ltcai 11.5.1 → 11.5.2

package/lattice_brain/ingestion_jobs.py

@@ -351,9 +351,6 @@ class BackgroundIngestionQueue:
     def get(self, job_id: str) -> Optional[BackgroundIngestionJob]:
         return self._jobs.get(job_id)
 
-    def list_pending(self) -> List[BackgroundIngestionJob]:
-        return [j for j in self._jobs.values() if j.status == "queued"]
-
     def list_recent(self, limit: int = 20) -> List[BackgroundIngestionJob]:
         """Most recent jobs first (insertion order is schedule order)."""
         limit = max(1, int(limit))

package/lattice_brain/memory.py

@@ -27,33 +27,6 @@ class BrainMemory:
     def available(self) -> bool:
         return self._pipeline is not None and self._pipeline.available()
 
-    def record_decision(
-        self,
-        title: str,
-        detail: str = "",
-        *,
-        user_email: Optional[str] = None,
-        workspace_id: Optional[str] = None,
-        conversation_id: Optional[str] = None,
-        decided_by: Optional[str] = None,
-        metadata: Optional[Dict[str, Any]] = None,
-    ) -> Dict[str, Any]:
-        if not str(title or "").strip():
-            raise ValueError("a decision needs a title")
-        result = self._pipeline.ingest(
-            IngestionItem(
-                source_type="decision",
-                title=title.strip(),
-                text=detail,
-                owner=user_email,
-                workspace_id=workspace_id,
-                conversation_id=conversation_id,
-                metadata={"decided_by": decided_by or user_email, **(metadata or {})},
-            ),
-            user_email=user_email,
-        )
-        return result.as_dict()
-
     def record_experience(
         self,
         title: str,

package/lattice_brain/portability/sharing.py

@@ -167,10 +167,6 @@ class KGPortabilitySharingMixin(_Core):
                 quiet()
         return result
 
-    def import_from_file(self, path, *, mode: str = "merge", dry_run: bool = False) -> Dict[str, Any]:
-        artifact = json.loads(Path(path).read_text(encoding="utf-8"))
-        return self.import_data(artifact, mode=mode, dry_run=dry_run)
-
     # ── selective subgraph share (opt-in prototype, off by default) ──────────
     def share_status(self) -> Dict[str, Any]:
         """Honest read of the share surface. Safe to call while it is off.

package/lattice_brain/quality.py

@@ -375,15 +375,6 @@ class GraphEdgeQualityManager:
                 seen[key] = e.get("id")
         return dups
 
-    def merge_duplicate_edges(self, edges: List[Dict]) -> List[Dict]:
-        # keep highest confidence
-        best: Dict[Any, Dict[str, Any]] = {}
-        for e in edges:
-            key = (e.get("source"), e.get("target"), e.get("type"))
-            if key not in best or e.get("confidence", 0) > best[key].get("confidence", 0):
-                best[key] = e
-        return list(best.values())
-
     def compute_quality_metrics(self, edges: List[Dict]) -> Dict[str, float]:
         if not edges:
             return {"avg_conf": 0.0, "avg_evidence": 0.0, "dup_rate": 0.0}
@@ -532,46 +523,6 @@ class LatticeBrainQuality:
         self.context_assembler = StructuredContextAssembler()
         self.benchmark = RetrievalBenchmarkRunner()
 
-    def full_quality_pass(self, payload: Dict[str, Any]) -> Dict[str, Any]:
-        """End-to-end quality pipeline (non-destructive)"""
-        result = {"status": "ok", "timestamp": time.time()}
-
-        # embedding
-        if "embeddings" in payload:
-            labels = [self.embed_labeller.label(e["id"], e.get("vector")) for e in payload["embeddings"]]
-            result["embedding_labels"] = [label.__dict__ for label in labels]
-            result["reindex_plan"] = self.embed_labeller.generate_reindex_plan()
-
-        # hybrid retrieval
-        if "retrieval" in payload:
-            fused = self.hybrid.fuse(payload["retrieval"]["query"], payload["retrieval"]["candidates"])
-            reranked = self.reranker.rerank(payload["retrieval"]["query"], fused)
-            result["retrieval"] = {"fused": fused, "reranked": reranked}
-
-        # memory
-        if "memories" in payload:
-            cands = self.memory_mgr.extract_candidates(payload["memories"])
-            cands = self.memory_mgr.score_candidates(cands, payload.get("query", ""))
-            cands = self.memory_mgr.dedupe(cands)
-            cands = self.memory_mgr.merge(cands)
-            cands = self.memory_mgr.detect_conflicts(cands)
-            cands = self.memory_mgr.apply_retention(cands)
-            result["memory_candidates"] = [c.__dict__ for c in cands]
-
-        # graph
-        if "graph_edges" in payload:
-            eqs = [self.graph_mgr.validate_edge(e) for e in payload["graph_edges"]]
-            result["graph_quality"] = [q.__dict__ for q in eqs]
-            result["graph_metrics"] = self.graph_mgr.compute_quality_metrics(payload["graph_edges"])
-
-        # context
-        if "context_items" in payload:
-            ctx = self.context_assembler.assemble(payload["context_items"])
-            ctx = self.context_assembler.apply_guardrails(ctx)
-            result["structured_context"] = ctx
-
-        return result
-
 
 __all__ = [
     "BM25Scorer",

package/lattice_brain/runtime/agent_runtime.py

@@ -8,7 +8,7 @@
 진입점: app_factory.py:AGENT_RUNTIME (wiring root), api/agents.py, RunExecutor.
 
 Before this module the agent concern was spread across three places: the
-:class:`~latticeai.core.multi_agent.MultiAgentOrchestrator` (role pipeline),
+:class:`~lattice_brain.runtime.multi_agent.MultiAgentOrchestrator` (role pipeline),
 the :class:`~latticeai.services.platform_runtime.PlatformRuntime` (cross-system
 wiring + an ad-hoc ``run_agent``), and ``api/agents.py`` (HTTP transport that
 also owned orchestration + persistence + audit). The frontend reached past all

package/lattice_brain/runtime/hooks.py

@@ -181,16 +181,6 @@ class HookResult:
         }
 
 
-def hook_context(kind: str, event: str = "", **kwargs: Any) -> HookContext:
-    """Factory for a :class:`HookContext` (matches the public hook vocabulary)."""
-    return HookContext(kind, event, **kwargs)
-
-
-def hook_result(**kwargs: Any) -> HookResult:
-    """Factory for a :class:`HookResult`."""
-    return HookResult(**kwargs)
-
-
 def dispatch_tool(
     hooks: Any,
     tool_name: str,
@@ -525,9 +515,6 @@ class HooksRegistry:
     # Alias — descriptive name used by the wiring layer.
     register_runtime_hook = register_hook
 
-    def unregister_hook(self, hook_id: str) -> None:
-        self._runtime_runners.pop(hook_id, None)
-
     def has_runner(self, hook_id: str) -> bool:
         return hook_id in self._runtime_runners
 

package/lattice_brain/runtime/multi_agent.py

@@ -49,7 +49,7 @@ from typing import Any, Callable, Dict, List, Optional
 from ..utils import now_iso as _now
 from .contracts import multi_agent_contract
 
-MULTI_AGENT_VERSION = "11.5.1"
+MULTI_AGENT_VERSION = "11.5.2"
 
 AGENT_ROLES = ("researcher", "planner", "executor", "reviewer", "release")
 CORE_PIPELINE = ("planner", "executor", "reviewer")

package/lattice_brain/sealed_box.py

@@ -212,10 +212,6 @@ class RecipientIdentity:
             "path": str(self._key_file),
         }
 
-    def seal_to_self(self, plaintext: bytes) -> Dict[str, Any]:
-        """Seal to this Brain's own key — the honest way to test a round trip."""
-        return seal(plaintext, recipient_public_key=self.public_key_b64)
-
     def unseal(self, block: Dict[str, Any]) -> bytes:
         return unseal(block, self._private)
 

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "11.5.1"
+__version__ = "11.5.2"

package/latticeai/api/admin.py

@@ -8,6 +8,8 @@ from typing import Any, Callable, Dict, List, Optional
 from fastapi import APIRouter, Query, Request
 from pydantic import BaseModel
 
+from latticeai.api.workspace_scope import requested_workspace
+from latticeai.core.http_origin import request_external_origin
 from latticeai.core.messages import http_error, resolve_language
 from latticeai.core.workspace_os import DEFAULT_WORKSPACE_ID
 
@@ -65,13 +67,6 @@ def create_admin_router(
 ) -> APIRouter:
     router = APIRouter()
 
-    def _workspace_scope(request: Request) -> Optional[str]:
-        header = request.headers.get("X-Workspace-Id")
-        if header and header.strip():
-            return header.strip()
-        query = request.query_params.get("workspace_id")
-        return query.strip() if query and query.strip() else None
-
     def _matches_scope(item: Dict[str, object], workspace_id: Optional[str]) -> bool:
         if not workspace_id:
             return True
@@ -81,11 +76,11 @@ def create_admin_router(
         return str(item_scope or "") == str(workspace_id)
 
     def _scoped_history(request: Request) -> List[Dict]:
-        scope = _workspace_scope(request)
+        scope = requested_workspace(request)
         return [item for item in get_history() if _matches_scope(item, scope)]
 
     def _scoped_audit_log(request: Request) -> List[Dict]:
-        scope = _workspace_scope(request)
+        scope = requested_workspace(request)
         return [item for item in get_audit_log() if _matches_scope(item, scope)]
 
     def _filter_audit_log(
@@ -427,9 +422,14 @@ def create_admin_router(
     @router.get("/admin/invite-link")
     async def admin_invite_link(request: Request):
         require_admin(request)
-        host = request.headers.get("host", f"localhost:{default_port}")
-        scheme = "https" if request.headers.get("x-forwarded-proto") == "https" else "http"
-        url = f"{scheme}://{host}/?code={invite_code}" if invite_gate_enabled else f"{scheme}://{host}/"
+        # The link is *mailed to a person*, so it has to name the door they can
+        # actually knock on. Behind the desktop gateway ``Host`` is the internal
+        # worker authority, which meant every invite emitted through the front
+        # door pointed at a port only the gateway can reach.
+        origin = request_external_origin(
+            request, fallback=f"http://localhost:{default_port}",
+        )
+        url = f"{origin}/?code={invite_code}" if invite_gate_enabled else f"{origin}/"
         return {"invite_url": url, "invite_code": invite_code, "gate_enabled": invite_gate_enabled}
 
     @router.get("/admin/sso")

package/latticeai/api/auth.py

@@ -13,6 +13,8 @@ from fastapi import APIRouter, Request
 from fastapi.responses import JSONResponse, RedirectResponse
 from pydantic import BaseModel
 
+from latticeai.core.config import SSO_CALLBACK_PATH
+from latticeai.core.http_origin import request_external_origin
 from latticeai.core.messages import DEFAULT_LANGUAGE, http_error, resolve_language
 from latticeai.core.oidc import (
     OIDCValidationError,
@@ -56,6 +58,10 @@ class _SSOLoginState:
     nonce: str
     code_verifier: str
     invite_authorized: bool
+    #: Exactly what was sent to ``authorize``. The token exchange must repeat
+    #: it byte for byte or the provider rejects the code, so it is carried
+    #: rather than recomputed from a second request that may differ.
+    redirect_uri: str = ""
 
 
 # The nonce and PKCE verifier bind the callback/token to this login attempt.
@@ -88,6 +94,7 @@ def create_auth_router(
     ensure_identity: Optional[Callable[[str, Dict], None]] = None,
     invite_gate_enabled: bool = False,
     invite_authorized: Optional[Callable[[Request], bool]] = None,
+    default_redirect_uri: Optional[str] = None,
     verify_id_token: Callable[..., Dict] = _default_verify_id_token,
     fetch_jwks: Callable[[str], Awaitable[Dict]] = _default_fetch_jwks,
 ) -> APIRouter:
@@ -169,6 +176,20 @@ def create_auth_router(
     async def sso_config_endpoint():
         return public_sso_config()
 
+    def _resolve_redirect_uri(request: Request, settings: Dict) -> str:
+        """Where the provider should send the browser back to.
+
+        A configured URI is registered with the provider and is used verbatim.
+        Only the *built-in default* — which names the worker's own port, and is
+        therefore unreachable whenever a gateway fronts it — is replaced by the
+        front door this login actually arrived through.
+        """
+        configured = str(settings.get("redirect_uri") or "")
+        if not default_redirect_uri or configured != default_redirect_uri:
+            return configured
+        origin = request_external_origin(request)
+        return f"{origin}{SSO_CALLBACK_PATH}" if origin else configured
+
     @router.get("/auth/sso/login")
     async def sso_login(request: Request):
         lang = resolve_language(request)
@@ -193,16 +214,18 @@ def create_auth_router(
                 and invite_authorized(request)
             )
         )
+        redirect_uri = _resolve_redirect_uri(request, settings)
         _sso_states[state] = _SSOLoginState(
             issued_at=time.time(),
             nonce=nonce,
             code_verifier=code_verifier,
             invite_authorized=invite_claim,
+            redirect_uri=redirect_uri,
         )
         params = urlencode({
             "client_id": settings["client_id"],
             "response_type": "code",
-            "redirect_uri": settings["redirect_uri"],
+            "redirect_uri": redirect_uri,
             "scope": settings.get("scopes") or "openid email profile",
             "state": state,
             "nonce": nonce,
@@ -228,7 +251,7 @@ def create_auth_router(
             r = await c.post(discovery["token_endpoint"], data={
                 "grant_type": "authorization_code",
                 "code": code,
-                "redirect_uri": settings["redirect_uri"],
+                "redirect_uri": entry.redirect_uri or settings["redirect_uri"],
                 "client_id": settings["client_id"],
                 "client_secret": settings["client_secret"],
                 "code_verifier": entry.code_verifier,

package/latticeai/api/chat.py

@@ -42,7 +42,6 @@ from latticeai.api.chat_helpers import (
     pair_user_history,
     single_text_stream,
     strip_generated_file_content,
-    workspace_scope_from_request,
 )
 from latticeai.api.chat_history import HistoryRouteDependencies, register_history_routes
 from latticeai.api.chat_hybrid import (
@@ -51,6 +50,7 @@ from latticeai.api.chat_hybrid import (
 )
 from latticeai.api.chat_intents import ChatIntentController
 from latticeai.api.chat_stream import stream_chat
+from latticeai.api.workspace_scope import requested_workspace
 from latticeai.core.messages import DEFAULT_LANGUAGE, resolve_language, translate
 from latticeai.core.project_sessions import ProjectSessionStore
 from latticeai.core.run_store import AgentRunStore
@@ -84,7 +84,7 @@ __all__ = [
     "is_clear_command",
     "format_network_status",
     "strip_generated_file_content",
-    "workspace_scope_from_request",
+    "requested_workspace",
     "single_text_stream",
 ]
 
@@ -272,7 +272,7 @@ def create_chat_router(context: AppContext) -> APIRouter:
         )
         effective_email = authenticated_identity(current_user, req.user_email, resolve_language(request))
         workspace_id = write_workspace(
-            workspace_scope_from_request(request),
+            requested_workspace(request),
             current_user,
         )
         history_user = chat_service.history_user(

package/latticeai/api/chat_agent_http.py

@@ -22,12 +22,9 @@ from latticeai.api.chat_contracts import (
     AgentRequest,
     AgentResumeRequest,
 )
-from latticeai.api.chat_helpers import (
-    _LANG_HINT,
-    detect_language,
-    workspace_scope_from_request,
-)
+from latticeai.api.chat_helpers import _LANG_HINT, detect_language
 from latticeai.api.chat_stream import agent_live_stream
+from latticeai.api.workspace_scope import requested_workspace
 from latticeai.core.agent import AgentRunContext, AgentState, normalize_plan
 from latticeai.core.messages import resolve_language
 from latticeai.core.quiet import quiet
@@ -268,14 +265,8 @@ class AgentHTTPController:
         current_user = self.require_user(request)
         self.enforce_rate_limit(current_user, "agent")
         effective_email = self.authenticated_identity(current_user, req.user_email, resolve_language(request))
-        header_workspace = workspace_scope_from_request(request)
-        if req.workspace_id and header_workspace and req.workspace_id != header_workspace:
-            raise HTTPException(
-                status_code=403,
-                detail="workspace_id must match X-Workspace-Id.",
-            )
         req.workspace_id = self.write_workspace(
-            req.workspace_id or header_workspace,
+            requested_workspace(request, body_workspace=req.workspace_id),
             current_user,
         )
         req.user_email = effective_email

package/latticeai/api/chat_helpers.py

@@ -1,8 +1,14 @@
 """Pure chat helpers: language/intent detection, file-action parsing,
-network-status formatting, workspace-scope extraction, and recent-context
-assembly. Split out of the chat router module so create_chat_router keeps
-only request wiring. chat.py re-imports every name, so external import
-sites (tests, app_factory) are unaffected.
+network-status formatting, and recent-context assembly. Split out of the chat
+router module so create_chat_router keeps only request wiring. chat.py
+re-imports every name, so external import sites (tests, app_factory) are
+unaffected.
+
+Workspace-scope extraction used to live here too, as a verbatim copy of the
+header/query derivation. 11.5.2 deleted it: the callers now use
+:func:`latticeai.api.workspace_scope.requested_workspace`, so a request that
+names two different workspaces is refused instead of having one selector
+silently win.
 """
 
 from __future__ import annotations
@@ -11,8 +17,6 @@ import json
 import re
 from typing import Any, AsyncIterator, Dict, List, Optional
 
-from fastapi import Request
-
 
 def pair_user_history(history: List[Dict], user_email: str) -> List[Dict]:
     """Restrict history to one user's exchange.
@@ -406,13 +410,6 @@ def assess_answer_grounding(
     }
 
 
-def workspace_scope_from_request(request: Request) -> Optional[str]:
-    header = request.headers.get("X-Workspace-Id")
-    if header and header.strip():
-        return header.strip()
-    query = request.query_params.get("workspace_id")
-    return query.strip() if query and query.strip() else None
-
 async def single_text_stream(text: str, model: str = "system") -> AsyncIterator[str]:
     yield f"data: {json.dumps({'chunk': text, 'model': model}, ensure_ascii=False)}\n\n"
     yield "data: [DONE]\n\n"

package/latticeai/api/computer_use.py

@@ -11,7 +11,9 @@ from fastapi.responses import StreamingResponse
 from pydantic import BaseModel
 
 from lattice_brain.runtime.hooks import dispatch_tool
+from latticeai.api.workspace_scope import resolve_workspace_scope
 from latticeai.core.agent import extract_action as _extract_agent_action
+from latticeai.core.sse import sse_frame
 from latticeai.services.tool_dispatch import enforce_tool_policy
 from latticeai.tools import (
     AGENT_ROOT,
@@ -121,34 +123,24 @@ def create_computer_use_router(
 ) -> APIRouter:
     router = APIRouter()
 
-    def _requested_workspace(request: Request) -> Optional[str]:
-        header = request.headers.get("X-Workspace-Id")
-        if header and header.strip():
-            return header.strip()
-        query = request.query_params.get("workspace_id")
-        return query.strip() if query and query.strip() else None
-
     def _write_workspace(request: Request, current_user: str) -> Optional[str]:
         """Resolve only the CU agent's durable write scope.
 
         The other ``/cu`` actions remain host operations and do not acquire a
         workspace dependency.  A no-auth local request without an explicit
-        scope preserves its legacy unscoped history behavior; explicit scopes
-        and every authenticated request go through the normal write gate.
+        scope preserves its legacy unscoped history behavior — that is exactly
+        what ``allow_unscoped_anonymous`` names in the shared resolver;
+        explicit scopes and every authenticated request go through the normal
+        write gate.
         """
 
-        requested = _requested_workspace(request)
-        if workspace_service is None:
-            return requested
-        if not current_user and requested is None:
-            return None
-        try:
-            return workspace_service.resolve_write_scope(
-                requested,
-                current_user or None,
-            )
-        except PermissionError as exc:
-            raise HTTPException(status_code=403, detail=str(exc)) from exc
+        return resolve_workspace_scope(
+            request,
+            user=current_user,
+            workspace_service=workspace_service,
+            write=True,
+            allow_unscoped_anonymous=True,
+        )
 
     def _audit_args(name: str, args: dict) -> dict:
         """Return audit-safe argument metadata without storing typed text."""
@@ -351,17 +343,14 @@ def create_computer_use_router(
             task_lower = (req.task or "").lower()
             url_match = re.search(r"(https?://[^\s]+|localhost:\d+[^\s]*|127\.0\.0\.1:\d+[^\s]*)", req.task or "")
 
-            def _send(event: str, data: dict) -> str:
-                return f"event: {event}\ndata: {json.dumps(data, ensure_ascii=False)}\n\n"
-
             if ("chrome" in task_lower or "크롬" in task_lower) and any(
                 word in task_lower for word in ["open", "열", "켜", "실행", "띄"]
             ):
-                yield _send("start", {"task": req.task, "max_steps": 1})
+                yield sse_frame("start", {"task": req.task, "max_steps": 1})
                 try:
                     if url_match:
                         url = url_match.group(1)
-                        yield _send(
+                        yield sse_frame(
                             "action",
                             {"step": 1, "action": "computer_open_url", "args": {"url": url, "app": "Google Chrome"}},
                         )
@@ -371,11 +360,11 @@ def create_computer_use_router(
                             lambda: computer_open_url(url, "Google Chrome"),
                             current_user=current_user,
                         )
-                        yield _send("result", {"step": 1, "action": "computer_open_url", "result": result})
+                        yield sse_frame("result", {"step": 1, "action": "computer_open_url", "result": result})
                         message = f"Google Chrome에서 {url}을 열었습니다."
                         action_name = "computer_open_url"
                     else:
-                        yield _send(
+                        yield sse_frame(
                             "action",
                             {"step": 1, "action": "computer_open_app", "args": {"app": "Google Chrome"}},
                         )
@@ -385,26 +374,26 @@ def create_computer_use_router(
                             lambda: computer_open_app("Google Chrome"),
                             current_user=current_user,
                         )
-                        yield _send("result", {"step": 1, "action": "computer_open_app", "result": result})
+                        yield sse_frame("result", {"step": 1, "action": "computer_open_app", "result": result})
                         message = "Google Chrome을 열었습니다."
                         action_name = "computer_open_app"
                     _save_completed("user", req.task)
                     _save_completed("assistant", message)
-                    yield _send("final", {"message": message, "steps": [{"step": 1, "action": action_name, "result": result}]})
+                    yield sse_frame("final", {"message": message, "steps": [{"step": 1, "action": action_name, "result": result}]})
                 except HTTPException as exc:
-                    yield _send("tool_error", {"step": 1, "action": "computer_open_app", "error": str(exc.detail)})
+                    yield sse_frame("tool_error", {"step": 1, "action": "computer_open_app", "error": str(exc.detail)})
                 except (ToolError, PermissionError) as exc:
-                    yield _send("tool_error", {"step": 1, "action": "computer_open_app", "error": str(exc)})
+                    yield sse_frame("tool_error", {"step": 1, "action": "computer_open_app", "error": str(exc)})
                 return
 
             if not model_router.current_model_id:
-                yield _send("error", {"error": "No model loaded."})
+                yield sse_frame("error", {"error": "No model loaded."})
                 return
 
             transcript: List[Dict[str, Any]] = []
             last_screenshot_b64: Optional[str] = None
             max_steps = max(1, min(req.max_steps, 20))
-            yield _send("start", {"task": req.task, "max_steps": max_steps})
+            yield sse_frame("start", {"task": req.task, "max_steps": max_steps})
 
             for step in range(max_steps):
                 context = (
@@ -423,7 +412,7 @@ def create_computer_use_router(
                 try:
                     action = _extract_agent_action(str(raw))
                 except ValueError as exc:
-                    yield _send("error", {"step": step + 1, "error": str(exc), "raw": str(raw)})
+                    yield sse_frame("error", {"step": step + 1, "error": str(exc), "raw": str(raw)})
                     break
 
                 name = action.get("action")
@@ -432,10 +421,10 @@ def create_computer_use_router(
                     message = action.get("message", "작업을 완료했습니다.")
                     _save_completed("user", req.task)
                     _save_completed("assistant", message)
-                    yield _send("final", {"message": message, "steps": transcript})
+                    yield sse_frame("final", {"message": message, "steps": transcript})
                     return
 
-                yield _send("action", {"step": step + 1, "action": name, "args": args})
+                yield sse_frame("action", {"step": step + 1, "action": name, "args": args})
                 try:
                     result = _dispatch(
                         name,
@@ -449,7 +438,7 @@ def create_computer_use_router(
                         result_summary = {k: v for k, v in result.items() if k != "screenshot_b64"}
                         result_summary["screenshot_captured"] = True
                         transcript.append({"step": step + 1, "action": name, "args": args, "result": result_summary})
-                        yield _send(
+                        yield sse_frame(
                             "screenshot",
                             {
                                 "step": step + 1,
@@ -461,17 +450,17 @@ def create_computer_use_router(
                     else:
                         last_screenshot_b64 = None
                         transcript.append({"step": step + 1, "action": name, "args": args, "result": result})
-                        yield _send("result", {"step": step + 1, "action": name, "result": result})
+                        yield sse_frame("result", {"step": step + 1, "action": name, "result": result})
                 except HTTPException as exc:
                     error_str = str(exc.detail)
                     transcript.append({"step": step + 1, "action": name, "args": args, "error": error_str})
-                    yield _send("tool_error", {"step": step + 1, "action": name, "error": error_str})
+                    yield sse_frame("tool_error", {"step": step + 1, "action": name, "error": error_str})
                 except (ToolError, PermissionError, KeyError, TypeError) as exc:
                     error_str = str(exc)
                     transcript.append({"step": step + 1, "action": name, "args": args, "error": error_str})
-                    yield _send("tool_error", {"step": step + 1, "action": name, "error": error_str})
+                    yield sse_frame("tool_error", {"step": step + 1, "action": name, "error": error_str})
 
-            yield _send("done", {"steps": len(transcript), "transcript": transcript})
+            yield sse_frame("done", {"steps": len(transcript), "transcript": transcript})
 
         return StreamingResponse(
             _stream(),

package/latticeai/api/health.py

@@ -19,6 +19,7 @@ def create_health_router(
     engine_status: Callable[[], List[dict]],
     get_current_user: Callable[[Request], Optional[str]],
     require_auth: bool,
+    externally_reachable: bool,
     app_version: str,
     app_mode: str,
 ) -> APIRouter:
@@ -29,9 +30,28 @@ def create_health_router(
         if require_auth and not get_current_user(request):
             raise HTTPException(status_code=401, detail="인증이 필요합니다.")
 
+    def _access_posture() -> dict:
+        """The two facts ``trusted_local_owner`` is computed from.
+
+        Stated on the *unauthenticated* part of ``/health`` on purpose: the Rust
+        front door polls this endpoint already, and it gates its own native
+        ``/rust/*`` lanes on the answer.  Those lanes read the store with no
+        credential at all, so without this they had no way to tell an
+        optional-auth loopback worker (where that is exactly right) from a
+        ``LATTICEAI_REQUIRE_AUTH=true`` one (where it is a hole).  Neither field
+        is a secret: an unauthenticated caller discovers both by being refused.
+        """
+        return {
+            "require_auth": bool(require_auth),
+            "externally_reachable": bool(externally_reachable),
+        }
+
     @router.get("/health")
     async def health(request: Request):
-        base = svc.health_base(version=app_version, mode=app_mode)
+        base = {
+            **svc.health_base(version=app_version, mode=app_mode),
+            "access": _access_posture(),
+        }
         if not get_current_user(request) and require_auth:
             return base
         engines = await asyncio.to_thread(engine_status)