workspai 0.76.0 → 0.78.0

package/docs/agent-framework-adapters.md

@@ -27,6 +27,10 @@ complete cross-platform matrix is reviewed into that inventory. Public
 commands fail closed rather than silently substituting Microsoft, OpenAI, or
 another runtime.
 
+OpenRouter Client SDK access belongs to the [AI Gateway](./model-gateways.md)
+category. Do not add OpenRouter under Agent Frameworks, and do not use
+`@openrouter/agent` to implement a gateway kit.
+
 ## Published contracts
 
 | Contract                                                                       | Purpose                                                                                  |
@@ -234,15 +238,63 @@ remains blocked until the exact v2 cross-platform candidate is promoted.
 Handoffs, MCP, sessions, voice, sandbox, and approval loops stay unsupported.
 Microsoft adapters remain `preview`.
 
-A path-filtered PR gate compiles only the affected Microsoft or OpenAI adapter
-family on Linux. Shared lifecycle, security, registry, admission, and contract
-changes select both families; documentation-only edits do not run adapter
-conformance. The complete twelve-lane matrix is an explicit release-
-qualification operation: it compiles Microsoft Python/.NET and OpenAI
-Python/TypeScript on Linux, macOS, and Windows. Every full-qualification lane
+## Google Agent Development Kit baseline
+
+Google ADK is an agent runtime and orchestration framework. It is not an AI
+Gateway, not OpenRouter, and not a Gemini/Vertex model-provider product.
+Provider profiles in the generated starter are `gemini-api` (Gemini Developer
+API) and `vertex-ai`. OpenRouter stays in the separate Gateway category.
+
+Python `google-adk` and TypeScript `@google/adk` are independent runtimes.
+Exact pins live in `src/agent-frameworks/version-baselines.v1.json`. Discovery
+must re-prove registry and GitHub agreement on the day it runs; TypeScript 2.0
+graph Workflow Runtime is not generalized to Python.
+
+| Adapter                 | Runtime           | Authored detection            |
+| ----------------------- | ----------------- | ----------------------------- |
+| `google-adk-python`     | Python `>=3.10`   | exact PyPI package `google-adk` |
+| `google-adk-typescript` | Node.js `>=20.19` | exact npm package `@google/adk` |
+
+The TypeScript starter also pins `zod`, TypeScript, and `@types/node` from the
+same baseline document. `@google/adk-devtools` is not a v1 dependency. Do not
+run unqualified `npx adk`.
+
+Adapters are labeled `preview`. Create kits are `agent.google-adk.python` and
+`agent.google-adk.typescript`. The reviewed v2 inventory admits both exact
+baselines from Linux, macOS, and Windows evidence, so Create and Attach are
+enabled. The generic admission boundary still refuses any unpublished or
+drifted kit before `--dry-run` and before filesystem or workspace mutation.
+Streaming emits `event.partial` fragments as
+display deltas. The SDK-recognized final response is retained as canonical text
+and is not re-emitted after streamed fragments. Intermediate metadata does not
+close the fragment window; tool-call and function-response events do. Telemetry
+stays off unless `WORKSPAI_AGENT_TRACING=1` is set from process startup;
+otherwise the starter sets `OTEL_SDK_DISABLED=true` before importing ADK. That
+env var is process-global, so the generated starter is an isolated CLI process
+and must not be imported into a host that still needs OpenTelemetry.
+Credentialless conformance observes a non-recording span in a process without
+opt-in and a recording span in a separate opted-in process with a test
+TracerProvider. Context loaders live
+in `src/agent-frameworks/context-loaders/` and are shared by Google, OpenAI, and
+Microsoft adapters. Sequential, parallel, loop, graph workflow, A2A, MCP, Agent Engine,
+Cloud Run, GKE, Google Search, voice, browser agents, and remote agents are
+unsupported. In-memory sessions are process-local, not durable persistence.
+
+Credentialless conformance subclasses the public `BaseLlm` surface. It does not
+monkey-patch private SDK internals and does not call Gemini or Vertex.
+
+A path-filtered PR gate compiles only the affected Microsoft, OpenAI, or Google
+adapter family on Linux. Shared lifecycle, security, registry, admission,
+Create/Doctor integration, and contract changes select the affected families;
+documentation-only edits do not run adapter conformance. The complete matrix is
+an explicit release-qualification operation: it compiles every built-in adapter runtime on Linux,
+macOS, and Windows. Every full-qualification lane
 records all 18 mandatory checks, the exact runtime and framework baseline,
 digests of the adapter manifest and semantic implementation, and one bounded
-evidence file per check. Reports are retained as CI artifacts for review. A
+evidence file per check. Google ADK `verification-binding` evidence records
+`streamingPartialSemantics`, `streamingMetadataInterleaving`,
+`streamingToolBoundary`, `telemetryDefaultNonRecording`, and
+`telemetryOptInRecording` as distinct booleans. Reports are retained as CI artifacts for review. A
 final job validates every evidence path and emits an admission candidate only
 when all three operating-system lanes pass for every built-in adapter.
 Python conformance is pinned to 3.10.11, the final Python 3.10 release with
@@ -287,10 +339,11 @@ npx workspai agent framework plan \
   --name support-agent
 ```
 
-When more than one admitted framework shares a runtime, pass `--framework`
+When more than one published framework shares a runtime, pass `--framework`
 explicitly. Workspai does not guess or fall back. `--runtime python` without
-`--framework` now requires an explicit choice because Microsoft Agent Framework
-and OpenAI Agents SDK are both admitted.
+`--framework` requires an explicit choice because Microsoft Agent Framework,
+OpenAI Agents SDK, and Google ADK are all published and release-admitted at
+their exact reviewed baselines.
 
 The interactive attach command displays the same plan and asks before granting
 its filesystem effect. Automation must opt in with `--yes` and records the
@@ -397,12 +450,12 @@ and unadvertised runtimes fail closed.
 
 The generic boundary was hardened against two deliberately different
 integration shapes: a filesystem-first Node.js framework and the
-multi-language Microsoft Agent Framework. OpenAI Agents SDK Python and
-TypeScript adapters now share that same create, attach, detection, ownership,
-and verification host. They are selectable for Create and Attach only after
-their exact manifest digest, framework baseline, runtime, and platform list
-enter the reviewed release-admission inventory. Microsoft adapters remain
-selectable while their current inventory entries stay valid.
+multi-language Microsoft Agent Framework. OpenAI Agents SDK and Google ADK
+Python and TypeScript adapters share that same create, attach, detection,
+ownership, and verification host. They are selectable for Create and Attach
+only while their exact manifest digest, framework baseline, runtime, and
+platform list remain in the reviewed release-admission inventory. Microsoft
+adapters remain selectable while their current inventory entries stay valid.
 
 ## Implementation sequence
 
@@ -411,8 +464,9 @@ selectable while their current inventory entries stay valid.
 2. Use the framework-neutral registry, detector, and bounded manifest loader.
 3. Review the Microsoft Python and .NET digest-bound evidence produced by the
    full conformance matrix.
-4. Review the OpenAI Python and TypeScript digest-bound evidence produced by
-   the same matrix; do not treat local Linux success as multi-OS admission.
+4. Review the OpenAI and Google Python and TypeScript digest-bound evidence
+   produced by the same matrix; do not treat local Linux success as multi-OS
+   admission.
 5. Keep automated upstream discovery separate from release authority: report
    newer registry versions, then update pins only through a reviewed change.
    Re-run the full matrix before treating a new pin as independently proven.

package/docs/ci-workflows.md

@@ -13,6 +13,8 @@ Map of GitHub Actions workflows in this repository. Use this when editing CI to
 | Official generator smoke  | `.github/workflows/frontend-generator-smoke.yml`          | Contract-driven official-generator drift gate                                             |
 | Agent Framework matrix    | `.github/workflows/agent-framework-conformance.yml`       | Affected-family Linux PR gate plus manual twelve-lane release qualification and admission |
 | Agent Framework discovery | `.github/workflows/agent-framework-version-discovery.yml` | Weekly PyPI/NuGet candidate report; no commit, PR, or contract rewrite                    |
+| Model Gateway matrix      | `.github/workflows/model-gateway-qualification.yml`       | Three-OS generated-project and lifecycle qualification; manual fast mode stays on Linux |
+| Model Gateway discovery   | `.github/workflows/model-gateway-version-discovery.yml`   | Weekly npm/PyPI/GitHub candidate report; no baseline write, commit, or PR                 |
 | Security                  | `.github/workflows/security.yml`                          | Path-aware scanning plus the always-resolved `Security Gate`                              |
 | Manual npm release        | `.github/workflows/release-npm-manual.yml`                | Maintainer-only release gate and publish workflow                                         |
 | Discord announcement      | `.github/workflows/discord-release-announcement.yml`      | Preview and publish one idempotent product-aware release announcement                     |
@@ -27,17 +29,26 @@ a report and artifact. It does not commit, open a pull request, regenerate
 Create contracts, or write `release-admissions.v2.json`. A human pin update
 still has to pass the manual `full` mode of `agent-framework-conformance` on
 Linux, macOS, and Windows for every built-in adapter runtime. Pull requests run
-the faster Linux gate only for the affected Microsoft or OpenAI family; shared
-agent-framework surfaces select both, while documentation-only changes skip the
-specialized workflow. The full matrix compiles the nested `agents/primary`
+the faster Linux gate only for the affected Microsoft, OpenAI, or Google family;
+shared agent-framework surfaces select the affected families, while documentation-only
+changes skip the specialized workflow. The full matrix compiles the nested `agents/primary`
 runtime, runs credentialless context-boundary tests, and records manifest-bound
 admission data plus semantic implementation provenance. Promotion requires the
 candidate source commit to equal the checked-out promotion commit. An
 implementation digest is audit evidence, not a runtime lock and not a manual
 maintenance requirement after every routine adapter edit.
-It never sets Foundry or OpenAI credentials. Only a reviewed admission on the protected
+It never sets Foundry, OpenAI, Gemini, or Vertex credentials. Only a reviewed admission on the protected
 version-update branch can promote a green candidate.
 
+OpenRouter AI Gateway kits are not part of the Agent Framework conformance
+matrix. They use a dedicated qualification workflow for generated-project
+install, tests, smoke, missing-key startup, Workspace Run, and Workspace
+Verify. Path-triggered runs and manual `full` mode qualify both adapters on
+Linux, macOS, and Windows. Manual `fast` mode is the only single-OS path.
+Weekly discovery reports newer stable sdk-core versions, with registry and
+GitHub agreement shown as a candidate diff. It does not write the baseline or
+open a pull request. See [AI Gateway](./model-gateways.md).
+
 The PR template at `.github/agent-framework-version-update.md` is for that
 human pin update. It is not opened by the weekly discovery workflow.
 
@@ -102,7 +113,10 @@ cross-platform qualification is needed. npm and Composer download caches reduce
 repeated network work without treating an earlier commit or calendar-day result
 as proof for a new SHA.
 
-The Windows coverage lane intentionally uses bounded Vitest worker concurrency
+Linux is the only matrix job that collects V8 coverage, and that report is
+text plus `coverage-final.json`. macOS and Windows run the same suite without
+coverage instrumentation and without a second `tsup`, because the job build
+already produced `dist`. The Windows test lane intentionally uses bounded Vitest worker concurrency
 and platform-aware transaction timeouts. Filesystem-heavy workspace tests must
 finish their transaction before teardown; cleanup retries transient Windows
 `EBUSY`, `ENOTEMPTY`, and `EPERM` states instead of converting one slow operation into a
@@ -125,7 +139,7 @@ Validate or preview the current CLI announcement locally:
 npm --workspace workspai run check:release-announcement
 npm --workspace workspai run release:announcement -- \
   --product workspai-cli \
-  --tag v0.76.0 \
+  --tag v0.78.0 \
   --markdown-output /tmp/workspai-discord-announcement.md
 ```
 

package/docs/commands-reference.md

@@ -82,6 +82,8 @@ npx workspai change capsule validate --change <change-id> [--workspace <path>] [
 npx workspai change capsule export --change <change-id> --output <path> [--workspace <path>] [--json]
 npx workspai create project agent.microsoft.python <name> [--agent-name <name>] [--skip-git]
 npx workspai create project agent.microsoft.dotnet <name> [--agent-name <name>] [--skip-git]
+npx workspai create project gateway.openrouter.typescript <name> [--skip-git] [--json]
+npx workspai create project gateway.openrouter.python <name> [--skip-git] [--json]
 npx workspai agent bootstrap [--project <path>] [--for-agent <host>] [--no-live-inputs] [--strict] [--json]
 npx workspai agent framework list [--json]
 npx workspai agent framework plan --project <name> --runtime <python|dotnet|node> [--framework <id>] --name <agent> [--goal <goal-id>] [--workspace <path>] [--json]
@@ -278,7 +280,9 @@ See [Canonical-first agent entry](./agent-entry.md).
 agent runtime. `list` exposes every built-in adapter and its release-admission
 state. In this CLI version Microsoft Python `1.18.0` and .NET `1.21.0` remain
 `preview`. OpenAI Agents SDK Python `0.22.2` and TypeScript `0.18.0` are
-labeled `stable`. Create and Attach require the reviewed v2 release inventory,
+labeled `stable`. Google ADK Python `2.9.2` and TypeScript `2.1.0` remain
+labeled `preview` and are admitted for Create and Attach by their complete
+Linux, macOS, and Windows evidence. Create and Attach require the reviewed v2 release inventory,
 whose manifest, framework baseline, runtime, and platform claims were promoted
 from the Linux, macOS, and Windows release matrix. Semantic implementation
 digests remain audit provenance rather than runtime authorization. `plan`
@@ -293,7 +297,8 @@ agent.microsoft.python|dotnet` uses the same admitted lifecycle for a new
 project: it registers the project, plans against a Model baseline, writes the
 nested runtime, then re-observes Model/Graph before it claims Intelligence is
 sealed. `create project agent.openai.python|typescript` uses the same admitted
-lifecycle. Dependency installation, credentials, generated-code execution, and
+lifecycle. `create project agent.google-adk.python|typescript` uses the same
+admitted lifecycle. Dependency installation, credentials, generated-code execution, and
 model provider calls are never implied by that approval. `apply` is the
 automation counterpart for a plan that was separately authorized with
 `change authorize`. Any adapter, version, manifest, runtime, or platform drift

package/docs/create-planner-capabilities.md

@@ -22,6 +22,7 @@ Native create is reserved for Workspai-owned kits with deterministic contracts:
 - Spring Boot
 - ASP.NET Core Web API
 - Rust / Axum
+- OpenRouter AI Gateway (TypeScript and Python)
 
 These kits can be exposed through `workspai create project` because Workspai can
 create the project and immediately produce the expected `.workspai` metadata,

package/docs/creating-workspaces-and-projects.md

@@ -16,9 +16,9 @@ For a compact list of command syntax, see
 A **workspace** is the shared home for related projects, rules, and saved
 Workspai reports.
 
-A **project** is an application, service, or governed agent, such as a FastAPI
-API, Go service, Spring Boot service, .NET API, frontend application, or
-Microsoft Agent Framework entrypoint.
+A **project** is an application, service, governed agent, or model gateway, such as a FastAPI
+API, Go service, Spring Boot service, .NET API, frontend application,
+Microsoft Agent Framework entrypoint, or OpenRouter AI Gateway.
 
 The canonical commands are:
 
@@ -42,6 +42,7 @@ does not have exactly the same behavior.
 | Turn the current folder into a workspace before creating        | `npx workspai create project gofiber.standard api --create-workspace --yes` |
 | Create a project without workspace management                   | `npx workspai create project gofiber.standard api --no-workspace --yes`     |
 | Create a governed Microsoft Agent Framework project             | `npx workspai create project agent.microsoft.python support-agent`          |
+| Create a server-owned OpenRouter AI Gateway                     | `npx workspai create project gateway.openrouter.typescript model-gateway`   |
 | Preview a supported create plan                                 | `npx workspai create project frontend.nextjs web --dry-run`                 |
 
 # Creating a workspace
@@ -396,6 +397,8 @@ project metadata and performs the selected workspace registration.
 | `agent.microsoft.dotnet` | .NET    | `Microsoft.Agents.AI` `1.21.0`, Foundry `1.21.0-preview.260911.1` | Isolated `agents/<instance>/` with the executable project plus a dedicated test project |
 | `agent.openai.python` | Python | `openai-agents` `0.22.2` | Isolated `agents/<instance>/` with pip-editable `pyproject.toml`, credentialless `unittest`, and `.env.example` |
 | `agent.openai.typescript` | Node.js | `@openai/agents` `0.18.0`, `zod` `4.6.5` | Isolated `agents/<instance>/` with `package.json`, credentialless `node:test`, and `.env.example` |
+| `agent.google-adk.python` | Python | `google-adk` `2.9.2` | Isolated `agents/<instance>/` with pip-editable `pyproject.toml`, credentialless `unittest`, and provider profiles `gemini-api` / `vertex-ai`. Preview and release-admitted. |
+| `agent.google-adk.typescript` | Node.js | `@google/adk` `2.1.0`, `zod` `4.6.5` | Isolated `agents/<instance>/` with `package.json`, credentialless `node:test`, and provider profiles `gemini-api` / `vertex-ai`. Preview, release-admitted, and independent from the Python runtime. |
 
 Interactive `workspai create` shows these kits under **AI Agent** after
 reviewed release admission. Agent kits require Workspace governance and therefore do not
@@ -418,6 +421,21 @@ npx workspai change verify --change <change-id> --json
 independent proof for this scaffold. See
 [Agent Framework Adapter Contract](./agent-framework-adapters.md).
 
+## AI Gateway kits
+
+| Kit | Runtime | Tested baseline | Layout |
+| --- | --- | --- | --- |
+| `gateway.openrouter.typescript` | Node.js | `@openrouter/sdk` `1.3.11`, TypeScript `5.9.3`, `@types/node` `22.20.3` | Server-owned OpenRouter Client SDK starter with `gateway.policy.json`, credentialless `node:test`, and `.env.example` |
+| `gateway.openrouter.python` | Python | `openrouter` `1.2.11` | Server-owned OpenRouter Client SDK starter with `gateway.policy.json`, credentialless `unittest`, and `.env.example` |
+
+Interactive `workspai create` shows these kits under **AI Gateway** with the
+hint **Unified model access and routing**. A model identifier is runtime
+configuration, not a kit. Create does not install dependencies, call a model,
+or store credentials. Attach is not supported for Gateway in this release.
+The official Go Client SDK remains beta (`v0.8.11` on
+2026-09-21) and is not admitted. See
+[AI Gateway](./model-gateways.md).
+
 ## Desktop, extension, and additional backend generators
 
 | Category  | Project           | Kit                | Creation owner                        |
@@ -428,10 +446,11 @@ independent proof for this scaffold. See
 | Desktop   | Electron Forge    | `desktop.electron` | create-electron-app                   |
 | Extension | VS Code Extension | `extension.vscode` | generator-code                        |
 
-Every generated project receives a canonical `kind` and `category`. The five
-user-facing creation categories are `backend`, `frontend`, `desktop`, `agent`, and `extension`;
-they remain visible in the Workspace Model and Knowledge Graph so consumers do
-not have to guess a project’s role from its runtime.
+Every generated project receives a canonical `kind` and `category`. The
+user-facing creation categories are `backend`, `frontend`, `desktop`, `agent`,
+`gateway`, and `extension`; they remain visible in the Workspace Model and
+Knowledge Graph so consumers do not have to guess a project’s role from its
+runtime.
 
 Official generators may download packages and therefore need network access.
 Each available integration requests the upstream latest stable channel rather

package/docs/doctor-command.md

@@ -775,12 +775,17 @@ These fields are designed for release gates and extension timeline cards that mu
 - Supports Workspai, legacy RapidKit, and non-Workspai projects when project metadata is missing.
 - Evidence: `.workspai/reports/doctor-project-last-run.json`.
 - `--fix`, `--plan`, and `--apply` apply only project-scoped fixes.
-- Governed Microsoft Agent Framework and OpenAI Agents SDK projects keep
-  `kind` as `agent`. Microsoft retains `microsoft-agent-framework`; OpenAI
-  retains `openai-agents`. Doctor discovers nested environment examples and
+- Governed Microsoft Agent Framework, OpenAI Agents SDK, and Google ADK
+  projects keep `kind` as `agent`. Microsoft retains
+  `microsoft-agent-framework`; OpenAI retains `openai-agents`; Google ADK
+  retains `google-adk`. Doctor discovers nested environment examples and
+  dependency manifests under `agents/primary` and aims Python/`uv`, Node
   dependency manifests under `agents/primary` and aims Python/`uv`, Node
   `npm --prefix`, or .NET repair commands at that runtime, not at a phantom
   project-root manifest.
+- OpenRouter AI Gateway projects keep `kind` as `gateway` and `framework` as
+  `openrouter`. Doctor uses the project-root Node or Python runtime, not the
+  Agent Framework nested layout.
 
 ## Project JSON fields (AI/automation)
 

package/docs/model-gateways.md

@@ -0,0 +1,204 @@
+# AI Gateway
+
+AI Gateway is a first-class Workspai project category for unified model access
+and routing. It is not an Agent Framework.
+
+## Why Gateway is not Agent Framework
+
+Agent Framework owns agent loops, tools, handoffs, state, and orchestration.
+AI Gateway owns model and provider access, routing preferences, fallbacks,
+privacy policy, and normalized transport behavior.
+
+A model identifier is runtime configuration, not a project kit. Workspai owns
+project generation, governance, context, lifecycle, verification, workspace
+integration, and proof. OpenRouter owns provider and model routing. Generated
+projects do not reimplement OpenRouter's routing algorithms.
+
+Future agent-to-gateway composition should consume the generated Model Gateway
+port. Do not copy these templates into an Agent Framework kit.
+
+## Current kits
+
+These kits ship as source-ready. That is not Workspai release admission and
+does not label them `stable` or `qualified`. SDK `1.x` stability is an upstream
+classification, not a Workspai release gate.
+
+| Kit | Runtime | Official Client SDK | Reviewed |
+| --- | --- | --- | --- |
+| `gateway.openrouter.typescript` | Node.js `>=20` | `@openrouter/sdk` `1.3.11` | 2026-09-21 |
+| `gateway.openrouter.python` | Python `>=3.10` | `openrouter` `1.2.11` | 2026-09-21 |
+
+Aliases: `openrouter.typescript`, `gateway.openrouter.ts`, `openrouter-typescript`,
+and the matching Python aliases. Bare `openrouter` is not an alias.
+
+Interactive Create shows **AI Gateway** with the hint **Unified model access
+and routing** after at least one gateway kit is registered. Labels are:
+
+- `AI Gateway · OpenRouter · TypeScript`
+- `AI Gateway · OpenRouter · Python`
+
+```bash
+npx workspai create project gateway.openrouter.typescript <name>
+npx workspai create project gateway.openrouter.python <name>
+```
+
+Create does not install dependencies, call a model, or write credentials.
+
+Attach is not supported for AI Gateway in this release. Do not use
+`agent framework attach` or any gateway-specific attach command. Adopt an
+existing OpenRouter project only by creating a new gateway kit or by adding
+the generated starter beside user-owned code. Repeated Create is not Attach.
+
+## Version upgrades
+
+Exact SDK pins live only in
+[`version-baselines.v1.json`](../src/model-gateways/version-baselines.v1.json).
+`releaseChannel: stable` means the upstream SDK release is stable. It does not
+mean the Workspai adapter passed Linux, macOS, and Windows qualification.
+
+The supported upgrade path is read-only until a human reviews the proposal:
+
+```text
+discover → propose → review → qualify → merge
+```
+
+```bash
+npm --workspace workspai run propose:model-gateway:versions -- \
+  --baseline src/model-gateways/version-baselines.v1.json \
+  --report test-results/model-gateway-version-discovery.json
+```
+
+The command does not commit, push, open a pull request, or write the baseline
+unless `--write` is passed after the on-disk file matches the validated
+in-memory document and every candidate agrees across registry and GitHub.
+A normal SDK upgrade should not require editing generator source when the
+upstream contract is compatible. Three-OS qualification must be green on the
+same commit before a Workspai release can present these kits as qualified.
+
+## Intentionally unsupported languages
+
+The official Go SDK (`github.com/OpenRouterTeam/go-sdk`) was evaluated on
+2026-09-21. The upstream README classifies the current `0.x` line as beta and
+warns that breaking changes may ship in minor releases. proxy.golang.org
+reported `v0.8.11`. Go is excluded from the stable Create surface until
+upstream classifies a release line as stable.
+
+The OpenRouter Agent SDK (`@openrouter/agent`) belongs to the agent-runtime
+dimension. It is not used by AI Gateway kits and is not added as
+`agent.openrouter.typescript` in this family.
+
+## Configuration
+
+Required environment:
+
+- `OPENROUTER_API_KEY` — server-side only
+- `OPENROUTER_MODEL` — chosen by the operator; Workspai does not default a
+  billable model
+
+Optional attribution maps to the official SDK fields:
+
+- TypeScript: `httpReferer`, `appTitle` via `OPENROUTER_HTTP_REFERER` and
+  `OPENROUTER_APP_TITLE`
+- Python: `http_referer`, `x_open_router_title` via `OPENROUTER_HTTP_REFERER`
+  and `OPENROUTER_X_OPEN_ROUTER_TITLE`
+
+Routing and privacy policy live in source-controlled `gateway.policy.json`.
+Field names match the pinned SDK for that language. Unknown fields are rejected
+fail-closed in both languages. Supported controls:
+
+| Official field | TypeScript policy | Python policy | Validation |
+| --- | --- | --- | --- |
+| model fallbacks | `models` | `models` | unique non-empty strings; must not repeat `OPENROUTER_MODEL` |
+| `allowFallbacks` | `allowFallbacks` | `allow_fallbacks` | boolean when present |
+| `order` / `only` / `ignore` | same camelCase | same snake_case | unique non-empty strings; `only`∩`ignore` empty; `order` must not include ignored providers |
+| `sort` | string or `{ by, partition }` | string or `{ by, partition }` | `price`/`throughput`/`latency`/`exacto`; `partition` is `model` or `none` |
+| `quantizations` | camelCase list | snake_case list | pinned SDK enum values |
+| `requireParameters` | `requireParameters` | `require_parameters` | boolean when present |
+| `zdr` | `zdr` | `zdr` | boolean; cannot combine with `dataCollection`/`data_collection` `allow` |
+| `dataCollection` | `dataCollection` | `data_collection` | `allow` or `deny` |
+| `enforceDistillableText` | `enforceDistillableText` | `enforce_distillable_text` | boolean when present; both pinned SDKs expose this field |
+| `maxPrice` | `maxPrice` | `max_price` | object with `prompt`/`completion`/`request`/`image`/`audio` as non-negative numeric strings that remain finite after numeric interpretation |
+| `preferredMinThroughput` | number or `{ p50, p75, p90, p99 }` | same | finite non-negative numbers |
+| `preferredMaxLatency` | number or `{ p50, p75, p90, p99 }` | same | finite non-negative numbers |
+| timeout | `timeoutMs` | `timeout_ms` | integer 1–600000; env overrides with a digit string |
+| attribution | `httpReferer`, `appTitle` | `http_referer`, `x_open_router_title` | strings when present |
+
+`exacto` is part of the pinned SDK `ProviderSort` enums, not a Workspai extension.
+Malformed JSON and wrong types raise `GatewayConfigurationError` before SDK
+construction. Contradictory policy, including ZDR combined with
+`dataCollection: "allow"`, fails before a network request.
+
+Omitted privacy or routing fields leave OpenRouter upstream defaults in
+effect. The SDKs document `dataCollection` / `data_collection` default as
+`allow` when unset. Application-side retries are set to strategy `none` so they
+cannot duplicate billable requests. OpenRouter may still apply provider
+fallbacks when `allowFallbacks` / `allow_fallbacks` is not `false`.
+
+Capabilities such as tools, JSON schema, structured output, images, audio, and
+embeddings vary by model and provider. These starters only claim chat
+generation and streaming.
+
+## Security
+
+- Never commit, log, or serialize API keys.
+- Generated clients are server-side only. Do not expose `OPENROUTER_API_KEY`
+  through browser bundles or frontend environment prefixes such as `VITE_` or
+  `NEXT_PUBLIC_`.
+- Diagnostics redact Authorization headers, API keys, URL secrets, and request
+  bodies.
+- TLS verification is not disabled.
+- Telemetry and prompt recording are not added.
+
+## Lifecycle
+
+After local install, documented commands are:
+
+TypeScript: `npm install`, `npm test`, `npm run typecheck`, `npm run build`,
+`npm run smoke`, `npm start`.
+
+Python: create a virtualenv, `python -m pip install -e .`, `python -m compileall .`,
+`python -m unittest discover -s tests`, `python main.py --smoke`, `python main.py`.
+
+Workspace Run uses those same manifests and the generated project's declared
+polyglot unit commands. Stage commands, including `&&` chains and a multi-step
+`start`, run as argv. They are not passed to a shell, so an absolute interpreter
+path cannot be expanded by `/bin/sh`. `test` and `--smoke` inject a fake
+transport. They do not require a live `OPENROUTER_API_KEY`.
+
+Streaming uses the official Client SDK event stream. Opening and iterating the
+stream are both normalized: configuration errors stay configuration errors,
+timeouts and caller aborts stay recognizable, and other failures become
+`GatewayUpstreamError` with redacted messages and preserved status / request id /
+retry-after when the SDK exposes them. Cleanup is once-only and prefers, in
+order: async iterator `return()` / generator `close()`, then SDK `close()`, then
+SDK `cancel()`. A cleanup failure does not replace the primary error or convert
+a successful completion into an error.
+
+The TypeScript starter forwards `AbortSignal` through `chat.send` options,
+including an already-aborted signal. Pinned `@openrouter/sdk` `1.3.11`
+`EventStream` extends `ReadableStream` and does not expose a dedicated `close()`.
+Cancellation is `ReadableStream` async-iterator `return()` → `cancel()`. If the
+stream has already errored, `cancel()` may be a no-op; the gateway still drops
+its own reference and remains usable for a later request. The Python starter
+closes the SDK iterator first (`EventStream.generator.close()`), which is the
+consumer `generator.close()` path. Python does not expose `AbortSignal`.
+Application-side retries stay disabled. Timeouts use SDK `timeoutMs` /
+`timeout_ms`. An empty successful completion returns an empty string.
+
+Exact pins live in
+[`version-baselines.v1.json`](../src/model-gateways/version-baselines.v1.json).
+Do not copy versions into unrelated files.
+
+## Qualification boundary
+
+Workspai source readiness is not release qualification. These kits are not
+described as `stable`, `release-ready`, `admitted`, or `qualified` until Linux,
+macOS, and Windows CI prove generated-project installation and lifecycle on the
+same commit SHA, and a later admission change records that evidence. The
+dedicated workflow is `.github/workflows/model-gateway-qualification.yml`.
+Path-triggered runs and manual `full` mode each qualify both the TypeScript and
+Python OpenRouter adapters on Linux, macOS, and Windows. Manual `fast` mode
+stays on Linux. There is no unused kit axis. Discovery is
+`.github/workflows/model-gateway-version-discovery.yml`. Its job summary shows
+the sdk-core candidate diff when registry and GitHub agree. A green job that
+skipped installation or lifecycle is not qualified.

package/docs/native-kit-baselines.md

@@ -12,10 +12,11 @@ native kits:
 This policy does not cover FastAPI or NestJS kits owned by the RapidKit Python
 engine. It also does not cover generators delegated to an upstream official
 CLI, such as Next.js, Astro, Angular, Vue, Svelte, Nuxt, or React Native.
-Governed Microsoft Agent Framework and OpenAI Agents SDK kits are versioned
-separately through the
+Governed Microsoft Agent Framework, OpenAI Agents SDK, and Google ADK kits are
+versioned separately through the
 [Agent Framework Adapter Contract](./agent-framework-adapters.md); they are
-not native HTTP service generators.
+not native HTTP service generators. OpenRouter AI Gateway kits are versioned
+through [AI Gateway](./model-gateways.md) and are not Agent Framework kits.
 
 ## Current tested baseline
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workspai",
-  "version": "0.76.0",
+  "version": "0.78.0",
   "type": "module",
   "description": "Open-source workspace intelligence CLI for software systems: create, adopt, govern, verify, and align polyglot workspaces for humans, CI, IDEs, and AI agents.",
   "keywords": [
@@ -97,6 +97,7 @@
     "test:parity-contract": "corepack npm run check:shared-contracts && vitest run src/__tests__/contracts/import-stack-parity.snapshot.test.ts",
     "test:watch": "vitest",
     "test:coverage": "corepack npm run test:prebuild && vitest run --coverage --reporter=default --reporter=json --outputFile.json=test-results/vitest.json",
+    "test:coverage:ci": "vitest run --coverage --reporter=default --reporter=json --outputFile.json=test-results/vitest.json",
     "test:prepare-embeddings": "node scripts/prepare-mock-embeddings.mjs",
     "generate-embeddings": "npx tsx src/ai/generate-embeddings.ts",
     "verify:package-cli": "node scripts/verify-package-cli.mjs",
@@ -117,9 +118,13 @@
     "test:agent-framework:dotnet": "tsx scripts/smoke-microsoft-agent-framework-adapter.ts --runtime dotnet",
     "test:agent-framework:openai:python": "tsx scripts/smoke-openai-agents-adapter.ts --runtime python",
     "test:agent-framework:openai:typescript": "tsx scripts/smoke-openai-agents-adapter.ts --runtime typescript",
+    "test:agent-framework:google-adk:python": "tsx scripts/smoke-google-adk-adapter.ts --runtime python",
+    "test:agent-framework:google-adk:typescript": "tsx scripts/smoke-google-adk-adapter.ts --runtime typescript",
     "verify:agent-framework:matrix": "tsx scripts/verify-agent-framework-conformance.ts --reports test-results/agent-framework-conformance",
     "discover:agent-framework:versions": "tsx scripts/discover-agent-framework-versions.ts",
     "propose:agent-framework:versions": "tsx scripts/propose-agent-framework-version-update.ts",
+    "discover:model-gateway:versions": "tsx scripts/propose-model-gateway-version-update.ts",
+    "propose:model-gateway:versions": "tsx scripts/propose-model-gateway-version-update.ts",
     "promote:agent-framework:admission": "tsx scripts/promote-agent-framework-release-admission.ts",
     "prepush:test:runtime-contract": "node scripts/run-cached-prepush-gate.mjs runtime-contract",
     "test:runtime-matrix:full": "node scripts/runtime-acceptance-matrix.mjs --full",