Documentation
LLM Foundation
Select language
Select version
Loading versions...
Search all
Options
Options
Give feedback
View source
View as Markdown
How to edit
Edit on GitHub
LLM Foundation
Introduction
Installation
For editors
Administration
Managing providers
Managing models
Managing configurations
Site settings
Choosing a record from a list
Managing tasks
Managing prompt snippets
Managing translation glossaries
Term lists
Rule-
set judge
Get Started: use-
case packs
Managing skills
Importing and reviewing skill sources
Authoring local skills
Approving and revoking skill versions
Attaching and loading skills
Skill trust and integrity controls
Running tools
Managing enabled tools and groups
Editor action catalogue and batches
Using the Tool Playground
Tools, languages and workspaces
Read and interaction tool catalogue
Write-
tool authorization and previews
Metadata field writers
Attaching and creating records
Updating and managing records
Redirects and cache tools
Tool network policy and external pages
Skill tool grants
Registering tools
MCP servers
A2A remote agents
AI-
powered wizards
Per-
user AI budgets
Backend user permissions
Verifying the specialized services
Translating with autotranslate
Usage analytics
Monthly billing and export
Provider health diagnostics
AI usage of assigned groups
Error hints
Agent runs
Queues and background answers
Batch actions
Recovery and run expiry
Data retention & purge
Command-
line operation
Effective policy
Policy profiles and retention overrides
Inspecting the effective policy
Routing and request diagnostics
AI-
written record marker
Configuration reference
Adapter catalogue
Provider fields
Model fields
Configuration field reference
Configuration parameters and policies
Task fields
Task inputs and placements
Model routing reference
Settings
Developer guide
Streaming support
Tool/
function calling
Creating custom providers
Registering a provider
Fallback chain
Configuration presets
Quality evaluation
Build your extension on nr-
llm
Report usage from your own provider calls
Protecting anonymous LLM-
cost-
bearing endpoints
Rendering LLM Markdown server-
side safely
Feature services
Completion recipes
Image-
input recipes
Embedding recipes
Translation recipes
Injection and prompt defaults
Testing feature-
service consumers
Caching and batch behavior
Consumer integration examples
API reference
API stability
Release availability
Deprecation and removal policy
Support matrix
Llm
Service
Manager
Persisted agent runtime
Stored conversations
Completion
Service
Decision service
Embedding
Service
Vision
Service
Document
Analysis
Service
Translation
Service
Translation options
An editor's budget status
An extension's own usage
Tool
Calling
Service
Tool extension API
Guardrail extensions
Provider middleware
Specialized services
Tool invocation rules
Delegated MCP authentication
Keyword
Search
Reciprocal
Rank
Fusion
Retrieval provenance
Reranker
Response objects
Option classes
Provider interface
Events
Exceptions
Architecture
Responsible AI
Capabilities and boundaries
Gaps, owners and acceptance
Framework comparison
Operational evidence
Application evaluation
Testing guide
Unit testing
Functional testing
E2E testing
CI configuration
Architecture decision records
All decision records
ADR-
001: Provider Abstraction Layer
ADR-
002: Feature Services Architecture
ADR-
003: Typed Response Objects
ADR-
004: PSR-
14 Event System
ADR-
005: TYPO3 Caching Framework Integration
ADR-
006: Option Objects vs Arrays
ADR-
007: Multi-
Provider Strategy
ADR-
008: Error Handling Strategy
ADR-
009: Streaming Implementation
ADR-
010: Tool/
Function Calling Design
ADR-
011: Object-
Only Options API
ADR-
012: API key encryption at application level
ADR-
013: Three-
level configuration architecture
(Provider-
Model-
Configuration)
ADR-
014: AI-
Powered Wizard System
ADR-
015: Type-
Safe Domain Models via PHP 8.
1+ Enums & Value Objects
ADR-
016: Thinking/
Reasoning Block Extraction
ADR-
017: Safe Type Casting via Safe
Cast
Trait
ADR-
018: Multi-
Provider Model Discovery
ADR-
019: Internationalization Strategy
ADR-
020: Backend Output Format Rendering
ADR-
021: Provider Fallback Chain
ADR-
022: Attribute-
Based Provider Registration
ADR-
023: Native Backend Capability Permissions
ADR-
024: Dashboard Widgets
ADR-
025: Per-
User AI Budgets
ADR-
026: Provider Middleware Pipeline
ADR-
027: Split Task
Controller
ADR-
028: Public services policy in Configuration/
Services.
yaml
ADR-
029: Usage Analytics Dashboard
ADR-
030: Specialized Services Authenticate Through nr-
vault
ADR-
031: Tagged Prompt Snippet Library
ADR-
032: Specialized Usage Tracking and Pricing Catalog
ADR-
033: Specialized Models in the Model Registry
ADR-
034: Remove the Extension
Configuration default-
provider fallback
ADR-
035: Skill ingest
(Git
Hub-
hosted SKILL.
md sources)
ADR-
036: Skill injection
(attach + compose into prompts)
ADR-
037: Backend AJAX admin guard
ADR-
038: Tool runtime
(function-
calling agent loop)
ADR-
039: Global per-
tool availability state
ADR-
040: Playground run trace and tool-
path prompt augmentation
ADR-
041: Playground live run streaming
ADR-
042: Content and configuration read tools for the agent
ADR-
043: Tool groups with a fail-
closed enable cascade
ADR-
044: Error-
analysis tools with fail-
closed guards
ADR-
045: Schema and resolution tools
ADR-
046: History, URL and validation tools
ADR-
047: FAL tools
ADR-
048: Diagnostics tools
ADR-
049: RAG site-
search tools over installed search indexes
ADR-
050: Retrieval and embedding scope — the boundary with nr_
ai_
search
ADR-
051: Tool-
calling feature service — narrow consumer interface
ADR-
052: Usage attribution honours the caller-
supplied be
User
Uid
ADR-
053: One marker interface for all thrown exceptions
ADR-
054: Typed tool turns on Chat
Message instead of wire arrays
ADR-
055: Embeddings join the configuration path; dimensions metadata
ADR-
056: Configuration presets — consumer-
declared, admin-
imported records
ADR-
057: Speech and image services carry attribution in options
ADR-
058: Telemetry Middleware
ADR-
059: Decompose Llm
Service
Manager into focused collaborators
ADR-
060: Quality evaluation — golden sets, grading and regression detection
ADR-
061: Skill trust levels, manifest fingerprints, injection scanning
ADR-
062: Streaming Request Lifecycle
ADR-
063: Provider Resilience — Circuit Breaker, Health, Idempotency
ADR-
064: Central Privacy Model
ADR-
065: Reduce the public service surface
(ADR-
028 follow-
up)
ADR-
066: Criteria-
mode configurations resolve in the service layer
ADR-
067: Solr per-
language core — no language filter query
ADR-
069: Remove the unusable Prompt
Template stack
ADR-
070: User-
less configuration resolution by identifier
ADR-
071: Public keyword-
search facade over the retrieval cascade
ADR-
072: Retrieval-
quality evaluation — golden questions and top-
k hit rates
ADR-
073: First-
party test doubles for consumer-
facing interfaces
ADR-
074: Reciprocal Rank Fusion as a hosted utility
ADR-
075: Neutral cross-
encoder reranker protocol
ADR-
076: Document understanding — native-
first, rasterize fallback
ADR-
077: Plain completion joins the named-
configuration path
ADR-
078: Budget pre-
flight for the specialized image/
speech services
ADR-
079: First-
party fakes for Completion, Vision and Budget services
ADR-
080: Typed provider HTTP exceptions
(authentication 401, rate-
limit 429)
ADR-
081: Agent run persistence and a durable event stream
ADR-
082: Schema-
validated structured outputs with one repair round-
trip
ADR-
083: Conversation sessions and memory
ADR-
084: Human-
in-
the-
loop tool approval with suspend and resume
ADR-
085: Guardrail pipeline for provider responses
ADR-
086: Guardrail enforcement gaps — playground verdicts and streamed output
ADR-
087: Input-
side guardrails — screening and redacting the outgoing prompt
ADR-
088: Live streaming redaction with a holdback buffer
ADR-
089: Guardrail boundary completeness — reasoning, system prompt, vision
ADR-
090: One extension until 1.
0, with documented split seams
ADR-
091: Sessions are owned — an explicit actor context on every turn
ADR-
092: A run records why it ended, and cannot be settled twice
ADR-
093: One tool gate, in the loop — not in the controller
ADR-
094: Tool data classes and provider trust zones
ADR-
095: One failure taxonomy for retry and circuit-
breaker decisions
ADR-
096: The pipeline configuration lives on the call context
ADR-
097: Specialized services dispatch through the shared pipeline
ADR-
098: Input-
guardrail screening for specialized prompts
ADR-
099: Fail-
closed HTTP egress for the specialized services
ADR-
100: Specialized usage recorded by tagged extractors in the pipeline
ADR-
101: Agent
Runtime — the agent-
run lifecycle as a public service
ADR-
102: Queued agent runs over the TYPO3 message bus
ADR-
103: Cooperative cancellation at step boundaries
ADR-
104: Worker heartbeat, stale-
run reaper, retry and dead-
letter
ADR-
105: Typed user-
input suspension
(WAITING_
FOR_
INPUT)
ADR-
106: Per-
configuration guardrail policies
ADR-
107: Agent-
loop context-
window management
ADR-
108: Typed Tool
Result with run-
only artifacts
ADR-
109: Agent Runs approvals inbox
(backend module)
ADR-
110: Service account scopes
ADR-
111: Tool side effects and fail-
closed audit for writes
ADR-
112: Lease-
before-
op fence — no retry for an interrupted write
ADR-
113: Fail-
closed tool data-
class enforcement switch
ADR-
114: Encrypt queued and suspended agent-
run state at rest
ADR-
115: Tool data-
class enforcement is the default for new installs
ADR-
116: Central tooling authority — nr_
llm owns builtin + MCP tools
ADR-
117: Withdraw the backend capability permissions
ADR-
118: Verify the specialized services from the backend
ADR-
119: Where the backend modules live — Administration, for now
ADR-
120: The agent loop's tool gate is a required collaborator
ADR-
121: Conversations are bounded where they are assembled
ADR-
122: The side-
effecting tool contract waits for a side-
effecting tool
ADR-
123: One catalogue of secret shapes for every masking path
ADR-
124: A provider key can be set from the command line
ADR-
125: Per-
adapter collaborator classes
ADR-
126: A named JSON-
Schema subset, enforced strict
ADR-
127: A marked, versioned API surface
ADR-
128: Provider-
native structured output
ADR-
129: In-
repo consumers of structured output
ADR-
130: Capability grants for backend users
ADR-
131: The editor-
facing module
ADR-
132: Fail-
closed approval audit and turn binding
ADR-
133: An approver may only release a write they could run
ADR-
134: A builtin's declared write effect implies human approval
ADR-
135: The first writing tool, and the contract it actually needed
ADR-
136: The write preview is produced when the run suspends
ADR-
137: One candidate resolution for the primary's chain
ADR-
138: Criteria-
mode selection matches the operation, not only the criteria
ADR-
139: Context assembly is a seam, not a provider registry
ADR-
140: The effective-
policy readout has no apply path
ADR-
141: Every executing segment holds a lease, or writes stop
ADR-
142: One routing decision, with a reason per candidate
ADR-
143: Bound every send against the model that actually serves it
ADR-
144: Injected context carries a declared data class
ADR-
145: Governance profiles describe a posture, they never apply it
ADR-
146: Three more editorial writers, and what the third one reviewed
ADR-
147: No Symfony AI bridge while it is below 1.
0
ADR-
148: The routing readout is a second gate on the Governance tab
ADR-
149: A criteria-
mode trust zone comes from the resolved model
ADR-
150: A submitter may only feed a tool they could run, on the turn they saw
ADR-
151: The context budget is a breakdown, not a number
ADR-
152: An editor action is a declaration, not a second executor
ADR-
153: A run's uuid is the correlation id of everything it does
ADR-
154: An MCP server's liveness is observed, not inferred
ADR-
155: The system prompt carries a declared data class
ADR-
156: Persist the routing decision, and observe complexity without routing
ADR-
157: The simulation covers the run, and answers for an actor
ADR-
158: The Editor Action Center adds a catalogue, not a runtime
ADR-
159: One extension, confirmed at the 1.
0 API freeze
ADR-
160: One adapter contract, and honest capability provenance
ADR-
161: One conformance suite for every MCP connection we support
ADR-
162: Bulk editor actions are N ordinary runs, not a bulk runtime
ADR-
163: A use-
case pack is data plus a small installer
ADR-
164: A run's forced sources bind against the trust ceiling
ADR-
165: A resumed run re-
gates its forced sources
ADR-
166: Deactivating a source does not lower a ceiling
ADR-
167: Configuration access is a simulated axis
ADR-
168: A use-
case pack declares editor actions, and only declares them
ADR-
169: Record management belongs to TYPO3's permission model
ADR-
170: One deadline per MCP operation, spent across its legs
ADR-
171: The personas nr_
llm's code already assumes
ADR-
172: Four-
eyes approval is a per-
configuration switch, default off
ADR-
173: A self-
approved run says so, wherever the approval is shown
ADR-
174: Per-
call cost, and request facts measured before the model is chosen
ADR-
175: A forced skill binds by the same rule as a forced snippet
ADR-
176: A per-
call outcome, kept apart from the approval gate
ADR-
177: Caller-
source attribution on the options path
ADR-
178: Caller source on the cost path
ADR-
179: A forced source that is dropped is recorded on the run
ADR-
180: The sixth writer creates a page, and the one-
record rule holds
ADR-
181: The client reads an event-
stream framed answer, and holds no stream
ADR-
182: A write tool names the record it wrote
ADR-
183: The AI section exists, and editor surfaces live in it
ADR-
184: An approval binds to the state the preview showed
ADR-
185: An observed outcome is derived from history, inside a window
ADR-
186: A pack may ship snippets its own extension reads
ADR-
187: AI-
write provenance is announced, not implemented
ADR-
188: Every conversation has a configuration from the moment it opens
ADR-
189: A model capability is vocabulary, and only sometimes data
ADR-
190: Cancellation crosses the transport boundary as a signal
ADR-
191: A cancelled tool call is not a failed one
ADR-
192: The eighth writer describes an asset, and stays out of the seventh's field
ADR-
193: A draft element does not turn a connected page into a mixed one
ADR-
194: Two more metadata fields, one of them a select
ADR-
195: The ninth writer sets a page's social image, and stays out of the first's allow-
list
ADR-
196: The element draft offers the TCA's content types
ADR-
197: A generic record creator, only where no narrow writer exists
ADR-
198: The assistant acts on existing pages and content elements
ADR-
199: A copy is a hidden draft, and a page is copied without its branch
ADR-
200: A denied approval tells the model who declined it
ADR-
201: A consumer can ask which tools a run will not be offered
ADR-
202: Reading a public web page through an address guard
ADR-
203: Tool calling on an Open
AI reasoning model goes through Responses
ADR-
204: Reasoning effort is a request option, and the thinking switch sets it
ADR-
205: A column every content type carries excludes no type
ADR-
206: A hook that fails does not fail the write it ran after
ADR-
207: The Deep
L character quota is shown on the test page
ADR-
208: A site glossary reaches both translators
ADR-
209: The translation draft translates its text
ADR-
210: A caller can ask which tools run without approval
ADR-
211: Typed decisions from an exchangeable backend
ADR-
212: A generic file attacher, only where no narrow writer exists
ADR-
213: Approval preview lines are in the acting user's language
ADR-
214: Approved skill versions instruct, load on demand and run processes
ADR-
214 historical appendices
ADR-
214 historical context
ADR-
214 historical decision
ADR-
214 historical consequences
ADR-
215: Retrieval evaluation keeps its provenance
ADR-
216: Invocation policies see the call they decide
ADR-
217: Delegated MCP authentication keeps the acting identity
ADR-
218: Document source synchronisation belongs to the search companion
ADR-
219: Observe worker operations
ADR-
220: Evaluation results name their generator
ADR-
221: Skill synchronization holds a durable lease
ADR-
222: Gemini replay keeps native thought signatures
ADR-
223: Gemini separates native thoughts from text
ADR-
224: Gemini keeps known Struct roots as JSON objects
ADR-
225: Agent outcomes survive optional diagnostic failures
ADR-
226: Gemini correlates native function-
call IDs
ADR-
227: MCP replies belong to the request that accepts them
ADR-
228: A process run records its lineage; the runtime derives pins
ADR-
229: A skill declares whether it needs a page, outside its version
ADR-
230: An alternative text for one use of an image
ADR-
231: A monthly billing report with a markup
ADR-
232: An editor's budget status is public API
ADR-
233: A language model revises a Deep
L translation
ADR-
234: Background work is a stored run and a sweep
ADR-
235: A vision editor action sends the image
ADR-
236: A batch over a folder is a draft per record
ADR-
237: An empty field is filled after the save
ADR-
238: A term list blocks an output and says why
ADR-
239: A record an AI wrote carries a field
ADR-
240: The text of a tool round is streamed
ADR-
241: A reasoning model gets room to think
ADR-
242: A provider or a task tightens the privacy level
ADR-
243: A rule set is a snippet and a term list
ADR-
244: A site names its configuration and its Deep
L key
ADR-
245: A task is marked for the places that offer it
ADR-
246: Arguments are checked before a turn runs
ADR-
247: Azure Open
AI has its own URLs and key header
ADR-
248: An extension reads its own usage through public API
ADR-
249: A configuration may answer a repeated request from the cache
ADR-
255: A record select explains the chosen option
ADR-
256: Routing may rank by the call history
ADR-
257: The assistant manages redirects and clears caches
ADR-
258: A model hints at the cause of a logged error
ADR-
259: An MCP server may be connected through OAuth
ADR-
260: The assistant writes into the editor's workspace
ADR-
261: A configuration may exclude single tools
ADR-
262: The field writers write into the workspace, and a redirect is refused before the card
ADR-
263: The read tools read the run's workspace
ADR-
264: The creating writers create their record new in the workspace
ADR-
265: Background work writes into the workspace it was started in
ADR-
266: Move, copy, delete and translate act in the workspace the run is in
ADR-
267: The file list offers the editor actions
ADR-
268: A file is tagged from a configured category tree
ADR-
269: Responsible AI claims require evidence and an owner
ADR-
270: Run privacy accounts for actual provider selection
ADR-
271: Completion benchmarks have a revision
ADR-
272: Usage preserves reported token presence
ADR-
273: Observed outcomes require affirmative evidence
ADR-
274: The replacing writers replace a reference in the workspace
ADR-
275: A model record carries its reasoning profile
ADR-
276: A continuation streams its progress
ADR-
277: A head editor sees the usage of the groups assigned to him
ADR-
278: A2A is an agent interface in both roles
ADR-
279: A2A code sits in the agent module and calls out guarded
ADR-
280: An inbound A2A client is a record with a hashed token
ADR-
281: A run waits durably for a dependency or a decision
ADR-
282: An A2A result is stored with the run's completion
ADR-
283: An A2A task runs in the worker, and the request only waits
ADR-
284: A2A files are private, and adopting one into FAL is a write
ADR-
285: A2A push has an inbox and a bounded outbox
ADR-
286: A table task may send its rows as TOON
ADR-
287: An approved write that failed decides nothing
ADR-
288: A rule set can be judged by a second model
ADR-
289: autotranslate translates through nr-
llm
ADR-
290: A caller adds the term lists of another configuration
Writing and maintaining ADRs
Changelog
Release highlights archive
Earlier release highlights
Sitemap
Options
Give feedback
View source
View as Markdown
How to edit
Edit on GitHub
LLM Foundation
Changelog
Release highlights archive
Give feedback
Markdown
Edit on GitHub
Release highlights archive
Earlier release highlights
Previous
Next
Reference to the headline
Permalink (Shortlink)
Copy and freely share the link
URL
This link target has no permanent anchor assigned. You can make a
pull request on GitHub
to suggest an anchor. The link below can be used, but is prone to change if the page gets moved.
Link in reStructuredText (reST)
Copy this link into your TYPO3 manual.
Link in Markdown
Link in HTML
