Inference runtime

Model calls are a host facility, the AI port. Tenant code never holds a provider key or a provider id: it names a system and a model class, and the host maps them.

Two systems and embeddings

• sys_2 — the language model: ctx.ai.sys_2.infer and the agent loop, by declared model class
• sys_1 — a fast structured-decision model: message triage, AI filtering in the view popover, and ctx.ai.sys_1.decide
• embed — embeddings, for ctx.ai.embed and semantic search

When a host binds the AI facility, both systems are required; embeddings are present when the host maps an embedding model. Nothing falls back from one system to another.

Files

Every sys_2 and embedding model is multimodal, verified when the host activates the facility. Before a call, the engine checks that the caller may read each file, reads its bytes and hands them to the host adapter, which only encodes them for the provider. sys_1 takes text only: a file in its state is a type error.

Calls and walls

Each model request has a 20 s idle deadline, refreshed by streamed progress. A request with no progress within that interval fails Timeout. Multi-step inference retains its separate whole-call ceiling. sys_1.decide is one call of at most 3 s.

Journal and metering

sys_2.infer and sys_1.decide are journalled by content hash, so a replayed step returns the recorded answer with no second call or charge. Each call’s cost is metered.

Errors

Failures are typed: Upstream, Timeout, RateLimited, Invalid, TooLarge, Unsupported and Unavailable. A provider’s refusal of an input it cannot take passes through as the error it maps to.