lex-llm-mlx 0.5.2 → 0.5.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e5f9a7dab605748337a587418be077e253a7e6b497c6b014ecba9875043c6ad
-  data.tar.gz: 3114258fbcc3dd3b6f184f28d83bc14c866187947a08c42bf6128f86e002c9c3
+  metadata.gz: b2be714a855933a9b2eaa90d975550eacf40d0e34d7a072ae9c7cade745cf0c8
+  data.tar.gz: 30222c46840faddde023875adf8282efcdf773b6b56b3840497613f03d65ce6b
 SHA512:
-  metadata.gz: 12ae5ec7295decb7048148673f35daac26c2737f0739b4d236a2097ac07d6b7c5eddcad7af5bbde8fc7e6c2ca3d4bea570a2021ff6d0b30f2eff1e45711dc836
-  data.tar.gz: d227264342de019670a47624dcf121ae21c9ed9653d3e65c47d15ff754c05da407b44b29e20de06ee357f21b5bf34fffe7fac9869c1cacecefcd2ed21fd42c62
+  metadata.gz: f34a9e7e80330ca83cbc703ac8c2c1e9ee2124c89a246655c525943a2176f7163ddd409ec9df12cd3b9c28ee68a6bd98f0f7d0211ec54608494f3e656c45d8a6
+  data.tar.gz: 37027094de2819478977b96140b19c14564f33afa5c0d42d3d7d89338e7009b5dfbb2eedc73679b5742c09ff70534dc6ee64e750e4a465a163e7016f066aa6da

data/.rubocop.yml

@@ -14,6 +14,8 @@ Metrics/BlockLength:
     - spec/**/*
 Metrics/MethodLength:
   Enabled: false
+Metrics/ModuleLength:
+  Max: 350
 RSpec/ExampleLength:
   Enabled: false
 RSpec/MultipleExpectations:

data/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## [0.5.4] - 2026-08-20
+
+### Changed
+- **lex-llm 0.8.0 conformance.** Legacy type usage migrates to Canonical; the legacy coordinator wiring is removed; the gemspec floor is `lex-llm >= 0.8.0`.
+- Enforce the canonical dispatch boundary end to end: the `MlxCallable` dispatch operations (chat, stream_chat, count_tokens) call the shared `Provider#enforce_canonical_messages!` helper at the exact-execution boundary (12/O05) before delegating. Plain-Hash input raises a typed `ArgumentError` on every dispatch operation; the lenient hash re-canonicalization that masked the 2026-08-19 hash-bypass defect for 25 failed openai dispatches is gone.
+- Migrate the `MlxCallable` dispatch contract to the 0.8.0 callable shape: `chat`/`stream_chat` take the rehydrated `Array<Canonical::Message>` positionally (the `Fleet::WorkerExecution` dispatch shape and the kit B1/B2 callable contract), the Selection-derived model passes through as a bare String (the 0.8.0 renderer puts `model` on the wire as-is), and the folded wire params become a `Canonical::Params` at the dispatch boundary — `temperature` is a params member (05 O4) and no longer a named kwarg.
+- Migrate the offering call site to the writer path: the legacy read-path production (`offering_from_model` → `Routing::ModelOffering`, deleted from lex-llm 0.8.0) is removed; the base `discover_offerings` now serves the activated inventory offerings published by the discovery actor from the Registry snapshot (07 C5 / 08 D3).
+- Remove the discovery actor's `Inventory::ScopedRefresher::LegacyCoordinatorAdapter` compatibility wiring (the adapter is deleted in the lex-llm 0.8.0 cut; the `Publisher` is constructed registry-only).
+- Raise the `lex-llm` dependency floor to 0.8.0 for the canonical-only funnel, the Registry read path, fleet v3 exact execution, and the conformance kit.
+
+### Removed
+- `Provider#offering_from_model` with its offering-kwarg and capability-policy resolution helpers, and the `CapabilityConfig`/`CapabilityResolution` modules that fed only that read path. Config-cascade capability overrides (provider/instance/model `*_flag` keys) no longer have an MLX consumer: the SSOT evidence model treats config sources as unknown-only (`Taxonomies::UNKNOWN_ONLY_EVIDENCE_SOURCES`).
+- The provider-local `render_payload` message-boundary check — the 0.8.0 base funnel enforces `Canonical::Message` input centrally before rendering (08 F2); providers no longer re-implement the check, and the reference to the deleted legacy `Llm::Message` class is gone.
+- `MlxCallable#model_info` — the `Model::Info` wrapping was a 0.7.7 `model.id` renderer artifact; the 0.8.0 renderer renders the model string as-is.
+- `spec/legion/extensions/llm/mlx/provider_capability_policy_spec.rb` — it tested the removed offering-production path.
+
+### Added
+- The ssot_v3 conformance spec runs the 0.8.0 kit boundary groups B1 (central canonical enforcement) and B2 (canonical outputs asserted by type) against the real `MlxCallable`, alongside the existing SSOT v3 provider-adapter group.
+- `provider_contract_spec` rewritten against the 0.8.0 funnel shape (positional completion messages, named `text`/`prompt`) and the Registry-snapshot read path.
+- RULES.md (the 0.8.0 architecture law, byte-for-byte mirror of the lex-llm 0.8.0 release).
+- A local-tree `lex-llm` path dependency in the test group so the adjacent checkout resolves against the 0.8.0 cut during development.
+
+## [0.5.3] - 2026-08-19
+
+### Changed
+- Publish the immutable four-component lane-weight pair from MLX discovery and reconcile weight-only changes on the existing scheduled writer pass.
+- Serialize initial, recovery, replacement, removal, and shutdown state transitions behind one actor-local mutex without adding a Settings callback or operator workflow.
+- Track configured-but-unpublished weight keys on the existing discovery cadence and log each dormant transition once.
+- Raise the `lex-llm` dependency floor to 0.7.6; the existing `legion-settings` dependency remains unchanged.
+
+### Fixed
+- Compare every offering contract field while excluding only non-authoritative evidence observation timestamps, preventing unchanged discovery passes from republishing snapshots while retaining real evidence and weight changes.
+- Treat discovery catalogs as order-independent multisets, so provider reorderings do not republish while adding or removing a duplicate offering remains a significant change.
+- Validate the complete weighted offering set before constructing or claiming a callable scope, so malformed weights leave no orphaned Registry publication and a later corrected ordinary pass activates without restart or operator cleanup.
+
+### Added
+- Cover the complete writer lifecycle, publication races, failure atomicity, dormant-state cycle, and the actual callable's folded-system OpenAI-compatible wire payload.
+
 ## [0.5.2] - 2026-08-18
 
 ### Fixed

data/Gemfile

@@ -2,10 +2,15 @@
 
 source 'https://rubygems.org'
 
-gem 'lex-llm'
-
 gemspec
 
+# Local-tree resolution: use the adjacent lex-llm checkout when present so the
+# canonical-boundary work resolves against the unreleased 0.7.7.
+group :test do
+  lex_llm_path = File.expand_path('../lex-llm', __dir__)
+  gem 'lex-llm', path: lex_llm_path if Dir.exist?(lex_llm_path)
+end
+
 group :development do
   gem 'bundler', '>= 2.0'
   gem 'rake', '>= 13.0'

data/RULES.md

@@ -0,0 +1,97 @@
+RULES.md — Legion LLM Architecture Law
+These rules apply to every task, file, repository, agent, model, session, test, refactor, migration, incident, and release.
+The requested task defines what may change. These rules define how the system ALWAYS works.
+Every rule remains active 100% of the time. If requested work conflicts with these rules, stop and surface the conflict before changing code.
+These are architecture laws. Scope, compatibility, urgency, convenience, tests, existing behavior, and model judgment do not change them.
+1. Canonical is the only internal language.
+Every client translates client wire -> Canonical before shared execution.
+Shared execution carries Canonical through context, tools, routing, direct dispatch, fleet dispatch, and response handling.
+Every provider translates Canonical -> provider wire at the provider boundary, then provider wire -> Canonical before returning to shared execution.
+Every internal boundary validates the Canonical type it is defined to receive and raises immediately when that contract is violated.
+Client Wire -> Client Translator -> Canonical -> Shared Execution -> Canonical -> Provider Translator -> Provider Wire.
+2. Serialization preserves Canonical.
+Transport may serialize Canonical state. The receiving transport boundary ALWAYS rehydrates the exact Canonical type before execution continues.
+Fleet follows Canonical -> serialize -> wire -> deserialize -> rehydrate Canonical -> Canonical.
+Serialization changes encoding only. Ownership, identity, model, operation, capability, selection, and meaning remain exactly the same.
+After rehydration, shared execution continues only with Canonical objects.
+3. Every authoritative fact has exactly one owner.
+The owner creates the fact once. Every downstream layer carries, projects, serializes, rehydrates, verifies, or executes that exact fact.
+A downstream layer receiving missing or contradictory authoritative state raises and returns the defect to the owning layer.
+Authority ALWAYS moves forward by preservation.
+Authority is created once and is never recreated downstream.
+4. Requirements describe the request. Inventory describes reality. Router chooses. Dispatch executes.
+Canonical request construction owns request semantics. RequestRequirements expresses operation, capabilities, modality, context, output, tools, and explicit pins.
+Providers publish exact executable facts into Inventory. Inventory owns canonical instance, offering, lane, capability, context, quota, health, and published weight state.
+Router.next_lane consumes Requirements plus one immutable Inventory snapshot and produces one authoritative Selection.
+Dispatch executes that Selection exactly. Once Selection exists, routing is finished.
+5. Inventory facts are immutable executable facts.
+Providers publish exact instances and complete offering snapshots through the Inventory publication contract.
+Identity, capability evidence, context evidence, quota domains, availability, and write-time weights are consumed from published Inventory state.
+A changed fact becomes authoritative only through the owning publication or reconciliation path and a new Inventory snapshot.
+Routing reads Inventory. Dispatch verifies and executes Inventory-backed Selection.
+6. Identity, capabilities, weights, and context policy retain exact ownership.
+Inventory::Identity owns instance, offering, and lane identity; canonical instance identity is provider family plus the operator/configured instance name; physical endpoint data remains secondary.
+Providers publish capability evidence. Requirements state required capabilities. Candidate evaluation compares the two and determines capability eligibility.
+The weight owner computes lane weight at publication time; Inventory stores it; ranking consumes that stored weight; a stored zero disables the lane.
+Preferred-context binning orders eligible candidates into preference bands and preserves eligibility. Capability, health, binning, and weight ALWAYS retain distinct meanings.
+7. Routing chooses exactly once.
+Router.next_lane is the sole routing authority.
+Candidate evaluation determines eligibility from Requirements and Inventory. Ranking orders eligible candidates from published routing facts.
+Selection freezes the exact provider, instance, offering, lane, model, operation, and routing identity required for execution.
+Every downstream component consumes the Selection it receives.
+Selection is preserved, not reconstructed.
+8. Exact execution stays exact through every boundary.
+Direct dispatch executes the exact Selection-derived binding it receives.
+Fleet dispatch serializes and signs that exact binding; fleet validation verifies it; fleet rehydration restores it; worker resolution verifies it against authoritative Inventory.
+The selected provider, instance, offering, lane, model, and operation remain identical through projection, signing, transport, validation, rehydration, resolution, and callable invocation.
+A mismatch raises before provider execution.
+An exact execution request ALWAYS remains exact execution.
+9. Health and errors preserve one authoritative meaning.
+Inventory owns exact-instance availability. An authoritative instance-unavailable result removes that exact instance; readiness probing owns recovery; successful readiness republish re-admits it.
+Overload, timeout, rate limit, model-not-ready, and transient provider failures remain request-local according to ProviderOutcome semantics.
+The first layer that can authoritatively classify an error performs that classification once. Every downstream layer preserves it.
+Programming errors remain programming errors. Contract violations remain contract violations. Routing exhaustion remains the defined typed Rejection.
+10. Compatibility exists only at explicit edges.
+Supported legacy clients and protocols are translated into the current Canonical and SSOT architecture at explicit compatibility boundaries.
+Shared execution remains Canonical. Routing remains SSOT-driven. Exact execution remains exact.
+Compatibility code adapts an external contract to the current internal architecture.
+The current internal architecture ALWAYS has one representation, one routing authority, one identity system, and one execution truth.
+11. Fix every defect at its owner.
+Trace the incorrect value to the layer that owns it, then fix that owner.
+Fix client wire in the client translator; Canonical shape in Canonical construction; Requirements in Requirements construction; provider facts in publication; identity in Inventory identity; weights in publication/reconciliation.
+Fix eligibility in candidate evaluation; ordering in ranking; choice in Router.next_lane; execution preservation in dispatch; provider wire in the provider translator.
+The layer where a defect becomes visible is evidence. The owning layer is where the correction belongs.
+12. A discovered issue remains in its owning domain.
+Complete the requested task inside its stated scope.
+When investigation exposes a separate defect owned by another architectural domain, record and surface it as separate work unless the requested task is explicitly expanded.
+Routing work consumes existing Canonical Requirements and Inventory facts. Canonical work changes Canonical contracts. Provider work changes publication or translation. Transport work changes transport.
+Nearby code never changes ownership. “While we are here” never changes architecture.
+13. N x N ALWAYS converges through Canonical.
+Equivalent client semantics produce equivalent Canonical state before shared execution. Every provider consumes the same Canonical semantics for the same request.
+When two paths disagree, capture the state at every involved boundary and locate the FIRST point where Canonical meaning diverges.
+Fix that first divergent boundary, then run the exact failing path again.
+Client behavior is proven at client-wire <-> Canonical. Provider behavior is proven at Canonical <-> provider-wire. Shared execution is proven with Canonical throughout.
+14. Debug from captured authoritative state.
+Capture the actual input at the failing boundary before reasoning from symptoms.
+For translation or transport defects, capture Canonical immediately before and after every involved boundary.
+For routing or dispatch defects, capture Requirements, relevant Inventory facts, Selection, execution binding, and ProviderOutcome.
+Compare each captured value to the contract owned by that layer. Find the first divergence. Fix its owner. Re-run the exact path.
+Then inspect sibling implementations for the same defect class.
+15. Tests prove the real boundary and the invariant.
+A boundary test exercises the real boundary it claims to protect.
+Fleet tests exercise real serialization, deserialization, Canonical rehydration, signing, validation, exact resolution, and callable dispatch.
+Provider tests exercise the real callable boundary and provider translator. Routing tests exercise real Requirements, Inventory records, candidate evaluation, ranking, and Selection.
+Regression tests prove the violated invariant, not only the observed symptom.
+A green suite is release evidence only when the tested path traverses the real architecture.
+16. Shared contracts are consumed directly.
+Shared Canonical types own execution representation. Shared Inventory types own inventory state. Shared Routing types own routing state.
+Shared taxonomy owns canonical mappings. Shared ProviderOutcome owns provider-neutral outcomes. Shared fleet protocol owns exact execution claims.
+Every repository consumes these shared owners directly.
+A defect in one shared boundary triggers an audit of every sibling implementation of that boundary. Fix the shared owner centrally whenever the defect belongs to a shared contract.
+17. Architecture is the release gate.
+Every change preserves every rule in this file.
+Tests, compatibility, historical behavior, migration phase, patch urgency, nearby code, task wording, and model judgment are evaluated UNDER these rules.
+A contradiction between existing behavior and these rules is surfaced as an architecture conflict and resolved at the owning boundary before release.
+Limited scope means do less. Limited scope NEVER means fewer rules apply.
+These rules apply 100% of the time.
+These are the law.

data/lex-llm-mlx.gemspec

@@ -28,8 +28,9 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'legion-logging', '>= 1.3.2'
   spec.add_dependency 'legion-settings', '>= 1.4.2'
   spec.add_dependency 'legion-transport', '>= 1.4.14'
-  # 0.7.1 carries the SSOT v3 InstanceKey (instance_id = config name +
-  # secondary physical_id) and the Publisher physical_id: kwargs the
-  # discovery actor calls. 0.7.0 publishers reject the physical_id: kwarg.
-  spec.add_dependency 'lex-llm', '>= 0.7.1'
+  # 0.8.0 is the complete contract cut: the canonical-only funnel
+  # (positional completion messages, Canonical::Params at the render boundary),
+  # the Registry-snapshot read path, fleet v3 exact execution, and the
+  # conformance kit the ssot_v3 conformance spec runs.
+  spec.add_dependency 'lex-llm', '>= 0.8.0'
 end

data/lib/legion/extensions/llm/mlx/actors/discovery.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require 'legion/extensions/llm/discovery/actor'
+
+# The base discovery actor only exists inside the daemon (it inherits the
+# LegionIO time-based Every actor). In a standalone load, define nothing.
+return unless defined?(Legion::Extensions::Llm::Discovery::Actor)
+
+module Legion
+  module Extensions
+    module Llm
+      module Mlx
+        module Actor
+          # Mlx discovery actor: an EMPTY subclass of the shared base. The
+          # timer, dispatch, and runner-resolution convention are inherited — this
+          # class redefines nothing. The Mlx-specific work lives in
+          # Mlx::Runners::Discovery, resolved by the base from this
+          # namespace.
+          class Discovery < Legion::Extensions::Llm::Discovery::Actor; end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/llm/mlx/helpers/callable.rb

@@ -0,0 +1,162 @@
+# frozen_string_literal: true
+
+require 'faraday'
+
+require 'legion/extensions/llm/routing/provider_outcome'
+require 'legion/extensions/llm/canonical'
+require 'legion/extensions/llm/mlx/provider'
+
+module Legion
+  module Extensions
+    module Llm
+      module Mlx
+        module Helpers
+          # Callable wrapper for an MLX provider instance. It is the
+          # exact-execution dispatch target: it implements the fleet dispatch
+          # operations (chat, stream_chat, embed, count_tokens) by delegating
+          # to a per-instance Mlx::Provider built from the instance config,
+          # plus the `disconnect` and `normalize_dispatch_error(error:)`
+          # contracts required by Inventory::CallableHandle and
+          # Routing::ProviderOutcome. Provider and Faraday errors are NOT
+          # rescued here so the dispatch normalizer can classify them.
+          # 0.8.0 callable contract: chat/stream_chat take the rehydrated
+          # message array positionally (WorkerExecution dispatch shape) and
+          # the Selection-derived model as a bare String.
+          class Callable
+            # Keys the base Provider exposes as named kwargs for the
+            # completion operations. Anything else the fleet passes (sampling
+            # scalars, `temperature` — a Canonical::Params member, 05 O4) is
+            # folded into Canonical::Params at the dispatch boundary.
+            COMPLETION_NAMED_KEYS = %i[tools schema thinking tool_prefs headers].freeze
+            EMBED_NAMED_KEYS = %i[dimensions headers].freeze
+
+            def initialize(instance_cfg:, logger:)
+              @instance_cfg = instance_cfg
+              @logger = logger
+              @disconnected = false
+              @inference_calls = 0
+            end
+
+            def call_count
+              @inference_calls
+            end
+
+            def disconnected?
+              @disconnected
+            end
+
+            def disconnect
+              @disconnected = true
+              @provider&.disconnect
+              @logger.debug { '[mlx][callable] disconnected' }
+            end
+
+            # ── Fleet dispatch operations ───────────────────────────────────
+
+            def chat(messages, model:, **rest)
+              record_inference
+              # Canonical boundary (N x N law): pipeline dispatch delivers
+              # Canonical::Message objects only. Hash/legacy shapes are the
+              # bypass class — reject loudly, never coerce.
+              provider.enforce_canonical_messages!(messages)
+              named, params = split_fleet_kwargs(rest, COMPLETION_NAMED_KEYS)
+              provider.chat(messages, model: model, params: canonical_params(params), **named)
+            end
+
+            def stream_chat(messages, model:, **rest, &)
+              record_inference
+              provider.enforce_canonical_messages!(messages)
+              named, params = split_fleet_kwargs(rest, COMPLETION_NAMED_KEYS)
+              provider.stream_chat(messages, model: model, params: canonical_params(params), **named, &)
+            end
+
+            def embed(text:, model:, **rest)
+              record_inference
+              named, params = split_fleet_kwargs(rest, EMBED_NAMED_KEYS)
+              provider.embed(text: text, model: model, params: params, **named)
+            end
+
+            def count_tokens(messages:, model:, **rest)
+              record_inference
+              provider.enforce_canonical_messages!(messages)
+              _named, params = split_fleet_kwargs(rest, [])
+              provider.count_tokens(messages: messages, model: model, params: params)
+            end
+
+            def normalize_dispatch_error(error:)
+              reason = error.message.to_s[0, 512]
+              kind = classify_error_kind(error: error)
+
+              Legion::Extensions::Llm::Routing::ProviderOutcome.new(
+                kind: kind,
+                reason: reason.empty? ? 'unknown dispatch error' : reason
+              )
+            end
+
+            private
+
+            def record_inference
+              @inference_calls += 1
+            end
+
+            def provider
+              @provider ||= Legion::Extensions::Llm::Mlx::Provider.new(@instance_cfg)
+            end
+
+            # The 0.8.0 completion funnel receives canonical values only
+            # (08 F3): the folded wire params become a Canonical::Params at
+            # the dispatch boundary — temperature is a params member (05 O4),
+            # never a kwarg.
+            def canonical_params(params)
+              Legion::Extensions::Llm::Canonical::Params.from_hash(params)
+            end
+
+            # Split the fleet's **rest into the base Provider's named kwargs
+            # and a payload params hash (any passed :params merged with
+            # unknown keys).
+            def split_fleet_kwargs(rest, named_keys)
+              named = rest.slice(*named_keys)
+              extra = rest.reject { |key, _| named.key?(key) }
+              params = (extra.delete(:params) || {}).to_h.merge(extra)
+              [named, params]
+            end
+
+            def classify_error_kind(error:)
+              case error
+              when Faraday::ConnectionFailed then :connection_failure
+              when Faraday::TimeoutError then :timeout
+              when Faraday::ClientError then classify_client_error(error: error)
+              when Faraday::ServerError then classify_server_error(error: error)
+              when Legion::Extensions::Llm::OverloadedError then :overloaded
+              else :provider_error
+              end
+            end
+
+            def classify_client_error(error:)
+              status = error.respond_to?(:response_status) ? error.response_status : nil
+              case status
+              when 401 then :authentication
+              when 403 then :authorization
+              when 404 then :model_missing
+              when 429 then :rate_limited
+              else :invalid_request
+              end
+            end
+
+            def classify_server_error(error:)
+              # NEVER classify raw 503/529/5xx as instance_unavailable by status alone.
+              # Only an explicit flat MLX service/instance-unavailable signal (which MLX
+              # does not produce) would justify instance_unavailable. For MLX, connection
+              # failure (port unreachable) is the signal the instance is down.
+              status = error.respond_to?(:response_status) ? error.response_status : nil
+              case status
+              when 503, 529 then :overloaded
+              else :provider_error
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/llm/mlx/provider.rb

@@ -30,56 +30,6 @@ module Legion
           end
         end
 
-        # Capability config helpers — mix into Provider.
-        module CapabilityConfig
-          private
-
-          def provider_capability_config
-            conf = Legion::Extensions::Llm::CredentialSources.setting(:extensions, :llm, :mlx)
-            conf.is_a?(Hash) ? conf.to_h.except(:instances, 'instances') : {}
-          rescue StandardError => e
-            handle_exception(e, level: :warn, handled: true, operation: 'mlx.provider_capability_config')
-            {}
-          end
-
-          def instance_capability_config
-            cfg = config
-            result = {}
-            %i[capabilities enable_thinking enable_tools enable_streaming enable_vision enable_embeddings
-               thinking_flag tools_flag streaming_flag vision_flag embedding_flag embeddings_flag
-               tool_flag images_flag image_flag].each do |key|
-              next unless cfg.respond_to?(key)
-
-              val = cfg.send(key)
-              result[key] = val unless val.nil?
-            rescue StandardError => e
-              handle_exception(e, level: :warn, handled: true, operation: 'mlx.provider.instance_capability_config')
-              next
-            end
-            result
-          end
-
-          def model_capability_config(model_id)
-            models_conf = fetch_models_config
-            return {} unless models_conf
-
-            hash = models_conf.to_h
-            hash[model_id.to_s] || hash[model_id.to_sym] || {}
-          rescue StandardError => e
-            handle_exception(e, level: :warn, handled: true, operation: 'mlx.model_capability_config')
-            {}
-          end
-
-          def fetch_models_config
-            conf = config.models if config.respond_to?(:models)
-            conf ||= config[:models] if config.respond_to?(:[])
-            conf if conf.respond_to?(:to_h)
-          rescue StandardError => e
-            handle_exception(e, level: :warn, handled: true, operation: 'mlx.fetch_models_config')
-            nil
-          end
-        end
-
         # Health payload helpers — mix into Provider.
         module HealthHelpers
           private
@@ -110,62 +60,10 @@ module Legion
           end
         end
 
-        # Capability resolution helpers — mix into Provider.
-        module CapabilityResolution
-          private
-
-          def resolve_capability_policy(model_info)
-            Legion::Extensions::Llm::CapabilityPolicy.resolve(
-              real: extract_real_capabilities(model_info),
-              provider_catalog: extract_catalog_capabilities(model_info),
-              probe: {},
-              provider_envelope: provider_envelope_capabilities,
-              provider_config: provider_capability_config,
-              instance_config: instance_capability_config,
-              model_config: model_capability_config(model_info.id)
-            )
-          end
-
-          def extract_real_capabilities(model_info)
-            return {} unless model_info.respond_to?(:metadata)
-
-            meta = model_info.metadata
-            return {} unless meta.is_a?(Hash)
-
-            caps = meta[:capabilities]
-            caps.is_a?(Hash) ? caps : {}
-          end
-
-          def extract_catalog_capabilities(_model_info)
-            # Regex-based name matching is not authoritative evidence.
-            # Unverified capability support is unknown, not promoted to supported.
-            {}
-          end
-
-          def embedding_model?(model_id)
-            model_id.to_s.match?(/embed|bge|e5|nomic/i)
-          end
-
-          def provider_envelope_capabilities
-            # No capabilities are advertised at the envelope level without endpoint evidence.
-            {}
-          end
-
-          def offering_metadata_for(model_info)
-            {
-              raw_model: model_info.id,
-              parameter_count: model_info.respond_to?(:parameter_count) ? model_info.parameter_count : nil,
-              quantization: model_info.respond_to?(:quantization) ? model_info.quantization : nil
-            }.compact
-          end
-        end
-
         # MLX provider implementation for local OpenAI-compatible servers.
         class Provider < Legion::Extensions::Llm::Provider
           include Legion::Extensions::Llm::Provider::OpenAICompatible
-          include CapabilityConfig
           include HealthHelpers
-          include CapabilityResolution
 
           class << self
             def slug = 'mlx'
@@ -215,45 +113,6 @@ module Legion
             log.info("Checking MLX readiness (live=#{live})")
             super
           end
-
-          def list_models(**)
-            log.info('Listing available MLX models')
-            models = super
-            log.info("Discovered #{Array(models).size} MLX models")
-            models
-          end
-
-          def offering_from_model(model_info, health: {})
-            policy = resolve_capability_policy(model_info)
-            Legion::Extensions::Llm::Routing::ModelOffering.new(**build_offering_kwargs(
-              model_info: model_info, policy: policy, health: health
-            ))
-          end
-
-          private
-
-          def build_offering_kwargs(model_info:, policy:, health:)
-            {
-              provider_family: :mlx,
-              instance_id: provider_instance_id,
-              transport: offering_transport,
-              tier: offering_tier,
-              model: model_info.id,
-              canonical_model_alias: model_info.respond_to?(:name) ? model_info.name : nil,
-              model_family: model_info.respond_to?(:family) ? model_info.family : nil,
-              usage_type: embedding_model?(model_info.id) ? :embedding : :inference,
-              capabilities: policy[:capabilities],
-              capability_sources: policy[:sources],
-              limits: extract_model_limits(model_info),
-              health: health,
-              metadata: offering_metadata_for(model_info).merge(capability_sources: policy[:sources])
-            }
-          end
-
-          def extract_model_limits(model_info)
-            ctx = model_info.respond_to?(:context_length) ? model_info.context_length : nil
-            { context_window: ctx }.compact
-          end
         end
       end
     end