ltcai 10.6.3 → 10.8.0

package/latticeai/api/auth.py

@@ -9,10 +9,11 @@ from dataclasses import dataclass
 from typing import Any, Awaitable, Callable, Dict, Optional
 from urllib.parse import urlencode
 
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Request
 from fastapi.responses import JSONResponse, RedirectResponse
 from pydantic import BaseModel
 
+from latticeai.core.messages import DEFAULT_LANGUAGE, http_error, resolve_language
 from latticeai.core.oidc import (
     OIDCValidationError,
 )
@@ -92,18 +93,16 @@ def create_auth_router(
 ) -> APIRouter:
     router = APIRouter()
 
-    def _enforce_password_policy(password: str) -> None:
+    def _enforce_password_policy(password: str, language: str = DEFAULT_LANGUAGE) -> None:
         # Real policy (v4): length >= 8 with letters AND digits. A 4-char
         # minimum was not a policy.
         pw = str(password or "")
         if len(pw) < 8 or not any(c.isalpha() for c in pw) or not any(c.isdigit() for c in pw):
-            raise HTTPException(
-                status_code=400,
-                detail="비밀번호는 8자 이상이며 영문자와 숫자를 모두 포함해야 합니다.",
-            )
+            raise http_error(400, "auth.password_too_weak", language)
 
     @router.post("/register")
     async def register(req: UserRegister, request: Request):
+        lang = resolve_language(request)
         check_ip_rate_limit(client_ip(request), "register", max_calls=5, window_secs=3600)
         invite_claim = bool(
             invite_gate_enabled
@@ -111,19 +110,16 @@ def create_auth_router(
             and invite_authorized(request)
         )
         if invite_gate_enabled and not invite_claim:
-            raise HTTPException(
-                status_code=403,
-                detail="유효한 서명 초대 권한이 필요합니다.",
-            )
+            raise http_error(403, "auth.invitation_required", lang)
         # Closed public registration stays closed unless the operator enabled
         # the invite gate and this exact request carries a valid signed claim.
         if not open_registration and not invite_claim:
-            raise HTTPException(status_code=403, detail="회원가입이 비활성화되어 있습니다. 관리자에게 문의하세요.")
-        _enforce_password_policy(req.password)
+            raise http_error(403, "auth.registration_disabled", lang)
+        _enforce_password_policy(req.password, lang)
         email = normalize_email(req.email)
         users = load_users()
         if email in users:
-            raise HTTPException(status_code=400, detail="이미 존재하는 이메일입니다.")
+            raise http_error(400, "auth.email_taken", lang)
         role = "admin" if not users else "user"
         users[email] = {
             "password": hash_password(req.password),
@@ -140,14 +136,15 @@ def create_auth_router(
 
     @router.post("/login")
     async def login(req: UserLogin, request: Request):
+        lang = resolve_language(request)
         check_ip_rate_limit(client_ip(request), "login", max_calls=10, window_secs=300)
         email = normalize_email(req.email)
         users = load_users()
         user = users.get(email)
         if not user or not verify_and_migrate(email, req.password, user.get("password", ""), users):
-            raise HTTPException(status_code=401, detail="이메일 또는 비밀번호가 틀렸습니다.")
+            raise http_error(401, "auth.bad_credentials", lang)
         if user.get("disabled"):
-            raise HTTPException(status_code=403, detail="비활성화된 계정입니다.")
+            raise http_error(403, "auth.account_disabled", lang)
         role = get_user_role(email, users)
         token = create_session(email)
         response = JSONResponse(content={
@@ -174,10 +171,11 @@ def create_auth_router(
 
     @router.get("/auth/sso/login")
     async def sso_login(request: Request):
+        lang = resolve_language(request)
         settings = get_sso_settings()
         discovery = await get_sso_discovery()
         if not settings.get("enabled") or not discovery:
-            raise HTTPException(status_code=503, detail="SSO가 설정되지 않았습니다.")
+            raise http_error(503, "sso.not_configured", lang)
         state = secrets.token_urlsafe(16)
         nonce = secrets.token_urlsafe(16)
         # PKCE (S256): bind the token exchange to this login, so an
@@ -214,16 +212,17 @@ def create_auth_router(
         return RedirectResponse(f"{discovery['authorization_endpoint']}?{params}")
 
     @router.get("/auth/sso/callback")
-    async def sso_callback(code: str = "", state: str = "", error: str = ""):
+    async def sso_callback(request: Request, code: str = "", state: str = "", error: str = ""):
+        lang = resolve_language(request)
         entry = _sso_states.pop(state, None)
         if entry is None or time.time() - entry.issued_at > 300:
-            raise HTTPException(status_code=400, detail="유효하지 않은 SSO 상태입니다.")
+            raise http_error(400, "sso.invalid_state", lang)
         if error:
             return RedirectResponse(f"/?{urlencode({'sso_error': error})}")
         settings = get_sso_settings()
         discovery = await get_sso_discovery()
         if not settings.get("enabled") or not discovery:
-            raise HTTPException(status_code=503, detail="SSO 설정 오류입니다.")
+            raise http_error(503, "sso.config_error", lang)
         import httpx as _httpx
         async with _httpx.AsyncClient() as c:
             r = await c.post(discovery["token_endpoint"], data={
@@ -237,7 +236,7 @@ def create_auth_router(
             tokens = r.json()
         id_token = tokens.get("id_token")
         if not id_token:
-            raise HTTPException(status_code=400, detail="ID 토큰을 받지 못했습니다.")
+            raise http_error(400, "sso.no_id_token", lang)
         # Never trust a decoded JWT payload: verify signature (against the
         # provider JWKS), issuer, audience, expiry and the login nonce before
         # using any claim. Any failure is fail-closed (401).
@@ -253,20 +252,17 @@ def create_auth_router(
             )
         except OIDCValidationError as exc:
             logging.warning("SSO ID token rejected: %s", exc)
-            raise HTTPException(status_code=401, detail="SSO 토큰 검증에 실패했습니다.")
+            raise http_error(401, "sso.token_verification_failed", lang)
         except Exception as exc:  # discovery/JWKS fetch failure → fail closed
             logging.warning("SSO token validation error: %s", exc)
-            raise HTTPException(status_code=502, detail="SSO 공급자 검증에 실패했습니다.")
+            raise http_error(502, "sso.provider_verification_failed", lang)
         email = normalize_email(payload.get("email") or payload.get("preferred_username") or payload.get("upn") or "")
         if not email:
-            raise HTTPException(status_code=400, detail="이메일을 확인할 수 없습니다.")
+            raise http_error(400, "sso.email_unavailable", lang)
         users = load_users()
         if email not in users:
             if invite_gate_enabled and not entry.invite_authorized:
-                raise HTTPException(
-                    status_code=403,
-                    detail="신규 SSO 계정에는 유효한 서명 초대 권한이 필요합니다.",
-                )
+                raise http_error(403, "sso.invitation_required", lang)
             is_first = len(users) == 0
             users[email] = {
                 "password": "",
@@ -280,7 +276,7 @@ def create_auth_router(
                 ensure_identity(email, users[email])
             save_users(users)
         if users[email].get("disabled"):
-            raise HTTPException(status_code=403, detail="비활성화된 계정입니다.")
+            raise http_error(403, "auth.account_disabled", lang)
         token = create_session(email)
         resp = RedirectResponse("/app", status_code=302)
         resp.set_cookie(
@@ -309,33 +305,35 @@ def create_auth_router(
 
     @router.post("/account/change-password")
     async def change_password(req: ChangePasswordRequest, request: Request):
+        lang = resolve_language(request)
         email = normalize_email(require_user(request))
         if not email:
-            raise HTTPException(status_code=401, detail="인증이 필요합니다.")
-        _enforce_password_policy(req.new_password)
+            raise http_error(401, "auth.login_required", lang)
+        _enforce_password_policy(req.new_password, lang)
         users = load_users()
         user = users.get(email)
         if not user:
-            raise HTTPException(status_code=404, detail="사용자를 찾을 수 없습니다.")
+            raise http_error(404, "auth.user_not_found", lang)
         if not verify_and_migrate(email, req.current_password, user.get("password", ""), users):
-            raise HTTPException(status_code=401, detail="현재 비밀번호가 틀렸습니다.")
+            raise http_error(401, "auth.current_password_wrong", lang)
         users[email]["password"] = hash_password(req.new_password)
         save_users(users)
         return {"status": "ok", "message": "비밀번호가 변경되었습니다."}
 
     @router.patch("/account/profile")
     async def update_profile(req: UpdateProfileRequest, request: Request):
+        lang = resolve_language(request)
         email = normalize_email(require_user(request))
         if not email:
-            raise HTTPException(status_code=401, detail="인증이 필요합니다.")
+            raise http_error(401, "auth.login_required", lang)
         if req.name is not None and not req.name.strip():
-            raise HTTPException(status_code=400, detail="이름을 입력해주세요.")
+            raise http_error(400, "auth.name_required", lang)
         if req.nickname is not None and not req.nickname.strip():
-            raise HTTPException(status_code=400, detail="닉네임을 입력해주세요.")
+            raise http_error(400, "auth.nickname_required", lang)
         users = load_users()
         user = users.get(email)
         if not user:
-            raise HTTPException(status_code=404, detail="사용자를 찾을 수 없습니다.")
+            raise http_error(404, "auth.user_not_found", lang)
         if req.name is not None:
             users[email]["name"] = req.name.strip()
         if req.nickname is not None:
@@ -345,15 +343,16 @@ def create_auth_router(
 
     @router.get("/account/profile")
     async def get_profile(request: Request):
+        lang = resolve_language(request)
         email = normalize_email(require_user(request))
         if not email:
             if require_auth:
-                raise HTTPException(status_code=401, detail="인증이 필요합니다.")
+                raise http_error(401, "auth.login_required", lang)
             return {"email": "", "name": "Local User", "nickname": "You", "role": "admin", "is_admin": True}
         users = load_users()
         user = users.get(email)
         if not user:
-            raise HTTPException(status_code=404, detail="사용자를 찾을 수 없습니다.")
+            raise http_error(404, "auth.user_not_found", lang)
         role = get_user_role(email, users)
         return {"email": email, "name": user.get("name", ""), "nickname": user.get("nickname", ""),
                 "role": role, "is_admin": role == "admin"}

package/latticeai/api/automation_intelligence.py

@@ -44,6 +44,65 @@ class AutomationRunNowRequest(BaseModel):
     dry_run: bool = True
 
 
+def _ensure_activity_run_source(run: Any) -> dict[str, Any]:
+    """Guarantee the Act feed ``source`` field for 레시피/목표 badge split.
+
+    Capture 09 (``frontend/src/pages/Act.tsx``) distinguishes workflow vs agent
+    with ``run.source === "workflow" || Boolean(run.workflow_id)``. A store that
+    omits both collapses every row to "목표" and silently undoes the merged
+    timeline redesign. Prefer an explicit ``source``; otherwise infer from
+    ``workflow_id`` / ``agent_id``.
+    """
+    if not isinstance(run, dict):
+        return {"source": "agent", "id": None, "title": "", "status": ""}
+    row = dict(run)
+    source = str(row.get("source") or "").strip().lower()
+    if source in {"workflow", "agent"}:
+        row["source"] = source
+        return row
+    if row.get("workflow_id"):
+        row["source"] = "workflow"
+        return row
+    if row.get("agent_id"):
+        row["source"] = "agent"
+        return row
+    # Last resort: keep any non-empty legacy value, else agent.
+    row["source"] = source if source else "agent"
+    return row
+
+
+def _with_run_truncation_meta(payload: Any, *, capped: int) -> dict[str, Any]:
+    """Guarantee ``total`` / ``truncated`` on combined-run payloads.
+
+    Stores that already implement :meth:`list_combined_runs` may return only
+    ``runs``. The Act feed needs to say how many rows are hidden when the
+    server slices agent+workflow history (default cap 20).
+
+    Every run is also passed through :func:`_ensure_activity_run_source` so the
+    레시피/목표 badge never loses its discriminator.
+    """
+    if not isinstance(payload, dict):
+        return {"runs": [], "total": 0, "truncated": False}
+    runs = [_ensure_activity_run_source(run) for run in (payload.get("runs") or [])]
+    if "total" in payload:
+        try:
+            total = max(0, int(payload.get("total") or 0))
+        except (TypeError, ValueError):
+            total = len(runs)
+    else:
+        total = len(runs)
+    if "truncated" in payload:
+        truncated = bool(payload.get("truncated"))
+    else:
+        truncated = total > len(runs) or total > capped
+    # Prefer the larger of declared total and visible rows so a buggy store
+    # never claims fewer total than the list it just returned.
+    total = max(total, len(runs))
+    if total > len(runs):
+        truncated = True
+    return {**payload, "runs": runs, "total": total, "truncated": truncated}
+
+
 def _run_now_wait_seconds() -> float:
     raw = os.environ.get("LATTICEAI_AUTOMATION_RUN_NOW_WAIT", "30")
     try:
@@ -283,6 +342,59 @@ def create_automation_intelligence_router(
             payload["review_item_id"] = review_item.get("id")
         return payload
 
+    def _combined_runs(request: Request, limit: int = 20) -> dict[str, Any]:
+        require_user(request)
+        scope = gate_read(request)
+        capped = max(1, min(int(limit or 20), 100))
+        if hasattr(store, "list_combined_runs"):
+            payload = store.list_combined_runs(limit=capped, workspace_id=scope)
+            return _with_run_truncation_meta(payload, capped=capped)
+        # Store without the helper: merge the two existing listings in place.
+        agent_listing = (
+            store.list_agents(workspace_id=scope)
+            if hasattr(store, "list_agents")
+            else {"runs": []}
+        )
+        # Pull a wide window so agent+workflow merge can still fill ``capped``
+        # after sort; true total is the unscoped merge size before slice.
+        workflow_listing = (
+            store.list_workflow_runs(limit=max(capped, 100), workspace_id=scope)
+            if hasattr(store, "list_workflow_runs")
+            else {"runs": []}
+        )
+        from latticeai.core.workspace_runs import WorkspaceRuns
+
+        rows = []
+        for run in agent_listing.get("runs") or []:
+            rows.append(
+                _ensure_activity_run_source(
+                    WorkspaceRuns.activity_run_row(run, source="agent")
+                )
+            )
+        for run in workflow_listing.get("runs") or []:
+            rows.append(
+                _ensure_activity_run_source(
+                    WorkspaceRuns.activity_run_row(run, source="workflow")
+                )
+            )
+        rows.sort(key=lambda row: str(row.get("started_at") or ""), reverse=True)
+        total = len(rows)
+        return {
+            "runs": rows[:capped],
+            "total": total,
+            "truncated": total > capped,
+        }
+
+    @router.get("/api/activity/runs")
+    async def activity_runs(request: Request, limit: int = 20):
+        """Unified agent + workflow run timeline (layout rebuild screen 09)."""
+        return _combined_runs(request, limit=limit)
+
+    @router.get("/automations/runs/combined")
+    async def automations_runs_combined(request: Request, limit: int = 20):
+        """Alias used by the frontend handoff for the same combined timeline."""
+        return _combined_runs(request, limit=limit)
+
     return router
 
 

package/latticeai/api/browser.py

@@ -29,6 +29,7 @@ from pydantic import BaseModel
 from lattice_brain.ingestion import IngestionItem, capture_quality_verdict
 from latticeai import __version__
 from latticeai.api.workspace_scope import resolve_workspace_scope
+from latticeai.core.messages import DEFAULT_LANGUAGE, http_error, resolve_language
 from latticeai.core.quiet import quiet
 
 MAX_TAB_BYTES = 4 * 1024 * 1024          # 4 MB per captured tab payload
@@ -395,9 +396,9 @@ def create_browser_router(
     router = APIRouter()
     _fetch = fetch_url or _default_fetch_url
 
-    def _require_pipeline():
+    def _require_pipeline(language: str = DEFAULT_LANGUAGE):
         if pipeline is None or not pipeline.available():
-            raise HTTPException(status_code=503, detail="Knowledge Graph ingestion is disabled.")
+            raise http_error(503, "capture.ingestion_disabled", language)
 
     def _write_workspace(request: Request, body_workspace: Optional[str], user: str) -> Optional[str]:
         return resolve_workspace_scope(
@@ -412,7 +413,7 @@ def create_browser_router(
     async def read_url(req: ReadUrlRequest, request: Request):
         """Fetch a public URL locally and ingest it as a web_url source."""
         user = require_user(request)
-        _require_pipeline()
+        _require_pipeline(resolve_language(request))
         workspace_id = _write_workspace(request, req.workspace_id, user)
         url = _validate_http_url(req.url)
         try:
@@ -443,7 +444,7 @@ def create_browser_router(
     async def ingest_current_tab(req: IngestTabRequest, request: Request):
         """Ingest a payload captured from the local browser extension."""
         user = require_user(request)
-        _require_pipeline()
+        _require_pipeline(resolve_language(request))
         workspace_id = _write_workspace(request, req.workspace_id, user)
         url = _validate_http_url(req.url)
         # Bound the entire capture, not merely each field independently. The
@@ -462,14 +463,14 @@ def create_browser_router(
             if value
         )
         if captured_bytes > max_tab_bytes:
-            raise HTTPException(status_code=413, detail="Captured payload is too large.")
+            raise http_error(413, "capture.payload_too_large", resolve_language(request))
         text = (req.text or "").strip()
         if not text and req.html:
             _title, text = extract_readable_text(req.html)
         if not text:
             text = (req.selected_text or "").strip()
         if not text:
-            raise HTTPException(status_code=400, detail="No text, html, or selected_text provided.")
+            raise http_error(400, "capture.nothing_to_capture", resolve_language(request))
         res = pipeline.ingest(
             IngestionItem(
                 source_type="browser_tab",

package/latticeai/api/knowledge_graph.py

@@ -6,6 +6,7 @@ remains as a deprecation shim. Route paths and response shapes are frozen by
 data endpoints back the v3 SPA (Files, Hybrid Search, graph explorer).
 """
 
+from datetime import datetime
 from pathlib import Path
 from typing import Any, Callable, Dict, List, Optional
 
@@ -18,6 +19,7 @@ from latticeai.api.workspace_scope import (
     resolve_workspace_scope,
     workspace_scope_from_request,
 )
+from latticeai.core.quiet import quiet
 
 
 class KnowledgeGraphIngestRequest(BaseModel):
@@ -71,6 +73,25 @@ def _format_context(matches: list, limit: int) -> str:
     return "\n".join(lines)
 
 
+def _pipeline_stage_view(*, count: int, pending: int) -> Dict[str, Any]:
+    """Derive a coherent journey-ribbon stage from count + pending.
+
+    Invariants (enforced for layout-rebuild Capture screen 11):
+    - ``pending > 0`` → ``working``
+    - ``pending == 0`` and ``count > 0`` → ``done`` (never ``waiting``)
+    - ``pending == 0`` and ``count == 0`` → ``waiting`` (nothing arrived yet)
+    """
+    safe_count = max(0, int(count))
+    safe_pending = max(0, int(pending))
+    if safe_pending > 0:
+        status = "working"
+    elif safe_count > 0:
+        status = "done"
+    else:
+        status = "waiting"
+    return {"count": safe_count, "pending": safe_pending, "status": status}
+
+
 def create_knowledge_graph_router(
     *,
     get_graph: Callable[[], Any],
@@ -248,6 +269,118 @@ def create_knowledge_graph_router(
     async def knowledge_graph_stats(request: Request):
         return _scoped_stats(request)
 
+    @router.get("/knowledge-graph/pipeline/status")
+    async def knowledge_graph_pipeline_status(request: Request):
+        """Per-stage counts + status for the Capture 3-step journey ribbon.
+
+        Aggregates existing store data only — no schema change. Top-level
+        ``received`` / ``extracted`` / ``connected`` stay for simple clients;
+        ``stages`` is the single source of truth for count, pending, and
+        status (``done`` / ``working`` / ``waiting``). Keys are omitted when
+        a value cannot be computed (never faked as 0 when the underlying
+        source is unavailable).
+        """
+        kg, allowed = _scoped(request)
+        received: Optional[int] = None
+        extracted: Optional[int] = None
+        connected: Optional[int] = None
+        index_pending: Optional[int] = None
+
+        try:
+            docs_payload = kg.list_documents(10_000)
+            documents = list(docs_payload.get("documents") or [])
+            if allowed is not None:
+                documents = _filter_scoped(kg, documents, allowed)
+            received = len(documents)
+            extracted = sum(
+                1
+                for doc in documents
+                if doc.get("indexed") or int(doc.get("chunks") or 0) > 0
+            )
+        except Exception:
+            quiet()
+
+        try:
+            stats = _scoped_stats(request)
+            edges = stats.get("edges")
+            if isinstance(edges, dict):
+                connected = sum(int(value or 0) for value in edges.values())
+            elif isinstance(edges, (int, float)) and not isinstance(edges, bool):
+                connected = int(edges)
+            elif isinstance(stats.get("v2"), dict):
+                v2_edges = stats["v2"].get("edges")
+                if isinstance(v2_edges, (int, float)) and not isinstance(v2_edges, bool):
+                    connected = int(v2_edges)
+            if received is None:
+                nodes = stats.get("nodes")
+                if isinstance(nodes, dict):
+                    received = sum(
+                        int(value or 0)
+                        for key, value in nodes.items()
+                        if str(key).lower() != "chunk"
+                    )
+                elif isinstance(nodes, (int, float)) and not isinstance(nodes, bool):
+                    received = int(nodes)
+        except Exception:
+            quiet()
+
+        index_fn = getattr(kg, "index_status", None)
+        if callable(index_fn):
+            try:
+                index = index_fn() or {}
+                if received is None and index.get("source_items") is not None:
+                    received = int(index.get("source_items") or 0)
+                if extracted is None and index.get("ready_items") is not None:
+                    extracted = int(index.get("ready_items") or 0)
+                if index.get("pending_items") is not None:
+                    index_pending = max(0, int(index.get("pending_items") or 0))
+                elif index.get("pending") is not None:
+                    index_pending = max(0, int(index.get("pending") or 0))
+            except Exception:
+                quiet()
+
+        payload: Dict[str, Any] = {}
+        if received is not None:
+            payload["received"] = max(0, int(received))
+        if extracted is not None:
+            payload["extracted"] = max(0, int(extracted))
+        if connected is not None:
+            payload["connected"] = max(0, int(connected))
+
+        if payload:
+            stages: Dict[str, Dict[str, Any]] = {}
+            if "received" in payload:
+                # Once listed as a document it has been received — no backlog.
+                stages["received"] = _pipeline_stage_view(
+                    count=payload["received"], pending=0
+                )
+            if "extracted" in payload:
+                # Prefer vector-index backlog; fall back to docs not yet chunked.
+                if index_pending is not None:
+                    extract_pending = index_pending
+                elif "received" in payload:
+                    extract_pending = max(
+                        0, int(payload["received"]) - int(payload["extracted"])
+                    )
+                else:
+                    extract_pending = 0
+                stages["extracted"] = _pipeline_stage_view(
+                    count=payload["extracted"], pending=extract_pending
+                )
+            if "connected" in payload:
+                # Connections are graph edges; backlog only when index reports
+                # pending items that still need linking (reuse extract backlog
+                # only when we have no better signal — 0 when graph is ready).
+                connect_pending = 0
+                if index_pending is not None and payload["connected"] == 0:
+                    connect_pending = index_pending
+                stages["connected"] = _pipeline_stage_view(
+                    count=payload["connected"], pending=connect_pending
+                )
+            payload["stages"] = stages
+            payload["updated_at"] = datetime.now().isoformat(timespec="seconds")
+        return payload
+
     @router.get("/knowledge-graph/schema")
     async def knowledge_graph_schema(request: Request):
         stats = _scoped_stats(request)

package/latticeai/api/static_routes.py

@@ -34,6 +34,30 @@ PRODUCTION_CSP = (
 INVITE_COOKIE_NAME = "lattice_invite"
 INVITE_COOKIE_TTL_SECONDS = 60 * 60 * 24 * 7
 
+# Host-capacity plain-language judgment for System basic mode (layout rebuild).
+# Thresholds live here so the frontend never re-derives copy from raw percents.
+SYSINFO_READINESS_ROOMY_MAX = 55.0
+SYSINFO_READINESS_TIGHT_MAX = 80.0
+
+
+def host_capacity_readiness(
+    *,
+    cpu_pct: float = 0.0,
+    ram_pct: float = 0.0,
+    gpu_mem_pct: float = 0.0,
+) -> str:
+    """Map host telemetry to a single plain-language readiness bucket.
+
+    Returns one of ``roomy`` / ``tight`` / ``low``. The product uses this so
+    basic-mode System copy and advanced-mode numbers share one judgment.
+    """
+    load = max(float(cpu_pct or 0.0), float(ram_pct or 0.0), float(gpu_mem_pct or 0.0))
+    if load <= SYSINFO_READINESS_ROOMY_MAX:
+        return "roomy"
+    if load <= SYSINFO_READINESS_TIGHT_MAX:
+        return "tight"
+    return "low"
+
 
 def _sign_invite_cookie(secret: str, *, now: Optional[int] = None) -> str:
     """Create an expiring, nonce-bearing invite-gate capability cookie."""
@@ -250,7 +274,11 @@ def create_static_routes_router(
     
     @api_router.get("/local/sysinfo")
     async def local_sysinfo(request: Request):
-        """CPU / RAM / GPU(MLX) 사용량을 반환합니다."""
+        """CPU / RAM / GPU(MLX) usage plus a plain-language readiness bucket.
+
+        ``readiness`` is ``roomy`` | ``tight`` | ``low`` so basic System copy
+        does not re-interpret raw percents on the client.
+        """
         require_user(request)
         import re as _re
         result: Dict[str, Any] = {
@@ -258,6 +286,7 @@ def create_static_routes_router(
             "ram_pct": 0.0,
             "gpu_mem_pct": 0.0,
             "gpu_mem_gb": 0.0,
+            "readiness": "roomy",
         }
         try:
             # CPU
@@ -291,6 +320,11 @@ def create_static_routes_router(
                 quiet()
         except Exception as e:
             result["error"] = str(e)
+        result["readiness"] = host_capacity_readiness(
+            cpu_pct=float(result.get("cpu_pct") or 0.0),
+            ram_pct=float(result.get("ram_pct") or 0.0),
+            gpu_mem_pct=float(result.get("gpu_mem_pct") or 0.0),
+        )
         return result
 
     return StaticRoutesBundle(