ltcai 10.8.0 → 10.9.0

package/latticeai/api/local_files.py

@@ -15,6 +15,12 @@ from fastapi.responses import FileResponse
 from pydantic import BaseModel
 
 from latticeai.api.knowledge_graph import create_knowledge_graph_router
+from latticeai.core.messages import (
+    DEFAULT_LANGUAGE,
+    http_error,
+    resolve_language,
+    translate,
+)
 from latticeai.services.local_knowledge import create_local_knowledge_router
 from latticeai.tools import local_list, local_read, local_write
 
@@ -234,20 +240,20 @@ def create_local_files_router(
         )
         target = Path(path).expanduser().resolve()
         if not target.exists() or not target.is_file():
-            raise HTTPException(status_code=404, detail="File not found")
+            raise http_error(404, "common.file_not_found", resolve_language(request))
         return FileResponse(str(target))
 
     # ── v9.8.0 ingestion jobs API (frozen paths — consumed by the frontend) ───
     def _require_pipeline():
         if ingestion_pipeline is None or not ingestion_pipeline.available():
-            raise HTTPException(status_code=503, detail="Knowledge Graph ingestion is disabled.")
+            raise http_error(503, "capture.ingestion_disabled", DEFAULT_LANGUAGE)
 
     def _ingestion_write_workspace(request: Request, body_workspace: Optional[str], user: str) -> Optional[str]:
         header = request.headers.get("X-Workspace-Id")
         header = header.strip() if header and header.strip() else None
         supplied = [value for value in (body_workspace, header) if value]
         if len(set(supplied)) > 1:
-            raise HTTPException(status_code=403, detail="Workspace selectors must match.")
+            raise http_error(403, "common.workspace_mismatch", resolve_language(request))
         requested = supplied[0] if supplied else None
         if workspace_service is None:
             return requested
@@ -271,7 +277,7 @@ def create_local_files_router(
         _require_pipeline()
         job = ingestion_pipeline.get_background_job(job_id)
         if job is None:
-            raise HTTPException(status_code=404, detail="ingestion job not found")
+            raise http_error(404, "ingestion.job_not_found", resolve_language(request))
         return job.as_dict()
 
     @router.post("/api/ingestion/jobs/{job_id}/resume")
@@ -281,7 +287,7 @@ def create_local_files_router(
         _require_pipeline()
         job = ingestion_pipeline.get_background_job(job_id)
         if job is None:
-            raise HTTPException(status_code=404, detail="ingestion job not found")
+            raise http_error(404, "ingestion.job_not_found", resolve_language(request))
         if job.status == "running":
             return {"status": "already_running", "job_id": job_id, "job": job.as_dict()}
         remaining = len(job.remaining_indices())
@@ -312,7 +318,7 @@ def create_local_files_router(
         workspace_id = _ingestion_write_workspace(request, req.workspace_id, current_user)
         path = (req.path or "").strip()
         if not path:
-            raise HTTPException(status_code=400, detail="path is required.")
+            raise http_error(400, "common.path_required", resolve_language(request))
         if not req.approved:
             return permission_gateway.local_permission_response(path, "read", current_user)
         permission_gateway.require_local_approval(
@@ -339,16 +345,16 @@ def create_local_files_router(
         return summary
 
     # ── folder watch mode: opt-in, off by default (backlog #8) ────────────────
-    def _require_folder_watch():
+    def _require_folder_watch(request: Request):
         _require_pipeline()
         if folder_watch is None:
-            raise HTTPException(status_code=503, detail="Folder watch service is unavailable.")
+            raise http_error(503, "ingestion.watch_unavailable", resolve_language(request))
 
     @router.get("/api/ingestion/watch")
     async def folder_watch_status(request: Request):
         """Watch-mode status: stored opt-ins, poller state, last scan results."""
         require_user(request)
-        _require_folder_watch()
+        _require_folder_watch(request)
         return folder_watch.status()
 
     @router.post("/api/ingestion/watch")
@@ -361,11 +367,11 @@ def create_local_files_router(
         watch owner's workspace scope).
         """
         current_user = permission_gateway.require_local_user(request)
-        _require_folder_watch()
+        _require_folder_watch(request)
         workspace_id = _ingestion_write_workspace(request, req.workspace_id, current_user)
         path = (req.path or "").strip()
         if not path:
-            raise HTTPException(status_code=400, detail="path is required.")
+            raise http_error(400, "common.path_required", resolve_language(request))
         if not req.approved:
             return permission_gateway.local_permission_response(path, "read", current_user)
         permission_gateway.require_local_approval(
@@ -381,7 +387,11 @@ def create_local_files_router(
             recursive=req.recursive,
         )
         if result.get("status") != "ok":
-            raise HTTPException(status_code=400, detail=result.get("detail") or "watch enable failed")
+            raise HTTPException(
+                status_code=400,
+                detail=result.get("detail")
+                or translate("ingestion.watch_enable_failed", resolve_language(request)),
+            )
         return result
 
     @router.delete("/api/ingestion/watch")
@@ -392,12 +402,12 @@ def create_local_files_router(
     ):
         """Opt back out of watch mode (removes the stored consent record)."""
         require_user(request)
-        _require_folder_watch()
+        _require_folder_watch(request)
         if not watch_id and not path:
-            raise HTTPException(status_code=400, detail="watch_id or path is required.")
+            raise http_error(400, "ingestion.watch_selector_required", resolve_language(request))
         result = folder_watch.disable(watch_id=watch_id, path=path)
         if result.get("status") == "not_found":
-            raise HTTPException(status_code=404, detail="watch not found")
+            raise http_error(404, "ingestion.watch_not_found", resolve_language(request))
         return result
 
     @router.post("/local/write")

package/latticeai/api/mcp.py

@@ -11,6 +11,7 @@ import cycle.
 
 from __future__ import annotations
 
+import asyncio
 import json
 import logging
 from datetime import datetime
@@ -29,6 +30,7 @@ from latticeai.core.mcp_registry import (
     _get_combined_registry,
     install_skill,
 )
+from latticeai.core.messages import http_error, resolve_language
 from latticeai.core.tool_registry import (
     KNOWLEDGE_WRITE_TOOLS,
     MCP_TOOL_DESCRIPTIONS,
@@ -130,7 +132,7 @@ def create_mcp_router(
         except PermissionError as exc:
             raise HTTPException(status_code=403, detail=str(exc)) from exc
 
-    def _read_workspace(requested: Optional[str], user: Optional[str]) -> Optional[str]:
+    def _read_workspace(request: Request, requested: Optional[str], user: Optional[str]) -> Optional[str]:
         if workspace_service is not None:
             try:
                 return workspace_service.resolve_read_scope(requested, user)
@@ -139,7 +141,7 @@ def create_mcp_router(
         workspace_id = requested or "personal"
         allowed = _allowed_graph_workspaces(user)
         if allowed is not None and workspace_id not in set(allowed):
-            raise HTTPException(status_code=403, detail=f"workspace '{workspace_id}' is not readable")
+            raise http_error(403, "common.workspace_unreadable", resolve_language(request), workspace=workspace_id)
         return workspace_id
 
     @router.get("/mcp/tools")
@@ -204,7 +206,7 @@ def create_mcp_router(
         registry = await _get_combined_registry()
         item = next((e for e in registry if e["id"] == mcp_id), None)
         if not item or item.get("install_mode") != "connector":
-            raise HTTPException(status_code=404, detail="커넥터를 찾을 수 없습니다.")
+            raise http_error(404, "mcp.connector_not_found", resolve_language(request))
         installed = load_mcp_installs().get("installed", {})
         public = mcp_public_item(item, installed)
         public["instructions"] = [
@@ -229,8 +231,10 @@ def create_mcp_router(
         if not settings_path.exists():
             return {"servers": []}
         try:
-            with open(settings_path, "r", encoding="utf-8") as f:
-                settings = json.load(f)
+            # Home may be a network mount, where a read is not the microsecond
+            # a local one is; keep it off the loop like every other file read.
+            raw = await asyncio.to_thread(settings_path.read_text, "utf-8")
+            settings = json.loads(raw)
             mcp_servers = settings.get("mcpServers", {})
             servers = []
             for name, cfg in mcp_servers.items():
@@ -272,9 +276,9 @@ def create_mcp_router(
         admin_email, _ = require_admin(request)
         append_audit_event("mcp_custom_add", user_email=admin_email, name=req.name, package=req.package)
         if not req.name.strip():
-            raise HTTPException(status_code=400, detail="name은 필수입니다.")
+            raise http_error(400, "mcp.name_required", resolve_language(request))
         if not req.package.strip():
-            raise HTTPException(status_code=400, detail="package는 필수입니다.")
+            raise http_error(400, "mcp.package_required", resolve_language(request))
         items = _load_custom_mcps()
         entry = {
             "id": f"custom:{req.name.strip().lower().replace(' ', '-')}",
@@ -302,7 +306,7 @@ def create_mcp_router(
         before = len(items)
         items = [e for e in items if e["id"] != mcp_id]
         if len(items) == before:
-            raise HTTPException(status_code=404, detail="항목을 찾을 수 없습니다.")
+            raise http_error(404, "mcp.item_not_found", resolve_language(request))
         _save_custom_mcps(items)
         return {"status": "ok"}
 
@@ -415,7 +419,7 @@ def create_mcp_router(
             # pipeline (provenance + hook lifecycle), not a direct store call.
             claimed_user = str(args.get("user_email") or "").strip()
             if current_user and claimed_user and claimed_user.lower() != current_user.strip().lower():
-                raise HTTPException(status_code=403, detail="user_email must match the authenticated user.")
+                raise http_error(403, "common.user_mismatch", resolve_language(request))
             owner = current_user or claimed_user or None
             workspace_id = _write_workspace(args.get("workspace_id"), owner)
             raw = dict(args)
@@ -464,12 +468,12 @@ def create_mcp_router(
         if req.action in SCOPED_KNOWLEDGE_TOOLS:
             claimed_user = str(dispatch_args.get("user_email") or "").strip().lower()
             if claimed_user and claimed_user != current_user.strip().lower():
-                raise HTTPException(status_code=403, detail="user_email must match the authenticated user.")
+                raise http_error(403, "common.user_mismatch", resolve_language(request))
             requested_workspace = dispatch_args.get("workspace_id")
             if req.action in KNOWLEDGE_WRITE_TOOLS:
                 workspace_id = _write_workspace(requested_workspace, current_user)
             else:
-                workspace_id = _read_workspace(requested_workspace, current_user)
+                workspace_id = _read_workspace(request, requested_workspace, current_user)
             dispatch_args["workspace_id"] = workspace_id
             dispatch_args["user_email"] = current_user
         enforce_tool_policy(req.action, dispatch_args, current_user=current_user, source="mcp")

package/latticeai/api/memory.py

@@ -12,6 +12,7 @@ from typing import Callable, List, Optional
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
+from latticeai.core.messages import http_error, resolve_language
 from latticeai.services.memory_service import MemoryService
 
 
@@ -96,7 +97,7 @@ def create_memory_router(
         try:
             return service.inspect(source, user_email=user, workspace_id=scope, limit=limit)
         except KeyError as exc:
-            raise HTTPException(status_code=404, detail=f"Unknown memory source: {source}") from exc
+            raise http_error(404, "memory.unknown_source", resolve_language(request), source=source) from exc
 
     @router.post("/api/memory/recall")
     async def memory_recall(req: RecallRequest, request: Request):

package/latticeai/api/models.py

@@ -20,6 +20,7 @@ from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import StreamingResponse
 from pydantic import BaseModel
 
+from latticeai.core.messages import http_error, resolve_language, translate
 from latticeai.services.model_errors import ModelRuntimeError
 
 
@@ -140,7 +141,7 @@ def create_models_router(
         current_user = require_user(request)
         if REQUIRE_AUTH:
             if claimed_email and _normalized_identity(claimed_email) != _normalized_identity(current_user):
-                raise HTTPException(status_code=403, detail="다른 사용자의 모델 자격 증명을 사용할 수 없습니다.")
+                raise http_error(403, "models.other_user_credentials", resolve_language(request))
             require_admin(request)
         return current_user
 
@@ -305,9 +306,14 @@ def create_models_router(
     async def engines_install(req: InstallEngineRequest, request: Request):
         _authorize_model_admin(request)
         try:
+            # `install_engine` shells out with a 900s timeout. On the event loop
+            # that is a fifteen-minute freeze of the entire server — no chat, no
+            # status, no UI — for one admin installing an engine.
             if req.confirmation_token:
-                return install_engine(req.engine, confirmation_token=req.confirmation_token)
-            return install_engine(req.engine)
+                return await asyncio.to_thread(
+                    install_engine, req.engine, confirmation_token=req.confirmation_token
+                )
+            return await asyncio.to_thread(install_engine, req.engine)
         except ModelRuntimeError as exc:
             _raise_model_http(exc)
 
@@ -326,11 +332,11 @@ def create_models_router(
         if not req.allow_download:
             raise HTTPException(
                 status_code=403,
-                detail="Model downloads require explicit user consent (allow_download=true).",
+                detail=translate("models.download_consent_required", resolve_language(request)),
             )
         model_ref = normalize_local_model_request(req.model, None)
         if not model_ref:
-            raise HTTPException(status_code=400, detail="모델 식별자가 비어 있습니다.")
+            raise http_error(400, "models.identifier_empty", resolve_language(request))
 
         if ":" in model_ref and model_ref.split(":", 1)[0].strip().lower() in {"ollama", "vllm", "lmstudio", "llamacpp", "local_mlx", "mlx"}:
             provider, model_name = model_ref.split(":", 1)
@@ -340,25 +346,36 @@ def create_models_router(
             provider, model_name = "local_mlx", model_ref
 
         if not model_name:
-            raise HTTPException(status_code=400, detail="모델 이름이 비어 있습니다.")
+            raise http_error(400, "models.name_empty", resolve_language(request))
 
         if provider == "ollama":
             try:
-                ensure_ollama_server()
+                # Starts the daemon and waits for it — blocking, like the pull
+                # below, and for the same reason it may not run on the loop.
+                await asyncio.to_thread(ensure_ollama_server)
             except ModelRuntimeError as exc:
                 _raise_model_http(exc)
             ollama = local_binary("ollama")
             if not ollama:
-                raise HTTPException(status_code=400, detail="Ollama가 설치되지 않았습니다.")
+                raise http_error(400, "models.ollama_missing", resolve_language(request))
             try:
-                completed = subprocess.run(
-                    [ollama, "pull", model_name],
-                    capture_output=True, text=True, timeout=900, check=False,
+                # A model pull is minutes of network I/O. Held on the event loop
+                # it stalled every other request — including the health check the
+                # UI uses to decide the server is alive — until the pull finished.
+                completed = await asyncio.to_thread(
+                    lambda: subprocess.run(
+                        [ollama, "pull", model_name],
+                        capture_output=True, text=True, timeout=900, check=False,
+                    )
                 )
             except subprocess.TimeoutExpired:
-                raise HTTPException(status_code=408, detail="모델 다운로드 시간이 초과되었습니다.")
+                raise http_error(408, "models.download_timeout", resolve_language(request))
             if completed.returncode != 0:
-                raise HTTPException(status_code=500, detail=completed.stderr[-2000:] or "pull 실패")
+                raise HTTPException(
+                    status_code=500,
+                    detail=completed.stderr[-2000:]
+                    or translate("models.pull_failed", resolve_language(request)),
+                )
             return {"provider": provider, "model": model_name, "returncode": completed.returncode}
 
         if provider == "lmstudio":
@@ -374,12 +391,13 @@ def create_models_router(
         if provider in {"vllm", "llamacpp", "local_mlx", "mlx"}:
             download_provider = "local_mlx" if provider == "mlx" else provider
             try:
-                result = download_hf_model(model_name, download_provider)
+                # Multi-gigabyte Hugging Face download; same rule as the pull above.
+                result = await asyncio.to_thread(download_hf_model, model_name, download_provider)
             except ModelRuntimeError as exc:
                 _raise_model_http(exc)
             return {"provider": provider, "model": model_name, "returncode": 0, **result}
 
-        raise HTTPException(status_code=400, detail=f"{provider} 엔진 모델 다운로드는 아직 자동화되지 않았습니다.")
+        raise http_error(400, "models.download_not_automated", resolve_language(request), provider=provider)
 
     @router.post("/engines/prepare-model")
     async def engines_prepare_model(req: PrepareModelRequest, request: Request):
@@ -439,15 +457,15 @@ def create_models_router(
         from latticeai.models.router import OPENAI_COMPATIBLE_PROVIDERS
         config = OPENAI_COMPATIBLE_PROVIDERS.get(req.provider)
         if not config:
-            raise HTTPException(status_code=400, detail="알 수 없는 프로바이더입니다.")
+            raise http_error(400, "models.unknown_provider", resolve_language(request))
         if not req.key.strip():
-            raise HTTPException(status_code=400, detail="API 키가 비어있습니다.")
+            raise http_error(400, "models.api_key_empty", resolve_language(request))
         current_user = require_user(request)
         if REQUIRE_AUTH and req.user_email and _normalized_identity(req.user_email) != _normalized_identity(current_user):
-            raise HTTPException(status_code=403, detail="다른 사용자의 API 키를 설정할 권한이 없습니다.")
+            raise http_error(403, "models.other_user_api_key", resolve_language(request))
         target_email = str(_effective_email(current_user, req.user_email) or "").strip()
         if not target_email:
-            raise HTTPException(status_code=400, detail="사용자 식별이 필요합니다. 로그인 후 다시 시도하세요.")
+            raise http_error(400, "models.sign_in_required", resolve_language(request))
         set_user_api_key(target_email, req.provider, req.key.strip())
         return {"ok": True, "provider": req.provider, "user_email": target_email, "scope": "user"}
 
@@ -502,10 +520,7 @@ def create_models_router(
             model_id = req.model_id
             requested_engine = req.engine or (model_id.split(":", 1)[0] if ":" in model_id else "local_mlx")
             if IS_PUBLIC_MODE and not ALLOW_LOCAL_MODELS and requested_engine in {"local_mlx", "mlx"}:
-                raise HTTPException(
-                    status_code=400,
-                    detail="Public mode blocks local MLX model loading. Use openai:, openrouter:, groq:, together:, or set LATTICEAI_ALLOW_LOCAL_MODELS=true.",
-                )
+                raise http_error(400, "models.public_mode_blocks_local", resolve_language(request))
             compatibility = model_runtime_compatibility(model_id, engine=requested_engine)
             if compatibility.get("supported") is False:
                 raise HTTPException(status_code=400, detail=compatibility)
@@ -532,7 +547,7 @@ def create_models_router(
             _router.switch_model(model_id)
             return {"status": "ok", "current": _router.current_model_id}
         except KeyError:
-            raise HTTPException(status_code=404, detail=f"Model '{model_id}' not loaded. Call /models/load first.")
+            raise http_error(404, "chat.model_not_loaded", resolve_language(request), model=model_id)
 
     @router.delete("/models/unload/{model_id:path}")
     async def unload_model(model_id: str, request: Request):

package/latticeai/api/network_boundary.py

@@ -7,6 +7,7 @@ from typing import Any, Callable, Dict, Optional
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel, Field
 
+from latticeai.core.messages import http_error, resolve_language, translate
 from latticeai.core.network_boundary import network_mode_catalog, normalize_network_mode
 from latticeai.services.cloud_egress_audit import record_cloud_egress
 from latticeai.services.cloud_token_guard import budget_for
@@ -164,12 +165,16 @@ def create_network_boundary_router(
         """
         user, scope = _scope(request, body.workspace_id)
         if knowledge_graph is None or not hasattr(knowledge_graph, "set_node_sensitivity"):
-            raise HTTPException(status_code=501, detail="knowledge graph not available")
+            raise http_error(501, "common.graph_unavailable", resolve_language(request))
         result = knowledge_graph.set_node_sensitivity(
             body.node_id, local_only=bool(body.local_only), reason=body.reason
         )
         if not result.get("ok"):
-            raise HTTPException(status_code=404, detail=result.get("reason") or "node not found")
+            raise HTTPException(
+                status_code=404,
+                detail=result.get("reason")
+                or translate("graph.node_not_found", resolve_language(request)),
+            )
         record_cloud_egress(
             node_ids=[body.node_id], token_estimate=0, mode="(policy)",
             provider="(local)", user_email=user, workspace_id=scope,
@@ -184,14 +189,14 @@ def create_network_boundary_router(
         workspace_id: Optional[str] = None,
     ):
         if policy_service is None:
-            raise HTTPException(status_code=501, detail="hybrid policy service not configured")
+            raise http_error(501, "boundary.policy_not_configured", resolve_language(request))
         user, scope = _scope(request, workspace_id)
         return policy_service.resolve(user_email=user, workspace_id=scope)
 
     @router.post("/api/network-boundary/policy")
     async def set_hybrid_policy(body: SetHybridPolicyRequest, request: Request):
         if policy_service is None:
-            raise HTTPException(status_code=501, detail="hybrid policy service not configured")
+            raise http_error(501, "boundary.policy_not_configured", resolve_language(request))
         user, scope = _scope(request, body.workspace_id)
         patch: Dict[str, Any] = {}
         for key in (

package/latticeai/api/portability.py

@@ -12,6 +12,8 @@ from typing import Any, Callable, Optional
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
+from latticeai.core.messages import http_error, resolve_language, translate
+
 
 class ImportRequest(BaseModel):
     artifact: dict
@@ -72,52 +74,52 @@ def create_portability_router(
 ) -> APIRouter:
     router = APIRouter()
 
-    def _require_service():
+    def _require_service(request: Request):
         if service is None or not service.available():
-            raise HTTPException(status_code=503, detail="Knowledge Graph is disabled.")
+            raise http_error(503, "common.graph_disabled", resolve_language(request))
 
     @router.get("/api/knowledge-graph/portability")
     async def portability_status(request: Request):
         require_user(request)
-        _require_service()
+        _require_service(request)
         return service.snapshot_metadata()
 
     @router.get("/api/brain/storage")
     async def brain_storage_status(request: Request):
         require_user(request)
-        _require_service()
+        _require_service(request)
         return service.storage_status()
 
     @router.get("/api/knowledge-graph/backup-health")
     async def backup_health(request: Request):
         require_user(request)
-        _require_service()
+        _require_service(request)
         return service.backup_health()
 
     @router.get("/api/knowledge-graph/provenance")
     async def recent_provenance(request: Request, limit: int = 50, source_type: Optional[str] = None):
         """Recent ingestions (provenance trail) for the ingestion-sources UI."""
         require_admin(request)
-        _require_service()
+        _require_service(request)
         return service.recent_ingestions(limit=limit, source_type=source_type)
 
     @router.post("/api/knowledge-graph/export")
     async def export_graph(request: Request):
         """Logical JSON export of the whole graph (read-only)."""
         require_admin(request)
-        _require_service()
+        _require_service(request)
         return service.export()
 
     @router.post("/api/knowledge-graph/export-file")
     async def export_graph_file(request: Request):
         require_admin(request)
-        _require_service()
+        _require_service(request)
         return service.export_to_file()
 
     @router.post("/api/knowledge-graph/import")
     async def import_graph(req: ImportRequest, request: Request):
         require_admin(request)
-        _require_service()
+        _require_service(request)
         try:
             return service.import_data(req.artifact, mode=req.mode, dry_run=req.dry_run)
         except ValueError as exc:
@@ -126,13 +128,13 @@ def create_portability_router(
     @router.post("/api/knowledge-graph/backup")
     async def backup_graph(req: BackupRequest, request: Request):
         require_admin(request)
-        _require_service()
+        _require_service(request)
         return service.backup(req.path)
 
     @router.post("/api/knowledge-graph/restore")
     async def restore_graph(req: RestoreRequest, request: Request):
         require_admin(request)
-        _require_service()
+        _require_service(request)
         try:
             return service.restore(req.path, verify=req.verify, dry_run=req.dry_run, confirm=req.confirm)
         except (ValueError, FileNotFoundError) as exc:
@@ -141,7 +143,7 @@ def create_portability_router(
     @router.post("/api/knowledge-graph/archive")
     async def encrypted_archive(req: EncryptedArchiveRequest, request: Request):
         require_admin(request)
-        _require_service()
+        _require_service(request)
         try:
             return service.encrypted_archive(req.path, passphrase=req.passphrase)
         except (ValueError, FileNotFoundError) as exc:
@@ -150,7 +152,7 @@ def create_portability_router(
     @router.post("/api/knowledge-graph/archive/inspect")
     async def inspect_encrypted_archive(req: EncryptedInspectRequest, request: Request):
         require_admin(request)
-        _require_service()
+        _require_service(request)
         try:
             return service.inspect_encrypted_archive(req.path, passphrase=req.passphrase)
         except (ValueError, FileNotFoundError) as exc:
@@ -159,16 +161,22 @@ def create_portability_router(
     @router.post("/api/knowledge-graph/archive/verify")
     async def verify_encrypted_archive(req: EncryptedVerifyRequest, request: Request):
         require_admin(request)
-        _require_service()
+        _require_service(request)
         result = service.verify_encrypted_archive(req.path, passphrase=req.passphrase)
         if not result.get("ok"):
-            raise HTTPException(status_code=400, detail="; ".join(result.get("errors") or ["Archive verification failed."]))
+            raise HTTPException(
+            status_code=400,
+            detail="; ".join(
+                result.get("errors")
+                or [translate("portability.verification_failed", resolve_language(request))]
+            ),
+        )
         return result
 
     @router.post("/api/knowledge-graph/archive/import")
     async def import_encrypted_archive(req: EncryptedRestoreRequest, request: Request):
         require_admin(request)
-        _require_service()
+        _require_service(request)
         try:
             return service.import_encrypted_archive(
                 req.path,
@@ -182,7 +190,7 @@ def create_portability_router(
     @router.post("/api/knowledge-graph/archive/restore")
     async def restore_encrypted_archive(req: EncryptedRestoreRequest, request: Request):
         require_admin(request)
-        _require_service()
+        _require_service(request)
         try:
             return service.restore_encrypted_archive(
                 req.path,
@@ -196,7 +204,7 @@ def create_portability_router(
     @router.post("/api/brain/storage/postgres/docker")
     async def setup_postgres_docker(req: DockerPostgresRequest, request: Request):
         require_admin(request)
-        _require_service()
+        _require_service(request)
         return service.postgres_docker_setup(
             consent=req.consent,
             dry_run=req.dry_run,
@@ -206,7 +214,7 @@ def create_portability_router(
     @router.post("/api/brain/storage/migrate-postgres")
     async def migrate_sqlite_to_postgres(req: SQLiteToPostgresRequest, request: Request):
         require_admin(request)
-        _require_service()
+        _require_service(request)
         try:
             return service.migrate_sqlite_to_postgres(
                 dsn=req.dsn,

package/latticeai/api/project_sessions.py

@@ -11,9 +11,11 @@ from __future__ import annotations
 
 from typing import Any, Callable, List, Optional
 
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Request
 from pydantic import BaseModel, Field
 
+from latticeai.core.messages import http_error, resolve_language
+
 
 class CreateProjectRequest(BaseModel):
     title: str = Field(..., min_length=1, max_length=200)
@@ -65,7 +67,7 @@ def create_project_sessions_router(
         user = require_user(request)
         record = store.get(session_id, user_email=user, workspace_id=_scope(request))
         if record is None:
-            raise HTTPException(status_code=404, detail="project not found")
+            raise http_error(404, "project.not_found", resolve_language(request))
         return record
 
     @router.patch("/api/projects/{session_id}")
@@ -80,7 +82,7 @@ def create_project_sessions_router(
             workspace_id=_scope(request, write=True),
         )
         if record is None:
-            raise HTTPException(status_code=404, detail="project not found")
+            raise http_error(404, "project.not_found", resolve_language(request))
         return record
 
     @router.put("/api/projects/{session_id}/todos")
@@ -93,7 +95,7 @@ def create_project_sessions_router(
             workspace_id=_scope(request, write=True),
         )
         if record is None:
-            raise HTTPException(status_code=404, detail="project not found")
+            raise http_error(404, "project.not_found", resolve_language(request))
         return record
 
     @router.delete("/api/projects/{session_id}")
@@ -103,7 +105,7 @@ def create_project_sessions_router(
             session_id, user_email=user, workspace_id=_scope(request, write=True)
         )
         if not removed:
-            raise HTTPException(status_code=404, detail="project not found")
+            raise http_error(404, "project.not_found", resolve_language(request))
         return {"status": "deleted", "id": session_id}
 
     return router