ltcai 11.5.0 → 11.5.2

package/latticeai/services/network_boundary_service.py

@@ -12,12 +12,9 @@ ack is audited. Hard node filters remain in ``latticeai.core.network_boundary``.
 
 from __future__ import annotations
 
-import json
-import threading
 from pathlib import Path
 from typing import Any, Callable, Dict, Optional
 
-from latticeai.core.io_utils import atomic_write_json
 from latticeai.core.network_boundary import (
     DEFAULT_NETWORK_MODE,
     NetworkBoundaryMode,
@@ -25,11 +22,14 @@ from latticeai.core.network_boundary import (
     network_mode_contract,
     normalize_network_mode,
 )
+from latticeai.services.mode_store import JsonBackedModeService
 
 
-class NetworkBoundaryService:
+class NetworkBoundaryService(JsonBackedModeService[NetworkBoundaryMode]):
     """Load / save the network boundary dial."""
 
+    FILENAME = "network_boundary.json"
+
     def __init__(
         self,
         *,
@@ -37,36 +37,11 @@ class NetworkBoundaryService:
         default_mode: NetworkBoundaryMode | str = DEFAULT_NETWORK_MODE,
         audit: Optional[Callable[..., None]] = None,
     ) -> None:
-        self._path = Path(data_dir) / "network_boundary.json"
+        super().__init__(data_dir=data_dir, audit=audit)
         self._default = normalize_network_mode(default_mode)
-        self._audit = audit or (lambda *a, **kw: None)
-        self._lock = threading.Lock()
-
-    def rebind_data_dir(self, data_dir: Path) -> None:
-        with self._lock:
-            self._path = Path(data_dir) / "network_boundary.json"
 
-    def rebind_audit(self, audit: Callable[..., None]) -> None:
-        with self._lock:
-            self._audit = audit
-
-    def _read(self) -> Dict[str, Any]:
-        if not self._path.exists():
-            return {"default": self._default.value, "users": {}, "workspaces": {}}
-        try:
-            data = json.loads(self._path.read_text(encoding="utf-8"))
-        except Exception:
-            return {"default": self._default.value, "users": {}, "workspaces": {}}
-        if not isinstance(data, dict):
-            return {"default": self._default.value, "users": {}, "workspaces": {}}
-        data.setdefault("default", self._default.value)
-        data.setdefault("users", {})
-        data.setdefault("workspaces", {})
-        return data
-
-    def _write(self, data: Dict[str, Any]) -> None:
-        self._path.parent.mkdir(parents=True, exist_ok=True)
-        atomic_write_json(self._path, data)
+    def _default_entry(self) -> Any:
+        return self._default.value
 
     def _resolve_from(
         self,
@@ -85,18 +60,6 @@ class NetworkBoundaryService:
                 return normalize_network_mode(user)
         return normalize_network_mode(data.get("default") or self._default)
 
-    def resolve(
-        self,
-        *,
-        user_email: Optional[str] = None,
-        workspace_id: Optional[str] = None,
-    ) -> NetworkBoundaryMode:
-        with self._lock:
-            data = self._read()
-        return self._resolve_from(
-            data, user_email=user_email, workspace_id=workspace_id,
-        )
-
     def get(
         self,
         *,

package/latticeai/services/permission_mode_service.py

@@ -14,12 +14,9 @@ not by this store.
 
 from __future__ import annotations
 
-import json
-import threading
 from pathlib import Path
 from typing import Any, Callable, Dict, Optional
 
-from latticeai.core.io_utils import atomic_write_json
 from latticeai.core.permission_mode import (
     DEFAULT_MODE,
     PermissionMode,
@@ -27,11 +24,14 @@ from latticeai.core.permission_mode import (
     mode_contract,
     normalize_mode,
 )
+from latticeai.services.mode_store import JsonBackedModeService
 
 
-class PermissionModeService:
+class PermissionModeService(JsonBackedModeService[PermissionMode]):
     """Load / save the autonomy dial."""
 
+    FILENAME = "permission_mode.json"
+
     def __init__(
         self,
         *,
@@ -39,43 +39,11 @@ class PermissionModeService:
         default_mode: PermissionMode | str = DEFAULT_MODE,
         audit: Optional[Callable[..., None]] = None,
     ) -> None:
-        self._path = Path(data_dir) / "permission_mode.json"
+        super().__init__(data_dir=data_dir, audit=audit)
         self._default = normalize_mode(default_mode)
-        self._audit = audit or (lambda *a, **kw: None)
-        self._lock = threading.Lock()
-
-    def rebind_data_dir(self, data_dir: Path) -> None:
-        """Point the store at the app's real data dir.
-
-        The wiring may instantiate this service lazily before routers know the
-        configured data dir; rebinding keeps one file of record instead of
-        stranding writes under the fallback path.
-        """
-        with self._lock:
-            self._path = Path(data_dir) / "permission_mode.json"
 
-    def rebind_audit(self, audit: Callable[..., None]) -> None:
-        """Attach the real audit sink once app wiring provides one."""
-        with self._lock:
-            self._audit = audit
-
-    def _read(self) -> Dict[str, Any]:
-        if not self._path.exists():
-            return {"default": self._default.value, "users": {}, "workspaces": {}}
-        try:
-            data = json.loads(self._path.read_text(encoding="utf-8"))
-        except Exception:
-            return {"default": self._default.value, "users": {}, "workspaces": {}}
-        if not isinstance(data, dict):
-            return {"default": self._default.value, "users": {}, "workspaces": {}}
-        data.setdefault("default", self._default.value)
-        data.setdefault("users", {})
-        data.setdefault("workspaces", {})
-        return data
-
-    def _write(self, data: Dict[str, Any]) -> None:
-        self._path.parent.mkdir(parents=True, exist_ok=True)
-        atomic_write_json(self._path, data)
+    def _default_entry(self) -> Any:
+        return self._default.value
 
     def _resolve_from(
         self,
@@ -84,11 +52,7 @@ class PermissionModeService:
         user_email: Optional[str],
         workspace_id: Optional[str],
     ) -> PermissionMode:
-        """Scope precedence: workspace → user → process default.
-
-        Pure over ``data`` and lock-free, so holders of ``_lock`` can reuse it
-        without re-entering a non-reentrant lock.
-        """
+        """Scope precedence: workspace → user → process default."""
         if workspace_id:
             ws = (data.get("workspaces") or {}).get(str(workspace_id))
             if ws:
@@ -99,18 +63,6 @@ class PermissionModeService:
                 return normalize_mode(user)
         return normalize_mode(data.get("default") or self._default)
 
-    def resolve(
-        self,
-        *,
-        user_email: Optional[str] = None,
-        workspace_id: Optional[str] = None,
-    ) -> PermissionMode:
-        with self._lock:
-            data = self._read()
-        return self._resolve_from(
-            data, user_email=user_email, workspace_id=workspace_id,
-        )
-
     def get(
         self,
         *,

package/latticeai/services/product_readiness.py

@@ -18,7 +18,7 @@ from typing import Any, Dict, List
 
 from latticeai.services.architecture_readiness import architecture_readiness
 
-PRODUCT_VERSION_TARGET = "11.5.0"
+PRODUCT_VERSION_TARGET = "11.5.2"
 
 
 @dataclass(frozen=True)

package/latticeai/services/setup_detection.py

@@ -50,6 +50,64 @@ def parse_windows_video_controllers(raw: str) -> List[Dict[str, Any]]:
     return controllers
 
 
+
+def parse_windows_cpu_info(
+    raw: str,
+    *,
+    model: str,
+    physical_cores: int,
+    logical_cores: int,
+) -> Tuple[str, int, int]:
+    """Read ``wmic cpu get Name,NumberOfCores,NumberOfLogicalProcessors``.
+
+    Whatever the output does not say keeps the value the caller already had —
+    ``wmic`` is absent on modern Windows images and prints nothing there, and
+    "0 cores" would be a worse answer than ``os.cpu_count()``'s guess.
+    """
+    for line in raw.splitlines():
+        key, _, value = line.partition("=")
+        if key == "Name" and value.strip():
+            model = value.strip()
+        elif key == "NumberOfCores" and value.strip():
+            try:
+                physical_cores = int(value.strip())
+            except ValueError:
+                quiet()
+        elif key == "NumberOfLogicalProcessors" and value.strip():
+            try:
+                logical_cores = int(value.strip())
+            except ValueError:
+                quiet()
+    return model, physical_cores, logical_cores
+
+
+#: ``IsProcessorFeaturePresent`` codes worth reporting, by instruction name.
+WINDOWS_PROCESSOR_FEATURES: Dict[int, str] = {
+    6: "sse", 10: "sse2", 13: "sse3", 19: "neon", 28: "rdrand",
+}
+
+
+def windows_processor_features() -> List[str]:
+    """Instruction-set flags from the Win32 API, or none anywhere else.
+
+    ``ctypes.windll`` exists only on Windows, so on every other platform this
+    raises and answers "nothing known" — which is the honest reading, since the
+    flags are unobtainable rather than absent.
+    """
+    try:
+        import ctypes
+
+        kernel32 = ctypes.windll.kernel32  # type: ignore[attr-defined]  # Windows-only
+        return [
+            name
+            for code, name in WINDOWS_PROCESSOR_FEATURES.items()
+            if kernel32.IsProcessorFeaturePresent(code)
+        ]
+    except Exception:
+        quiet()
+        return []
+
+
 def detect_cuda(which: WhichFn, run: RunFn) -> Tuple[bool, str, Optional[str], Optional[str]]:
     nvidia_smi = which("nvidia-smi")
     nvcc = which("nvcc")
@@ -78,4 +136,12 @@ def detect_tools(which: WhichFn, binaries: Iterable[str]) -> Dict[str, Optional[
     return {binary: which(binary) for binary in binaries}
 
 
-__all__ = ["detect_cuda", "detect_tools", "detect_wsl_from_text", "parse_windows_video_controllers"]
+__all__ = [
+    "WINDOWS_PROCESSOR_FEATURES",
+    "detect_cuda",
+    "detect_tools",
+    "detect_wsl_from_text",
+    "parse_windows_cpu_info",
+    "parse_windows_video_controllers",
+    "windows_processor_features",
+]

package/latticeai/services/tool_dispatch.py

@@ -362,10 +362,6 @@ def configure_tool_dispatch(
     )
 
 
-def agent_policy(action_name: str, args: dict) -> ToolPolicy:
-    return DEFAULT_TOOL_DISPATCH_SERVICE.policy_for(action_name, args)
-
-
 def agent_risk(action_name: str, args: dict) -> str:
     return DEFAULT_TOOL_DISPATCH_SERVICE.risk_level(action_name, args)
 

package/latticeai/services/upload_service.py

@@ -6,23 +6,15 @@ import logging
 import tempfile
 from datetime import datetime
 from pathlib import Path
-from typing import Optional
 
 from fastapi import HTTPException, Request, UploadFile
 
 from lattice_brain.ingestion import IngestionItem
+from latticeai.api.workspace_scope import resolve_workspace_scope
 from latticeai.core.quiet import quiet
 from latticeai.tools import ToolError, read_document
 
 
-def _workspace_scope_from_request(request: Request) -> Optional[str]:
-    header = request.headers.get("X-Workspace-Id")
-    if header and header.strip():
-        return header.strip()
-    query = request.query_params.get("workspace_id")
-    return query.strip() if query and query.strip() else None
-
-
 async def process_uploaded_document(
     *,
     request: Request,
@@ -39,17 +31,12 @@ async def process_uploaded_document(
     workspace_service=None,
 ) -> dict:
     enforce_rate_limit(current_user, "upload")
-    requested_workspace = _workspace_scope_from_request(request)
-    if workspace_service is not None:
-        try:
-            workspace_id = workspace_service.resolve_write_scope(
-                requested_workspace,
-                current_user or None,
-            )
-        except PermissionError as exc:
-            raise HTTPException(status_code=403, detail=str(exc)) from exc
-    else:
-        workspace_id = requested_workspace
+    workspace_id = resolve_workspace_scope(
+        request,
+        user=current_user,
+        workspace_service=workspace_service,
+        write=True,
+    )
     suffix = Path(file.filename or "upload").suffix.lower()
     allowed = {".pdf", ".docx", ".xlsx", ".pptx", ".txt", ".md", ".csv"}
     if suffix not in allowed:

package/latticeai/services/workspace_service.py

@@ -73,12 +73,6 @@ class WorkspaceService:
         self._ensure_permission(workspace_id, user_id, "write")
         return workspace_id
 
-    def can_read(self, workspace_id: str, user_id: Optional[str]) -> bool:
-        return self.store.has_permission(workspace_id, self._identity(user_id), "read")
-
-    def can_write(self, workspace_id: str, user_id: Optional[str]) -> bool:
-        return self.store.has_permission(workspace_id, self._identity(user_id), "write")
-
     def readable_workspaces(self, user_id: Optional[str]) -> list[str]:
         """Return workspace ids the caller can read.
 

package/latticeai/setup/auto_setup.py

@@ -47,6 +47,7 @@ from dataclasses import asdict, dataclass, field
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple
 
+from latticeai.core.module_probe import module_available
 from latticeai.core.quiet import quiet
 from latticeai.services.process_audit import (
     CommandConfirmationError,
@@ -59,6 +60,8 @@ from latticeai.services.setup_detection import (
     detect_cuda,
     detect_tools,
     detect_wsl_from_text,
+    parse_windows_cpu_info,
+    windows_processor_features,
 )
 from latticeai.services.setup_detection import (
     parse_windows_video_controllers as _parse_windows_video_controllers,
@@ -282,37 +285,23 @@ def _detect_cpu_details(prof_os: str) -> Tuple[str, int, int, List[str]]:
                 flags = line.split(":", 1)[-1].strip().lower().split()
     elif prof_os == "windows":
         raw = _run(["wmic", "cpu", "get", "Name,NumberOfCores,NumberOfLogicalProcessors", "/format:list"])
-        for line in raw.splitlines():
-            key, _, value = line.partition("=")
-            if key == "Name" and value.strip():
-                model = value.strip()
-            elif key == "NumberOfCores" and value.strip():
-                try:
-                    physical = int(value.strip())
-                except ValueError:
-                    quiet()
-            elif key == "NumberOfLogicalProcessors" and value.strip():
-                try:
-                    logical = int(value.strip())
-                except ValueError:
-                    quiet()
-        try:
-            import ctypes
-            kernel32 = ctypes.windll.kernel32  # type: ignore[attr-defined]  # Windows-only
-            feature_map = {6: "sse", 10: "sse2", 13: "sse3", 19: "neon", 28: "rdrand"}
-            flags.extend(name for code, name in feature_map.items() if kernel32.IsProcessorFeaturePresent(code))
-        except Exception:
-            quiet()
+        model, physical, logical = parse_windows_cpu_info(
+            raw, model=model, physical_cores=physical, logical_cores=logical,
+        )
+        flags.extend(windows_processor_features())
     interesting = {"avx", "avx2", "avx512f", "fma", "neon", "sse4_2", "sse", "sse2", "sse3", "rdrand"}
     return model, physical, logical, sorted({flag for flag in flags if flag in interesting})
 
 
 def _has_module(name: str) -> bool:
-    try:
-        __import__(name)
-        return True
-    except Exception:
-        return False
+    """Importable *and loadable*.
+
+    ``strict=True`` on purpose: this probe drives what the setup wizard offers
+    to install, and an ``mlx`` wheel built for another architecture has a
+    findable spec right up until it raises on load. Answering from the spec
+    alone would plan a runtime that cannot start.
+    """
+    return module_available(name, strict=True)
 
 
 def probe() -> SystemProfile:

package/latticeai/setup/wizard/catalog.py

@@ -10,6 +10,8 @@ from __future__ import annotations
 import re
 from typing import Dict, List, Tuple
 
+from latticeai.services.model_catalog import _version_tuple as _catalog_version_tuple
+
 # ── Model Catalog ─────────────────────────────────────────────────────────────
 # (model_id, display_name, size_gb, tag, description, min_ram_gb)
 # 11.2.0: 모든 repo id 를 2026-08-10 Hugging Face API 로 확인했다 — 존재 여부,
@@ -127,8 +129,9 @@ _BEST_MODEL_TIERS: Dict[str, List[Tuple[int, str]]] = {
 }
 
 
-def _version_tuple(raw: str) -> Tuple[int, ...]:
-    return tuple(int(part) for part in raw.split(".") if part.isdigit())
+
+#: The engine catalog owns this parse; the wizard compares the same strings.
+_version_tuple = _catalog_version_tuple
 
 
 def _catalog_row_family_version(row: Tuple[str, str, float, str, str, int]) -> Tuple[str, Tuple[int, ...]] | None:

package/latticeai/setup/wizard/detect.py

@@ -21,6 +21,8 @@ from latticeai.services.setup_detection import (
     detect_cuda,
     detect_tools,
     detect_wsl_from_text,
+    parse_windows_cpu_info,
+    windows_processor_features,
 )
 from latticeai.services.setup_detection import (
     parse_windows_video_controllers as _parse_windows_video_controllers,
@@ -98,33 +100,10 @@ def _detect_cpu() -> Dict[str, Any]:
             quiet()
     elif platform.system() == "Windows":
         raw = _cmd(["wmic", "cpu", "get", "Name,NumberOfCores,NumberOfLogicalProcessors", "/format:list"], timeout=5)
-        for line in raw.splitlines():
-            key, _, value = line.partition("=")
-            if key == "Name" and value.strip():
-                model = value.strip()
-            elif key == "NumberOfCores" and value.strip():
-                try:
-                    physical_cores = int(value.strip())
-                except ValueError:
-                    quiet()
-            elif key == "NumberOfLogicalProcessors" and value.strip():
-                try:
-                    logical_cores = int(value.strip())
-                except ValueError:
-                    quiet()
-        try:
-            import ctypes
-            kernel32 = ctypes.windll.kernel32  # type: ignore[attr-defined]  # Windows-only
-            feature_map = {
-                6: "sse",
-                10: "sse2",
-                13: "sse3",
-                19: "neon",
-                28: "rdrand",
-            }
-            flags.extend(name for code, name in feature_map.items() if kernel32.IsProcessorFeaturePresent(code))
-        except Exception:
-            quiet()
+        model, physical_cores, logical_cores = parse_windows_cpu_info(
+            raw, model=model, physical_cores=physical_cores, logical_cores=logical_cores,
+        )
+        flags.extend(windows_processor_features())
     interesting = {"avx", "avx2", "avx512f", "fma", "neon", "sse4_2"}
     if platform.system() == "Windows":
         interesting.update({"sse", "sse2", "sse3", "rdrand"})

package/latticeai/setup/wizard/paths.py

@@ -20,6 +20,8 @@ import shutil
 from pathlib import Path
 from typing import Any, Dict, List
 
+from latticeai.core.module_probe import module_available as _module_available
+
 OFFICIAL_DOWNLOADS: Dict[str, str] = {
     "homebrew": "https://brew.sh",
     "python": "https://www.python.org/downloads/",
@@ -149,11 +151,6 @@ def _which_detail(binary: str) -> Dict[str, Any]:
     return {"installed": path is not None, "path": path}
 
 
-def _module_available(module_name: str) -> bool:
-    import importlib.util
-    return importlib.util.find_spec(module_name) is not None
-
-
 def _package_module(package: str) -> str:
     return PACKAGE_MODULES.get(package, package.replace("-", "_").split("[", 1)[0])
 

package/latticeai/setup/wizard/plans.py

@@ -8,15 +8,15 @@ plan and therefore nothing to confirm.
 
 from __future__ import annotations
 
-import json as _json
 import sys
 from typing import Any, Dict, List
 
+from latticeai.core.sse import sse_frame
 from latticeai.services.process_audit import command_plan_for_commands
 
 
 def _sse(data: Dict) -> str:
-    return f"data: {_json.dumps(data, ensure_ascii=False)}\n\n"
+    return sse_frame(None, data)
 
 
 def _action_commands(action: Dict[str, Any]) -> List[List[str]]:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ltcai",
-  "version": "11.5.0",
+  "version": "11.5.2",
   "description": "Lattice AI — local-first Digital Brain that keeps your knowledge durable across any AI model.",
   "homepage": "https://github.com/TaeSooPark-PTS/LatticeAI#readme",
   "repository": {
@@ -52,7 +52,6 @@
     "desktop:tauri:check": "cd src-tauri && cargo check",
     "rust:test": "cd rust && cargo test --workspace",
     "rust:lint": "cd rust && cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings",
-    "desktop:electron": "electron desktop/electron/main.cjs",
     "package:vsix": "node scripts/build_vsix.mjs",
     "check:screenshot-delta": "node scripts/run_python.mjs scripts/check_screenshot_pixel_delta.py",
     "release:evidence": "node scripts/capture_release_evidence.mjs && node scripts/prune_release_evidence.mjs && npm run check:screenshot-delta",
@@ -124,7 +123,6 @@
     "!src-tauri/gen/**",
     "!src-tauri/target/",
     "!src-tauri/target/**",
-    "desktop/electron/",
     "docs/*.md",
     "!docs/assets/",
     "!docs/images/"
@@ -142,6 +140,7 @@
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
     "@types/cytoscape": "^3.21.9",
+    "@types/node": "24.13.2",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
@@ -150,7 +149,6 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cytoscape": "^3.34.0",
-    "electron": "^42.4.0",
     "jsdom": "^29.1.1",
     "lucide-react": "^1.17.0",
     "openapi-fetch": "^0.17.0",

package/scripts/bump_version.py

@@ -25,7 +25,20 @@ REPO = Path(__file__).resolve().parents[1]
 # it per crate — src-tauri's too, since 11.4.0, because the desktop shell now
 # depends on lattice-host by path — and a lockfile left behind is a file the
 # next `cargo build` silently rewrites underneath a tagged release.
-RUST_CRATES = ("lattice-core", "lattice-host", "lattice-retrieval")
+#
+# 11.5.2: this tuple listed only the three Phase-1 crates, so every bump since
+# 11.5.0 left `lattice-agent`, `lattice-ingest` and `lattice-jobs` at the
+# previous version in both lockfiles — and the first `cargo` invocation of the
+# test suite rewrote them, dirtying the tree mid-release. Every workspace
+# member belongs here.
+RUST_CRATES = (
+    "lattice-agent",
+    "lattice-core",
+    "lattice-host",
+    "lattice-ingest",
+    "lattice-jobs",
+    "lattice-retrieval",
+)
 RUST_LOCKFILES = ("rust/Cargo.lock", "src-tauri/Cargo.lock")
 
 # (path, kind, pattern) — pattern groups: (prefix, version)

package/scripts/check_current_release_docs.mjs

@@ -6,7 +6,7 @@ const root = process.cwd();
 const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
 const version = pkg.version;
 const releaseDir = `output/release/v${version}`;
-const releaseTheme = "Rust Complete";
+const releaseTheme = "Tight Ship";
 const title = `${version} — ${releaseTheme}`;
 const escapedVersion = version.replaceAll(".", "\\.");
 

package/scripts/check_legacy_debt.mjs

@@ -31,7 +31,7 @@ const REMOVED_MODULES = [
 ];
 // Trees that must not import removed shims. static/app and node_modules are
 // build output; src-tauri/target is compiler output.
-const SOURCE_TREES = ["latticeai", "lattice_brain", "tests", "scripts", "bin", "desktop/electron"];
+const SOURCE_TREES = ["latticeai", "lattice_brain", "tests", "scripts", "bin"];
 
 const failures = [];
 

package/scripts/check_server_i18n.mjs

@@ -29,6 +29,7 @@ const API_DIR = "latticeai/api";
 // which is how the removed root shims used to be referenced.
 const LOCALIZED = [
   "admin",
+  "agent_worker_seam",
   "auth",
   "browser",
   "chat",