feat: let builder use caller or platform llm

agent_builder/builder.py

@@ -28,8 +28,9 @@ class BuilderContext:
     workspace: Any | None = None
     grant_token: str | None = None
     # LLM creds forwarded by the orchestrator according to this agent's Card.
-    # The builder itself uses platform grants; generated agents usually use
-    # caller-provided creds. Falls back to settings for local development.
+    # The builder accepts caller-selected creds and falls back to platform
+    # grants; generated agents usually use caller-provided creds. Falls back
+    # to settings for local development.
     llm_base_url: str | None = None
     llm_api_key: str | None = None
     llm_model: str | None = None
@@ -57,6 +58,10 @@ Default generated/user agents to ``LLMProvisioning.CALLER_PROVIDED`` and
 usage. ``LLMProvisioning.PLATFORM`` is allowed only through the A2A LiteLLM
 grant path: the generated agent must still read ``ctx.llm`` and must never read
 ``A2A_LITELLM_KEY`` or any provider key directly.
+``LLMProvisioning.PLATFORM_OR_CALLER_PROVIDED`` is reserved for trusted
+platform/meta agents that should prefer caller-selected credentials and fall
+back to a scoped platform grant; do not use it for ordinary generated agents
+unless the user explicitly asks for that mixed billing mode.
 
 You have packaged DeepAgents skills loaded from ``/.agent-builder/skills/``.
 Use ``deepagent-agent-design`` before designing generated agent internals,

agent_builder/skills/a2apack-agent-authoring/SKILL.md

@@ -24,8 +24,10 @@ Use `A2AAgent` class attributes for runtime and marketplace behavior:
 For generated/user-owned agents that call an LLM, default to
 `LLMProvisioning.CALLER_PROVIDED` with `Pricing(..., caller_pays_llm=True, ...)`.
 Use `LLMProvisioning.PLATFORM` only when the user explicitly wants
-platform-paid LLM usage. In either mode, read `ctx.llm`; never read
-`A2A_LITELLM_KEY`, provider keys, or platform secrets directly.
+platform-paid LLM usage. Reserve `LLMProvisioning.PLATFORM_OR_CALLER_PROVIDED`
+for trusted platform/meta agents that must work with either the caller's
+selected creds or a platform fallback grant. In every mode, read `ctx.llm`;
+never read `A2A_LITELLM_KEY`, provider keys, or platform secrets directly.
 
 Keep each `@skill` method `async`, put `RunContext[...]` immediately after
 `self`, and annotate every public argument. Do not use `*args` or `**kwargs`;

agent_builder/skills/agent-quality-review/SKILL.md

@@ -31,7 +31,8 @@ Check these items:
 - The public schema is small and stable. No unbounded command strings, hidden
   prompt fragments, or provider credentials as public inputs.
 - The implementation reads `ctx.llm` for both `CALLER_PROVIDED` and
-  `PLATFORM` LLM provisioning.
+  `PLATFORM` LLM provisioning. `PLATFORM_OR_CALLER_PROVIDED` is acceptable
+  only for trusted platform/meta agents and must also read `ctx.llm`.
 - Generated/user agents should default to
   `llm_provisioning = LLMProvisioning.CALLER_PROVIDED` and
   `Pricing(..., caller_pays_llm=True, ...)`. If the user explicitly wants

agent_builder/tools.py

@@ -28,7 +28,7 @@ if TYPE_CHECKING:
     from .config import Settings
 
 
-A2A_PACK_MIN_VERSION = "0.1.27"
+A2A_PACK_MIN_VERSION = "0.1.28"
 
 
 @dataclass(frozen=True)