lex-llm 0.7.6 → 0.8.4

data/spec/legion/extensions/llm/fleet/exact_offering_spec.rb

@@ -36,11 +36,21 @@ RSpec.describe Legion::Extensions::Llm::Fleet::ExactOffering do
 
       def disconnect; end
 
-      def chat(messages:, model:, **rest)
+      def chat(messages, model:, **rest)
         @calls << { op: :chat, messages: messages, model: model, rest: rest }
         { content: 'exact-ok' }
       end
 
+      def stream_chat(messages, model:, **rest)
+        @calls << { op: :stream_chat, messages: messages, model: model, rest: rest }
+        { content: 'stream-exact-ok' }
+      end
+
+      def count_tokens(messages:, model:, **rest)
+        @calls << { op: :count_tokens, messages: messages, model: model, rest: rest }
+        1
+      end
+
       def embed(text:, model:, **rest)
         @calls << { op: :embed, text: text, model: model, rest: rest }
         { content: 'embed-ok' }
@@ -52,12 +62,17 @@ RSpec.describe Legion::Extensions::Llm::Fleet::ExactOffering do
 
   before do
     inventory::Registry.reset!
-    claim_and_activate(key: key, callable: recording_callable, coordinator: probe_coordinator(key))
+    claim_and_activate(
+      key: key, callable: recording_callable, coordinator: probe_coordinator(key),
+      supported: %i[chat stream_chat count_tokens]
+    )
     allow(worker).to receive_messages(validate_identity!: true, validate_idempotency!: nil)
   end
 
+  # The claim field keeps the name offering_id (D4); its value is the
+  # activated inference lane's 5 tuple.
   def offering_id
-    Legion::Extensions::Llm::Inventory::Identity.offering_id(instance_key: key, provider_native_key: 'gemma4')
+    Legion::Extensions::Llm::Inventory::Registry.snapshot.lanes_for(instance_key: key).first.lane_id
   end
 
   def exact_envelope(**overrides)
@@ -79,10 +94,9 @@ RSpec.describe Legion::Extensions::Llm::Fleet::ExactOffering do
       expect(handle_reference_count).to eq(0)
     end
 
-    it 'requires exactly one of registry or provider' do
-      expect { worker.call(envelope: exact_envelope, registry: inventory::Registry, provider: Object.new) }
-        .to raise_error(worker::PolicyError)
-      expect { worker.call(envelope: exact_envelope) }.to raise_error(worker::PolicyError)
+    it 'requires the registry — the provider-object topology is deleted (W1)' do
+      expect { worker.call(envelope: exact_envelope, registry: nil) }
+        .to raise_error(worker::PolicyError, /requires registry/)
     end
 
     it 'releases the lease even when the callable raises' do
@@ -92,7 +106,10 @@ RSpec.describe Legion::Extensions::Llm::Fleet::ExactOffering do
     end
 
     it 'rejects a mismatched offering_id, model, operation, and absent instance before invocation' do
-      expect { worker.call(envelope: exact_envelope(offering_id: "off:v1:#{'0' * 64}"), registry: inventory::Registry) }
+      foreign = Legion::Extensions::Llm::Inventory::Identity.compose_lane_id(
+        tier: :local, provider_family: 'vllm', instance_id: 'elsewhere', type: :inference, model: 'gemma4'
+      )
+      expect { worker.call(envelope: exact_envelope(offering_id: foreign), registry: inventory::Registry) }
         .to raise_error(errors::ExactOfferingMismatchError)
       expect { worker.call(envelope: exact_envelope(model: 'other'), registry: inventory::Registry) }
         .to raise_error(errors::ExactOfferingMismatchError)
@@ -103,19 +120,19 @@ RSpec.describe Legion::Extensions::Llm::Fleet::ExactOffering do
       expect(recording_callable.calls).to be_empty
     end
 
-    it 'rejects duplicate String/Symbol param spellings' do
+    it 'raises ContractError on duplicate String/Symbol param spellings' do
       expect { worker.call(envelope: exact_envelope(params: { 'messages' => [], :messages => [] }), registry: inventory::Registry) }
-        .to raise_error(errors::ExactOfferingMismatchError)
+        .to raise_error(Legion::Extensions::Llm::Fleet::ContractError, /duplicate param spelling/)
     end
 
-    it 'rejects a params-supplied model (envelope model is the only model)' do
+    it 'raises ContractError on a params-supplied model (envelope model is the only model)' do
       expect { worker.call(envelope: exact_envelope(params: { messages: [], model: 'x' }), registry: inventory::Registry) }
-        .to raise_error(errors::ExactOfferingMismatchError)
+        .to raise_error(Legion::Extensions::Llm::Fleet::ContractError, /must not contain model/)
     end
 
-    it 'rejects a missing required operation param' do
+    it 'raises ContractError on a missing required operation param' do
       expect { worker.call(envelope: exact_envelope(params: {}), registry: inventory::Registry) }
-        .to raise_error(errors::ExactOfferingMismatchError)
+        .to raise_error(Legion::Extensions::Llm::Fleet::ContractError, /requires the messages param/)
     end
 
     it 'passes an explicit empty messages array and forwards unknown kwargs' do
@@ -124,36 +141,32 @@ RSpec.describe Legion::Extensions::Llm::Fleet::ExactOffering do
       expect(call[:messages]).to eq([])
       expect(call[:rest]).to eq(temperature: 0.2)
     end
-  end
 
-  describe 'registry-backed legacy v2 resolution' do
-    def activate_two_offerings
-      registry = Legion::Extensions::Llm::Inventory::Registry
-      registry.reset!
-      token = registry.claim_instance(instance_key: key, callable: recording_callable, probe_request_handle: probe_coordinator(key))
-      probe = registry.readiness_probe_started(instance_key: key, publisher_token: token)
-      two = drafts(native: 'a', model: 'gemma4') + drafts(native: 'b', model: 'gemma4')
-      registry.activate_instance_snapshot(publisher_token: token, instance_key: key, offerings: two, sequence: 0, probe_token: probe)
-    end
-
-    it 'refuses zero matches' do
-      envelope = { provider: 'vllm', provider_instance: 'h200', model: 'nope', operation: 'chat', params: { messages: [] } }
-      expect { worker.call(envelope: envelope, registry: inventory::Registry) }.to raise_error(errors::ExactOfferingMismatchError)
-    end
-
-    it 'refuses multiple matches' do
-      activate_two_offerings
-      envelope = { provider: 'vllm', provider_instance: 'h200', model: 'gemma4', operation: 'chat', params: { messages: [] } }
-      expect { worker.call(envelope: envelope, registry: inventory::Registry) }.to raise_error(errors::AmbiguousLegacyOfferingError)
-    end
-  end
+    it 'rehydrates JSON-round-tripped messages before every message operation' do
+      raw_messages = [
+        { role: 'system', content: 'follow the rules' },
+        {
+          role: 'assistant', content: '',
+          tool_calls: [{ id: 'call-1', name: 'lookup', arguments: { query: 'status' } }]
+        },
+        { role: 'tool', tool_call_id: 'call-1', content: 'clean' },
+        { role: 'user', content: 'continue' }
+      ]
+
+      %w[chat stream_chat count_tokens].each do |operation|
+        wire_envelope = Legion::JSON.load(
+          Legion::JSON.dump(exact_envelope(operation: operation, params: { messages: raw_messages }))
+        )
+        worker.call(envelope: wire_envelope, registry: inventory::Registry)
+      end
 
-  describe 'legacy provider path still operates' do
-    it 'dispatches through the provider object without a registry' do
-      provider = recording_callable
-      envelope = { operation: 'chat', model: 'gemma4', params: { messages: [] } }
-      worker.call(envelope: envelope, provider: provider)
-      expect(recording_callable.calls.map { |c| c[:op] }).to eq([:chat])
+      expect(recording_callable.calls.map { |call| call[:op] }).to eq(%i[chat stream_chat count_tokens])
+      recording_callable.calls.each do |call|
+        expect(call[:messages]).to all(be_a(Legion::Extensions::Llm::Canonical::Message))
+        expect(call[:messages].map(&:role)).to eq(%i[system assistant tool user])
+        expect(call[:messages][1].tool_calls.first.name).to eq('lookup')
+        expect(call[:messages][2].tool_call_id).to eq('call-1')
+      end
     end
   end
 
@@ -167,13 +180,14 @@ RSpec.describe Legion::Extensions::Llm::Fleet::ExactOffering do
       expect { token_validator.validate_exact_execution_claims!(missing, envelope) }
         .to raise_error(Legion::Extensions::Llm::Fleet::TokenError)
 
-      mismatched = { execution_contract: protocol::EXACT_EXECUTION_CONTRACT, offering_id: "off:v1:#{'0' * 64}" }
+      mismatched = { execution_contract: protocol::EXACT_EXECUTION_CONTRACT, offering_id: 'local:other:other:inference:other' }
       expect { token_validator.validate_exact_execution_claims!(mismatched, envelope) }
         .to raise_error(Legion::Extensions::Llm::Fleet::TokenError)
     end
 
-    it 'is a no-op for a legacy v2 envelope without the marker' do
-      expect { token_validator.validate_exact_execution_claims!({}, { operation: 'chat' }) }.not_to raise_error
+    it 'verifies unconditionally — the marker-absence branch is deleted (S3)' do
+      expect { token_validator.validate_exact_execution_claims!({}, { operation: 'chat' }) }
+        .to raise_error(Legion::Extensions::Llm::Fleet::TokenError, /missing signed execution_contract/)
     end
   end
 end

data/spec/legion/extensions/llm/fleet/provider_responder_spec.rb

@@ -1,56 +1,58 @@
 # frozen_string_literal: true
 
+require 'spec_helper'
 require 'legion/extensions/llm/fleet/provider_responder'
+require 'support/ssot_registry_helpers'
 
 RSpec.describe Legion::Extensions::Llm::Fleet::ProviderResponder do
+  include SsotRegistryHelpers
+
   let(:protocol) { Legion::Extensions::Llm::Fleet::Protocol }
-  let(:payload) do
+  let(:key) { instance_key(family: 'ollama', instance: 'default') }
+  let(:callable) do
+    Class.new do
+      def chat(messages, model:, **_params)
+        Legion::Extensions::Llm::Canonical::Response.build(
+          text: "chat #{model} #{messages.first.text}",
+          model: model,
+          stop_reason: :end_turn,
+          usage: Legion::Extensions::Llm::Canonical::Usage.build(input_tokens: 1, output_tokens: 2)
+        )
+      end
+    end.new
+  end
+  # Claim field keeps the name offering_id (D4); value = the lane 5 tuple.
+  let(:offering_id) do
+    Legion::Extensions::Llm::Inventory::Registry.snapshot.lanes_for(instance_key: key).first.lane_id
+  end
+  let(:payload) { payload_for(offering_id) }
+
+  def payload_for(offering_id)
     {
       request_id: 'req-1',
       correlation_id: 'corr-1',
       idempotency_key: 'idem-1',
-      operation: :chat,
-      provider: :ollama,
-      provider_instance: :default,
+      operation: 'chat',
+      provider: 'ollama',
+      provider_instance: 'default',
       model: 'llama3',
-      params: { messages: [{ role: 'user', content: 'hello' }], temperature: 0.1 },
+      params: { messages: [{ role: 'user', content: 'hello' }] },
       reply_to: 'reply.queue',
       message_context: { conversation_id: 'conv-1' },
-      caller: { identity: 'user:matt' },
+      caller: { identity: 'user:test' },
       trace_context: { trace_id: 'trace-1' },
       signed_token: 'unsigned',
       timeout_seconds: 30,
       expires_at: (Time.now.utc + 30).iso8601,
-      protocol_version: protocol::VERSION
+      protocol_version: protocol::VERSION,
+      execution_contract: protocol::EXACT_EXECUTION_CONTRACT,
+      offering_id: offering_id
     }
   end
-  let(:provider_instances) do
-    {
-      default: {
-        base_url: 'http://localhost:11434',
-        fleet: { respond_to_requests: true }
-      }
-    }
-  end
-  let(:provider_class) do
-    Class.new do
-      attr_reader :settings
-
-      def initialize(settings)
-        @settings = settings
-      end
-
-      def chat(messages:, model:, **params)
-        {
-          content: "chat #{model} #{messages.first[:content]}",
-          usage: { input_tokens: 1, output_tokens: 2 },
-          metadata: { temperature: params[:temperature], base_url: settings[:base_url] }
-        }
-      end
-    end
-  end
 
   before do
+    Legion::Extensions::Llm::Inventory::Registry.reset!
+    claim_and_activate(key: key, callable: callable, coordinator: probe_coordinator(key), model: 'llama3')
     Legion::Extensions::Llm::Fleet::WorkerExecution.reset_idempotency_cache!
     allow(Legion::Extensions::Llm::Fleet::Settings).to receive(:value).and_call_original
     allow(Legion::Extensions::Llm::Fleet::Settings).to receive(:value)
@@ -59,6 +61,14 @@ RSpec.describe Legion::Extensions::Llm::Fleet::ProviderResponder do
       .with(:fleet, :responder, :require_idempotency, default: nil).and_return(false)
   end
 
+  it 'L6: the dead provider_class/provider_instances params are deleted (v3 dispatch never constructs a provider)' do
+    params = described_class.instance_method(:call).parameters
+    expect(params).not_to include(%i[key provider_class])
+    expect(params).not_to include(%i[key provider_instances])
+    expect { described_class.call(payload: payload, provider_family: 'ollama', provider_class: Object) }
+      .to raise_error(ArgumentError, /provider_class/)
+  end
+
   it 'does not require the legion-llm namespace on responder nodes' do
     hide_const('Legion::LLM') if defined?(Legion::LLM)
 
@@ -66,47 +76,55 @@ RSpec.describe Legion::Extensions::Llm::Fleet::ProviderResponder do
     expect(described_class).to respond_to(:call)
   end
 
-  it 'builds a provider from the requested instance, dispatches the operation, and publishes a fleet response' do
+  it 'dispatches the exact request through the registry and publishes the serialized Canonical::Response (E3)' do
     response_message = instance_double(Legion::Extensions::Llm::Transport::Messages::FleetResponse, publish: true)
-    allow(Legion::Extensions::Llm::Transport::Messages::FleetResponse).to receive(:new).and_return(response_message)
+    published_args = nil
+    allow(Legion::Extensions::Llm::Transport::Messages::FleetResponse).to receive(:new) do |*args|
+      published_args = args
+      response_message
+    end
 
     response = described_class.call(
       payload: payload,
-      provider_family: :ollama,
-      provider_class: provider_class,
-      provider_instances: provider_instances
+      provider_family: 'ollama',
+      registry: Legion::Extensions::Llm::Inventory::Registry
     )
 
-    expect(response).to include(content: 'chat llama3 hello')
-    expect(Legion::Extensions::Llm::Transport::Messages::FleetResponse).to have_received(:new).with(
-      hash_including(
-        request_id: 'req-1',
-        correlation_id: 'corr-1',
-        provider: :ollama,
-        provider_instance: :default,
-        model: 'llama3',
-        content: 'chat llama3 hello',
-        usage: { input_tokens: 1, output_tokens: 2 },
-        metadata: { temperature: 0.1, base_url: 'http://localhost:11434' }
-      )
+    expect(response).to be_a(Legion::Extensions::Llm::Canonical::Response)
+    expect(response.text).to eq('chat llama3 hello')
+    expect(published_args.first).to include(
+      request_id: 'req-1',
+      correlation_id: 'corr-1',
+      provider: 'ollama',
+      provider_instance: 'default',
+      model: 'llama3',
+      execution_contract: protocol::EXACT_EXECUTION_CONTRACT,
+      offering_id: offering_id
     )
+    published = published_args.first[:response]
+    expect(published).to include(text: 'chat llama3 hello', stop_reason: :end_turn)
+    # The envelope carries the serialized Canonical::Response; the Usage member
+    # is the canonical object (JSON encoding at publish serializes it per as_json).
+    expect(published[:usage]).to be_a(Legion::Extensions::Llm::Canonical::Usage)
+    expect(published[:usage].input_tokens).to eq(1)
+    expect(published[:usage].output_tokens).to eq(2)
     expect(response_message).to have_received(:publish)
   end
 
-  it 'rejects legacy fleet protocol fields before provider execution' do
+  it 'rejects legacy fleet protocol fields before execution (P4)' do
     expect do
       described_class.call(
         payload: payload.merge(request_type: 'chat'),
-        provider_family: :ollama,
-        provider_class: provider_class,
-        provider_instances: provider_instances
+        provider_family: 'ollama',
+        registry: Legion::Extensions::Llm::Inventory::Registry
       )
     end.to raise_error(ArgumentError, /request_type/)
   end
 
   it 'reports whether a provider instance is enabled for fleet responses' do
-    expect(described_class.enabled_for?(provider_instances)).to be(true)
+    expect(described_class.enabled_for?(default: { fleet: { respond_to_requests: true } })).to be(true)
     expect(described_class.enabled_for?(default: { fleet: { respond_to_requests: false } })).to be(false)
+    expect(described_class.enabled_for?(-> { { default: { fleet: { respond_to_requests: 'true' } } } })).to be(true)
   end
 
   it 'raises an actionable configuration error when fleet transport messages cannot load' do
@@ -118,62 +136,122 @@ RSpec.describe Legion::Extensions::Llm::Fleet::ProviderResponder do
     end.to raise_error(described_class::ConfigurationError, /fleet responder transport unavailable/)
   end
 
-  describe 'execution_contract marker validation' do
-    it 'preserves false values for both envelope key spellings' do
-      symbol_envelope = described_class::FleetEnvelope.new(data: { execution_contract: false })
-      string_envelope = described_class::FleetEnvelope.new(data: { 'execution_contract' => false })
+  describe 'P2 — exact-only execution contract' do
+    it 'rejects a missing marker (legacy v2 tolerance is deleted)' do
+      legacy = payload_for(offering_id).except(:execution_contract)
+      envelope = described_class.parse_payload(legacy)
+      expect { described_class.check_envelope!(envelope, provider_family: 'ollama') }
+        .to raise_error(ArgumentError, /execution_contract is required/)
+    end
 
-      expect(symbol_envelope[:execution_contract]).to be(false)
-      expect(string_envelope[:execution_contract]).to be(false)
+    it 'rejects an unknown nonempty marker' do
+      envelope = described_class.parse_payload(payload.merge(execution_contract: 'made_up'))
+      expect { described_class.check_envelope!(envelope, provider_family: 'ollama') }
+        .to raise_error(Legion::Extensions::Llm::Fleet::ContractError, /execution_contract must be/)
     end
 
-    it 'accepts a legacy v2 envelope with no marker' do
+    it 'requires the exact fields for the exact marker' do
+      envelope = described_class.parse_payload(payload.merge(offering_id: nil))
+      expect { described_class.check_envelope!(envelope, provider_family: 'ollama') }
+        .to raise_error(ArgumentError, /offering_id is required/)
+    end
+
+    it 'rejects a false marker before dispatch' do
+      envelope = described_class.parse_payload(payload.merge(execution_contract: false))
+      expect { described_class.check_envelope!(envelope, provider_family: 'ollama') }
+        .to raise_error(Legion::Extensions::Llm::Fleet::ContractError, /execution_contract must be/)
+    end
+
+    it 'accepts a complete exact envelope' do
       envelope = described_class.parse_payload(payload)
-      expect { described_class.check_envelope!(envelope, provider_family: :ollama) }.not_to raise_error
+      expect { described_class.check_envelope!(envelope, provider_family: 'ollama') }.not_to raise_error
     end
+  end
 
-    it 'accepts an explicitly nil marker as legacy v2' do
-      envelope = described_class.parse_payload(payload.merge(execution_contract: nil))
-      expect { described_class.check_envelope!(envelope, provider_family: :ollama) }.not_to raise_error
+  describe 'P3 — explicit protocol version' do
+    it 'rejects a missing protocol_version (no default fill)' do
+      envelope = described_class.parse_payload(payload.except(:protocol_version))
+      expect { described_class.check_envelope!(envelope, provider_family: 'ollama') }
+        .to raise_error(ArgumentError, /protocol_version is required/)
     end
 
-    { symbol: { execution_contract: false }, string: { 'execution_contract' => false } }.each do |spelling, marker|
-      it "rejects a false #{spelling}-key marker before provider or registry dispatch" do
-        registry = class_spy(Legion::Extensions::Llm::Inventory::Registry)
-        allow(provider_class).to receive(:new).and_call_original
-
-        expect do
-          described_class.call(
-            payload: payload.merge(marker),
-            provider_family: :ollama,
-            provider_class: provider_class,
-            provider_instances: provider_instances,
-            registry: registry
-          )
-        end.to raise_error(ArgumentError, /unknown execution_contract: false/)
+    it 'rejects a mismatched protocol_version' do
+      envelope = described_class.parse_payload(payload.merge(protocol_version: 2))
+      expect { described_class.check_envelope!(envelope, provider_family: 'ollama') }
+        .to raise_error(ArgumentError, /protocol_version must be 3/)
+    end
+  end
 
-        expect(provider_class).not_to have_received(:new)
-        expect(registry).not_to have_received(:snapshot)
-      end
+  describe 'E1 — wire normalization' do
+    it 'raises on a wrong-shape payload (the silent {} fallback is deleted)' do
+      expect { described_class.parse_payload(42) }
+        .to raise_error(Legion::Extensions::Llm::Fleet::ContractError, /expected Hash or String, got Integer/)
     end
 
-    it 'rejects an unknown nonempty marker' do
-      envelope = described_class.parse_payload(payload.merge(execution_contract: 'made_up'))
-      expect { described_class.check_envelope!(envelope, provider_family: :ollama) }
-        .to raise_error(ArgumentError, /unknown execution_contract/)
+    it 'wraps Hash payloads through the single FleetEnvelope entry' do
+      envelope = described_class.parse_payload({ 'request_id' => 'r1', protocol_version: 3 })
+      expect(envelope).to be_a(Legion::Extensions::Llm::Fleet::FleetEnvelope)
+      expect(envelope.request_id).to eq('r1')
     end
 
-    it 'requires offering_id for the exact marker' do
-      envelope = described_class.parse_payload(payload.merge(execution_contract: 'exact_offering_v1'))
-      expect { described_class.check_envelope!(envelope, provider_family: :ollama) }
-        .to raise_error(ArgumentError, /offering_id is required/)
+    it 'reads false values for both key spellings' do
+      symbol_envelope = Legion::Extensions::Llm::Fleet::FleetEnvelope.new(data: { execution_contract: false })
+      string_envelope = Legion::Extensions::Llm::Fleet::FleetEnvelope.new(data: { 'execution_contract' => false })
+
+      expect(symbol_envelope[:execution_contract]).to be(false)
+      expect(string_envelope[:execution_contract]).to be(false)
     end
+  end
 
-    it 'accepts a complete exact envelope' do
-      exact = payload.merge(execution_contract: 'exact_offering_v1', offering_id: 'off:v1:abc')
-      envelope = described_class.parse_payload(exact)
-      expect { described_class.check_envelope!(envelope, provider_family: :ollama) }.not_to raise_error
-      expect(described_class.exact?(envelope)).to be(true)
+  describe 'F6 — retryability derived from the ProviderOutcome kind table' do
+    it 'never retries contract, policy, auth, or classification errors' do
+      expect(described_class.retryable_error?(Legion::Extensions::Llm::Fleet::ContractError.new('x'))).to be(false)
+      expect(described_class.retryable_error?(Legion::Extensions::Llm::Fleet::WorkerExecution::PolicyError.new('x'))).to be(false)
+      expect(described_class.retryable_error?(Legion::Extensions::Llm::Fleet::TokenError.new('x'))).to be(false)
+      expect(described_class.retryable_error?(Legion::Extensions::Llm::Inventory::Errors::ExactOfferingMismatchError.new('x'))).to be(false)
+      expect(described_class.retryable_error?(described_class::ConfigurationError.new('x'))).to be(false)
+    end
+
+    it 'retries transient provider kinds only' do
+      expect(described_class.retryable_error?(Legion::Extensions::Llm::RateLimitError.new(nil, 'x'))).to be(true)
+      expect(described_class.retryable_error?(Legion::Extensions::Llm::OverloadedError.new(nil, 'x'))).to be(true)
+      expect(described_class.retryable_error?(Timeout::Error.new('x'))).to be(true)
+      expect(described_class.retryable_error?(Legion::Extensions::Llm::UnauthorizedError.new(nil, 'x'))).to be(false)
+    end
+  end
+
+  describe 'G5 — thinking never crosses the fleet' do
+    it 'excludes thinking from the response envelope exactly once at the builder' do
+      thinking_callable = Class.new do
+        def chat(_messages, model:, **)
+          Legion::Extensions::Llm::Canonical::Response.build(
+            text: 'done',
+            model: model,
+            stop_reason: :end_turn,
+            thinking: Legion::Extensions::Llm::Canonical::Thinking.build(content: 'secret-reasoning')
+          )
+        end
+      end.new
+      key2 = instance_key(family: 'ollama', instance: 'thinking')
+      Legion::Extensions::Llm::Inventory::Registry.reset!
+      claim_and_activate(key: key2, callable: thinking_callable, coordinator: probe_coordinator(key2), model: 'llama3')
+      thinking_offering = Legion::Extensions::Llm::Inventory::Registry
+                          .snapshot.lanes_for(instance_key: key2).first.lane_id
+
+      response_message = instance_double(Legion::Extensions::Llm::Transport::Messages::FleetResponse, publish: true)
+      published_args = nil
+      allow(Legion::Extensions::Llm::Transport::Messages::FleetResponse).to receive(:new) do |*args|
+        published_args = args
+        response_message
+      end
+
+      described_class.call(
+        payload: payload_for(thinking_offering).merge(provider_instance: 'thinking'),
+        provider_family: 'ollama',
+        registry: Legion::Extensions::Llm::Inventory::Registry
+      )
+
+      expect(published_args.first[:response]).not_to have_key(:thinking)
     end
   end
 end

data/spec/legion/extensions/llm/fleet/token_validator_spec.rb

@@ -17,10 +17,15 @@ RSpec.describe Legion::Extensions::Llm::Fleet::TokenValidator do
       reply_to: 'reply.queue',
       message_context: { conversation_id: 'conv-1' },
       params: { messages: [{ role: 'user', content: 'hello' }] },
-      caller: { identity: 'user:matt' },
+      caller: { identity: 'user:primary' },
       trace_context: { trace_id: 'trace-1' },
       timeout_seconds: 30,
-      expires_at: expires_at
+      expires_at: expires_at,
+      # v3: exact claims are verified unconditionally (S3) — the envelope and
+      # the signed claims must both carry the exact marker + offering_id.
+      # The claim value is the lane's 5 tuple (D4).
+      execution_contract: Legion::Extensions::Llm::Fleet::Protocol::EXACT_EXECUTION_CONTRACT,
+      offering_id: 'local:ollama:default:inference:llama3'
     }
   end
   let(:claims) do