# Agent Runtime Phase 2 — Optional LLM tool selection

## Runtime mode

Phase 2 adds a provider-neutral `ToolSelector` after the deterministic resolver.
Deterministic matches run first and consume no AI tokens. The optional OpenAI
adapter uses structured output to propose one capability and its arguments.

The model is not an authority. After selection, the platform:

1. rejects capabilities outside the tenant tool catalog;
2. validates proposed arguments against the app JSON Schema;
3. applies the Bridge allowlist and confirmation policy;
4. executes through the normal app gateway;
5. lets the target app apply domain validation such as the ABN checksum;
6. records AI tokens separately from app operations.

The live test demonstrated why every layer is required: a number written as
words produced an incorrect but well-shaped ABN and the ABN app rejected it.
A second instruction containing `51/824/753/556` was normalized correctly and
returned the Australian Taxation Office record.

## Configuration

```text
AGENT_LLM_ENABLED=1
AGENT_LLM_MODEL=<operational model>
```

Model choice is runtime configuration, not part of an app contract. Provider
keys remain outside source control. Local secret files are readable only by the
deployment owner and web-server group. Production should use a managed secret
service rather than `.env`.

## Data and usage

The provider receives only the current user instruction and safe tool
definitions. It does not receive credentials, source code, tenant storage, or
provider implementation details. Usage records contain provider, model,
input/output token counts, tenant, and request ID; prompts are not stored in the
usage ledger or structured platform logs.