fix: remove AirLLM config settings from config.py

Remove `airllm` from timmy_model_backend Literal type and delete the
airllm_model_size field plus associated comments. Replace the one
settings.airllm_model_size reference in agent.py with a hardcoded
default, and clean up mock assignments in tests.

Fixes #473

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/config.py

@@ -64,17 +64,10 @@ class Settings(BaseSettings):
     # Seconds to wait for user confirmation before auto-rejecting.
     discord_confirm_timeout: int = 120
 
-    # ── AirLLM / backend selection ───────────────────────────────────────────
+    # ── Backend selection ────────────────────────────────────────────────────
     # "ollama"  — always use Ollama (default, safe everywhere)
-    # "airllm"  — always use AirLLM (requires pip install ".[bigbrain]")
-    # "auto"    — use AirLLM on Apple Silicon if airllm is installed,
-    #             fall back to Ollama otherwise
-    timmy_model_backend: Literal["ollama", "airllm", "grok", "claude", "auto"] = "ollama"
-
-    # AirLLM model size when backend is airllm or auto.
-    # Larger = smarter, but needs more RAM / disk.
-    # 8b  ~16 GB  |  70b  ~140 GB  |  405b  ~810 GB
-    airllm_model_size: Literal["8b", "70b", "405b"] = "70b"
+    # "auto"    — auto-detect best available backend
+    timmy_model_backend: Literal["ollama", "grok", "claude", "auto"] = "ollama"
 
     # ── Grok (xAI) — opt-in premium cloud backend ────────────────────────
     # Grok is a premium augmentation layer — local-first ethos preserved.
@@ -138,7 +131,12 @@ class Settings(BaseSettings):
 
     # CORS allowed origins for the web chat interface (Gitea Pages, etc.)
     # Set CORS_ORIGINS as a comma-separated list, e.g. "http://localhost:3000,https://example.com"
-    cors_origins: list[str] = ["*"]
+    cors_origins: list[str] = [
+        "http://localhost:3000",
+        "http://localhost:8000",
+        "http://127.0.0.1:3000",
+        "http://127.0.0.1:8000",
+    ]
 
     # Trusted hosts for the Host header check (TrustedHostMiddleware).
     # Set TRUSTED_HOSTS as a comma-separated list. Wildcards supported (e.g. "*.ts.net").

src/dashboard/app.py

@@ -484,15 +484,14 @@ app = FastAPI(
 
 
 def _get_cors_origins() -> list[str]:
-    """Get CORS origins from settings, with sensible defaults."""
+    """Get CORS origins from settings, rejecting wildcards in production."""
     origins = settings.cors_origins
-    if settings.debug and origins == ["*"]:
-        return [
-            "http://localhost:3000",
-            "http://localhost:8000",
-            "http://127.0.0.1:3000",
-            "http://127.0.0.1:8000",
-        ]
+    if "*" in origins and not settings.debug:
+        logger.warning(
+            "Wildcard '*' in CORS_ORIGINS stripped in production — "
+            "set explicit origins via CORS_ORIGINS env var"
+        )
+        origins = [o for o in origins if o != "*"]
     return origins
 
 

src/infrastructure/router/api.py

@@ -183,6 +183,22 @@ async def run_health_check(
     }
 
 
+@router.post("/reload")
+async def reload_config(
+    cascade: Annotated[CascadeRouter, Depends(get_cascade_router)],
+) -> dict[str, Any]:
+    """Hot-reload providers.yaml without restart.
+
+    Preserves circuit breaker state and metrics for existing providers.
+    """
+    try:
+        result = cascade.reload_config()
+        return {"status": "ok", **result}
+    except Exception as exc:
+        logger.error("Config reload failed: %s", exc)
+        raise HTTPException(status_code=500, detail=f"Reload failed: {exc}") from exc
+
+
 @router.get("/config")
 async def get_config(
     cascade: Annotated[CascadeRouter, Depends(get_cascade_router)],

src/infrastructure/router/cascade.py

@@ -815,6 +815,66 @@ class CascadeRouter:
         provider.status = ProviderStatus.HEALTHY
         logger.info("Circuit breaker CLOSED for %s", provider.name)
 
+    def reload_config(self) -> dict:
+        """Hot-reload providers.yaml, preserving runtime state.
+
+        Re-reads the config file, rebuilds the provider list, and
+        preserves circuit breaker state and metrics for providers
+        that still exist after reload.
+
+        Returns:
+            Summary dict with added/removed/preserved counts.
+        """
+        # Snapshot current runtime state keyed by provider name
+        old_state: dict[
+            str, tuple[ProviderMetrics, CircuitState, float | None, int, ProviderStatus]
+        ] = {}
+        for p in self.providers:
+            old_state[p.name] = (
+                p.metrics,
+                p.circuit_state,
+                p.circuit_opened_at,
+                p.half_open_calls,
+                p.status,
+            )
+
+        old_names = set(old_state.keys())
+
+        # Reload from disk
+        self.providers = []
+        self._load_config()
+
+        # Restore preserved state
+        new_names = {p.name for p in self.providers}
+        preserved = 0
+        for p in self.providers:
+            if p.name in old_state:
+                metrics, circuit, opened_at, half_open, status = old_state[p.name]
+                p.metrics = metrics
+                p.circuit_state = circuit
+                p.circuit_opened_at = opened_at
+                p.half_open_calls = half_open
+                p.status = status
+                preserved += 1
+
+        added = new_names - old_names
+        removed = old_names - new_names
+
+        logger.info(
+            "Config reloaded: %d providers (%d preserved, %d added, %d removed)",
+            len(self.providers),
+            preserved,
+            len(added),
+            len(removed),
+        )
+
+        return {
+            "total_providers": len(self.providers),
+            "preserved": preserved,
+            "added": sorted(added),
+            "removed": sorted(removed),
+        }
+
     def get_metrics(self) -> dict:
         """Get metrics for all providers."""
         return {

src/timmy/agent.py

@@ -220,7 +220,7 @@ def create_timmy(
     print_response(message, stream).
     """
     resolved = _resolve_backend(backend)
-    size = model_size or settings.airllm_model_size
+    size = model_size or "70b"
 
     if resolved == "claude":
         from timmy.backends import ClaudeBackend
@@ -300,7 +300,11 @@ def create_timmy(
             max_context = 2000 if not use_tools else 8000
             if len(memory_context) > max_context:
                 memory_context = memory_context[:max_context] + "\n... [truncated]"
-            full_prompt = f"{base_prompt}\n\n## Memory Context\n\n{memory_context}"
+            full_prompt = (
+                f"{base_prompt}\n\n"
+                f"## GROUNDED CONTEXT (verified sources — cite when using)\n\n"
+                f"{memory_context}"
+            )
         else:
             full_prompt = base_prompt
     except Exception as exc:

src/timmy/prompts.py

@@ -23,6 +23,9 @@ Rules:
 - Remember what the user tells you during the conversation.
 - If you don't know something, say so honestly — never fabricate facts.
 - If a request is ambiguous, ask a brief clarifying question before guessing.
+- SOURCE DISTINCTION: When answering from memory or retrieved context, cite it.
+  When answering from your own training, use hedging: "I think", "I believe".
+  The user must be able to tell grounded claims from pattern-matching.
 - Use the user's name if you know it.
 - When you state a fact, commit to it.
 - NEVER attempt arithmetic in your head. If asked to compute anything, respond:
@@ -78,6 +81,18 @@ HONESTY:
 - Never fabricate tool output. Call the tool and wait.
 - If a tool errors, report the exact error.
 
+SOURCE DISTINCTION (SOUL requirement — non-negotiable):
+- Every claim you make comes from one of two places: a verified source you
+  can point to, or your own pattern-matching. The user must be able to tell
+  which is which.
+- When your response uses information from GROUNDED CONTEXT (memory, retrieved
+  documents, tool output), cite it: "From memory:", "According to [source]:".
+- When you are generating from your training data alone, signal it naturally:
+  "I think", "My understanding is", "I believe" — never false certainty.
+- If the user asks a factual question and you have no grounded source, say so:
+  "I don't have a verified source for this — from my training I think..."
+- Prefer "I don't know" over a confident-sounding guess. Refusal over fabrication.
+
 MEMORY (three tiers):
 - Tier 1: MEMORY.md (hot, always loaded)
 - Tier 2: memory/ vault (structured, append-only, date-stamped)

tests/infrastructure/test_router_cascade.py

@@ -516,3 +516,183 @@ class TestProviderAvailabilityCheck:
 
         with patch("importlib.util.find_spec", return_value=None):
             assert router._check_provider_available(provider) is False
+
+
+class TestCascadeRouterReload:
+    """Test hot-reload of providers.yaml."""
+
+    def test_reload_preserves_metrics(self, tmp_path):
+        """Test that reload preserves metrics for existing providers."""
+        config = {
+            "providers": [
+                {
+                    "name": "test-openai",
+                    "type": "openai",
+                    "enabled": True,
+                    "priority": 1,
+                    "api_key": "sk-test",
+                }
+            ],
+        }
+        config_path = tmp_path / "providers.yaml"
+        config_path.write_text(yaml.dump(config))
+
+        router = CascadeRouter(config_path=config_path)
+        assert len(router.providers) == 1
+
+        # Simulate some traffic
+        router._record_success(router.providers[0], 150.0)
+        router._record_success(router.providers[0], 250.0)
+        assert router.providers[0].metrics.total_requests == 2
+
+        # Reload
+        result = router.reload_config()
+
+        assert result["total_providers"] == 1
+        assert result["preserved"] == 1
+        assert result["added"] == []
+        assert result["removed"] == []
+        # Metrics survived
+        assert router.providers[0].metrics.total_requests == 2
+        assert router.providers[0].metrics.total_latency_ms == 400.0
+
+    def test_reload_preserves_circuit_breaker(self, tmp_path):
+        """Test that reload preserves circuit breaker state."""
+        config = {
+            "cascade": {"circuit_breaker": {"failure_threshold": 2}},
+            "providers": [
+                {
+                    "name": "test-openai",
+                    "type": "openai",
+                    "enabled": True,
+                    "priority": 1,
+                    "api_key": "sk-test",
+                }
+            ],
+        }
+        config_path = tmp_path / "providers.yaml"
+        config_path.write_text(yaml.dump(config))
+
+        router = CascadeRouter(config_path=config_path)
+
+        # Open circuit breaker
+        for _ in range(2):
+            router._record_failure(router.providers[0])
+        assert router.providers[0].circuit_state == CircuitState.OPEN
+
+        # Reload
+        router.reload_config()
+
+        # Circuit breaker state preserved
+        assert router.providers[0].circuit_state == CircuitState.OPEN
+        assert router.providers[0].status == ProviderStatus.UNHEALTHY
+
+    def test_reload_detects_added_provider(self, tmp_path):
+        """Test that reload detects newly added providers."""
+        config = {
+            "providers": [
+                {
+                    "name": "openai-1",
+                    "type": "openai",
+                    "enabled": True,
+                    "priority": 1,
+                    "api_key": "sk-test",
+                }
+            ],
+        }
+        config_path = tmp_path / "providers.yaml"
+        config_path.write_text(yaml.dump(config))
+
+        router = CascadeRouter(config_path=config_path)
+        assert len(router.providers) == 1
+
+        # Add a second provider to config
+        config["providers"].append(
+            {
+                "name": "anthropic-1",
+                "type": "anthropic",
+                "enabled": True,
+                "priority": 2,
+                "api_key": "sk-ant-test",
+            }
+        )
+        config_path.write_text(yaml.dump(config))
+
+        result = router.reload_config()
+
+        assert result["total_providers"] == 2
+        assert result["preserved"] == 1
+        assert result["added"] == ["anthropic-1"]
+        assert result["removed"] == []
+
+    def test_reload_detects_removed_provider(self, tmp_path):
+        """Test that reload detects removed providers."""
+        config = {
+            "providers": [
+                {
+                    "name": "openai-1",
+                    "type": "openai",
+                    "enabled": True,
+                    "priority": 1,
+                    "api_key": "sk-test",
+                },
+                {
+                    "name": "anthropic-1",
+                    "type": "anthropic",
+                    "enabled": True,
+                    "priority": 2,
+                    "api_key": "sk-ant-test",
+                },
+            ],
+        }
+        config_path = tmp_path / "providers.yaml"
+        config_path.write_text(yaml.dump(config))
+
+        router = CascadeRouter(config_path=config_path)
+        assert len(router.providers) == 2
+
+        # Remove anthropic
+        config["providers"] = [config["providers"][0]]
+        config_path.write_text(yaml.dump(config))
+
+        result = router.reload_config()
+
+        assert result["total_providers"] == 1
+        assert result["preserved"] == 1
+        assert result["removed"] == ["anthropic-1"]
+
+    def test_reload_re_sorts_by_priority(self, tmp_path):
+        """Test that providers are re-sorted by priority after reload."""
+        config = {
+            "providers": [
+                {
+                    "name": "low-priority",
+                    "type": "openai",
+                    "enabled": True,
+                    "priority": 10,
+                    "api_key": "sk-test",
+                },
+                {
+                    "name": "high-priority",
+                    "type": "openai",
+                    "enabled": True,
+                    "priority": 1,
+                    "api_key": "sk-test2",
+                },
+            ],
+        }
+        config_path = tmp_path / "providers.yaml"
+        config_path.write_text(yaml.dump(config))
+
+        router = CascadeRouter(config_path=config_path)
+        assert router.providers[0].name == "high-priority"
+
+        # Swap priorities
+        config["providers"][0]["priority"] = 1
+        config["providers"][1]["priority"] = 10
+        config_path.write_text(yaml.dump(config))
+
+        router.reload_config()
+
+        assert router.providers[0].name == "low-priority"
+        assert router.providers[1].name == "high-priority"

tests/timmy/test_agent.py

@@ -81,7 +81,6 @@ def test_create_timmy_respects_custom_ollama_url():
         mock_settings.ollama_url = custom_url
         mock_settings.ollama_num_ctx = 4096
         mock_settings.timmy_model_backend = "ollama"
-        mock_settings.airllm_model_size = "70b"
 
         from timmy.agent import create_timmy
 
@@ -159,7 +158,6 @@ def test_resolve_backend_auto_uses_airllm_on_apple_silicon():
         patch("timmy.agent.settings") as mock_settings,
     ):
         mock_settings.timmy_model_backend = "auto"
-        mock_settings.airllm_model_size = "70b"
         mock_settings.ollama_model = "llama3.2"
 
         from timmy.agent import _resolve_backend
@@ -174,7 +172,6 @@ def test_resolve_backend_auto_falls_back_on_non_apple():
         patch("timmy.agent.settings") as mock_settings,
     ):
         mock_settings.timmy_model_backend = "auto"
-        mock_settings.airllm_model_size = "70b"
         mock_settings.ollama_model = "llama3.2"
 
         from timmy.agent import _resolve_backend
@@ -259,7 +256,6 @@ def test_create_timmy_includes_tools_for_large_model():
         mock_settings.ollama_url = "http://localhost:11434"
         mock_settings.ollama_num_ctx = 4096
         mock_settings.timmy_model_backend = "ollama"
-        mock_settings.airllm_model_size = "70b"
         mock_settings.telemetry_enabled = False
 
         from timmy.agent import create_timmy