GOOGLE_GENERATIVE_AI_API_KEY must remain server-side. The model is selected by
/api/v1/live/token and passed to the client. Google documents the protocol in the
Live API guide.
Native local text models
See Assistant local models for mobile installation, compatibility, preparation recovery, and the separate inference gate.Experience
On mobile, entering Live keeps the shell navbar available until an explicit Call Mira action starts the call. Preparing, connecting, and reconnecting show a calling screen with the real connection status and a cancel action; microphone/camera/text/end controls appear only after connection. The connected controls replace navigation inside the same shell material at the same adaptive navbar width. Expanding navigation or ending the call preserves that surface. Text chat grows to at least three lines while focused and at most five lines in the dock. The control above Send opens a full-screen draft editor; minimizing returns the same text and selection to the dock without sending. Live capture requests PCM16 mono, gain control, echo cancellation, and noise suppression. Android uses the communication source/mode and speaker route. The pinned iOS recorder enables native voice processing, and playback preserves its existing category/options. Disconnect stops capture and releases the playback unit instead of immediately initializing it again; this does not claim global iOS audio-session deactivation. Delayed setup/frame work and cancelled call starts are generation fenced; old requests cannot connect or clear a restarted call’s pending state. Cancelling capture clears its startup ownership immediately; obsolete permission or ready waits cannot block or clear the replacement microphone attempt. Device routes and echo reduction still require device verification, including speaker, headset, and Bluetooth calls. Regression coverage includesassistant_live_dock_lifecycle_test.dart, assistant_live_calling_view_test.dart,
assistant_live_recorder_test.dart, assistant_live_disconnect_audio_test.dart,
and assistant_live_microphone_restart_test.dart.
Mobile chat uses the shell’s existing dock for its composer and primary action.
An empty draft keeps the navigation menu; a nonempty draft or attachment changes
that action to Send. During inline recording it becomes Pause, then Send while
paused. Cancel discards only the recording and returns to the retained text draft.
The input row has no second Send button. Each assistant turn has one initially
collapsed transparent thinking accordion, showing the latest heading from reasoning
text already supplied by the API. Expanding it reveals those existing sections in
source order. Only the current streaming turn animates its thinking icon; stopped,
completed, and failed turns use a static icon. Consecutive tool calls share one
collapsed transparent accordion displaying the latest tool name, while response
text and generated images keep their relative positions. No additional hidden
reasoning is requested or inferred. These rules apply to mobile Mira’s timeline;
other clients retain their own presentation. Accordion regressions are in
assistant_activity_accordion_test.dart. The transcript’s scroll-to-bottom
action clears the dock using the shell viewport’s inherited clearance; the outer
shell consumes the keyboard inset once. Regressions cover controller and capture
transitions, retained dock identity, transparent tool inspection, and actual shell
geometry in apps/mobile/test/features/assistant/widgets/.
On the web dashboard, start or stop Live with the waveform icon in the chat
composer. Live keeps the
same message timeline visible, with a compact gradient visualization and media
controls above it. Spoken turns, typed prompts, tool calls, and search sources
appear in that timeline and share the workspace artifacts. Close Live or press
Escape to stop media capture and continue typing.
Finalized Live turns are saved to the same chat through the owner-checked
/api/ai/chat/live-messages endpoint. Stable message IDs make retries idempotent;
ordered parts keep text and tools interleaved after refresh. Complete transcript
text lives in canonical parts metadata; the separate search/fallback content field
is capped at 10,000 Unicode characters to satisfy its database limits of
10,000 characters and 40,000 bytes. Pending saves finish
before a subsequent typed request. Failed saves show a retry action; keep the page
open until they succeed. In-progress speech remains provisional until the turn
finishes or the session closes. Audio and video are not stored as chat attachments.
Live starts with up to 64,000 characters of conversation context: bounded earlier
excerpts preserve original roles alongside recent turns and compact tool results.
This is deterministic compaction, not a generated summary. This bound does not remove older saved messages. Temporary session notes
remain separate from workspace documents.
Chat and Live share a persistent composer panel in the page layout. Switching
modes swaps the toolset and preserves the text draft. Chat shows its model and
credit controls without a redundant mode label. Screen/camera sharing uses a
compact thumbnail that expands on demand; the composer does not cover messages.
Transitions respect reduced-motion preferences.
The assistant opens tasks, calendar, finance, and meetings next to the conversation
through tool calls. The chat toolbar has no product, sidebar, or layout controls. One artifact splits the available space in half; multiple
artifacts automatically use a four-cell grid with chat in one cell. Side-by-side,
stacked, and grid controls override the arrangement. Narrow containers stack
panels so sidebar width is included in the responsive decision. Up to three
artifacts remain open; opening a fourth replaces the oldest. Artifacts are scoped
to the workspace selected when opened and can be refreshed or closed individually.
Task previews use the Tasks app’s personal feed, showing 12 rows at a time with
Show more. Calendar previews cover the next seven days, and wallet balances retain
their own currencies. APIs remain the
permission boundary and panels expose loading, empty, and retry states.
The assistant can call show_workspace_artifact, set_sidebar (expanded,
collapsed, hover, hidden), and set_theme (light, dark, system) in chat and Live.
Chat applies UI commands when the streamed tool output arrives, independently of
whether the result card is visible. Restoring history does not replay old UI
commands. Sidebar changes use the existing preference provider and respect its
local/account synchronization settings. Ask the assistant to restore navigation
when it is hidden.
Meeting panels provide a creation form to eligible @tuturuuu.com accounts using
createWorkspaceMeeting. The existing meeting API authenticates the account,
checks workspace membership, and enforces the domain policy. Opening the panel is
not meeting creation; success is shown only after the creation request succeeds.
No meeting API or database policy changes are part of this interface update.
Live mode displays both speakers’ streamed transcripts, task visualizations,
Google Search sources, tool activity, and temporary session notes. Typed prompts
and voice share one session. Camera and screen sharing require an explicit media
control action; a preview indicates what is shared. Microphone mute sends
audioStreamEnd, and interruption stops queued assistant playback.
Workspace artifacts remain beside the shared conversation. Tool results and Google
Search sources stay in the message timeline. Temporary notes are not workspace
documents. The existing five-minute credit authorization limit remains in force;
expiration ends media capture and keeps the saved conversation available.
Mobile audio capture
On mobile, Chat and Live use the same top header mode switch and page background. Live keeps the floating bottom navigation visible. Its idle start action is the icon-only Call Mira button beside that navigation; the top header opens Live settings in a sheet with the Keep Live while browsing switch. The idle screen does not show an availability badge or a second start button. During a session, connected call controls replace navigation inside the same dock and provide camera, microphone, typing, and end actions. A connecting call retains navigation and offers cancel. Connection problems show retry without changing the page background. Starting mobile Live with the microphone enabled requests permission and captures speech while the connection initializes. A memory-only FIFO holds at most 30 seconds of 16 kHz mono PCM. Once ready, chunks drain in order; cancelling capture or leaving the session discards unsent audio. Connection errors do not persist this buffer to disk. The normal mobile chat microphone replaces the text field with a real microphone waveform inside the same persistent floating dock. It opens no recording sheet. Pause reveals restart, attach, send, and resume; the two-minute limit pauses capture rather than discarding it. Restart erases only the current unsent local recording. Attach keeps the text draft and uploads through the existing attachment flow; send explicitly attaches and submits it. Backgrounding pauses capture. Leaving the Assistant, switching actors or workspaces, and disposal cancel the unsent recording. Async completion cannot attach or send into a different scope. Mobile assistant Markdown renders directly against the app background. Text, reasoning, and separate tool activity follow canonical persisted part order after history restoration. User messages keep their own bubble. Chat and Live both expose the shared quick-settings action. Regression coverage lives in the voice capture, composer dock, and transcript bubble tests underapps/mobile/test/features/assistant/.
Flash and Pro
Flash usesgemini-3.8-live; Pro uses gemini-3.8-live-extended-thinking
with high background reasoning. The chat response labels are now Flash/Pro;
existing saved Fast/Thinking preferences remain compatible. Live starts with that
preference and offers its own Flash/Pro control. Switching restarts authorization
and media capture, preserves the shared conversation, and uses a separate
resumption scope for each model.
Both models declare tools as NON_BLOCKING. Each incoming tool batch runs up to
four calls concurrently, so pending approval does not hold up independent reads.
Speech interruptions stop audio without falsely cancelling background tools;
provider cancellation IDs or disconnects end those calls. Flash omits thinkingConfig;
Pro never uses MINIMAL or function-response scheduling. Pro’s turnComplete
ends an utterance, while interactionStatus: IDLE finalizes the interaction.
The UI shows background work until that signal, allowing further speech and tools.
Both modes compress context at 100,000 tokens toward a 64,000-token window,
using more of the new models’ 131,072-token input capacity.
Proactive audio stays enabled by the provider. Camera and screen frames remain
opt-in, and mutation approval/cancellation checks still apply.
Before deploying this upgrade, apply
20260916100000_mira_live_38_models.sql through the database release process.
It registers model pricing and extends existing Live model allowlists. Without
these rows new sessions fail closed; they do not silently bill another model.
Production migration application is user-operated. Existing sessions keep their
original pricing snapshot. The installed @google/genai 2.22 SDK already supports
interaction status and asynchronous tool declarations.
Google’s migration guide
and Thinking guide
define the session contract. Rates come from the
pricing table.
First-party tools
Calendar reads require an explicit ISO date range of at most 31 days and return
at most 50 events to Gemini. Event creation validates timestamps and text lengths.
Model arguments cannot select a different workspace or calendar provider. Existing
calendar APIs enforce authentication and workspace permissions. Calendar tools
themselves require no additional schema changes.
The dashboard token has its own expanded tool declarations and instructions.
Legacy assistant voice clients retain their original tool catalog.
Task mutations and calendar creation wait for approval of an on-screen argument
preview. This is a user-interaction gate; server-side authorization remains the
security boundary. Calls are deduplicated by provider ID, cancellation includes
queued calls, and late cancelled results are not sent back or displayed. Stopping
a request cannot roll back a mutation already accepted by the server. Failed
mutations are not retried automatically; verify their result before retrying.
Recovery and billing
The client forwardssessionResumption.handle even with ephemeral authorization,
without supplying replacements for server-constrained tools or instructions.
GoAway schedules reconnection, and unexpected closure attempts recovery at most
three times. Explicit disconnect and unmount invalidate pending connections and
retries. Manual restart obtains fresh authorization. Paid dashboard sessions retain recovery handles in memory for the current billing
reservation only, so a fresh authorization cannot replay cumulative usage from a
previous reservation. Legacy unmetered consumers retain workspace/conversation
scoping through the existing session API.
Credit reservation and cumulative usage settlement remain on the live Next.js
backend. Rust is a future migration target, not the deployed API. The token route
is tracked in apps/tanstack-web/migration/route-overrides.json.
Verification
Fromapps/web, run focused Vitest tests under the dashboard assistant directory,
src/__tests__/assistant-live-token-routes.test.ts, and
src/__tests__/live/token-builder.test.ts. Run internal API live-tool tests from
packages/internal-api, followed by bun check at the root and bun run build
in apps/web.
Authenticated runtime acceptance requires a configured Gemini key, available AI
credits, and microphone permissions. Verify spoken input/output, interruption,
mute, camera/screen stop, task and calendar permission failures, approval/decline,
provider cancellation, reconnect, expiration, Flash/Pro switching, Pro background
status after an utterance, and export at desktop and mobile
sizes. Component or mocked protocol checks do not prove provider audio quality,
credit settlement, or authenticated production delivery.
Artifact panels replace the dashboard’s former server-loaded task and calendar insight slots. Full-view links preserve the active language; meeting links open the Meet app. Meeting creation checks the authenticated account’s verified email and provides a retry if account lookup fails. The live panel follows measured header and composer sizes as attachments, text, and narrow layouts change.
Platform forwards /api/v1/workspaces/:wsId/calendar/events and its event-detail path to the Calendar app. Calendar remains responsible for membership, manage_calendar, and event encryption. Keep these forwarding rules when changing dashboard artifacts or Live calendar tools; a missing rule returns a Platform HTML 404 before Calendar authorization runs. The empty chat reserves space for the composer, allowing welcome actions to scroll independently in compact panels.
Compact product panels
The Tasks artifact uses the same personal task feed as the Tasks app. A Personal context includes tasks across workspaces and applies personal overrides; a team context stays scoped to that workspace. Compact cards reuse Tasks label colors, priority icons, estimation mappings, and assignee avatars. Due-date filters and board links keep the task feed actionable. Search filters the loaded panel, and Show more reveals additional tasks without discarding the rest of the feed. Calendar shows a seven-day strip and an agenda, including events spanning multiple days. Finance keeps currencies separate and compares absolute wallet balances, marking negative values; totals reflect the displayed wallets. Meetings separates upcoming and past entries from the latest 30 records and keeps creation in an expandable form for eligible accounts. Each panel retains refresh, error recovery, and full-app navigation.Assistant-managed workspace
Useshow_workspace_artifact to open or update a panel. Its optional presentation carries a concise title plus search, taskStatus, currency, date, or itemIds filters. Scope captions and assistant explanation blocks are omitted so product cards have the space. Legacy descriptions and highlights remain accepted for compatibility but are not rendered. Calendar dates start a seven-day local range. Keep explanations in chat, grounded in tool data, and only use IDs already returned by data tools. Artifacts fetch their own authorized data; presentation text never grants access or changes source records.
Use manage_workspace with close_artifact, focus_artifact, close_all, or set_layout to manage screen space as the task changes. Opening a new panel automatically collapses expanded navigation; collapsed, hover, and hidden modes are preserved. Updating an existing panel leaves navigation alone. Opening or updating a panel without a layout preserves the current arrangement. Focusing retains that panel’s presentation and closes the others; closing all restores full-width chat. The user can still search, filter, refresh, open the full product, and close each artifact directly. Distinct theme-aware product accents distinguish task urgency, calendar days, wallet balances, and meetings.
For artifact orchestration, a successful UI command is complete: issue only the remaining requested actions and then answer. Replacing one panel uses close_artifact and show_workspace_artifact; focus_artifact deliberately closes the others. Opening a panel does not return its data to the model. Use a title-only presentation until a relevant data-read tool supplies facts; the panel itself displays authoritative counts and balances.
Chat capability discovery and reliable actions
Chat starts with a small discovery set.search_tools returns at most eight authorized matches plus focused domain guidance and activates them for the next step. select_tools supports a working set of at most twelve known operations. Add tool definitions, directory metadata, permission mapping, and an executor together; discovery indexes the directory automatically. This is progressive tool loading, not arbitrary code execution or automatic access to external MCP servers.
Workspace verification fails closed before context reads. Mutation permissions are resolved for the selected workspace, and operations retain that authorized workspace if another concurrent call changes context. The per-turn runtime ends repeated identical read/discovery/UI cycles and repeated failures. Gemini native search reports server:GOOGLE_SEARCH_WEB; recognize it alongside google_search before forcing another search, and do not retry a wrapper that already returned grounded sources. Identical task creations share their first result within a turn, including concurrent calls. This is not cross-request idempotency. Task creation saves creator, start/due dates, and estimates, then reads the saved task location. Assignment or readback failures return an incomplete result with the created ID; recover that task rather than inserting another. get_task and paginated search_tasks locate saved tasks in the current workspace. Existing label, project, assignee, and task mutation tools remain available.
Chat Calendar automation and event writes forward the authenticated request through the existing Calendar API, including selected Google/Microsoft destinations. It can inspect connection health, provide Google OAuth authorization, sync connected calendars, lock/unlock events, read schedulable tasks, and preview/apply scheduling. Apply requires a successful same-workspace/window preview in the current turn and uses safe apply; the Calendar service recomputes availability and rejects unresolved warnings. Provider authorization and locked commitments remain enforced by Calendar. These new automation tools are not exposed in legacy Live/Meet sessions without the corresponding authenticated execution path.
When debugging a reported false completion, inspect the stored tool result and returned task ID first, then read that ID in its recorded workspace. A chat confirmation or artifact opening alone is not evidence of a product write. Runtime verification of provider sync or scheduling requires an authorized test account; mocked tests only verify dispatch and failure handling.
Native search completion
Mira keepsgoogle_search as an executable function tool. Do not override it
with a provider-native tool in the main mixed tool set: Gemini maps required
tool choice to ANY, which can issue many server-side searches inside one
provider step without answering. The outer step guard cannot interrupt that
provider-step loop.
Explicit search requests require the search executor before proceeding. The
executor uses native Google search through the direct Google provider used by chat, with
automatic tool choice, a 30-second deadline, one provider step, and at most one
grounding retry. It requires grounding evidence and a nonempty final answer.
Other required workspace and task tools keep their required-tool policy.
Verify a real grounded answer and visible sources after orchestration changes;
mocked tool events alone are insufficient.
The search executor must use the configured direct Google connection, like the
chat route. Routing only search through AI Gateway adds a separate credit and
authentication dependency; a gateway 403 does not mean Google search is down.
Conversation chronology and native presentation
Assistant history stores the ordered provider content for every generation step inmetadata.ai.parts. Tool results update their original call slot, including failed
and unfinished calls; they do not move to completion order. The message content
column contains all text segments in order. History loading prefers these canonical
parts over legacy text/tool arrays, and only adjacent tool activity is grouped.
When metadata must be compacted, text spans reference the content column and tool
payload previews shrink while later timeline entries remain present. The fallback
omits the detailed context breakdown to prioritize conversation history. The
current schema allows 10 MiB of AI message metadata and exempts message content
from generic short-text limits. Old records
that already lost interleaving cannot have their original chronology reconstructed.
Explicit requests to show tasks, calendar, finance, or meetings activate the native
artifact opener directly. Follow-ups such as “show it in an artifact” use recent
conversation context. Product panels fetch their own data; a task-data read or
Markdown table must never be described as an opened artifact. Workspace resolution
still precedes presentation when a named workspace needs to be selected.
Reading retried tool chains
The collapsed action summary counts unresolved failed attempts, rather than all calls in a chain. A later successful call with the same tool name and normalized input changes the summary to “Completed after retry”. The original failed attempt remains expandable, labeled as recovered. Different inputs and missing inputs do not establish recovery. A logical failure output is not a successful retry; a later verified success can recover either a transport error or a logical failure. This outcome is derived from ordered message parts, so restoring a conversation produces the same summary; assistant prose is never used as proof of success. Presentation destinations such as “in the task panel” are not workspace names. An explicitly requested artifact can still open after repeated discovery calls, subject to the existing three-attempt artifact limit.Composer and session timeline
Mira keeps Live controls in the chat composer. Voice starts with text entry collapsed; opening text entry adds the prompt below the Live controls without hiding them. The shared conversation stays visible at every artifact layout size. Session start/end notices are canonicaldata-live-session parts and are restored alongside text and tool results. They describe session state, not a guarantee that an outstanding save has completed; save failures retain the existing retry notification.
Context bounds are described under Experience; media verification remains covered under Verification.
Shared Chat and Live personalization
Chat and both Live token endpoints usepackages/ai/src/chat/mira-prompt.ts for the same Mira identity, behavior, workspace context and scoped memory prompt. Live loads the authenticated user’s saved name, personality, tone, boundaries and memories on session creation; saved language, accent and speaking-pace preferences are passed to the model as instructions. These are behavioral preferences, not a separate selectable provider voice ID.
apps/web/src/lib/live/mira-prompt.ts adds only spoken-delivery and actual Live tool constraints. Do not restore a static “You are Mira” prompt or duplicate the Chat context loader. Live’s smaller tool catalog does not support Chat’s memory/settings writes: it must not claim to persist changes using session notes. Dashboard personalization is resolved before reserving credits, and a prompt-loading failure prevents an unpersonalized token from being minted. End and restart Live after changing saved preferences; an ongoing connection retains its session instructions.
Mira chat tool discovery
Mira chat uses AI SDKtoolSearch() with deferred tool definitions (AI SDK
7.0.107 or later). The first step exposes only the selected control tools.
Search results make matching capabilities available on the next model step;
searching does not perform the operation or approve a mutation. Explicit tool
selection remains supported for clients that already know the tool names.
The per-generation discovery adapter rechecks workspace permissions before each
step, while the existing executors authorize writes independently. A workspace
change during permission resolution fails closed. Forced artifact/workspace
steps and terminal loop guards retain their restricted tool sets. Definitions
are never mutated in the shared registry. This change applies to streamed Mira
chat; live voice retains its separate tool protocol.
Run the SDK-backed tests in packages/ai/src/tools/mira-sdk-tool-search.test.ts
when changing discovery. They exercise real SDK model steps with a mock provider,
including deferred loading, denied permissions, workspace changes, explicit
selection, and approval-gated writes. These tests do not replace authenticated
provider or meeting-invitation round trips.
Mobile text dock modes
Normal mobile Assistant text chat uses one floating bottom dock. Navigation mode shows the existing section icons with a chat-bubble primary action. Composing replaces that same slot with a single-row plus menu, prompt, microphone/send and hamburger primary action. The hamburger returns to navigation; it does not place navigation above the prompt. The draft and selection survive a toggle. Opening chat focuses the prompt; returning to navigation, opening the menu or microphone, leaving the page, and tapping outside release prompt focus and dismiss the IME. Both modes use the same default 52 logical pixel rail, theme-derived glass and outline; prompt height grows for accessible text. Reduced-motion settings remove mode animation. The anchored plus popover uses one matching glass surface and consistent icon/title rows for attachments, model, credit source and closing the prompt; existing per-attachment previews/removal remain available. Live mode keeps its explicit entry and transport behavior. This rule applies to normal native mobile text chat, not web chat or Live stage controls. Regression coverage is inassistant_morphing_dock_test.dart and
assistant_composer_dock_test.dart; installed-device appearance/keyboard checks
remain part of release verification.
Native mobile text sends and regeneration always use Thinking, including chats
restored from older Fast preferences and the legacy transport fallback. The mode
selector is intentionally absent; web and Live behavior are unchanged. Model
selection defaults to hiding locked or disabled models; users can reveal them
for inspection but cannot select them. Model and attachment sheets use the dock
glass material. Add attachments offers Files, Photos & Videos Library, and
Capture & Record. Camera photo/video capture appears on Android and iOS only;
recorded audio uses the existing microphone permission/recording flow. Cancelling
a system picker adds nothing. Regression coverage includes the native request
payload, stored preference migration, model default filter and source availability.
Root mobile destinations and Assistant share 12px horizontal insets, an 8px
bottom gap, and fixed 52px primary-action columns. A second column is reserved
on viewports at least 400px wide, regardless of whether an action is present.
Narrow phones keep secondary dock actions in the top navbar so five root
navigation targets retain at least 44px. Apps and Assistant use the same rail;
chat/navigation toggling changes content without moving the primary action.
The fixed empty action columns apply to the five root destinations (Home, Apps,
Assistant, Notifications, and Profile). Mini-app navigation intentionally keeps
its available width when it has no actions, including six-item docks on narrow
phones. Registered mini-app actions consume space only when present; secondary
actions remain reachable from the top navbar on narrow screens. The six-item
320px no-action regression checks that touch targets stay at least 44px; this
does not claim every possible mini-app/action combination has that width.
Native attachment requests retain the workspace version captured before opening
a picker or recording. They reject a workspace switch, including a switch back,
before decoding, adding a pending attachment, creating a chat, or starting an
upload. An upload already in flight retains its original workspace and does not
update a replacement composer. Voice send-now also checks the original scope.
Delayed file decoding and stale pre-timezone scope are covered by
assistant_chat_restore_test.dart.
Mobile Live calling surface
Mira Live uses the app background for its calling stage and transcript. Camera, microphone, text-entry and end-call actions are published as content of the existing shell-owned floating dock; the page creates no second control rail. The same dock material persists when switching between Chat input and Live controls. The stage reflects real connection and speaking state, respects reduced motion, and retains permission/recovery feedback. Camera is enabled only after connection, microphone toggling is disabled while connecting, and end-call remains available to cancel an in-progress connection. This presentation does not claim a provider-latency improvement or on-device model execution. Regression coverage:assistant_live_mode_view_test.dart and assistant_live_call_controls_test.dart cover narrow/landscape and enlarged-text layouts, real connection-state action availability, and the absence of a body-owned control rail. shared_navbar_large_text_test.dart exercises the actual shell at enlarged text size and verifies the same dock Material element survives Chat, Live, global-navigation and full-screen transitions.
Mobile draft editing and previews
The mobile prompt’s expansion control sits above Send. Full-screen editing uses that same draft controller and preserves its selection; returning restores the previous dock focus. Enter remains a newline. The editor has no Send action and keeps the existing upload/removal and guarded submission callbacks unchanged. Attachment previews sit above the prompt in both modes. Images and videos open media previews; audio opens playback controls without automatic playback. Uploading and failed attachments remain identified and removable. Previews are bounded and scrollable on narrow screens and at enlarged text sizes. Assistant settings and its field editors reuse the existing custom floating navigation for Back. Other settings frames retain their current navigation. Live-browsing, local-model and workspace-memory explanations open from labeled information buttons. Hardware, upload/download progress, errors and recovery controls remain visible; all original explanatory copy stays in the dialogs. Personality values use two-line previews with the full value retained for accessibility and field editing. The central Assistant tile waits for completed authentication; this presentation does not grant new permissions. Regression coverage:assistant_composer_draft_test.dart observes focused input
height, control order, draft/selection/focus return, preview state updates and
blocked submission. assistant_settings_ux_test.dart covers authentication
readiness; existing routed settings tests cover Back and safe-area clearance.
Widget evidence uses synthetic data and does not establish installed-device
performance, chat persistence, or provider operation.
Central mobile Mira settings
On mobile, Settings → Product settings → Assistant opens the same live-browsing preference used by Mira quick settings. The shared shell supplies the title and back dock; the editor adds no second navbar. The preference defaults to off and remains scoped to the signed-in actor and workspace. Switching either scope invalidates the open editor and prevents late reads or writes from publishing into the replacement scope. An unreadable preference shows retry without an editable guessed value; a failed save retains the last confirmed value. This surface configures the existing live-browsing setting only, not local-model installation or provider credentials. Regression coverage:assistant_settings_cubit_test.dart, assistant_settings_hub_test.dart, and assistant_preferences_test.dart cover persisted values, shared shell publication, failed reads/writes, and async scope invalidation.
Mobile tool ordering and session ownership
Mobile Live runs the currently declared workspace tools on the authenticated server API; only screen context is resolved locally. Tool batches execute in provider receipt order. Finalizing a turn waits for its pending tool results, including errors, before saving ordered text/tool parts. Both canonical Chat history and legacy Assistant history restore those parts without replaying tools. Provider text and output transcription are alternate streams: text takes priority when both are present, preventing duplicated replies. Each batch belongs to the actor, workspace, and connection generation captured when received. Disconnecting, replacing the session, or changing actor discards late output and prevents remaining calls from executing or reaching a new socket. An already dispatched server mutation cannot be undone by client cancellation. Starting a new typed turn keeps the completed previous turn’s original text and attachment metadata; its pending output cannot overwrite the new draft. Regression evidence lives inassistant_live_persistence_test.dart and
assistant_live_turn_parts_test.dart. These are lifecycle and metadata checks;
provider latency and live device connectivity require separate runtime evidence.
Mobile startup measurements
After the authenticated token arrives, mobile binds the owned conversation and initializes its native audio player concurrently. Both must finish before the provider socket is opened. A failure settles both operations; cancellation or an actor/workspace epoch change prevents later connection and timing publication. Native playback initialization and disposal retain their existing serial queue. Live state records monotonic millisecond durations for token minting, history binding, audio initialization, socket connection, provider readiness, and the whole attempt. These measurements contain no tokens, account identifiers, message content, or error payloads and are not uploaded automatically. Concurrent stage durations must not be added to estimate total latency. Failed attempts retain only completed phase timings; obsolete attempts publish none.assistant_live_startup_phases_test.dart verifies independent overlap, the
settle-all failure barrier, cancelled scope fencing, and immutable measurements.
The Live information action in the shared shell opens the existing info sheet.
It shows the most recent attempt’s recorded phase durations in milliseconds,
including partial failed attempts, in a fixed phase order. Missing phases are
omitted. Measurements stay in memory on the current device: no account IDs,
request IDs, credentials, message content, persistence, or automatic uploads.
History and audio run concurrently, so phase durations do not sum to total time.
The sheet scrolls on small screens and with enlarged text. Widget regression
coverage is in assistant_live_startup_diagnostics_test.dart.
This removes serial client-side waiting; actual device/provider speed remains a
runtime measurement rather than a promised fixed latency reduction.
Canonical mobile Live capabilities
New mobile clients request thecanonical-v1 tool protocol. The token response
selects the protocol; an absent or unsupported response value keeps the legacy
execution route. Existing clients keep legacy declarations and execution. A
canonical session discovers authorized operations through search_workspace_tools
and executes their validated input through execute_workspace_tool. Schemas come
from the same Mira registry used by Chat, so registered capabilities do not need
a second manually maintained mobile tool declaration list.
Every canonical request authenticates the actor, verifies workspace membership
and the voice tier, and executes through the canonical permission-aware factory.
This transport stays in the session workspace; workspace switching, interactive
rendered UI, and approval-gated tools are unavailable. Screen metadata remains a
local, opt-in capability. Discovery does not authorize a later request: execution
rechecks access. A tool error is retained as an error rather than represented as
a completed action. Provider call identifiers are preserved; this does not claim
network-wide mutation deduplication or cancellation of dispatched writes.
Resumption handles use protocol-specific, UUID-validated chat scopes so a
canonical connection cannot restore legacy tool declarations, or vice versa.
Both scopes still require ownership of the same conversation. The Rust GET
session port follows the same validation; web remains the production runtime.
canonical-tool-bridge.test.ts, the canonical execution route tests,
session-scope.test.ts, and assistant_live_repository_test.dart cover schema
validation, permissions, unavailable tools, scope separation, and compatibility.
Provider calls and latency still require authenticated runtime verification.
Mobile remote reply lifecycle
An admitted mobile Chat reply keeps streaming while the app is temporarily backgrounded and can complete or report its error before the user returns. Foreground admission still applies to new prompts, attachments, history actions, and Live controls. Account and workspace changes, including leaving and returning to the same identity, and an explicit local/remote mode change invalidate the old reply lease. Local runtime unload/reload alone does not invalidate that lease; selecting a local model still stops remote work before local interaction.assistant_background_reply_test.dart exercises the actual page and shell dock
through pause, completion/error, active resume, and account/workspace/mode ABA.
assistant_local_chat_cubit_test.dart verifies that semantic mode selection and
transient runtime epochs remain separate. These injected stream tests do not
guarantee that an operating system keeps a suspended app’s network connection
alive; device and provider delivery remain separate evidence.
A replacement prompt accepted before pause remains accepted while cancellation
of the previous reply finishes. The composer clears only that captured prompt
under the same durable account/workspace/mode and attachment lease; a newer
unsent edit remains intact. Account departure clears private drafts through the
existing account reset, and mode/account ABA refuses the stale replacement.
assistant_durable_acceptance_test.dart exercises deferred real cancellation,
pause/resume, newer edits, and mode/account refusal through the actual dock.
Mobile playback, transcript and call completion
The Live stage uses a layered gradient blob driven by the assistant’s signed 16-bit, little-endian 24 kHz mono PCM admitted to the native playback queue. Microphone input, text events and byte counts do not synthesize speaking energy. Spectrum work and visual updates are bounded; a native drained-buffer callback, interruption or teardown resets activity. Reduced motion keeps the shape static. These controls do not establish physical speaker output or provider/device timing. A received completed turn is sealed before waiting for tools, persistence or history refresh. Subsequent spoken turns receive distinct identities and remain in receipt order. Pending turns remain visible until scoped history confirms them; restored Live identities prevent duplicate pending/history rows and preserve order when server retries receive later timestamps. Failed synchronization stays marked as unsynchronized and retries use the same turn identity. A successful write does not remove the visible snapshot until restored history confirms every saved role for that exact turn, workspace and conversation. A failed history restore retries restoration without issuing another successful write. Pending snapshots are in memory; process termination does not guarantee recovery of unsaved content. Explicit End seals the currently observed partial turn before closing the call, keeps Live selected and presents centered Call again and View transcript actions. Calling again remains an explicit consent/admission action. Account, workspace and conversation epochs refuse stale persistence and End callbacks. Logout or other privacy teardown clears local drafts without flushing them to a remote conversation. Reconnect does not authorize an old actor’s work. Queued provider frames carry an internal connection generation and are checked at delivery; replacing or closing a connection also invalidates its raw listeners. A deferred old close cannot revive or close a newer connection. Disposal closes admission before native teardown awaits, clears retained retry closures and refuses new session, microphone, camera or screen-capture admission. Repeated disposal shares one completion; a native cleanup failure still closes the state and attempts the remaining cleanup. This is separate from explicit End, which may finish the current admitted turn. Connected controls use the same shell action button geometry and styling as the normal navbar, within its existing material. Buttons retain semantic toggle and busy states and use the shared haptic preference. Calling uses the branded pending indicator and respects reduced motion. No automatic sound is enabled by this presentation change. Regression coverage is inassistant_live_persistence_test.dart,
assistant_live_audio_player_test.dart, assistant_playback_spectrum_test.dart,
assistant_live_transcript_section_test.dart, assistant_live_post_call_view_test.dart,
assistant_live_history_confirmation_cases.dart, assistant_live_socket_test.dart
and the Live dock/calling widget tests. Device audio quality, suspended-process
survival and published mobile builds require separate delivery evidence.
Pinned local runtime configuration
On-device preparation resolves only the app-owned<catalog-id>.litertlm
filename after store integrity verification. The pinned Qwen 3 0.6B artifact
uses its publisher-declared 4096-token context; Gemma and SmolLM2 retain the
existing 2048-token configuration. CPU, general-model interpretation, one
concurrent session and 256 output tokens remain unchanged. The Qwen context
is documented by its immutable publisher README.
assistant_litert_configuration_test.dart checks actual adapter configuration,
unknown filename rejection, real import/verification through a fresh store,
saved selection reload and late native-result disposal after session ABA.
assistant_local_reselection_test.dart checks that held preparation is disposed
before the newest local choice activates. Synthetic bytes and native factories
prove persistence and configuration wiring only; they do not prove device
format compatibility or successful inference. Failed local prompts remain local
with visible recovery and never silently fall back to a remote provider.
Mobile name confirmation and offline intent
The mobile header uses the confirmed assistant name, with Mira as its display default when no verified snapshot exists. An offline rename keeps the confirmed header and records a separate local name intent. Queued, conflicted and failed intents remain available through the existing offline changes sheet; they are never automatically discarded or promoted to confirmed names. Explicit pending name presentation is a separate UI step. Verified Soul snapshots use an account-owned cache envelope. Legacy optimistic name caches are not evidence of server confirmation, and disappearance of a queue record alone does not confirm its value. A validated server receipt establishes confirmation. Account departure and cache-clear epochs fence held reads and writes, including same-account restoration. Genuine permission and transport errors remain errors on explicit refresh.assistant_soul_provenance_test.dart exercises real encrypted cache and queue
restart, all three pending statuses, held account/clear boundaries, malformed and
foreign receipts, permission failure, and the Shell header’s offline rename.
These tests establish source behavior, not device or deployed-runtime proof.