Model execution

1. The LLM's job and the software's job

P On the 68 case journeys, a model receives the selected task contract, current scoped evidence, compatible pinned knowledge and bounded permitted actions. It returns a proposed action or typed result with evidence references, distinguishing hypothesis, external report and verified observation. Software resolves those references and evaluates dependencies/completion. “Done” in model output cannot discharge external work, omit a family member, cancel restoration or publish memory. The negative fixtures test these joins.

P An LLM interprets material, proposes a plan, chooses a permitted next action, or assesses evidence. It does not own a case, schedule a worker, open a database connection, issue a grant, commit a transaction or decide whether its own output is valid. C# performs those operations. An agent is a published profile executed repeatedly against a durable task; the model call is one step inside that execution. A skill is executable code with typed inputs and assertions. A connector is the only adapter to an estate system. Their composition is the Agent Runtime, not a conversation stored by the provider.

P Training a write shape means collecting verified instances and changing its approved execution policy. It does not train model weights. Memory changes the material retrieved into future requests; prompt publication changes instructions; a model-route change changes the selected provider/deployment. These are separately versioned changes, each evaluated before use (Agent Framework § 6). No fine-tuning service is required to implement the platform.

2. What is actually reusable

F The inspected copy source is commit 9ce3cb304058c2dfdd65301fb202becf8d479107 on codex/health-ai-csharp-architecture, read 07.09.2026. Under src/Serdica/Ablera.Serdica.AI/__Libraries/, ProviderInterfaces.cs defines IInferenceClient.ExecuteAsync(InferenceRequestV1), ProbeAsync, and optional IInferenceRecoveryClient.RecoverAsync. It does not define IModelClient, chat history, native function declarations or function-call results. ProviderContracts.cs carries text/image input parts, prompt arguments, a structured output schema, requested reasoning settings, service tier, output limit, provider identity and nullable usage measurements.

F The copied OpenAiSdkResponsesTransport.cs sends one user message containing the input parts, requests strict JSON output, sets store=false, and disables SDK retries. Its idempotency value is provider metadata; this is not evidence that the provider deduplicates submissions. Its streaming implementation collects a terminal response, not tool-call deltas. These are reusable transport behaviours, not an existing agent loop.

P First implementation. Copy the abstraction and transport under the ownership rules of Software Architecture § 9. Use a structured action document as the model's output. The runtime renders the permitted tool catalogue into the request and validates the returned action before dispatch. This works with the existing one-call interface; it requires no second provider abstraction and no third-party agent runtime. Native function calling may later map into the same action document, but is not a prerequisite and may not bypass the validator or permission service.

3. One request, assembled in a fixed order

P ContextAssembler loads only committed revisions, in this order. It produces the exact text input, the action output schema and a manifest of every source/hash used. The complete, sanitised request is an immutable case artefact before provider dispatch; RUNTIME_CALLS.REQUEST_PAPER_ID names it. The ledger contains its hash and references, not its body.

P With the initial transport, all sections are one deliberately rendered input document. The adapter does not manufacture a system-role separation the copied interface lacks. Instructions and quoted content have explicit boundaries, but delimiter formatting is not the security boundary: unavailable tools and deterministic permission checks are. A future adapter exposing system/developer roles must preserve the same section manifest and action contract.

P Context sizing. Resolve MODEL_ROUTES.CONTEXT_BUDGET_TOKENS; reserve the requested output allowance and the adapter's framing allowance before admitting input. Never truncate the platform protocol, active plan identity, grant scope or output schema. First replace large old tool bodies with hash-checked references; then compact old conversational material. Retain pending tool actions and unanswered questions exactly. If the mandatory portion does not fit, park as a capability gap; do not silently drop a constraint. compaction.retain and per-part limits are versioned policy values whose chosen values are captured in the request manifest. The replay fixtures must cover overflow at each boundary.

4. The action contract and control tools

P The closed model-turn contract admits two outcomes: tool_calls or message. A tool call carries a registered tool name and JSON arguments. A message carries a typed message kind and payload; the runtime supplies sender, case, task, message id, timestamp and ancestry. An LLM cannot claim to be another task or a gate actor. The model cannot spawn an executor to bypass writes.propose; only the execution coordinator dispatches that handler after its decisions. A short summary is the agent's stated reason for the action, suitable for the case card; raw chain-of-thought is neither requested nor stored.

P No model-facing tool accepts a connection string, raw credential, arbitrary process executable, grant creation command or direct mutating connector handle. Development's filesystem/build operations are declared connector operations restricted to the case worktree; having a build tool is not permission to publish or deploy. Control tools may change platform records under task ownership without an estate write grant; their effects and messages are still journalled.

P Validate the response in two steps: JSON/action-schema validity, then semantic validity against the permitted catalogue and current task. Validate every call before scheduling the batch. Independent reads may run together; mutations and platform control changes run sequentially. Duplicate call identities with different arguments are refused. Unknown tools, invented paper references and unsupported messages produce a typed refusal. No fragment of malformed or incomplete JSON is executed. Re-asking after validation failure consumes a new recorded model attempt; after the profile's failed-attempt threshold, escalate through the parent.

5. Routing, data and provider failures

P Retirement removes a version from new selection; a pinned running task may continue using it while its dependencies remain available and no explicit deny, risk withdrawal or failed evaluation blocks it. Retirement is not revocation. A revoked route/profile is refused at dispatch and requires a recorded replacement or stop.

P The owned adapter registry caches clients by endpoint/credential configuration and adapter version, not provider name alone. Routes on one provider can use different approved deployments/endpoints without changing task history. This is host composition around the inspected IInferenceClient interface; the copied Manager's singleton-registration restriction is not inherited as a platform limitation.

P A task pins profile, prompt, route, framework, skill and manifest versions. Before each call, RouteSelector verifies that the pinned route remains published/usable, that current data policy permits every input, and that the endpoint probe is healthy. Support's EU/DPA requirement remains; a configuration label does not make an arbitrary attachment non-personal or publicly disclosable (Trust and Data § 4). Secrets never enter the request. Images follow the screenshot restriction; the initial slice uses extracted, sanitised text and tables.

P A fallback must be pre-approved and evaluated for this profile and input class. Switching routes is a recorded task transition and a new request manifest; it never edits an old call. Provider/model names, requested/effective reasoning settings, resolved deployment, provider request id and measured usage travel with each result. Missing usage remains unknown; it is not recorded as zero. Context capacity and output limits are technical constraints, distinct from the case's delivery-time budget.

P A model response is not made actionable until durably recorded. After a crash, use the recorded response and its action list; do not ask the model to reconstruct which tools it had requested. The separate runtime call journal and recovery procedure decide what may run again.

6. What proves the LLM part works

P The runtime's replay adapter returns recorded model results without network access. It tests context assembly, action parsing, denied tools, malformed output, multiple reads, late cancellation, pending gates, duplicate messages and crash recovery. These are software tests and must pass before a live provider is needed.

P Profile evaluations run the real selected model against versioned inputs and expected outcomes. Deterministic checks run first; a model grader is used only for declared rubric dimensions and can return Unknown. Set-level publication rules are in Agent Framework § 6.5. Test an author prompt with its actual tools, source renditions and context limits; a prompt that succeeds only with an unrestricted transcript is not an accepted profile.

P The first live acceptance is one profile completing a bounded read task, returning one valid action at a time, followed by an exact proposal refused without a grant. Only after replay and permission tests pass does the authorised configuration slice exercise target writes. This proves the provider seam, the loop and the authority boundary separately.