All decision records
- ADR-001: Provider Abstraction Layer
- ADR-002: Feature Services Architecture
- ADR-003: Typed Response Objects
- ADR-004: PSR-14 Event System
- ADR-005: TYPO3 Caching Framework Integration
- ADR-006: Option Objects vs Arrays
- ADR-007: Multi-Provider Strategy
- ADR-008: Error Handling Strategy
- ADR-009: Streaming Implementation
- ADR-010: Tool/Function Calling Design
- ADR-011: Object-Only Options API
- ADR-012: API key encryption at application level
- ADR-013: Three-level configuration architecture (Provider-Model-Configuration)
- ADR-014: AI-Powered Wizard System
- ADR-015: Type-Safe Domain Models via PHP 8.1+ Enums & Value Objects
- ADR-016: Thinking/Reasoning Block Extraction
- ADR-017: Safe Type Casting via SafeCastTrait
- ADR-018: Multi-Provider Model Discovery
- ADR-019: Internationalization Strategy
- ADR-020: Backend Output Format Rendering
- ADR-021: Provider Fallback Chain
- ADR-022: Attribute-Based Provider Registration
- ADR-023: Native Backend Capability Permissions
- ADR-024: Dashboard Widgets
- ADR-025: Per-User AI Budgets
- ADR-026: Provider Middleware Pipeline
- ADR-027: Split TaskController
- ADR-028: Public services policy in Configuration/Services.yaml
- ADR-029: Usage Analytics Dashboard
- ADR-030: Specialized Services Authenticate Through nr-vault
- ADR-031: Tagged Prompt Snippet Library
- ADR-032: Specialized Usage Tracking and Pricing Catalog
- ADR-033: Specialized Models in the Model Registry
- ADR-034: Remove the ExtensionConfiguration default-provider fallback
- ADR-035: Skill ingest (GitHub-hosted SKILL.md sources)
- ADR-036: Skill injection (attach + compose into prompts)
- ADR-037: Backend AJAX admin guard
- ADR-038: Tool runtime (function-calling agent loop)
- ADR-039: Global per-tool availability state
- ADR-040: Playground run trace and tool-path prompt augmentation
- ADR-041: Playground live run streaming
- ADR-042: Content and configuration read tools for the agent
- ADR-043: Tool groups with a fail-closed enable cascade
- ADR-044: Error-analysis tools with fail-closed guards
- ADR-045: Schema and resolution tools
- ADR-046: History, URL and validation tools
- ADR-047: FAL tools
- ADR-048: Diagnostics tools
- ADR-049: RAG site-search tools over installed search indexes
- ADR-050: Retrieval and embedding scope — the boundary with nr_ai_search
- ADR-051: Tool-calling feature service — narrow consumer interface
- ADR-052: Usage attribution honours the caller-supplied beUserUid
- ADR-053: One marker interface for all thrown exceptions
- ADR-054: Typed tool turns on ChatMessage instead of wire arrays
- ADR-055: Embeddings join the configuration path; dimensions metadata
- ADR-056: Configuration presets — consumer-declared, admin-imported records
- ADR-057: Speech and image services carry attribution in options
- ADR-058: Telemetry Middleware
- ADR-059: Decompose LlmServiceManager into focused collaborators
- ADR-060: Quality evaluation — golden sets, grading and regression detection
- ADR-061: Skill trust levels, manifest fingerprints, injection scanning
- ADR-062: Streaming Request Lifecycle
- ADR-063: Provider Resilience — Circuit Breaker, Health, Idempotency
- ADR-064: Central Privacy Model
- ADR-065: Reduce the public service surface (ADR-028 follow-up)
- ADR-066: Criteria-mode configurations resolve in the service layer
- ADR-067: Solr per-language core — no language filter query
- ADR-069: Remove the unusable PromptTemplate stack
- ADR-070: User-less configuration resolution by identifier
- ADR-071: Public keyword-search facade over the retrieval cascade
- ADR-072: Retrieval-quality evaluation — golden questions and top-k hit rates
- ADR-073: First-party test doubles for consumer-facing interfaces
- ADR-074: Reciprocal Rank Fusion as a hosted utility
- ADR-075: Neutral cross-encoder reranker protocol
- ADR-076: Document understanding — native-first, rasterize fallback
- ADR-077: Plain completion joins the named-configuration path
- ADR-078: Budget pre-flight for the specialized image/speech services
- ADR-079: First-party fakes for Completion, Vision and Budget services
- ADR-080: Typed provider HTTP exceptions (authentication 401, rate-limit 429)
- ADR-081: Agent run persistence and a durable event stream
- ADR-082: Schema-validated structured outputs with one repair round-trip
- ADR-083: Conversation sessions and memory
- ADR-084: Human-in-the-loop tool approval with suspend and resume
- ADR-085: Guardrail pipeline for provider responses
- ADR-086: Guardrail enforcement gaps — playground verdicts and streamed output
- ADR-087: Input-side guardrails — screening and redacting the outgoing prompt
- ADR-088: Live streaming redaction with a holdback buffer
- ADR-089: Guardrail boundary completeness — reasoning, system prompt, vision
- ADR-090: One extension until 1.0, with documented split seams
- ADR-091: Sessions are owned — an explicit actor context on every turn
- ADR-092: A run records why it ended, and cannot be settled twice
- ADR-093: One tool gate, in the loop — not in the controller
- ADR-094: Tool data classes and provider trust zones
- ADR-095: One failure taxonomy for retry and circuit-breaker decisions
- ADR-096: The pipeline configuration lives on the call context
- ADR-097: Specialized services dispatch through the shared pipeline
- ADR-098: Input-guardrail screening for specialized prompts
- ADR-099: Fail-closed HTTP egress for the specialized services
- ADR-100: Specialized usage recorded by tagged extractors in the pipeline
- ADR-101: AgentRuntime — the agent-run lifecycle as a public service
- ADR-102: Queued agent runs over the TYPO3 message bus
- ADR-103: Cooperative cancellation at step boundaries
- ADR-104: Worker heartbeat, stale-run reaper, retry and dead-letter
- ADR-105: Typed user-input suspension (WAITING_FOR_INPUT)
- ADR-106: Per-configuration guardrail policies
- ADR-107: Agent-loop context-window management
- ADR-108: Typed ToolResult with run-only artifacts
- ADR-109: Agent Runs approvals inbox (backend module)
- ADR-110: Service account scopes
- ADR-111: Tool side effects and fail-closed audit for writes
- ADR-112: Lease-before-op fence — no retry for an interrupted write
- ADR-113: Fail-closed tool data-class enforcement switch
- ADR-114: Encrypt queued and suspended agent-run state at rest
- ADR-115: Tool data-class enforcement is the default for new installs
- ADR-116: Central tooling authority — nr_llm owns builtin + MCP tools
- ADR-117: Withdraw the backend capability permissions
- ADR-118: Verify the specialized services from the backend
- ADR-119: Where the backend modules live — Administration, for now
- ADR-120: The agent loop's tool gate is a required collaborator
- ADR-121: Conversations are bounded where they are assembled
- ADR-122: The side-effecting tool contract waits for a side-effecting tool
- ADR-123: One catalogue of secret shapes for every masking path
- ADR-124: A provider key can be set from the command line
- ADR-125: Per-adapter collaborator classes
- ADR-126: A named JSON-Schema subset, enforced strict
- ADR-127: A marked, versioned API surface
- ADR-128: Provider-native structured output
- ADR-129: In-repo consumers of structured output
- ADR-130: Capability grants for backend users
- ADR-131: The editor-facing module
- ADR-132: Fail-closed approval audit and turn binding
- ADR-133: An approver may only release a write they could run
- ADR-134: A builtin's declared write effect implies human approval
- ADR-135: The first writing tool, and the contract it actually needed
- ADR-136: The write preview is produced when the run suspends
- ADR-137: One candidate resolution for the primary's chain
- ADR-138: Criteria-mode selection matches the operation, not only the criteria
- ADR-139: Context assembly is a seam, not a provider registry
- ADR-140: The effective-policy readout has no apply path
- ADR-141: Every executing segment holds a lease, or writes stop
- ADR-142: One routing decision, with a reason per candidate
- ADR-143: Bound every send against the model that actually serves it
- ADR-144: Injected context carries a declared data class
- ADR-145: Governance profiles describe a posture, they never apply it
- ADR-146: Three more editorial writers, and what the third one reviewed
- ADR-147: No Symfony AI bridge while it is below 1.0
- ADR-148: The routing readout is a second gate on the Governance tab
- ADR-149: A criteria-mode trust zone comes from the resolved model
- ADR-150: A submitter may only feed a tool they could run, on the turn they saw
- ADR-151: The context budget is a breakdown, not a number
- ADR-152: An editor action is a declaration, not a second executor
- ADR-153: A run's uuid is the correlation id of everything it does
- ADR-154: An MCP server's liveness is observed, not inferred
- ADR-155: The system prompt carries a declared data class
- ADR-156: Persist the routing decision, and observe complexity without routing
- ADR-157: The simulation covers the run, and answers for an actor
- ADR-158: The Editor Action Center adds a catalogue, not a runtime
- ADR-159: One extension, confirmed at the 1.0 API freeze
- ADR-160: One adapter contract, and honest capability provenance
- ADR-161: One conformance suite for every MCP connection we support
- ADR-162: Bulk editor actions are N ordinary runs, not a bulk runtime
- ADR-163: A use-case pack is data plus a small installer
- ADR-164: A run's forced sources bind against the trust ceiling
- ADR-165: A resumed run re-gates its forced sources
- ADR-166: Deactivating a source does not lower a ceiling
- ADR-167: Configuration access is a simulated axis
- ADR-168: A use-case pack declares editor actions, and only declares them
- ADR-169: Record management belongs to TYPO3's permission model
- ADR-170: One deadline per MCP operation, spent across its legs
- ADR-171: The personas nr_llm's code already assumes
- ADR-172: Four-eyes approval is a per-configuration switch, default off
- ADR-173: A self-approved run says so, wherever the approval is shown
- ADR-174: Per-call cost, and request facts measured before the model is chosen
- ADR-175: A forced skill binds by the same rule as a forced snippet
- ADR-176: A per-call outcome, kept apart from the approval gate
- ADR-177: Caller-source attribution on the options path
- ADR-178: Caller source on the cost path
- ADR-179: A forced source that is dropped is recorded on the run
- ADR-180: The sixth writer creates a page, and the one-record rule holds
- ADR-181: The client reads an event-stream framed answer, and holds no stream
- ADR-182: A write tool names the record it wrote
- ADR-183: The AI section exists, and editor surfaces live in it
- ADR-184: An approval binds to the state the preview showed
- ADR-185: An observed outcome is derived from history, inside a window
- ADR-186: A pack may ship snippets its own extension reads
- ADR-187: AI-write provenance is announced, not implemented
- ADR-188: Every conversation has a configuration from the moment it opens
- ADR-189: A model capability is vocabulary, and only sometimes data
- ADR-190: Cancellation crosses the transport boundary as a signal
- ADR-191: A cancelled tool call is not a failed one
- ADR-192: The eighth writer describes an asset, and stays out of the seventh's field
- ADR-193: A draft element does not turn a connected page into a mixed one
- ADR-194: Two more metadata fields, one of them a select
- ADR-195: The ninth writer sets a page's social image, and stays out of the first's allow-list
- ADR-196: The element draft offers the TCA's content types
- ADR-197: A generic record creator, only where no narrow writer exists
- ADR-198: The assistant acts on existing pages and content elements
- ADR-199: A copy is a hidden draft, and a page is copied without its branch
- ADR-200: A denied approval tells the model who declined it
- ADR-201: A consumer can ask which tools a run will not be offered
- ADR-202: Reading a public web page through an address guard
- ADR-203: Tool calling on an OpenAI reasoning model goes through Responses
- ADR-204: Reasoning effort is a request option, and the thinking switch sets it
- ADR-205: A column every content type carries excludes no type
- ADR-206: A hook that fails does not fail the write it ran after
- ADR-207: The DeepL character quota is shown on the test page
- ADR-208: A site glossary reaches both translators
- ADR-209: The translation draft translates its text
- ADR-210: A caller can ask which tools run without approval
- ADR-211: Typed decisions from an exchangeable backend
- ADR-212: A generic file attacher, only where no narrow writer exists
- ADR-213: Approval preview lines are in the acting user's language
- ADR-214: Approved skill versions instruct, load on demand and run processes
- ADR-215: Retrieval evaluation keeps its provenance
- ADR-216: Invocation policies see the call they decide
- ADR-217: Delegated MCP authentication keeps the acting identity
- ADR-218: Document source synchronisation belongs to the search companion
- ADR-219: Observe worker operations
- ADR-220: Evaluation results name their generator
- ADR-221: Skill synchronization holds a durable lease
- ADR-222: Gemini replay keeps native thought signatures
- ADR-223: Gemini separates native thoughts from text
- ADR-224: Gemini keeps known Struct roots as JSON objects
- ADR-225: Agent outcomes survive optional diagnostic failures
- ADR-226: Gemini correlates native function-call IDs
- ADR-227: MCP replies belong to the request that accepts them
- ADR-228: A process run records its lineage; the runtime derives pins
- ADR-229: A skill declares whether it needs a page, outside its version
- ADR-230: An alternative text for one use of an image
- ADR-231: A monthly billing report with a markup
- ADR-232: An editor's budget status is public API
- ADR-233: A language model revises a DeepL translation
- ADR-234: Background work is a stored run and a sweep
- ADR-235: A vision editor action sends the image
- ADR-236: A batch over a folder is a draft per record
- ADR-237: An empty field is filled after the save
- ADR-238: A term list blocks an output and says why
- ADR-239: A record an AI wrote carries a field
- ADR-240: The text of a tool round is streamed
- ADR-241: A reasoning model gets room to think
- ADR-242: A provider or a task tightens the privacy level
- ADR-243: A rule set is a snippet and a term list
- ADR-244: A site names its configuration and its DeepL key
- ADR-245: A task is marked for the places that offer it
- ADR-246: Arguments are checked before a turn runs
- ADR-247: Azure OpenAI has its own URLs and key header
- ADR-248: An extension reads its own usage through public API
- ADR-249: A configuration may answer a repeated request from the cache
- ADR-255: A record select explains the chosen option
- ADR-256: Routing may rank by the call history
- ADR-257: The assistant manages redirects and clears caches
- ADR-258: A model hints at the cause of a logged error
- ADR-259: An MCP server may be connected through OAuth
- ADR-260: The assistant writes into the editor's workspace
- ADR-261: A configuration may exclude single tools
- ADR-262: The field writers write into the workspace, and a redirect is refused before the card
- ADR-263: The read tools read the run's workspace
- ADR-264: The creating writers create their record new in the workspace
- ADR-265: Background work writes into the workspace it was started in
- ADR-266: Move, copy, delete and translate act in the workspace the run is in
- ADR-267: The file list offers the editor actions
- ADR-268: A file is tagged from a configured category tree
- ADR-269: Responsible AI claims require evidence and an owner
- ADR-270: Run privacy accounts for actual provider selection
- ADR-271: Completion benchmarks have a revision
- ADR-272: Usage preserves reported token presence
- ADR-273: Observed outcomes require affirmative evidence
- ADR-274: The replacing writers replace a reference in the workspace
- ADR-275: A model record carries its reasoning profile
- ADR-276: A continuation streams its progress
- ADR-277: A head editor sees the usage of the groups assigned to him
- ADR-278: A2A is an agent interface in both roles
- ADR-279: A2A code sits in the agent module and calls out guarded
- ADR-280: An inbound A2A client is a record with a hashed token
- ADR-281: A run waits durably for a dependency or a decision
- ADR-282: An A2A result is stored with the run's completion
- ADR-283: An A2A task runs in the worker, and the request only waits
- ADR-284: A2A files are private, and adopting one into FAL is a write
- ADR-285: A2A push has an inbox and a bounded outbox
- ADR-286: A table task may send its rows as TOON
- ADR-287: An approved write that failed decides nothing
- ADR-288: A rule set can be judged by a second model
- ADR-289: autotranslate translates through nr-llm
- ADR-290: A caller adds the term lists of another configuration