All tunable parameters in one validated place. Pass a config dict or load from YAML/env — never hardcode in prod.

Output contract the LLM response must satisfy.

The orchestrator. Sits between your application logic and the LLM. Composes all eight components: InputGuard → TokenBudget → PromptBui

Slot-based token allocator using tiktoken for accurate counts. Production fix over v1: char/4 heuristic replaced with the actual tokeniz

Records every attempt with its failure mode, latency, and outcome. Production fix over v1: - Thread-safe writes via lock - Persi

Stops hammering a failing LLM backend. States: CLOSED (normal) → OPEN (failing) → HALF_OPEN (testing) → CLOSED Production fix over v1:

When the primary strategy exhausts all retries, routes to a registered fallback handler. Fallbacks are called in registration order. Fir

Simulates an LLM with configurable failure behavior. Swap this for your real LLM in production: layer = ControlLayer(llm_fn=your_open

Wraps any callable LLM function with timeout enforcement. Production fix over v1: without a timeout, a hung LLM call blocks the thread f

Assembles the final prompt within a hard token budget. Reservation order (priority, highest first): 1. System prompt — fixed overhead

Validates and sanitizes user input before it reaches the prompt builder. Three checks, in order: 1. Empty / whitespace-only input.

Validates model output against a schema and rule set. Prompts ask. Validators enforce. That's the whole difference.

Retries failed LLM calls with prompt mutation targeted at the specific failure mode detected. Production fix over v1: - Uses tenac

Raised when the LLM call exceeds the configured timeout.