feat: require live infrastructure for event store and inference, removing offline mode

.env.example

@@ -1,12 +1,12 @@
 # Copy to .env and fill in your values.
 #
-# With no live binding configured the app runs on a deterministic local stub —
-# fully offline, no network, NO API KEYS. That is the default, and it is fully
-# reproducible (ideal for demos and CI). To go live, pick one of two inference
-# backends (the Lab's §00 selector chooses per run): the small models you serve
-# yourself from `modal/` (see modal/README.md), or Hugging Face's serverless
-# Inference Providers (just an HF_TOKEN). Either is small-model-only (<=32B); there
-# is no generic OpenAI/cloud path.
+# The app requires real infrastructure to run: a DATABASE_URL (durable event
+# store) and a live inference backend. There is no offline/stub product mode —
+# the deterministic stub now exists only as the test suite's mock data. Pick one
+# of two inference backends (the Lab's §00 selector chooses per run): the small
+# models you serve yourself from `modal/` (see modal/README.md), or Hugging Face's
+# serverless Inference Providers (just an HF_TOKEN). Either is small-model-only
+# (<=32B); there is no generic OpenAI/cloud path.
 
 # ── Live models: the OpenAI-compatible small models served on Modal ────────────
 # (ADR-0014 / 0015 / 0019). Setting MODAL_WORKSPACE activates the live path. Each
@@ -54,17 +54,17 @@ HF_INFERENCE_BASE_URL=
 #   MODEL_BALANCED=openai/google/gemma-4-12B
 #   MODEL_STRONG=openai/google/gemma-4-26B-A4B-it
 
-# Durable event store backend (ADR-0014 Postgres). When unset, the in-memory
-# ledger is used (fully offline). When set, the append-only ledger is persisted
-# through SQLAlchemy. Neon (managed Postgres) form:
+# Durable event store backend (ADR-0014 Postgres) — REQUIRED. The append-only
+# ledger is persisted through SQLAlchemy; the app refuses to run without a URL
+# (there is no in-memory fallback). Neon (managed Postgres) form:
 #   DATABASE_URL=postgresql+psycopg://USER:PASSWORD@HOST/DB?sslmode=require
-# A local SQLite URL also works (e.g. to try the backend without a server):
+# A local SQLite URL also works (e.g. a single-box run without a server):
 #   DATABASE_URL=sqlite:///runs/events.db
 DATABASE_URL=
 
 # Semantic memory index (ADR-0018). Truthy activates a derived vector lens over
-# the ledger. Embeddings run LOCALLY via sentence-transformers (no API key; fully
-# offline once the model is cached) — install with `uv sync --extra memory`.
+# the ledger. Embeddings run LOCALLY via sentence-transformers (no API key;
+# cached after first use); sentence-transformers + mem0 ship as core deps.
 # Override the backend/embedder with a MEMORY_INDEX_CONFIG JSON blob (passed
 # verbatim to mem0; see docs/architecture/memory-stack.md).
 #   MEMORY_INDEX=1

config/models.yaml

@@ -1,17 +1,19 @@
 # Logical model profiles → small models served on Modal.
 #
 # offline:
-#   null  = auto (deterministic stub unless a live binding is configured —
-#           MODAL_WORKSPACE or MODAL_LLM_BASE_URL)
-#   true  = always the deterministic stub (reproducible demos / CI)
-#   false = always live inference
+#   null  = live inference required (default). The build refuses to start if no
+#           backend is configured (MODAL_WORKSPACE / MODAL_LLM_BASE_URL / HF_TOKEN);
+#           there is no silent fallback to the stub.
+#   false = live inference (same as null, stated explicitly).
+#   true  = deterministic stub for every profile — a test/dev seam (the test suite
+#           sets this), NOT a product mode.
 #
 # Each profile binds to a model by its **catalogue key** (`endpoint:`) — the model
 # slug in `modal/catalogue.py`, the single source of truth for what is deployed.
 # The loader (`Registry.from_dir`) expands that key into the concrete binding:
 #   model    = openai/<served_model_id>
 #   base_url = https://${MODAL_WORKSPACE}--<app>-<endpoint>.modal.run/v1
-#              (or $MODAL_LLM_BASE_URL if set; "" when neither → offline stub)
+#              (or $MODAL_LLM_BASE_URL if set; a backend is required to run)
 #   api_key  = $MODAL_LLM_KEY   (a self-served vLLM endpoint accepts any token)
 #
 # So adding/retuning a model is a one-line edit in `modal/catalogue.py`, and

docs/adr/0010-per-agent-model-routing.md

@@ -24,8 +24,14 @@ inference there.
 The router is config/env driven:
 - `config/models.yaml` binds each profile to a concrete (small) model.
 - `MODEL_TINY` / `MODEL_FAST` / `MODEL_BALANCED` / `MODEL_STRONG` override at runtime.
-- Offline (no API key) it serves a `DeterministicTinyModel` for *every* profile,
-  so demos and tests are reproducible with no inference.
+- With `offline=True` it serves a `DeterministicTinyModel` for *every* profile,
+  so the test suite is reproducible with no inference.
+
+> **Amended:** offline is no longer a *product* mode. The app requires live
+> inference — `Registry.build_router()` raises when no backend is configured
+> instead of serving the stub. The `offline=True` flag and `DeterministicTinyModel`
+> are retained purely as the test/dev seam — the deterministic "mock data" the
+> suite injects via `tests/conftest.py`.
 
 Providers expose `last_usage`; the conductor meters those tokens into the
 Governor (see ADR-0013).
@@ -37,4 +43,5 @@ Governor (see ADR-0013).
 - Swapping a tier to a different small model is a one-line config change; no agent
   code names a model.
 - The `tiny` profile (≤4B) gives a first-class Tiny Titan mode.
-- The deterministic offline path keeps the green, mock-free test suite.
+- The deterministic stub (the `offline=True` test seam) keeps the test suite green
+  and network-free without it being a runtime product mode.

docs/adr/0014-postgres-event-store.md

@@ -35,17 +35,16 @@ is a serial `offset` column (not `created_at`, which is subject to clock skew, n
 exercised in CI against SQLite without a server, and the Neon path is
 code-identical.
 
-**Env-gated, offline by default.** A small factory (`src/core/ledger_factory.py`,
-`make_ledger()`) selects the backend: `DATABASE_URL` set → `SqlAlchemyLedger`;
-unset → the in-memory `Ledger`. With no `DATABASE_URL` the system never imports
-SQLAlchemy or a driver. SQLAlchemy is imported lazily inside the backend, so
-importing `src.core.*` does not require the library to be installed. The store
-deps (`sqlalchemy>=2.0`, `psycopg[binary]>=3` — the Neon driver) are **core
-dependencies** in `pyproject.toml`: the deployed app is configured with a real
-`DATABASE_URL` and must not silently degrade to a local store when the durable
-backend is missing, so the driver always ships rather than hiding behind an
-optional extra. (The lazy import is retained so `src.core.*` stays importable in
-minimal/test contexts even though the driver is now always present.)
+**The durable store is required.** A small factory (`src/core/ledger_factory.py`,
+`make_ledger()`) constructs the backend from `DATABASE_URL` (`SqlAlchemyLedger`).
+There is **no in-memory fallback**: with no URL resolved, `make_ledger()` raises —
+the app persists to a real event store and refuses to run without one (this is
+part of dropping the offline product mode; see ADR-0010). The store deps
+(`sqlalchemy>=2.0`, `psycopg[binary]>=3` — the Neon driver) are therefore **core
+dependencies** in `pyproject.toml`, not an optional extra. SQLAlchemy is still
+imported lazily inside the backend (so `src.core.*` stays importable in minimal
+contexts), but it always ships. Tests pass an explicit ephemeral `sqlite://` URL
+as the mock store — a real `SqlAlchemyLedger` with no server.
 
 **SQLAlchemy-direct, not the `eventsourcing` library.** `eventsourcing` is built
 around DDD aggregates: its `StoredEvent` is keyed on `originator_id` +
@@ -70,8 +69,9 @@ The two are complementary, not competing.
 - A hosted deployment points `DATABASE_URL` at Neon
   (`postgresql+psycopg://USER:PASSWORD@HOST/DB?sslmode=require`) and the durable
   log lives in managed Postgres; everything else is unchanged.
-- The offline path is the default and is import-clean: all existing tests pass
-  with no database and no `store` extra installed.
+- A `DATABASE_URL` is required to run; `make_ledger()` raises without one. Tests
+  pass an ephemeral `sqlite://` URL (a real `SqlAlchemyLedger`, no server) as the
+  mock store, so the suite stays green with no database server and no network.
 - `snapshot_to` is backend-agnostic (it replays the log into a destination
   ledger, default a SQLite file) since Postgres has no portable in-process backup
   API like SQLite's `.backup()`; a Postgres run can be checkpointed to a portable

pyproject.toml

@@ -14,10 +14,22 @@ dependencies = [
   "opentelemetry-api>=1.20.0",
   "opentelemetry-sdk>=1.20.0",
   "opentelemetry-semantic-conventions>=0.41b0",
-  # Durable event store backend (ADR-0014). Core dependency: the app requires a
-  # real DATABASE_URL and refuses to run without it. psycopg is the Neon driver.
+  # The app requires real infrastructure — a DB and live inference — and refuses to
+  # run without it; there is no offline/stub product mode. Everything the live path
+  # touches is therefore a core dependency rather than an opt-in extra:
+  #   - sqlalchemy + psycopg : durable event store backend (ADR-0014); psycopg is the Neon driver.
+  #   - litellm              : model gateway to the OpenAI-compatible endpoints (ADR-0015).
+  #   - instructor           : validated, schema-constrained structured output (ADR-0016).
+  #   - mcp                  : Model Context Protocol tool transport (ADR-0017).
+  #   - mem0ai + sentence-transformers : semantic memory index over the ledger (ADR-0018).
+  # These are still imported lazily at their call sites, but they always ship.
   "sqlalchemy>=2.0",
   "psycopg[binary]>=3",
+  "litellm>=1.40",
+  "instructor>=1.5",
+  "mcp>=1.0",
+  "mem0ai>=0.1",
+  "sentence-transformers>=3.0",
 ]
 
 [project.optional-dependencies]
@@ -25,41 +37,6 @@ dev = [
   "pytest>=8.2.0",
   "ruff>=0.5.0",
 ]
-# Model gateway (ADR-0015). Optional: routes live profiles through LiteLLM to the
-# OpenAI-compatible models served on Modal, with real per-call cost metering. The
-# system runs fully offline on the deterministic stub without this installed;
-# litellm is imported lazily so importing src.models.* never requires it.
-litellm = [
-  "litellm>=1.40",
-]
-# Validated structured output (ADR-0016). Optional: wraps the LiteLLM gateway
-# with Instructor so the live path returns schema-valid, kind-constrained event
-# payloads (retried on validation failure) instead of parsing prose. The system
-# runs fully offline on the deterministic stub + tolerant parser without this;
-# instructor is imported lazily so importing src.* never requires it.
-instructor = [
-  "instructor>=1.5",
-]
-# MCP tool transport (ADR-0017). Optional: exposes the built-in tools over a
-# stdio Model Context Protocol server and resolves granted tools over it when the
-# MCP_SERVERS / MCP_ORACLE gate is set. The capability check still runs first, so
-# MCP is transport, not the security boundary. The system runs fully offline on
-# the in-process registry without this; mcp is imported lazily so importing src.*
-# and app never requires it.
-mcp = [
-  "mcp>=1.0",
-]
-# Semantic memory index (ADR-0018). Optional: a derived, rebuildable vector lens
-# over the event ledger that upgrades the salience relevance term from keyword
-# overlap to semantic search when the MEMORY_INDEX gate is set. The ledger stays
-# the single source of truth; the index is repopulated from it. The system runs
-# fully offline on the keyword path without this; mem0 is imported lazily so
-# importing src.* and app never requires it. Embeddings run LOCALLY via
-# sentence-transformers (no API key) — keeping the active index off the grid too.
-memory = [
-  "mem0ai>=0.1",
-  "sentence-transformers>=3.0",
-]
 
 [tool.ruff]
 line-length = 120

src/core/ledger_factory.py

@@ -1,15 +1,13 @@
-"""Backend selection for the event ledger — env-gated, offline by default.
+"""Backend selection for the event ledger — the durable store is required.
 
 One decision lives here: which ``Ledger`` backend to construct.  The append-only
 ledger is the single source of truth (ADR-0014); this only chooses *where* it is
 durably stored.
 
-  - ``DATABASE_URL`` set  → :class:`SqlAlchemyLedger` (Postgres/Neon or any
-    SQLAlchemy URL), the durable event store.
-  - ``DATABASE_URL`` unset → the in-memory :class:`Ledger`.
-
-With no ``DATABASE_URL`` the system never imports SQLAlchemy or a database driver,
-so the offline path stays import-clean and fully testable without a server.
+A ``DATABASE_URL`` (Postgres/Neon, or any SQLAlchemy URL — e.g. ``sqlite://`` for
+an in-memory store in tests) is **required**: the app persists to a real event
+store and refuses to run without one.  Construction raises when no URL is
+resolved rather than silently degrading to an ephemeral in-memory ledger.
 """
 
 from __future__ import annotations
@@ -29,8 +27,8 @@ def _normalize_db_url(url: str) -> str:
     """Steer a bare Postgres URL to the installed psycopg3 driver.
 
     Neon (and most providers) hand out ``postgresql://`` / ``postgres://``, which
-    SQLAlchemy maps to psycopg2 — but this project ships psycopg3 (the ``store``
-    extra), so a copy-pasted Neon URL would fail with a missing-driver error.
+    SQLAlchemy maps to psycopg2 — but this project ships psycopg3, so a
+    copy-pasted Neon URL would fail with a missing-driver error.
     Rewrite the bare scheme to ``postgresql+psycopg://``; URLs that already name a
     driver (``postgresql+...``) or use another backend (sqlite, …) pass through.
     """
@@ -41,15 +39,19 @@ def _normalize_db_url(url: str) -> str:
 
 
 def make_ledger(url: str | None = None) -> Ledger:
-    """Construct the configured ledger backend.
+    """Construct the durable ledger backend (required — never an in-memory fallback).
 
-    *url* overrides ``DATABASE_URL`` (useful for tests/scripts).  When neither is
-    set, returns the in-memory ``Ledger``.  ``SqlAlchemyLedger`` is imported lazily
-    so the offline path does not require SQLAlchemy to be installed.
+    *url* overrides ``DATABASE_URL`` (useful for tests/scripts — pass ``"sqlite://"``
+    for an ephemeral in-memory store).  Raises :class:`RuntimeError` when neither is
+    set: the app requires a real event store and must not silently run without one.
     """
     resolved = url or database_url()
     if not resolved:
-        return Ledger()
+        raise RuntimeError(
+            "DATABASE_URL is required — the event store is not optional. "
+            "Set DATABASE_URL (e.g. a Neon postgresql:// URL, or sqlite:///runs/events.db for "
+            "a local file), or pass an explicit url to make_ledger()."
+        )
     from src.core.sqlalchemy_ledger import SqlAlchemyLedger
 
     return SqlAlchemyLedger(_normalize_db_url(resolved))

src/core/registry.py

@@ -197,17 +197,26 @@ class Registry:
     # ── building ───────────────────────────────────────────────────────────────
 
     def build_router(self) -> ModelRouter:
-        """Construct a ModelRouter honouring the models config (offline/specs)."""
+        """Construct a ModelRouter honouring the models config.
+
+        ``models.offline: true`` forces the deterministic stub (the test/dev seam);
+        ``false`` and the default (``null``) both build the live path.  On the live
+        path live inference is **required**: if no backend is configured the build
+        raises rather than silently degrading to the stub — the app has no offline
+        product mode.
+        """
         specs = {profile: ProfileSpec(**cfg.model_dump()) for profile, cfg in self.models.profiles.items()}
         if self.models.offline is True:
             return ModelRouter(offline=True, specs=specs)
-        if self.models.offline is False:
-            return ModelRouter(offline=False, specs=specs)
-        # auto: detect credentials, but keep explicit specs for the live case
-        router = ModelRouter.from_env()
-        if not router.offline and specs:
-            router.specs = specs
-        return router
+        from src.models.openai_compat import has_live_credentials
+
+        if not has_live_credentials():
+            raise RuntimeError(
+                "No inference backend configured. Set MODAL_WORKSPACE / MODAL_LLM_BASE_URL "
+                "or HF_TOKEN / HF_INFERENCE_BASE_URL to run live, or set models.offline: true "
+                "for the deterministic stub (tests/dev only)."
+            )
+        return ModelRouter(offline=False, specs=specs)
 
     def build_agent(self, name: str, router: ModelRouter, tools=None, memory_index=None) -> Agent:
         if name not in self.agents:

src/models/router.py

@@ -9,9 +9,12 @@ This is the single place per-agent model selection happens, so:
   - a scenario can mix a ``tiny`` worker with a ``strong`` judge for free;
   - the rest of the engine never names a model.
 
-Offline (no API key) the router serves a :class:`DeterministicTinyModel` for
-every profile, so demos and tests run with zero inference and full
-reproducibility.  See ADR-0010.
+The live path is the only product path: profiles resolve to concrete models and
+the router calls them over the gateway.  The ``offline`` flag is a *test seam* —
+when set it serves a :class:`DeterministicTinyModel` for every profile so the
+suite runs with zero inference and full reproducibility (the deterministic
+"mock data").  Production never sets it; ``Registry.build_router`` requires live
+credentials and refuses to construct a stub router.  See ADR-0010.
 
 On the live path the concrete transport is the :class:`LiteLLMProvider` gateway
 (ADR-0015): profiles point at the OpenAI-compatible Modal/vLLM endpoints in
@@ -25,7 +28,6 @@ from dataclasses import dataclass, field
 
 from src import observability as obs
 from src.core.manifest import ModelProfile, resolve_model
-from src.models.openai_compat import has_live_credentials
 from src.models.provider import DeterministicTinyModel, ModelProvider
 
 # Decoding defaults per profile.  Smaller models stay cooler and shorter; the
@@ -62,6 +64,8 @@ class ModelRouter:
     """
 
     specs: dict[str, ProfileSpec] = field(default_factory=dict)
+    # Test seam only: serve the deterministic stub for every profile. Production
+    # never sets this (Registry.build_router requires live credentials).
     offline: bool = False
     _cache: dict[str, ModelProvider] = field(default_factory=dict, init=False, repr=False)
 
@@ -156,10 +160,11 @@ class ModelRouter:
 
     @classmethod
     def from_env(cls) -> "ModelRouter":
-        """Build a router from environment configuration.
+        """Build a live router from environment configuration.
 
-        Offline (deterministic stub for every profile) unless a live API key is
-        present, in which case each profile resolves to its concrete model via
-        ``resolve_model`` plus the per-profile decoding defaults.
+        Each profile resolves to its concrete model via ``resolve_model`` plus the
+        per-profile decoding defaults (``MODEL_TINY`` / … overrides honoured).  This
+        always builds the live path; the deterministic stub is reached only by
+        constructing ``ModelRouter(offline=True)`` explicitly (the test seam).
         """
-        return cls(offline=not has_live_credentials())
+        return cls(offline=False)

tests/conftest.py

@@ -0,0 +1,47 @@
+"""Suite-wide test fixtures: the deterministic "mock data" the app no longer ships.
+
+The app has no offline product mode — it requires a real event store
+(``DATABASE_URL``) and live inference, and refuses to run without them.  The test
+suite must still run with zero network, no credentials, and full reproducibility,
+so it supplies that infrastructure as *mock data* instead:
+
+  * an ephemeral in-memory SQLite event store (a real ``SqlAlchemyLedger``, no server);
+  * the :class:`~src.models.provider.DeterministicTinyModel` stub for every profile,
+    via ``ModelRouter(offline=True)`` — wired in by patching ``Registry.build_router``.
+
+A test that needs the *real* production wiring (e.g. to assert that a missing DB
+URL or missing credentials raises) opts out with ``@pytest.mark.real_infra`` and
+sets up its own environment.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+
+def pytest_configure(config):
+    config.addinivalue_line(
+        "markers",
+        "real_infra: use the real make_ledger/build_router wiring instead of the mock fixtures",
+    )
+
+
+@pytest.fixture(autouse=True)
+def _mock_infra(request, monkeypatch):
+    # An ephemeral SQLite store stands in for the required durable event store.
+    monkeypatch.setenv("DATABASE_URL", "sqlite://")
+
+    if request.node.get_closest_marker("real_infra"):
+        return
+
+    # Route every profile to the deterministic stub so tests never reach live
+    # inference. Patching build_router (rather than env) keeps production code's
+    # "live credentials required" contract intact while tests get reproducible data.
+    from src.core.registry import Registry
+    from src.models.router import ModelRouter, ProfileSpec
+
+    def _stub_build_router(self) -> ModelRouter:
+        specs = {profile: ProfileSpec(**cfg.model_dump()) for profile, cfg in self.models.profiles.items()}
+        return ModelRouter(offline=True, specs=specs)
+
+    monkeypatch.setattr(Registry, "build_router", _stub_build_router)

tests/test_live_wiring.py

@@ -1,31 +1,34 @@
-"""Guard the env-gating contract for the live/offline wiring (no network, no creds).
+"""Guard the env-gating contract for the live wiring (no network, no creds).
 
-These tests pin the *selection* behaviour that hooks the Fishbowl UI to live
-services so it cannot silently regress:
+The app has no offline product mode: it requires live inference and a real event
+store and refuses to run without them.  These tests pin that *selection* behaviour
+so it cannot silently regress:
 
-  * Models  — :meth:`ModelRouter.from_env` is offline unless a Modal binding is set
-    (``MODAL_WORKSPACE`` or ``MODAL_LLM_BASE_URL``), via
-    :func:`~src.models.openai_compat.has_live_credentials`.
-  * Ledger  — :func:`~src.core.ledger_factory.make_ledger` returns the in-memory
-    ``Ledger`` with no ``DATABASE_URL`` and the ``SqlAlchemyLedger`` for a URL.
+  * Models  — :func:`~src.models.openai_compat.has_live_credentials` is False unless a
+    Modal/HF binding is set, and :meth:`ModelRouter.from_env` always builds the live
+    path (the deterministic stub is reachable only via ``ModelRouter(offline=True)``).
+  * Ledger  — :func:`~src.core.ledger_factory.make_ledger` raises with no ``DATABASE_URL``
+    and returns the ``SqlAlchemyLedger`` for a URL.
   * Memory  — :func:`~src.core.memory_index.memory_index_from_env` is ``None`` when
     the gate is unset and a cloud index when ``MEMORY_INDEX=cloud``.
 
-Everything runs on ``monkeypatch`` env edits (auto-reverted), an in-memory SQLite
-URL, and optional-dep guards (``pytest.importorskip``) so the suite never touches a
-real network, a database server, or live credentials.
+Everything runs on ``monkeypatch`` env edits (auto-reverted) and an in-memory SQLite
+URL so the suite never touches a real network, a database server, or live credentials.
+These cases assert the real wiring, so they opt out of the mock-infra fixture.
 """
 
 from __future__ import annotations
 
 import pytest
 
-from src.core.ledger import Ledger
 from src.core.ledger_factory import make_ledger
 from src.core.memory_index import memory_index_from_env
 from src.models.openai_compat import has_live_credentials
+from src.models.provider import DeterministicTinyModel
 from src.models.router import ModelRouter
 
+pytestmark = pytest.mark.real_infra
+
 # Env vars these tests touch; cleared before each case so the host environment and
 # sibling tests never leak into (or out of) a case.
 _LIVE_ENV = (
@@ -45,58 +48,58 @@ def _clean_live_env(monkeypatch):
         monkeypatch.delenv(name, raising=False)
 
 
-# ── models: offline by default, live when a Modal binding is present ───────────
+# ── models: always live; the stub is reachable only by explicit opt-in ─────────
 
 
-class TestModelsOfflineByDefault:
+class TestCredentialDetection:
     def test_has_live_credentials_false_when_unset(self):
         assert has_live_credentials() is False
 
-    def test_router_from_env_is_offline_when_unset(self):
-        assert ModelRouter.from_env().offline is True
-
-
-class TestModelsLiveWhenBound:
     def test_workspace_marks_live_credentials(self, monkeypatch):
         monkeypatch.setenv("MODAL_WORKSPACE", "demo-workspace")
         assert has_live_credentials() is True
 
-    def test_workspace_makes_router_live(self, monkeypatch):
-        monkeypatch.setenv("MODAL_WORKSPACE", "demo-workspace")
-        assert ModelRouter.from_env().offline is False
-
     def test_base_url_marks_live_credentials(self, monkeypatch):
         monkeypatch.setenv("MODAL_LLM_BASE_URL", "https://demo.modal.run/v1")
         assert has_live_credentials() is True
 
-    def test_base_url_makes_router_live(self, monkeypatch):
-        monkeypatch.setenv("MODAL_LLM_BASE_URL", "https://demo.modal.run/v1")
-        assert ModelRouter.from_env().offline is False
-
-    def test_blank_workspace_stays_offline(self, monkeypatch):
+    def test_blank_workspace_is_not_a_binding(self, monkeypatch):
         # An empty/whitespace value must NOT count as a live binding.
         monkeypatch.setenv("MODAL_WORKSPACE", "   ")
         assert has_live_credentials() is False
-        assert ModelRouter.from_env().offline is True
 
 
-# ── ledger: in-memory by default, SqlAlchemy-backed for a URL ──────────────────
+class TestRouterAlwaysLive:
+    def test_from_env_is_live_when_unset(self):
+        # No offline auto-detection: from_env always builds the live path.
+        router = ModelRouter.from_env()
+        assert router.offline is False
+        assert not isinstance(router.for_profile("fast"), DeterministicTinyModel)
+
+    def test_from_env_is_live_when_bound(self, monkeypatch):
+        monkeypatch.setenv("MODAL_WORKSPACE", "demo-workspace")
+        assert ModelRouter.from_env().offline is False
+
+    def test_stub_only_via_explicit_offline(self):
+        # The deterministic stub is the test seam, never selected automatically.
+        assert isinstance(ModelRouter(offline=True).for_profile("fast"), DeterministicTinyModel)
+
+
+# ─�� ledger: required — raises with no URL, SqlAlchemy-backed for a URL ──────────
 
 
 class TestLedgerSelection:
-    def test_no_url_returns_in_memory_ledger(self):
-        ledger = make_ledger()
-        assert type(ledger) is Ledger
+    def test_no_url_raises(self):
+        with pytest.raises(RuntimeError, match="DATABASE_URL is required"):
+            make_ledger()
 
     def test_sqlite_url_returns_sqlalchemy_ledger(self):
-        pytest.importorskip("sqlalchemy")
         from src.core.sqlalchemy_ledger import SqlAlchemyLedger
 
         ledger = make_ledger("sqlite:///:memory:")
         assert isinstance(ledger, SqlAlchemyLedger)
 
     def test_sqlite_ledger_append_read_roundtrip(self):
-        pytest.importorskip("sqlalchemy")
         from src.core.events import Event
 
         ledger = make_ledger("sqlite:///:memory:")

tests/test_registry.py

@@ -30,14 +30,21 @@ class TestDefaultRegistry:
         assert profiles["pocket-actor"] == "tiny"
         assert profiles["mischief-critic"] == "balanced"
 
-    def test_build_router_offline_without_binding(self, monkeypatch):
-        # No Modal binding configured → the deterministic offline stub.
-        for var in ("MODAL_WORKSPACE", "MODAL_LLM_BASE_URL", "OPENAI_API_KEY"):
+    @pytest.mark.real_infra
+    def test_build_router_requires_live_credentials(self, monkeypatch):
+        # No backend configured → the app refuses to build a router (no offline mode).
+        for var in ("MODAL_WORKSPACE", "MODAL_LLM_BASE_URL", "OPENAI_API_KEY", "HF_TOKEN", "HF_INFERENCE_BASE_URL"):
             monkeypatch.delenv(var, raising=False)
         reg = default_registry()
-        router = reg.build_router()
+        with pytest.raises(RuntimeError, match="No inference backend configured"):
+            reg.build_router()
+
+    @pytest.mark.real_infra
+    def test_build_router_is_live_with_credentials(self, monkeypatch):
+        monkeypatch.setenv("MODAL_WORKSPACE", "demo-workspace")
+        router = default_registry().build_router()
         assert isinstance(router, ModelRouter)
-        assert router.offline is True
+        assert router.offline is False
 
     def test_governor_for_uses_config_budget(self):
         reg = default_registry()

tests/test_router.py

@@ -121,7 +121,7 @@ class TestModelRouterCatalogueEndpoint:
         assert provider.model == "openai/Qwen/Qwen2.5-7B-Instruct"
         assert provider.api_base == "https://router.huggingface.co/v1"
         assert provider.api_key == "hf_secret"
-        assert provider.max_tokens == 220  # fast tier decoding (the model's tier)
+        assert provider.max_tokens == 320  # fast tier decoding (the model's tier)
 
     def test_offline_hf_endpoint_key_serves_distinct_stub(self):
         # Offline, an HF key routes like any profile: the deterministic stub with the
@@ -133,9 +133,9 @@ class TestModelRouterCatalogueEndpoint:
 
 
 class TestFromEnv:
-    def test_offline_without_binding(self, monkeypatch):
-        # No backend configured (no Modal binding, no HF token, no stray cloud key)
-        # → deterministic offline stub.
+    def test_live_without_binding(self, monkeypatch):
+        # No offline auto-detection: from_env always builds the live path, even with
+        # no backend configured (the stub is reachable only via offline=True).
         for var in (
             "MODAL_WORKSPACE",
             "MODAL_LLM_BASE_URL",
@@ -146,8 +146,8 @@ class TestFromEnv:
         ):
             monkeypatch.delenv(var, raising=False)
         router = ModelRouter.from_env()
-        assert router.offline is True
-        assert isinstance(router.for_profile("fast"), DeterministicTinyModel)
+        assert router.offline is False
+        assert not isinstance(router.for_profile("fast"), DeterministicTinyModel)
 
     def test_online_with_modal_workspace(self, monkeypatch):
         # A Modal workspace is the activating signal for the live path.

tests/test_sqlalchemy_ledger.py

@@ -7,7 +7,6 @@ from pathlib import Path
 import pytest
 
 from src.core.events import Event
-from src.core.ledger import Ledger
 from src.core.ledger_factory import make_ledger
 from src.core.sqlalchemy_ledger import SqlAlchemyLedger
 
@@ -110,14 +109,15 @@ class TestSqlAlchemyLedgerPersistence:
 
 
 class TestLedgerFactory:
-    def test_offline_returns_in_memory_ledger(self, monkeypatch):
+    def test_missing_database_url_raises(self, monkeypatch):
         monkeypatch.delenv("DATABASE_URL", raising=False)
-        ledger = make_ledger()
-        assert type(ledger) is Ledger
+        with pytest.raises(RuntimeError, match="DATABASE_URL is required"):
+            make_ledger()
 
-    def test_empty_database_url_is_offline(self, monkeypatch):
+    def test_empty_database_url_raises(self, monkeypatch):
         monkeypatch.setenv("DATABASE_URL", "")
-        assert type(make_ledger()) is Ledger
+        with pytest.raises(RuntimeError, match="DATABASE_URL is required"):
+            make_ledger()
 
     def test_explicit_url_builds_sqlalchemy_backend(self):
         with tempfile.TemporaryDirectory() as tmpdir:

uv.lock

@@ -1627,6 +1627,10 @@ version = "0.1.0"
 source = { virtual = "." }
 dependencies = [
     { name = "gradio" },
+    { name = "instructor" },
+    { name = "litellm" },
+    { name = "mcp" },
+    { name = "mem0ai" },
     { name = "modal" },
     { name = "openai" },
     { name = "opentelemetry-api" },
@@ -1637,6 +1641,7 @@ dependencies = [
     { name = "pydantic" },
     { name = "python-dotenv" },
     { name = "pyyaml" },
+    { name = "sentence-transformers" },
     { name = "sqlalchemy" },
 ]
 
@@ -1645,27 +1650,14 @@ dev = [
     { name = "pytest" },
     { name = "ruff" },
 ]
-instructor = [
-    { name = "instructor" },
-]
-litellm = [
-    { name = "litellm" },
-]
-mcp = [
-    { name = "mcp" },
-]
-memory = [
-    { name = "mem0ai" },
-    { name = "sentence-transformers" },
-]
 
 [package.metadata]
 requires-dist = [
     { name = "gradio", specifier = ">=4.44.0" },
-    { name = "instructor", marker = "extra == 'instructor'", specifier = ">=1.5" },
-    { name = "litellm", marker = "extra == 'litellm'", specifier = ">=1.40" },
-    { name = "mcp", marker = "extra == 'mcp'", specifier = ">=1.0" },
-    { name = "mem0ai", marker = "extra == 'memory'", specifier = ">=0.1" },
+    { name = "instructor", specifier = ">=1.5" },
+    { name = "litellm", specifier = ">=1.40" },
+    { name = "mcp", specifier = ">=1.0" },
+    { name = "mem0ai", specifier = ">=0.1" },
     { name = "modal", specifier = ">=1.4.3" },
     { name = "openai", specifier = ">=1.40.0" },
     { name = "opentelemetry-api", specifier = ">=1.20.0" },
@@ -1678,10 +1670,10 @@ requires-dist = [
     { name = "python-dotenv", specifier = ">=1.0.1" },
     { name = "pyyaml", specifier = ">=6.0" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.5.0" },
-    { name = "sentence-transformers", marker = "extra == 'memory'", specifier = ">=3.0" },
+    { name = "sentence-transformers", specifier = ">=3.0" },
     { name = "sqlalchemy", specifier = ">=2.0" },
 ]
-provides-extras = ["dev", "litellm", "instructor", "mcp", "memory"]
+provides-extras = ["dev"]
 
 [[package]]
 name = "multidict"