ltcai 11.4.0 → 11.5.0

package/README.md

@@ -11,7 +11,7 @@
 [![CI Status](https://github.com/TaeSooPark-PTS/LatticeAI/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/TaeSooPark-PTS/LatticeAI/actions/workflows/ci.yml)
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 
-![v11.4.0 Living Brain walkthrough](output/release/v11.4.0/gifs/v11.4.0-living-brain-walkthrough.gif)
+![v11.5.0 Living Brain walkthrough](output/release/v11.5.0/gifs/v11.5.0-living-brain-walkthrough.gif)
 
 Chat, files, folders, notes, and web pages all flow into one durable knowledge
 graph on your computer. Any model — local MLX or cloud — can speak with that
@@ -24,10 +24,10 @@ memory. Nothing leaves your machine without explicit consent.
 
 | | |
 | --- | --- |
-| **See your Brain's story in time** — a growth curve, an activity heatmap, and each day's story, rewindable to any past moment ![Brain Chronicle](output/release/v11.4.0/screenshots/13-chronicle.png) | **Chat with a Brain that remembers** — every conversation grows durable, source-linked memory ![Brain Chat](output/release/v11.4.0/screenshots/04-brain-chat-home.png) |
-| **See how knowledge connects** — a real relationship graph, not a file list ![Memory Graph](output/release/v11.4.0/screenshots/05-memory-graph.png) | **Capture anything** — files, whole folders, notes, screenshots, web pages ![Capture](output/release/v11.4.0/screenshots/06-capture.png) |
-| **Automate with review** — agent changes become proposals you approve first ![Review Center](output/release/v11.4.0/screenshots/12-review-center.png) | **Pick a model in one click** — recommended local models for your hardware ![Recommended Models](output/release/v11.4.0/screenshots/02-recommended-models.png) |
-| **Watch a file become memory** — three named steps, not a pipeline diagram ![Material to memory](output/release/v11.4.0/screenshots/11-knowledge-journey.png) | **Say how much it may do alone** — one dial in plain words; dangerous actions stay blocked either way ![Settings](output/release/v11.4.0/screenshots/08-system.png) |
+| **See your Brain's story in time** — a growth curve, an activity heatmap, and each day's story, rewindable to any past moment ![Brain Chronicle](output/release/v11.5.0/screenshots/13-chronicle.png) | **Chat with a Brain that remembers** — every conversation grows durable, source-linked memory ![Brain Chat](output/release/v11.5.0/screenshots/04-brain-chat-home.png) |
+| **See how knowledge connects** — a real relationship graph, not a file list ![Memory Graph](output/release/v11.5.0/screenshots/05-memory-graph.png) | **Capture anything** — files, whole folders, notes, screenshots, web pages ![Capture](output/release/v11.5.0/screenshots/06-capture.png) |
+| **Automate with review** — agent changes become proposals you approve first ![Review Center](output/release/v11.5.0/screenshots/12-review-center.png) | **Pick a model in one click** — recommended local models for your hardware ![Recommended Models](output/release/v11.5.0/screenshots/02-recommended-models.png) |
+| **Watch a file become memory** — three named steps, not a pipeline diagram ![Material to memory](output/release/v11.5.0/screenshots/11-knowledge-journey.png) | **Say how much it may do alone** — one dial in plain words; dangerous actions stay blocked either way ![Settings](output/release/v11.5.0/screenshots/08-system.png) |
 
 ## Why Lattice AI
 
@@ -58,54 +58,57 @@ First-run flow — wake the Brain, pick the owner, load a recommended model:
 
 | | | |
 | --- | --- | --- |
-| ![Login](output/release/v11.4.0/screenshots/01-login.png) | ![Model install](output/release/v11.4.0/screenshots/03-install-load-progress.png) | ![Model library](output/release/v11.4.0/screenshots/07-model-library.png) |
+| ![Login](output/release/v11.5.0/screenshots/01-login.png) | ![Model install](output/release/v11.5.0/screenshots/03-install-load-progress.png) | ![Model library](output/release/v11.5.0/screenshots/07-model-library.png) |
 
 Screenshot index and capture notes:
-[output/release/v11.4.0/SCREENSHOT_INDEX.md](output/release/v11.4.0/SCREENSHOT_INDEX.md)
+[output/release/v11.5.0/SCREENSHOT_INDEX.md](output/release/v11.5.0/SCREENSHOT_INDEX.md)
 
 ## Current Release
 
-The current release is **11.4.0 — Rust Foundation**:
-
-The Rust migration begins — not as a rewrite, but as **working, proven
-pieces**, while the Python server keeps serving every product surface.
-
-- **A `rust/` workspace with three crates.** `lattice-core` reads the
-  same `knowledge_graph.sqlite` (read-only, WAL) and carries a
-  bit-for-bit port of the local hash embedder. `lattice-retrieval` is the
-  native hybrid/keyword/vector engine — proven against committed Python
-  goldens at **75/75 exact parity, zero epsilon**, with a bidirectional
-  contract: a Python test suite re-runs the same goldens so neither side
-  can drift silently. `lattice-host` is the worker supervisor (HTTP
-  `/health` gating, crash auto-restart with backoff, graceful shutdown,
-  unified port selection) plus a loopback-only gateway: `/host/*` status,
-  native `/rust/search/*`, and a streaming reverse proxy for everything
-  else — an opt-in front door, with 194 Rust tests behind it.
-- **The desktop shell rides the new foundation.** The Tauri `main.rs`
-  shrank from 451 to 149 lines by consuming `lattice-host`; its five IPC
-  commands keep their exact contracts, a candidate-resolution
-  priority-order bug is fixed, and the TCP probe became a real health
-  check.
-- **The same discipline, extended.** CI gained a dedicated `rust` job
-  (fmt, clippy `-D warnings`, tests); the 1,000-line file ceiling now
-  covers `*.rs`; the version bump keeps the Rust workspace in lockstep
-  (25 synchronized targets). The full migration roadmap lives in
-  [docs/v11.4.0_RUST_FOUNDATION_PLAN.md](docs/v11.4.0_RUST_FOUNDATION_PLAN.md).
-
-All of it lands with the floor intact: **6,643 Python + 1,761 frontend
-tests at 100.00% statement and branch coverage, 194 Rust tests**, mypy
-and clippy clean, verified on macOS 3.14 and a fresh-resolve python 3.11
-environment.
+The current release is **11.5.0 — Rust Complete**:
+
+Phases 2–4 of the Rust roadmap land in one release — as **working, proven
+pieces**, with Python converging to its target role: the AI Worker.
+
+- **The desktop's front door is now the Rust gateway.** The Tauri shell
+  boots the supervisor + gateway topology by default and the webview
+  lives at the gateway origin. The one real blocker — a CSRF policy
+  bound to the worker's own port — is dissolved by environment
+  injection, proven live against the real Python worker (trusted
+  origins 200, foreign origins 403). Three escape hatches preserve the
+  previous topologies.
+- **The native surface grew fourfold.** `lattice-retrieval` now serves
+  the three-channel service search, graph reads (search /
+  relationships / traverse), the full history read family, and the
+  chat context assembler — **191/191 exact-parity goldens, zero
+  epsilon**. `lattice-ingest` carries the typed chunker (332 golden
+  chunks, and a 26/26 mutation-test pass proving every constant
+  load-bearing) plus the polling folder watcher; writes stay delegated
+  to the worker, the single writer. `lattice-agent` carries the
+  permission kernel — **2,452 exact decision-table verdicts** — and
+  natively executes only validated read-only commands in a replaced
+  environment. `lattice-jobs` closes a documented gap: the durable
+  embed queue now has a scheduler (60s ticks, honest backoff,
+  `/host/jobs` status) driving a new fully-covered drain endpoint.
+- **The honest boundary, stated.** The Python worker keeps the document
+  parser matrix, embedding production, LLM inference, mutating tool
+  execution, and all graph writes. The agent loop orchestration port
+  remains for a future release, for reasons written down in the plan.
+
+All of it lands with the floor intact: **6,861 Python + 1,761 frontend
+tests at 100.00% statement and branch coverage, 534 Rust workspace
+tests**, four bidirectional golden families, mypy/ruff/clippy clean,
+verified on macOS 3.14 and a fresh-resolve python 3.11 environment.
 
 Release notes: [RELEASE.md](RELEASE.md) · Full history: [docs/CHANGELOG.md](docs/CHANGELOG.md)
 
-Expected artifacts for 11.4.0 release must use exact filenames:
+Expected artifacts for 11.5.0 release must use exact filenames:
 
-- `dist/ltcai-11.4.0-py3-none-any.whl`
-- `dist/ltcai-11.4.0.tar.gz`
-- `ltcai-11.4.0.tgz`
-- `dist/ltcai-11.4.0.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_11.4.0_aarch64.dmg`
+- `dist/ltcai-11.5.0-py3-none-any.whl`
+- `dist/ltcai-11.5.0.tar.gz`
+- `ltcai-11.5.0.tgz`
+- `dist/ltcai-11.5.0.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_11.5.0_aarch64.dmg`
 
 Do not use wildcard artifact uploads. Package registry publishing remains owner-run.
 
@@ -140,6 +143,7 @@ See [ARCHITECTURE.md](ARCHITECTURE.md) for details and
 
 | Version | Theme |
 | --- | --- |
+| 11.5.0 | Rust Complete |
 | 11.4.0 | Rust Foundation |
 | 11.3.0 | Time Remembers |
 | 11.2.0 | All Systems On |

package/docs/CHANGELOG.md

@@ -4,6 +4,32 @@ The top entry is either the current unreleased main-branch work or the current
 release line. Older entries are historical and may describe behavior as it
 existed at that release.
 
+## [11.5.0] - 2026-08-11 — Rust Complete
+
+### Added
+- **Phase 2–4 완결** (docs/v11.5.0_RUST_COMPLETE_PLAN.md): 신규 크레이트
+  `lattice-ingest`(typed chunking 4전략 1:1 포트 — 골든 332청크 완전
+  일치·뮤테이션 26/26, mtime 폴링 워처, 워커 위임 단일 작성자),
+  `lattice-jobs`(60s 드레인 스케줄러·백오프·`/host/jobs`·옵트인
+  autoresume), `lattice-agent`(권한 커널 — 모드 판정 2,358 + 명령 검증
+  59 + shlex 35 완전 일치, 읽기 전용 명령 네이티브 실행, `/rust/agent/*`).
+- `lattice-retrieval` 확장: 3채널 service-hybrid·graph_search·
+  relationship_search·traverse·히스토리 전 읽기·Context Assembler —
+  신규 패리티 116(총 191/191, 엡실론 0), 계약 pytest 199.
+- Python additive: `POST /api/index/drain` + `GET /api/index/queue`
+  (문·분기 100%, ko/en 로컬라이즈 21번째 라우터) — "배경 임베드 큐를
+  아무도 몰지 않는다" 한계 해소.
+- 게이트웨이 마운트 맵: `/rust/{search,graph,history,context,ingest,agent}`
+  + `/host/jobs*`; `/host`·`/rust` 네임스페이스는 프록시로 새지 않음.
+
+### Changed
+- **데스크톱 front-door 기본화**: Tauri가 게이트웨이 토폴로지로 기동
+  (웹뷰=게이트웨이 origin), CSRF는 `LATTICEAI_CSRF_TRUSTED_ORIGINS`
+  주입으로 해소(실워커 라이브 검증), 안전 밸브
+  `LATTICEAI_DESKTOP_DIRECT=1`/`BACKEND_ORIGIN`/`NO_BACKEND` 유지,
+  `backend_status`에 topology/worker_origin/gateway_origin/jobs_running
+  추가(기존 6필드 보존). SSE 프록시 `X-Accel-Buffering: no` 보강.
+
 ## [11.4.0] - 2026-08-11 — Rust Foundation
 
 ### Added

package/docs/COMMUNITY_AND_PLUGINS.md

@@ -1,6 +1,6 @@
 # Community And Plugins
 
-Current release: **11.4.0 — Rust Foundation**.
+Current release: **11.5.0 — Rust Complete**.
 
 LatticeAI defines the path from a strong local-first framework (8.4.0
 action-aware baseline, 8.5.0 registry+DI hardening, 8.6.0 capture/navigation

package/docs/DEVELOPMENT.md

@@ -3,7 +3,7 @@
 > **Status: canonical** — current contributor guidance, kept in sync with the
 > current release.
 
-Current release: **11.4.0 — Rust Foundation**.
+Current release: **11.5.0 — Rust Complete**.
 
 This document is for contributors working on the local-first Digital Brain
 codebase. Product positioning and quick start stay in `README.md`; release

package/docs/ONBOARDING.md

@@ -1,6 +1,6 @@
 # Lattice AI Onboarding
 
-Current release: **11.4.0 — Rust Foundation**.
+Current release: **11.5.0 — Rust Complete**.
 
 The first-run goal is a five-minute path from "I opened the app" to "my Brain
 has a source, a question, and proof." This page is the product contract behind

package/docs/OPERATIONS.md

@@ -1,4 +1,4 @@
-# Lattice AI — Operations Guide (v11.4.0)
+# Lattice AI — Operations Guide (v11.5.0)
 
 > **Status: canonical** — kept in sync with the current release. Storage layout
 > below reflects the SQLite live Brain store and workspace scoping, not the

package/docs/TRUST_MODEL.md

@@ -1,6 +1,6 @@
 # Lattice AI Trust Model
 
-Current release: **11.4.0 — Rust Foundation**.
+Current release: **11.5.0 — Rust Complete**.
 
 Lattice AI is local-first, explicit about external communication, and honest
 when a capability is unavailable.

package/docs/WHY_LATTICE.md

@@ -1,6 +1,6 @@
 # Why Lattice AI Exists
 
-Current release: **11.4.0 — Rust Foundation**.
+Current release: **11.5.0 — Rust Complete**.
 
 **Lattice AI is a local-first Digital Brain that keeps your knowledge durable
 across any AI model.**

package/docs/kg-schema.md

@@ -1,6 +1,6 @@
 # Knowledge Graph Schema
 
-Current release: **11.4.0 — Rust Foundation**.
+Current release: **11.5.0 — Rust Complete**.
 
 명세 출처: `lattice_ai_full_spec.pptx` 슬라이드 20·21·22
 구현: `lattice_brain/graph/schema.py`

package/docs/v11.4.0_RUST_FOUNDATION_PLAN.md

@@ -156,12 +156,17 @@ Tauri 명령 5종(`backend_origin`/`backend_status`/`restart_backend`/
 
 ## 로드맵 (다이어그램 → 릴리스 매핑)
 
-| Phase | 릴리스 | 내용 |
-|---|---|---|
-| 1 | **11.4.0** | workspace + core 읽기층 + retrieval 패리티 + host 수퍼바이저/게이트웨이(옵트인) + Tauri 통합 |
-| 2 | 11.5.x | 게이트웨이 front-door 기본화, KG 읽기·3채널 검색·history 네이티브, Ingestion Watch/Chunk/Dedup |
-| 3 | 11.6.x | Jobs/Events/Pipeline/Scheduler, Context Builder 네이티브 |
-| 4 | 12.0 | Agent Runtime(Tools·Process·Sandbox·Permission) Rust화 — Python은 AI Worker로 수렴 |
+| Phase | 릴리스 | 내용 | 상태 |
+|---|---|---|---|
+| 1 | **11.4.0** | workspace + core 읽기층 + retrieval 패리티 + host 수퍼바이저/게이트웨이(옵트인) + Tauri 통합 | **출하됨** |
+| 2 | **11.5.0** | 게이트웨이 front-door 기본화(데스크톱), KG 읽기·3채널 검색·history 네이티브, Ingestion Watch/Chunk/Dedup | **출하됨** |
+| 3 | **11.5.0** | Jobs/Events/Scheduler, Context Builder 네이티브 | **출하됨** |
+| 4 | **11.5.0** | Agent Runtime(Tools·Sandbox·Permission) Rust화 — 단, 루프 오케스트레이션 이식은 명시적 비-목표로 남음(v11.5.0 계획 §4c) | **출하됨(커널)** |
+
+Phase 2~4는 원래 11.5.x~12.0으로 나뉘어 있었으나 한 릴리스로 합쳐 출하했다
+([`v11.5.0_RUST_COMPLETE_PLAN.md`](v11.5.0_RUST_COMPLETE_PLAN.md)). 아래 §
+"명시적 비-목표"의 네 항목 중 마지막(HNSW/quantized·CE rerank·이미지 late
+fusion 패리티)만 여전히 미이식이며, 나머지는 11.5.0에서 닫혔다.
 
 ## 릴리스 체크리스트 (11.4.0)
 

package/docs/v11.5.0_RUST_COMPLETE_PLAN.md

@@ -0,0 +1,145 @@
+# v11.5.0 — Rust Complete (설계 문서)
+
+> 상태: 계획 → 구현 → **출하됨(v11.5.0)**. v11.4.0 Rust Foundation 계획의
+> Phase 2·3·4를 한 릴리스로 완결한다. 원칙 불변: **작동하고 증명된
+> 조각만 출하하고, Python 서버는 목표 다이어그램의 AI Worker로
+> 수렴하되 제거되지 않는다.** 모든 네이티브 경로는 패리티 골든 또는
+> 결정표 골든으로 잠근다.
+>
+> 통합 상태: **완료**. 네 크레이트의 라우터 팩토리는 게이트웨이의
+> 리버스 프록시 폴스루보다 앞에 마운트되어 있고(`rust/lattice-host/src/gateway/mounts.rs`),
+> 데스크톱은 기본으로 게이트웨이 토폴로지로 뜬다(`src-tauri/src/topology.rs`,
+> 안전 밸브 3종 유지). §2a의 CSRF origin 주입과 SSE `X-Accel-Buffering`
+> 보강도 배선 완료. §4c(에이전트 루프 오케스트레이션 이식)만 의도적으로
+> 남아 있으며, 그 이유는 아래 본문 그대로다.
+
+## Phase 2 — Front Door + 읽기/검색/히스토리 네이티브 + Ingestion 프리미티브
+
+### 2a. 게이트웨이 front-door 기본화 (데스크톱)
+- 정찰 확정 사실: 쿠키(host-only)·CSP(`connect-src 'self' http://127.0.0.1:*`)
+  ·리다이렉트(전부 상대)는 origin 전환에 안전. **유일한 차단기는 CSRF
+  origin 정책이 워커 자신의 포트로 빌드되는 것**(web_runtime.py:42-67,
+  csrf.py:154-164 — Host는 프록시가 hop-by-hop으로 제거).
+- 해소(Rust만으로): `worker_env`가
+  `LATTICEAI_CSRF_TRUSTED_ORIGINS=http://127.0.0.1:{gw},http://localhost:{gw}`
+  를 워커에 주입(config.py:170이 이미 파싱). 게이트웨이 SSE 프록시는
+  `X-Accel-Buffering: no`를 이벤트 스트림 응답에 보강.
+- Tauri는 기본적으로 **게이트웨이 origin으로 항해**(`backend_origin` =
+  게이트웨이). `LATTICEAI_DESKTOP_BACKEND_ORIGIN`/`LATTICEAI_DESKTOP_DIRECT=1`
+  이면 종전 직결 유지(안전 밸브). e2e: 게이트웨이 경유 스모크 추가.
+- 알려진 잔여(문서화): invite-link 절대 URL(Host 재작성), SSO redirect
+  기본값, permission UI 기본 URL — 데스크톱 front-door에서 워커 포트를
+  가리킴. 영향 좁음(관리자/SSO 경로), FEATURE_STATUS에 명시.
+
+### 2b. 3채널 검색·KG 읽기·히스토리 네이티브 (lattice-retrieval 확장)
+패리티 대상(정찰 §6·§7의 명세 그대로):
+- `graph_search`: direct 1/rank + relationship 0.75/rank + traverse
+  이웃 0.45/rank, score=max 병합, **안정 정렬(동점 삽입순, id 타이브레이크
+  없음 — Python 그대로)**, graph_context 축적.
+- `relationship_search`: 6-way LIKE, `ORDER BY weight DESC, created_at
+  DESC, id ASC`, 양 끝점 스코프 통과 시만 생존, 점수 없음.
+- `traverse`: 무방향 BFS, 라운드당 `limit*3` 엣지 캡(라운드 종속성
+  포함 재현), visited<limit 게이트, 노드 수화 `updated_at DESC, id ASC`.
+- 서비스층 `hybrid_search`(3채널): `weights` 명시=재작성/감쇠 없음,
+  None=policy 적용; 기여도 `w * max(score, 1/rank)` 합산; 채널 payload
+  에코; POST/GET 비대칭 재현.
+- 히스토리 읽기: `_scope_sql`(빈 allowed+no-legacy ⇒ 1=0), 그룹핑
+  (`legacy-previous-history` 버킷, updated_at DESC), get_conversation
+  (전체 로드 후 필터 — 동일 재현), search(부분일치, "마지막 30그룹"
+  슬라이스 그대로).
+- 골든: 기존 픽스처 스토어 확장(대화 행 추가) + 새 질의 세트,
+  Python 계약 테스트 확장. 게이트웨이 라우트:
+  `/rust/search/service-hybrid`, `/rust/graph/{search,relationships,traverse}`,
+  `/rust/history`, `/rust/history/{conversations,search}` (라우터 팩토리로
+  노출, X5가 마운트).
+
+### 2c. lattice-ingest — Watch · Parse · Chunk · Dedup (단일 작성자 원칙)
+- **typed chunking 1:1 포트**(_kg_common/text.py 명세 전부: plain 1200/160,
+  markdown 섹션 스택+200자 전방 병합, code 세그먼트 팩킹+1.5x 하드리밋,
+  prose 경계 백업 `max(start+1, end-overlap)`, overlap 클램프) +
+  chunk id `chunk:{sha256(f"{node}:{i}:{text}")[:24]}` (utf-8 replace).
+- 해시 규약: `_clean_text`+sha256(text_hash), content_hash 이원 규약
+  (파일=바이트 sha256, 텍스트=`type|uri|text`) 그대로.
+- 파일 워치: mtime 폴링 스냅샷(현행 folder_watch 의미론 — OS 워처
+  아님)을 Rust 타이머로; 변경 감지 시 **워커의 기존 인제스트 API로
+  위임**(`POST /knowledge-graph/ingest` type=note 또는 folder 재스캔
+  트리거) — 그래프 쓰기는 계속 Python 단일 작성자. Rust는 감지·파싱
+  (txt/md)·청킹·중복 판정까지 수행하고 결과를 검증 가능하게 반환.
+- 패리티: 청킹 골든(Python 생성기 — 4전략 × 경계 케이스 · 한/영 ·
+  PDF 페이지 오프셋 산술) 완전 일치.
+
+## Phase 3 — Jobs · Events · Scheduler + Context Builder
+
+### 3a. lattice-jobs — 스케줄러 (문서화된 갭의 해소)
+- FEATURE_STATUS:179-185 "아무것도 배경 임베드 큐를 몰지 않는다"를
+  닫는다: Rust 타이머(기본 60s, env 조절)가 워커의 **신규 additive
+  엔드포인트** `POST /api/index/drain`(이번 릴리스에 Python에 추가,
+  `IngestionPipeline.drain_vector_queue` 호출, require_user+게이트,
+  100% 커버)을 호출. 미완 ingestion job resume도 동일 타이머가
+  `GET /api/ingestion/jobs` → 조건부 `/resume`으로 재개(기본 꺼짐,
+  `LATTICEAI_JOBS_AUTORESUME=1` 옵트인).
+- `/host/jobs` 상태 라우트: 마지막 틱 결과·다음 예정·큐 카운트
+  (`vector_jobs` 읽기 전용 카운트는 lattice-core로 직접).
+- 이벤트: 틱 결과를 호스트 로그 + `/host/jobs`에 노출(간결·정직).
+
+### 3b. Context Builder 네이티브 (lattice-retrieval 내 모듈)
+- `lattice_brain/context.py`의 `ContextAssembler` 포트: approx_tokens
+  `(len+3)//4`, 고정 섹션 순서(memories→artifacts→knowledge→notes→recent),
+  greedy 예산 절단(`content[:remaining*4]`, 절단 후 재계측 동작 포함)
+  — 시임은 네이티브 검색/히스토리 리더로 주입. 골든: 동일 픽스처에서
+  Python 어셈블러 출력과 완전 일치. 게이트웨이 `/rust/context/assemble`.
+- 문서 생성용 context_builder(B)는 Phase 4 이후로 명시 이월(
+  search_for_document_generation 의존).
+
+## Phase 4 — Agent Runtime: Tools · Sandbox · Permission (안전 커널)
+
+**다이어그램의 라벨(Tools/Process/Sandbox/Permission)을 Rust가 소유**하고,
+LLM 추론·변이 도구 실행은 워커에 위임(그것이 AI Worker의 정의다).
+
+### 4a. 권한 커널 — 결정표 패리티
+- `normalize_mode`(별칭 표 포함), `effective_auto_approve`(모드×도구
+  집합×risk×change_class 전 분기), `is_circuit_breaker`(파괴 risk·루트/홈
+  경로·rm -rf 변형), `should_stage_proposal`, `plan_requires_approval`,
+  `block_reason_for_tool`(우선순위 체인), `classify_tool_call`
+  (MUTATING_TOOL_INVENTORY 27종) 전부 포트.
+- **결정표 골든**: Python 생성기가 (mode × tool × policy × args)
+  그리드 수백 케이스의 판정을 JSON으로 떠서 커밋; Rust와 Python 양쪽
+  계약 테스트가 같은 골든을 상시 단언(11.4.0 방식).
+
+### 4b. 도구 샌드박스 — 검증 패리티 + 네이티브 실행(읽기 전용)
+- `run_command` 검증기 포트: shlex 분해, 실행경로/allowlist/셸 연산자/
+  find·rg 플래그/절대경로·`..`·심링크 이스케이프 규칙, env 치환
+  (HOME=AGENT_ROOT, 고정 PATH). **검증 판정 골든**(명령 문자열 그리드)
+  완전 일치. 통과한 읽기 전용 명령(pwd/ls/find/cat/head/tail/wc/rg)은
+  Rust가 직접 실행(타임아웃 30s·출력 12,000자 캡 동일).
+- 파일 도구: `_resolve_path` 의미론(AGENT_ROOT 격리) + read/list 네이티브.
+- 게이트웨이 `/rust/agent/preflight`(계획/도구콜 배열 + mode → 판정
+  목록)와 `/rust/agent/exec`(커널 통과 읽기 전용 명령만 실행; 그 외
+  는 판정과 함께 거부) — 변이는 절대 실행하지 않는다.
+
+### 4c. 루프 위임 — `/rust/agent/run`
+- 워커 `/agent`(SSE)로 턴을 위임하되 호스트가 `permission_mode`를
+  스탬프하고, 반환 계획에 커널 preflight를 병기해 표면에 제공.
+  Python 루프 자체의 재작성은 **명시적 비-목표**(결정 커널이 잠긴
+  지금, 루프 이식은 후속 릴리스의 기계적 작업으로 남긴다 — 이유:
+  AgentDeps 12개 시임의 실배선 검증 없이 이식하면 증명 없는 재작성).
+
+## 게이트/검증/릴리스
+
+- 신규 크레이트 3종(lattice-ingest/jobs/agent) 워크스페이스 편입,
+  전 파일 ≤1,000줄(목표 ≤500), fmt/clippy/test CI rust 잡 그대로.
+- Python 추가분(drain 엔드포인트 등)은 문·분기 100% 유지.
+- 골든 4계열(검색·히스토리/청킹/컨텍스트/권한·명령 판정) 모두
+  양방향(계약 pytest + cargo 테스트).
+- 릴리스 절차는 11.4.0과 동일: bump 11.5.0 → 문서·테마("Rust
+  Complete") → evidence 재촬영(13종+GIF) → artifacts(DMG) →
+  main 커밋·푸시 → CI 그린.
+
+## 정직한 경계 (FEATURE_STATUS에 그대로 기재)
+
+- Python 서버는 계속 모든 제품 표면을 서빙한다 — front-door는
+  데스크톱 기본 + 옵트인 바이너리이며, 네이티브 라우트는 검증된
+  대체 경로다.
+- 문서 파서 매트릭스(pdf/docx/xlsx/pptx)·임베딩 생산·LLM 추론·변이
+  도구 실행·그래프 쓰기는 워커 소유(설계상 단일 작성자/AI Worker).
+- 에이전트 루프 오케스트레이션의 Rust 이식은 남는다(4c의 이유).

package/lattice_brain/__init__.py

@@ -26,7 +26,7 @@ from .storage import (
     storage_from_env,
 )
 
-__version__ = "11.4.0"
+__version__ = "11.5.0"
 
 __all__ = [
     "AgentRuntime",

package/lattice_brain/runtime/multi_agent.py

@@ -49,7 +49,7 @@ from typing import Any, Callable, Dict, List, Optional
 from ..utils import now_iso as _now
 from .contracts import multi_agent_contract
 
-MULTI_AGENT_VERSION = "11.4.0"
+MULTI_AGENT_VERSION = "11.5.0"
 
 AGENT_ROLES = ("researcher", "planner", "executor", "reviewer", "release")
 CORE_PIPELINE = ("planner", "executor", "reviewer")

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "11.4.0"
+__version__ = "11.5.0"

package/latticeai/api/index_jobs.py

@@ -0,0 +1,145 @@
+"""Index jobs API (v11.5.0, plan §3a) — the trigger the embed queue never had.
+
+``vector_jobs`` has been a durable backlog since v11.1.0: an ingest whose
+inline embedding fails lands anyway, the node is queued, and
+``VectorEmbedQueue.tick`` will embed it *when someone runs a tick*. Nobody did.
+The only drain in the product was
+:meth:`~lattice_brain.ingestion.IngestionPipeline.drain_vector_queue`, callable
+from a test or a REPL and from nothing that runs on its own — which is what
+FEATURE_STATUS.md:179-185 says out loud.
+
+This router is the missing half: an HTTP surface a scheduler can call.
+
+* ``POST /api/index/drain`` — run one tick now, answer with what it did and
+  what is left.
+* ``GET  /api/index/queue`` — the backlog counts, read-only.
+
+Their two siblings under the same prefix live in ``search.py``
+(``/api/index/status``, ``/api/index/rebuild``): those answer *is the index
+complete* and *rebuild it from scratch*, which is the operator's hammer. This
+pair is the small, repeatable step a timer can take every minute.
+
+Two honest boundaries, stated here so the payloads are not read as more than
+they are:
+
+* **The backlog is machine-wide.** One SQLite queue serves every workspace, so
+  a drain embeds whatever is owed regardless of who asked, and the counts are
+  totals for this Brain. The workspace gate still runs on both paths — it is
+  the authorization check, not a filter — and the drain payload says
+  ``scope: "machine"`` rather than implying a scoped number.
+* **Draining is not indexing.** The tick delegates to the store's own indexer;
+  a node that fails goes back to ``pending`` until its retry budget runs out.
+  The response reports ``claimed``/``indexed``/``retried``/``failed`` verbatim
+  from the queue instead of summarising them into a success flag.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Any, Callable, Dict, Optional
+
+from fastapi import APIRouter, Request
+from pydantic import BaseModel
+
+from lattice_brain.graph.vector_index import DEFAULT_TICK_LIMIT, VECTOR_JOB_STATUSES
+from latticeai.core.messages import http_error, resolve_language
+
+#: Bounds on one drain. The floor keeps a caller from asking for a no-op tick
+#: that still claims the queue's lock; the ceiling keeps one HTTP request from
+#: turning into an unbounded embedding run behind a client that will time out.
+MIN_DRAIN_LIMIT = 1
+MAX_DRAIN_LIMIT = 100
+
+
+class DrainRequest(BaseModel):
+    """How many queued nodes one drain may claim.
+
+    Omitted (or a body-less POST) means the queue's own tick size, so a caller
+    with no opinion inherits the number the queue was designed around.
+    """
+
+    limit: Optional[int] = None
+
+
+def create_index_jobs_router(
+    *,
+    pipeline: Any,
+    knowledge_graph: Any,
+    require_user: Callable[[Request], Any],
+    gate_read: Callable[[Request], Optional[str]],
+    gate_write: Callable[[Request], Optional[str]],
+) -> APIRouter:
+    router = APIRouter()
+
+    def _require_pipeline(request: Request) -> Any:
+        """The pipeline, or 503 — a drain without ingestion is not a 500."""
+        if pipeline is None or not pipeline.available():
+            raise http_error(503, "capture.ingestion_disabled", resolve_language(request))
+        return pipeline
+
+    def _queue_state() -> Dict[str, Any]:
+        """Backlog counts, or an explicit "not tracked" — never a fake zero.
+
+        A store without a durable queue reports ``available: false`` alongside
+        its zeros, because "0 pending" and "nothing is counting" are different
+        answers and a scheduler polling this would otherwise read the second as
+        the first.
+        """
+        queue = getattr(knowledge_graph, "vector_queue", None)
+        if queue is None or not queue.available:
+            return {
+                "available": False,
+                "counts": dict.fromkeys(VECTOR_JOB_STATUSES, 0),
+                "pending": 0,
+            }
+        return {
+            "available": True,
+            "counts": dict(queue.snapshot()),
+            "pending": int(queue.pending_count()),
+        }
+
+    @router.post("/api/index/drain")
+    async def drain_index_queue(request: Request, req: Optional[DrainRequest] = None):
+        """Run one background-embedding tick and report what it did.
+
+        Off the event loop: the tick opens SQLite and calls the embedder, and
+        this server has one loop for every user (10.9.0).
+        """
+        require_user(request)
+        gate_write(request)
+        active = _require_pipeline(request)
+        requested = req.limit if req is not None else None
+        limit = DEFAULT_TICK_LIMIT if requested is None else requested
+        if limit < MIN_DRAIN_LIMIT or limit > MAX_DRAIN_LIMIT:
+            raise http_error(
+                422,
+                "index.limit_out_of_range",
+                resolve_language(request),
+                min=MIN_DRAIN_LIMIT,
+                max=MAX_DRAIN_LIMIT,
+            )
+        tick = await asyncio.to_thread(active.drain_vector_queue, limit)
+        return {
+            **dict(tick),
+            "limit": limit,
+            "scope": "machine",
+            "queue": _queue_state(),
+        }
+
+    @router.get("/api/index/queue")
+    async def index_queue(request: Request):
+        """The embed backlog, counted. Reads nothing else and writes nothing."""
+        require_user(request)
+        gate_read(request)
+        _require_pipeline(request)
+        return _queue_state()
+
+    return router
+
+
+__all__ = [
+    "MAX_DRAIN_LIMIT",
+    "MIN_DRAIN_LIMIT",
+    "DrainRequest",
+    "create_index_jobs_router",
+]

package/latticeai/core/legacy_compatibility.py

@@ -13,7 +13,7 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Dict, List
 
-LEGACY_COMPATIBILITY_VERSION = "11.4.0"
+LEGACY_COMPATIBILITY_VERSION = "11.5.0"
 
 
 @dataclass(frozen=True)

package/latticeai/core/marketplace.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 from copy import deepcopy
 from typing import Any, Dict, List, Optional
 
-MARKETPLACE_VERSION = "11.4.0"
+MARKETPLACE_VERSION = "11.5.0"
 TEMPLATE_KINDS = ("plugin", "workflow", "agent", "ingestion_bridge")
 
 

package/latticeai/core/messages.py

@@ -531,6 +531,11 @@ MESSAGES: Dict[str, Dict[str, str]] = {
         "ko": "시점을 읽을 수 없습니다. 2026-08-11T09:00:00 처럼 적어 주세요.",
         "en": "That moment could not be read. Write it like 2026-08-11T09:00:00.",
     },
+    # ── index jobs ──────────────────────────────────────────────────────
+    "index.limit_out_of_range": {
+        "ko": "한 번에 처리할 개수는 {min}에서 {max} 사이여야 합니다.",
+        "en": "Ask for between {min} and {max} items in one pass.",
+    },
     # ── MCP / setup ─────────────────────────────────────────────────────
     "mcp.connector_not_found": {
         "ko": "커넥터를 찾을 수 없습니다.",

package/latticeai/core/workspace_os_constants.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 
 from typing import Dict
 
-WORKSPACE_OS_VERSION = "11.4.0"
+WORKSPACE_OS_VERSION = "11.5.0"
 
 # Workspace types separate single-user Personal workspaces from shared
 # Organization workspaces. Both keep the same local-first JSON store; the type