TYPO3 Documentation
LLM Foundation
Options
Give feedback View source View as Markdown How to edit Edit on GitHub

LLM Foundation

  • Introduction
  • Installation
  • For editors
  • Administration
    • Managing providers
    • Managing models
    • Managing configurations
    • Site settings
    • Choosing a record from a list
    • Managing tasks
    • Managing prompt snippets
    • Managing translation glossaries
    • Term lists
    • Rule-set judge
    • Get Started: use-case packs
    • Managing skills
      • Importing and reviewing skill sources
      • Authoring local skills
      • Approving and revoking skill versions
      • Attaching and loading skills
      • Skill trust and integrity controls
    • Running tools
      • Managing enabled tools and groups
      • Editor action catalogue and batches
      • Using the Tool Playground
      • Tools, languages and workspaces
      • Read and interaction tool catalogue
      • Write-tool authorization and previews
        • Metadata field writers
        • Attaching and creating records
        • Updating and managing records
      • Redirects and cache tools
      • Tool network policy and external pages
      • Skill tool grants
      • Registering tools
    • MCP servers
    • A2A remote agents
    • AI-powered wizards
    • Per-user AI budgets
    • Backend user permissions
    • Verifying the specialized services
    • Translating with autotranslate
    • Usage analytics
      • Monthly billing and export
      • Provider health diagnostics
    • AI usage of assigned groups
    • Error hints
    • Agent runs
      • Queues and background answers
      • Batch actions
      • Recovery and run expiry
    • Data retention & purge
    • Command-line operation
    • Effective policy
      • Policy profiles and retention overrides
      • Inspecting the effective policy
      • Routing and request diagnostics
      • AI-written record marker
  • Configuration reference
    • Adapter catalogue
    • Provider fields
    • Model fields
    • Configuration field reference
      • Configuration parameters and policies
    • Task fields
      • Task inputs and placements
    • Model routing reference
    • Settings
  • Developer guide
    • Streaming support
    • Tool/function calling
    • Creating custom providers
    • Registering a provider
    • Fallback chain
    • Configuration presets
    • Quality evaluation
    • Build your extension on nr-llm
    • Report usage from your own provider calls
    • Protecting anonymous LLM-cost-bearing endpoints
    • Rendering LLM Markdown server-side safely
    • Feature services
      • Completion recipes
      • Image-input recipes
      • Embedding recipes
      • Translation recipes
      • Injection and prompt defaults
      • Testing feature-service consumers
      • Caching and batch behavior
      • Consumer integration examples
  • API reference
    • API stability
    • Release availability
    • Deprecation and removal policy
    • Support matrix
    • LlmServiceManager
    • Persisted agent runtime
    • Stored conversations
    • CompletionService
    • Decision service
    • EmbeddingService
    • VisionService
    • DocumentAnalysisService
    • TranslationService
      • Translation options
    • An editor's budget status
    • An extension's own usage
    • ToolCallingService
    • Tool extension API
    • Guardrail extensions
    • Provider middleware
    • Specialized services
    • Tool invocation rules
    • Delegated MCP authentication
    • KeywordSearch
    • ReciprocalRankFusion
    • Retrieval provenance
    • Reranker
    • Response objects
    • Option classes
    • Provider interface
    • Events
    • Exceptions
  • Architecture
  • Responsible AI
    • Capabilities and boundaries
    • Gaps, owners and acceptance
    • Framework comparison
    • Operational evidence
    • Application evaluation
  • Testing guide
    • Unit testing
    • Functional testing
    • E2E testing
    • CI configuration
  • Architecture decision records
    • All decision records
      • ADR-001: Provider Abstraction Layer
      • ADR-002: Feature Services Architecture
      • ADR-003: Typed Response Objects
      • ADR-004: PSR-14 Event System
      • ADR-005: TYPO3 Caching Framework Integration
      • ADR-006: Option Objects vs Arrays
      • ADR-007: Multi-Provider Strategy
      • ADR-008: Error Handling Strategy
      • ADR-009: Streaming Implementation
      • ADR-010: Tool/Function Calling Design
      • ADR-011: Object-Only Options API
      • ADR-012: API key encryption at application level
      • ADR-013: Three-level configuration architecture (Provider-Model-Configuration)
      • ADR-014: AI-Powered Wizard System
      • ADR-015: Type-Safe Domain Models via PHP 8.1+ Enums & Value Objects
      • ADR-016: Thinking/Reasoning Block Extraction
      • ADR-017: Safe Type Casting via SafeCastTrait
      • ADR-018: Multi-Provider Model Discovery
      • ADR-019: Internationalization Strategy
      • ADR-020: Backend Output Format Rendering
      • ADR-021: Provider Fallback Chain
      • ADR-022: Attribute-Based Provider Registration
      • ADR-023: Native Backend Capability Permissions
      • ADR-024: Dashboard Widgets
      • ADR-025: Per-User AI Budgets
      • ADR-026: Provider Middleware Pipeline
      • ADR-027: Split TaskController
      • ADR-028: Public services policy in Configuration/Services.yaml
      • ADR-029: Usage Analytics Dashboard
      • ADR-030: Specialized Services Authenticate Through nr-vault
      • ADR-031: Tagged Prompt Snippet Library
      • ADR-032: Specialized Usage Tracking and Pricing Catalog
      • ADR-033: Specialized Models in the Model Registry
      • ADR-034: Remove the ExtensionConfiguration default-provider fallback
      • ADR-035: Skill ingest (GitHub-hosted SKILL.md sources)
      • ADR-036: Skill injection (attach + compose into prompts)
      • ADR-037: Backend AJAX admin guard
      • ADR-038: Tool runtime (function-calling agent loop)
      • ADR-039: Global per-tool availability state
      • ADR-040: Playground run trace and tool-path prompt augmentation
      • ADR-041: Playground live run streaming
      • ADR-042: Content and configuration read tools for the agent
      • ADR-043: Tool groups with a fail-closed enable cascade
      • ADR-044: Error-analysis tools with fail-closed guards
      • ADR-045: Schema and resolution tools
      • ADR-046: History, URL and validation tools
      • ADR-047: FAL tools
      • ADR-048: Diagnostics tools
      • ADR-049: RAG site-search tools over installed search indexes
      • ADR-050: Retrieval and embedding scope — the boundary with nr_ai_search
      • ADR-051: Tool-calling feature service — narrow consumer interface
      • ADR-052: Usage attribution honours the caller-supplied beUserUid
      • ADR-053: One marker interface for all thrown exceptions
      • ADR-054: Typed tool turns on ChatMessage instead of wire arrays
      • ADR-055: Embeddings join the configuration path; dimensions metadata
      • ADR-056: Configuration presets — consumer-declared, admin-imported records
      • ADR-057: Speech and image services carry attribution in options
      • ADR-058: Telemetry Middleware
      • ADR-059: Decompose LlmServiceManager into focused collaborators
      • ADR-060: Quality evaluation — golden sets, grading and regression detection
      • ADR-061: Skill trust levels, manifest fingerprints, injection scanning
      • ADR-062: Streaming Request Lifecycle
      • ADR-063: Provider Resilience — Circuit Breaker, Health, Idempotency
      • ADR-064: Central Privacy Model
      • ADR-065: Reduce the public service surface (ADR-028 follow-up)
      • ADR-066: Criteria-mode configurations resolve in the service layer
      • ADR-067: Solr per-language core — no language filter query
      • ADR-069: Remove the unusable PromptTemplate stack
      • ADR-070: User-less configuration resolution by identifier
      • ADR-071: Public keyword-search facade over the retrieval cascade
      • ADR-072: Retrieval-quality evaluation — golden questions and top-k hit rates
      • ADR-073: First-party test doubles for consumer-facing interfaces
      • ADR-074: Reciprocal Rank Fusion as a hosted utility
      • ADR-075: Neutral cross-encoder reranker protocol
      • ADR-076: Document understanding — native-first, rasterize fallback
      • ADR-077: Plain completion joins the named-configuration path
      • ADR-078: Budget pre-flight for the specialized image/speech services
      • ADR-079: First-party fakes for Completion, Vision and Budget services
      • ADR-080: Typed provider HTTP exceptions (authentication 401, rate-limit 429)
      • ADR-081: Agent run persistence and a durable event stream
      • ADR-082: Schema-validated structured outputs with one repair round-trip
      • ADR-083: Conversation sessions and memory
      • ADR-084: Human-in-the-loop tool approval with suspend and resume
      • ADR-085: Guardrail pipeline for provider responses
      • ADR-086: Guardrail enforcement gaps — playground verdicts and streamed output
      • ADR-087: Input-side guardrails — screening and redacting the outgoing prompt
      • ADR-088: Live streaming redaction with a holdback buffer
      • ADR-089: Guardrail boundary completeness — reasoning, system prompt, vision
      • ADR-090: One extension until 1.0, with documented split seams
      • ADR-091: Sessions are owned — an explicit actor context on every turn
      • ADR-092: A run records why it ended, and cannot be settled twice
      • ADR-093: One tool gate, in the loop — not in the controller
      • ADR-094: Tool data classes and provider trust zones
      • ADR-095: One failure taxonomy for retry and circuit-breaker decisions
      • ADR-096: The pipeline configuration lives on the call context
      • ADR-097: Specialized services dispatch through the shared pipeline
      • ADR-098: Input-guardrail screening for specialized prompts
      • ADR-099: Fail-closed HTTP egress for the specialized services
      • ADR-100: Specialized usage recorded by tagged extractors in the pipeline
      • ADR-101: AgentRuntime — the agent-run lifecycle as a public service
      • ADR-102: Queued agent runs over the TYPO3 message bus
      • ADR-103: Cooperative cancellation at step boundaries
      • ADR-104: Worker heartbeat, stale-run reaper, retry and dead-letter
      • ADR-105: Typed user-input suspension (WAITING_FOR_INPUT)
      • ADR-106: Per-configuration guardrail policies
      • ADR-107: Agent-loop context-window management
      • ADR-108: Typed ToolResult with run-only artifacts
      • ADR-109: Agent Runs approvals inbox (backend module)
      • ADR-110: Service account scopes
      • ADR-111: Tool side effects and fail-closed audit for writes
      • ADR-112: Lease-before-op fence — no retry for an interrupted write
      • ADR-113: Fail-closed tool data-class enforcement switch
      • ADR-114: Encrypt queued and suspended agent-run state at rest
      • ADR-115: Tool data-class enforcement is the default for new installs
      • ADR-116: Central tooling authority — nr_llm owns builtin + MCP tools
      • ADR-117: Withdraw the backend capability permissions
      • ADR-118: Verify the specialized services from the backend
      • ADR-119: Where the backend modules live — Administration, for now
      • ADR-120: The agent loop's tool gate is a required collaborator
      • ADR-121: Conversations are bounded where they are assembled
      • ADR-122: The side-effecting tool contract waits for a side-effecting tool
      • ADR-123: One catalogue of secret shapes for every masking path
      • ADR-124: A provider key can be set from the command line
      • ADR-125: Per-adapter collaborator classes
      • ADR-126: A named JSON-Schema subset, enforced strict
      • ADR-127: A marked, versioned API surface
      • ADR-128: Provider-native structured output
      • ADR-129: In-repo consumers of structured output
      • ADR-130: Capability grants for backend users
      • ADR-131: The editor-facing module
      • ADR-132: Fail-closed approval audit and turn binding
      • ADR-133: An approver may only release a write they could run
      • ADR-134: A builtin's declared write effect implies human approval
      • ADR-135: The first writing tool, and the contract it actually needed
      • ADR-136: The write preview is produced when the run suspends
      • ADR-137: One candidate resolution for the primary's chain
      • ADR-138: Criteria-mode selection matches the operation, not only the criteria
      • ADR-139: Context assembly is a seam, not a provider registry
      • ADR-140: The effective-policy readout has no apply path
      • ADR-141: Every executing segment holds a lease, or writes stop
      • ADR-142: One routing decision, with a reason per candidate
      • ADR-143: Bound every send against the model that actually serves it
      • ADR-144: Injected context carries a declared data class
      • ADR-145: Governance profiles describe a posture, they never apply it
      • ADR-146: Three more editorial writers, and what the third one reviewed
      • ADR-147: No Symfony AI bridge while it is below 1.0
      • ADR-148: The routing readout is a second gate on the Governance tab
      • ADR-149: A criteria-mode trust zone comes from the resolved model
      • ADR-150: A submitter may only feed a tool they could run, on the turn they saw
      • ADR-151: The context budget is a breakdown, not a number
      • ADR-152: An editor action is a declaration, not a second executor
      • ADR-153: A run's uuid is the correlation id of everything it does
      • ADR-154: An MCP server's liveness is observed, not inferred
      • ADR-155: The system prompt carries a declared data class
      • ADR-156: Persist the routing decision, and observe complexity without routing
      • ADR-157: The simulation covers the run, and answers for an actor
      • ADR-158: The Editor Action Center adds a catalogue, not a runtime
      • ADR-159: One extension, confirmed at the 1.0 API freeze
      • ADR-160: One adapter contract, and honest capability provenance
      • ADR-161: One conformance suite for every MCP connection we support
      • ADR-162: Bulk editor actions are N ordinary runs, not a bulk runtime
      • ADR-163: A use-case pack is data plus a small installer
      • ADR-164: A run's forced sources bind against the trust ceiling
      • ADR-165: A resumed run re-gates its forced sources
      • ADR-166: Deactivating a source does not lower a ceiling
      • ADR-167: Configuration access is a simulated axis
      • ADR-168: A use-case pack declares editor actions, and only declares them
      • ADR-169: Record management belongs to TYPO3's permission model
      • ADR-170: One deadline per MCP operation, spent across its legs
      • ADR-171: The personas nr_llm's code already assumes
      • ADR-172: Four-eyes approval is a per-configuration switch, default off
      • ADR-173: A self-approved run says so, wherever the approval is shown
      • ADR-174: Per-call cost, and request facts measured before the model is chosen
      • ADR-175: A forced skill binds by the same rule as a forced snippet
      • ADR-176: A per-call outcome, kept apart from the approval gate
      • ADR-177: Caller-source attribution on the options path
      • ADR-178: Caller source on the cost path
      • ADR-179: A forced source that is dropped is recorded on the run
      • ADR-180: The sixth writer creates a page, and the one-record rule holds
      • ADR-181: The client reads an event-stream framed answer, and holds no stream
      • ADR-182: A write tool names the record it wrote
      • ADR-183: The AI section exists, and editor surfaces live in it
      • ADR-184: An approval binds to the state the preview showed
      • ADR-185: An observed outcome is derived from history, inside a window
      • ADR-186: A pack may ship snippets its own extension reads
      • ADR-187: AI-write provenance is announced, not implemented
      • ADR-188: Every conversation has a configuration from the moment it opens
      • ADR-189: A model capability is vocabulary, and only sometimes data
      • ADR-190: Cancellation crosses the transport boundary as a signal
      • ADR-191: A cancelled tool call is not a failed one
      • ADR-192: The eighth writer describes an asset, and stays out of the seventh's field
      • ADR-193: A draft element does not turn a connected page into a mixed one
      • ADR-194: Two more metadata fields, one of them a select
      • ADR-195: The ninth writer sets a page's social image, and stays out of the first's allow-list
      • ADR-196: The element draft offers the TCA's content types
      • ADR-197: A generic record creator, only where no narrow writer exists
      • ADR-198: The assistant acts on existing pages and content elements
      • ADR-199: A copy is a hidden draft, and a page is copied without its branch
      • ADR-200: A denied approval tells the model who declined it
      • ADR-201: A consumer can ask which tools a run will not be offered
      • ADR-202: Reading a public web page through an address guard
      • ADR-203: Tool calling on an OpenAI reasoning model goes through Responses
      • ADR-204: Reasoning effort is a request option, and the thinking switch sets it
      • ADR-205: A column every content type carries excludes no type
      • ADR-206: A hook that fails does not fail the write it ran after
      • ADR-207: The DeepL character quota is shown on the test page
      • ADR-208: A site glossary reaches both translators
      • ADR-209: The translation draft translates its text
      • ADR-210: A caller can ask which tools run without approval
      • ADR-211: Typed decisions from an exchangeable backend
      • ADR-212: A generic file attacher, only where no narrow writer exists
      • ADR-213: Approval preview lines are in the acting user's language
      • ADR-214: Approved skill versions instruct, load on demand and run processes
        • ADR-214 historical appendices
          • ADR-214 historical context
          • ADR-214 historical decision
          • ADR-214 historical consequences
      • ADR-215: Retrieval evaluation keeps its provenance
      • ADR-216: Invocation policies see the call they decide
      • ADR-217: Delegated MCP authentication keeps the acting identity
      • ADR-218: Document source synchronisation belongs to the search companion
      • ADR-219: Observe worker operations
      • ADR-220: Evaluation results name their generator
      • ADR-221: Skill synchronization holds a durable lease
      • ADR-222: Gemini replay keeps native thought signatures
      • ADR-223: Gemini separates native thoughts from text
      • ADR-224: Gemini keeps known Struct roots as JSON objects
      • ADR-225: Agent outcomes survive optional diagnostic failures
      • ADR-226: Gemini correlates native function-call IDs
      • ADR-227: MCP replies belong to the request that accepts them
      • ADR-228: A process run records its lineage; the runtime derives pins
      • ADR-229: A skill declares whether it needs a page, outside its version
      • ADR-230: An alternative text for one use of an image
      • ADR-231: A monthly billing report with a markup
      • ADR-232: An editor's budget status is public API
      • ADR-233: A language model revises a DeepL translation
      • ADR-234: Background work is a stored run and a sweep
      • ADR-235: A vision editor action sends the image
      • ADR-236: A batch over a folder is a draft per record
      • ADR-237: An empty field is filled after the save
      • ADR-238: A term list blocks an output and says why
      • ADR-239: A record an AI wrote carries a field
      • ADR-240: The text of a tool round is streamed
      • ADR-241: A reasoning model gets room to think
      • ADR-242: A provider or a task tightens the privacy level
      • ADR-243: A rule set is a snippet and a term list
      • ADR-244: A site names its configuration and its DeepL key
      • ADR-245: A task is marked for the places that offer it
      • ADR-246: Arguments are checked before a turn runs
      • ADR-247: Azure OpenAI has its own URLs and key header
      • ADR-248: An extension reads its own usage through public API
      • ADR-249: A configuration may answer a repeated request from the cache
      • ADR-255: A record select explains the chosen option
      • ADR-256: Routing may rank by the call history
      • ADR-257: The assistant manages redirects and clears caches
      • ADR-258: A model hints at the cause of a logged error
      • ADR-259: An MCP server may be connected through OAuth
      • ADR-260: The assistant writes into the editor's workspace
      • ADR-261: A configuration may exclude single tools
      • ADR-262: The field writers write into the workspace, and a redirect is refused before the card
      • ADR-263: The read tools read the run's workspace
      • ADR-264: The creating writers create their record new in the workspace
      • ADR-265: Background work writes into the workspace it was started in
      • ADR-266: Move, copy, delete and translate act in the workspace the run is in
      • ADR-267: The file list offers the editor actions
      • ADR-268: A file is tagged from a configured category tree
      • ADR-269: Responsible AI claims require evidence and an owner
      • ADR-270: Run privacy accounts for actual provider selection
      • ADR-271: Completion benchmarks have a revision
      • ADR-272: Usage preserves reported token presence
      • ADR-273: Observed outcomes require affirmative evidence
      • ADR-274: The replacing writers replace a reference in the workspace
      • ADR-275: A model record carries its reasoning profile
      • ADR-276: A continuation streams its progress
      • ADR-277: A head editor sees the usage of the groups assigned to him
      • ADR-278: A2A is an agent interface in both roles
      • ADR-279: A2A code sits in the agent module and calls out guarded
      • ADR-280: An inbound A2A client is a record with a hashed token
      • ADR-281: A run waits durably for a dependency or a decision
      • ADR-282: An A2A result is stored with the run's completion
      • ADR-283: An A2A task runs in the worker, and the request only waits
      • ADR-284: A2A files are private, and adopting one into FAL is a write
      • ADR-285: A2A push has an inbox and a bounded outbox
      • ADR-286: A table task may send its rows as TOON
      • ADR-287: An approved write that failed decides nothing
      • ADR-288: A rule set can be judged by a second model
      • ADR-289: autotranslate translates through nr-llm
      • ADR-290: A caller adds the term lists of another configuration
    • Writing and maintaining ADRs
  • Changelog
    • Release highlights archive
      • Earlier release highlights
  • Sitemap

Options

Give feedback View source View as Markdown How to edit Edit on GitHub
  1. LLM Foundation
  2. Architecture decision records
  3. All decision records
  4. ADR-214: Approved skill versions instruct, load on demand and run processes
  5. ADR-214 historical appendices
Give feedback Markdown Edit on GitHub

ADR-214 historical appendices 

  • ADR-214 historical context
  • ADR-214 historical decision
  • ADR-214 historical consequences
  • Previous
  • Next
Reference to the headline

Copy and freely share the link

This link target has no permanent anchor assigned. You can make a pull request on GitHub to suggest an anchor. The link below can be used, but is prone to change if the page gets moved.

Copy this link into your TYPO3 manual.

  • Home
  • Contact
  • Issues
  • Repository

Last rendered: Nov 12, 2026 15:41

© since 2025 by Netresearch DTT GmbH
  • Legal Notice
  • Privacy Policy