Overview:

Add P2P model config file delivery from workers to frontends. Workers automatically serve config files (config.json, tokenizer.json, etc.) over the request plane. Frontends
discover and download them from any available worker before falling back to HuggingFace. Enables private models without shared filesystems.

Details:

Problem: Frontends need model config files for preprocessing. The only paths were HuggingFace and ModelExpress — breaking for private/custom models not on HF.

Solution: Workers register a model-config AsyncEngine endpoint alongside inference endpoints. Frontends discover it through standard discovery and download files directly
over the current request plane (HTTP, TCP, or NATS).

Download priority chain (new):

1. Local HF cache — instant, no network
2. ModelExpress server — server-only, no hidden HF fallback
3. P2P from any available worker — parallel downloads, atomic writes
4. Direct HuggingFace download — last resort

Implementation:

• config_endpoint.rs (new) — ModelConfigEngine, request/response types, P2pConfigDownloader trait
• hub.rs — split from_hf() into get_cached_model_path(), try_model_express_server(), mx_download_direct() for fine-grained fallback control
• model_card.rs — download_config() orchestrates the 4-step chain; new config_filenames(), verify_local_checksums(), checked_file() accessors
• watcher.rs — WatcherP2pDownloader implements P2pConfigDownloader with parallel downloads and atomic writes (temp file + rename)
• local_model.rs — registers model-config endpoint in attach()
• checked_file.rs — filename() method, update_dir() refactored to use it

Safety:

• Blake3 checksum verification after P2P download
• Path traversal sanitization in engine (../etc/passwd → passwd)
• Atomic file writes prevent corruption from concurrent discovery events
• String-based response avoids Vec<u8> JSON serialization blowup (4-7x)

Docs updated:

• frontend/README.md — download fallback chain
• frontend/configuration.md — new "Model Config File Delivery" section
• discovery-plane.md — new "Model Config Endpoint" section

Tests:

• checked_file.rs — filename() from paths/URLs, update_dir() conversion
• config_endpoint.rs — engine file serving, path traversal, serde round-trip, cache dir uniqueness
• model_card.rs — config_filenames(), verify_local_checksums() on valid and tampered files

Where should the reviewer start?

1. lib/llm/src/config_endpoint.rs — new file, core types and engine
2. lib/llm/src/model_card.rs:537-598 — download_config() 4-step fallback chain
3. lib/llm/src/hub.rs:149-175 — try_model_express_server() using request_model_with_provider (not _and_fallback)
4. lib/llm/src/discovery/watcher.rs:832-931 — WatcherP2pDownloader with parallel downloads and atomic writes