'%20fill='%23EDEDED'%3e%3cg%20id='symbol'%3e%3crect%20x='0'%20y='0'%20width='10.5'%20height='42'%20rx='3.5'/%3e%3crect%20x='16'%20y='0'%20width='10'%20height='28'%20rx='3.5'/%3e%3crect%20x='31'%20y='14'%20width='10.5'%20height='28'%20rx='3.5'/%3e%3c/g%3e%3cg%20transform='translate(-19.88%20-0.33)%20scale(1.08)'%3e%3cg%20id='wordmark'%3e%3cpath%20d='M76%203H82V9H76Z%20M76%2011H82V36H76Z'/%3e%3cpath%20d='M86%2011H91.5V15.4C93.1%2012.3%2095.5%2010.8%2098.6%2010.8H100V16.5H97.9C93.7%2016.5%2092%2019%2092%2023.5V36H86Z'/%3e%3cpath%20fill-rule='evenodd'%20d='M110.8%2010.8C118.1%2010.8%20122.5%2015.8%20122.5%2023.5C122.5%2031.3%20118.1%2036.5%20110.8%2036.5C103.5%2036.5%2099.1%2031.3%2099.1%2023.5C99.1%2015.8%20103.5%2010.8%20110.8%2010.8Z%20M110.8%2015.5C107%2015.5%20105%2018.3%20105%2023.5C105%2028.8%20107%2031.8%20110.8%2031.8C114.6%2031.8%20116.6%2028.8%20116.6%2023.5C116.6%2018.3%20114.6%2015.5%20110.8%2015.5Z'/%3e%3c/g%3e%3cg%20fill='%23767676'%3e%3cpath%20id='period'%20d='M124%2030H130V36H124Z'/%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/svg%3e)
AI layer
Router, not bindings
llm@1 is routed: after the grant check, the kernel’s router picks provider and model from Settings → AI (tiers fast/smart/best, fallback, embeddings). App inputs are strict objects — a model or provider id in params is InvalidParams.
Budgets and ledger
Per app per calendar month, tokens and/or micro-USD (default 2M tokens, 5 USD). Each call reserves before running and settles to reported usage (gateway cost, else catalog price; local costs 0). Over budget is BudgetExceeded, by hand and in jobs. Spend per app and model is shown in Settings → AI over Activity’s date ranges.
Model picker
With llm.choose, an app can offer a picker among the models the user made available. Handles are opaque per-app hashes — no provider ids leak and handles can’t be compared between apps. Local-only, pins and budgets still win.
Tools
llm@1 1.2 carries tool calls; tools@1 (Iro’s own, under tools.use) lists what the app declares, was granted and has a provider for, and runs a model’s call by tool name as the app. The app runs the loop (list → chat → call → results, ≤ 10 turns). Sensitive tools always ask, saying a model asked. Jobs can’t prompt.
Model apps
API-key gateways (Anthropic, OpenAI, OpenAI-compatible with a user-entered origin) and credential-free local Ollama (http://127.0.0.1:11434 only). Keys are typed into Iro’s page, kept in the vault, and sent only to the account’s origins. Streams are scrubbed with a held-back tail so split secrets are still caught.