fix: generate agents with platform LLM grants

agent_builder/builder.py

@@ -29,8 +29,8 @@ class BuilderContext:
     grant_token: str | None = None
     # LLM creds forwarded by the orchestrator according to this agent's Card.
     # The builder accepts caller-selected creds and falls back to platform
-    # grants; generated agents usually use caller-provided creds. Falls back
-    # to settings for local development.
+    # grants. Hosted generated agents should usually use platform grants too.
+    # Falls back to settings for local development.
     llm_base_url: str | None = None
     llm_api_key: str | None = None
     llm_model: str | None = None
@@ -47,17 +47,20 @@ user's workspace at ``agents/<name>/`` and then deploy it through the
 control plane.
 
 The default starter is the current a2a-pack DeepAgents scaffold. It declares
-``LLMProvisioning.CALLER_PROVIDED``, reads caller LLM credentials from
-``ctx.llm``, builds a ``ChatOpenAI`` model from those credentials, and wires a
-small tool-calling DeepAgent with ``create_deep_agent`` plus
-``wrap_model_call`` middleware. Do not recreate this from memory: call
-``init_agent_template`` first and modify the generated files.
+``LLMProvisioning.PLATFORM``, reads the scoped LLM grant from ``ctx.llm``,
+builds a ``ChatOpenAI`` model from those credentials, and wires a small
+tool-calling DeepAgent with ``create_deep_agent`` plus ``wrap_model_call``
+middleware. Do not recreate this from memory: call ``init_agent_template`` first
+and modify the generated files.
 
-Default generated/user agents to ``LLMProvisioning.CALLER_PROVIDED`` and
-``caller_pays_llm=True`` unless the user explicitly wants platform-paid LLM
-usage. ``LLMProvisioning.PLATFORM`` is allowed only through the A2A LiteLLM
-grant path: the generated agent must still read ``ctx.llm`` and must never read
-``A2A_LITELLM_KEY`` or any provider key directly.
+Default hosted generated/user agents to ``LLMProvisioning.PLATFORM`` and
+``caller_pays_llm=False`` so main-agent handoffs mint a scoped A2A LiteLLM grant
+for the callee. The generated agent must still read ``ctx.llm`` and must never
+read ``A2A_LITELLM_KEY``, ``OPENAI_API_KEY``, LiteLLM master keys, or provider
+keys directly. If the user explicitly asks for BYOK or caller-paid inference,
+use ``LLMProvisioning.CALLER_PROVIDED`` with ``caller_pays_llm=True`` and make
+missing ``ctx.llm.api_key`` a clear setup/config result before constructing
+``ChatOpenAI``.
 ``LLMProvisioning.PLATFORM_OR_CALLER_PROVIDED`` is reserved for trusted
 platform/meta agents that should prefer caller-selected credentials and fall
 back to a scoped platform grant; do not use it for ordinary generated agents