spec/llm: openai-chat packages don't need the sandbox

[HereLiesAz]

spec/llm.md § Setup said that a host unable to provide the named sandbox MUST NOT install the package. Every llm package names github-actions, so a strict reading barred even endpoint packages that a host reaches directly over openai-chat. That protocol needs neither setup nor the sandbox (§ Protocols), and the reference chatLlm doesn't use them either.

The new wording:

• A host without the sandbox MUST NOT run setup or use github-actions-runner.
• It MAY install a package that declares openai-chat and use it over that protocol alone.
• It MUST NOT install a runner-only package, which includes every sandbox-weights package.
• A host still MUST NOT run script on the device.

docs/specs/llm.md was regenerated with docs/scripts/sync-specs.mjs. The sync also rewrote docs/specs/repository-api.md, a drift already on main, which I left out of this change. The changeset is empty because this is spec-only.

Found while wiring kind: "llm" into Guillotine (HereLiesAz/Guillotine#358, HereLiesAz/Guillotine#359).

🤖 Generated with Claude Code

https://claude.ai/code/session_019p6LTRthBQLE6CfynKmSZr

---

Generated by Claude Code

Summary by Sourcery

Allow sandbox-free hosts to install and use OpenAI Chat LLM endpoints while preserving restrictions on runner-only packages and device-side scripts.

Enhancements:

• Clarify LLM package installation rules so hosts without the GitHub Actions sandbox can use packages through the openai-chat protocol while prohibiting setup, runner-only packages, and on-device scripts.

Documentation:

• Update the LLM specification and its generated documentation with the revised sandbox and openai-chat requirements.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
azphalt	Error		Sep 27, 2026 11:16pm UTC

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the LLM specification so hosts without the named sandbox may install and use endpoint packages over openai-chat alone, while setup, github-actions-runner, runner-only packages, and on-device scripts remain restricted; the generated documentation mirror and a spec changeset are included.

Flow diagram for LLM package installation and execution permissions

flowchart TD
    Host[Host without github-actions sandbox] --> Package{Package declares openai-chat?}
    Package -->|Yes| Install[Install package]
    Install --> Protocol[Use package over openai-chat]
    Package -->|No| RunnerOnly[Runner-only package]
    RunnerOnly --> Reject[Do not install]
    Host --> Setup[Run setup or github-actions-runner]
    Setup --> Deny[Not permitted]
    Host --> Script[Run script on device]
    Script --> Deny

Loading

File-Level Changes

Change	Details	Files
Clarify sandbox requirements to distinguish protocol-only OpenAI Chat packages from runner-dependent packages.	Allow installation and direct use of packages exposing openai-chat without a local sandbox, setup, or github-actions-runner. Continue prohibiting installation of runner-only packages, including all sandbox-weights packages. Retain the prohibition against running setup scripts on the user's device.	spec/llm.md docs/specs/llm.md
Add a changeset documenting the updated installation and sandbox behavior.	Record the exception for openai-chat packages and the requirement for runner-only packages to have the sandbox.	.changeset/llm-openai-chat-without-sandbox.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[HereLiesAz]

None of the red checks on this PR comes from its change. The PR only edits spec Markdown.

• Vercel: it fails the same way on main at 8efebe0, the merge of Remove @azphalt/registry-store-vercel; fix changesets naming a non-workspace package #238 that removed the Vercel store. The Vercel project is still connected to the repo, but its build target is gone. It needs to be disconnected (or its root directory repointed) in Vercel's project settings. No fix exists in the repo.
• Workers Builds: azphalt: the preview build fails on every recent PR branch (Docs: the domains are on the azphalt Worker (merging deploys it) #231, Add kind: "llm" and publish first-party llm packages #232, Worker: POST /updates and Play subscriptions #236, Remove @azphalt/registry-store-vercel; fix changesets naming a non-workspace package #238), while the production build on main passes (8efebe0). The branch-preview configuration in Cloudflare is broken, and the build logs are only visible in the Cloudflare dashboard. I can't re-run it from here.
• github-advanced-security: this is GitHub's Copilot security job, and it failed in its own "Processing Request (Linux)" agent step, not on a finding. It failed the same way on Remove @azphalt/registry-store-vercel; fix changesets naming a non-workspace package #238's head (999de67).
• validate_node / validate_python / validate_gradle / validate_docker / validate_flutter: each one ran twice on this head. The shared HereLiesAz/workflows catalog cancelled one of the two runs ("validate_node: cancelled"). The other run passed all five.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Failed ❌ View logs ↗		8d974b0	2026-09-27T23:17:14.835Z	View logs ↗

[HereLiesAz]

OpenCode security review

⚠️ Review unavailable. Neither model answered; see the shared workflow run. This is not a finding about the pull request.

[sourcery-ai]

Sorry @HereLiesAz, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 20 hours and 4 minutes by commenting @sourcery-ai review. Upgrade to get a review now.