everything-gemini 2.2.0 → 2.5.0

package/skills/opentelemetry-agent-observability/SKILL.md

@@ -0,0 +1,139 @@
+---
+name: opentelemetry-agent-observability
+description: Implements OpenTelemetry GenAI semantic conventions, distributed multi-agent W3C trace propagation, tool call span attributes, and Google Cloud Trace export for autonomous agent workflows.
+---
+
+# OpenTelemetry Agent Observability (GenAI Semantic Conventions & Distributed Tracing)
+
+Instruments autonomous multi-agent pipelines with OpenTelemetry (v1.30+), adhering strictly to OpenTelemetry GenAI Semantic Conventions (`gen_ai.system`, `gen_ai.request.model`, `gen_ai.usage.input_tokens`, `gen_ai.usage.output_tokens`). Propagates W3C `traceparent` headers across subagent handoffs, captures internal thinking token events, and exports traces to Google Cloud Trace and Jaeger.
+
+---
+
+## 1. Multi-Agent Distributed Tracing Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                       OPENTELEMETRY TRACE TOPOLOGY                          │
+│                                                                             │
+│   Planner Span (trace_id: 4bf92f3577b34da6a3ce929d0e0e4736)                 │
+│   ├── gen_ai.system: "gemini"                                               │
+│   ├── gen_ai.request.model: "gemini-3.8-thinking"                          │
+│   │                                                                         │
+│   ├── Subagent Handoff (W3C traceparent injected into message payload)       │
+│   │   └── Swarm Coordinator Span                                            │
+│   │       ├── Worker-1 Tool Execution Span (eBPF Sandboxed)                 │
+│   │       └── Worker-2 Tool Execution Span (eBPF Sandboxed)                 │
+│   │                                                                         │
+│   └── Cloud Trace Exporter (OTLP gRPC -> Google Cloud Trace)                │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 2. Python OpenTelemetry GenAI Instrumentor
+
+```python
+import os
+from contextlib import contextmanager
+from opentelemetry import trace
+from opentelemetry.sdk.trace import TracerProvider
+from opentelemetry.sdk.trace.export import BatchSpanProcessor
+from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter
+from opentelemetry.trace.propagation.tracecontext import TraceContextTextMapPropagator
+from opentelemetry.trace import Status, StatusCode
+
+# Initialize TracerProvider and OTLP Exporter
+provider = TracerProvider()
+otlp_exporter = OTLPSpanExporter(
+    endpoint=os.getenv("OTEL_EXPORTER_OTLP_ENDPOINT", "localhost:4317"),
+    insecure=True
+)
+provider.add_span_processor(BatchSpanProcessor(otlp_exporter))
+trace.set_tracer_provider(provider)
+tracer = trace.get_tracer("everything-gemini.runtime", "2.5.0")
+propagator = TraceContextTextMapPropagator()
+
+class AgentTelemetryContext:
+    @staticmethod
+    @contextmanager
+    def start_llm_span(agent_name: str, model_name: str, operation_name: str = "chat"):
+        """Starts a span compliant with OpenTelemetry GenAI Semantic Conventions."""
+        with tracer.start_as_current_span(
+            f"gen_ai.{operation_name} {agent_name}",
+            kind=trace.SpanKind.INTERNAL
+        ) as span:
+            span.set_attribute("gen_ai.system", "gemini")
+            span.set_attribute("gen_ai.request.model", model_name)
+            span.set_attribute("gen_ai.agent.name", agent_name)
+            span.set_attribute("gen_ai.operation.name", operation_name)
+            try:
+                yield span
+            except Exception as exc:
+                span.record_exception(exc)
+                span.set_status(Status(StatusCode.ERROR, str(exc)))
+                raise
+
+    @staticmethod
+    def record_usage(span: trace.Span, prompt_tokens: int, completion_tokens: int, thinking_tokens: int = 0):
+        """Records standardized GenAI token metrics and thinking tokens."""
+        span.set_attribute("gen_ai.usage.input_tokens", prompt_tokens)
+        span.set_attribute("gen_ai.usage.output_tokens", completion_tokens)
+        span.set_attribute("gen_ai.usage.total_tokens", prompt_tokens + completion_tokens)
+        if thinking_tokens > 0:
+            span.set_attribute("gen_ai.usage.thinking_tokens", thinking_tokens)
+            span.add_event("thinking_budget_allocated", {"tokens": thinking_tokens})
+
+    @staticmethod
+    def inject_carrier() -> dict:
+        """Injects W3C traceparent into a dictionary for cross-agent RPC or Pub/Sub."""
+        carrier = {}
+        propagator.inject(carrier)
+        return carrier
+
+    @staticmethod
+    def extract_context(carrier: dict):
+        """Extracts remote trace context from carrier dictionary."""
+        return propagator.extract(carrier)
+```
+
+---
+
+## 3. Subagent Handoff Trace Propagation Example
+
+When delegating tasks across scoped subagents (e.g. `planner` to `swarm-coordinator`), inject W3C headers to preserve single continuous traces:
+
+```python
+# In Planner subagent:
+with AgentTelemetryContext.start_llm_span("planner", "gemini-3.8-pro") as span:
+    carrier = AgentTelemetryContext.inject_carrier()
+    # Payload sent to swarm-coordinator includes trace context
+    dispatch_payload = {
+        "task": "refactor_auth_module",
+        "trace_context": carrier
+    }
+    AgentTelemetryContext.record_usage(span, prompt_tokens=1200, completion_tokens=340)
+
+# In Swarm Coordinator:
+ctx = AgentTelemetryContext.extract_context(dispatch_payload["trace_context"])
+with tracer.start_as_current_span("swarm_coordinator.execute", context=ctx) as sub_span:
+    sub_span.set_attribute("swarm.workers.count", 4)
+    # Child spans automatically link to the parent Planner span
+```
+
+---
+
+## 4. Google Cloud Trace Integration via Terraform
+
+```hcl
+resource "google_project_iam_member" "agent_trace_agent" {
+  project = var.gcp_project_id
+  role    = "roles/cloudtrace.agent"
+  member  = "serviceAccount:${google_service_account.agent_runtime.email}"
+}
+```
+
+Export telemetry with standard environment variables:
+```bash
+export OTEL_EXPORTER_OTLP_ENDPOINT="https://cloudtrace.googleapis.com"
+export OTEL_RESOURCE_ATTRIBUTES="service.name=everything-gemini,service.version=2.5.0"
+```

package/skills/quantum-safe-cryptography/SKILL.md

@@ -0,0 +1,84 @@
+---
+name: quantum-safe-cryptography
+description: Implements NIST FIPS 203/204 Post-Quantum Cryptography (PQC) algorithms, hybrid TLS 1.3 key exchange, and quantum-resistant API authentication.
+---
+
+# Quantum-Safe Cryptography & Post-Quantum Cryptography (PQC)
+
+Implements NIST Post-Quantum Cryptography standards (FIPS 203 ML-KEM / Kyber, FIPS 204 ML-DSA / Dilithium), hybrid classical-quantum TLS 1.3 key exchanges, and quantum-resistant authentication token signing for enterprise Gemini agent communications.
+
+---
+
+## 1. Architecture: Post-Quantum Security for AI Agents
+
+```
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                   HYBRID POST-QUANTUM SECURITY PIPELINE                     │
+│                                                                             │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ 1. Agent Handshake & Mutual Authentication (mTLS 1.3)               │   │
+│   │    • Classical: X25519 or ECDH (P-256)                              │   │
+│   │    • Post-Quantum: ML-KEM-768 (Module-Lattice KEM / Kyber)          │   │
+│   │    • Combined Shared Secret = KDF(Classical_SS || PQC_SS)           │   │
+│   └──────────────────────────────────┬──────────────────────────────────┘   │
+│                                      │                                      │
+│                                      ▼                                      │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ 2. Quantum-Resistant Agent Token Signing (ML-DSA / Dilithium)       │   │
+│   │    • Ephemeral agent delegation tokens signed via FIPS 204          │   │
+│   │    • Immune to Shor's algorithm and "Harvest Now, Decrypt Later"    │   │
+│   └──────────────────────────────────┬──────────────────────────────────┘   │
+│                                      │                                      │
+│                                      ▼                                      │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ 3. Cloud KMS & Google Cloud Hybrid Integration                      │   │
+│   │    • Google Cloud Certificate Authority Service (CAS) PQC roots     │   │
+│   │    • Vertex AI / Cloud Run encrypted ingress via X25519Kyber768     │   │
+│   └─────────────────────────────────────────────────────────────────────┘   │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 2. NIST Standardized PQC Specifications
+
+| Standard | Algorithm Name | Purpose | Classical Equivalent | Key/Sig Sizes |
+| :--- | :--- | :--- | :--- | :--- |
+| **FIPS 203** | **ML-KEM-768** (Kyber) | Key Encapsulation (KEM) | RSA 3072 / ECDH P-256 | Public Key: 1,184 B, Ciphertext: 1,088 B |
+| **FIPS 204** | **ML-DSA-65** (Dilithium) | Digital Signatures | ECDSA P-256 / Ed25519 | Public Key: 1,952 B, Signature: 3,309 B |
+| **FIPS 205** | **SLH-DSA-128s** (SPHINCS+) | Stateless Hash-Based Signatures | Fallback Digital Signatures | Public Key: 32 B, Signature: 7,856 B |
+
+---
+
+## 3. Node.js & Web Cryptography Implementation
+
+```javascript
+import crypto from 'node:crypto';
+
+// Verify runtime supports hybrid post-quantum cipher suites
+export function getQuantumSafeCipherConfiguration() {
+  const ciphers = crypto.getCiphers();
+  const curves = crypto.getCurves ? crypto.getCurves() : [];
+  
+  const supportsKyber = curves.includes('X25519Kyber768Draft00') || curves.includes('x25519_kyber768');
+  
+  return {
+    tlsVersion: 'TLSv1.3',
+    ecdhCurve: supportsKyber ? 'X25519Kyber768Draft00:P-256' : 'auto',
+    signatureAlgorithms: [
+      'mldsa65',
+      'ecdsa_secp256r1_sha256',
+      'ed25519'
+    ],
+    pqcReady: supportsKyber
+  };
+}
+```
+
+---
+
+## 4. Agent Migration Checklist
+
+1. **Inventory Cryptographic Assets**: Audit all RSA 2048/4096 and ECDSA keys used for subagent authentication and webhook signing.
+2. **Deploy Hybrid Key Exchange First**: Enable `X25519Kyber768` on all reverse proxies, load balancers, and Cloud Run agent endpoints. This protects against *Harvest Now, Decrypt Later* (HNDL) attacks with zero downtime.
+3. **Upgrade Token Signatures**: Migrate internal agent JWTs to ML-DSA signatures with fallback validation for legacy clients.

package/skills/spanner-change-streams/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: spanner-change-streams
+description: Implements Google Cloud Spanner Change Streams for real-time transaction log Change Data Capture, Pub/Sub integration, and event-driven database synchronization.
+---
+
+# Google Cloud Spanner Change Streams (Real-Time CDC)
+
+Designs, provisions, and processes transaction-level Change Data Capture (CDC) events using Google Cloud Spanner Change Streams. Enables event-driven microservices, real-time cache invalidation, and continuous replication to BigQuery and Pub/Sub.
+
+---
+
+## 1. Architecture: Spanner Change Streams & Data Mesh
+
+```
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                         SPANNER CHANGE STREAM PIPELINE                      │
+│                                                                             │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ Google Cloud Spanner Database                                       │   │
+│   │ (Transactions committing to primary tables)                         │   │
+│   └──────────────────────────────────┬──────────────────────────────────┘   │
+│                                      │                                      │
+│                                      ▼                                      │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ Spanner Change Stream (CREATE CHANGE STREAM)                        │   │
+│   │ Captures INSERT, UPDATE, DELETE with externalized commit timestamps │   │
+│   └──────────────────────────────────┬──────────────────────────────────┘   │
+│                                      │                                      │
+│                                      ▼                                      │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ Dataflow CDC Consumer / Cloud Functions (Java / Python)             │   │
+│   └──────────────────┬────────────────────────────┬─────────────────────┘   │
+│                      │                            │                         │
+│                      ▼ Real-time Invalidation     ▼ Continuous Analytics    │
+│   ┌─────────────────────────────┐      ┌─────────────────────────────┐      │
+│   │ Redis / Valkey Cache        │      │ BigQuery Real-Time Replica  │      │
+│   │ (Sub-second Invalidation)   │      │ (Streaming Buffer Table)    │      │
+│   └─────────────────────────────┘      └─────────────────────────────┘      │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 2. Spanner DDL (`CREATE CHANGE STREAM`)
+
+Provision a change stream watching specific tables and columns with retention policies:
+
+```sql
+-- 1. Create Change Stream tracking Accounts and Orders tables
+CREATE CHANGE STREAM AgentAuditChangeStream
+FOR Services, Dependencies
+OPTIONS (
+  retention_period = '36h',
+  value_capture_type = 'OLD_AND_NEW_VALUES'
+);
+```
+
+- **`retention_period`**: Retains change stream data for up to 7 days (default is 24 hours).
+- **`value_capture_type`**: `OLD_AND_NEW_VALUES` captures before-and-after states, essential for audit logs and rollback verification.
+
+---
+
+## 3. Dataflow Pipeline Template Deployment (`gcloud`)
+
+Stream Spanner mutations directly into Google Cloud Pub/Sub:
+
+```bash
+gcloud dataflow flex-template run spanner-to-pubsub-cdc \
+  --template-file-gcs-location="gs://dataflow-templates/latest/flex/Spanner_Change_Streams_to_PubSub" \
+  --region="us-central1" \
+  --parameters \
+    spannerInstanceId="production-instance",\
+    spannerDatabase="architecture-db",\
+    spannerMetadataInstanceId="production-instance",\
+    spannerMetadataDatabase="cdc-metadata",\
+    spannerChangeStreamName="AgentAuditChangeStream",\
+    pubsubTopic="projects/my_project/topics/spanner-cdc-events"
+```
+
+---
+
+## 4. Change Stream Processing Best Practices
+
+| Strategy | Recommendation | Anti-Pattern |
+| :--- | :--- | :--- |
+| **Metadata Database** | Maintain a dedicated Spanner metadata database for Dataflow partition tracking | Storing metadata in the production database increasing transaction contention |
+| **Retention Window** | Set retention to at least 36 hours (`36h`) to survive Dataflow upgrades | 1-hour retention risking permanent data loss during pipeline restarts |
+| **Payload Optimization** | Only track critical tables instead of `FOR ALL` database objects | Capturing ephemeral log tables overwhelming streaming workers |

package/skills/vertex-ai-feature-store/SKILL.md

@@ -0,0 +1,110 @@
+---
+name: vertex-ai-feature-store
+description: Provisions and queries Google Cloud Vertex AI Feature Store, point-in-time correct historical joins, low-latency online serving, and Gemini embedding feature tables.
+---
+
+# Vertex AI Feature Store & Embeddings Serving
+
+Architects, provisions, and serves machine learning features and vector representations using Google Cloud Vertex AI Feature Store. Covers BigQuery-backed offline storage, point-in-time joins, low-latency online feature serving, and real-time agent memory retrieval.
+
+---
+
+## 1. Architecture: Vertex AI Feature Store
+
+```
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                         VERTEX AI FEATURE STORE                             │
+│                                                                             │
+│   ┌─────────────────────┐                   ┌───────────────────────────┐   │
+│   │ BigQuery Lakehouse  │                   │ Streaming Ingestion       │   │
+│   │ (Offline Gold Data) │                   │ (Pub/Sub + Dataflow)      │   │
+│   └──────────┬──────────┘                   └─────────────┬─────────────┘   │
+│              │                                            │                 │
+│              ▼                                            ▼                 │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ Feature Registry & View Definitions (BigQuery-backed Feature Store) │   │
+│   │ • Entity: user_id, repo_id, session_id                              │   │
+│   │ • Embeddings: text_embedding_004 (768-dim)                          │   │
+│   └──────────────────┬────────────────────────────┬─────────────────────┘   │
+│                      │                            │                         │
+│                      ▼ Offline                    ▼ Online (<10ms)          │
+│   ┌─────────────────────────────┐      ┌─────────────────────────────┐      │
+│   │ Point-in-Time Correct       │      │ Optimized Online Serving    │      │
+│   │ Historical Training Joins   │      │ (Bigtable / Cache Engine)   │      │
+│   └─────────────────────────────┘      └─────────────────────────────┘      │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 2. Infrastructure Provisioning (`gcloud`)
+
+Set up a Feature Online Store optimized for sub-10ms feature retrieval:
+
+```bash
+# 1. Create Feature Online Store with optimized serving
+gcloud vertex-ai feature-online-stores create agent-memory-store \
+  --location=us-central1 \
+  --dedicated-serving-nodes-min=1 \
+  --dedicated-serving-nodes-max=5
+
+# 2. Create Feature View backed by BigQuery table
+gcloud vertex-ai feature-views create user-profile-features \
+  --feature-online-store=agent-memory-store \
+  --location=us-central1 \
+  --bigquery-table=projects/my_project/datasets/features/tables/user_profiles \
+  --entity-id-columns=user_id \
+  --cron-schedule="0 */4 * * *"
+```
+
+---
+
+## 3. Real-Time Online Feature Retrieval (Python SDK)
+
+Query real-time feature vectors inside an agent execution turn:
+
+```python
+from google.cloud import aiplatform_v1beta1 as vertex_ai
+
+client = vertex_ai.FeatureOnlineStoreServiceClient()
+
+def fetch_agent_session_features(user_id: str) -> dict:
+    """Fetches real-time developer context and historical preference vectors."""
+    feature_view_path = client.feature_view_path(
+        project="my_project",
+        location="us-central1",
+        feature_online_store="agent-memory-store",
+        feature_view="user-profile-features"
+    )
+    
+    response = client.fetch_feature_values(
+        request=vertex_ai.FetchFeatureValuesRequest(
+            feature_view=feature_view_path,
+            data_key=vertex_ai.FeatureViewDataKey(key=user_id)
+        )
+    )
+    
+    return {
+        field.name: field.value
+        for field in response.key_values.features
+    }
+```
+
+---
+
+## 4. Point-in-Time Correct Offline Joins
+
+Avoid data leakage in offline agent evaluation benchmarks:
+
+```sql
+SELECT
+  observations.task_id,
+  observations.timestamp,
+  features.seniority_level,
+  features.preferred_framework,
+  features.embedding_vector
+FROM `my_project.evals.agent_runs` AS observations
+POINT_IN_TIME JOIN `my_project.features.user_profiles` AS features
+  ON observations.user_id = features.user_id
+  AND observations.timestamp >= features.feature_timestamp;
+```

package/skills/webrtc-agent-gateway/SKILL.md

@@ -0,0 +1,199 @@
+---
+name: webrtc-agent-gateway
+description: Architect and deploy ultra-low latency WebRTC audio duplex gateways, Opus audio transcoding, STUN/TURN ICE candidate negotiation, and real-time voice streaming for Gemini Live pair programming.
+---
+
+# WebRTC Agent Gateway (Ultra-Low Latency Duplex Voice Streaming)
+
+Architects, secures, and deploys production-grade WebRTC media gateways that bridge browser/IDE client media streams directly into the Google Gemini Live API. Implements bidirectional Opus/PCM audio transcoding, interactive data channels, STUN/TURN NAT traversal, and jitter-buffer optimization for sub-200ms voice pair-programming.
+
+---
+
+## 1. WebRTC Duplex Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                       WEBRTC MEDIA GATEWAY TOPOLOGY                         │
+│                                                                             │
+│   ┌─────────────────────┐      WebRTC PeerConnection     ┌────────────────┐ │
+│   │ Developer Browser   │◄──────────────────────────────►│ WebRTC Gateway │ │
+│   │ / Antigravity IDE   │   SRTP / Opus Audio Tracks     │ (aiortc / Go)  │ │
+│   └─────────────────────┘   SCTP DataChannel (Events)    └───────┬────────┘ │
+│              │                                                   │          │
+│              │ SDP Offer / Answer (HTTPS / WSS)                  │          │
+│              ▼                                                   ▼          │
+│   ┌─────────────────────┐                            ┌────────────────────┐ │
+│   │ Coturn STUN / TURN  │                            │ Google Gemini Live │ │
+│   │ NAT Traversal Relay │                            │ WebSocket Endpoint │ │
+│   └─────────────────────┘                            └────────────────────┘ │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 2. Python aiortc WebRTC Gateway Implementation
+
+Below is a production-grade WebRTC audio bridge receiving developer microphone tracks, transcoding Opus to PCM 16kHz for Gemini Live, and streaming back synthesized agent speech:
+
+```python
+import asyncio
+import json
+import fractions
+import time
+from aiortc import RTCPeerConnection, RTCSessionDescription, MediaStreamTrack
+from aiortc.contrib.media import MediaBlackhole
+from av import AudioResampler, AudioFrame
+from google import genai
+from google.genai import types
+
+class GeminiLiveAudioTrack(MediaStreamTrack):
+    """Generates outgoing WebRTC audio frames from Gemini Live synthesized speech."""
+    kind = "audio"
+
+    def __init__(self):
+        super().__init__()
+        self.queue = asyncio.Queue()
+        self._sample_rate = 48000
+        self._samples_per_frame = 960  # 20ms at 48kHz
+        self._pts = 0
+
+    def push_pcm_bytes(self, pcm_data: bytes):
+        """Pushes raw 24kHz/16kHz PCM audio bytes from Gemini into the WebRTC audio queue."""
+        self.queue.put_nowait(pcm_data)
+
+    async def recv(self):
+        pcm_chunk = await self.queue.get()
+        frame = AudioFrame(format="s16", layout="mono", samples=self._samples_per_frame)
+        frame.planes[0].update(pcm_chunk[:frame.linesizes[0]])
+        frame.sample_rate = self._sample_rate
+        frame.time_base = fractions.Fraction(1, self._sample_rate)
+        frame.pts = self._pts
+        self._pts += self._samples_per_frame
+        return frame
+
+class WebRTCAgentGateway:
+    def __init__(self, gemini_api_key: str):
+        self.client = genai.Client(api_key=gemini_api_key)
+        self.pcs = set()
+
+    async def handle_offer(self, sdp_offer: str, sdp_type: str = "offer") -> dict:
+        pc = RTCPeerConnection()
+        self.pcs.add(pc)
+
+        outgoing_audio = GeminiLiveAudioTrack()
+        pc.addTrack(outgoing_audio)
+
+        @pc.on("track")
+        def on_track(track):
+            if track.kind == "audio":
+                asyncio.create_task(self._relay_to_gemini(track, outgoing_audio))
+
+        @pc.on("connectionstatechange")
+        async def on_connectionstatechange():
+            if pc.connectionState in ["failed", "closed"]:
+                await pc.close()
+                self.pcs.discard(pc)
+
+        offer = RTCSessionDescription(sdp=sdp_offer, type=sdp_type)
+        await pc.setRemoteDescription(offer)
+        answer = await pc.createAnswer()
+        await pc.setLocalDescription(answer)
+
+        return {"sdp": pc.localDescription.sdp, "type": pc.localDescription.type}
+
+    async def _relay_to_gemini(self, track: MediaStreamTrack, outgoing_audio: GeminiLiveAudioTrack):
+        resampler = AudioResampler(format="s16", layout="mono", rate=16000)
+        async with self.client.aio.live.connect(
+            model="gemini-2.0-flash-exp",
+            config=types.LiveConnectConfig(
+                response_modalities=[types.LiveModality.AUDIO],
+                speech_config=types.SpeechConfig(
+                    voice_config=types.VoiceConfig(
+                        prebuilt_voice_config=types.PrebuiltVoiceConfig(voice_name="Aoede")
+                    )
+                )
+            )
+        ) as session:
+            # Task to read synthesized audio from Gemini and queue to WebRTC
+            async def receive_from_gemini():
+                async for response in session.receive():
+                    server_content = response.server_content
+                    if server_content and server_content.model_turn:
+                        for part in server_content.model_turn.parts:
+                            if part.inline_data:
+                                outgoing_audio.push_pcm_bytes(part.inline_data.data)
+
+            receiver_task = asyncio.create_task(receive_from_gemini())
+
+            try:
+                while True:
+                    frame = await track.recv()
+                    resampled = resampler.resample(frame)
+                    for r_frame in resampled:
+                        pcm_bytes = r_frame.planes[0].to_bytes()
+                        await session.send(input={"data": pcm_bytes, "mime_type": "audio/pcm;rate=16000"})
+            except asyncio.CancelledError:
+                receiver_task.cancel()
+```
+
+---
+
+## 3. Client WebRTC SDP Exchange & ICE Configuration
+
+```typescript
+export async function initializeVoiceSession(gatewayUrl: string): Promise<RTCPeerConnection> {
+  const pc = new RTCPeerConnection({
+    iceServers: [
+      { urls: 'stun:stun.l.google.com:19302' },
+      {
+        urls: 'turn:turn.enterprise-antigravity.internal:3478',
+        username: 'agent-dev',
+        credential: 'ephemeral-turn-token'
+      }
+    ]
+  });
+
+  // Capture developer microphone stream
+  const micStream = await navigator.mediaDevices.getUserMedia({
+    audio: {
+      channelCount: 1,
+      sampleRate: 48000,
+      echoCancellation: true,
+      noiseSuppression: true,
+      autoGainControl: true
+    }
+  });
+
+  micStream.getAudioTracks().forEach(track => pc.addTrack(track, micStream));
+
+  // Audio track speaker output
+  pc.ontrack = (event) => {
+    if (event.track.kind === 'audio') {
+      const audioEl = new Audio();
+      audioEl.srcObject = event.streams[0];
+      audioEl.play().catch(console.error);
+    }
+  };
+
+  const offer = await pc.createOffer();
+  await pc.setLocalDescription(offer);
+
+  const response = await fetch(`${gatewayUrl}/api/webrtc/offer`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ sdp: offer.sdp, type: offer.type })
+  });
+
+  const answer = await response.json();
+  await pc.setRemoteDescription(new RTCSessionDescription(answer));
+  return pc;
+}
+```
+
+---
+
+## 4. Operational Best Practices & SLA Targets
+
+1. **Jitter-Buffer Tuning**: Target 40ms to 80ms playout delay. Avoid buffer bloating which degrades conversational turn-taking.
+2. **STUN/TURN High Availability**: Deploy Coturn behind Network Load Balancers (NLB) across at least 2 GCP availability zones.
+3. **Graceful Teardown**: Intercept `connectionstatechange` to immediately close Gemini WebSocket sessions on client hangup.