ltcai 10.3.0 → 10.4.0

package/latticeai/runtime/review_wiring.py

@@ -5,7 +5,12 @@ from __future__ import annotations
 from typing import Any, Callable, Dict, Optional
 
 
-def build_review_run_now_runner(platform: Any, http_exception: type[Exception]) -> Callable[..., Any]:
+def build_review_run_now_runner(
+    platform: Any,
+    # Injected as `fastapi.HTTPException`, which takes (status_code, detail) —
+    # not the bare `Exception` signature the narrower annotation implied.
+    http_exception: Callable[..., Exception],
+) -> Callable[..., Any]:
     """Build the Review Center run-now runner used by the API router.
 
     The runner preserves the public contract: "Run now" previews/regenerates the

package/latticeai/runtime/runtime_context.py

@@ -0,0 +1,276 @@
+"""The assembly state the build phases share.
+
+``app_factory._build`` was one 1,300-line function. That was not an accident:
+its sections genuinely depend on each other, and several of them close over
+names bound *further down* — ``save_to_history`` calls ``append_audit_event``,
+which is built ~150 lines later. Inside a single function that works, because a
+closure resolves a free variable when it is called, not when it is defined.
+Any naive extraction breaks exactly there (10.3.0 hit this and documented it).
+
+``RuntimeContext`` is what makes the extraction safe. It is a mutable object
+that every phase writes into and reads from, so a closure created in phase 2
+that calls ``ctx.append_audit_event`` still resolves it at call time — the same
+late binding the single function had, now with the shared state named instead
+of implicit.
+
+Two properties keep it honest:
+
+* **Attributes are declared, not defaulted.** Reading one before its phase has
+  run raises ``AttributeError`` naming the attribute, rather than silently
+  yielding ``None`` and failing somewhere unrelated.
+* **The phase order is a contract.** ``tests/unit/test_runtime_context.py``
+  fixes which phase produces which attribute, so reordering the phases in a way
+  that breaks a dependency fails a test instead of production.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List, Set
+
+
+class RuntimeContext:
+    """Mutable state carried across the ordered application build phases."""
+
+    # ── phase 1: platform ────────────────────────────────────────────────
+    mx: Any
+
+    # ── phase 2: configuration and paths ─────────────────────────────────
+    config_arg: Any
+    config_runtime: Any
+    security_runtime: Any
+    CONFIG: Any
+    APP_VERSION: str
+    APP_MODE: str
+    IS_PUBLIC_MODE: bool
+    DEFAULT_HOST: str
+    DEFAULT_PORT: int
+    ENABLE_TELEGRAM: bool
+    ENABLE_GRAPH: bool
+    AUTOLOAD_MODELS: bool
+    MODEL_IDLE_UNLOAD_SECONDS: Any
+    ALLOW_MODEL_DOWNLOADS: bool
+    MODEL_DOWNLOAD_TIMEOUT: Any
+    ALLOW_LOCAL_MODELS: bool
+    REQUIRE_AUTH: bool
+    ALLOW_PLAINTEXT_API_KEYS: bool
+    CORS_ALLOW_NETWORK: bool
+    CORS_EXTRA_ORIGINS: Any
+    PUBLIC_MODEL: str
+    LOCAL_MODEL: Any
+    LOCAL_DRAFT_MODEL: Any
+    OPEN_REGISTRATION: bool
+    SSO_DISCOVERY_URL: Any
+    SSO_CLIENT_ID: Any
+    SSO_CLIENT_SECRET: Any
+    SSO_REDIRECT_URI: Any
+    SSO_PROVIDER_NAME: Any
+    INVITE_CODE: Any
+    INVITE_COOKIE_SECRET: Any
+    INVITE_GATE_ENABLED: bool
+    SECURE_COOKIES: bool
+    BASE_DIR: Any
+    DATA_DIR: Any
+    STATIC_DIR: Any
+    USERS_FILE: Any
+    HISTORY_FILE: Any
+    VPC_FILE: Any
+    AUDIT_FILE: Any
+    SSO_FILE: Any
+    keyring: Any
+
+    # ── phase 3: identity, audit, history ────────────────────────────────
+    load_mcp_installs: Any
+    mcp_public_item: Any
+    recommend_mcps: Any
+    install_mcp: Any
+    _SESSION_TTL: Any
+    _session_store: Any
+    create_session: Any
+    get_session_email: Any
+    invalidate_session: Any
+    load_users: Any
+    save_users: Any
+    user_id_for_email: Any
+    verify_and_migrate_password: Any
+    redact_secret_text: Any
+    get_audit_log: Any
+    append_audit_event: Any
+    classify_sensitive_message: Any
+    build_sensitivity_report: Any
+    build_admin_audit_report: Any
+    get_user_role: Any
+    _extract_bearer_token: Any
+    get_current_user: Any
+    require_user: Any
+    require_admin: Any
+    public_user: Any
+    _RATE_LIMIT_ENABLED: bool
+    enforce_rate_limit: Any
+    _check_rate_limit: Any
+    _client_ip: Any
+    _bytes_match_extension: Any
+    _host_is_loopback: Any
+    get_history_user: Any
+    get_user_api_key: Any
+    set_user_api_key: Any
+    get_sso_settings: Any
+    public_sso_config: Any
+    save_sso_config: Any
+    _get_sso_discovery: Any
+    _sso_states: Any
+    _sso_env_defaults: Any
+    load_vpc_config: Any
+    save_vpc_config: Any
+
+    # ── phase 4: brain, persistence ──────────────────────────────────────
+    EMBEDDING_PROFILE: Any
+    EMBEDDER: Any
+    STORAGE_ENGINE: Any
+    brain_runtime: Any
+    KNOWLEDGE_GRAPH: Any
+    CONVERSATIONS: Any
+    save_to_history: Any
+    HOOKS_REGISTRY: Any
+    LOCAL_KG_WATCHER: Any
+    REALTIME_BUS: Any
+    WORKSPACE_OS: Any
+    WORKSPACE_SERVICE: Any
+    INVITATION_STORE: Any
+    PLUGIN_REGISTRY: Any
+    TEMPLATE_CATALOG: Any
+    AGENT_REGISTRY: Any
+    MEMORY_SERVICE: Any
+    BRAIN_INTELLIGENCE: Any
+    AUTOMATION_INTELLIGENCE: Any
+    INGESTION_PIPELINE: Any
+    DEVICE_IDENTITY: Any
+    KG_PORTABILITY: Any
+    FUNNEL_METRICS: Any
+    get_history: Any
+    conversation_title: Any
+    group_history_conversations: Any
+    get_conversation_messages: Any
+    clear_history: Any
+    clear_conversation: Any
+    _history_allowed_workspaces_for: Any
+    _history_include_legacy_global: Any
+    _require_graph: Any
+    _workspace_graph: Any
+
+    # ── phase 5: domain services ─────────────────────────────────────────
+    model_router: Any
+    gardener: Any
+    CHAT_SERVICE: Any
+    SEARCH_SERVICE: Any
+    BRAIN_MEMORY: Any
+    CONTEXT_ASSEMBLER: Any
+    ARTIFACT_LEDGER: Any
+    _scoped_hybrid_search: Any
+    CHAT_AGENT_RUNTIME: Any
+    on_chat_message: Any
+    _recent_chat_context: Any
+    _workspace_settings_payload: Any
+    _workspace_models_payload: Any
+    _embedding_info: Any
+    _allowed_workspaces_for: Any
+    app_context: Any
+
+    # ── phase 6: web app and foundation routers ──────────────────────────
+    _spawn: Any
+    lifespan: Any
+    app: Any
+    model_runtime_service: Any
+    STATIC_ROUTES: Any
+    ui_file_response: Any
+    local_sysinfo: Any
+    invite_authorized: Any
+    auth_router: Any
+    admin_router: Any
+    invitations_router: Any
+    security_router: Any
+    _graph_stats_safe: Any
+    _product_hardening_status: Any
+    _security_audit_events_safe: Any
+    _security_list_uploaded_files: Any
+
+    # ── phase 7: platform features ───────────────────────────────────────
+    _llm_generate_sync: Any
+    PLATFORM: Any
+    _automation_runtime: Any
+    REVIEW_QUEUE: Any
+    TRIGGER_SERVICE: Any
+    AGENT_RUNTIME: Any
+    RUN_EXECUTOR: Any
+    COMMAND_CENTER: Any
+    CHANGE_PROPOSALS: Any
+    EVIDENCE_ACTIONS_SERVICE: Any
+    VOICE_CAPTURE: Any
+    PROJECT_SESSIONS: Any
+
+    # ── phase 8: interaction routers ─────────────────────────────────────
+    model_runtime: Any
+
+    # ── legacy compatibility surface (phase 9 reads these) ───────────────
+    legacy: Dict[str, Any]
+
+    def __init__(self, config: Any = None) -> None:
+        self.config_arg = config
+        self.legacy = {}
+        self._produced: Dict[str, str] = {}
+        self._phase: str = "<none>"
+
+    # ── phase bookkeeping ────────────────────────────────────────────────
+    def enter(self, phase: str) -> None:
+        """Mark which phase subsequent ``set`` calls belong to."""
+        self._phase = phase
+
+    def set(self, **values: Any) -> None:
+        """Publish values produced by the current phase.
+
+        Recording the producing phase is what lets the ordering test assert a
+        contract instead of a comment.
+        """
+        for name, value in values.items():
+            setattr(self, name, value)
+            self._produced.setdefault(name, self._phase)
+
+    def adopt(self, stage: Any, *names: str) -> None:
+        """Publish selected keys of a runtime-stage mapping onto the context."""
+        self.set(**{name: stage[name] for name in names})
+
+    def require(self, name: str) -> Any:
+        """Read an attribute, failing with the phase contract if it is unset.
+
+        The bare ``AttributeError`` is already specific; this adds which phase
+        was supposed to have produced the value, which is the actual question
+        when a phase gets reordered.
+        """
+        try:
+            return getattr(self, name)
+        except AttributeError:
+            producer = self._produced.get(name)
+            hint = f" (produced by phase {producer!r})" if producer else ""
+            raise RuntimeError(
+                f"RuntimeContext.{name} was read before it was built{hint}"
+            ) from None
+
+    @property
+    def produced_by(self) -> Dict[str, str]:
+        """Attribute name → the phase that published it, for the order test."""
+        return dict(self._produced)
+
+    def names(self) -> Set[str]:
+        return set(self._produced)
+
+    def phases_run(self) -> List[str]:
+        seen: List[str] = []
+        for phase in self._produced.values():
+            if phase not in seen:
+                seen.append(phase)
+        return seen
+
+    def __repr__(self) -> str:  # pragma: no cover - debugging aid
+        return f"<RuntimeContext phase={self._phase!r} names={len(self._produced)}>"
+
+
+__all__ = ["RuntimeContext"]

package/latticeai/runtime/sso_config_runtime.py

@@ -97,7 +97,7 @@ def build_sso_config_runtime(
 
     async def _get_sso_discovery() -> Optional[Dict]:
         settings = get_sso_settings()
-        url = settings.get("discovery_url", "")
+        url = str(settings.get("discovery_url", "") or "")
         if _discovery_cache["data"] and _discovery_cache["url"] == url:
             return _discovery_cache["data"]
         if not url:

package/latticeai/runtime/stages.py

@@ -2,13 +2,19 @@
 
 from __future__ import annotations
 
-from dataclasses import fields
-from typing import Any, Iterator, Mapping
+from dataclasses import Field, fields
+from typing import TYPE_CHECKING, Any, ClassVar, Dict, Iterator, Mapping
 
 
 class RuntimeStage(Mapping[str, Any]):
     """Dataclass mixin that preserves the legacy mapping access during DI migration."""
 
+    if TYPE_CHECKING:
+        # The mixin is only ever combined with @dataclass classes; declaring
+        # the marker attribute is how a type checker learns that `fields(self)`
+        # is legal here (see the dataclasses stubs' DataclassInstance protocol).
+        __dataclass_fields__: ClassVar[Dict[str, Field[Any]]]
+
     def __getitem__(self, key: str) -> Any:
         if key not in self:
             raise KeyError(key)

package/latticeai/services/app_context.py

@@ -97,3 +97,26 @@ class AppContext:
     # persisted; ``None`` means no external chat mirror is registered. The
     # telegram bridge subscribes here only when ENABLE_TELEGRAM is truthy.
     on_chat_message: Optional[Callable[..., None]] = None
+
+    def require(self, field: str) -> Any:
+        """Return a dependency this router cannot operate without.
+
+        Every field defaults to ``None`` so a test can build a context holding
+        only what it exercises. A router that binds an absent dependency used
+        to discover it as ``TypeError: 'NoneType' object is not callable``
+        inside a request handler, far from the wiring mistake. Binding through
+        ``require`` moves that to router construction with the field named.
+
+        It is also what makes the binding statically honest: the declared type
+        is ``Optional[...]``, so a type checker reports every call site as
+        ``"None" not callable`` — 105 of them in the workspace router alone.
+        ``require`` states the precondition once instead.
+        """
+        if field not in self.__dataclass_fields__:
+            raise AttributeError(f"AppContext has no field {field!r}")
+        value = getattr(self, field)
+        if value is None:
+            raise RuntimeError(
+                f"AppContext.{field} is required by this router but was not provided"
+            )
+        return value

package/latticeai/services/architecture_readiness.py

@@ -16,7 +16,7 @@ from typing import Any, Dict, List
 
 from latticeai.core.legacy_compatibility import legacy_shim_report
 
-ARCHITECTURE_VERSION_TARGET = "10.3.0"
+ARCHITECTURE_VERSION_TARGET = "10.4.0"
 
 PREFERRED_REFACTORING_ORDER = [
     "agent-runtime",

package/latticeai/services/brain_intelligence.py

@@ -143,7 +143,7 @@ class BrainIntelligenceService:
             stale_cutoff = now - timedelta(days=_STALE_DAYS)
             dated = [(_parse_ts(n.get("updated_at")), n) for n in nodes]
             known = [pair for pair in dated if pair[0] is not None]
-            stale = [n for ts, n in known if ts < stale_cutoff]
+            stale = [n for ts, n in known if ts is not None and ts < stale_cutoff]
             fresh_ratio = 1.0 - (len(stale) / len(known)) if known else 0.0
             dimensions["freshness"] = {
                 "status": "ok",
@@ -576,7 +576,9 @@ class BrainIntelligenceService:
                     for c in conflicts
                 ):
                     continue
-                other = next((r for r in memory_rows if r["id"] == other_id), None)
+                other: Dict[str, Any] | None = next(
+                    (r for r in memory_rows if r["id"] == other_id), None
+                )
                 conflicts.append({
                     "kind": "memory_pair",
                     "left_id": candidate.id,

package/latticeai/services/cloud_streaming.py

@@ -46,7 +46,9 @@ class CloudTurnResult:
 
 
 class CloudLLMAdapter(Protocol):
-    async def stream(
+    # `def`, not `async def`: implementations are async generators, so the
+    # call itself returns the iterator rather than a coroutine wrapping it.
+    def stream(
         self,
         *,
         system: str,
@@ -107,7 +109,7 @@ class CloudStreamingBridge:
             answer_text=answer,
             sent_node_ids=list(minimal.node_ids),
             provider=getattr(self._adapter, "provider_name", "cloud"),
-            model=model or getattr(self._adapter, "default_model", ""),
+            model=str(model or getattr(self._adapter, "default_model", "")),
         )
 
 
@@ -157,7 +159,7 @@ def plan_kg_expansion(result: CloudTurnResult) -> KGExpansionPlan:
         )
 
     return KGExpansionPlan(
-        conversation_title=conv_node["title"],
+        conversation_title=str(conv_node["title"]),
         new_nodes=[conv_node],
         new_edges=edges,
         provenance={

package/latticeai/services/command_center.py

@@ -185,7 +185,7 @@ class CommandCenterService:
             "drafts": drafts,
         }
         if last_execution is not None:
-            section["last_execution"] = last_execution
+            section["last_execution"] = last_execution  # type: ignore[assignment]
         return section
 
     def _review_section(

package/latticeai/services/evidence_actions.py

@@ -150,7 +150,8 @@ class EvidenceActionService:
                 missing.append(node_id)
                 continue
             # /api/graph/node wraps the record; get_node returns it directly.
-            record = node.get("node") if isinstance(node.get("node"), Mapping) else node
+            wrapped = node.get("node")
+            record: Mapping[str, Any] = wrapped if isinstance(wrapped, Mapping) else node
             title = str(record.get("title") or record.get("id") or node_id)
             body = str(record.get("summary") or record.get("content") or "").strip()
             metadata = record.get("metadata")

package/latticeai/services/hybrid_chat.py

@@ -202,7 +202,7 @@ async def stream_hybrid_cloud_turn(
                 answer_text=answer,
                 sent_node_ids=list(minimal.node_ids),
                 provider=getattr(chosen_adapter, "provider_name", "cloud"),
-                model=model or getattr(chosen_adapter, "default_model", ""),
+                model=str(model or getattr(chosen_adapter, "default_model", "")),
             )
         else:
             result = await bridge.run_turn(

package/latticeai/services/local_knowledge.py

@@ -57,8 +57,9 @@ class LocalKnowledgeWatcher:
         self._hooks = hooks
         self._lock = threading.Lock()
         self._watched: Dict[str, Dict[str, Any]] = {}
-        self._observer_cls = None
-        self._event_handler_base = None
+        # watchdog is optional; these stay None when it is not installed.
+        self._observer_cls: Optional[Any] = None
+        self._event_handler_base: Optional[Any] = None
         self._import_error = ""
         try:
             from watchdog.events import FileSystemEventHandler
@@ -127,12 +128,21 @@ class LocalKnowledgeWatcher:
 
         self.stop_source(source_id)
 
-        class Handler(_LocalWatchHandler, self._event_handler_base):  # type: ignore[misc, valid-type]
+        handler_base = self._event_handler_base
+        observer_cls = self._observer_cls
+        if handler_base is None or observer_cls is None:
+            return {
+                "watching": False,
+                "source_id": source_id,
+                "error": self._import_error or "watchdog is not installed",
+            }
+
+        class Handler(_LocalWatchHandler, handler_base):  # type: ignore[misc, valid-type]
             def __init__(handler_self):
-                self._event_handler_base.__init__(handler_self)
+                handler_base.__init__(handler_self)  # type: ignore[misc]
                 _LocalWatchHandler.__init__(handler_self, lambda: self._schedule(source_id))
 
-        observer = self._observer_cls()
+        observer = observer_cls()
         try:
             observer.schedule(Handler(), str(root), recursive=True)
             observer.start()
@@ -161,6 +171,8 @@ class LocalKnowledgeWatcher:
             timer.cancel()
         observer = item.get("observer")
         try:
+            if observer is None:
+                raise RuntimeError("watch entry has no observer")
             observer.stop()
             observer.join(timeout=3)
         except Exception as exc:
@@ -285,8 +297,10 @@ def create_local_knowledge_router(
     async def knowledge_graph_local_sources(request: Request):
         require_user(request)
         payload = graph().local_sources()
-        watch_status = watcher.status() if watcher else {"available": False, "active": {}}
-        active = watch_status.get("active", {})
+        watch_status: Dict[str, Any] = (
+            watcher.status() if watcher else {"available": False, "active": {}}
+        )
+        active: Dict[str, Any] = dict(watch_status.get("active") or {})
         for source in payload.get("sources", []):
             source["watch_active"] = source.get("id") in active
             source["watch_status"] = active.get(source.get("id"))
@@ -305,8 +319,10 @@ def create_local_knowledge_router(
         require_user(request)
         kg = graph()
         payload = kg.local_source_health(error_samples=error_samples)
-        watch_status = watcher.status() if watcher else {"available": False, "active": {}}
-        active = watch_status.get("active", {})
+        watch_status: Dict[str, Any] = (
+            watcher.status() if watcher else {"available": False, "active": {}}
+        )
+        active = dict(watch_status.get("active") or {})
         for folder in payload.get("folders", []):
             folder["watch_active"] = folder.get("id") in active
         payload["watch"] = watch_status

package/latticeai/services/memory_service.py

@@ -236,7 +236,7 @@ class MemoryService:
         elif kg_index:
             vector_total = kg_index.get("indexed") or kg_index.get("ready")
 
-        sources = [
+        sources: List[Dict[str, Any]] = [
             {
                 "id": "workspace", "type": "workspace", "label": "Workspace Memory",
                 "count": len(ws_mem), "size_bytes": ws_bytes if ws_mem else 0,
@@ -272,7 +272,7 @@ class MemoryService:
                 "detail": "Local embedding vector index." if kg_index else "Vector index unavailable.",
             },
         ]
-        total_items = sum((s["count"] or 0) for s in sources)
+        total_items = sum(int(s["count"] or 0) for s in sources)
         total_bytes = ws_bytes + kg_bytes + conv_bytes
         healthy = sum(1 for s in sources if s["health"] == "ok")
         overall = "ok" if healthy >= 4 else "degraded" if healthy >= 1 else "unavailable"
@@ -747,7 +747,11 @@ class MemoryService:
         graph_count = int(sources.get("graph", {}).get("count") or 0)
         vector_count = int(sources.get("vector", {}).get("count") or 0)
         query = recall_query.strip() or self._latest_recall_query(user_email=user_email, workspace_id=workspace_id)
-        recall = self.recall(query, user_email=user_email, workspace_id=workspace_id, limit=limit) if query else {"query": "", "results": [], "count": 0, "source": "live"}
+        recall: Dict[str, Any] = (
+            self.recall(query, user_email=user_email, workspace_id=workspace_id, limit=limit)
+            if query
+            else {"query": "", "results": [], "count": 0, "source": "live"}
+        )
         recall_items = [
             {
                 "id": item.get("id"),
@@ -760,7 +764,7 @@ class MemoryService:
                 "matched_terms": item.get("matched_terms") or [],
                 "confidence": item.get("confidence") or "low",
             }
-            for item in recall.get("results", [])[: max(1, min(limit, 8))]
+            for item in list(recall.get("results", []))[: max(1, min(limit, 8))]
         ]
         durable_items = workspace_count + conversation_count + graph_count
         # Capability and proof are deliberately separated. The brain is

package/latticeai/services/model_catalog.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 import re
 import sys
-from typing import Dict, List, Optional
+from typing import Any, Dict, List, Optional
 
 from latticeai.services.model_capability_registry import (
     LOCAL_MLX_MODELS as _LOCAL_MLX_MODELS,
@@ -34,7 +34,7 @@ from latticeai.services.model_capability_registry import (
     get_verified_models as _get_verified_models,
 )
 
-ENGINE_INSTALLERS = {
+ENGINE_INSTALLERS: Dict[str, Dict[str, Any]] = {
     "local_mlx": {
         "command": [sys.executable, "-m", "pip", "install", "--upgrade", "mlx-vlm>=0.6.3", "mlx-lm", "huggingface_hub[cli]"],
         "label": "Install MLX runtime",
@@ -89,10 +89,10 @@ ENGINE_INSTALLERS = {
 # user-facing ENGINE_MODEL_CATALOG below is then narrowed to the aggressive 5.2.0
 # policy (latest family generations only, no text-only/legacy weights) and the
 # engine-specific ids/sizes are normalised. See `_finalize_engine_catalog`.
-_RAW_ENGINE_MODEL_CATALOG: Dict[str, List[Dict[str, object]]] = _build_engine_model_catalog()
+_RAW_ENGINE_MODEL_CATALOG: Dict[str, List[Dict[str, Any]]] = _build_engine_model_catalog()
 # Filled in at module end once the blocklist, alias map and family-version filter
 # are all defined; declared here so the public name exists for static readers.
-ENGINE_MODEL_CATALOG: Dict[str, List[Dict[str, object]]] = {}
+ENGINE_MODEL_CATALOG: Dict[str, List[Dict[str, Any]]] = {}
 
 # Historical aliases preserved (used by _recommended_with_engine_options and resolution).
 # These can be enriched later from registry if needed; kept verbatim for safety.
@@ -173,7 +173,7 @@ def _version_tuple(raw: str) -> tuple[int, ...]:
     return tuple(int(part) for part in raw.split(".") if part.isdigit())
 
 
-def _model_family_version(model: Dict[str, object]) -> Optional[tuple[str, tuple[int, ...]]]:
+def _model_family_version(model: Dict[str, Any]) -> Optional[tuple[str, tuple[int, ...]]]:
     text = " ".join(str(model.get(key) or "") for key in ("family", "name", "id"))
     for family, pattern in _VERSIONED_MODEL_PATTERNS:
         match = pattern.search(text)
@@ -184,9 +184,9 @@ def _model_family_version(model: Dict[str, object]) -> Optional[tuple[str, tuple
     return None
 
 
-def filter_lower_family_versions(models: List[Dict[str, object]]) -> List[Dict[str, object]]:
+def filter_lower_family_versions(models: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
     max_versions: Dict[str, tuple[int, ...]] = {}
-    detected: List[tuple[Dict[str, object], Optional[tuple[str, tuple[int, ...]]]]] = []
+    detected: List[tuple[Dict[str, Any], Optional[tuple[str, tuple[int, ...]]]]] = []
     for model in models:
         version_info = _model_family_version(model)
         detected.append((model, version_info))
@@ -214,12 +214,12 @@ _BLOCKED_CATALOG_FRAGMENTS = (
 )
 
 
-def _is_blocked_catalog_id(model: Dict[str, object]) -> bool:
+def _is_blocked_catalog_id(model: Dict[str, Any]) -> bool:
     ident = str(model.get("id") or "").lower()
     return any(fragment in ident for fragment in _BLOCKED_CATALOG_FRAGMENTS)
 
 
-def _normalize_engine_entry(engine: str, model: Dict[str, object]) -> Dict[str, object]:
+def _normalize_engine_entry(engine: str, model: Dict[str, Any]) -> Dict[str, Any]:
     """Apply historical engine-specific id + size conventions to a raw entry.
 
     * Non-MLX engines resolve to their canonical packaged id via
@@ -243,9 +243,9 @@ def _normalize_engine_entry(engine: str, model: Dict[str, object]) -> Dict[str,
 
 
 def _finalize_engine_catalog(
-    raw: Dict[str, List[Dict[str, object]]],
-) -> Dict[str, List[Dict[str, object]]]:
-    final: Dict[str, List[Dict[str, object]]] = {}
+    raw: Dict[str, List[Dict[str, Any]]],
+) -> Dict[str, List[Dict[str, Any]]]:
+    final: Dict[str, List[Dict[str, Any]]] = {}
     for engine, models in raw.items():
         kept = [
             _normalize_engine_entry(engine, m)