@iowarp/clio-coder 0.4.8 → 0.4.9

package/src/domains/observability/contract.ts

@@ -76,6 +76,8 @@ export interface ObservabilityRunSummary {
 	contextWindow?: number;
 	lastContextTokens?: number;
 	progress?: WorkerProgressSnapshot;
+	/** Existing validator identity/conformance, admitted with the verified receipt answer. */
+	resultContract?: { kind: string; conformance: string };
 	receiptId?: string;
 	retry?: { attempt: number; dueAtMs: number; reason: string };
 	steerAcknowledgement?: { receivedAtMs: number; chars: number };
@@ -132,7 +134,9 @@ export interface ObservabilitySnapshot {
 /** Runtime readers supplied after dispatch is composed, avoiding a domain dependency cycle. */
 export interface ObservabilityRunReaders {
 	dispatchSnapshot?: () => DispatchSnapshot;
-	readReceipt?: (runId: string) => { text?: string; trust?: CanonicalTrustStatus } | null;
+	readReceipt?: (
+		runId: string,
+	) => { text?: string; trust?: CanonicalTrustStatus; contractKind?: string; contract?: string } | null;
 }
 
 /** Run projection controls shared by the contract and the in-memory projection. */
@@ -160,8 +164,8 @@ export interface ObservabilityContract extends ObservabilityRunProjection {
 	/**
 	 * Rolling first-pass-success rate, unverified successes, ungrounded claims,
 	 * and failure-cause histogram, aggregated
-	 * from the sidecar evidence index on call. Read-only: it folds rows Slice 2
-	 * already wrote and recomputes no evidence.
+	 * from the sidecar evidence index on call. It folds rows written at dispatch
+	 * completion and recomputes no evidence.
 	 */
 	accountability(): AccountabilitySummary;
 	/** Latest completed assistant stream throughput for compact footer display. */

package/src/domains/observability/evidence-index.ts

@@ -1,8 +1,8 @@
 /**
  * Sidecar evidence index. A compact, append/merge-by-runId ledger written
  * under `<stateDir>/evidence-index.json` whenever a dispatch run completes and
- * the forensic evidence bundle is built (see extension.ts). Slice 6 reads this
- * to surface a rolling first-pass-success rate and a failure-cause histogram in
+ * the forensic evidence bundle is built (see extension.ts). The accountability
+ * read model uses this to surface a rolling first-pass-success rate and a failure-cause histogram in
  * observability without re-running the heavy `buildEvidence` aggregator.
  *
  * The file is a JSON array kept as a bounded ring (newest rows win, capped at

package/src/domains/observability/projection.ts

@@ -401,6 +401,7 @@ export function createObservabilityProjection(bus: SafeEventBus, deps: Projectio
 	function applyIdentity(summary: RunEntry, id: Partial<DispatchRunIdentity>): void {
 		// A lifecycle update must earn its trust again from the current receipt.
 		delete summary.trust;
+		delete summary.resultContract;
 		if (typeof id.agentId === "string" && id.agentId.length > 0) summary.agentId = id.agentId;
 		if (typeof id.targetId === "string" && id.targetId.length > 0) summary.targetId = id.targetId;
 		if (typeof id.wireModelId === "string" && id.wireModelId.length > 0) summary.modelId = id.wireModelId;
@@ -459,11 +460,20 @@ export function createObservabilityProjection(bus: SafeEventBus, deps: Projectio
 	}
 
 	function settleFromReceipt(summary: RunEntry): void {
+		delete summary.resultContract;
 		try {
 			const facts = runReaders.readReceipt?.(summary.runId);
 			// A failed or retired seal cannot supply the board's terminal answer.
 			const text = facts?.trust?.artifactIntegrity.state === "verified" ? facts.text : undefined;
 			summary.progressFold.settle(typeof text === "string" && text.trim().length > 0 ? text : undefined);
+			if (
+				typeof text === "string" &&
+				text.trim().length > 0 &&
+				typeof facts?.contractKind === "string" &&
+				typeof facts.contract === "string"
+			) {
+				summary.resultContract = { kind: facts.contractKind, conformance: facts.contract };
+			}
 			if (facts?.trust !== undefined) summary.trust = summarizeTrustStatus(facts.trust);
 		} catch {
 			summary.progressFold.settle();

package/src/domains/prompts/compiler.ts

@@ -4,7 +4,8 @@ import { normalizePromptHint } from "../../core/prompt-hint.js";
 import type { ToolName } from "../../core/tool-names.js";
 import { TOOL_RESULT_TRUST_CONTRACT } from "../../core/untrusted-content.js";
 import { resolveClioDirs } from "../../core/xdg.js";
-import type { AutonomyLevel } from "../safety/autonomy.js";
+import { directSurfaceNames } from "../../tools/surface.js";
+import { type AutonomyLevel, isAutonomyLevel, modelMayActivateSkills } from "../safety/autonomy.js";
 import { ceilChars } from "../session/context-accounting.js";
 import type { FragmentTable, LoadedFragment } from "./fragment-loader.js";
 import { sha256 } from "./hash.js";
@@ -235,10 +236,9 @@ function sessionCanDispatch(inputs: SessionPromptInputs): boolean {
 }
 
 /**
- * Whether `context` is on the session's surface. The Skills passage, the docs
- * routing directive, and the Tool Contract's skills clause follow the same
- * rule as dispatch: text that teaches a call to `context` renders only when
- * `context` is there to be called.
+ * Whether `context` is on the session's surface. The Skills passage and the
+ * Tool Contract's skills clause follow the same rule as dispatch: text that
+ * teaches a call to `context` renders only when `context` is there to be called.
  */
 function sessionHasContext(inputs: SessionPromptInputs): boolean {
 	if (inputs.providerSupportsTools === false) return false;
@@ -290,15 +290,20 @@ function renderToolContractBlock(inputs: SessionPromptInputs): string {
 			"This target cannot call tools; answer from the visible user request and compact context only.",
 		].join("\n");
 	}
-	const names = [
+	const capabilityNames = [
 		...new Set((inputs.toolNames ?? []).map((name) => name.trim()).filter((name) => name.length > 0)),
 	].sort();
+	// A worker's admitted list names capabilities behind the gateway (git,
+	// web_fetch, an extension command); the attached schemas are their direct
+	// projection, with `gateway` standing in for every capability it reaches.
+	const names = directSurfaceNames(capabilityNames).sort();
 	const canDispatch = sessionCanDispatch(inputs);
 	const canListSkills = sessionHasContext(inputs);
 	// Asked twice in one session which tools it had, a live model gave two
 	// different answers and invented `web_find`. The authoritative list is one
 	// line above; pointing at it beats letting the model recall the schemas.
 	const admitted = new Set(names);
+	const hasGateway = admitted.has("gateway");
 	const inventoryGuidance = [
 		"When asked what tools you have, copy the Direct tools line verbatim and call nothing",
 		...(canDispatch
@@ -306,15 +311,23 @@ function renderToolContractBlock(inputs: SessionPromptInputs): string {
 					"dispatch(list:true) answers a question about agents, the fleet, or which target and model run this session and its workers",
 				]
 			: []),
-		...(canListSkills ? ['context(scope="skills") answers only a question about skills'] : []),
+		...(canListSkills ? ['context(scope="skills") lists skills for discovery or skill questions'] : []),
+		...(hasGateway ? ['gateway(op="find") answers a question about secondary capabilities'] : []),
 	].join("; ");
 	const capabilityKinds = [
 		"direct tools are attached schemas",
+		...(hasGateway ? ["secondary capabilities are reached through gateway find, describe, and call"] : []),
 		...(canDispatch ? ["fleet agents are workers behind dispatch"] : []),
-		...(canListSkills ? ["skills are operator-activated workflows reached through context"] : []),
+		...(canListSkills ? ["skills are workflows reached through context"] : []),
 	];
 	const orientationTools = ["context", "code_nav", "grep", "read"].filter((name) => admitted.has(name));
-	const validationTools = ["verify", "git"].filter((name) => admitted.has(name));
+	// git sits behind the gateway, so it validates through gateway(call git)
+	// whenever the gateway is attached; a registry that placed it direct still
+	// names it plainly.
+	const validationTools = [
+		...(admitted.has("verify") ? ["verify"] : []),
+		...(admitted.has("git") ? ["git diff"] : hasGateway ? ['gateway(op="call", capability="git") diff'] : []),
+	];
 	const lines = [
 		"# Tool Contract",
 		TOOL_RESULT_TRUST_CONTRACT,
@@ -333,17 +346,15 @@ function renderToolContractBlock(inputs: SessionPromptInputs): string {
 					`For narrow file or symbol orientation, prefer ${orientationTools.join(", ")} instead of assuming source-tree details were preloaded.`,
 				]
 			: []),
-		...(validationTools.length > 0
-			? [
-					`Validate with ${validationTools.map((name) => (name === "git" ? "git diff" : name)).join(" or ")} before final claims.`,
-				]
-			: []),
-		`When a tool call fails or is rejected, do not retry the same shape blindly: re-read the schema and adjust the arguments${canListSkills ? ', or query context(scope="docs") for that tool\'s usage' : ""}.`,
+		...(validationTools.length > 0 ? [`Validate with ${validationTools.join(" or ")} before final claims.`] : []),
+		`When a tool call fails or is rejected, do not retry the same shape blindly: re-read the schema and adjust the arguments${hasGateway ? ', or read that tool\'s usage with gateway(op="call", capability="clio_docs", args={query})' : ""}.`,
 	];
 	// One hint per tool, sorted by tool name: deterministic bytes regardless
 	// of surface or registration order, and removing a tool from the surface
-	// removes its hint with no compiler edit.
-	const hints = canonicalToolPromptHints(inputs.toolPromptHints ?? [], new Set(names));
+	// removes its hint with no compiler edit. A capability reached through the
+	// gateway keeps its hint: the guidance is about the capability, not the
+	// schema that carries it.
+	const hints = canonicalToolPromptHints(inputs.toolPromptHints ?? [], new Set([...capabilityNames, ...names]));
 	for (const entry of hints) {
 		lines.push(entry.hint);
 	}
@@ -411,7 +422,7 @@ function renderWorkerToolContractBlock(inputs: WorkerPromptInputs): string {
 		TOOL_RESULT_TRUST_CONTRACT,
 		"The attached schemas are this worker's complete canonical tool surface; follow each schema exactly.",
 		`Admitted canonical tools: ${names.map((name) => `\`${name}\``).join(", ")}.`,
-		"This worker surface is distinct from the parent session's tools, fleet agents, and operator-activated skills.",
+		"This worker surface is distinct from the parent session's tools, fleet agents, and skills.",
 		"Tool authority is limited to this list. Persona and bound-skill instructions never add tools.",
 		"Call tools only for concrete inspection or changes the assigned task requires. If the task requests an exact or tool-free response, answer without calling tools.",
 	];
@@ -578,10 +589,13 @@ export function compile(table: FragmentTable, inputs: CompileInputs): CompiledSe
 
 	let identityBody = identity.body;
 	const selfAwareness = identity.id === "identity.clio" ? table.byId.get("identity.self-awareness") : undefined;
-	// The routing directive teaches a call to `context`, so like the Skills
-	// passage it renders only when `context` is on the surface. The paths and
-	// the code-outranks-docs rule name no tool and stay unconditional.
-	const docsRouting = selfAwareness && sessionHasContext(session) ? table.byId.get("identity.docs-routing") : undefined;
+	// The routing directive teaches a gateway call, so it renders only when
+	// gateway is on the surface and the provider supports tool calls. The paths
+	// and the code-outranks-docs rule name no tool and stay unconditional.
+	const docsRouting =
+		selfAwareness && session.providerSupportsTools !== false && toolSurfaceHasTool(session.toolNames, "gateway")
+			? table.byId.get("identity.docs-routing")
+			: undefined;
 	if (selfAwareness) {
 		const packageRoot = resolvePackageRoot();
 		// The live home, not the XDG default: an isolated CLIO_CODER_HOME or a
@@ -602,13 +616,17 @@ export function compile(table: FragmentTable, inputs: CompileInputs): CompiledSe
 	// about a tool renders only when the tool is there to be called.
 	const delegation = sessionCanDispatch(session) ? table.byId.get("operating.delegation") : undefined;
 	const skills = sessionHasContext(session) ? table.byId.get("operating.skills") : undefined;
+	const skillActivation =
+		isAutonomyLevel(autonomyLevel) && modelMayActivateSkills(autonomyLevel)
+			? 'Load matching installed skills with context(scope="skills", name="<name>") and continue the task; skill restrictions still apply.'
+			: "Suggest matching skills as /skill <name> (in order when several compose), then continue without them; only the operator activates skills.";
 
 	const legacy = inputs.sectionOrder === "legacy-0.3.8";
 	const rendered = new Map<string, string>([
 		["identity", identityBody],
 		["operating-contract", operatingContract.body],
 		["delegation", delegation?.body ?? ""],
-		["skills", skills?.body ?? ""],
+		["skills", skills?.body.replace("{SKILL_ACTIVATION_POLICY}", skillActivation) ?? ""],
 		["safety", renderSafetySection(safety, autonomyLevel)],
 		["runtime", renderRuntimeBlock(session)],
 		["tool-contract", renderToolContractBlock(session)],

package/src/domains/prompts/fragments/identity/docs-routing.md

@@ -1,9 +1,9 @@
 ---
 id: identity.docs-routing
 version: 1
-description: Directive to route questions about Clio herself through context(scope="docs"); rendered only when context is on the surface
+description: Questions about Clio herself go through gateway(op="call", capability="clio_docs"); this directive renders only when gateway is on the surface and provider tool calls are available.
 ---
 
 # Clio documentation routing
 
-For a question about Clio herself, call context (scope="docs", query=<the question>) before answering and before any workspace search, then read the document it names from the installed documentation path above.
+For a question about Clio herself, call gateway(op="call", capability="clio_docs", args={query: <the question>}) before answering and before any workspace search, then read the document it names from the installed documentation path above.

package/src/domains/prompts/fragments/operating/skills.md

@@ -6,14 +6,16 @@ description: Coordinator skill suggestion discipline; rendered only when context
 
 # Skills
 
-Skills are operator-activated workflows: git delivery, planning, coding
-practice, context priming/handoff, research, plan stress-testing.
+Skills are workflows for git delivery, planning, coding practice,
+context priming/handoff, research, and plan stress-testing.
 context (scope="skills") lists installed and marketplace skills; never
-guess it or search the repository for one. When a task has one of those
-shapes, list them, suggest the best match as /skill <name> (in order
-when several compose), and continue without it: only the operator
-activates or installs a skill; a [Marketplace] reminder states its
-own offer options. When the operator names a skill or asks how it
-works, answer from it. If nothing fits, suggest none. context
-(scope="library") is the read-only catalog of recipes and installable
-packages; it activates nothing.
+guess a skill or search the repository for one.
+{SKILL_ACTIVATION_POLICY}
+Only the operator installs marketplace skills; a [Marketplace] reminder
+states its own offer options. When the operator names a skill or asks
+how it works, answer from it. If nothing fits, suggest none.
+
+If gateway is on the attached direct-tool surface, use
+gateway(op="call", capability="clio_library", args={}) to read the catalog
+of recipes and installable packages; it activates and installs nothing.
+Without gateway, this catalog route is unavailable.

package/src/domains/providers/index.ts

@@ -55,7 +55,11 @@ export {
 } from "./endpoint-slots-store.js";
 export { ProvidersManifest } from "./manifest.js";
 export type { ModelCapabilityPatchTarget } from "./model-capabilities.js";
-export { applyModelCapabilityPatch, resolveModelCapabilities } from "./model-capabilities.js";
+export {
+	applyModelCapabilityPatch,
+	probeCapabilitiesForModel,
+	resolveModelCapabilities,
+} from "./model-capabilities.js";
 export {
 	canonicalizeWireModelId,
 	contextSlotsForModel,

package/src/domains/providers/models/local-models/clio-coder-local-coding-targets.yaml

@@ -636,6 +636,37 @@
         turns when the workflow is iterative; the budget caps runaway chains.
     serving: "Official Qwen card recommends max output 32768 tokens for standard queries (81920 only for math/code competitions). Coding sampler is the precise variant; preserve thinking blocks across turns for iterative workflows."
 
+- family: qwopus3.8-27b-dense
+  matchPatterns:
+    - mini/qwopus3.8-27b-dense
+  capabilities:
+    reasoning: true
+  quirks:
+    measuredUnder:
+      runtime: "LiteLLM route mini/qwopus3.8-27b-dense-q6; model_info.runtime llama.cpp"
+      date: "2026-09-16"
+      source: "Operator report and current-source request to blade-gateway, reproduced during v0.4.9 closeout"
+      note: |
+        The exact route rejected an omitted effort with Jinja's diagnostic
+        Unexpected reasoning effort high. Supported types are xhigh
+        (default), medium, and low. Clio's captured request carried only
+        enable_thinking true. The upstream behavior is consistent with an
+        incompatible deployment default; its precise cause was not inspected.
+        These effort levels come from that server diagnostic, not from
+        Qwen or Qwopus name similarity. Other capabilities remain supplied
+        by the route probe; no sampler, hardware, or context size is inherited.
+    thinking:
+      mechanism: effort-levels
+      effortByLevel:
+        low: low
+        medium: medium
+        xhigh: xhigh
+      guidance: |
+        The measured mini/qwopus3.8-27b-dense-q6 route accepts low, medium,
+        and xhigh, and rejects high. Clio maps high and max to xhigh and
+        explicitly forwards that supported effort through LiteLLM. Omitting
+        active effort can expose an incompatible deployment default.
+
 - family: qwen3.8-27b
   matchPatterns:
     - qwen3.8-27b
@@ -829,23 +860,23 @@
     leakageNote: |
       LM Studio's gemma4 chat template emits chain-of-thought as plain text
       bracketed by literal '<|channel>thought\n' and '<channel|>' markers
-      rather than structured reasoning fragments. The OpenAI-compatible path
-      currently exposes those markers as the server streams them; filtering
-      this family remains a follow-up.
+      rather than structured reasoning fragments. Clio splits those regions into
+      thinking content on the OpenAI-compatible stream, including LM Studio,
+      and removes the channel markers from the visible answer.
     gpuTiers:
       "48gb": "Fits at f16 KV when parallel=1 and ctx=122880; drop to q8_0 KV at parallel=4."
       "80gb": "Comfortable at f16 KV with parallel=1 and ctx=122880."
     runtimePreference:
       lmstudio: "Pin parallel=1 in the LM Studio per-model preset to give a single agent the full 122880 context."
-      openaiCompat: "LM Studio chat uses this surface; visible text may contain the raw channel markers."
+      openaiCompat: "LM Studio chat uses this surface; Clio separates inline thought regions and removes their channel markers."
     thinking:
       mechanism: on-off
       guidance: |
         Gemma 4 chat template exposes thinking only as on or off; intermediate
         levels coerce to on. NVFP4 quantization can corrupt JSON tool-call
         output under aggressive sampling, so the instruct profile pins
-        temperature at 0.7. LM Studio's OpenAI-compatible stream currently
-        exposes channel markers when the server does not classify them.
+        temperature at 0.7. Clio classifies inline channel markers on LM Studio's
+        OpenAI-compatible stream when the server leaves them in content.
     serving: "LilaRest publishes no per-model sampler; values inherit the gemma family default per the official Google Gemma 4 31B card. KV cache budget at f16, ctx=122880 is roughly 57 GB on top of ~21 GB of NVFP4 weights."
 
 # The qat/UD-Q4_K_XL/MTP build is the long-context llama.cpp gemma profile and is a
@@ -928,7 +959,7 @@
       "32gb": "32 GB Vulkan llama.cpp profile with UD-Q4_K_XL weights, ctx=262144, q8 KV, flash attention, parallel=1, F16 gemma4v mmproj (vision), and MTP draft (spec-type draft-mtp, n_max 4) both active."
     runtimePreference:
       llamaCpp: "OpenAI-compatible chat completions with --jinja and --reasoning off. Recommended local profile serves at ctx=262144, q8 KV, flash attention, parallel=1, batch=1024, ubatch=256, with F16 mmproj vision and draft-mtp speculative decoding; sampler temperature 0.8, top_p 0.95, top_k 64, repeat_penalty 1.05."
-      openaiCompat: "Fallback when a gateway fronts the same llama.cpp chat-completions surface; the openai-compat surface does not expose the channel-marker classifier, so visible text may show raw thought markers."
+      openaiCompat: "Fallback when a gateway fronts the same llama.cpp chat-completions surface; Clio separates inline thought regions with the shared channel-marker filter."
     llamaCpp:
       ctxSize: 262144
       cacheTypeK: q8_0
@@ -1008,15 +1039,16 @@
       "48gb": "Fits at f16 KV with parallel=1; q8_0 KV recommended at parallel=4."
       "80gb": "Comfortable at f16 KV with parallel=1 and ctx=122880."
     runtimePreference:
-      lmstudio: "LM Studio's OpenAI-compatible stream may expose this family's channel markers as visible text."
+      lmstudio: "LM Studio may stream inline channel markers; Clio separates the thought region and removes the markers from the answer."
       openaiCompat: "Fallback; reasoning_content is absent from the openai-compat reasoning probe for this family."
     thinking:
       mechanism: always-on
       guidance: |
         Distilled traces emit unconditionally. The thinking level setting is
         ignored at the API surface; chain-of-thought arrives whether or not
-        Clio asks for it. Channel-marker filtering remains a follow-up for the
-        OpenAI-compatible LM Studio path.
+        Clio asks for it. The shared channel-marker filter splits inline thought
+        regions into thinking content on the OpenAI-compatible LM Studio path
+        and removes the markers from the visible answer.
     serving: "Distilled from Claude 4.6 Opus reasoning traces onto Google Gemma 4 31B; sampler matches the gemopus card values."
 
 - family: qwopus3.6-27b-v1-preview

package/src/domains/providers/probe/http.ts

@@ -13,84 +13,69 @@ export interface HttpProbeOptions {
 
 export type JsonProbeOptions = HttpProbeOptions;
 
-export interface JsonProbeResult<T = unknown> extends ProbeResult {
-	data?: T;
+export interface HttpProbeResult extends ProbeResult {
+	/** Status of a completed HTTP response; absent when body/transport work fails. */
+	status?: number;
 }
 
-export async function probeHttp(opts: HttpProbeOptions): Promise<ProbeResult> {
-	const { response, latencyMs, error } = await runFetch(opts);
-	if (response === null) return { ok: false, error: error ?? "unknown transport error", latencyMs };
-	const method = opts.method ?? "GET";
-	if (response.ok) return { ok: true, latencyMs };
-	// Some servers reject HEAD with 405 even though the endpoint is reachable.
-	if (method === "HEAD" && response.status === 405) return { ok: true, latencyMs };
-	return {
-		ok: false,
-		latencyMs,
-		error: `HTTP ${response.status}: ${response.statusText}`,
-	};
+export interface JsonProbeResult<T = unknown> extends HttpProbeResult {
+	data?: T;
 }
 
-export async function probeJson<T = unknown>(opts: JsonProbeOptions): Promise<JsonProbeResult<T>> {
-	const { response, latencyMs, error } = await runFetch(opts);
-	if (response === null) return { ok: false, error: error ?? "unknown transport error", latencyMs };
-	const method = opts.method ?? "GET";
-	if (!response.ok && !(method === "HEAD" && response.status === 405)) {
-		return {
-			ok: false,
-			latencyMs,
-			error: `HTTP ${response.status}: ${response.statusText}`,
-		};
-	}
-	let data: T;
-	try {
-		data = (await response.json()) as T;
-	} catch (err) {
-		return { ok: false, latencyMs, error: `JSON parse: ${describeError(err)}` };
-	}
-	return { ok: true, latencyMs, data };
+export async function probeHttp(opts: HttpProbeOptions): Promise<HttpProbeResult> {
+	return runProbe(opts, false);
 }
 
-interface FetchOutcome {
-	response: Response | null;
-	latencyMs: number;
-	error?: string;
+export async function probeJson<T = unknown>(opts: JsonProbeOptions): Promise<JsonProbeResult<T>> {
+	return runProbe<T>(opts, true);
 }
 
-async function runFetch(opts: HttpProbeOptions): Promise<FetchOutcome> {
+/** Own the request until its body has been consumed or cancelled. */
+async function runProbe<T>(opts: HttpProbeOptions, readJson: boolean): Promise<JsonProbeResult<T>> {
 	const controller = new AbortController();
-	let timedOut = false;
-	const timer = setTimeout(() => {
-		timedOut = true;
+	let abortError: string | undefined;
+	const abort = (error: string): void => {
+		if (controller.signal.aborted) return;
+		abortError = error;
 		controller.abort();
-	}, opts.timeoutMs);
-	const onExternalAbort = () => controller.abort();
-	if (opts.signal) {
-		if (opts.signal.aborted) controller.abort();
-		else opts.signal.addEventListener("abort", onExternalAbort, { once: true });
-	}
-	const init: RequestInit = {
-		method: opts.method ?? "GET",
-		signal: controller.signal,
 	};
+	const timer = setTimeout(() => abort(`timeout after ${opts.timeoutMs}ms`), opts.timeoutMs);
+	const onExternalAbort = () => abort("aborted by caller");
+	if (opts.signal?.aborted) onExternalAbort();
+	else opts.signal?.addEventListener("abort", onExternalAbort, { once: true });
+	const method = opts.method ?? "GET";
+	const init: RequestInit = { method, signal: controller.signal };
 	if (opts.headers) init.headers = opts.headers;
 	if (opts.body !== undefined) init.body = opts.body;
 	const started = performance.now();
+	let latencyMs: number | undefined;
+	let parsingJson = false;
 	try {
 		const response = await fetch(opts.url, init);
-		return { response, latencyMs: Math.round(performance.now() - started) };
-	} catch (err) {
-		const latencyMs = Math.round(performance.now() - started);
-		if (timedOut) {
-			return { response: null, latencyMs, error: `timeout after ${opts.timeoutMs}ms` };
+		// Preserve the existing network latency measurement at response headers.
+		latencyMs = Math.round(performance.now() - started);
+		// HEAD 405 demonstrates reachability, but does not supply JSON data.
+		const ok = response.ok || (method === "HEAD" && response.status === 405);
+		if (!ok || !readJson) {
+			await response.body?.cancel();
+			controller.signal.throwIfAborted();
+			return ok
+				? { ok: true, latencyMs, status: response.status }
+				: { ok: false, latencyMs, status: response.status, error: `HTTP ${response.status}: ${response.statusText}` };
 		}
-		if (opts.signal?.aborted) {
-			return { response: null, latencyMs, error: "aborted by caller" };
-		}
-		return { response: null, latencyMs, error: describeError(err) };
+		parsingJson = true;
+		const data = (await response.json()) as T;
+		controller.signal.throwIfAborted();
+		return { ok: true, latencyMs, status: response.status, data };
+	} catch (err) {
+		return {
+			ok: false,
+			latencyMs: latencyMs ?? Math.round(performance.now() - started),
+			error: abortError ?? `${parsingJson ? "JSON parse: " : ""}${describeError(err)}`,
+		};
 	} finally {
 		clearTimeout(timer);
-		if (opts.signal) opts.signal.removeEventListener("abort", onExternalAbort);
+		opts.signal?.removeEventListener("abort", onExternalAbort);
 	}
 }
 

package/src/domains/providers/probe/reasoning.ts

@@ -95,6 +95,8 @@ export async function probeOpenAICompatReasoning(opts: ProbeReasoningOptions): P
 		});
 		const latencyMs = Math.round(performance.now() - started);
 		if (!response.ok) {
+			await response.body?.cancel();
+			controller.signal.throwIfAborted();
 			return { reasoning: false, latencyMs, error: `HTTP ${response.status}: ${response.statusText}` };
 		}
 		const data = (await response.json()) as ChatCompletionResponse;

package/src/domains/providers/runtimes/local-native/llamacpp-embed.ts

@@ -54,27 +54,6 @@ function flattenNativeEmbedding(entry: NativeEmbeddingItem): number[] {
 	return value as number[];
 }
 
-async function postJson<T>(
-	url: string,
-	body: unknown,
-	signal: AbortSignal | undefined,
-): Promise<{ status: number; data: T | null }> {
-	const init: RequestInit = {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify(body),
-	};
-	if (signal) init.signal = signal;
-	const response = await fetch(url, init);
-	if (!response.ok) return { status: response.status, data: null };
-	try {
-		const data = (await response.json()) as T;
-		return { status: response.status, data };
-	} catch {
-		return { status: response.status, data: null };
-	}
-}
-
 const llamacppEmbedRuntime: RuntimeDescriptor = {
 	id: "llamacpp-embed",
 	displayName: "llama.cpp (embeddings)",
@@ -90,16 +69,16 @@ const llamacppEmbedRuntime: RuntimeDescriptor = {
 		const healthOpts = { url: `${base}/health`, timeoutMs: ctx.httpTimeoutMs } as const;
 		const health = await (ctx.signal ? probeHttp({ ...healthOpts, signal: ctx.signal }) : probeHttp(healthOpts));
 		if (!health.ok) return health;
-		const probeResponse = await fetch(`${base}/embedding`, {
+		const probeResponse = await probeHttp({
+			url: `${base}/embedding`,
 			method: "POST",
+			timeoutMs: ctx.httpTimeoutMs,
 			headers: { "content-type": "application/json" },
 			body: JSON.stringify({ content: "probe" }),
 			...(ctx.signal ? { signal: ctx.signal } : {}),
-		}).catch((err) => {
-			return new Response(null, { status: 599, statusText: String(err) });
 		});
 		if (!probeResponse.ok) {
-			return { ok: false, error: `/embedding not available: HTTP ${probeResponse.status}` };
+			return { ok: false, error: `/embedding not available: ${probeResponse.error}` };
 		}
 		const props = await probeLlamaCppProps(base, ctx, target.defaultModel);
 		const result: ProbeResult = { ok: true };
@@ -129,12 +108,15 @@ const llamacppEmbedRuntime: RuntimeDescriptor = {
 		if (!base) throw new Error("target has no url");
 		const modelId = target.defaultModel ?? "default";
 		const inputs = Array.isArray(input) ? input : [input];
-		const oai = await postJson<OaiEmbeddingResponse>(
-			`${base}/v1/embeddings`,
-			{ input: inputs, model: modelId, encoding_format: "float" },
-			ctx.signal,
-		);
-		if (oai.data && Array.isArray(oai.data.data)) {
+		const oai = await probeJson<OaiEmbeddingResponse>({
+			url: `${base}/v1/embeddings`,
+			method: "POST",
+			timeoutMs: ctx.httpTimeoutMs,
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ input: inputs, model: modelId, encoding_format: "float" }),
+			...(ctx.signal ? { signal: ctx.signal } : {}),
+		});
+		if (oai.ok && oai.data && Array.isArray(oai.data.data)) {
 			const rows = oai.data.data;
 			const sorted = [...rows].sort((a, b) => (a.index ?? 0) - (b.index ?? 0));
 			const vectors = sorted.map((row) => row.embedding ?? []);
@@ -148,6 +130,13 @@ const llamacppEmbedRuntime: RuntimeDescriptor = {
 			if (tokens !== undefined) result.tokensUsed = tokens;
 			return result;
 		}
+		// Only endpoint-unavailable responses permit trying the native route.
+		// Cancellation, transport failures and malformed successes must not
+		// submit a second inference request.
+		if (oai.status === undefined || ![404, 405, 501].includes(oai.status)) {
+			throw new Error(`llama.cpp embedding failed: ${oai.error ?? "invalid OAI embedding response"}`);
+		}
+		if (ctx.signal?.aborted) throw new Error("llama.cpp embedding failed: aborted by caller");
 		const probeOpts = { url: `${base}/embedding`, timeoutMs: ctx.httpTimeoutMs } as const;
 		const native = await (ctx.signal
 			? probeJson<NativeEmbeddingItem[]>({

package/src/domains/providers/runtimes/local-native/llamacpp-rerank.ts

@@ -51,14 +51,19 @@ const llamacppRerankRuntime: RuntimeDescriptor = {
 		const health = await (ctx.signal ? probeHttp({ ...healthOpts, signal: ctx.signal }) : probeHttp(healthOpts));
 		if (!health.ok) return health;
 		const modelId = target.defaultModel ?? "default";
-		const probeResponse = await fetch(`${base}/reranking`, {
+		const probeResponse = await probeHttp({
+			url: `${base}/reranking`,
 			method: "POST",
+			timeoutMs: ctx.httpTimeoutMs,
 			headers: { "content-type": "application/json" },
 			body: JSON.stringify({ query: "probe", documents: ["a"], model: modelId }),
 			...(ctx.signal ? { signal: ctx.signal } : {}),
-		}).catch((err) => new Response(null, { status: 599, statusText: String(err) }));
-		if (!(probeResponse.status === 200 || probeResponse.status === 202)) {
-			return { ok: false, error: `/reranking not available: HTTP ${probeResponse.status}` };
+		});
+		if (!probeResponse.ok || !(probeResponse.status === 200 || probeResponse.status === 202)) {
+			return {
+				ok: false,
+				error: `/reranking not available: ${probeResponse.error ?? `HTTP ${probeResponse.status}`}`,
+			};
 		}
 		const props = await probeLlamaCppProps(base, ctx, target.defaultModel);
 		const result: ProbeResult = { ok: true };