Genkit for Go 1.13.1

Apply the Go 1.27 baseline first. These rules cover Genkit for Go 1.13.1 models, tools, flows, experimental agents and middleware, resumable and detached work, HTTP and streaming surfaces, MCP, media downloads, A2UI, state, and telemetry.

Version and capability boundary

• Record github.com/firebase/genkit/go in go.mod and go.sum, and take Genkit fixes from newer releases after reading their notes. The module's Go 1.25.0 minimum is a build floor, not a promise of continuing Go 1.25 security support.
• Import the A2UI preview from github.com/firebase/genkit/go/plugins/a2ui/exp; do not deploy retracted 1.13.0, which shipped it at the non-exp path.
• Treat ai/exp, genkit/exp, plugins/middleware/exp, plugins/firebase/exp, and plugins/a2ui/exp as experimental contracts that may change in a minor release; pin the exact module, protocol, store, renderer, and client versions and test compatibility before upgrading.
• Inventory model, provider, retriever, evaluator, storage, stream-manager, middleware, and telemetry plugins separately and register only the capabilities each deployment needs.
• Fail startup when a required model, schema, tool, agent, middleware, catalog, store capability, or provider configuration is absent or resolves differently from reviewed policy.

Model, prompt, and output authority

• Construct genkit.Init, model references, system instructions, .prompt assets, tool and agent lists, middleware, provider endpoints, and runtime configuration from trusted server policy; finish shared registrations before serving requests and keep