sync: publish A2A reliability, Host Broker, and meeting intake

.sync-provenance.json

@@ -1,28 +1,28 @@
 {
-  "source_commit_sha": "ccd61419380bdb85f4c137703a5dba44cc11afb1",
-  "target_head_sha": "1f4124baeed4541ffab409a4d7f7fbbbfa78c514",
+  "source_commit_sha": "69d5597eb4bdd9aba9c3de3931f9bbd853384963",
+  "target_head_sha": "b8449d13d1ccc5f71bb489d560013df1ed7fca6c",
   "release_tag": null,
   "source_snapshot_tag": null,
   "manifest_version": 3,
-  "included_file_count": 7020,
+  "included_file_count": 7080,
   "excluded_file_count": 14,
   "transform_count": 35,
   "secret_scan_result": "clean",
-  "synced_at": "2026-08-10T06:07:59Z",
+  "synced_at": "2026-08-10T15:38:57Z",
   "publicBehaviorReporter": {
-    "changeCount": 33,
+    "changeCount": 6,
     "watchlistTouched": true,
-    "migrationNotesLength": 522,
+    "migrationNotesLength": 937,
     "allowEmptyNotes": false,
     "allowEmptyNotesReason": null,
     "blockReason": null,
-    "reportBasename": "public-behavior-impact-2026-08-10T06-30-28-898Z.json"
+    "reportBasename": "public-behavior-impact-2026-08-10T16-01-34-121Z.json"
   },
   "publicDeltaGate": {
     "blockCount": 0,
     "overrideCount": 0,
     "cvoApprovalRequired": false,
-    "passCount": 720,
-    "reportBasename": "sync-public-delta-gate-2026-08-10T062934330Z.json"
+    "passCount": 269,
+    "reportBasename": "sync-public-delta-gate-2026-08-10T160038362Z.json"
   }
 }

cat-template.json

@@ -101,6 +101,7 @@
       "models": [
         "Gemini 3.1 Pro (High)",
         "Gemini 3.1 Pro (Low)",
+        "Gemini 3.6 Flash (High)",
         "Gemini 3.5 Flash (High)",
         "Claude Opus 4.6 (Thinking)"
       ]
@@ -659,16 +660,27 @@
       "id": "gemini35",
       "relationshipKey": "siamese",
       "catId": "gemini35",
-      "name": "暹罗猫 Gemini 3.5 Flash",
+      "name": "暹罗猫 Gemini 3.6 Flash",
       "displayName": "暹罗猫",
       "nickname": "烁烁",
       "avatar": "/avatars/gemini25.png",
       "color": {
         "primary": "#2563EB",
         "secondary": "#DBEAFE"
       },
-      "mentionPatterns": ["@gemini35", "@gemini-35", "@gemini3.5", "@flash", "@暹罗flash", "@暹罗gemini35"],
-      "roleDescription": "暹罗猫 Gemini 3.5 Flash，视觉设计和创意顾问",
+      "mentionPatterns": [
+        "@gemini35",
+        "@gemini-35",
+        "@gemini3.5",
+        "@gemini36",
+        "@gemini-36",
+        "@gemini3.6",
+        "@flash",
+        "@暹罗flash",
+        "@暹罗gemini35",
+        "@暹罗gemini36"
+      ],
+      "roleDescription": "暹罗猫 Gemini 3.6 Flash，视觉设计和创意顾问",
       "teamStrengths": "审美、前端设计风格、打破常规",
       "caution": "新猫加入还在测评；开发任务需要强 reviewer 守门",
       "defaultVariantId": "gemini35-default",
@@ -679,8 +691,8 @@
         {
           "id": "gemini35-default",
           "clientId": "google",
-          "variantLabel": "Gemini 3.5 Flash",
-          "defaultModel": "Gemini 3.5 Flash (High)",
+          "variantLabel": "Gemini 3.6 Flash",
+          "defaultModel": "Gemini 3.6 Flash (High)",
           "mcpSupport": true,
           "cli": {
             "command": "agy",

docs/architecture/ownership/cells/plugin.md

@@ -1,28 +1,32 @@
 ---
 cell_id: plugin
 title: Plugin Framework
-summary: Repository-local plugin activation plus Host-governed external official-plugin contracts, grants, runtime isolation, owned resource adapters, and narrow receipt-bearing Host capabilities.
+summary: Repository-local plugin activation plus Host-governed external package inventory, Broker sessions, grants, durable call settlement, owned resource adapters, and narrow receipt-bearing Host capabilities.
 canonical_features: [F202, F247, F285, F292]
 code_anchors:
   - packages/api/src/domains/plugin/PluginRegistry.ts
   - packages/api/src/domains/plugin/PluginResourceActivator.ts
   - packages/api/src/domains/plugin/ScheduleFactoryRegistry.ts
   - packages/api/src/domains/plugin/plugin-manifest.ts
   - packages/api/src/domains/plugin/plugin-config-store.ts
+  - packages/api/src/domains/plugin/host-inventory/index.ts
+  - packages/api/src/domains/plugin/host-broker/index.ts
+  - packages/api/src/domains/plugin/host-broker/events-publish-handler.ts
   - packages/api/src/routes/plugin-routes.ts
   - packages/shared/src/types/plugin.ts
   - packages/api/src/domains/cats/services/cloud-bridge/conversation-host-adapter.ts
 doc_anchors:
   - docs/features/F202-plugin-framework.md
   - docs/features/F285-stackchan-physical-limb-plugin.md
   - docs/features/F247-cloud-cat-family.md
-static_scan_hints: [PluginRegistry, PluginResourceActivator, ScheduleFactoryRegistry, IConversationHostAdapter, append_message, plugin.yaml, pluginId, plugin-owned, factoryId, schedule, PluginConfigPanel]
+static_scan_hints: [PluginRegistry, PluginResourceActivator, ScheduleFactoryRegistry, PluginInventoryStore, HostBrokerControlPlane, HostBrokerStore, BrokerMethodHandler, IConversationHostAdapter, append_message, plugin.yaml, pluginId, plugin-owned, factoryId, schedule, PluginConfigPanel]
 cited_by:
   - {feature: F202, date: 2026-05-31, delta: new cell}
   - {feature: F202, date: 2026-06-08, delta: schedule resources}
   - {feature: F285, date: 2026-08-01, delta: external official-plugin and physical-limb contribution boundary}
   - {feature: F292, date: 2026-08-08, delta: C-2 signal declaration/wire contribution boundary; durable intake stays in signal-intake}
   - {feature: F247, date: 2026-08-08, delta: narrow conversation Host Adapter seam with no implicit UI fallback}
+  - {feature: F202, date: 2026-08-10, delta: K-2B contract-native Broker sessions, durable call ledger, and typed signal-intake edge}
 ---
 
 # Plugin Framework
@@ -41,6 +45,14 @@ resource adapters, and the existing domain control planes that those adapters
 invoke. A plugin-declared contribution is a candidate resource, never proof of
 identity, installation, permission, health, or execution authority.
 
+K-2A and K-2B make that Host authority executable without loading community
+code into the API process. The inventory owns admitted package, installation,
+grant, and activation truth. The Broker owns one-use handshake sessions,
+runtime leases, and a durable call ledger whose recovery consults the owning
+domain's canonical settlement before it can redispatch. The builtin loopback
+adapter exercises this same state machine, but production composition and an
+external process transport remain dormant.
+
 F247 owns the first narrow conversation Host capability seam:
 `append_message(conversationId, text, idempotencyKey)` returns a durable Host
 message ID. The seam is an admission point, not proof that a provider exposes
@@ -79,6 +91,13 @@ automation is a separate, explicitly enabled legacy transport.
 - Bind package digest, installation instance, runtime session, grants, and
   resource identity from Host-owned state. External runtimes cannot choose or
   widen those identities through self-report.
+- Admit only methods marked ready by the exact published wire registry. Validate
+  every frame with contract-owned validators and never mirror public wire
+  schemas or method registries in core.
+- Persist dispatch intent before invoking a domain handler. Recovery may return
+  a domain's canonical receipt, but must not blindly replay an ambiguous effect.
+- Keep domain adapters narrow: the Broker owns transport settlement, while the
+  receiving domain owns authorization, idempotency, and durable product truth.
 - Keep C-2 signal declaration, wire, generated types, SDK helpers, conformance,
   and official input-source plugin code in the public plugin seam. Route
   admission, idempotent settlement, durable workflow intake, source access,
@@ -99,7 +118,8 @@ automation is a separate, explicitly enabled legacy transport.
 - Do not treat remote marketplace install/signing as already solved by F202
   Phase 1. That trust boundary needs a separate design slice.
 - Do not load external executable plugins into the API process or treat the
-  existence of a public SDK as proof that the production Host Broker has landed.
+  presence of the dormant Broker state machine as proof that stdio/process
+  supervision, production composition, or an external plugin runtime is live.
 - Do not let an external physical plugin register a parallel Limb registry,
   bypass F126 for actions, or turn device observations directly into cat intent.
 - Do not absorb K-3a routes, `MeetingIntake`, source-resolution authority, or
@@ -111,7 +131,8 @@ automation is a separate, explicitly enabled legacy transport.
 ## Static Scan Hints
 
 Watch for new or renamed `PluginRegistry`, `PluginResourceActivator`,
-`ScheduleFactoryRegistry`, `PluginConfigStore`, `plugin.yaml`, `pluginId`,
+`ScheduleFactoryRegistry`, `PluginInventoryStore`, `HostBrokerControlPlane`,
+`HostBrokerStore`, `BrokerMethodHandler`, `PluginConfigStore`, `plugin.yaml`, `pluginId`,
 `plugin-owned`, `factoryId`, `schedule`, `PluginConfigPanel`, and direct writers
 to plugin-owned capability records. Also watch `IConversationHostAdapter`,
 `append_message`, provider receipts, and implicit browser/composer fallbacks.

docs/architecture/ownership/cells/signal-intake.md

@@ -5,13 +5,21 @@ doc_kind: architecture
 created: 2026-08-08
 summary: Host-owned admission, routing, durable workflow intake, source-resolution authority, and repair projection for declared external plugin signals.
 canonical_features: [F292]
-code_anchors: []
+code_anchors:
+  - packages/shared/src/types/signal-ingress.ts
+  - packages/shared/src/types/meeting-intake.ts
+  - packages/api/src/domains/signal-intake/SignalAdmissionService.ts
+  - packages/api/src/domains/signal-intake/RedisMeetingIntakeStore.ts
+  - packages/api/src/domains/signal-intake/SourceAccessLeaseService.ts
+  - packages/api/src/domains/plugin/host-broker/events-publish-handler.ts
+  - packages/api/src/routes/meeting-intake-routes.ts
 doc_anchors:
   - docs/features/F292-feishu-meeting-intake-plugin.md
   - feature-specs/2026-08-08-f292-feishu-meeting-intake.md
-static_scan_hints: [SignalAdmissionService, SignalRouteStore, MeetingIntakeStore, MeetingIntakeService, SourceAccessLeaseService, signal-ingress, meeting-intake]
+static_scan_hints: [SignalAdmissionService, SignalRouteStore, MeetingIntakeStore, MeetingIntakeService, SourceAccessLeaseService, EventsPublishBrokerHandler, signal-ingress, meeting-intake]
 cited_by:
   - {feature: F292, date: 2026-08-08, delta: "new Host-side cell separates durable external-signal truth from plugin lifecycle and source-specific collectors"}
+  - {feature: F292, date: 2026-08-10, delta: "K-2B typed events.publish adapter consumes Host Broker identity while preserving signal-intake settlement authority"}
 ---
 
 # External Signal Intake
@@ -31,8 +39,11 @@ The external source remains source truth. This cell persists bounded metadata, s
 governance/settlement history, and workflow choices; it does not become a document store or universal
 event log.
 
-The cell is frozen before implementation, so its code-anchor list is intentionally empty. PR 2 must
-replace that empty list with the exact landed shared/API anchors before it can claim completion.
+The merged core slices establish released-contract admission, atomic TTL=0 intake truth, Host route
+generation, one-shot source access, typed repair state, Needs Me actions, and owner-scoped recovery.
+K-2B adds the typed `events.publish` transport edge: it resolves the current Host route for every
+call, invokes this cell's admission service, and uses this cell's canonical settlement receipt to
+recover ambiguous Broker dispatch without creating a second intake.
 
 ## Use This When
 
@@ -47,6 +58,10 @@ replace that empty list with the exact landed shared/API anchors before it can c
 - Require one released public contract and exact package digest; never mirror its schema in core.
 - Bind producer, provenance, grants, runtime session, liveness, and route generation from Host truth.
 - Persist accepted settlement and durable intake atomically before attempting wake or UI fan-out.
+- Keep route generation in the per-call Host binding, not in a long-lived runtime lease; route
+  changes must take effect without re-authorizing the plugin process.
+- Expose a validated canonical-settlement lookup for Broker recovery. It may return an already
+  committed receipt, but it cannot create or mutate intake truth.
 - Treat delivery as at-least-once and visible work as idempotent; exact retries return the same receipt,
   while same-key/different-input conflicts fail closed.
 - Cross the plugin boundary with bounded metadata and opaque source refs. Resolve source content only

docs/features/.export-summary.json

@@ -1,5 +1,5 @@
 {
-  "exportedAt": "2026-08-10T06:07:40.195Z",
+  "exportedAt": "2026-08-10T15:38:38.258Z",
   "minTier": "yellow",
   "exported": 287,
   "skipped": 16,

docs/features/F167-a2a-chain-quality.md

@@ -4,9 +4,22 @@ related_features: [F064, F027, F055, F122, F246, F280]
 topics: [a2a, collaboration, harness-engineering, agent-readiness]
 doc_kind: spec
 created: 2026-04-17
-updated: 2026-08-04
+updated: 2026-08-10
 tips_exempt: action-custody protocol is exposed to cats through the typed MCP action schema; no separate operator-facing capability action
 user_journey_exempt: protocol behavior has no direct UI surface; end-to-end custody is dogfooded through the real MCP/task path
+mcp_admission_status: accepted
+mcp_admission_ref: "file:docs/features/F167-a2a-chain-quality.md"
+mcp_admission_claims:
+  - ref: "file:docs/features/F167-a2a-chain-quality.md"
+    toolName: cat_cafe_complete_managed_hold
+    resourceFamily: task-workflow
+    boundaryKind: authority-boundary
+    decision: accepted
+  - ref: "file:docs/features/F167-a2a-chain-quality.md"
+    toolName: cat_cafe_complete_a2a_dispatch
+    resourceFamily: task-workflow
+    boundaryKind: authority-boundary
+    decision: accepted
 ---
 
 # F167: A2A Chain Quality — 乒乓球熔断 + 虚空传球检测 + 角色护栏
@@ -43,6 +56,16 @@ operator experience：
 
 1. **路由可见性不退化**（operator拍板）：若猫通过 MCP `targetCats` 路由但响应文本无 @mention，系统须自动补可见路由指示，不可让协作"悄咪咪"发生。
 2. **Provider-agnostic**：护栏不依赖特定模型行为，对所有引擎生效。
+
+### Bounded repair: invocation-bound structured-wake dispositions (2026-08-10)
+
+Architecture cell: `ball-custody` + `dispatch` + `mcp-surface-governance`
+
+operator decision `[thread-id]#0001786347630932-000025-ab3cdda3` accepts narrow terminal producers for structured wakes already exposed to the current invocation. `cat_cafe_complete_managed_hold` closes an exact managed hold using callback-authenticated invocation identity plus server-derived source message/task/thread/holder coordinates. The live regression in `[thread-id]` extends the same accepted F167 boundary to ordinary A2A dispatch: `cat_cafe_complete_a2a_dispatch` derives source message, previous cat, thread, holder, and invocation from the current callback record and exact `ball.handed` event. The caller selects only `handled | completed`; stale, replaced, cross-thread, cross-holder, cross-source, or cross-task attempts fail closed. Read, command exit, tests, merge truth, ACK, unrelated task completion, and another coordination terminal remain non-terminal.
+
+This is a bounded F167/F254/F264 repair, not a new Feature or lifecycle owner. Managed holds write the existing F264 target receipt and both wake kinds write the F167 BallCustody event log. The repair does not add another Queue, receipt ledger, projection, or state machine.
+
+The same repair boundary also owns two dispatch invariants exposed by the post-merge A→B→A dogfood (`[thread-id]#0001786350407910-000095-8739ed4a`): a successful same-thread `post_message` callback is the one carrier for that source/target and must be suppressed from the later route-serial line-start scan; releasing the invocation slot must have a bounded path to `notifyQueueCompletion` even if F194/F224 terminal bookkeeping stalls. The normal ordering remains terminal truth and continuation commit before queue drain; a 5-second idempotent watchdog is only the liveness fallback. Ordinary inline dispatches now receive their completion producer on the first child and fail typed without spawning a stale `routing_guard` child when the producer is omitted.
 3. **Backward compatible**：不退化 4.6 等已正常工作模型的体验。
 4. **极简**：只加运行时刹车（压制坏直觉）和认知路径工程（对齐好直觉），不加认知脚手架（替模型思考）。