# Agent Runtime Phase 1 — Deterministic ABN execution

## Scope

Phase 1 proves the complete agent-to-tool path without an external LLM. It is
deliberately limited to the read-only `business.au.abn.lookup` capability.

1. WordPress submits a nonce-protected instruction server-side.
2. Bridge authenticates to `POST /api/v1/bridge_platform/agent/resolve` with a
   short-lived RS256 JWT and `platform:agent:invoke` scope.
3. The runtime loads only agent tools from apps enabled for the tenant.
4. `deterministic_v1` extracts an exact 11-digit ABN.
5. JSON Schema validates the proposed arguments.
6. Bridge permits only the expected low-risk, no-confirmation ABN selection.
7. Bridge invokes `lookup_v1` through the normal app gateway.
8. The gateway independently enforces tenant, subscription, app enablement,
   JWT scope, quota, credential resolution, logging, and the response envelope.

The browser receives neither site JWTs nor ABR credentials. Agent resolution
does not bypass the existing app contract or gateway.

## Supported instruction

Example:

```text
Check whether ABN 51824753556 is registered.
```

Spaces and hyphens inside the 11 digits are normalized. Instructions without a
supported exact ABN return `no_matching_tool`; business-name search is not
silently converted into an ABN lookup.

## Current limitations

- No external LLM or natural-language provider is used.
- Only ABN lookup can execute.
- Only WordPress administrators can use the development form.
- User-level permission profiles and approval records are not implemented.
- Conversation memory, streaming, model usage, AI billing, resources, and MCP
  remain later phases.

Any future LLM replaces or supplements tool selection only. JSON Schema,
policy checks, confirmation, gateway authorization, quotas, and auditing remain
deterministic platform responsibilities.

## Optional selector adapter

The next additive layer provides a provider-neutral `ToolSelector` interface.
The OpenAI implementation uses structured output only to select a published
tool and propose arguments; it cannot execute capabilities. Deterministic
selection runs first to avoid unnecessary AI cost. The proposed capability is
matched against the tenant catalog and its arguments are validated again with
the tool JSON Schema before the Bridge and gateway policies run.

The selector is disabled unless `AGENT_LLM_ENABLED=1`. Its model is operational
configuration (`AGENT_LLM_MODEL`), not part of an app contract. API keys must be
in a managed secret or a mode-0600 external key file and must never be copied
from `.env` into application storage automatically.