
-legion memory search "testing"
-legion memory forget 3
-```
+LEGION_MODE=lite legion start   # no RabbitMQ, no Redis, no database required
+```
+## What this is
+LegionIO is a distributed async job engine (RabbitMQ-backed, in the Sidekiq/Celery
+family) that chains tasks into dependency graphs, plus a set of optional layers that
+install as separate gems:
+| Layer | Gem | What it adds | Requires |
+|-------|-----|--------------|----------|
+| Task engine | [legionio](https://github.com/LegionIO/LegionIO) | Task chains, scheduling, 8 actor types, CLI, REST API | nothing (lite mode) |
+| LLM gateway | [legion-llm](https://github.com/LegionIO/legion-llm) | Any-client-to-any-provider routing, tiered escalation, mid-stream failover, context curation, fleet dispatch to pooled workstation GPUs | usable standalone |
+| MCP server | [legion-mcp](https://github.com/LegionIO/legion-mcp) | Exposes tasks and extensions as MCP tools (stdio or HTTP) | legion-llm |
+| Knowledge store | [legion-apollo](https://github.com/LegionIO/legion-apollo) | RAG retrieval, embeddings, confidence-decayed knowledge | activated by lex-apollo / lex-knowledge |
+| Access control | [legion-rbac](https://github.com/LegionIO/legion-rbac) | Vault-style flat policies | usable standalone |
+| Cognitive layer | [legion-gaia](https://github.com/LegionIO/legion-gaia) | Experimental: tick-cycle scheduling over agentic extensions | see "The experimental part" below |
-### Knowledge
+The composition rules are simple and enforced by gemspecs, not documentation: every
+layer is optional, dependencies between layers are declared where they exist
+(legion-mcp depends on legion-llm; Apollo does little until a lex-* extension activates
+it), and installing a core gem you don't use adds a contract, not overhead. You can run
+the LLM gateway without the task engine, the task engine without any AI, or the whole
+stack together.
-Query and manage the Apollo shared knowledge store and local knowledge index:
+There are no paid tiers, no enterprise editions, and no feature gates. RBAC, the audit
+ledger, identity integration, and every operational control ship in the open-source
+gems, because there is no commercial version for them to be held back for.
-```bash
-legion knowledge query "how does transport routing work?"
-legion knowledge retrieve "embedding cosine similarity" --scope global
-legion knowledge ingest /path/to/docs/
-legion knowledge status             # index stats, embedding coverage
-legion knowledge health             # detect orphans, quality metrics
-legion knowledge maintain           # cleanup orphans, reindex
-legion knowledge quality            # quality report
-```
+## The part most worth your skepticism budget: legion-llm
-### Mind Growth
+legion-llm is a proxy/gateway between AI clients and model backends, in the same
+category as LiteLLM or OpenRouter, with one addition neither has: automatic context
+curation for long agent sessions.
-Autonomous cognitive architecture expansion system. Analyzes gaps, proposes new cognitive extensions, and builds them via a staged pipeline:
+**Routing.** Every model is classified into a tier:
+[`local(0) → direct(1) → fleet(2) → cloud(3) → frontier(4)`](https://github.com/LegionIO/legion-llm/blob/main/lib/legion/llm/router.rb).
+Requests try the cheapest capable tier first and escalate on failure or capability
+mismatch. A [health tracker](https://github.com/LegionIO/legion-llm/blob/main/lib/legion/llm/router/health_tracker.rb)
+(300s window, 3 failures trips the circuit, 60s cooldown) keys availability per
+provider instance, and a provider dying mid-stream fails over and continues the stream
+rather than erroring the client.
-```bash
-legion mind-growth status           # current growth cycle state
-legion mind-growth analyze          # gap analysis against 5 reference models
-legion mind-growth propose          # propose a new concept
-legion mind-growth evaluate <id>    # evaluate a proposal
-legion mind-growth build <id>       # run staged build pipeline
-legion mind-growth list             # list proposals
-legion mind-growth approve <id>     # manually approve
-legion mind-growth reject <id>      # manually reject
-legion mind-growth profile          # cognitive profile across all models
-legion mind-growth health           # extension fitness validation
-```
+**Curation.** After each turn (async, off the request path), the
+[Curator](https://github.com/LegionIO/legion-llm/blob/main/lib/legion/llm/context/curator.rb)
+shrinks accumulated history with six deterministic strategies: `strip_thinking`,
+`distill_tool_result`, `fold_resolved_exchanges`, `evict_superseded`, `dedup_similar`,
+and `drop_and_archive` (overflow goes to the knowledge store, not the trash).
-Requires `lex-mind-growth`. Also exposes 6 MCP tools in the `legion.mind_growth_*` namespace.
-### Digital Workers
-AI-as-labor with governance, risk tiers, and cost tracking:
-```bash
-legion worker list                  # list workers
-legion worker show <id>             # worker detail
-legion worker create <name>         # register new worker (bootstrap state)
-legion worker pause <id>            # pause / activate / retire
-legion worker costs --days 30       # cost report
-```
+**Measured, including where it does nothing.** Production ledger aggregates, all
+requests, by conversation length:
-### Code Generation
+| Turns | 1 | 2–3 | 4–5 | 6–9 | 10–19 | 20–49 | 50+ |
+|-------|---|-----|-----|-----|-------|-------|-----|
+| Reduction vs. naive full-history resend | -0.1% | 9.6% | 13.3% | 23.6% | 54.3% | 72.8% | **97.7%** |
-Run inside a `lex-*` directory:
+Single-turn workloads gain nothing; long agent sessions go from an average 1.13M
+naive tokens per turn to ~26K. The asymmetry is the point: curation doesn't make cheap
+traffic cheaper, it bounds the runaway sessions where cost concentrates. Methodology,
+baseline definition, raw numbers, and caveats:
+[curation-production-metrics.md](https://github.com/LegionIO/legion-llm/blob/main/docs/curation-production-metrics.md).
-```bash
-legion generate runner <name>       # add runner + spec
-legion generate actor <name>        # add actor + spec
-legion g exchange <name>            # 'g' is an alias
-```
+Nine provider adapters exist today (Anthropic, OpenAI, Bedrock, Gemini, Vertex,
+Azure Foundry, Ollama, vLLM, MLX), each its own gem built on the
+[lex-llm](https://github.com/LegionIO/lex-llm) contract layer. lex-llm defines what a
+provider is; legion-llm decides where traffic goes. Install only the adapters you use.
-### Scheduling
+## The job engine
-Requires `lex-scheduler`:
+The original core, in production since before any of the AI layers existed:
-```bash
-legion schedule add alerts "*/5 * * * *" http.request.get
-legion schedule add daily "every day at noon" report.generate.summary
-legion schedule list
-```
+- Task chains with conditions and transformations:
+  `Task A → [condition] → Task B → [transform] → Task C`, with parallel fan-out.
+- Eight actor types (subscription, poll, every, once, loop, singleton, nothing,
+  absorber_dispatch) — see
+  [lib/legion/extensions/actors/](https://github.com/LegionIO/LegionIO/tree/main/lib/legion/extensions/actors).
+- Distributed cron scheduling with interval locking.
+- A JSONL disk spool that buffers messages through AMQP outages.
+- Scale by starting more processes; RabbitMQ distributes the work.
-### Configuration
+`LEGION_MODE=lite` swaps RabbitMQ for in-process pub/sub and Redis for an in-memory
+cache. Every feature works; nothing external is required. This is the recommended way
+to evaluate the framework, and it takes about five minutes.
-```bash
-legion config show              # resolved config (redacted)
-legion config validate          # verify settings + subsystem health
-legion config scaffold          # generate starter config files (auto-detects env vars)
-```
+## The experimental part, labeled as such
-`config scaffold` auto-detects environment variables (`ANTHROPIC_API_KEY`, `AWS_BEARER_TOKEN_BEDROCK`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, `VAULT_TOKEN`, `RABBITMQ_USER`/`PASSWORD`) and a running Ollama instance, enabling providers and setting `env://` references automatically.
+The `lex-agentic-*` gems are a research layer: 16 gems containing 369 actor and runner
+modules that model cognition-inspired behaviors on top of the job engine. The honest
+mechanical description is that each is a scheduled job or subscription that adjusts
+persistent state. The interesting research idea is what that state does: task-routing
+connections strengthen when chains succeed and
+[decay](https://github.com/LegionIO/lex-synapse) when unused, so frequently-successful
+paths get cheaper to select. A
+[16-phase tick cycle](https://github.com/LegionIO/lex-tick/blob/main/lib/legion/extensions/tick/helpers/constants.rb)
+schedules this work in budgeted modes (dormant 0.2s, sentinel 0.5s, full 5.0s), and a
+10-phase idle-time cycle consolidates memory and feeds what it learns about your usage
+back into RAG retrieval for the LLM layer.
-Settings load from the first directory found: `/etc/legionio/` → `~/.legionio/settings/` → `~/legionio/` → `./settings/`
+Whether this framing earns its keep is an open question we're running in production to
+answer. If you don't install these gems, none of this exists in your deployment.
-### Observability
+## Interfaces
 ```bash
-legion dashboard               # TUI operational dashboard with auto-refresh
-legion cost summary             # cost overview (today/week/month)
-legion cost worker <id>         # per-worker cost breakdown
-legion trace search "failed tasks last hour"  # natural language trace search
-legion graph show --format mermaid            # task relationship graph
+legion start                 # the engine
+legion chat                  # agentic REPL with tools, memory, subagents
+legion task run http.request.get url:https://example.com
+legion mcp                   # MCP server over stdio or streamable HTTP
+curl http://localhost:4567/api/v1/tasks   # REST API (OpenAPI 3.1 spec in legionio-spec)
 ```
-### Audit & RBAC
+Every CLI command supports `--json`. MCP tools are discovered at runtime from
+installed extensions, so the tool list reflects what your deployment can actually do.
-```bash
-legion audit list               # query audit log
-legion audit export --format csv
-legion rbac roles               # list roles
-legion rbac check <identity> <resource> <action>
-```
+## Verify the claims yourself
-### Diagnostics
+Every number above is reproducible from public source. A few one-liners:
 ```bash
-legion doctor                   # diagnose environment, suggest fixes
-legion doctor --fix             # auto-remediate fixable issues (stale PIDs, missing gems)
-legion doctor --json            # machine-readable output
-```
+# tick and dream phase counts (16 and 10)
+git clone https://github.com/LegionIO/lex-tick && \
+  grep -A20 'PHASES = ' lex-tick/lib/legion/extensions/tick/helpers/constants.rb
-Checks Ruby version, bundle status, config files, RabbitMQ, database, cache, Vault, extensions, PID files, and permissions. Exits 1 if any check fails.
+# legion-llm test surface (269 spec files, ~3,050 examples)
+git clone https://github.com/LegionIO/legion-llm && \
+  find legion-llm/spec -name '*_spec.rb' | wc -l
-### Updating
-```bash
-legion update                   # update all legion gems in-place
-legion update --dry-run         # check what's available without installing
+# router tiers and circuit-breaker defaults
+grep -n 'TIER_RANK\|failure_threshold' legion-llm/lib/legion/llm/router.rb \
+  legion-llm/lib/legion/llm/router/health_tracker.rb
 ```
-Uses the same Ruby that `legion` is running from — safe for Homebrew installs (updates go into the bundled gem directory, not your system Ruby).
-All commands support `--json` for structured output and `--no-color` to strip ANSI codes.
-## REST API
-The daemon exposes a REST API on port 4567 (configurable):
-| Route | Description |
-|-------|-------------|
-| `GET /api/health` | Health check |
-| `GET /api/ready` | Readiness + component status |
-| `GET/POST /api/tasks` | List / create tasks |
-| `GET /api/extensions` | Installed extensions + runners |
-| `GET /api/nodes` | Cluster nodes |
-| `GET/POST/PUT/DELETE /api/schedules` | Cron / interval scheduling |
-| `GET /api/settings` | Config (sensitive values redacted) |
-| `GET /api/transport` | RabbitMQ connection status |
-| `GET /api/events` | SSE event stream |
-| `GET/POST/PUT/DELETE /api/workers` | Digital worker lifecycle |
-| `GET /api/capacity` | Workforce capacity and forecasting |
-| `GET /api/tenants` | Multi-tenant management |
-| `GET /api/audit` | Audit log query and export |
-| `GET /api/rbac/*` | Role-based access control |
-| `GET /api/webhooks` | Webhook subscription management |
-| `GET /api/openapi.json` | OpenAPI 3.1.0 specification |
-| `GET /metrics` | Prometheus metrics |
-| `POST /api/coldstart/ingest` | Context ingestion |
-```json
-{
-  "data": { "..." },
-  "meta": { "timestamp": "2026-03-15T12:00:00Z", "node": "legion-01" }
-}
-```
-## MCP Server
-LegionIO exposes itself as an [MCP](https://modelcontextprotocol.io/) server, letting any AI agent run tasks, manage extensions, and query infrastructure directly.
-```bash
-legion mcp                # stdio transport (Claude Desktop, agent SDKs)
-legion mcp http           # streamable HTTP on localhost:9393
-legion mcp http --port 8080 --host 0.0.0.0
-```
-**60 tools** in the `legion.*` namespace:
-| Category | Tools |
-|----------|-------|
-| **Agentic** | `run_task`, `describe_runner` |
-| **Tasks** | `list_tasks`, `get_task`, `delete_task`, `get_task_logs` |
-| **Extensions** | `list_extensions`, `get_extension`, `enable_extension`, `disable_extension` |
-| **Chains** | `list_chains`, `create_chain`, `update_chain`, `delete_chain` |
-| **Relationships** | `list_relationships`, `create_relationship`, `update_relationship`, `delete_relationship` |
-| **Schedules** | `list_schedules`, `create_schedule`, `update_schedule`, `delete_schedule` |
-| **System** | `get_status`, `get_config` |
-| **Workers** | `list_workers`, `show_worker`, `worker_lifecycle`, `worker_costs`, `team_summary` |
-| **RBAC** | `rbac_assignments`, `rbac_check`, `rbac_grants` |
-| **Analytics** | `routing_stats` |
-| **Knowledge** | `query_knowledge`, `knowledge_health` |
-| **Mind Growth** | `mind_growth_status`, `mind_growth_analyze`, `mind_growth_propose`, `mind_growth_evaluate`, `mind_growth_build`, `mind_growth_profile` |
-**Resources**: `legion://runners` (full runner catalog), `legion://extensions/{name}` (extension detail)
-## Task Relationships
-### Conditions
-JSON rule engine via `lex-conditioner`. Supports nested `all`/`any` with operators:
-```json
-{
-  "all": [
-    {"fact": "pet.type", "value": "dog", "operator": "equal"},
-    {"fact": "pet.hungry", "operator": "is_true"}
-  ]
-}
-```
-### Transformations
-ERB templates via `lex-transformer`. Map data between services:
-```json
-{"message": "Incident assigned to <%= assignee %> with priority <%= severity %>"}
-```
-Access Vault secrets inline: `<%= Legion::Crypt.read('pushover/token') %>`
-## Extensions
-Browse: [LegionIO GitHub](https://github.com/LegionIO) | [legionio topic](https://github.com/topics/legionio?l=ruby)
-### Core (14 operational extensions)
-`lex-node` `lex-tasker` `lex-conditioner` `lex-transformer` `lex-scheduler` `lex-health` `lex-log` `lex-ping` `lex-exec` `lex-lex` `lex-codegen` `lex-metering` `lex-telemetry` `lex-task_pruner`
-### Agentic (242 cognitive extensions)
-Brain-modeled cognitive architecture. 20 core orchestration extensions plus 222 expanded modules across 18 domains:
-| Domain | Examples |
-|--------|----------|
-| **Orchestration** | `lex-tick`, `lex-cortex`, `lex-dream`, `lex-memory`, `lex-identity` |
-| **Emotion** | `lex-emotion`, `lex-mood`, `lex-empathy` |
-| **Reasoning** | `lex-prediction`, `lex-planning`, `lex-logic` |
-| **Social** | `lex-trust`, `lex-consent`, `lex-governance` |
-| **Metacognition** | `lex-reflection`, `lex-awareness`, `lex-curiosity` |
-Coordinated by [legion-gaia](https://github.com/LegionIO/legion-gaia), the cognitive coordination layer with tick-cycle scheduling, channel abstraction, and weighted routing across cognitive modules.
+Engineering docs are public in each repo, including the
+[router design doc](https://github.com/LegionIO/legion-llm/tree/main/docs/work/planning)
+and the [debugging methodology](https://github.com/LegionIO/legion-llm/blob/main/docs/work/planning/nxn-debugging-method.md)
+the routing layer is held to. They are the most accurate picture of how this project
+is actually built.
-### AI / LLM
-`legion-llm` `lex-llm` `lex-llm-anthropic` `lex-llm-azure-foundry` `lex-llm-bedrock` `lex-llm-gemini` `lex-llm-ledger` `lex-llm-mlx` `lex-llm-ollama` `lex-llm-openai` `lex-llm-vertex` `lex-llm-vllm`
-Powered by [legion-llm](https://github.com/LegionIO/legion-llm) with provider-neutral model offerings, local and fleet routing, hosted cloud providers, health tracking, metering, and automatic model discovery.
-LLM API routes are mounted from `legion-llm` when available; LegionIO only hosts those route modules and does not provide a provider gateway fallback.
-### Service Integrations (8 common + 15 additional)
-**Common**: `lex-http` `lex-redis` `lex-s3` `lex-github` `lex-consul` `lex-tfe` `lex-vault` `lex-kerberos` `lex-microsoft_teams`
-**Additional**: `lex-ssh` `lex-slack` `lex-smtp` `lex-influxdb` `lex-pagerduty` `lex-elasticsearch` `lex-chef` `lex-pushover` `lex-twilio` `lex-todoist` `lex-pushbullet` `lex-sleepiq` `lex-elastic_app_search` `lex-memcached` `lex-sonos`
-### Build Your Own
-```bash
-legion lex create myextension
-cd lex-myextension
-legion generate runner myrunner
-legion generate actor myactor
-bundle exec rspec
-```
-## Role Profiles
-Control which extensions load at startup via `settings/legion.json`:
-```json
-{"role": {"profile": "dev"}}
-```
-| Profile | What loads |
-|---------|-----------|
-| *(default)* | Everything — no filtering |
-| `core` | 14 core operational extensions only |
-| `cognitive` | core + all agentic extensions |
-| `service` | core + service + other integrations |
-| `dev` | core + native LLM providers + essential agentic (~20 extensions) |
-| `custom` | only what's listed in `role.extensions` |
-Faster boot and lower memory footprint for dedicated worker roles.
-## Scaling
-Task distribution uses RabbitMQ FIFO queues. Add workers by running more Legion processes — each subscribes to the same queues and picks up work automatically. Tested to 100+ workers.
-Run different LEX combinations per worker: 10 pods focused on `lex-ssh`, a separate pod for `lex-pagerduty` + `lex-log` notifications.
-No paid tiers. No feature gates. Full HA out of the box.
-## Security
-- **Message encryption**: AES-256-CBC via `legion-crypt`
-- **Vault integration**: Secrets, PKI, encrypted settings
-- **Node identity**: Each worker generates a keypair for inter-node communication
-- **Cluster secret**: Generated at first startup, distributed via Vault or in-memory
-- **JWT auth**: Bearer token authentication on the REST API
-- **API key support**: `X-API-Key` header authentication
-- **RBAC**: Role-based access control with Vault-style flat policies
-- **Rate limiting**: Sliding-window per-IP/agent/tenant rate limiting
-- **API versioning**: `/api/v1/` prefix with deprecation headers
-- **Kerberos**: SPNEGO/GSSAPI authentication with LDAP group resolution
-## Docker
-```bash
-docker pull legionio/legion
-```
-```dockerfile
-FROM ruby:3-alpine
-RUN gem install legionio
-CMD ruby --yjit $(which legion) start
-```
-## Architecture
-Before any Legion code loads, the executable applies performance optimizations:
-- **YJIT** — `RubyVM::YJIT.enable` for 15-30% runtime throughput (Ruby 3.1+ builds)
-- **GC tuning** — pre-allocates 600k heap slots and raises malloc limits (ENV overrides respected)
-- **bootsnap** *(opt-in)* — set `LEGION_BOOTSNAP=true` to cache YARV bytecode and `$LOAD_PATH` resolution at `~/.legionio/cache/bootsnap/`
-```
-legion start
-  └── Legion::Service
-      ├── 1.  Logging          (legion-logging)
-      ├── 2.  Settings         (legion-settings — /etc/legionio, ~/legionio, ./settings)
-      ├── 3.  Crypt            (legion-crypt — Vault connection)
-      ├── 4.  Transport        (legion-transport — RabbitMQ)
-      ├── 5.  Cache            (legion-cache — Redis/Memcached)
-      ├── 6.  Data             (legion-data — database + migrations)
-      ├── 7.  RBAC             (legion-rbac — optional role-based access control)
-      ├── 8.  LLM              (legion-llm — AI provider setup + routing)
-      ├── 9.  Apollo           (legion-apollo — shared/local knowledge store)
-      ├── 10. GAIA             (legion-gaia — cognitive coordination layer)
-      ├── 11. Telemetry        (OpenTelemetry — optional)
-      ├── 12. Supervision      (process supervision)
-      ├── 13. Extensions       (two-phase parallel load: require+autobuild, then hook_all_actors)
-      ├── 14. Cluster Secret   (distribute via Vault or memory)
-      └── 15. API              (Sinatra/Puma on port 4567)
-```
-Each phase registers with `Legion::Readiness`. All phases are individually toggleable.
-`SIGHUP` triggers a live reload (`Legion.reload`) — subsystems shut down in reverse order and restart fresh without killing the process. Useful for rolling restarts and config changes.
-## Similar Projects
-| Project | Language | HA | AI | Cognitive |
-|---------|----------|----|----|-----------|
-| **LegionIO** | Ruby | Yes | Chat, MCP, agents, LLM routing | 242 extensions |
-| [Node-RED](https://nodered.org/) | JS | No | No | No |
-| [n8n.io](https://n8n.io/) | TS | Limited | Limited | No |
-| [StackStorm](https://stackstorm.com/) | Python | Yes | No | No |
-| [Huginn](https://github.com/huginn/huginn) | Ruby | No | No | No |
-## Development
-```bash
-git clone https://github.com/LegionIO/LegionIO.git
-cd LegionIO
-bundle install
-bundle exec rspec       # ~3500+ examples, 0 failures
-bundle exec rubocop     # 0 offenses
-```
+## Project status, honestly
-Always run `bundle exec rspec` and `bundle exec rubocop -A` and fix all errors before committing.
+LegionIO is built primarily by one engineer, with a disciplined process: PR-based flow,
+CI on every repo, RSpec and RuboCop green before merge, conventional commits. The
+GitHub org dates to 2018 (the job engine's first life); the AI platform is a 2025–2026
+rebuild, which is why most public repos are young. It runs production workloads daily.
+It is early, it is small, and the code is real. Read the source before betting on it —
+that's what it's there for.
-### Project Structure
+The commit history shows the shape plainly: a 2018-era org, early gems from 2019, and an intense 2025–2026 rebuild sprint. That rebuild was heavily AI-assisted — and the LLM traffic behind it was routed through LegionIO itself, which means the production metrics published here are largely the workload of building the thing they describe. The 1:1 test-to-code ratio, PR-gated flow, and conventional commits are what make that velocity safe; the audit ledger is its receipt trail.
-| Path | Purpose |
-|------|---------|
-| `lib/legion.rb` | Entry point: `Legion.start`, `.shutdown`, `.reload` |
-| `lib/legion/service.rb` | 15-phase startup orchestrator |
-| `lib/legion/cli.rb` | Thor CLI: 40+ subcommands across two binaries |
-| `lib/legion/api.rb` | Sinatra REST API with middleware stack |
-| `lib/legion/extensions/` | LEX discovery, loading, actors, builders |
-| `lib/legion/tools/` | Canonical tool layer (Registry, Discovery, EmbeddingCache) |
-| `lib/legion/digital_worker/` | AI-as-labor governance platform |
-| `lib/legion/cli/chat/` | Interactive AI REPL with 40 tools |
-| `spec/` | RSpec suite (~3500+ examples) |
+LegionIO is also published through [Optum Open Source](https://github.com/Optum/LegionIO), where it first shipped publicly; this org is the active development home, and updates are periodically merged back upstream. The enterprise provenance is why a framework this young ships RBAC, an audit ledger, and identity integration — a real production deployment required them.
-### Contributing
+## Requirements
-1. Fork the repo and create a feature branch
-2. Write specs for new functionality
-3. Ensure `bundle exec rspec` passes with 0 failures
-4. Ensure `bundle exec rubocop` passes with 0 offenses
-5. Open a PR targeting `main`
+- Ruby >= 3.4
+- Nothing else in lite mode. Full mode: RabbitMQ; optional PostgreSQL/MySQL/SQLite,
+  Redis/Memcached, HashiCorp Vault.
 ## License
-Apache-2.0
+Core framework: [Apache-2.0](https://www.apache.org/licenses/LICENSE-2.0).
+Extensions: [MIT](https://opensource.org/licenses/MIT).

data/legionio.gemspec CHANGED Viewed

@@ -10,8 +10,11 @@ Gem::Specification.new do |spec|
   spec.authors       = ['Esity']
   spec.email         = ['matthewdiverson@gmail.com']
-  spec.summary       = 'The primary gem to run the LegionIO Framework'
-  spec.description   = 'LegionIO is an extensible framework for running, scheduling and building relationships of tasks in a concurrent matter'
+  spec.summary       = 'Modular Ruby framework: distributed async job engine with optional LLM gateway, MCP server, and RBAC'
+  spec.description   = 'LegionIO chains tasks into dependency graphs across a RabbitMQ fleet, or fully in-process via ' \
+                       'lite mode with zero infrastructure. Optional layers install as independent gems: legion-llm adds ' \
+                       'tiered LLM routing with mid-stream failover and context curation, legion-mcp adds an MCP server, ' \
+                       'legion-rbac adds access control. All open source, no feature gates.'
   spec.homepage      = 'https://github.com/LegionIO/LegionIO'
   spec.license       = 'Apache-2.0'
   spec.require_paths = ['lib']

data/lib/legion/api/auth_teams.rb CHANGED Viewed

@@ -107,8 +107,9 @@ module Legion
             token_body = Legion::JSON.load(token_response.body)
             if token_body[:access_token]
-              # Store token via TokenCache if available
-              store_teams_token(token_body, entry[:scopes])
+              # Persist via the Entra TokenManager (the store the read path consults)
+              store_teams_token(token_body, entry[:scopes],
+                                tenant_id: entry[:tenant_id], client_id: entry[:client_id])
               AuthTeams.mutex.synchronize { entry[:result] = { authenticated: true } }
               content_type :html
               '<html><body><h2>Authentication successful!</h2><p>You can close this tab.</p></body></html>'
@@ -128,14 +129,16 @@ module Legion
         end
         module TeamsTokenHelper
-          def store_teams_token(token_body, scopes)
+          def store_teams_token(token_body, scopes, tenant_id: nil, client_id: nil)
             require 'legion/extensions/identity/entra/helpers/token_manager'
             Legion::Extensions::Identity::Entra::Helpers::TokenManager.save_token(
               :delegated,
               access_token:  token_body[:access_token],
               refresh_token: token_body[:refresh_token],
               expires_in:    token_body[:expires_in] || 3600,
-              scopes:        scopes
+              scopes:        scopes,
+              tenant_id:     tenant_id,
+              client_id:     client_id
             )
             Legion::Logging.info 'Teams delegated token stored' if defined?(Legion::Logging)
           rescue StandardError => e

data/lib/legion/api/extensions.rb CHANGED Viewed

@@ -32,8 +32,8 @@ module Legion
         def self.register_tools_route(app)
           app.get '/api/extensions/tools' do
-            entries = filter_tool_entries(Array(Legion::Settings::Extensions.tools), params)
-            tools = entries.map { |e| serialize_tool_entry(e) }
+            entries = Routes::Extensions.filter_tool_entries(Array(Legion::Settings::Extensions.tools), params)
+            tools = entries.map { |e| Routes::Extensions.serialize_tool_entry(e) }
             json_response({ total: tools.size, tools: tools })
           end
         end

data/lib/legion/api/health.rb ADDED Viewed

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+module Legion
+  class API < Sinatra::Base
+    # Subsystem health assessment for GET /api/health.
+    #
+    # A component degrades health ONLY if it is both:
+    #   1. enabled — Legion::Readiness.status[c] == true (Service marks a
+    #      component ready only when its config flag is on AND setup succeeded).
+    #      :skipped (disabled) and false/nil (never booted / still booting) are
+    #      NOT enabled-and-previously-healthy, so they never fail health.
+    #   2. currently unhealthy — its live liveness check now returns false.
+    #
+    # This prevents both false negatives (200 while transport can't process
+    # messages) and false positives (503 for a subsystem that was never
+    # configured or hasn't finished booting).
+    module Health
+      COMPONENTS = %i[transport cache data].freeze
+      class << self
+        # Returns { status:, components: { name => { enabled:, healthy:, detail? } } }
+        def assess
+          components = COMPONENTS.to_h { |name| [name, component_health(name)] }
+          degraded = components.any? { |_name, c| c[:enabled] && c[:healthy] == false }
+          { status: degraded ? 'degraded' : 'ok', components: components }
+        end
+        def component_health(name)
+          enabled = Legion::Readiness.status[name] == true
+          return { enabled: false, healthy: nil } unless enabled
+          healthy, detail = send("#{name}_liveness")
+          info = { enabled: true, healthy: healthy }
+          info[:detail] = detail if detail && !healthy
+          info
+        end
+        # --- liveness checks: [healthy_boolean, detail_string_or_nil] ---
+        def transport_liveness
+          conn = Legion::Transport::Connection
+          return [true, nil] if conn.respond_to?(:lite_mode?) && conn.lite_mode?
+          session = conn.session
+          open = session.respond_to?(:open?) && session.open?
+          [open, open ? nil : 'session_open: false']
+        rescue StandardError => e
+          [false, e.message]
+        end
+        def cache_liveness
+          return [true, nil] unless defined?(Legion::Cache)
+          connected = Legion::Cache.connected?
+          [connected, connected ? nil : 'cache not connected']
+        rescue StandardError => e
+          [false, e.message]
+        end
+        def data_liveness
+          connected = begin
+            Legion::Settings[:data][:connected] == true
+          rescue StandardError
+            false
+          end
+          [connected, connected ? nil : 'data not connected']
+        rescue StandardError => e
+          [false, e.message]
+        end
+      end
+    end
+  end
+end

data/lib/legion/api/middleware/auth.rb CHANGED Viewed

@@ -6,6 +6,9 @@ module Legion
       class Auth
         SKIP_PATHS       = %w[/api/health /api/ready /api/openapi.json /metrics /api/auth/token /api/auth/worker-token
                               /api/auth/authorize /api/auth/callback /api/auth/negotiate].freeze
+        # Match a skip path exactly or as a bounded sub-path (segment boundary),
+        # NOT as a bare prefix — `/api/healthily_fake` must not match `/api/health`.
+        SKIP_PATTERNS    = SKIP_PATHS.map { |p| %r{\A#{Regexp.escape(p)}(?:/|\z)} }.freeze
         AUTH_HEADER      = 'HTTP_AUTHORIZATION'
         BEARER_PATTERN   = /\ABearer\s+(.+)\z/i
         NEGOTIATE_PATTERN = /\ANegotiate\s+(.+)\z/i
@@ -81,7 +84,7 @@ module Legion
         end
         def skip_path?(path)
-          SKIP_PATHS.any? { |p| path.start_with?(p) }
+          SKIP_PATTERNS.any? { |re| re.match?(path) }
         end
         def extract_negotiate_token(env)

data/lib/legion/api/openapi.rb CHANGED Viewed

@@ -92,7 +92,7 @@ module Legion
         }
       end
-      def self.to_json
+      def self.to_json(*_args)
         require 'json'
         ::JSON.generate(spec)
       end
@@ -432,7 +432,9 @@ module Legion
             get: {
               tags:        ['Health'],
               summary:     'Health check',
-              description: 'Returns ok status and version. Skips auth middleware.',
+              description: 'Returns ok/degraded status, version, and per-subsystem component health. ' \
+                           'Returns 503 when an enabled, previously-healthy subsystem (transport, cache, data) ' \
+                           'has degraded. Skips auth middleware.',
               operationId: 'getHealth',
               security:    [],
               responses:   {
@@ -440,11 +442,13 @@ module Legion
                                                   properties: {
                                                     data: {
                                                       type:       'object',
-                                                      properties: { status: { type: 'string', example: 'ok' }, version: { type: 'string' } }
+                                                      properties: { status: { type: 'string', example: 'ok' }, version: { type: 'string' },
+                                                                    components: { type: 'object' } }
                                                     },
                                                     meta: { '$ref' => '#/components/schemas/Meta' }
                                                   }
-                                                ))
+                                                )),
+                '503' => { description: 'Degraded — an enabled subsystem has broken' }
               }
             }
           },

data/lib/legion/api.rb CHANGED Viewed

@@ -5,6 +5,7 @@ require 'legion/json'
 require_relative 'events'
 require_relative 'readiness'
 require_relative 'api/default_settings'
+require_relative 'api/health'
 require_relative 'api/middleware/auth'
 require_relative 'api/middleware/body_limit'
@@ -107,7 +108,11 @@ module Legion
     # Health and readiness
     get '/api/health' do
       uptime_seconds = (::Process.clock_gettime(::Process::CLOCK_MONOTONIC) - START_TIME).to_i
-      json_response({ status: 'ok', version: Legion::VERSION, uptime_seconds: uptime_seconds, uptime: uptime_seconds })
+      assessment = Legion::API::Health.assess
+      json_response({ status: assessment[:status], version: Legion::VERSION,
+                      uptime_seconds: uptime_seconds, uptime: uptime_seconds,
+                      components: assessment[:components] },
+                    status_code: assessment[:status] == 'ok' ? 200 : 503)
     end
     get '/api/ready' do

data/lib/legion/cli/chat/daemon_chat.rb CHANGED Viewed

@@ -4,7 +4,7 @@ require 'securerandom'
 require 'legion/cli/chat_command'
 begin
-  require 'legion/llm/daemon_client'
+  require 'legion/llm/call/daemon_client'
 rescue LoadError
   # legion-llm not yet loaded; DaemonClient must be defined before DaemonChat#ask is called.
 end

data/lib/legion/cli/chat/tools/model_comparison.rb CHANGED Viewed

@@ -56,7 +56,7 @@ module Legion
             return pricing if models_str.nil? || models_str.strip.empty?
             names = models_str.split(',').map(&:strip).map(&:downcase)
-            pricing.select { |k, _| names.any? { |n| k.downcase.include?(n) } }
+            pricing.select { |k, _| names.any? { |n| k.downcase.include?(n) } } # rubocop:disable Style/ArrayIntersect
           end
           def self.format_comparison(selected, tokens)

data/lib/legion/cli/chat_command.rb CHANGED Viewed

@@ -184,7 +184,7 @@ module Legion
           Connection.log_level = options[:verbose] ? 'debug' : 'error'
           Connection.ensure_settings
-          require 'legion/llm/daemon_client'
+          require 'legion/llm/call/daemon_client'
           return if Legion::LLM::DaemonClient.available?
           raise CLI::Error,

data/lib/legion/cli/connect_command.rb CHANGED Viewed

@@ -8,6 +8,7 @@ module Legion
       namespace :connect
       PROVIDERS = %w[microsoft github google].freeze
+      STATE_COLORS = { 'connected' => :green, 'revoked' => :red, 'not connected' => :yellow }.freeze
       desc 'microsoft', 'Connect a Microsoft account (OAuth2 delegated auth)'
       method_option :tenant_id,  type: :string, desc: 'Azure tenant ID'
@@ -17,7 +18,11 @@ module Legion
       method_option :no_browser, type: :boolean, default: false, desc: 'Print URL instead of launching browser'
       def microsoft
         say 'Delegating to Teams OAuth2 browser auth...', :blue
-        Legion::CLI::Auth.start(['teams'] + ARGV.select { |a| a.start_with?('--') })
+        forwarded = ['teams']
+        forwarded += ['--tenant_id', options[:tenant_id]] if options[:tenant_id]
+        forwarded += ['--client_id', options[:client_id]] if options[:client_id]
+        forwarded += ['--scopes', options[:scope]] if options[:scope]
+        Legion::CLI::Auth.start(forwarded)
       end
       desc 'github', 'Connect a GitHub account (OAuth2 device flow)'
@@ -31,14 +36,8 @@ module Legion
         require 'legion/auth/token_manager'
         PROVIDERS.each do |provider|
-          manager = Legion::Auth::TokenManager.new(provider: provider.to_sym)
-          if manager.token_valid?
-            say "  #{provider}: connected", :green
-          elsif manager.revoked?
-            say "  #{provider}: revoked", :red
-          else
-            say "  #{provider}: not connected", :yellow
-          end
+          state = provider_state(provider)
+          say "  #{provider}: #{state}", STATE_COLORS.fetch(state, :yellow)
         end
       end
@@ -51,6 +50,32 @@ module Legion
         say "Disconnected #{provider} account.", :green
       end
+      no_commands do
+        # Microsoft delegated login writes tokens via the Entra TokenManager
+        # (vault/local/memory), not the legacy Legion::Auth secret store — so
+        # status for :microsoft must consult the Entra store to avoid always
+        # reporting 'not connected' after a successful Teams/delegated login.
+        def provider_state(provider)
+          return microsoft_state if provider == 'microsoft'
+          manager = Legion::Auth::TokenManager.new(provider: provider.to_sym)
+          return 'connected' if manager.token_valid?
+          return 'revoked' if manager.revoked?
+          'not connected'
+        end
+        def microsoft_state
+          return 'not connected' unless defined?(Legion::Extensions::Identity::Entra::Helpers::TokenManager)
+          tm = Legion::Extensions::Identity::Entra::Helpers::TokenManager
+          data = tm.token_data(:delegated, refresh: false)
+          data && !tm.expired?(data) ? 'connected' : 'not connected'
+        rescue StandardError
+          'not connected'
+        end
+      end
     end
   end
 end

data/lib/legion/extensions/builders/routes.rb CHANGED Viewed

@@ -29,7 +29,6 @@ module Legion
             methods.each do |function|
               route_path = "#{extension_name}/#{runner_name}/#{function}"
               defn = runner_module.respond_to?(:definition_for) ? runner_module.definition_for(function) : nil
-              log.info "[Routes] auto-route registered: POST /api/extensions/#{extension_name}/runners/#{runner_name}/#{function}"
               @routes[route_path] = {
                 lex_name:       extension_name,
                 runner_name:    runner_name,
@@ -51,6 +50,7 @@ module Legion
                 runner_class:   runner_class,
                 definition:     defn
               )
+              log.info "[Routes] registered: POST /api/extensions/#{extension_name}/runners/#{runner_name}/#{function}"
             end
           end
         end

data/lib/legion/service.rb CHANGED Viewed

@@ -418,6 +418,8 @@ module Legion
         Legion::API.use Legion::Rbac::Middleware
       end
+      register_extension_routes_with_api_router
       @api_thread = Thread.new do
         retries = 0
         max_retries = api_settings[:bind_retries]
@@ -448,6 +450,32 @@ module Legion
       handle_exception(e, level: :warn, operation: 'service.setup_api')
     end
+    def register_extension_routes_with_api_router
+      return unless defined?(Legion::API) && Legion::API.respond_to?(:router)
+      return unless defined?(Legion::Extensions)
+      count = 0
+      Legion::Extensions.loaded_extension_modules.each do |ext_mod|
+        next unless ext_mod.respond_to?(:routes) && ext_mod.routes.is_a?(Hash)
+        ext_mod.routes.each_value do |route_entry|
+          Legion::API.router.register_extension_route(
+            lex_name:       route_entry[:lex_name],
+            amqp_prefix:    ext_mod.respond_to?(:amqp_prefix) ? ext_mod.amqp_prefix : "lex.#{route_entry[:lex_name].to_s.tr('_', '.')}",
+            component_type: route_entry[:component_type],
+            component_name: route_entry[:runner_name],
+            method_name:    route_entry[:function].to_s,
+            runner_class:   route_entry[:runner_class],
+            definition:     route_entry[:definition]
+          )
+          count += 1
+        end
+      end
+      log.info "[Routes] backfilled #{count} extension routes with API router" if count.positive?
+    rescue StandardError => e
+      handle_exception(e, level: :warn, operation: 'service.register_extension_routes_with_api_router')
+    end
     def setup_llm
       log.info 'Setting up Legion::LLM'
       require 'legion/llm'
@@ -960,6 +988,7 @@ module Legion
       Legion::Crypt.cs if defined?(Legion::Crypt)
       setup_apm if @api_enabled
       setup_api if @api_enabled
+      register_extension_routes_with_api_router if @api_enabled
       if defined?(Legion::MCP)
         Legion::MCP.reset!

data/lib/legion/version.rb CHANGED Viewed

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 module Legion
-  VERSION = '1.9.43'
+  VERSION = '1.9.50'
 end

metadata CHANGED Viewed

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legionio
 version: !ruby/object:Gem::Version
-  version: 1.9.43
+  version: 1.9.50
 platform: ruby
 authors:
 - Esity
@@ -387,8 +387,11 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: LegionIO is an extensible framework for running, scheduling and building
-  relationships of tasks in a concurrent matter
+description: 'LegionIO chains tasks into dependency graphs across a RabbitMQ fleet,
+  or fully in-process via lite mode with zero infrastructure. Optional layers install
+  as independent gems: legion-llm adds tiered LLM routing with mid-stream failover
+  and context curation, legion-mcp adds an MCP server, legion-rbac adds access control.
+  All open source, no feature gates.'
 email:
 - matthewdiverson@gmail.com
 executables:
@@ -490,6 +493,7 @@ files:
 - lib/legion/api/graphql/types/query_type.rb
 - lib/legion/api/graphql/types/task_type.rb
 - lib/legion/api/graphql/types/worker_type.rb
+- lib/legion/api/health.rb
 - lib/legion/api/helpers.rb
 - lib/legion/api/identity_audit.rb
 - lib/legion/api/inbound_webhooks.rb
@@ -969,5 +973,6 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
-summary: The primary gem to run the LegionIO Framework
+summary: 'Modular Ruby framework: distributed async job engine with optional LLM gateway,
+  MCP server, and RBAC'
 test_files: []