Module llm 

LLM backend abstraction (ADR 0016; an engine module since ADR 0018).

Nothing else in the engine may reach into subprocess machinery: grouping and the pipeline consume only LlmBackend/CommandBackend from here.

The grouping stage needs exactly one capability from a model: one-shot text completion — prompt in, raw text out. The contract is deliberately that narrow: no streaming, no chat state, no conversation to manage.

It stays that narrow now that the model reads for itself (ADR 0022). Tools run inside the CLI this spawns, so what crosses this seam is still a prompt and a string. What changed is a flag in the argv below, not the trait.

There are five agents, one constructor each, and the trait did not move to make room for them (ADR 0033). What differs between them is the argv, and the part of the argv that matters is how each one is stopped from writing:

• An allowlist — claude_cli, copilot_cli. The agent may run the named tools and nothing else, and the fetch command is one of them.
• An OS sandbox — codex_cli, droid_cli. The agent may run anything and the kernel refuses the writes, so there is no allowlist to derive and fetch does not appear in the argv.
• Nothing — pi_cli. Pi ships no sandbox and no per-command allowlist, and the shell tool it needs to fetch is the one that also lets it write. That is a decision with a reason, recorded in ADR 0033 and in the constructor, and config::Agent::read_only is how a caller tells a user about it.

Adding a sixth means a constructor here, a variant in config::Agent, and an arm in the application layer’s backend_from. The compiler asks for the last two; this comment is the only thing that asks for the boundary.

Structs

CommandBackend

A subprocess backend: prompt on stdin, completion on stdout.

Enums

LlmError

Traits

LlmBackend

One-shot completion: prompt in, raw text out.