MB721 — Gemini enters Mediabot through a guarded Floo connection 🔮

A new owl has reached the Mediabot tower.

MB721 introduces Google Gemini as a native third provider behind the shared Mediabot::AI::Client, adds the opt-in public !gemini command, extends Hailo’s provider-neutral post-editor, and updates the road to Mediabot 3.5.

The implementation was developed, tested and piloted on the development instance before being committed. Production services were not restarted or modified.

Commit: 00794c9fd5a8e60ef9187fe7ffc1720d17ed4cd1 Development version: 3.4dev-20260902_200411

A native Gemini provider 🪄

Gemini now joins Anthropic and OpenAI behind Mediabot’s common AI client.

The provider adapter handles:

• Google’s generateContent endpoint;
• the gemini-3.8-flash stable model by default;
• verified HTTPS transport;
• API authentication through the x-goog-api-key header;
• provider-neutral requests and normalized responses;
• explicit generation and timeout limits;
• safe Google error classification;
• asynchronous execution through Mediabot’s existing worker boundary.

An explicit Gemini request remains strictly Gemini. It never silently crosses to Anthropic or OpenAI.

The existing auto policy keeps its compatibility order:

1. Anthropic;
2. OpenAI;
3. Gemini.

Gemini is considered by auto only when it is configured. The API key remains exclusively in the private mediabot.conf; it is never placed in a request object, URL, log, repository file or operator artifact.

Thinking without losing the visible answer 🧠✨

Gemini 3.8 can spend part of its output budget on internal reasoning. Small limits may therefore produce a successful HTTP response without any visible text.

MB721 makes this behavior explicit:

• default thinking level: LOW;
• default IRC generation ceiling: 1024 tokens;
• bounded provider smoke ceiling: 2048 tokens;
• internal thought parts are never sent to IRC;
• thought text is never retained in diagnostics.

If Google returns HTTP 200 without visible text, Mediabot records only safe structural information such as:

• finish reason;
• prompt block reason;
• thought, candidate and total token counts;
• total, thought and visible-text part counts.

No prompt, response text, thought content, authentication header or credential enters that diagnostic evidence.

The public !gemini command 🔐

The new command is deliberately opt-in:

!gemini <prompt>

It is protected by a strict per-channel capability:

m chanset +Gemini

The +Gemini gate is the outermost command boundary. A channel where Gemini is disabled receives no syntax response, configuration notice or provider call. It cannot even use the command to discover whether a Gemini key exists.

The command also includes:

• a configurable prompt-size ceiling;
• bounded IRC output;
• UTF-8-aware message splitting;
• a maximum number of emitted PRIVMSG lines;
• paced delivery;
• per-nick and per-channel rate limiting;
• a single in-flight request for each conversation;
• aggregate request, error and rate-limit metrics.

The migration 20260902_gemini_chanset.sql only registers the Gemini capability. It enables no channel automatically.

The operator remains responsible for choosing the pilot channel:

m chanset +Gemini
!gemini Reply with one short sentence

It can be disabled just as explicitly:

m chanset -Gemini

Hailo gains another careful post-editor 🧙‍♂️

MB720 established Hailo’s isolated per-channel brains, reply-before-learn ordering and provider-neutral constrained post-editor.

MB721 extends that foundation: Hailo may now explicitly select Gemini through:

HAILO_POST_EDIT_PROVIDER=gemini

This does not change Hailo’s creative ownership of the answer.

The learned Hailo draft remains the anchor. Gemini may perform the same bounded, language-aware post-editing already defined by the MB720 policy, but it cannot replace Hailo with an unrelated generic assistant response.

If the provider is unavailable, rejects the request, returns malformed output or rewrites the draft too aggressively, Mediabot keeps the original sanitized Hailo candidate.

No automatic Hailo provider change is imposed by MB721. Existing installations retain their current provider and fallback behavior until an operator deliberately selects Gemini.

Development qualification ⚗️

The rollout was completed on the development instance with a real Gemini key kept outside the repository.

The final evidence includes:

• provider adapter and command contracts: 168/168 passed;
• complete fast lane: 6847/6847 passed;
• single final full suite: 18300/18300 passed;
• real bounded Gemini provider smoke: passed with gemini-3.8-flash;
• real opt-in IRC command response: passed;
• Gemini registry row: exactly one;
• pilot channel activation: exactly one;
• development service restart and stability gate: passed;
• all other active Mediabot services unchanged;
• production unchanged;
• repository and operator evidence scanned without detecting a secret value.

The final commit contains 24 files: 23 reviewed project paths plus the development VERSION update. The local commit.sh, private configuration, backups, logs and validation markers remain outside Git.

Updated road to Mediabot 3.5 🗺️

MB721 also removes a roadmap numbering collision and records Gemini as a completed development pilot.

The remaining path is now:

• MB721 — complete on development pilot: native Gemini provider, guarded public command, bounded live smoke and opt-in IRC pilot;
• MB722 — supported-instance convergence: deploy instances one at a time and complete a seven-day observation window without unexplained restarts, reconnect loops, persistent worker failures or schema drift;
• MB723 — mbweb boundary: decide and document whether mbweb is supported or experimental;
• MB724 — operational safeguards: update and exercise security, privacy, observability and restore gates;
• MB725 — Debian 13 qualification: validate a fresh installation and a representative 3.3-to-3.5 upgrade in disposable environments;
• MB726 — release documentation: align installation, update, database, systemd and release documentation, then reproduce and inspect the release archives;
• MB727 — final release gate: complete the soak, close every blocker, run the release candidate’s single final full suite and wait for an explicit operator decision.

Mediabot therefore remains on the 3.4dev line. MB721 is a substantial new capability, not an implicit 3.5 release.

Mischief managed — provider edition 🪄🔮

Gemini is now available without weakening Mediabot’s existing privacy and routing boundaries.

It enters through a guarded door, speaks only where invited, keeps its reasoning out of IRC, and can assist Hailo without stealing Hailo’s voice.

The Floo connection is open — but only on channels holding the right permission.