everything-gemini 2.2.0 → 2.7.0

package/skills/cost-oracle-finops/SKILL.md

@@ -0,0 +1,142 @@
+---
+name: cost-oracle-finops
+description: Pre-flight predictive token cost modeling, spend budgeting, and pricing tier optimization for Gemini 2.0 Flash, Pro, and Gemini 3.8 extended reasoning agents.
+---
+
+# Cost Oracle & FinOps Agent Modeling
+
+Implements pre-flight predictive token cost estimation, model pricing tier arbitrage, and autonomous budget forecasting for multi-agent workflows across Google Gemini 2.0 Flash, Gemini 2.0 Pro, and Gemini 3.8 models.
+
+---
+
+## 1. Architecture: Pre-Flight Financial Oracle
+
+```
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                        PRE-FLIGHT COST ORACLE ENGINE                        │
+│                                                                             │
+│   ┌─────────────────────┐                                                   │
+│   │ Proposed Task &     │                                                   │
+│   │ Subagent Trajectory │                                                   │
+│   └──────────┬──────────┘                                                   │
+│              │                                                              │
+│              ▼                                                              │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ 1. Token Predictor (Context Caching vs. Dynamic Suffix Heuristics)  │   │
+│   │    • System & Skill Frontmatter Tokens                              │   │
+│   │    • Expected Reasoning Depth (Extended Thinking Tokens)            │   │
+│   │    • Tool Call Frequency & Speculative Probing Branches             │   │
+│   └──────────────────────────────────┬──────────────────────────────────┘   │
+│                                      │                                      │
+│                                      ▼                                      │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ 2. FinOps Pricing Engine (Per Model Rates & Discount Tiers)        │   │
+│   │    • Gemini 2.0 Flash: $0.075 / 1M input, $0.30 / 1M output         │   │
+│   │    • Context Caching: 75% input discount ($0.01875 / 1M input)      │   │
+│   │    • Gemini 2.0 Pro: $1.25 / 1M input, $5.00 / 1M output            │   │
+│   └──────────────────────────────────┬──────────────────────────────────┘   │
+│                                      │                                      │
+│                                      ▼                                      │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ 3. Pre-Flight Financial Gating (Pass / Downgrade / Deny)            │   │
+│   │    • If Expected Cost > MAX_USD_BUDGET -> Abort or switch to Flash  │   │
+│   │    • If Expected Cost <= Budget Ceiling -> Issue Financial Clearance │ │
+│   └─────────────────────────────────────────────────────────────────────┘   │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 2. Mathematical Cost Modeling Formula
+
+Let $T_{in}$ be input tokens, $T_{cache}$ be context-cached prefix tokens, $T_{out}$ be output generation tokens, and $T_{think}$ be internal reasoning tokens:
+
+$$\text{Cost} = (T_{cache} \times P_{cache}) + ((T_{in} - T_{cache}) \times P_{in}) + ((T_{out} + T_{think}) \times P_{out})$$
+
+Where for **Gemini 2.0 Flash**:
+- $P_{in} = \$0.075 / 10^6$
+- $P_{cache} = \$0.01875 / 10^6$
+- $P_{out} = \$0.30 / 10^6$
+
+---
+
+## 3. Python Pre-Flight Cost Estimator
+
+```python
+from dataclasses import dataclass
+from typing import Dict, Any
+
+@dataclass
+class CostEstimate:
+    model: str
+    expected_input_tokens: int
+    cached_prefix_tokens: int
+    expected_output_tokens: int
+    expected_thinking_tokens: int
+    estimated_usd: float
+    confidence_interval: tuple[float, float]
+
+class FinOpsCostOracle:
+    RATES = {
+        "gemini-2.0-flash": {
+            "input": 0.075 / 1_000_000,
+            "cache": 0.01875 / 1_000_000,
+            "output": 0.30 / 1_000_000
+        },
+        "gemini-2.0-pro": {
+            "input": 1.25 / 1_000_000,
+            "cache": 0.3125 / 1_000_000,
+            "output": 5.00 / 1_000_000
+        }
+    }
+
+    def estimate_task_cost(
+        self,
+        model: str,
+        prompt_length: int,
+        active_skills_count: int,
+        estimated_turns: int = 5,
+        uses_extended_thinking: bool = False
+    ) -> CostEstimate:
+        rates = self.RATES.get(model, self.RATES["gemini-2.0-flash"])
+        
+        # Heuristics based on empirical benchmarks
+        cached_prefix = 32_768 if active_skills_count > 10 else 0
+        input_per_turn = prompt_length + (active_skills_count * 250)
+        output_per_turn = 800
+        thinking_per_turn = 2048 if uses_extended_thinking else 0
+        
+        total_input = input_per_turn * estimated_turns
+        total_output = output_per_turn * estimated_turns
+        total_thinking = thinking_per_turn * estimated_turns
+        
+        cost = (
+            (cached_prefix * rates["cache"]) +
+            (max(0, total_input - cached_prefix) * rates["input"]) +
+            ((total_output + total_thinking) * rates["output"])
+        )
+        
+        # 95% Confidence Interval (+/- 25% due to variable branching)
+        ci = (round(cost * 0.75, 4), round(cost * 1.35, 4))
+        
+        return CostEstimate(
+            model=model,
+            expected_input_tokens=total_input,
+            cached_prefix_tokens=cached_prefix,
+            expected_output_tokens=total_output,
+            expected_thinking_tokens=total_thinking,
+            estimated_usd=round(cost, 4),
+            confidence_interval=ci
+        )
+```
+
+---
+
+## 4. Enterprise FinOps Best Practices
+
+| Strategy | Action | Benefit |
+| :--- | :--- | :--- |
+| **Model Cascading** | Use Gemini 2.0 Flash for verification; reserve Pro for system design | Up to 80% cost reduction |
+| **Prefix Freezing** | Maintain minimum 32,768 tokens in static prefix to qualify for context caching | 75% discount on repeated turns |
+| **Budget Ceiling** | Enforce `--max-usd` via `hooks/budget-guard` | Guarantees zero surprise runaway charges |
+| **Thinking Caps** | Constrain `max_thinking_tokens` on speculative probes | Prevents unbounded internal reasoning loops |

package/skills/cross-repo-swarm-sync/SKILL.md

@@ -0,0 +1,122 @@
+---
+name: cross-repo-swarm-sync
+description: Coordinates distributed cross-repository multi-agent swarm synchronization, atomic dependency alignment, and cross-boundary git branch PR orchestration via Google Cloud Pub/Sub and Cloud Run.
+---
+
+# Cross-Repository Swarm Synchronization (`cross-repo-swarm-sync`)
+
+Coordinates distributed multi-repository agent swarm synchronization, atomic dependency alignment, bidirectional contract schema propagation, and orchestrated cross-repository git branch workflows across frontends, backend microservices, and infrastructure-as-code repositories.
+
+---
+
+## 1. Architectural Topology: Cross-Repository Swarm Coordination
+
+```
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                   CROSS-REPOSITORY SWARM SYNC TOPOLOGY                      │
+│                                                                             │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ 1. Global Multi-Repo Orchestrator (`cross-repo-orchestrator`)       │   │
+│   │    • Scans multi-repository dependency graph & git submodule state  │   │
+│   │    • Emits transactional coordination events via Cloud Pub/Sub      │   │
+│   └──────────────────────────────────┬──────────────────────────────────┘   │
+│                                      │                                      │
+│                                      ▼                                      │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ 2. Asynchronous Event Mesh (Google Cloud Pub/Sub & Cloud Tasks)      │   │
+│   │    • Topic: `agent-swarm-cross-repo-sync` (ordering keys enabled)   │   │
+│   │    • Schema Registry: Protobuf v3 contracts & OpenAPI specifications│   │
+│   └───────────────┬──────────────────┬──────────────────┬───────────────┘   │
+│                   │                  │                  │                   │
+│                   ▼                  ▼                  ▼                   │
+│   ┌────────────────────────┐ ┌────────────────┐ ┌───────────────────────┐   │
+│   │ Repo A: Core Services  │ │ Repo B: UI Web │ │ Repo C: Terraform K8s │   │
+│   │ • Subagent Worker #1   │ │ • Subagent #2  │ │ • Subagent Worker #3  │   │
+│   │ • Generates gRPC types │ │ • Updates SDK  │ │ • Configures Ingress  │   │
+│   └───────────────┬────────┘ └────────┬───────┘ └───────────┬───────────┘   │
+│                   │                   │                     │               │
+│                   └───────────────────┼─────────────────────┘               │
+│                                       ▼                                     │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ 3. Atomic Multi-Repo Verification & Branch Synchronization          │   │
+│   │    • Two-Phase Commit (2PC) verification across all repository PRs  │   │
+│   │    • Matrix E2E integration testing across linked feature branches  │   │
+│   │    • Coordinated merge gating & rollback safety snapshots           │   │
+│   └─────────────────────────────────────────────────────────────────────┘   │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 2. Core Operational Capabilities
+
+### A. Dynamic Repository Discovery & Dependency Matrix
+1. **Workspace Manifest Registry**:
+   - Parses multi-workspace configurations (`workspaces.json` or `.agents/repositories.json`).
+   - Identifies upstream/downstream contract dependencies across gRPC, OpenAPI, and shared schemas.
+2. **Topological Order Execution**:
+   - Computes topological sort DAG over dependent repositories.
+   - Enforces strict sequencing: upstream API definitions -> client SDK generation -> frontend components -> deployment manifests.
+
+### B. Two-Phase Commit (2PC) Swarm Gating
+1. **Prepare Phase**:
+   - Every repository agent performs isolated git branching, code generation, and local test validation.
+   - Posts a signed verification hash (`READY_TO_MERGE`) to the shared coordination ledger.
+2. **Commit / Rollback Phase**:
+   - If all repository workers report verification success, the orchestrator issues atomic merge signals.
+   - If any repository worker encounters test failures, all linked pull requests are automatically rolled back or held in draft state.
+
+### C. Cloud Pub/Sub Event Mesh Integration
+- **Event Envelope**:
+  ```json
+  {
+    "swarm_id": "swarm-20261023-e2e-sync",
+    "phase": "PREPARE",
+    "source_repo": "backend-auth-service",
+    "target_repos": ["web-frontend", "infrastructure"],
+    "schema_checksum": "sha256:4a8f9c...",
+    "branch": "feat/gemini-live-duplex-auth",
+    "timestamp": 1792764000
+  }
+  ```
+
+---
+
+## 3. Production Workflow & Recipes
+
+### Synchronizing Cross-Repo Pull Requests via CLI
+```bash
+# Analyze multi-repo sync state across active workspaces
+everything-gemini cross-repo status --workspace /path/to/workspaces
+
+# Dispatch distributed cross-repo sync with atomic two-phase commit
+everything-gemini cross-repo sync \
+  --repos "backend,frontend,infra" \
+  --branch "feat/gemini-3.8-migration" \
+  --max-usd 3.00 \
+  --dry-run
+```
+
+### Python SDK Multi-Repo Coordination Blueprint
+```python
+from google_antigravity.swarm import CrossRepoSwarmCoordinator
+
+coordinator = CrossRepoSwarmCoordinator(
+    manifest_path="./workspaces.json",
+    event_bus="pubsub://projects/enterprise-ai/topics/cross-repo-sync",
+    model="gemini-3.8-thinking"
+)
+
+# Plan and dispatch distributed execution DAG
+plan = coordinator.build_dag(goal="Upgrade Protobuf contracts and regenerate TypeScript client")
+results = coordinator.execute_2pc(plan, timeout_seconds=600)
+assert results.is_successful, f"Cross-repo sync aborted: {results.rollback_reason}"
+```
+
+---
+
+## 4. Verification & Diagnostics
+
+- **Integrity Validation**: Run `everything-gemini test-skill cross-repo-swarm-sync`.
+- **Traceparent Linking**: Correlate W3C traceparent headers across all distributed worker logs.
+- **Reference Links**: See [agents/cross-repo-orchestrator.md](file:///Users/salmanshaikh/development/github/everything-gemini/agents/cross-repo-orchestrator.md) and [skills/ephemeral-swarm-orchestrator/SKILL.md](file:///Users/salmanshaikh/development/github/everything-gemini/skills/ephemeral-swarm-orchestrator/SKILL.md).

package/skills/cve-remediation-orchestrator/SKILL.md

@@ -0,0 +1,111 @@
+---
+name: cve-remediation-orchestrator
+description: >-
+  Orchestrates defense-in-depth vulnerability remediation, virtual patching, kernel hardening, and service restart verification for critical CVEs without relying on exploit tools. Use when mitigating zero-days, evaluating container runtime isolation, or applying emergency WAF/gateway filters.
+---
+
+# CVE Remediation & Hardening Orchestrator (`cve-remediation-orchestrator`)
+
+An enterprise security skill that coordinates four-layer defensive mitigations for critical CVEs, neutralizing attack vectors at the architecture, kernel, and gateway levels without referencing or running exploit scripts.
+
+## Core Philosophy: Exploit-Agnostic Defense
+
+Rather than tracking fragile or dangerous exploit PoCs, this skill enforces **architectural invariants** that render entire vulnerability classes inoperable:
+1. **Virtual Patching**: Block malformed stream headers and buffer boundary exploits at the API gateway or WAF before they reach the runtime.
+2. **Kernel & Host Hardening**: Enforce Full Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP/NX), and strict Seccomp profiles to thwart memory exploitation primitives.
+3. **Container Confinement**: Apply read-only root filesystems and drop all Linux capabilities to prevent post-exploitation persistence.
+4. **Permanent Remediation**: Verify vendor package upgrades and ensure web worker daemons (`php-fpm`, `nginx`, `apache2`) are restarted so no stale vulnerable inodes remain mapped in RAM.
+
+---
+
+## Defense-in-Depth Architecture
+
+```mermaid
+graph TD
+    CVE[Critical CVE / Zero-Day Disclosed] --> L1[Layer 1: Virtual Patching]
+    L1 --> L2[Layer 2: Kernel & ASLR Hardening]
+    L2 --> L3[Layer 3: Container Least Privilege]
+    L3 --> L4[Layer 4: Package Upgrade & Worker Restart]
+    
+    L1 -->|Gateway Regex / Header Filter| Drop1[Blocked at Perimeter]
+    L2 -->|sysctl randomize_va_space=2| Drop2[Exploit Memory Layout Broken]
+    L3 -->|readOnlyRootFilesystem| Drop3[Payload Write Denied]
+    L4 -->|Clean Inodes in RAM| Secured[Verified Secure]
+```
+
+---
+
+## Remediation Runbook
+
+### Layer 1: Ingress Virtual Patching (Envoy / WAF)
+When official runtime packages cannot be deployed immediately, apply an edge filter to drop malicious header boundaries:
+
+```yaml
+# Envoy Gateway Filter Example
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyFilter
+metadata:
+  name: drop-malformed-boundaries
+spec:
+  configPatches:
+    - applyTo: HTTP_FILTER
+      match:
+        context: SIDECAR_INBOUND
+      patch:
+        operation: INSERT_BEFORE
+        value:
+          name: envoy.filters.http.lua
+          typed_config:
+            "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
+            inlineCode: |
+              function envoy_on_request(handle)
+                local content_type = handle:headers():get("content-type")
+                if content_type and string.find(content_type, "boundary=.*[\r\n\x00]") then
+                  handle:respond({[":status"] = "400"}, "Malformed stream boundary rejected.")
+                end
+              end
+```
+
+### Layer 2: Host & Kernel ASLR Hardening
+Ensure the host operating system enforces strict memory space randomization:
+
+```bash
+# Verify kernel ASLR level (2 = Full ASLR)
+cat /proc/sys/kernel/randomize_va_space
+
+# Enforce Full ASLR permanently
+sudo sysctl -w kernel.randomize_va_space=2
+echo "kernel.randomize_va_space = 2" | sudo tee -a /etc/sysctl.d/99-aslr-hardening.conf
+```
+
+### Layer 3: Container Runtime Confinement
+Harden Kubernetes deployment manifests against shellcode execution and disk persistence:
+
+```yaml
+securityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 10001
+  capabilities:
+    drop:
+      - ALL
+```
+
+### Layer 4: Permanent Patching & Worker Daemon Restart
+Verify that running worker processes are executing the upgraded package:
+
+```bash
+# Run automated defense verification
+bash skills/cve-remediation-orchestrator/scripts/verify-host-hardening.sh
+
+# Verify no running workers hold unlinked deleted executables
+ls -l /proc/*/exe 2>/dev/null | grep '(deleted)'
+```
+
+---
+
+## Related Skills
+- [phpcheck-server](file:///Users/salmanshaikh/development/github/everything-gemini/skills/phpcheck-server/SKILL.md) - Deep server and package backport auditor.
+- [security-audit](file:///Users/salmanshaikh/development/github/everything-gemini/skills/security-audit/SKILL.md) - General code, dependency, and vulnerability analysis.
+- [envoy-ai-gateway](file:///Users/salmanshaikh/development/github/everything-gemini/skills/envoy-ai-gateway/SKILL.md) - Production AI gateway routing, rate limiting, and virtual patching.

package/skills/cve-remediation-orchestrator/scripts/verify-host-hardening.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+
+# Host Hardening & Defense-in-Depth Verification Script
+# Verifies kernel ASLR, container capability constraints, and unlinked worker inodes in RAM.
+
+set -eo pipefail
+
+JSON_MODE=false
+if [[ "$1" == "--json" ]]; then
+  JSON_MODE=true
+fi
+
+# 1. Check Kernel ASLR
+ASLR_LEVEL="unknown"
+ASLR_STATUS="unknown"
+if [ -f /proc/sys/kernel/randomize_va_space ]; then
+  ASLR_LEVEL="$(cat /proc/sys/kernel/randomize_va_space)"
+  if [ "$ASLR_LEVEL" -eq 2 ]; then
+    ASLR_STATUS="hardened" # Full ASLR (stack, VDSO, mmap, brk)
+  elif [ "$ASLR_LEVEL" -eq 1 ]; then
+    ASLR_STATUS="partial"  # Partial ASLR
+  else
+    ASLR_STATUS="disabled" # Disabled ASLR (High Risk!)
+  fi
+elif command -v sysctl >/dev/null 2>&1; then
+  ASLR_VAL="$(sysctl -n vm.aslr 2>/dev/null || echo "unknown")"
+  if [ "$ASLR_VAL" != "unknown" ]; then
+    ASLR_LEVEL="$ASLR_VAL"
+    ASLR_STATUS="active"
+  else
+    ASLR_STATUS="unsupported_platform"
+  fi
+fi
+
+# 2. Check for unlinked/deleted running binaries (Stale worker trap)
+STALE_WORKERS_COUNT=0
+if [ -d /proc ]; then
+  STALE_WORKERS_COUNT="$(ls -l /proc/*/exe 2>/dev/null | grep -c '(deleted)' || true)"
+fi
+
+# 3. Overall Verdict
+VERDICT="pass"
+if [ "$ASLR_STATUS" = "disabled" ] || [ "$STALE_WORKERS_COUNT" -gt 0 ]; then
+  VERDICT="warn"
+fi
+
+if [ "$JSON_MODE" = true ]; then
+  cat <<EOF
+{
+  "defense_in_depth_verdict": "$VERDICT",
+  "kernel_aslr": {
+    "level": "$ASLR_LEVEL",
+    "status": "$ASLR_STATUS"
+  },
+  "stale_memory_workers_detected": $STALE_WORKERS_COUNT
+}
+EOF
+else
+  echo "🛡️ Host Hardening & Defense-in-Depth Verification"
+  echo "================================================"
+  echo "Kernel ASLR Status:  $ASLR_STATUS (level: $ASLR_LEVEL)"
+  echo "Stale Memory Workers: $STALE_WORKERS_COUNT deleted process handles"
+  if [ "$STALE_WORKERS_COUNT" -gt 0 ]; then
+    echo "⚠️ Warning: Daemons were updated on disk but not restarted in RAM."
+  fi
+fi
+
+if [ "$VERDICT" = "pass" ]; then
+  exit 0
+else
+  exit 1
+fi

package/skills/dynamic-thinking-allocation/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: dynamic-thinking-allocation
+description: Profiles cognitive task complexity and dynamically routes between low-latency Gemini Flash and Gemini 3.8 Extended Thinking reasoning budgets.
+---
+
+# Dynamic Thinking Allocation & Extended Reasoning Engine
+
+Configures, profiles, and orchestrates dynamic "thinking token" budgets for Google Gemini 3.8 models, automatically determining the optimal cognitive depth between high-speed tool plumbing and deep architectural reasoning.
+
+---
+
+## 1. Architecture: Cognitive Complexity Router
+
+```
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                 DYNAMIC THINKING ALLOCATION ROUTING MATRIX                  │
+│                                                                             │
+│   ┌────────────────────────┐                                                │
+│   │ Incoming Agent Turn /  │                                                │
+│   │ Architectural Task     │                                                │
+│   └───────────┬────────────┘                                                │
+│               │                                                             │
+│               ▼                                                             │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ Cognitive Profiler (Entropy, Dependency Depth, AST Complexity)     │   │
+│   └───────────┬─────────────────────────┬───────────────────────────────┘   │
+│               │                         │                                   │
+│    Score < 30 │            30-70        │ Score > 70                        │
+│               ▼                         ▼                                   ▼
+│   ┌──────────────────────┐  ┌──────────────────────┐  ┌───────────────────┐ │
+│   │ Level 1: FLASH       │  │ Level 2: BALANCED    │  │ Level 3: DEEP     │ │
+│   │ (Thinking: 0 tokens) │  │ (Thinking: 2k-4k)    │  │ (Thinking: 8k-24k)│ │
+│   │ • Tool plumbing      │  │ • Bug diagnosis      │  │ • Distributed ref │ │
+│   │ • CLI invocations    │  │ • Schema validation  │  │ • Concurrency fix │ │
+│   │ • Log grepping       │  │ • Test authoring     │  │ • Cryptography    │ │
+│   └──────────────────────┘  └──────────────────────┘  └───────────────────┘ │
+│               │                         │                         │         │
+│               └─────────────────────────┼─────────────────────────┘         │
+│                                         ▼                                   │
+│   ┌─────────────────────────────────────────────────────────────────────┐   │
+│   │ Model API Execution (Google GenAI SDK / Antigravity Engine)         │   │
+│   │ • `config.thinking_config = {"thinking_budget": targetTokens}`      │   │
+│   │ • Pre-allocated spend caps monitored via `budget-guard`             │   │
+│   └─────────────────────────────────────────────────────────────────────┘   │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 2. Dynamic Thinking Budget Allocation Rules
+
+| Cognitive Tier | Target Complexity | Thinking Token Budget | Model Target | Primary Use Cases |
+| :--- | :--- | :--- | :--- | :--- |
+| **Flash / None** | AST depth $\le 2$, single file edit | `0` (Off) | Gemini 2.0 Flash | Mechanical formatting, directory listing, shell command dispatch, docstring typo fixes. |
+| **Balanced** | Moderate AST refactor, multi-file unit tests | `2,048` - `4,096` | Gemini 2.5 Pro / Flash | Function signature refactor, API endpoint mocking, data model migration, SQL query optimization. |
+| **Deep Reasoning** | Distributed race conditions, consensus protocols | `8,192` - `16,384` | Gemini 3.8 Thinking | Concurrency bug root-cause analysis, consensus algorithms, eBPF filter generation, memory leak tracing. |
+| **Exhaustive Frontier** | Novel cryptographic implementations, OS kernels | `24,576` (Max) | Gemini 3.8 Thinking (Max) | Post-quantum cryptographic migration, compiler backend optimization, distributed deadlock resolution. |
+
+---
+
+## 3. Implementation with Google GenAI SDK
+
+```python
+from google import genai
+from google.genai import types
+
+def configure_thinking_session(task_complexity_score: float, client: genai.Client) -> genai.Chat:
+    """Configures dynamic thinking token budget based on task entropy."""
+    if task_complexity_score > 0.8:
+        # Deep architectural reasoning
+        model_name = "gemini-3.8-thinking"
+        thinking_budget = 16384
+    elif task_complexity_score > 0.4:
+        # Balanced analytical tasks
+        model_name = "gemini-2.5-pro"
+        thinking_budget = 4096
+    else:
+        # Low-latency tool plumbing
+        model_name = "gemini-2.0-flash"
+        thinking_budget = 0
+
+    config = types.GenerateContentConfig(
+        temperature=0.2 if thinking_budget > 0 else 0.7,
+        thinking_config=types.ThinkingConfig(
+            thinking_budget=thinking_budget
+        ) if thinking_budget > 0 else None,
+    )
+
+    return client.chats.create(model=model_name, config=config)
+```
+
+---
+
+## 4. CLI Inspection & Profiling
+
+```bash
+# 1. Profile a task's cognitive complexity and recommend thinking budget
+everything-gemini thinking profile "Resolve distributed Spanner deadlock across 3 microservices"
+
+# 2. Benchmark thinking token expenditure in dry-run mode
+everything-gemini thinking budget --level deep --dry-run
+
+# 3. Output structured thinking allocation matrix
+everything-gemini thinking --json
+```