schema_version: 2
provider: fai
name: orchestrator-llm
version: 0.3.1

# Capability provided by this module.
provides:
  - capability: orchestrator.plan
    version: 0.3.0

# Inputs the invoke function accepts.
inputs:
  goal: text
  # LLM HTTP endpoint, e.g. "http://localhost:11434/api/chat"
  # for Ollama, "https://api.openai.com/v1/chat/completions",
  # or "https://api.anthropic.com/v1/messages".
  llm_endpoint: text
  # Model identifier, e.g. "qwen2.5:14b" for Ollama or "gpt-4o-mini".
  llm_model: text
  # Optional bearer token for cloud providers. Empty string means
  # no Authorization header is sent.
  llm_api_key: text
  # Optional JSON-encoded list of installed capabilities. If
  # omitted or empty, the module plans without capability context.
  available_capabilities: text
  # Optional JSON-encoded list of all known store capabilities
  # (installed + planned + alpha). Used when the orchestrator
  # needs to suggest installations.
  store_capabilities: text

# Outputs produced.
outputs:
  # JSON-encoded Plan compatible with `fai_hub::plan::Plan`.
  plan: json
  # The endpoint the plan was generated against. Empty when the
  # deterministic stub path (no llm_endpoint) ran.
  model_endpoint: text
  # The model name as supplied to the LLM API.
  model_name: text
  # SHA-256 digest of the served Ollama model, when reachable.
  # Empty for cloud providers (OpenAI / Anthropic do not expose
  # a digest API) and for the deterministic stub path. Together
  # with model_endpoint and model_name this answers the audit
  # question "which exact model produced this plan?"
  model_digest: text

# Permissions required.
#
# The module makes outbound HTTP to the configured LLM endpoint.
# Default declarations cover the common providers (cloud OpenAI,
# Anthropic, local Ollama on loopback). Operators with different
# LLM endpoints add a host-level entry via operator config
# (Phase 1+) — for Phase 0.5 they fork module.yaml.
permissions:
  - "net: api.openai.com"
  - "net: api.anthropic.com"
  - "net: localhost"
  - "net: 127.0.0.1"