docs: align capability matrix with 4.0.44 + fix tool-approval list

Adds BUDGET_ENFORCEMENT/CONFIDENCE_SCORES/PASSIVATION/MODEL_ENUMERATION/MULTI_AGENT_HANDOFF rows to the tutorial matrix; corrects the TOOL_APPROVAL list (Embabel and SK were wrongly excluded); updates the gateway-consumer count from "seven of nine" to all nine (verified by grep — every runtime calls admitThroughGateway); refreshes four pre-Koog/SK/AgentScope/Alibaba narrative enumerations to the current 9-runtime set.

Author: jfarcand

docs/src/content/docs/index.mdx

@@ -23,7 +23,7 @@ import { Card, CardGrid } from '@astrojs/starlight/components';
     `@ManagedService` with transport-agnostic Broadcaster pub/sub. WebSocket, SSE, long-polling, and gRPC — auto-negotiated per client. Rooms, presence, message history, and interceptors built in.
   </Card>
   <Card title="AI / LLM Platform" icon="star">
-    `@Agent` with pluggable `AgentRuntime` — auto-detects Spring AI, LangChain4j, Google ADK, or Embabel. Tool calling, conversation memory, filters, cost metering, and multi-model routing.
+    `@Agent` with pluggable `AgentRuntime` — auto-detects nine framework adapters (Spring AI, LangChain4j, Google ADK, Embabel, Koog, Semantic Kernel, AgentScope, Spring AI Alibaba) plus a built-in OpenAI-compatible client. Tool calling, conversation memory, filters, cost metering, and multi-model routing.
   </Card>
   <Card title="Multi-Agent Orchestration" icon="puzzle">
     `@Coordinator` + `@Fleet` for multi-agent systems. Parallel fan-out, sequential pipelines, and weighted routing. MCP, A2A, and AG-UI protocols for agent interoperability.

docs/src/content/docs/reference/ai.md

@@ -495,7 +495,7 @@ Default timeout: 5 minutes. Configurable via `@RequiresApproval(timeoutSeconds =
 
 When running on Google ADK, Atmosphere also calls `toolContext.requestConfirmation()` to give ADK native visibility into the approval pause. If ADK resolves a confirmation before Atmosphere (e.g., via its own UI), the ADK denial short-circuits without calling the executor. This creates a two-layer model: Atmosphere-level (cross-runtime) + ADK-native (runtime-specific).
 
-All runtimes with `TOOL_CALLING` also declare `AiCapability.TOOL_APPROVAL` (Built-in, Spring AI, LangChain4j, ADK, Koog). SK and Embabel are excluded: SK because its tool bridge is deferred; Embabel because it has no tool-calling path.
+All runtimes with `TOOL_CALLING` also declare `AiCapability.TOOL_APPROVAL` (Built-in, Spring AI, LangChain4j, ADK, Embabel, Koog, Semantic Kernel). AgentScope and Spring AI Alibaba are excluded because their underlying SDKs lack a native tool-call dispatch loop.
 
 ## Context Compaction SPI
 

docs/src/content/docs/tutorial/09-ai-endpoint.md

@@ -110,7 +110,7 @@ Key observations:
 
 1. **`@Ready` and `@Disconnect`** work the same as in `@ManagedService` -- they handle connection lifecycle.
 2. **`@Prompt`** receives the user's raw message and a `StreamingSession`.
-3. **`session.stream(message)`** sends the message to the resolved AI backend and streams the response back. This is the simplest way to invoke the LLM -- the framework resolves the correct adapter (Spring AI, LangChain4j, ADK, or built-in) automatically.
+3. **`session.stream(message)`** sends the message to the resolved AI backend and streams the response back. This is the simplest way to invoke the LLM -- the framework resolves the correct adapter (any of the nine `AgentRuntime` implementations: Spring AI, LangChain4j, ADK, Embabel, Koog, Semantic Kernel, AgentScope, Spring AI Alibaba, or the built-in OpenAI-compatible client) automatically via `ServiceLoader`.
 4. **Demo fallback** -- if no API key is configured, the sample uses `DemoResponseProducer` to simulate streaming. This pattern is useful for local development without an API key.
 5. **System prompt** -- loaded once at startup from `prompts/system-prompt.md` on the classpath via `PromptLoader`.
 

docs/src/content/docs/tutorial/11-ai-adapters.md

@@ -1,6 +1,6 @@
 ---
 title: "AI Framework Adapters"
-description: "Plugging Spring AI, LangChain4j, Google ADK, and Embabel into Atmosphere's streaming infrastructure"
+description: "Plugging Spring AI, LangChain4j, Google ADK, Embabel, Koog, Semantic Kernel, AgentScope, and Spring AI Alibaba into Atmosphere's streaming infrastructure"
 sidebar:
   order: 11
 ---
@@ -46,7 +46,7 @@ var request = ChatCompletionRequest.builder(settings.model())
 settings.client().streamChatCompletion(request, session);
 ```
 
-The built-in client is what powers `session.stream(message)` inside `@AiEndpoint`. If you need framework-specific features (Spring AI advisors, LangChain4j tool loops, ADK agent orchestration, Embabel agent planning), use one of the adapter modules below.
+The built-in client is what powers `session.stream(message)` inside `@AiEndpoint`. If you need framework-specific features (Spring AI advisors, LangChain4j tool loops, ADK agent orchestration, Embabel agent planning, Koog graph strategies, Semantic Kernel kernel hooks, AgentScope ReAct agents, or Spring AI Alibaba runnable configs), use one of the adapter modules below.
 
 ## Runtimes
 
@@ -80,18 +80,25 @@ This table mirrors the exact `Set<AiCapability>` each runtime's `capabilities()`
 | `CONVERSATION_MEMORY` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | `PER_REQUEST_RETRY`   | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | `TOKEN_USAGE`         | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |  — |
+| `BUDGET_ENFORCEMENT`  | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| `CONFIDENCE_SCORES`   | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | `CANCELLATION`        |  — |  — |  — |  — |  — | ✅ |  — | ✅ |  — |
+| `PASSIVATION`         | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 | `VISION`              | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |  — |  — |  — |
 | `MULTI_MODAL`         | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |  — |  — |  — |
 | `AUDIO`               | ✅ | ✅ | ✅ | ✅ |  — | ✅ |  — |  — |  — |
 | `PROMPT_CACHING`      | ✅ | ✅ | ✅ | ✅ |  — | ✅ |  — |  — |  — |
 | `AGENT_ORCHESTRATION` |  — |  — |  — | ✅ | ✅ | ✅ |  — |  — |  — |
 | `TOOL_CALL_DELTA`     | ✅ |  — |  — |  — |  — |  — |  — |  — |  — |
+| `MODEL_ENUMERATION`   |  — |  — |  — |  — |  — |  — |  — |  — |  — |
+| `MULTI_AGENT_HANDOFF` |  — |  — |  — |  — |  — |  — |  — |  — |  — |
 
 **Legend:**
 - ✅ Declared in `capabilities()` and honored at runtime
 - — Not declared. Either the framework's native API does not expose the feature, or the bridge has not threaded it through yet.
 
+The full `AiCapability` enum has 20 values. `MODEL_ENUMERATION` and `MULTI_AGENT_HANDOFF` are forward-looking SPI slots — the enum entries exist so callers can probe for them, but no runtime declares them today. `MULTI_AGENT_HANDOFF` is currently surfaced through the coordinator/handoff path (`session.handoff()`, `AiEvent.Handoff`) rather than a per-runtime capability flag.
+
 ### Why the baseline is so high
 
 The first three rows plus `CONVERSATION_MEMORY` and `PER_REQUEST_RETRY` are universal across all nine runtimes because `AbstractAgentRuntime` and the pipeline layer implement them once and every runtime that extends or delegates to them inherits the behavior. The framework builds the default, the adapter only plugs in where it differs. `TOOL_CALLING` / `TOOL_APPROVAL` reach the seven adapters that have a tool-call surface in their underlying SDK; `AgentScope` and `Spring AI Alibaba` lack a native dispatch loop today (tools must be invoked manually). `TOKEN_USAGE` reaches eight of nine — `Spring AI Alibaba` has no usage record on `ReactAgent.call()` in `1.1.2.2`.

docs/src/content/docs/tutorial/26-foundation-primitives.md

@@ -77,14 +77,13 @@ installed via `AiGatewayHolder.install(...)`; every
 `*AgentRuntime.doExecute` / `doExecuteWithHandle` calls
 `admitThroughGateway(context)` before native dispatch.
 
-- **Consumer** — seven of the nine runtimes consume the gateway:
-  `BuiltInAgentRuntime.java:79,98`, `SpringAiAgentRuntime.java:104`,
-  `LangChain4jAgentRuntime.java:147`, `AdkAgentRuntime.java:292`,
-  `SemanticKernelAgentRuntime.java:118`, `EmbabelAgentRuntime.kt:110`,
-  `KoogAgentRuntime.kt:103,165`. The two newer runtimes
-  (`AgentScopeAgentRuntime`, `SpringAiAlibabaAgentRuntime`) do not yet
-  call `admitThroughGateway` — gateway adoption on those is a tracked
-  follow-up.
+- **Consumer** — all nine runtimes consume the gateway. Each of
+  `BuiltInAgentRuntime`, `SpringAiAgentRuntime`,
+  `LangChain4jAgentRuntime`, `AdkAgentRuntime`,
+  `SemanticKernelAgentRuntime`, `EmbabelAgentRuntime`,
+  `KoogAgentRuntime`, `AgentScopeAgentRuntime`, and
+  `SpringAiAlibabaAgentRuntime` calls `admitThroughGateway(context)`
+  on its dispatch path before reaching the native SDK.
 - **Sample** — every sample implicitly exercises it; nothing dispatches
   an LLM without admission.