ltcai 1.1.0 → 1.2.0

package/README.md

@@ -36,6 +36,25 @@ Automatic knowledge graph
 Graph-aware chat, snapshots, memory, agents, workflows, skills, and timeline
 ```
 
+### New in 1.2.0: Server App Modularization
+
+- **server_app.py modularized** — Workspace/Organization and health/engine
+  endpoints extracted into dedicated routers (`latticeai/api/*`) backed by a
+  service layer (`latticeai/services/*`); `server_app` is now app assembly +
+  router include (~6,585 → ~5,948 lines)
+- **Routers / services split** — `create_workspace_router`,
+  `create_health_router`, `WorkspaceService`, `ModelService`, `ChatService`
+- **Workspace API service layer** — scope resolution and role/permission checks
+  centralized in `WorkspaceService`
+- **Workspace / org guardrails** — non-members can't read/write org data,
+  viewers can't write, owners/admins manage members; no-auth local owner
+  fallback preserved
+- **Health / model / chat modularization** — `/health`, `/mode`,
+  `/runtime_features`, `/engines` via the health router; chat trace recording
+  via the chat service (streaming behavior unchanged)
+- **Compatibility preserved** — `server:app` import path, all API routes, CLI,
+  Knowledge Graph / Admin / Security routers, and VS Code integration unchanged
+
 ### New in 1.1.0: Organization Workspace Foundation
 
 - **Organization Workspace** alongside Personal Workspace — create shared org

package/docs/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## [1.2.0] - 2026-05-31
+
+> Server app modularization (routers + service layer) and workspace/org guardrail hardening.
+
+### Changed
+
+- **server_app.py modularization (phase 2)** — reduced
+  `latticeai/server_app.py` from ~6,585 to ~5,948 lines by extracting the
+  Workspace OS / Organization API and the health/engine-summary endpoints into
+  dedicated routers backed by a new service layer. `server_app` now focuses on
+  app assembly, lifespan, middleware, and router include. The historical
+  `server:app` import path, all API paths, and request/response shapes are
+  unchanged.
+- **Workspace/Organization guardrails strengthened** — workspace-scoped reads
+  and writes now go through `WorkspaceService`, which gates explicitly-named
+  workspaces: non-members cannot read or write organization data, viewers
+  cannot write, members can write, and only owners/admins manage members. The
+  no-auth local-owner fallback for ownerless org workspaces is preserved, but a
+  *named* stranger never bypasses membership. `set_active_workspace` continues
+  to enforce membership.
+
+### Added
+
+- **New API routers** — `latticeai/api/workspace.py`
+  (`create_workspace_router`) and `latticeai/api/health.py`
+  (`create_health_router`), mirroring the existing auth/admin router-factory
+  convention (no import cycle: routers receive dependencies, never import the
+  app).
+- **New service layer** — `latticeai/services/workspace_service.py`
+  (`WorkspaceService`: scope resolution + permission guardrails),
+  `latticeai/services/model_service.py` (`ModelService`: health/engine summary
+  payloads), and `latticeai/services/chat_service.py` (`ChatService`: history +
+  answer-trace seam; the streaming chat path is unchanged and now records traces
+  through this façade).
+- **Shared-global areas made explicit** — the local knowledge graph and
+  installed skills remain machine-global shared state (not partitioned per
+  workspace); this is now surfaced in `WorkspaceService.SHARED_GLOBAL_AREAS`,
+  the `/workspace/os` summary (`shared_global_areas`), and code comments.
+- **Startup/modularization tests** — `tests/unit/test_server_app_modularization.py`
+  (import path, router registration, key route presence, no import cycle) and
+  `tests/unit/test_workspace_service.py` (read/write/member guardrails).
+
+### Notes
+
+- Release metadata aligned to `1.2.0`; `APP_VERSION` continues to derive from
+  `WORKSPACE_OS_VERSION` and `/health` reports `1.2.0`.
+- CI release hardening from 1.0.1/1.1.0 is retained (VSIX compile guard, Node.js
+  24, version-scoped artifact validation — no `dist/*` glob).
+
 ## [1.1.0] - 2026-05-31
 
 > Organization Workspace foundation, open-core Enterprise seam, and CI/release hardening.

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "1.1.0"
+__version__ = "1.2.0"

package/latticeai/api/health.py

@@ -0,0 +1,45 @@
+"""Health / status / engine-summary router.
+
+Extracted from ``server_app.py`` in v1.2.0. Paths unchanged: ``/health``,
+``/mode``, ``/runtime_features``, ``/engines`` (GET). Heavier engine *mutation*
+endpoints (install / verify-cloud / pull-model) stay in server_app for now.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Any, Callable, List, Optional
+
+from fastapi import APIRouter, Request
+
+
+def create_health_router(
+    *,
+    model_service,
+    engine_status: Callable[[], List[dict]],
+    get_current_user: Callable[[Request], Optional[str]],
+    require_auth: bool,
+    app_version: str,
+    app_mode: str,
+) -> APIRouter:
+    router = APIRouter()
+    svc = model_service
+
+    @router.get("/health")
+    async def health(request: Request):
+        base = svc.health_base(version=app_version, mode=app_mode)
+        if not get_current_user(request) and require_auth:
+            return base
+        engines = await asyncio.to_thread(engine_status)
+        return svc.health_full(base, engines)
+
+    @router.get("/mode")
+    @router.get("/runtime_features")
+    async def mode():
+        return svc.runtime()
+
+    @router.get("/engines")
+    async def engines():
+        return svc.engines_payload(await asyncio.to_thread(engine_status))
+
+    return router