refactor: remove LLM from online decisions

modelhub_submmit_api/README.md

@@ -21,9 +21,9 @@ It currently supports:
 - `hf_discovery.py`: ModelScope model discovery and inspection (keeps the legacy module name)
 - `modelhub_client.py`: ModelHub API client and token-pool routing
 - `history_stats.py`: online history aggregation, ranking, and warnings
-- `candidate_preflight.py`: repository, memory, context, and LLM-assisted compatibility gates
+- `candidate_preflight.py`: deterministic repository, memory, context, and compatibility gates
 - `failure_taxonomy.py`: deterministic/platform/semantic failure routing
-- `llm_classifier.py`: optional cached OpenAI-compatible ambiguity classifier
+- `llm_classifier.py`: offline-only experimental ambiguity-analysis helper
 - `template_selector.py`: template lookup and GPU normalization
 - `task_registry.py`: task-type and framework selection rules
 - `tests/`: unit tests and regression coverage
@@ -165,21 +165,18 @@ The memory gate totals the complete recursive repository and applies the same
 verifiable GPU types have evidence-backed capacities; an incomplete repository
 size is deferred instead of estimated. See `../docs/gpu-memory-capacity-2026-08-10.md`.
 
-Optional Qwen review uses `MODELHUB_QWEN_ENDPOINT`, `MODELHUB_QWEN_MODEL`, and
-`MODELHUB_QWEN_API_KEY` (or `DASHSCOPE_API_KEY`). The generic
-`MODELHUB_LLM_CLASSIFIER_*` names remain supported. A root `.env` key named
-`dashscope` is loaded automatically, and the default model is `qwen3.7-flash`.
-Qwen is called only for
-unresolved architecture/remote-code semantics or ambiguous failure roots, with
-a default rolling limit of 20 calls/hour and one concurrent request. Only
-high-confidence denials block; an error, timeout, or abstention leaves the
-already-vetted candidate eligible.
+The online runner never constructs an LLM client. A DashScope key or any
+`MODELHUB_QWEN_*`/`MODELHUB_LLM_CLASSIFIER_*` environment variable cannot enable
+inference. `llm_classifier.py` remains available only for deliberately invoked,
+offline experiments whose output is reviewed before being converted into a
+deterministic rule.
 
 Outcome sync also classifies a bounded set of this worker's failed-task ZIP logs.
-Hard error signatures run first; ambiguous runtime roots can use the configured
-LLM. Platform faults are excluded from long-term compatibility scores and use a
-short 30-minute breaker after three consecutive failures. Failed log downloads
-are persisted and stop after three attempts.
+Hard error signatures run first; ambiguous runtime roots remain explicitly
+unclassified and are never sent to an LLM. Platform faults are excluded from
+long-term compatibility scores and use a short 30-minute breaker after three
+consecutive failures. Failed log downloads are persisted and stop after three
+attempts.
 
 ## Output