lex-llm 0.7.3 → 0.8.0

data/spec/legion/extensions/llm/conformance/ssot_contract_examples.rb

@@ -0,0 +1,507 @@
+# frozen_string_literal: true
+
+# 09 §2–§4 — boundary (B), fleet (F), and registry (R) conformance shared
+# examples. The kit is the single oracle: provider gems load these and run
+# them against their REAL callable boundary and the shared Registry/Responder.
+#
+# The host spec provides:
+#   let(:callable)    — a 0.8.0 callable: chat(messages, model:, ...),
+#                       stream_chat(messages, model:, ...) yielding
+#                       Canonical::Chunk, count_tokens(messages:, model:)
+#   let(:registry)    — Legion::Extensions::Llm::Inventory::Registry
+#   let(:key)         — an InstanceKey for the activated scope
+#   let(:lane_id)     — a 5-tuple lane id on the activated instance
+#                       (tier:provider_family:instance_id:type:model)
+#   let(:callable_handle) — the activated instance's CallableHandle (B6)
+#   let(:activated)   — true once the scope is activated (F/R groups)
+
+# The kit's single operation-evidence builder: one supported operation, the
+# rest unknown. Kept here so every host resolves the 5-tuple type the same way.
+module KitEvidenceSupport
+  def kit_operation_evidence(operation)
+    LLM::Taxonomies::OPERATIONS.to_h do |op|
+      status, source = op == operation ? %i[supported provider_implementation] : %i[unknown absent]
+      [op, INV::OperationEvidence.new(operation: op, status: status, source: source)]
+    end
+  end
+end
+
+LLM  = Legion::Extensions::Llm
+CAN  = LLM::Canonical
+INV  = LLM::Inventory
+
+RSpec.shared_examples 'B1 — central canonical enforcement (08 F2)' do
+  let(:canonical_messages) { [CAN::Message.build(role: :user, content: 'hi')] }
+
+  [
+    ['a raw Hash message', [{ role: 'user', content: 'x' }]],
+    ['a String element', ['not canonical']],
+    ['a nil element', [nil]]
+  ].each do |label, bad_messages|
+    it "chat rejects #{label} with a typed ArgumentError" do
+      expect { callable.chat(bad_messages, model: 'm') }
+        .to raise_error(ArgumentError, /Canonical::Message/)
+    end
+
+    it "stream_chat rejects #{label} with a typed ArgumentError" do
+      # rubocop:disable Lint/EmptyBlock -- the block never runs: enforcement raises first
+      expect { callable.stream_chat(bad_messages, model: 'm') { |_c| } }
+        .to raise_error(ArgumentError, /Canonical::Message/)
+      # rubocop:enable Lint/EmptyBlock
+    end
+
+    it "count_tokens rejects #{label} with a typed ArgumentError" do
+      expect { callable.count_tokens(messages: bad_messages, model: 'm') }
+        .to raise_error(ArgumentError, /Canonical::Message/)
+    end
+  end
+
+  it 'accepts a canonical Array<Canonical::Message>' do
+    expect { callable.chat(canonical_messages, model: 'm') }.not_to raise_error
+  end
+end
+
+# H3: the tools half of the same boundary — one contract, one oracle.
+# A non-empty tools value must be Hash<name, Canonical::ToolDefinition>;
+# Hash/legacy tool values raise before any provider rendering.
+RSpec.shared_examples 'B1b — central canonical tool enforcement (H3)' do
+  let(:tool) { CAN::ToolDefinition.build(name: 'get_weather') }
+
+  it 'chat accepts Hash<name, Canonical::ToolDefinition>' do
+    expect do
+      callable.chat([CAN::Message.build(role: :user, content: 'hi')], model: 'm',
+                                                                      tools: { get_weather: tool })
+    end.not_to raise_error
+  end
+
+  it 'chat rejects Hash tool values with a typed ArgumentError' do
+    expect do
+      callable.chat([CAN::Message.build(role: :user, content: 'hi')], model: 'm',
+                                                                      tools: { get_weather: { name: 'get_weather' } })
+    end
+      .to raise_error(ArgumentError, /Canonical::ToolDefinition/)
+  end
+
+  it 'chat rejects a non-Hash tools container with a typed ArgumentError' do
+    expect do
+      callable.chat([CAN::Message.build(role: :user, content: 'hi')], model: 'm',
+                                                                      tools: [tool])
+    end
+      .to raise_error(ArgumentError, /Hash<name, Canonical::ToolDefinition>/)
+  end
+end
+
+RSpec.shared_examples 'B2 — canonical outputs (05 O5, 08 R2)' do
+  it 'chat returns a Canonical::Response (asserted by type)' do
+    expect(callable.chat([CAN::Message.build(role: :user, content: 'hi')], model: 'm'))
+      .to be_a(CAN::Response)
+  end
+
+  it 'stream_chat yields Canonical::Chunk objects ending in exactly one done chunk' do
+    chunks = []
+    callable.stream_chat([CAN::Message.build(role: :user, content: 'hi')], model: 'm') { |c| chunks << c }
+
+    expect(chunks.size).to be > 0
+    expect(chunks).to all(be_a(CAN::Chunk))
+    expect(chunks.count(&:done?)).to eq(1)
+    expect(chunks.last).to be_done
+  end
+end
+
+RSpec.shared_examples 'B3 — operation preservation (PR #189 defect class)' do
+  it 'a stream_chat dispatch invokes the stream_chat callable, never chat' do
+    chat_invocations = 0
+    stream_invocations = 0
+    allow(callable).to receive(:chat).and_wrap_original do |original, *args, **kwargs|
+      chat_invocations += 1
+      original.call(*args, **kwargs)
+    end
+    allow(callable).to receive(:stream_chat).and_wrap_original do |_original, *_args, &block|
+      stream_invocations += 1
+      block&.call(CAN::Chunk.done(request_id: nil))
+    end
+
+    # rubocop:disable Lint/EmptyBlock -- the block is the assertion target
+    callable.stream_chat([CAN::Message.build(role: :user, content: 'hi')], model: 'm') { |_c| }
+    # rubocop:enable Lint/EmptyBlock
+
+    expect(stream_invocations).to eq(1)
+    expect(chat_invocations).to eq(0)
+  end
+end
+
+RSpec.shared_examples 'B4 — no model re-derivation (PR #45 law)' do
+  it 'the Selection-derived model reaches the callable unchanged' do
+    response = callable.chat([CAN::Message.build(role: :user, content: 'hi')], model: 'selected-model-x')
+    expect(response.model).to eq('selected-model-x')
+  end
+end
+
+RSpec.shared_examples 'B5 — no weight recomputation (PR #47 defect class)' do
+  include KitEvidenceSupport
+
+  it 'the lane keeps the write-time pair even when settings would compute a different one' do
+    lane = registry.snapshot.lanes_for(instance_key: key).first
+    expect(lane.base_weight).to eq(100 * 50 * 2 * 1)
+
+    # A later settings read (e.g. after an operator change) would compute a
+    # different pair — the stored lane pair is consumed as-is.
+    family = key.provider_family.to_sym
+    other_inputs = LLM::Inventory.const_get(:WeightSchema).weight_inputs(
+      settings: { extensions: { llm: { family => { weight: 77, instances: { key.instance_id.to_sym => { weight: 77 } } } } },
+                  llm: { routing: { tier_weights: { local: 100 } } } },
+      instance_key: key, model: lane.model, tier: :local,
+      operation_evidence: kit_operation_evidence(lane.operation)
+    )
+    expect(other_inputs).to eq(tier: 100, provider: 77, instance: 77, model_or_offering: 100)
+    expect(registry.snapshot.lanes_for(instance_key: key).first.base_weight).to eq(10_000)
+  end
+end
+
+RSpec.shared_examples 'B6 — zero-weight disable (U4)' do
+  it 'Selection validation accepts a zero component (operator disable)' do
+    selection = LLM::Routing::Selection.new(
+      inventory_generation: 7, lane_id: lane_id, instance_key: instance_key,
+      provider_family: instance_key.provider_family, instance_id: instance_key.instance_id,
+      model: 'gemma4', operation: :chat, callable_handle: callable_handle,
+      publisher_token_id: 'ptok:v1:abc', capability_evidence: {},
+      context_evidence: INV::ValueEvidence.new(status: :unknown, source: :absent),
+      weight_inputs: { tier: 100, provider: 0, instance: 100, model_or_offering: 100 },
+      base_weight: 0, preference_ppm: 1_000_000, effective_weight: 0, rendezvous_score: 1
+    )
+    expect(selection.base_weight).to eq(0)
+    expect(selection.weight_inputs[:provider]).to eq(0)
+  end
+
+  it 'Selection validation still rejects a negative component' do
+    expect do
+      LLM::Routing::Selection.new(
+        inventory_generation: 7, lane_id: lane_id, instance_key: instance_key,
+        provider_family: instance_key.provider_family, instance_id: instance_key.instance_id,
+        model: 'gemma4', operation: :chat, callable_handle: callable_handle,
+        publisher_token_id: 'ptok:v1:abc', capability_evidence: {},
+        context_evidence: INV::ValueEvidence.new(status: :unknown, source: :absent),
+        weight_inputs: { tier: 100, provider: -1, instance: 100, model_or_offering: 100 },
+        base_weight: 0, preference_ppm: 1_000_000, effective_weight: 0, rendezvous_score: 1
+      )
+    end.to raise_error(INV::Errors::ValidationError, /nonnegative/)
+  end
+end
+
+RSpec.shared_examples 'B7 — health authority (RULES 9)' do
+  it 'transient provider outcomes do not change instance availability' do
+    outcome = callable.normalize_dispatch_error(error: LLM::RateLimitError.new(nil, 'slow down'))
+    expect(outcome.kind).to eq(:rate_limited)
+    expect(outcome.kind).not_to eq(:instance_unavailable)
+    expect(registry.snapshot.instance(instance_key: key).availability.state).to eq(:available)
+  end
+
+  it 'only the authoritative dispatch path marks the instance unavailable' do
+    health_key = INV::Identity::InstanceKey.new(provider_family: key.provider_family, instance_id: 'health-b')
+    health_coordinator = LLM::Inventory::ProbeCoordinator.new(instance_key: health_key, enqueue: ->(**) { true })
+    token = registry.claim_instance(instance_key: health_key, callable: Object.new, probe_request_handle: health_coordinator)
+    probe = registry.readiness_probe_started(instance_key: health_key, publisher_token: token)
+    registry.activate_instance_snapshot(publisher_token: token, instance_key: health_key,
+                                        offerings: drafts, sequence: 0, probe_token: probe)
+    record = registry.snapshot.instance(instance_key: health_key)
+    registry.dispatch_instance_unavailable(
+      instance_key: health_key, publisher_token_id: record.publisher_token_id, reason: 'node down'
+    )
+    expect(registry.snapshot.instance(instance_key: health_key).availability.state).to eq(:unavailable)
+  end
+end
+
+RSpec.shared_examples 'B8 — exact execution never downgrades (06 P2/W1)' do
+  it 'a fleet envelope without the exact marker is rejected' do
+    legacy_envelope = LLM::Fleet::FleetEnvelope.new(
+      data: exact_envelope_data.except(:execution_contract, :offering_id)
+    )
+    expect { LLM::Fleet::ProviderResponder.check_envelope!(legacy_envelope, provider_family: key.provider_family.to_s) }
+      .to raise_error(ArgumentError, /execution_contract is required/)
+  end
+
+  it 'the provider-object dispatch path does not exist' do
+    expect(LLM::Fleet::ProviderResponder).not_to respond_to(:build_provider)
+    expect(LLM::Fleet::WorkerExecution).not_to respond_to(:dispatch_local_provider!)
+  end
+end
+
+RSpec.shared_examples 'B9 — no silent defaults (06 W5)' do
+  it 'a missing per-operation param raises, never a default' do
+    expect { LLM::Fleet::WorkerExecution.call(envelope: exact_envelope_data.merge(params: {}), registry: registry) }
+      .to raise_error(LLM::Fleet::ContractError, /requires the messages param/)
+  end
+
+  it 'a params-supplied model raises — the Selection model is the only model' do
+    bad = exact_envelope_data.merge(params: { messages: [], model: 'other' })
+    expect { LLM::Fleet::WorkerExecution.call(envelope: bad, registry: registry) }
+      .to raise_error(LLM::Fleet::ContractError, /must not contain model/)
+  end
+end
+
+RSpec.shared_examples 'F1 — envelope round-trip (06 E2)' do
+  it 'FleetRequest encode → JSON → parse carries every required field' do
+    request = LLM::Transport::Messages::FleetRequest.new(**valid_request_options)
+    wire = Legion::JSON.load(Legion::JSON.dump(request.message))
+
+    LLM::Fleet::Protocol::REQUIRED_FIELDS.each do |field|
+      expect(wire).to have_key(field)
+      # JSON normalizes the wire: compare in wire form (symbols become strings).
+      expect(wire[field].is_a?(Hash) ? wire[field].transform_keys(&:to_s) : wire[field].to_s)
+        .to eq(request.message[field].is_a?(Hash) ? request.message[field].transform_keys(&:to_s) : request.message[field].to_s)
+    end
+  end
+end
+
+RSpec.shared_examples 'F2 — rehydration identity (06 W4, E01)' do
+  it 'JSON-round-tripped wire messages rehydrate to Data-equal Canonical::Message' do
+    original = CAN::Message.build(
+      role: :user, content: 'hi', cache_control: { type: :ephemeral },
+      tool_calls: [CAN::ToolCall.build(name: 'f', id: 'c1', arguments: { a: 1 })]
+    )
+    wire = Legion::JSON.load(Legion::JSON.dump([original.to_h]))
+    rehydrated = LLM::Fleet::WorkerExecution.rehydrate_wire_messages(wire)
+
+    expect(rehydrated.size).to eq(1)
+    rehydrated_message = rehydrated.first
+    expect(rehydrated_message).to be_a(CAN::Message)
+    expect(rehydrated_message.id).to eq(original.id)
+    expect(rehydrated_message.role).to eq(:user)
+    expect(rehydrated_message.content).to eq('hi')
+    expect(rehydrated_message.tool_calls.first.name).to eq('f')
+    expect(rehydrated_message.tool_calls.first.arguments).to eq(a: 1)
+    # E01: cache_control survives the full JSON wire round-trip.
+    expect(rehydrated_message.cache_control).to eq(type: 'ephemeral')
+  end
+
+  it 'a raw Hash message can NOT reach a callable — rehydration raises' do
+    expect { LLM::Fleet::WorkerExecution.rehydrate_wire_messages(['not a message']) }
+      .to raise_error(LLM::Fleet::ContractError, /serialized Canonical::Message/)
+  end
+end
+
+RSpec.shared_examples 'F3 — signing law (06 S3)' do
+  it 'verifies exact claims unconditionally — a missing marker claim is a TokenError' do
+    expect do
+      LLM::Fleet::TokenValidator.validate_exact_execution_claims!({}, { operation: 'chat' })
+    end.to raise_error(LLM::Fleet::TokenError, /missing signed execution_contract/)
+  end
+
+  it 'a tampered offering_id claim is a TokenError' do
+    claims = {
+      execution_contract: LLM::Fleet::Protocol::EXACT_EXECUTION_CONTRACT,
+      offering_id: 'local:other:other:inference:other'
+    }
+    expect do
+      LLM::Fleet::TokenValidator.validate_exact_execution_claims!(claims, exact_envelope_data)
+    end.to raise_error(LLM::Fleet::TokenError, /offering_id claim mismatch/)
+  end
+end
+
+RSpec.shared_examples 'F4 — fencing (07 §3)' do
+  let(:fence_key) { INV::Identity::InstanceKey.new(provider_family: 'kit', instance_id: 'fence') }
+  let(:fence_coordinator) do
+    LLM::Inventory::ProbeCoordinator.new(instance_key: fence_key, enqueue: ->(**) { true })
+  end
+
+  it 'a superseded publisher token is fenced' do
+    registry.reset!
+    token1 = registry.claim_instance(instance_key: fence_key, callable: Object.new, probe_request_handle: fence_coordinator)
+    registry.claim_instance(instance_key: fence_key, callable: Object.new, probe_request_handle: fence_coordinator)
+    expect { registry.readiness_probe_started(instance_key: fence_key, publisher_token: token1) }
+      .to raise_error(INV::Errors::FencedPublisherError)
+  end
+
+  it 'a sequence at or below the claim baseline is rejected (StaleSequenceError)' do
+    first = registry.claim_instance(instance_key: fence_key, callable: Object.new, probe_request_handle: fence_coordinator)
+    probe = registry.readiness_probe_started(instance_key: fence_key, publisher_token: first)
+    expect do
+      registry.activate_instance_snapshot(publisher_token: first, instance_key: fence_key,
+                                          offerings: drafts, sequence: -1, probe_token: probe)
+    end.to raise_error(INV::Errors::StaleSequenceError)
+  end
+end
+
+RSpec.shared_examples 'F5 — response envelope (06 E3/E4)' do
+  it 'carries the serialized Canonical::Response and never the thinking member' do
+    thinking_callable = Class.new do
+      def chat(_messages, model:, **_rest)
+        CAN::Response.build(
+          text: 'done', model: model, stop_reason: :end_turn,
+          thinking: CAN::Thinking.build(content: 'secret-reasoning')
+        )
+      end
+    end.new
+    thinking_key = INV::Identity::InstanceKey.new(provider_family: 'fake_llm', instance_id: 'thinking')
+    token = registry.claim_instance(instance_key: thinking_key, callable: thinking_callable,
+                                    probe_request_handle: LLM::Inventory::ProbeCoordinator.new(
+                                      instance_key: thinking_key, enqueue: ->(**) { true }
+                                    ))
+    probe = registry.readiness_probe_started(instance_key: thinking_key, publisher_token: token)
+    thinking_lane = INV::Identity.compose_lane_id(
+      tier: :local, provider_family: thinking_key.provider_family, instance_id: thinking_key.instance_id,
+      type: LLM::Taxonomies.lane_type_for(operation: :chat), model: 'gemma4'
+    )
+    registry.activate_instance_snapshot(publisher_token: token, instance_key: thinking_key,
+                                        offerings: [
+                                          INV::OfferingDraft.new(
+                                            provider_native_key: 'gemma4', model: 'gemma4', tier: :local,
+                                            operation_evidence: operation_evidence_map,
+                                            context_evidence: unknown_value, max_output_evidence: unknown_value,
+                                            embedding_dimensions_evidence: unknown_value,
+                                            model_revision_evidence: unknown_value, tokenizer_evidence: unknown_value,
+                                            publication_source: :provider_catalog
+                                          )
+                                        ], sequence: 0, probe_token: probe)
+
+    published_args = nil
+    response_double = instance_double(LLM::Transport::Messages::FleetResponse, publish: true)
+    allow(LLM::Transport::Messages::FleetResponse).to receive(:new) do |*args|
+      published_args = args
+      response_double
+    end
+
+    LLM::Fleet::ProviderResponder.call(
+      payload: exact_envelope_data.merge(provider_instance: 'thinking', offering_id: thinking_lane),
+      provider_family: exact_envelope_data[:provider],
+      registry: registry
+    )
+
+    expect(published_args.first[:response]).to include(text: 'done')
+    expect(published_args.first[:response]).not_to have_key(:thinking)
+    expect(response_double).to have_received(:publish)
+  end
+end
+
+RSpec.shared_examples 'F6 — contract errors (06 §5)' do
+  {
+    'a non-Hash wire message' => ->(data) { data.merge(params: { messages: ['nope'] }) },
+    'duplicate param spellings' => ->(data) { data.merge(params: { 'messages' => [], :messages => [] }) },
+    'an unknown operation' => ->(data) { data.merge(operation: 'teleport') }
+  }.each do |label, mutator|
+    it "#{label} is a Fleet::ContractError, never a silent substitute" do
+      expect { LLM::Fleet::WorkerExecution.call(envelope: mutator.call(exact_envelope_data), registry: registry) }
+        .to raise_error(LLM::Fleet::ContractError)
+    end
+  end
+end
+
+RSpec.shared_examples 'F7 — retryability (06 F6)' do
+  it 'contract, policy, and auth errors are never retryable' do
+    responder = LLM::Fleet::ProviderResponder
+    expect(responder.retryable_error?(LLM::Fleet::ContractError.new('x'))).to be(false)
+    expect(responder.retryable_error?(LLM::Fleet::WorkerExecution::PolicyError.new('x'))).to be(false)
+    expect(responder.retryable_error?(LLM::Fleet::TokenError.new('x'))).to be(false)
+    expect(responder.retryable_error?(INV::Errors::ExactOfferingMismatchError.new('x'))).to be(false)
+  end
+
+  it 'transient kinds are retryable' do
+    responder = LLM::Fleet::ProviderResponder
+    expect(responder.retryable_error?(LLM::RateLimitError.new(nil, 'x'))).to be(true)
+    expect(responder.retryable_error?(LLM::OverloadedError.new(nil, 'x'))).to be(true)
+    expect(responder.retryable_error?(Timeout::Error.new('x'))).to be(true)
+  end
+end
+
+RSpec.shared_examples 'R1 — state machine (07 §3)' do
+  let(:r1_key) { INV::Identity::InstanceKey.new(provider_family: 'kit', instance_id: 'r1') }
+  let(:r1_coordinator) { LLM::Inventory::ProbeCoordinator.new(instance_key: r1_key, enqueue: ->(**) { true }) }
+
+  it 'activate without a claim is invalid' do
+    registry.reset!
+    expect do
+      registry.activate_instance_snapshot(publisher_token: 'forged', instance_key: r1_key,
+                                          offerings: drafts, sequence: 0)
+    end.to raise_error(ArgumentError)
+  end
+
+  it 'a claim without activation stays initializing (no active instance)' do
+    registry.claim_instance(instance_key: r1_key, callable: Object.new, probe_request_handle: r1_coordinator)
+    expect(registry.snapshot.instance(instance_key: r1_key)).to be_nil
+    expect(registry.snapshot.publication_status(instance_key: r1_key).state).to eq(:initializing)
+  end
+end
+
+RSpec.shared_examples 'R2 — identity (07 §1, 5-tuple law)' do
+  it 'composes the same 5 tuple deterministically from the same fields' do
+    lane = INV::Identity.compose_lane_id(
+      tier: :local, provider_family: key.provider_family, instance_id: key.instance_id,
+      type: LLM::Taxonomies.lane_type_for(operation: :chat), model: 'gemma4'
+    )
+    expect(lane).to eq(
+      INV::Identity.compose_lane_id(
+        tier: :local, provider_family: key.provider_family, instance_id: key.instance_id,
+        type: LLM::Taxonomies.lane_type_for(operation: :chat), model: 'gemma4'
+      )
+    )
+    expect(INV::Identity.validate_lane_id!(value: lane)).to eq(lane)
+  end
+
+  it 'round-trips a colon-containing model through the bounded parse' do
+    lane = INV::Identity.compose_lane_id(
+      tier: :local, provider_family: key.provider_family, instance_id: key.instance_id,
+      type: :inference, model: 'model:tag:0'
+    )
+    expect(INV::Identity.parse_lane_id(lane).last).to eq('model:tag:0')
+  end
+
+  it 'rejects a value that is not a 5-tuple' do
+    expect do
+      INV::Identity.validate_lane_id!(value: 'not-a-five-tuple')
+    end.to raise_error(INV::Errors::ValidationError, /5 parts/)
+  end
+end
+
+RSpec.shared_examples 'R3 — snapshot law (07 §5)' do
+  it 'lookups return nil for absent scopes (no synthesized defaults)' do
+    absent = INV::Identity::InstanceKey.new(provider_family: 'vllm', instance_id: 'nowhere')
+    expect(registry.snapshot.instance(instance_key: absent)).to be_nil
+  end
+
+  it 'is generation-stable across later mutations' do
+    snapshot_before = registry.snapshot
+    before_record = snapshot_before.instance(instance_key: key)
+    expect(before_record).not_to be_nil
+
+    r3_key = INV::Identity::InstanceKey.new(provider_family: 'kit', instance_id: 'r3')
+    r3_coordinator = LLM::Inventory::ProbeCoordinator.new(instance_key: r3_key, enqueue: ->(**) { true })
+    registry.claim_instance(instance_key: r3_key, callable: Object.new, probe_request_handle: r3_coordinator)
+    expect(snapshot_before.generation).not_to eq(registry.snapshot.generation)
+    # The captured snapshot still serves its own generation's records.
+    expect(snapshot_before.instance(instance_key: key)).to eq(before_record)
+  end
+end
+
+RSpec.shared_examples 'R4 — weight law (07 §4)' do
+  it 'accepts zero (operator disable), rejects non-Integer, and requires base == product' do
+    schema = LLM::Inventory.const_get(:WeightSchema)
+    zero = { tier: 100, provider: 0, instance: 100, model_or_offering: 100 }
+    expect(schema.base_weight(zero)).to eq(0)
+
+    expect do
+      INV::RecordSupport.validated_weight_pair(
+        weight_inputs: { tier: '100', provider: 0, instance: 100, model_or_offering: 100 }, base_weight: 0
+      )
+    end.to raise_error(INV::Errors::ValidationError)
+
+    expect do
+      INV::RecordSupport.validated_weight_pair(
+        weight_inputs: zero, base_weight: 1
+      )
+    end.to raise_error(INV::Errors::ValidationError, /product/)
+  end
+end
+
+RSpec.shared_examples 'R5 — callable lifecycle (07 §6)' do
+  it 'acquires a lease exposing the exact captured callable and releases it' do
+    handle = registry.snapshot.instance(instance_key: key).callable_handle
+    lease = registry.acquire(callable_handle: handle)
+    expect(lease.callable).to be(callable)
+    lease.release
+  end
+
+  it 'an unknown handle is rejected' do
+    expect { registry.acquire(callable_handle: Object.new) }
+      .to raise_error(INV::Errors::UnknownCallableError)
+  end
+end

data/spec/legion/extensions/llm/conformance/ssot_provider_examples.rb

@@ -78,7 +78,7 @@ RSpec.shared_examples 'an SSOT v3 provider adapter' do
     lane_a = snapshot.lanes_for(instance_key: a[:key]).first
     lane_b = snapshot.lanes_for(instance_key: b[:key]).first
     expect(lane_a.lane_id).not_to eq(lane_b.lane_id)
-    expect(lane_a.offering_id).not_to eq(lane_b.offering_id)
+    expect(lane_a.lane_id).to match(/\A[a-z_]+:[a-z_]+:[^:]+:[a-z_]+:.+\z/)
   end
 
   it 'exposes no selector-visible model or callable before startup readiness' do
@@ -107,22 +107,23 @@ RSpec.shared_examples 'an SSOT v3 provider adapter' do
   it 'supports complete refresh, complete empty, and failed-refresh retention' do
     context = bring_up(configs[0])
     context[:publisher].replace_instance_snapshot(instance_id: context[:key].instance_id, publisher_token: context[:token], offerings: context[:drafts], sequence: 1)
-    expect(registry.snapshot.offerings_for(instance_key: context[:key]).size).to eq(1)
+    expect(registry.snapshot.lanes_for(instance_key: context[:key]).size).to eq(1)
     context[:publisher].replace_instance_snapshot(instance_id: context[:key].instance_id, publisher_token: context[:token], offerings: [], sequence: 2)
-    expect(registry.snapshot.offerings_for(instance_key: context[:key])).to be_empty
+    expect(registry.snapshot.lanes_for(instance_key: context[:key])).to be_empty
     expect do
       context[:publisher].replace_instance_snapshot(instance_id: context[:key].instance_id, publisher_token: context[:token], offerings: [], sequence: 2)
     end.to raise_error(Legion::Extensions::Llm::Inventory::Errors::StaleSequenceError)
   end
 
-  it 'preserves offering and lane identity across a tier-only republication' do
+  it 'reflects a tier change in the lane id (tier is the 5 tuple first part)' do
     context = bring_up(configs[0], tier: :local)
-    before_offering = registry.snapshot.offerings_for(instance_key: context[:key]).first.offering_id
     before_lane = registry.snapshot.lanes_for(instance_key: context[:key]).first.lane_id
+    expect(before_lane).to start_with('local:')
     frontier_drafts = ssot_harness.build_offering_drafts(instance_config: configs[0], callable: context[:callable], tier: :frontier)
     context[:publisher].replace_instance_snapshot(instance_id: context[:key].instance_id, publisher_token: context[:token], offerings: frontier_drafts, sequence: 1)
-    expect(registry.snapshot.offerings_for(instance_key: context[:key]).first.offering_id).to eq(before_offering)
-    expect(registry.snapshot.lanes_for(instance_key: context[:key]).first.lane_id).to eq(before_lane)
+    after_lane = registry.snapshot.lanes_for(instance_key: context[:key]).first.lane_id
+    expect(after_lane).to start_with('frontier:')
+    expect(after_lane).not_to eq(before_lane)
   end
 
   it 'refuses recovery from a stale probe started before the failure' do
@@ -154,11 +155,11 @@ RSpec.shared_examples 'an SSOT v3 provider adapter' do
   it 'executes an exact fleet request against only the captured callable' do
     allow(Legion::Extensions::Llm::Fleet::WorkerExecution).to receive_messages(validate_identity!: true, validate_idempotency!: nil)
     context = bring_up(configs[0])
-    offering = registry.snapshot.offerings_for(instance_key: context[:key]).first
+    lane = registry.snapshot.lanes_for(instance_key: context[:key]).first
     envelope = {
       execution_contract: Legion::Extensions::Llm::Fleet::Protocol::EXACT_EXECUTION_CONTRACT,
-      offering_id: offering.offering_id, provider: ssot_harness.provider_family.to_s,
-      provider_instance: context[:key].instance_id, model: offering.model, operation: 'chat', params: { messages: [] }
+      offering_id: lane.lane_id, provider: ssot_harness.provider_family.to_s,
+      provider_instance: context[:key].instance_id, model: lane.model, operation: 'chat', params: { messages: [] }
     }
     Legion::Extensions::Llm::Fleet::WorkerExecution.call(envelope: envelope, registry: registry)
     expect(ssot_harness.inference_call_count(callable: context[:callable])).to eq(1)

data/spec/legion/extensions/llm/credential_sources_spec.rb

@@ -410,26 +410,25 @@ RSpec.describe Legion::Extensions::Llm::CredentialSources do
       end
     end
 
-    it 'returns empty hash for missing file' do
-      result = mod.send(:read_json, '/nonexistent/file.json')
-      expect(result).to eq({})
+    it 'raises a configuration error for a missing file (O11 fail-closed)' do
+      expect { mod.send(:read_json, '/nonexistent/file.json') }
+        .to raise_error(Legion::Extensions::Llm::ConfigurationError, /credential file is missing/)
     end
 
-    it 'returns empty hash for invalid JSON' do
+    it 'raises for invalid JSON (O11 fail-closed)' do
       Dir.mktmpdir do |dir|
         path = File.join(dir, 'bad.json')
         File.write(path, 'not json{{{')
-        result = mod.send(:read_json, path)
-        expect(result).to eq({})
+        expect { mod.send(:read_json, path) }.to raise_error(Legion::JSON::ParseError)
       end
     end
 
-    it 'returns empty hash for empty file' do
+    it 'raises a configuration error for an empty file (O11 fail-closed)' do
       Dir.mktmpdir do |dir|
         path = File.join(dir, 'empty.json')
         File.write(path, '')
-        result = mod.send(:read_json, path)
-        expect(result).to eq({})
+        expect { mod.send(:read_json, path) }
+          .to raise_error(Legion::Extensions::Llm::ConfigurationError, /credential file is empty/)
       end
     end
   end
@@ -457,12 +456,12 @@ RSpec.describe Legion::Extensions::Llm::CredentialSources do
       expect(mod.send(:token_valid?, token)).to be true
     end
 
-    it 'returns true on parse error (malformed token)' do
-      expect(mod.send(:token_valid?, 'not.a.jwt')).to be true
+    it 'returns false on parse error (O11 fail-closed — no benefit of the doubt)' do
+      expect(mod.send(:token_valid?, 'not.a.jwt')).to be false
     end
 
-    it 'returns true for nil token' do
-      expect(mod.send(:token_valid?, nil)).to be true
+    it 'returns false for nil token (O11 fail-closed)' do
+      expect(mod.send(:token_valid?, nil)).to be false
     end
   end
 end

data/spec/legion/extensions/llm/error_spec.rb

@@ -71,17 +71,7 @@ RSpec.describe Legion::Extensions::Llm::Error do
     end
   end
 
-  describe Legion::Extensions::Llm::UnsupportedCapabilityError do
-    it 'keeps string message compatibility for existing callers' do
-      error = described_class.new('not supported')
-
-      expect(error.message).to eq('not supported')
-    end
-
-    it 'accepts the shared keyword initializer' do
-      error = described_class.new(provider: :openai, capability: :embed)
-
-      expect(error.message).to eq('Provider openai does not support embed')
-    end
+  it 'removes the UnsupportedCapabilityError compat alias (0.8.0 rip)' do
+    expect(Legion::Extensions::Llm.const_defined?(:UnsupportedCapabilityError, false)).to be(false)
   end
 end