✨ feat: gateway speech, an Aura navigable without touch, a live tier for agentic apps, and a declared indexing plan

## Features

### packages/mewbo_speech

A new package for synthesis and transcription against an OpenAI-compatible gateway, with model
capability discovery so a surface can ask what a deployment can actually do rather than assume.
It is optional in both senses the layering rule requires: a PEP 621 extra, and an import guard at
every call site.

### packages/mewbo_core

- **A declared step plan and an observed progress ledger** (`contracts/progress.py`). Long jobs
  previously reported progress as a register of ad hoc counters, so a value belonging to a phase
  that had already ended was read as describing the current one. Work is now DECLARED as a plan of
  steps and OBSERVED against it, which is what lets a reader tell "not started" from "finished
  and reset" — two states a bare counter spells identically.
- Tool refusals carry a machine-readable code and close the gap that made a refusal
  indistinguishable from an empty result. Generative UI ships as a first-party plugin suite with a
  canonical identity for built-ins, and `SessionToolRegistry` gains a deny set, so an operator can
  switch a built-in tool off without removing the plugin that provides it.

### packages/mewbo_graph

Per-project embedding models, and an indexing read failure that used to end a run early now
surfaces as a typed fact instead of silent truncation. Every indexing step opens a scope of its
own, so a log line that escapes its declared step is labelled as unattributed rather than
rendered anonymously — an invisible gap is how one survives a green suite.

### apps/mewbo_api

- **A live tier for Mewbo Apps** (`apps/pipeline_runner.py`, `pipeline_tracker.py`, `models.py`,
  `plugin/submit_app.py`). An app declares a result contract; a post-response verifier checks what
  it actually returned, and auto-repair reaches on-demand pipelines rather than only scheduled
  ones. A code pipeline's `ctx` is scoped to the app's own staging directory.
- Speech routes (`speech/routes.py`) expose synthesis and transcription over the gateway, gated by
  the same capability header every other client-side capability travels through.
- **Device control is a session** (`device_tools.py`): started, held, shown and ended, with the
  binding durable across re-engagement instead of rebuilt per request.
- An operator-owned execution allowlist for pipelines, and a concurrency bound on live pipelines —
  a long-lived request spends a process-wide budget, so the ceiling is stated rather than
  discovered when the API stops answering.

### apps/mewbo_console

The declared plan renders as an outline that follows the run and collapses what is done; the
indexing screen is rebuilt as four bounded regions so a loading screen can no longer grow a
scrollbar and push its own Cancel control off-screen. Live and average tokens-per-second appear in
the trajectory and the turn footer. The model and fallback pickers become one tabbed panel.

### apps/mewbo_aura

**Aura is operable without a touchscreen.** Anyone driving the app by D-pad, remote or keyboard
could not reach most of it, and the cause was not missing focus targets: `clickable` is already
focusable in Compose and the accessibility tree held eight focusable nodes. Focus was TRAPPED. A
focused text field consumed all four arrow keys to move its caret, the composer took focus on the
first frame, and eight consecutive arrow presses moved focus not once. So the fix is a navigation
model rather than a stylesheet, and adding `Modifier.focusable` anywhere would have changed
nothing.

Four parts, all in `ui/common/`. `Modifier.dpadFocusEscape` lets Up/Down always leave a text
field while keeping in-text caret movement. `Modifier.auraFocusRing` gives a control a visible
focus state, and must precede the click modifier in the chain — `onFocusChanged` observes only
focus targets that follow it, so ringing from behind compiles, draws nothing and warns about
nothing. `focusProperties { down = FocusRequester.Cancel }` contains focus at the bottom edge,
where a move onto a node the IME then destroyed left the tree with no focused node in any
direction and no key events to recover with. `Modifier.imeOnConfirmOnly` stops the keyboard
covering the screen for someone merely traversing past a field, and is named for the behaviour
rather than the device. Settings rows now carry their own click and render the switch as a
display-only indicator, because a trailing `Switch` was focusable and still unreachable from all
four directions.

Television is where this becomes unavoidable rather than what it is for: with no touchscreen at
all, each of the above is a hard failure instead of an inconvenience. Android TV and Fire TV
admission, a permanent navigation rail in place of the modal drawer, remote speech and in-app
updating ride along, and the API floor drops to 30 — `RuntimeShader`, not haptics, was what stood
in the way.

## Fixes

- **`packages/mewbo_core`** — a reasoning model's bare-string answer is wrapped as a text block
  before it reaches history, where a strict OpenAI-shaped backend rejected it on replay. Schema
  upper bounds that break grammar-constrained backends are dropped, an activated skill is no longer
  truncated in half, and a session stays on its own model. Every turn gets its own trace and every
  tool call a span.
- **`packages/mewbo_graph`** — the progress ledger gets a denominator that cannot move, settles at
  the end, and says when settling hid something; the ledger is read from whichever transport is
  ahead.
- **`apps/mewbo_api`** — the Web IDE app-staging tier no longer drops sessions bound only by tag;
  the external-cwd gate can see paths the server already owns; poisoned app workspace bindings are
  repaired on resubmit; the code-server image is pulled before a container is created.
- **`apps/mewbo_console`** — a citation badge annotates its sentence instead of erasing it, and the
  injected theme no longer collapses embedded-app sidebar spacing or leaves the auto-generated
  multipage sidebar nav unthemed.
- **`apps/mewbo_aura`** — the stop-reading-aloud control gets its focus ring, the one focusable box
  the sweep missed.
- **build and CI** — every package README resolves inside its own project so package metadata can
  reach it; the Docker and Android release pipelines run on both forges; the docs upload timeout is
  raised above the real transfer time, where the old cap cut the archive mid-stream and reported a
  truncated build rather than a timeout.

## Removals

`public_endpoint` is dropped — a declaration nothing read.

Co-authored-by: Mewbo AI <268600793+mewbo-ai[bot]@users.noreply.github.com>

Author: bearlike

.devcontainer/Dockerfile

@@ -76,6 +76,36 @@ RUN groupadd --gid $USER_GID $USERNAME \
 # monorepo root.
 RUN pip install --no-cache-dir uv
 
+# ---------- Simple Secrets Manager (ssm / ssm-cli) ----------
+# The workspace agent is launched through `ssm run`, so an image without it on
+# PATH boots the agent straight into exit 127. Installed here (Tier 0) rather
+# than init.d because it is toolchain, not project state.
+#
+# All three UV_* paths are load-bearing, because this installs as root while
+# the agent runs as $USERNAME:
+#   BIN_DIR     — uv's default (~/.local/bin) is NOT on a non-login shell's
+#                 PATH, and the agent pane runs `sh -c`, so a default install
+#                 is present and still unfindable (exit 127).
+#   TOOL_DIR    — the shim is a symlink INTO the tool venv; left at the default
+#                 it points inside /root and the agent gets exit 126.
+#   PYTHON_...  — the venv's interpreter is likewise fetched under /root by
+#                 default, so the venv resolves to an unreadable python.
+# `a+rX` then grants traverse/read without marking data files executable. The
+# python dir is only created when uv had to FETCH an interpreter; this image
+# already ships one it can reuse, so the loop skips what does not exist rather
+# than failing the build on it.
+#
+# The null keyring backend is required at RUNTIME, not just here: a container
+# has no secret service, and keyring's search for one hangs a headless client.
+# The CLI reads SSM_BASE_URL/SSM_TOKEN from the environment, which the
+# workspace supervisor already injects — so no credential file is baked in.
+ENV PYTHON_KEYRING_BACKEND=keyring.backends.null.Keyring
+RUN UV_PYTHON_INSTALL_DIR=/opt/uv-python \
+    UV_TOOL_DIR=/opt/uv-tools \
+    UV_TOOL_BIN_DIR=/usr/local/bin \
+    uv tool install git+https://github.com/bearlike/Simple-Secrets-Manager.git \
+    && for d in /opt/uv-python /opt/uv-tools; do [ -d "$d" ] && chmod -R a+rX "$d"; done
+
 # ---------- Shared cache mount points ----------
 # Named volumes are mounted here by devcontainer.json. Create and chown them at
 # build time: a volume is created empty and root-owned on first use, and the

.devcontainer/docker-compose.yml

@@ -26,6 +26,17 @@ services:
     init: true
     command: sleep infinity
 
+    # Compose does NOT add host.docker.internal for you the way a plain
+    # `docker run` on Linux does with `--add-host=…:host-gateway` — this is
+    # that same mapping, spelled for Compose. It is what lets an agent in here
+    # reach the host's own grove-mcp (networked MCP transport, :7431) by a
+    # name that also resolves for a host-side Claude session, so ONE .mcp.json
+    # URL serves both. `host-gateway` is Docker's own sentinel, resolved to
+    # whatever bridge gateway this container actually gets — never hardcode
+    # the IP, a fresh network is minted per workspace.
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+
     volumes:
       # Relative to THIS file, so it resolves correctly in any git worktree
       # rather than being pinned to one checkout path.

.env.example

@@ -39,6 +39,10 @@
 # API authentication token — generate a strong random string.
 MEWBO_MASTER_API_TOKEN=CHANGE_ME
 
+# Published image source. Set a private registry as git.example.com/bearlike.
+MEWBO_REGISTRY=ghcr.io/bearlike
+MEWBO_TAG=latest
+
 # Exposed ports (host networking)
 MEWBO_API_PORT=5125
 

.github/workflows/agent-pickup.yml

@@ -124,7 +124,14 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+          # A self-hosted forge behind a private CA is invisible to curl's system
+          # trust store: the runner exports that CA for node and for git, and
+          # nothing else. Trust the CA narrowly; AGENT_TLS_NO_VERIFY remains an
+          # explicit escape hatch only when it is configured.
           curl_flags=()
+          if [ -n "${NODE_EXTRA_CA_CERTS:-}" ] && [ -r "${NODE_EXTRA_CA_CERTS}" ]; then
+            curl_flags+=(--cacert "${NODE_EXTRA_CA_CERTS}")
+          fi
           case "${AGENT_TLS_NO_VERIFY,,}" in true|1|yes) curl_flags+=(-k) ;; esac
           # Gitea act_runner may leave github.api_url empty; derive it.
           api="$API_URL"
@@ -163,6 +170,9 @@ jobs:
           # pull_request events carry head/base inline; comment- and
           # dispatch-triggered PR pickups must look them up.
           curl_flags=()
+          if [ -n "${NODE_EXTRA_CA_CERTS:-}" ] && [ -r "${NODE_EXTRA_CA_CERTS}" ]; then
+            curl_flags+=(--cacert "${NODE_EXTRA_CA_CERTS}")
+          fi
           case "${AGENT_TLS_NO_VERIFY,,}" in true|1|yes) curl_flags+=(-k) ;; esac
           if [[ "${ITEM_IS_PR:-false}" == "true" && -z "${HEAD_REF:-}" ]]; then
             pr=$(curl "${curl_flags[@]}" --fail-with-body --silent --show-error \
@@ -179,6 +189,9 @@ jobs:
         run: |
           set -euo pipefail
           curl_flags=()
+          if [ -n "${NODE_EXTRA_CA_CERTS:-}" ] && [ -r "${NODE_EXTRA_CA_CERTS}" ]; then
+            curl_flags+=(--cacert "${NODE_EXTRA_CA_CERTS}")
+          fi
           case "${AGENT_TLS_NO_VERIFY,,}" in true|1|yes) curl_flags+=(-k) ;; esac
           provider="gitea"
           [[ "$SERVER_URL" == "https://github.com" ]] && provider="github"

.github/workflows/android-ci.yml

@@ -0,0 +1,142 @@
+#@doc
+# * PR gate for Mewbo Aura (apps/mewbo_aura): lints and unit-tests the `public`
+#   distribution flavor ONLY. The `enterprise` flavor needs a private CA cert
+#   that CI does not have (see android-release.yml) — never build/test it here.
+#
+# One job, not two: `:app:lintPublicDebug` and `:app:testPublicDebugUnitTest`
+# would otherwise provision JDK/SDK into the SAME persistent
+# `/opt/hostedtoolcache` volume in parallel, which is exactly the race
+# android-release.yml's concurrency comment documents (colliding unzip/mv →
+# mangled repo metadata → "Failed to find package"). Sequential steps in one
+# job reuse the already-provisioned toolcache for the second step for free.
+
+name: Android CI
+
+on:
+  pull_request:
+    paths:
+      - "apps/mewbo_aura/**"
+      - ".github/workflows/android-ci.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# TWO axes, and the outer one is not about this PR at all.
+#
+# Per-PR cancellation is what you want for signal (a new commit supersedes the
+# old run), but it CANNOT be the concurrency group: every Android job on this
+# runner provisions into the same persistent /opt/hostedtoolcache volume, and
+# two concurrent provisioners race on the SDK dir — colliding unzip/mv, mangled
+# repo metadata, "Failed to find package". That is why android-release.yml
+# serializes on ONE global group rather than per-tag; a per-PR group here would
+# re-open the same race between two PRs, and between a PR and a release.
+#
+# So: share the release workflow's global group. Two Android runs never overlap.
+# cancel-in-progress stays FALSE — a PR run must never kill a release build.
+#
+# ⚠️ The cost is NOT "concurrent PRs queue" — it is sharper than that. A group
+# holds at most ONE pending run, so with a release building and PR A waiting, PR
+# B's arrival CANCELS A. A cancelled check is neither a pass nor a failure, so
+# nobody re-runs it; the PR simply has no Android signal until someone notices.
+# Accepted deliberately: PR volume here is low, and a missing gate you can see is
+# better than the toolcache race, which corrupts the SDK for every later run.
+# Re-push to re-trigger. If this starts biting, the fix is a per-PR group plus a
+# lockfile around the provisioning step only — NOT dropping the shared group.
+concurrency:
+  group: android-toolcache
+  cancel-in-progress: false
+
+defaults:
+  run:
+    working-directory: apps/mewbo_aura
+
+jobs:
+  lint-and-test:
+    name: Lint + unit test (public flavor)
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    env:
+      # Same persistent toolcache volume as android-release.yml, so a JDK/SDK
+      # already provisioned by a release run (or an earlier CI run) is reused
+      # instead of re-downloaded.
+      ANDROID_HOME: /opt/hostedtoolcache/android-sdk
+      GRADLE_USER_HOME: /opt/hostedtoolcache/gradle-home
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Provision Temurin JDK 21 (persistent toolcache, skipped when present)
+        run: |
+          set -euo pipefail
+          JDK_DIR=/opt/hostedtoolcache/temurin-21-jdk
+          if [ ! -x "$JDK_DIR/bin/java" ]; then
+            curl -fsSL -o /tmp/jdk.tar.gz "https://api.adoptium.net/v3/binary/latest/21/ga/linux/x64/jdk/hotspot/normal/eclipse"
+            mkdir -p "$JDK_DIR"
+            tar -xzf /tmp/jdk.tar.gz -C "$JDK_DIR" --strip-components=1
+            rm /tmp/jdk.tar.gz
+          fi
+          echo "JAVA_HOME=$JDK_DIR" >> "$GITHUB_ENV"
+          echo "$JDK_DIR/bin" >> "$GITHUB_PATH"
+
+      - name: Provision Android SDK (persistent toolcache, skipped when present)
+        run: |
+          set -euo pipefail
+          if [ ! -d "$ANDROID_HOME/platforms/android-37.0" ] || [ ! -d "$ANDROID_HOME/build-tools/37.0.0" ]; then
+            mkdir -p "$ANDROID_HOME/cmdline-tools"
+            cd "$ANDROID_HOME/cmdline-tools"
+            rm -rf latest cmdline-tools.zip
+            curl -fsSL -o cmdline-tools.zip https://dl.google.com/android/repository/commandlinetools-linux-13114758_latest.zip
+            unzip -q cmdline-tools.zip
+            mv cmdline-tools latest
+            rm cmdline-tools.zip
+            (yes || true) | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --sdk_root="$ANDROID_HOME" --licenses >/dev/null
+            "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --sdk_root="$ANDROID_HOME" "platform-tools" "platforms;android-37.0" "build-tools;37.0.0"
+          fi
+
+      # Both Gradle invocations below cap the JVM the same way android-release.yml
+      # does, and for the same measured reason: the project's gradle.properties
+      # asks for -Xmx4096m, while a job container here is capped at 2.5 GiB with
+      # no swap, so the daemon is OOM-killed by construction and the build
+      # reports only "Gradle build daemon disappeared unexpectedly". The jvmargs
+      # value is quoted as ONE argument because it contains a space — unquoted,
+      # Gradle receives `-XX:...` as its own flag and rejects it.
+      - name: Lint (public flavor)
+        run: |
+          set -euo pipefail
+          ./gradlew :app:lintPublicDebug \
+            "-Dorg.gradle.jvmargs=-Xmx1536m -XX:MaxMetaspaceSize=512m -Dfile.encoding=UTF-8" \
+            -Dkotlin.compiler.execution.strategy=in-process \
+            -Dorg.gradle.caching=true \
+            --no-daemon --max-workers=2
+
+      - name: Unit tests (public flavor; test sources are flavor-agnostic)
+        run: |
+          set -euo pipefail
+          ./gradlew :app:testPublicDebugUnitTest \
+            "-Dorg.gradle.jvmargs=-Xmx1536m -XX:MaxMetaspaceSize=512m -Dfile.encoding=UTF-8" \
+            -Dkotlin.compiler.execution.strategy=in-process \
+            -Dorg.gradle.caching=true \
+            --no-daemon --max-workers=2
+
+      - name: Upload lint report on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: android-lint-report
+          path: apps/mewbo_aura/app/build/reports/lint-results-publicDebug.html
+          retention-days: 7
+          # warn, not ignore: a drifted report path must be visible, not a silent green.
+          if-no-files-found: warn
+
+      - name: Upload unit test results on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: android-unit-test-results
+          path: |
+            apps/mewbo_aura/app/build/reports/tests/testPublicDebugUnitTest
+            apps/mewbo_aura/app/build/test-results/testPublicDebugUnitTest
+          retention-days: 7
+          # warn, not ignore: a drifted report path must be visible, not a silent green.
+          if-no-files-found: warn