ltcai 10.8.0 → 10.10.0

package/latticeai/api/chat_history.py

@@ -9,7 +9,9 @@ from __future__ import annotations
 from dataclasses import dataclass
 from typing import Any, Callable, Dict
 
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Request
+
+from latticeai.core.messages import http_error, resolve_language
 
 
 @dataclass(frozen=True)
@@ -48,7 +50,7 @@ def register_history_routes(router: APIRouter, deps: HistoryRouteDependencies) -
             **deps.scope_for_user(current_user),
         )
         if not messages:
-            raise HTTPException(status_code=404, detail="대화를 찾을 수 없습니다.")
+            raise http_error(404, "chat.conversation_not_found", resolve_language(request))
         return {"id": conversation_id, "messages": messages}
 
     @router.delete("/history/conversations/{conversation_id:path}")

package/latticeai/api/chat_intents.py

@@ -31,9 +31,10 @@ from latticeai.core.file_generation import (
     repair_bundle_references,
     validate_project_bundle,
 )
+from latticeai.core.messages import DEFAULT_LANGUAGE, translate
 
 
-def next_available_path(root: Path, target: str) -> str:
+def next_available_path(root: Path, target: str, language: str = DEFAULT_LANGUAGE) -> str:
     """Return ``target`` unchanged, or a ``name_2.ext``-style variant when the
     file already exists in the workspace.
 
@@ -54,7 +55,7 @@ def next_available_path(root: Path, target: str) -> str:
             return str(Path(target).with_name(variant.name))
     raise HTTPException(
         status_code=409,
-        detail=f"'{target}' 이름의 파일이 너무 많습니다. 다른 이름을 지정해 주세요.",
+        detail=translate("chat.file_name_collision", language, name=target),
     )
 
 
@@ -118,14 +119,10 @@ class ChatIntentController:
         except Exception as exc:  # noqa: BLE001 — metrics must never break chat
             logging.warning("funnel metrics increment failed: %s", exc)
 
-    def no_model_response(self) -> JSONResponse:
-        detail = "No model loaded. Call /models/load first."
+    def no_model_response(self, language: str = DEFAULT_LANGUAGE) -> JSONResponse:
+        detail = translate("chat.no_model_loaded", language)
         if self.config.is_public:
-            detail = (
-                "No public model loaded. Set OPENAI_API_KEY and "
-                f"LATTICEAI_PUBLIC_MODEL={self.public_model}, or call /models/load "
-                "with an OpenAI-compatible model."
-            )
+            detail = translate("models.public_model_missing", language, model=self.public_model)
         return JSONResponse(
             status_code=400,
             content={
@@ -249,6 +246,7 @@ class ChatIntentController:
         model_id: Optional[str],
         effective_email: Optional[str] = None,
         workspace_id: Optional[str] = None,
+        language: str = DEFAULT_LANGUAGE,
     ):
         # An explicit path ("report.txt") wins; otherwise infer one from an
         # explicit type keyword ("html 파일 만들어줘") so weak models never
@@ -266,19 +264,20 @@ class ChatIntentController:
                     model_id=model_id,
                     effective_email=effective_email,
                     workspace_id=workspace_id,
+                    language=language,
                 )
         target_path = explicit_target or infer_file_target(req.message)
         if not target_path:
             return None
         # Never silently overwrite: an existing target gets a _2/_3 suffix so
         # regeneration is safe and repeatable without the proposal flow.
-        deduped_path = next_available_path(self.agent_root, target_path)
+        deduped_path = next_available_path(self.agent_root, target_path, language)
         renamed = deduped_path != target_path
         target_path = deduped_path
         content = inline_file_action_content(req.message)
         generation_meta: Optional[Dict[str, Any]] = None
         if content is None and not model_id:
-            return self.no_model_response()
+            return self.no_model_response(language)
         if content is None and model_id:
             # Model-agnostic pipeline: strict extension-aware prompt →
             # extraction → validation → one corrective retry → deterministic
@@ -302,7 +301,7 @@ class ChatIntentController:
         if content is None:
             raise HTTPException(
                 status_code=400,
-                detail="File content could not be generated.",
+                detail=translate("chat.file_generation_failed", language),
             )
         try:
             result = self.execute_tool(
@@ -395,6 +394,7 @@ class ChatIntentController:
         model_id: Optional[str],
         effective_email: Optional[str] = None,
         workspace_id: Optional[str] = None,
+        language: str = DEFAULT_LANGUAGE,
     ):
         """Artifact Loop: manifest → per-file generate/validate → bundle write.
 
@@ -405,8 +405,8 @@ class ChatIntentController:
         standard ``artifacts[]`` contract, and downloadable as a zip.
         """
         if not model_id:
-            return self.no_model_response()
-        project_dir = next_available_path(self.agent_root, manifest["name"])
+            return self.no_model_response(language)
+        project_dir = next_available_path(self.agent_root, manifest["name"], language)
         bundle_files = [str(f["path"]) for f in manifest["files"]]
 
         async def _generate(context: str) -> str:

package/latticeai/api/knowledge_graph.py

@@ -19,6 +19,7 @@ from latticeai.api.workspace_scope import (
     resolve_workspace_scope,
     workspace_scope_from_request,
 )
+from latticeai.core.messages import http_error, resolve_language
 from latticeai.core.quiet import quiet
 
 
@@ -456,9 +457,9 @@ def create_knowledge_graph_router(
     async def knowledge_graph_neighbors(node_id: str, request: Request):
         kg, allowed = _scoped(request)
         if not node_id:
-            raise HTTPException(status_code=400, detail="node_id required")
+            raise http_error(400, "graph.node_id_required", resolve_language(request))
         if allowed is not None and not _filter_scoped(kg, [{"id": node_id}], allowed):
-            raise HTTPException(status_code=404, detail="node not found")
+            raise http_error(404, "graph.node_not_found", resolve_language(request))
         payload = kg.neighbors(node_id)
         if allowed is not None:
             neighbors = _filter_scoped(kg, payload.get("neighbors", []), allowed)
@@ -476,13 +477,13 @@ def create_knowledge_graph_router(
         current_user = require_user(request)
         if current_user and req.user_email:
             if current_user.strip().lower() != req.user_email.strip().lower():
-                raise HTTPException(status_code=403, detail="user_email must match the authenticated user.")
+                raise http_error(403, "common.user_mismatch", resolve_language(request))
         effective_user = current_user or req.user_email or None
         kg = graph()
         workspace_id = _write_workspace(request, current_user)
         event_type = (req.type or "").strip().lower()
         if event_type not in {"message", "ai_response", "note"}:
-            raise HTTPException(status_code=400, detail="지원하는 type: message, ai_response, note")
+            raise http_error(400, "graph.unsupported_type", resolve_language(request))
         role = req.role or ("assistant" if event_type == "ai_response" else "user")
         if ingestion_pipeline is not None:
             source_type = "chat_message" if event_type in {"message", "ai_response"} else "note"

package/latticeai/api/local_files.py

@@ -15,6 +15,12 @@ from fastapi.responses import FileResponse
 from pydantic import BaseModel
 
 from latticeai.api.knowledge_graph import create_knowledge_graph_router
+from latticeai.core.messages import (
+    DEFAULT_LANGUAGE,
+    http_error,
+    resolve_language,
+    translate,
+)
 from latticeai.services.local_knowledge import create_local_knowledge_router
 from latticeai.tools import local_list, local_read, local_write
 
@@ -234,20 +240,20 @@ def create_local_files_router(
         )
         target = Path(path).expanduser().resolve()
         if not target.exists() or not target.is_file():
-            raise HTTPException(status_code=404, detail="File not found")
+            raise http_error(404, "common.file_not_found", resolve_language(request))
         return FileResponse(str(target))
 
     # ── v9.8.0 ingestion jobs API (frozen paths — consumed by the frontend) ───
     def _require_pipeline():
         if ingestion_pipeline is None or not ingestion_pipeline.available():
-            raise HTTPException(status_code=503, detail="Knowledge Graph ingestion is disabled.")
+            raise http_error(503, "capture.ingestion_disabled", DEFAULT_LANGUAGE)
 
     def _ingestion_write_workspace(request: Request, body_workspace: Optional[str], user: str) -> Optional[str]:
         header = request.headers.get("X-Workspace-Id")
         header = header.strip() if header and header.strip() else None
         supplied = [value for value in (body_workspace, header) if value]
         if len(set(supplied)) > 1:
-            raise HTTPException(status_code=403, detail="Workspace selectors must match.")
+            raise http_error(403, "common.workspace_mismatch", resolve_language(request))
         requested = supplied[0] if supplied else None
         if workspace_service is None:
             return requested
@@ -271,7 +277,7 @@ def create_local_files_router(
         _require_pipeline()
         job = ingestion_pipeline.get_background_job(job_id)
         if job is None:
-            raise HTTPException(status_code=404, detail="ingestion job not found")
+            raise http_error(404, "ingestion.job_not_found", resolve_language(request))
         return job.as_dict()
 
     @router.post("/api/ingestion/jobs/{job_id}/resume")
@@ -281,7 +287,7 @@ def create_local_files_router(
         _require_pipeline()
         job = ingestion_pipeline.get_background_job(job_id)
         if job is None:
-            raise HTTPException(status_code=404, detail="ingestion job not found")
+            raise http_error(404, "ingestion.job_not_found", resolve_language(request))
         if job.status == "running":
             return {"status": "already_running", "job_id": job_id, "job": job.as_dict()}
         remaining = len(job.remaining_indices())
@@ -312,7 +318,7 @@ def create_local_files_router(
         workspace_id = _ingestion_write_workspace(request, req.workspace_id, current_user)
         path = (req.path or "").strip()
         if not path:
-            raise HTTPException(status_code=400, detail="path is required.")
+            raise http_error(400, "common.path_required", resolve_language(request))
         if not req.approved:
             return permission_gateway.local_permission_response(path, "read", current_user)
         permission_gateway.require_local_approval(
@@ -339,16 +345,16 @@ def create_local_files_router(
         return summary
 
     # ── folder watch mode: opt-in, off by default (backlog #8) ────────────────
-    def _require_folder_watch():
+    def _require_folder_watch(request: Request):
         _require_pipeline()
         if folder_watch is None:
-            raise HTTPException(status_code=503, detail="Folder watch service is unavailable.")
+            raise http_error(503, "ingestion.watch_unavailable", resolve_language(request))
 
     @router.get("/api/ingestion/watch")
     async def folder_watch_status(request: Request):
         """Watch-mode status: stored opt-ins, poller state, last scan results."""
         require_user(request)
-        _require_folder_watch()
+        _require_folder_watch(request)
         return folder_watch.status()
 
     @router.post("/api/ingestion/watch")
@@ -361,11 +367,11 @@ def create_local_files_router(
         watch owner's workspace scope).
         """
         current_user = permission_gateway.require_local_user(request)
-        _require_folder_watch()
+        _require_folder_watch(request)
         workspace_id = _ingestion_write_workspace(request, req.workspace_id, current_user)
         path = (req.path or "").strip()
         if not path:
-            raise HTTPException(status_code=400, detail="path is required.")
+            raise http_error(400, "common.path_required", resolve_language(request))
         if not req.approved:
             return permission_gateway.local_permission_response(path, "read", current_user)
         permission_gateway.require_local_approval(
@@ -381,7 +387,11 @@ def create_local_files_router(
             recursive=req.recursive,
         )
         if result.get("status") != "ok":
-            raise HTTPException(status_code=400, detail=result.get("detail") or "watch enable failed")
+            raise HTTPException(
+                status_code=400,
+                detail=result.get("detail")
+                or translate("ingestion.watch_enable_failed", resolve_language(request)),
+            )
         return result
 
     @router.delete("/api/ingestion/watch")
@@ -392,12 +402,12 @@ def create_local_files_router(
     ):
         """Opt back out of watch mode (removes the stored consent record)."""
         require_user(request)
-        _require_folder_watch()
+        _require_folder_watch(request)
         if not watch_id and not path:
-            raise HTTPException(status_code=400, detail="watch_id or path is required.")
+            raise http_error(400, "ingestion.watch_selector_required", resolve_language(request))
         result = folder_watch.disable(watch_id=watch_id, path=path)
         if result.get("status") == "not_found":
-            raise HTTPException(status_code=404, detail="watch not found")
+            raise http_error(404, "ingestion.watch_not_found", resolve_language(request))
         return result
 
     @router.post("/local/write")

package/latticeai/api/mcp.py

@@ -11,6 +11,7 @@ import cycle.
 
 from __future__ import annotations
 
+import asyncio
 import json
 import logging
 from datetime import datetime
@@ -29,6 +30,7 @@ from latticeai.core.mcp_registry import (
     _get_combined_registry,
     install_skill,
 )
+from latticeai.core.messages import http_error, resolve_language
 from latticeai.core.tool_registry import (
     KNOWLEDGE_WRITE_TOOLS,
     MCP_TOOL_DESCRIPTIONS,
@@ -130,7 +132,7 @@ def create_mcp_router(
         except PermissionError as exc:
             raise HTTPException(status_code=403, detail=str(exc)) from exc
 
-    def _read_workspace(requested: Optional[str], user: Optional[str]) -> Optional[str]:
+    def _read_workspace(request: Request, requested: Optional[str], user: Optional[str]) -> Optional[str]:
         if workspace_service is not None:
             try:
                 return workspace_service.resolve_read_scope(requested, user)
@@ -139,7 +141,7 @@ def create_mcp_router(
         workspace_id = requested or "personal"
         allowed = _allowed_graph_workspaces(user)
         if allowed is not None and workspace_id not in set(allowed):
-            raise HTTPException(status_code=403, detail=f"workspace '{workspace_id}' is not readable")
+            raise http_error(403, "common.workspace_unreadable", resolve_language(request), workspace=workspace_id)
         return workspace_id
 
     @router.get("/mcp/tools")
@@ -204,7 +206,7 @@ def create_mcp_router(
         registry = await _get_combined_registry()
         item = next((e for e in registry if e["id"] == mcp_id), None)
         if not item or item.get("install_mode") != "connector":
-            raise HTTPException(status_code=404, detail="커넥터를 찾을 수 없습니다.")
+            raise http_error(404, "mcp.connector_not_found", resolve_language(request))
         installed = load_mcp_installs().get("installed", {})
         public = mcp_public_item(item, installed)
         public["instructions"] = [
@@ -229,8 +231,10 @@ def create_mcp_router(
         if not settings_path.exists():
             return {"servers": []}
         try:
-            with open(settings_path, "r", encoding="utf-8") as f:
-                settings = json.load(f)
+            # Home may be a network mount, where a read is not the microsecond
+            # a local one is; keep it off the loop like every other file read.
+            raw = await asyncio.to_thread(settings_path.read_text, "utf-8")
+            settings = json.loads(raw)
             mcp_servers = settings.get("mcpServers", {})
             servers = []
             for name, cfg in mcp_servers.items():
@@ -272,9 +276,9 @@ def create_mcp_router(
         admin_email, _ = require_admin(request)
         append_audit_event("mcp_custom_add", user_email=admin_email, name=req.name, package=req.package)
         if not req.name.strip():
-            raise HTTPException(status_code=400, detail="name은 필수입니다.")
+            raise http_error(400, "mcp.name_required", resolve_language(request))
         if not req.package.strip():
-            raise HTTPException(status_code=400, detail="package는 필수입니다.")
+            raise http_error(400, "mcp.package_required", resolve_language(request))
         items = _load_custom_mcps()
         entry = {
             "id": f"custom:{req.name.strip().lower().replace(' ', '-')}",
@@ -302,7 +306,7 @@ def create_mcp_router(
         before = len(items)
         items = [e for e in items if e["id"] != mcp_id]
         if len(items) == before:
-            raise HTTPException(status_code=404, detail="항목을 찾을 수 없습니다.")
+            raise http_error(404, "mcp.item_not_found", resolve_language(request))
         _save_custom_mcps(items)
         return {"status": "ok"}
 
@@ -415,7 +419,7 @@ def create_mcp_router(
             # pipeline (provenance + hook lifecycle), not a direct store call.
             claimed_user = str(args.get("user_email") or "").strip()
             if current_user and claimed_user and claimed_user.lower() != current_user.strip().lower():
-                raise HTTPException(status_code=403, detail="user_email must match the authenticated user.")
+                raise http_error(403, "common.user_mismatch", resolve_language(request))
             owner = current_user or claimed_user or None
             workspace_id = _write_workspace(args.get("workspace_id"), owner)
             raw = dict(args)
@@ -464,12 +468,12 @@ def create_mcp_router(
         if req.action in SCOPED_KNOWLEDGE_TOOLS:
             claimed_user = str(dispatch_args.get("user_email") or "").strip().lower()
             if claimed_user and claimed_user != current_user.strip().lower():
-                raise HTTPException(status_code=403, detail="user_email must match the authenticated user.")
+                raise http_error(403, "common.user_mismatch", resolve_language(request))
             requested_workspace = dispatch_args.get("workspace_id")
             if req.action in KNOWLEDGE_WRITE_TOOLS:
                 workspace_id = _write_workspace(requested_workspace, current_user)
             else:
-                workspace_id = _read_workspace(requested_workspace, current_user)
+                workspace_id = _read_workspace(request, requested_workspace, current_user)
             dispatch_args["workspace_id"] = workspace_id
             dispatch_args["user_email"] = current_user
         enforce_tool_policy(req.action, dispatch_args, current_user=current_user, source="mcp")

package/latticeai/api/memory.py

@@ -12,6 +12,7 @@ from typing import Callable, List, Optional
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
+from latticeai.core.messages import http_error, resolve_language
 from latticeai.services.memory_service import MemoryService
 
 
@@ -96,7 +97,7 @@ def create_memory_router(
         try:
             return service.inspect(source, user_email=user, workspace_id=scope, limit=limit)
         except KeyError as exc:
-            raise HTTPException(status_code=404, detail=f"Unknown memory source: {source}") from exc
+            raise http_error(404, "memory.unknown_source", resolve_language(request), source=source) from exc
 
     @router.post("/api/memory/recall")
     async def memory_recall(req: RecallRequest, request: Request):

package/latticeai/api/models.py

@@ -20,6 +20,7 @@ from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import StreamingResponse
 from pydantic import BaseModel
 
+from latticeai.core.messages import http_error, resolve_language, translate
 from latticeai.services.model_errors import ModelRuntimeError
 
 
@@ -140,7 +141,7 @@ def create_models_router(
         current_user = require_user(request)
         if REQUIRE_AUTH:
             if claimed_email and _normalized_identity(claimed_email) != _normalized_identity(current_user):
-                raise HTTPException(status_code=403, detail="다른 사용자의 모델 자격 증명을 사용할 수 없습니다.")
+                raise http_error(403, "models.other_user_credentials", resolve_language(request))
             require_admin(request)
         return current_user
 
@@ -305,9 +306,14 @@ def create_models_router(
     async def engines_install(req: InstallEngineRequest, request: Request):
         _authorize_model_admin(request)
         try:
+            # `install_engine` shells out with a 900s timeout. On the event loop
+            # that is a fifteen-minute freeze of the entire server — no chat, no
+            # status, no UI — for one admin installing an engine.
             if req.confirmation_token:
-                return install_engine(req.engine, confirmation_token=req.confirmation_token)
-            return install_engine(req.engine)
+                return await asyncio.to_thread(
+                    install_engine, req.engine, confirmation_token=req.confirmation_token
+                )
+            return await asyncio.to_thread(install_engine, req.engine)
         except ModelRuntimeError as exc:
             _raise_model_http(exc)
 
@@ -326,11 +332,11 @@ def create_models_router(
         if not req.allow_download:
             raise HTTPException(
                 status_code=403,
-                detail="Model downloads require explicit user consent (allow_download=true).",
+                detail=translate("models.download_consent_required", resolve_language(request)),
             )
         model_ref = normalize_local_model_request(req.model, None)
         if not model_ref:
-            raise HTTPException(status_code=400, detail="모델 식별자가 비어 있습니다.")
+            raise http_error(400, "models.identifier_empty", resolve_language(request))
 
         if ":" in model_ref and model_ref.split(":", 1)[0].strip().lower() in {"ollama", "vllm", "lmstudio", "llamacpp", "local_mlx", "mlx"}:
             provider, model_name = model_ref.split(":", 1)
@@ -340,25 +346,36 @@ def create_models_router(
             provider, model_name = "local_mlx", model_ref
 
         if not model_name:
-            raise HTTPException(status_code=400, detail="모델 이름이 비어 있습니다.")
+            raise http_error(400, "models.name_empty", resolve_language(request))
 
         if provider == "ollama":
             try:
-                ensure_ollama_server()
+                # Starts the daemon and waits for it — blocking, like the pull
+                # below, and for the same reason it may not run on the loop.
+                await asyncio.to_thread(ensure_ollama_server)
             except ModelRuntimeError as exc:
                 _raise_model_http(exc)
             ollama = local_binary("ollama")
             if not ollama:
-                raise HTTPException(status_code=400, detail="Ollama가 설치되지 않았습니다.")
+                raise http_error(400, "models.ollama_missing", resolve_language(request))
             try:
-                completed = subprocess.run(
-                    [ollama, "pull", model_name],
-                    capture_output=True, text=True, timeout=900, check=False,
+                # A model pull is minutes of network I/O. Held on the event loop
+                # it stalled every other request — including the health check the
+                # UI uses to decide the server is alive — until the pull finished.
+                completed = await asyncio.to_thread(
+                    lambda: subprocess.run(
+                        [ollama, "pull", model_name],
+                        capture_output=True, text=True, timeout=900, check=False,
+                    )
                 )
             except subprocess.TimeoutExpired:
-                raise HTTPException(status_code=408, detail="모델 다운로드 시간이 초과되었습니다.")
+                raise http_error(408, "models.download_timeout", resolve_language(request))
             if completed.returncode != 0:
-                raise HTTPException(status_code=500, detail=completed.stderr[-2000:] or "pull 실패")
+                raise HTTPException(
+                    status_code=500,
+                    detail=completed.stderr[-2000:]
+                    or translate("models.pull_failed", resolve_language(request)),
+                )
             return {"provider": provider, "model": model_name, "returncode": completed.returncode}
 
         if provider == "lmstudio":
@@ -374,12 +391,13 @@ def create_models_router(
         if provider in {"vllm", "llamacpp", "local_mlx", "mlx"}:
             download_provider = "local_mlx" if provider == "mlx" else provider
             try:
-                result = download_hf_model(model_name, download_provider)
+                # Multi-gigabyte Hugging Face download; same rule as the pull above.
+                result = await asyncio.to_thread(download_hf_model, model_name, download_provider)
             except ModelRuntimeError as exc:
                 _raise_model_http(exc)
             return {"provider": provider, "model": model_name, "returncode": 0, **result}
 
-        raise HTTPException(status_code=400, detail=f"{provider} 엔진 모델 다운로드는 아직 자동화되지 않았습니다.")
+        raise http_error(400, "models.download_not_automated", resolve_language(request), provider=provider)
 
     @router.post("/engines/prepare-model")
     async def engines_prepare_model(req: PrepareModelRequest, request: Request):
@@ -439,15 +457,15 @@ def create_models_router(
         from latticeai.models.router import OPENAI_COMPATIBLE_PROVIDERS
         config = OPENAI_COMPATIBLE_PROVIDERS.get(req.provider)
         if not config:
-            raise HTTPException(status_code=400, detail="알 수 없는 프로바이더입니다.")
+            raise http_error(400, "models.unknown_provider", resolve_language(request))
         if not req.key.strip():
-            raise HTTPException(status_code=400, detail="API 키가 비어있습니다.")
+            raise http_error(400, "models.api_key_empty", resolve_language(request))
         current_user = require_user(request)
         if REQUIRE_AUTH and req.user_email and _normalized_identity(req.user_email) != _normalized_identity(current_user):
-            raise HTTPException(status_code=403, detail="다른 사용자의 API 키를 설정할 권한이 없습니다.")
+            raise http_error(403, "models.other_user_api_key", resolve_language(request))
         target_email = str(_effective_email(current_user, req.user_email) or "").strip()
         if not target_email:
-            raise HTTPException(status_code=400, detail="사용자 식별이 필요합니다. 로그인 후 다시 시도하세요.")
+            raise http_error(400, "models.sign_in_required", resolve_language(request))
         set_user_api_key(target_email, req.provider, req.key.strip())
         return {"ok": True, "provider": req.provider, "user_email": target_email, "scope": "user"}
 
@@ -502,10 +520,7 @@ def create_models_router(
             model_id = req.model_id
             requested_engine = req.engine or (model_id.split(":", 1)[0] if ":" in model_id else "local_mlx")
             if IS_PUBLIC_MODE and not ALLOW_LOCAL_MODELS and requested_engine in {"local_mlx", "mlx"}:
-                raise HTTPException(
-                    status_code=400,
-                    detail="Public mode blocks local MLX model loading. Use openai:, openrouter:, groq:, together:, or set LATTICEAI_ALLOW_LOCAL_MODELS=true.",
-                )
+                raise http_error(400, "models.public_mode_blocks_local", resolve_language(request))
             compatibility = model_runtime_compatibility(model_id, engine=requested_engine)
             if compatibility.get("supported") is False:
                 raise HTTPException(status_code=400, detail=compatibility)
@@ -532,7 +547,7 @@ def create_models_router(
             _router.switch_model(model_id)
             return {"status": "ok", "current": _router.current_model_id}
         except KeyError:
-            raise HTTPException(status_code=404, detail=f"Model '{model_id}' not loaded. Call /models/load first.")
+            raise http_error(404, "chat.model_not_loaded", resolve_language(request), model=model_id)
 
     @router.delete("/models/unload/{model_id:path}")
     async def unload_model(model_id: str, request: Request):

package/latticeai/api/network_boundary.py

@@ -7,6 +7,7 @@ from typing import Any, Callable, Dict, Optional
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel, Field
 
+from latticeai.core.messages import http_error, resolve_language, translate
 from latticeai.core.network_boundary import network_mode_catalog, normalize_network_mode
 from latticeai.services.cloud_egress_audit import record_cloud_egress
 from latticeai.services.cloud_token_guard import budget_for
@@ -164,12 +165,16 @@ def create_network_boundary_router(
         """
         user, scope = _scope(request, body.workspace_id)
         if knowledge_graph is None or not hasattr(knowledge_graph, "set_node_sensitivity"):
-            raise HTTPException(status_code=501, detail="knowledge graph not available")
+            raise http_error(501, "common.graph_unavailable", resolve_language(request))
         result = knowledge_graph.set_node_sensitivity(
             body.node_id, local_only=bool(body.local_only), reason=body.reason
         )
         if not result.get("ok"):
-            raise HTTPException(status_code=404, detail=result.get("reason") or "node not found")
+            raise HTTPException(
+                status_code=404,
+                detail=result.get("reason")
+                or translate("graph.node_not_found", resolve_language(request)),
+            )
         record_cloud_egress(
             node_ids=[body.node_id], token_estimate=0, mode="(policy)",
             provider="(local)", user_email=user, workspace_id=scope,
@@ -184,14 +189,14 @@ def create_network_boundary_router(
         workspace_id: Optional[str] = None,
     ):
         if policy_service is None:
-            raise HTTPException(status_code=501, detail="hybrid policy service not configured")
+            raise http_error(501, "boundary.policy_not_configured", resolve_language(request))
         user, scope = _scope(request, workspace_id)
         return policy_service.resolve(user_email=user, workspace_id=scope)
 
     @router.post("/api/network-boundary/policy")
     async def set_hybrid_policy(body: SetHybridPolicyRequest, request: Request):
         if policy_service is None:
-            raise HTTPException(status_code=501, detail="hybrid policy service not configured")
+            raise http_error(501, "boundary.policy_not_configured", resolve_language(request))
         user, scope = _scope(request, body.workspace_id)
         patch: Dict[str, Any] = {}
         for key in (