chore: sync vzgpt-core with upstream ADK 2.9 lifecycle

.agents/skills/adk-architecture/references/interface-workflow.md

@@ -141,6 +141,13 @@ When `ctx.run_node()` is called, the scheduler checks three cases:
    - All resolved → re-execute with `resume_inputs` from the
      resolved function responses.
 
+4. **Agent Transfer** — if the child node is an agent that requests an
+   agent handoff (`child_ctx.actions.transfer_to_agent`), the scheduler
+   drives the sequential transfer loop. It resolves the target agent and
+   parent context, delegates single-step execution to the target context's
+   owning scheduler, and preserves output delegation (`use_as_output`)
+   when execution returns to the invoking context.
+
 State reconstruction is **lazy**: the scheduler scans session events
 only on the first `ctx.run_node()` call for a given path, not
 upfront. This avoids scanning for dynamic nodes that won't be

.github/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "2.8.0"
+  ".": "2.9.0"
 }

.github/release-please-config.json

@@ -57,5 +57,5 @@
       ]
     }
   },
-  "last-release-sha": "4d0d63c74cf161f90ef33c7b310b6fd6641d3249"
+  "last-release-sha": "b65be0155cd68b849809b9a13dc1eda8e43474f6"
 }

.github/workflows/continuous-integration.yml

@@ -14,16 +14,19 @@
 
 name: Continuous Integration
 
+# Release branches are listed alongside the development branches because a
+# release is cut to its own branch and published from there, so a branch left
+# out here ships without its tests ever having run.
 on:
   push:
-    branches: [main, v1]
+    branches: [main, v1, 'release/**']
     paths:
       - '**.py'
       - '.pre-commit-config.yaml'
       - 'pyproject.toml'
       - 'tests/**'
   pull_request:
-    branches: [main, v1]
+    branches: [main, v1, 'release/**']
     paths:
       - '**.py'
       - '.pre-commit-config.yaml'
@@ -179,10 +182,7 @@ jobs:
 
       - name: Run unit tests with pytest
         run: |
-          uv run pytest tests/unittests \
-            -n auto \
-            --ignore=tests/unittests/artifacts/test_artifact_service.py \
-            --ignore=tests/unittests/tools/google_api_tool/test_googleapi_to_openapi_converter.py
+          uv run pytest tests/unittests -n auto
 
   # 3b. Dual-version A2A coverage: This job pins a2a-sdk to 0.3.x and
   # runs only the A2A-related tests, so the a2a/_compat.py shim stays
@@ -232,5 +232,66 @@ jobs:
           uv pip install --reinstall-package a2a-sdk 'a2a-sdk>=0.3.4,<0.4'
           uv pip list
           uv run pytest tests/unittests/a2a \
-            tests/unittests/agents/test_remote_a2a_agent.py \
             tests/unittests/integrations/agent_registry/test_agent_registry.py
+
+  # 3c. Dual-version MCP coverage: the pin admits both SDK majors, but the lock
+  # resolves 1.x, so nothing else here ever exercises 2.x. This job reinstalls
+  # mcp 2.x and re-runs the MCP tests, keeping the dependencies seam verified
+  # against the major it is not resolved against by default.
+  # TODO: Remove this 2.x re-run once mcp 1.x support is dropped.
+  unit-test-mcp-v2:
+    name: MCP v2 Tests (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          enable-cache: true
+
+      - name: Set the dependency resolution cutoff
+        # PyPI uploads a release's wheels one platform at a time, so resolving
+        # mid-upload can select a version whose wheel for this interpreter does
+        # not exist yet and fail the install. Skip the last hour of releases.
+        run: echo "UV_EXCLUDE_NEWER=$(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"
+
+      - name: Install dependencies
+        run: |
+          uv venv .venv
+          source .venv/bin/activate
+          uv sync --extra test $SKIP_PACKAGE_FLAGS
+
+      - name: List installed packages (before reinstall)
+        run: uv pip list
+
+      - name: Run MCP tests against mcp v2
+        # --no-sync, or uv re-syncs the environment to uv.lock first and puts
+        # the locked 1.x back, leaving this job re-testing the major the job
+        # above already covers. The version assert makes that failure loud
+        # instead of a green run that proved nothing.
+        run: |
+          uv pip install --reinstall-package mcp 'mcp>=2,<3'
+          uv pip list
+          uv run --no-sync python -c "
+          import importlib.metadata as m
+          version = m.version('mcp')
+          assert version.startswith('2.'), f'expected mcp 2.x, got {version}'
+          print('testing against mcp', version)
+          "
+          uv run --no-sync pytest tests/unittests/tools/mcp_tool \
+            tests/unittests/tools/test_load_mcp_resource_tool.py \
+            tests/unittests/telemetry/test_spans.py

.github/workflows/release-cut.yml

@@ -67,12 +67,14 @@ jobs:
           fi
 
       # Action: CUT NEW RELEASE
+      # Full history and tags, so the step below can resolve the last release.
       - name: Checkout base ref (Cut)
         if: inputs.action == 'cut'
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.commit_sha || steps.config.outputs.base_ref }}
           token: ${{ secrets.RELEASE_PAT }}
+          fetch-depth: 0
 
       - name: Check for existing candidate branch (Cut)
         if: inputs.action == 'cut'
@@ -93,6 +95,60 @@ jobs:
           git push origin "$CANDIDATE_BRANCH"
           echo "Created and pushed branch: $CANDIDATE_BRANCH"
 
+      # The base branch only learns the released version from a merge-back that
+      # a maintainer has to land by hand, so it can sit behind for weeks. A
+      # stale copy makes the next release reuse a published version and rebuild
+      # a changelog that already shipped, so derive both from the last tag.
+      - name: Set release-please state from the last release tag (Cut)
+        if: inputs.action == 'cut' && inputs.branch == 'main'
+        env:
+          BASE_REF: ${{ steps.config.outputs.base_ref }}
+          CANDIDATE_BRANCH: ${{ steps.config.outputs.candidate_branch }}
+          CONFIG_FILE: ${{ steps.config.outputs.config_file }}
+          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
+          MANIFEST_FILE: ${{ steps.config.outputs.manifest_file }}
+        run: |
+          set -euo pipefail
+          git fetch --quiet --tags origin "$BASE_REF"
+
+          # The || true keeps a repo with no matching tag out of pipefail, so the
+          # empty case below is reachable.
+          LAST=$(git tag --list 'v[0-9]*' | sed 's/^v//' \
+            | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort --version-sort | tail -1 || true)
+          HAVE_VERSION=$(jq -r '.["."]' "$MANIFEST_FILE")
+
+          # This step only ever moves the state forward; anything else it leaves
+          # alone, so it can correct a release but never block one.
+          if [ -z "$LAST" ]; then
+            echo "::warning::Found no release tag, so the release-please state is unchecked."
+            exit 0
+          fi
+          NEWER=$(printf '%s\n%s\n' "$LAST" "$HAVE_VERSION" | sort --version-sort | tail -1)
+          if [ "$NEWER" != "$LAST" ]; then
+            echo "::warning::$MANIFEST_FILE says $HAVE_VERSION, ahead of the last release tag v$LAST. Leaving it alone."
+            exit 0
+          fi
+
+          # Where the last release branched off, which is what last-release-sha means.
+          SHA=$(git merge-base "origin/$BASE_REF" "v$LAST^{commit}")
+          HAVE_SHA=$(jq -r '."last-release-sha" // ""' "$CONFIG_FILE")
+          if [ "$HAVE_VERSION" = "$LAST" ] && [ "$HAVE_SHA" = "$SHA" ]; then
+            echo "$BASE_REF is already in sync with v$LAST"
+            exit 0
+          fi
+
+          echo "::warning title=Stale release-please state on $BASE_REF::$BASE_REF says $HAVE_VERSION / ${HAVE_SHA:0:8}, but the last release is $LAST / ${SHA:0:8}. Correcting the candidate branch; $BASE_REF itself still needs its merge-back."
+
+          jq --arg v "$LAST" '.["."] = $v' "$MANIFEST_FILE" > tmp.json && mv tmp.json "$MANIFEST_FILE"
+          jq --arg sha "$SHA" '. + {"last-release-sha": $sha}' "$CONFIG_FILE" > tmp.json && mv tmp.json "$CONFIG_FILE"
+
+          USER_JSON=$(gh api user)
+          git config user.name "$(echo "$USER_JSON" | jq -r '.login')"
+          git config user.email "$(echo "$USER_JSON" | jq -r '.id')+$(echo "$USER_JSON" | jq -r '.login')@users.noreply.github.com"
+          git add "$MANIFEST_FILE" "$CONFIG_FILE"
+          git commit -m "chore: pin release-please state to v$LAST"
+          git push origin "$CANDIDATE_BRANCH"
+
       # Action: REGENERATE EXISTING PR
       - name: Checkout existing candidate branch (Regenerate)
         if: inputs.action == 'regenerate'