ltcai 11.5.2 → 11.6.0

package/latticeai/runtime/namespace_runtime.py

@@ -1,163 +0,0 @@
-"""Explicit runtime exports for the legacy :mod:`server_app` facade.
-
-The composition root must never export ``locals()``. Every compatibility name
-is selected here and every typed assembly stage remains available through the
-``RuntimeBundle`` without leaking construction scratch state.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Any, Dict, Mapping
-
-
-@dataclass(frozen=True)
-class RuntimeBundle:
-    """Typed application assembly result and its five explicit stages."""
-
-    app: Any
-    CONFIG: Any
-    KNOWLEDGE_GRAPH: Any
-    INGESTION_PIPELINE: Any
-    AGENT_RUNTIME: Any
-    HOOKS_REGISTRY: Any
-    REVIEW_QUEUE: Any
-    AGENT_REGISTRY: Any
-    model_router: Any
-    build_runtime: Any
-    get_shared_runtime: Any
-    create_app: Any
-    config_runtime: Any
-    security_runtime: Any
-    brain_runtime: Any
-    model_runtime: Any
-    router_bundle: Any
-
-    def as_legacy_dict(self) -> Dict[str, Any]:
-        return {
-            name: getattr(self, name)
-            for name in RUNTIME_BUNDLE_EXPORTS
-        }
-
-    @property
-    def stages(self) -> Dict[str, Any]:
-        return {
-            "config": self.config_runtime,
-            "security": self.security_runtime,
-            "brain": self.brain_runtime,
-            "models": self.model_runtime,
-            "routers": self.router_bundle,
-        }
-
-
-RUNTIME_BUNDLE_EXPORTS = frozenset(
-    {
-        "app",
-        "CONFIG",
-        "KNOWLEDGE_GRAPH",
-        "INGESTION_PIPELINE",
-        "AGENT_RUNTIME",
-        "HOOKS_REGISTRY",
-        "REVIEW_QUEUE",
-        "AGENT_REGISTRY",
-        "model_router",
-        "build_runtime",
-        "get_shared_runtime",
-        "create_app",
-    }
-)
-
-LEGACY_UNDERSCORE_EXPORTS = {
-    "_LOCAL_WRITE_BLOCKED_PREFIXES",
-    "_RATE_LIMIT_ENABLED",
-    "_SESSION_TTL",
-    "_TOOL_CATALOG_BRIEF",
-    "_TOOL_GOVERNANCE_DEFAULT",
-    "_agent_risk",
-    "_allowed_workspaces_for",
-    "_build_admin_audit_report",
-    "_build_sensitivity_report",
-    "_bytes_match_extension",
-    "_check_ip_rate_limit",
-    "_check_rate_limit",
-    "_check_tool_role",
-    "_classify_sensitive_message",
-    "_client_ip",
-    "_create_security_router",
-    "_embedding_info",
-    "_fetch_skills_marketplace",
-    "_get_audit_log",
-    "_get_sso_discovery",
-    "_graph_stats_safe",
-    "_host_is_loopback",
-    "_list_compat_profiles",
-    "_llm_generate_sync",
-    "_product_hardening_status",
-    "_recent_chat_context",
-    "_redact_secret_text",
-    "_require_graph",
-    "_scoped_hybrid_search",
-    "_security_audit_events_safe",
-    "_security_list_uploaded_files",
-    "_spawn",
-    "_tool_response",
-    "_user_id_for_email",
-    "_workspace_graph",
-    "_workspace_models_payload",
-    "_workspace_scope_from_request",
-    "_workspace_settings_payload",
-}
-
-LEGACY_PUBLIC_EXPORTS = {
-    "ENGINE_MODEL_CATALOG",
-    "TOOL_GOVERNANCE",
-    "enforce_rate_limit",
-    "filter_lower_family_versions",
-    "hash_password",
-    "normalize_local_model_request",
-    "verify_password",
-}
-
-
-def build_runtime_namespace(
-    *, runtime_bundle: RuntimeBundle | Mapping[str, Any], legacy_exports: Mapping[str, Any]
-) -> Dict[str, Any]:
-    """Return only explicit compatibility exports and typed bundle handles."""
-    legacy_bundle = (
-        runtime_bundle.as_legacy_dict()
-        if isinstance(runtime_bundle, RuntimeBundle)
-        else dict(runtime_bundle)
-    )
-    exported: Dict[str, Any] = dict(legacy_bundle)
-    allowed = LEGACY_PUBLIC_EXPORTS | LEGACY_UNDERSCORE_EXPORTS
-    unexpected = set(legacy_exports) - allowed
-    if unexpected:
-        raise ValueError(f"unapproved runtime exports: {sorted(unexpected)}")
-    for name in sorted(allowed):
-        if name in exported:
-            continue
-        value = legacy_exports.get(name)
-        if value is None:
-            continue
-        exported[name] = value
-    exported["RUNTIME_BUNDLE"] = runtime_bundle
-    exported["_RUNTIME_BUNDLE"] = legacy_bundle
-    return exported
-
-
-SERVER_APP_EXPORTS = frozenset(
-    RUNTIME_BUNDLE_EXPORTS
-    | LEGACY_PUBLIC_EXPORTS
-    | LEGACY_UNDERSCORE_EXPORTS
-    | {"RUNTIME_BUNDLE", "_RUNTIME_BUNDLE"}
-)
-
-
-__all__ = [
-    "LEGACY_UNDERSCORE_EXPORTS",
-    "LEGACY_PUBLIC_EXPORTS",
-    "RUNTIME_BUNDLE_EXPORTS",
-    "RuntimeBundle",
-    "SERVER_APP_EXPORTS",
-    "build_runtime_namespace",
-]

package/latticeai/runtime/network_boundary_wiring.py

@@ -1,117 +0,0 @@
-"""Wire NetworkBoundaryMode + HybridPolicy into the running app (Phase 1–3)."""
-
-from __future__ import annotations
-
-import os
-import threading
-from pathlib import Path
-from typing import Any, Callable, Optional
-
-from latticeai.core.network_boundary import (
-    DEFAULT_NETWORK_MODE,
-    normalize_network_mode,
-)
-from latticeai.runtime.service_singletons import (
-    rebind_singleton,
-    singleton_data_dir,
-)
-from latticeai.services.hybrid_policy import HybridPolicyService
-from latticeai.services.network_boundary_service import NetworkBoundaryService
-
-_LOCK = threading.Lock()
-_SHARED: Optional[NetworkBoundaryService] = None
-_POLICY: Optional[HybridPolicyService] = None
-
-
-def _env_default_mode() -> Any:
-    return normalize_network_mode(
-        os.environ.get("LATTICEAI_NETWORK_MODE", DEFAULT_NETWORK_MODE.value)
-    )
-
-
-def get_network_boundary_service(
-    *,
-    data_dir: Optional[Path] = None,
-    audit: Optional[Callable[..., None]] = None,
-) -> NetworkBoundaryService:
-    global _SHARED
-    with _LOCK:
-        if _SHARED is None:
-            _SHARED = NetworkBoundaryService(
-                data_dir=singleton_data_dir(data_dir),
-                default_mode=_env_default_mode(),
-                audit=audit,
-            )
-            return _SHARED
-        return rebind_singleton(_SHARED, data_dir=data_dir, audit=audit)
-
-
-def get_hybrid_policy_service(
-    *,
-    data_dir: Optional[Path] = None,
-    audit: Optional[Callable[..., None]] = None,
-) -> HybridPolicyService:
-    global _POLICY
-    with _LOCK:
-        if _POLICY is None:
-            _POLICY = HybridPolicyService(
-                data_dir=singleton_data_dir(data_dir),
-                audit=audit,
-            )
-            return _POLICY
-        return rebind_singleton(_POLICY, data_dir=data_dir, audit=audit)
-
-
-def resolve_active_network_mode(
-    *,
-    user_email: Optional[str] = None,
-    workspace_id: Optional[str] = None,
-) -> Any:
-    return get_network_boundary_service().resolve(
-        user_email=user_email, workspace_id=workspace_id,
-    )
-
-
-def register_network_boundary_router(
-    app: Any,
-    *,
-    require_user: Callable[..., str],
-    data_dir: Optional[Path] = None,
-    append_audit_event: Optional[Callable[..., None]] = None,
-    knowledge_graph: Any = None,
-) -> Any:
-    from latticeai.api.network_boundary import create_network_boundary_router
-    from latticeai.services.cloud_egress_audit import bind_egress_audit
-
-    svc = get_network_boundary_service(data_dir=data_dir, audit=append_audit_event)
-    policy = get_hybrid_policy_service(data_dir=data_dir, audit=append_audit_event)
-    # The dial's own changes were audited from 10.1.0; the sends were not.
-    # Bind the same sink so egress lands in the same log.
-    bind_egress_audit(append_audit_event)
-    # Skip if already mounted (re-entrant factory / tests). Flag on app.state
-    # rather than a route-path scan: fastapi >= 0.140 wraps an included router
-    # in an opaque entry whose flat ``path`` is None, so path introspection
-    # stopped seeing the mount and a re-entrant call duplicated the routes.
-    # This function is the only in-tree mount site for this router.
-    state = getattr(app, "state", None)
-    if state is not None and getattr(state, "_ltcai_network_boundary_mounted", False):
-        return svc
-    app.include_router(
-        create_network_boundary_router(
-            service=svc,
-            require_user=require_user,
-            knowledge_graph=knowledge_graph,
-            policy_service=policy,
-        )
-    )
-    if state is not None:
-        state._ltcai_network_boundary_mounted = True
-    return svc
-
-
-__all__ = [
-    "get_network_boundary_service",
-    "get_hybrid_policy_service",
-    "resolve_active_network_mode",
-    "register_network_boundary_router",
-]

package/latticeai/runtime/network_config_runtime.py

@@ -1,56 +0,0 @@
-"""VPC network-profile config seam extracted from the legacy app factory.
-
-``DEFAULT_VPC_CONFIG`` and the load/save helpers used to live inline in
-``app_factory._build``. Behaviour and exported names are preserved exactly for
-the legacy ``server_app`` compatibility namespace; the only change is that they
-now live behind a builder so the factory stays a wiring path.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-from datetime import datetime
-from pathlib import Path
-from typing import Any, Dict
-
-
-def build_vpc_runtime(*, vpc_file: Path, logging: Any) -> Dict[str, Any]:
-    """Return ``DEFAULT_VPC_CONFIG`` and the VPC load/save helpers."""
-
-    default_vpc_config: Dict[str, Any] = {
-        "provider": "AWS",
-        "region": "ap-northeast-2",
-        "cidr_block": "10.42.0.0/16",
-        "private_subnets": ["10.42.10.0/24", "10.42.20.0/24"],
-        "endpoint": "ltcai-private.local",
-        "vpn_status": "standby",
-        "peering_status": "not_configured",
-        "notes": "로컬 MLX 브릿지를 프라이빗 서브넷 또는 VPN 뒤에서 운영할 때 쓰는 네트워크 프로필입니다.",
-        "updated_at": None,
-    }
-
-    def load_vpc_config() -> Dict:
-        if not os.path.exists(vpc_file):
-            return default_vpc_config.copy()
-        try:
-            with open(vpc_file, "r", encoding="utf-8") as f:
-                stored = json.load(f)
-            return {**default_vpc_config, **stored}
-        except Exception as e:
-            logging.warning("load_vpc_config failed (using defaults): %s", e)
-            return default_vpc_config.copy()
-
-    def save_vpc_config(config: Dict) -> None:
-        config["updated_at"] = datetime.now().isoformat()
-        with open(vpc_file, "w", encoding="utf-8") as f:
-            json.dump(config, f, ensure_ascii=False, indent=2)
-
-    return {
-        "DEFAULT_VPC_CONFIG": default_vpc_config,
-        "load_vpc_config": load_vpc_config,
-        "save_vpc_config": save_vpc_config,
-    }
-
-
-__all__ = ["build_vpc_runtime"]

package/latticeai/runtime/permission_mode_wiring.py

@@ -1,112 +0,0 @@
-"""Wire PermissionMode into the running app without a large app_factory rewrite.
-
-Creates one process-wide :class:`PermissionModeService`, points
-``ToolDispatchService.permission_mode`` at it, and registers the HTTP dial.
-Called from ``register_review_and_brain_tail_routers`` (which already has
-``data_dir``, ``require_user``, ``append_audit_event``) and from
-``build_chat_agent_runtime_from_context`` so the agent loop sees the same dial.
-"""
-
-from __future__ import annotations
-
-import os
-import threading
-from pathlib import Path
-from typing import Any, Callable, Optional
-
-from latticeai.core.permission_mode import DEFAULT_MODE, normalize_mode
-from latticeai.runtime.service_singletons import (
-    rebind_singleton,
-    singleton_data_dir,
-)
-from latticeai.services.permission_mode_service import PermissionModeService
-
-_LOCK = threading.Lock()
-_SHARED: Optional[PermissionModeService] = None
-
-
-def _env_default_mode() -> Any:
-    return normalize_mode(os.environ.get("LATTICEAI_PERMISSION_MODE", DEFAULT_MODE.value))
-
-
-def get_permission_mode_service(
-    *,
-    data_dir: Optional[Path] = None,
-    audit: Optional[Callable[..., None]] = None,
-) -> PermissionModeService:
-    """Process-wide singleton.
-
-    An early lazy caller (a tool dispatch before routers are mounted) would
-    otherwise pin the service to the fallback ``data_dir`` with no audit sink.
-    Explicit arguments therefore *rebind* an already-created service instead of
-    being silently dropped, so the app's real data dir and audit log always win.
-    """
-    global _SHARED
-    with _LOCK:
-        if _SHARED is None:
-            _SHARED = PermissionModeService(
-                data_dir=singleton_data_dir(data_dir),
-                default_mode=_env_default_mode(),
-                audit=audit,
-            )
-            return _SHARED
-        return rebind_singleton(_SHARED, data_dir=data_dir, audit=audit)
-
-
-def resolve_active_permission_mode(
-    *,
-    user_email: Optional[str] = None,
-    workspace_id: Optional[str] = None,
-) -> Any:
-    return get_permission_mode_service().resolve(
-        user_email=user_email, workspace_id=workspace_id,
-    )
-
-
-def bind_dispatch_permission_mode(dispatch_service: Any = None) -> None:
-    """Point tool dispatch at the shared mode resolver.
-
-    The bound callable accepts scope kwargs so per-user and per-workspace
-    overrides actually reach ``enforce_policy`` — an unscoped resolver would
-    always return the process-wide default and make the dial a no-op.
-    """
-    from latticeai.services.tool_dispatch import DEFAULT_TOOL_DISPATCH_SERVICE
-
-    service = dispatch_service or DEFAULT_TOOL_DISPATCH_SERVICE
-    service.permission_mode = resolve_active_permission_mode
-
-
-def register_permission_mode_router(
-    app: Any,
-    *,
-    require_user: Callable[..., str],
-    data_dir: Optional[Path] = None,
-    append_audit_event: Optional[Callable[..., None]] = None,
-) -> Any:
-    """Install GET/POST /api/permission-mode on ``app``. Idempotent by route path."""
-    from latticeai.api.permission_mode import create_permission_mode_router
-
-    svc = get_permission_mode_service(data_dir=data_dir, audit=append_audit_event)
-    bind_dispatch_permission_mode()
-    # Skip if already mounted (re-entrant factory / tests). The guard is a flag
-    # on app.state rather than a scan of route paths: fastapi >= 0.140 wraps an
-    # included router in an opaque entry whose flat ``path`` is None, so path
-    # introspection stopped seeing the mount and a re-entrant call duplicated
-    # the routes. This function is the only in-tree mount site for this router.
-    state = getattr(app, "state", None)
-    if state is not None and getattr(state, "_ltcai_permission_mode_mounted", False):
-        return svc
-    app.include_router(
-        create_permission_mode_router(service=svc, require_user=require_user)
-    )
-    if state is not None:
-        state._ltcai_permission_mode_mounted = True
-    return svc
-
-
-__all__ = [
-    "get_permission_mode_service",
-    "resolve_active_permission_mode",
-    "bind_dispatch_permission_mode",
-    "register_permission_mode_router",
-]

package/latticeai/runtime/persistence_runtime.py

@@ -1,159 +0,0 @@
-"""Persistence/service assembly seams for app startup.
-
-This module owns the durable local stores and services that sit between the
-Brain runtime and API routers. Imports stay inside the function so importing
-``latticeai.app_factory`` remains side-effect free.
-"""
-
-from __future__ import annotations
-
-from typing import Any, Callable, Dict, Optional
-
-from latticeai.core.quiet import quiet
-
-
-def build_persistence_runtime(
-    *,
-    data_dir: Any,
-    base_dir: Any,
-    enable_graph: bool,
-    knowledge_graph: Any,
-    hooks_registry: Any,
-    history_file: Any,
-    conversations: Any,
-    user_id_for_email: Callable[[Optional[str]], Optional[str]],
-    audit: Callable[[str, Dict[str, Any], Optional[str]], None],
-) -> Dict[str, Any]:
-    """Construct workspace, plugin, memory, ingestion, and portability services."""
-
-    import os
-    from pathlib import Path
-
-    from lattice_brain.graph.identity import DeviceIdentity
-    from lattice_brain.ingestion import IngestionPipeline
-    from lattice_brain.portability import KGPortabilityService
-    from latticeai.core.agent_registry import AgentRegistry
-    from latticeai.core.invitations import InvitationStore
-    from latticeai.core.marketplace import TemplateCatalog
-    from latticeai.core.plugins import PluginRegistry
-    from latticeai.core.realtime import RealtimeBus
-    from latticeai.core.workspace_os import WorkspaceOSStore
-    from latticeai.services.automation_intelligence import AutomationIntelligenceService
-    from latticeai.services.brain_intelligence import BrainIntelligenceService
-    from latticeai.services.funnel_metrics import FunnelMetricsService
-    from latticeai.services.memory_service import MemoryService
-    from latticeai.services.multimodal_ports import (
-        build_multimodal_ports,
-        multimodal_enabled,
-    )
-    from latticeai.services.workspace_service import WorkspaceService
-
-    realtime_bus = RealtimeBus()
-    workspace_os = WorkspaceOSStore(data_dir, event_sink=realtime_bus)
-    workspace_service = WorkspaceService(workspace_os, resolve_user_id=user_id_for_email)
-    invitation_store = InvitationStore(data_dir / "invitations.json")
-
-    plugins_dir = Path(os.getenv("LATTICEAI_PLUGINS_DIR") or (base_dir / "plugins"))
-    plugin_registry = PluginRegistry(plugins_dir, store=workspace_os)
-    template_catalog = TemplateCatalog()
-    agent_registry = AgentRegistry(data_dir / "agent_registry.json")
-
-    memory_service = MemoryService(
-        store=workspace_os,
-        data_dir=data_dir,
-        knowledge_graph=knowledge_graph,
-        enable_graph=enable_graph,
-        history_file=history_file,
-        conversation_store=conversations,
-    )
-    brain_intelligence = BrainIntelligenceService(
-        knowledge_graph=knowledge_graph,
-        memory_service=memory_service,
-        enable_graph=enable_graph,
-    )
-    automation_intelligence = AutomationIntelligenceService(
-        conversation_store=conversations,
-        knowledge_graph=knowledge_graph,
-        store=workspace_os,
-        enable_graph=enable_graph,
-    )
-    # UX funnel metrics (backlog #16): cheap JSON counters under the data dir.
-    # The ingestion pipeline's audit seam is wrapped so every successful
-    # ingest bumps the funnel (and starts the TTFV clock) without touching
-    # lattice_brain internals.
-    funnel_metrics = FunnelMetricsService(Path(data_dir) / "funnel_metrics.json")
-
-    def _funnel_audit(action, detail, user):
-        """Best-effort sinks for a landed ingest, then the real audit.
-
-        Both sinks are isolated separately: one failing must not cost the
-        other, and neither may cost the ingest that is already persisted.
-        """
-        if action == "kg_ingest":
-            try:
-                funnel_metrics.record_ingest(
-                    duplicate=bool((detail or {}).get("duplicate"))
-                )
-            except Exception:  # noqa: BLE001 — metrics must never break ingestion
-                quiet()
-            # v11.1.0: the same seam drives synthesis. The pipeline audits an
-            # ingest only after the graph write landed, so ``status: "ok"`` is
-            # a fact about this call site rather than a guess; ``duplicate``
-            # travels in the detail and is what keeps a re-import from pushing
-            # the Brain toward a pass it has nothing new to say in.
-            try:
-                brain_intelligence.note_ingest(
-                    {"status": "ok", **(detail or {})}, user_email=user
-                )
-            except Exception:  # noqa: BLE001 — synthesis must never break ingestion
-                quiet()
-        audit(action, detail, user)
-
-    # Multi-modal capture (v11.1.0): off unless the user turned it on, and
-    # even then only as capable as the models actually present. With nothing
-    # configured this resolves to an empty bundle without importing or loading
-    # anything.
-    multimodal_ports = build_multimodal_ports()
-    ingestion_pipeline = IngestionPipeline(
-        knowledge_graph,
-        hooks=hooks_registry,
-        enable_graph=enable_graph,
-        audit=_funnel_audit,
-        allow_multimodal=multimodal_enabled(),
-        multimodal=multimodal_ports,
-    )
-    # The local folder scanner reads images through the same ports, so a
-    # caption in the Evidence panel and a caption on a scanned screenshot come
-    # from one model or from none. A disabled/absent graph has nothing to
-    # attach them to, and a store that refuses new attributes is not a reason
-    # to fail startup.
-    try:
-        knowledge_graph.multimodal_ports = multimodal_ports
-    except AttributeError:
-        quiet()
-    device_identity = DeviceIdentity(data_dir)
-    kg_portability = KGPortabilityService(
-        knowledge_graph=knowledge_graph,
-        data_dir=data_dir,
-        enable_graph=enable_graph,
-        device_identity=device_identity,
-    )
-
-    return {
-        "REALTIME_BUS": realtime_bus,
-        "WORKSPACE_OS": workspace_os,
-        "WORKSPACE_SERVICE": workspace_service,
-        "INVITATION_STORE": invitation_store,
-        "PLUGINS_DIR": plugins_dir,
-        "PLUGIN_REGISTRY": plugin_registry,
-        "TEMPLATE_CATALOG": template_catalog,
-        "AGENT_REGISTRY": agent_registry,
-        "MEMORY_SERVICE": memory_service,
-        "BRAIN_INTELLIGENCE": brain_intelligence,
-        "AUTOMATION_INTELLIGENCE": automation_intelligence,
-        "INGESTION_PIPELINE": ingestion_pipeline,
-        "MULTIMODAL_PORTS": multimodal_ports,
-        "DEVICE_IDENTITY": device_identity,
-        "KG_PORTABILITY": kg_portability,
-        "FUNNEL_METRICS": funnel_metrics,
-    }

package/latticeai/runtime/platform_runtime_wiring.py

@@ -1,89 +0,0 @@
-"""Platform and automation wiring for the application factory.
-
-This module owns the cross-subsystem runtime assembly that used to live inline
-inside ``app_factory._build``.  Keeping it here reduces the app factory's global
-surface without changing router order or the legacy exported runtime names.
-"""
-
-from __future__ import annotations
-
-from typing import Any, Callable, Dict, Optional
-
-
-def build_platform_automation_runtime(
-    *,
-    model_router: Any,
-    workspace_store: Any,
-    workspace_service: Any,
-    plugin_registry: Any,
-    get_current_user: Callable[..., Any],
-    workspace_graph: Callable[[], Any],
-    workspace_scope_from_request: Callable[..., Any],
-    get_tool_permission: Callable[..., Any],
-    hooks: Any,
-    agent_registry: Any,
-    data_dir: Any,
-    append_audit_event: Callable[..., Any],
-    memory_service: Any = None,
-    tz_name: Optional[str] = None,
-) -> Dict[str, Any]:
-    """Build platform services, automation services, and hook bindings.
-
-    The returned names intentionally match the explicit composition-root
-    bindings consumed by the typed application stages.
-    """
-    from latticeai.runtime.automation_runtime import build_automation_runtime
-    from latticeai.services.platform_runtime import PlatformRuntime
-
-    def _llm_generate_sync(
-        message: str,
-        context: str = "",
-        max_tokens: int = 1024,
-        temperature: float = 0.1,
-    ) -> str:
-        # Synchronous model bridge for the orchestrator's role runner. Safe
-        # because the agents run endpoint executes start() in a worker thread
-        # (asyncio.to_thread), where no event loop is running.
-        import asyncio as _asyncio
-
-        return str(_asyncio.run(model_router.generate(
-            message,
-            context=context,
-            max_tokens=max_tokens,
-            temperature=temperature,
-        )))
-
-    platform = PlatformRuntime(
-        store=workspace_store,
-        workspace_service=workspace_service,
-        plugin_registry=plugin_registry,
-        get_current_user=get_current_user,
-        workspace_graph=workspace_graph,
-        workspace_scope_from_request=workspace_scope_from_request,
-        get_tool_permission=get_tool_permission,
-        hooks=hooks,
-        llm_generate=_llm_generate_sync,
-        llm_available=lambda: bool(getattr(model_router, "current_model_id", None)),
-        agent_registry=agent_registry,
-        memory_recall=memory_service.recall if memory_service is not None else None,
-    )
-
-    automation_runtime = build_automation_runtime(
-        store=workspace_store,
-        platform=platform,
-        data_dir=data_dir,
-        workspace_graph=workspace_graph,
-        append_audit_event=append_audit_event,
-        hooks=hooks,
-        tz_name=tz_name,
-    )
-
-    return {
-        "_llm_generate_sync": _llm_generate_sync,
-        "PLATFORM": platform,
-        "_automation_runtime": automation_runtime,
-        "REVIEW_QUEUE": automation_runtime["REVIEW_QUEUE"],
-        "TRIGGER_SERVICE": automation_runtime["TRIGGER_SERVICE"],
-        "AGENT_RUNTIME": automation_runtime["AGENT_RUNTIME"],
-        "RUN_EXECUTOR": automation_runtime["RUN_EXECUTOR"],
-    }