ltcai 11.5.2 → 11.7.0

package/latticeai/api/worker_seams.py

@@ -0,0 +1,216 @@
+"""The v11.6.0 worker seams: the two chains a Rust route package delegates.
+
+v11.5.1 gave the Rust loop calls back into Python (``/agent/llm``,
+``/agent/tool``). v11.6.0 moved the *product* routes to ``lattice-host`` as
+well, and two of those routes turn out to need something only this process can
+do:
+
+``GET /worker/sysinfo``
+    The MLX/GPU block of ``/local/sysinfo``. CPU and RAM are ordinary host
+    telemetry that Rust can sample itself; unified-memory usage can only be
+    read from the process that holds the MLX context, which is this one.
+
+``POST /worker/llm/stream``
+    Token generation never moves (plan §설계 결정 6). ``/agent/llm`` is
+    buffered; chat needs the same ``LLMRouter.stream_generate_as`` path
+    framed as SSE so the gateway can pass bytes through. ``mode=document``
+    selects ``stream_generate_document_as``.
+
+``POST /worker/chat/record-turn`` used to live here as a third seam — the
+redact → audit → store → ingest chain behind ``POST /chat``. WP-W3a moved that
+whole chain into ``lattice-chat`` (``rust/lattice-chat/src/turn.rs``) and its
+own tests assert the seam is requested **zero** times; WP-P1 retires it, along
+with the conversation store, the audit sink and the ingestion write door that
+were its only reason to exist in a worker that owns no state.
+
+Both remaining seams are gated by the same switch as ``/agent/tool`` —
+``LATTICEAI_AGENT_TOOL_SEAM=1``, read per request through
+:func:`~latticeai.api.agent_worker_seam._seam_open` so there is one gate, not a
+second one that can drift — and answer 404 with the same message when it is
+off. They are mounted only by the worker profile
+(:func:`latticeai.worker_app.create_worker_app`).
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import subprocess  # noqa: S404 — one fixed sysctl read, no shell, no user input
+from typing import Any, Callable, Dict, Optional, Tuple
+
+from fastapi import APIRouter, Request
+from fastapi.responses import StreamingResponse
+from pydantic import BaseModel
+
+from latticeai.api.agent_worker_seam import SEAM_RATE_BUCKET
+from latticeai.api.agent_worker_seam import _seam_open as seam_open
+from latticeai.core.messages import http_error, resolve_language
+from latticeai.core.quiet import quiet
+
+logger = logging.getLogger(__name__)
+
+
+# ── GPU probe: the MLX half of /local/sysinfo ───────────────────────────────
+
+
+def _mlx_memory() -> Tuple[int, int]:
+    """Active and cached unified memory held by this process's MLX context."""
+    import mlx.core as mx
+
+    return int(mx.get_active_memory()), int(mx.get_cache_memory())
+
+
+def _total_memory_bytes() -> int:
+    """Installed physical memory, the denominator ``gpu_mem_pct`` is taken of."""
+    completed = subprocess.run(  # noqa: S603,S607 — fixed argv, no shell
+        ["sysctl", "-n", "hw.memsize"],
+        capture_output=True,
+        text=True,
+        timeout=2,
+    )
+    return int(completed.stdout.strip())
+
+
+def probe_gpu_memory() -> Dict[str, Any]:
+    """The GPU block ``/local/sysinfo`` reports, on its own.
+
+    Blocking (one ``sysctl``), so callers hand it to a worker thread. A machine
+    without MLX — every Linux CI box, every Intel Mac — is not an error: it
+    answers ``mlx_available: false`` with zeroes and the reason, which is what
+    "we could not look" honestly looks like.
+    """
+    try:
+        active, cached = _mlx_memory()
+        total = _total_memory_bytes()
+    except Exception as exc:  # noqa: BLE001 — an absent GPU is not a failure
+        quiet("MLX unified-memory probe")
+        return {
+            "mlx_available": False,
+            "gpu_mem_gb": 0.0,
+            "gpu_mem_pct": 0.0,
+            "total_bytes": 0,
+            "detail": str(exc),
+        }
+    used = active + cached
+    return {
+        "mlx_available": True,
+        "gpu_mem_gb": round(used / (1024 ** 3), 2),
+        "gpu_mem_pct": round(used / total * 100, 1) if total else 0.0,
+        "total_bytes": total,
+        "detail": None,
+    }
+
+
+# ── request bodies ──────────────────────────────────────────────────────────
+
+
+class LlmStreamRequest(BaseModel):
+    """One streaming completion, in the argument shape ``LLMRouter`` already takes."""
+
+    model_id: Optional[str] = None
+    message: str
+    context: Optional[str] = None
+    max_tokens: int = 4096
+    temperature: float = 0.2
+    image_data: Optional[str] = None
+    mode: str = "chat"
+
+
+def create_worker_seams_router(
+    *,
+    require_user: Callable[[Request], Any],
+    enforce_rate_limit: Callable[[str, str], None],
+    model_router: Any = None,
+) -> APIRouter:
+    """The remaining v11.6.0 delegation seams, wired to what the worker holds.
+
+    ``model_router`` is the in-process
+    :class:`~latticeai.models.router.LLMRouter`; absent, the stream seam yields
+    the same ``No model.`` marker the router itself would.
+    """
+    router = APIRouter()
+
+    def _require_seam(request: Request) -> None:
+        """404 unless the host opened the seam for this worker."""
+        if not seam_open():
+            raise http_error(404, "agent_seam.disabled", resolve_language(request))
+
+    def _admit(request: Request) -> str:
+        """Authenticate and charge this call against the per-step budget."""
+        current_user = require_user(request)
+        enforce_rate_limit(current_user, SEAM_RATE_BUCKET)
+        return str(current_user or "")
+
+    @router.get("/worker/sysinfo")
+    async def worker_sysinfo(request: Request):
+        """The unified-memory reading only this process can take."""
+        _require_seam(request)
+        _admit(request)
+        return await asyncio.to_thread(probe_gpu_memory)
+
+    @router.post("/worker/llm/stream")
+    async def worker_llm_stream(req: LlmStreamRequest, request: Request):
+        """Stream one completion over the same path ``ChatService`` uses.
+
+        Frames are ``data: {"text": …}`` (or ``{"error": …}``) plus the
+        terminating ``data: [DONE]`` sentinel. The gateway never content-
+        negotiates on ``Accept``; this seam always answers as an event stream
+        so a VS Code client that sent only ``stream: true`` still parses.
+        """
+        _require_seam(request)
+        _admit(request)
+
+        async def _frames():
+            try:
+                if model_router is None:
+                    yield (
+                        "data: "
+                        + json.dumps({"text": "No model."}, ensure_ascii=False)
+                        + "\n\n"
+                    )
+                    yield "data: [DONE]\n\n"
+                    return
+                if req.mode == "document":
+                    agen = model_router.stream_generate_document_as(
+                        req.model_id,
+                        req.message,
+                        req.context or "",
+                        max_tokens=req.max_tokens,
+                        temperature=req.temperature,
+                    )
+                else:
+                    agen = model_router.stream_generate_as(
+                        req.model_id,
+                        req.message,
+                        req.context,
+                        req.max_tokens,
+                        req.temperature,
+                        req.image_data,
+                    )
+                async for chunk in agen:
+                    text = chunk.text if hasattr(chunk, "text") else chunk
+                    yield (
+                        "data: "
+                        + json.dumps({"text": str(text)}, ensure_ascii=False)
+                        + "\n\n"
+                    )
+            except Exception as exc:  # noqa: BLE001 — already streaming a 200
+                logger.warning("worker llm stream failed: %s", exc)
+                yield (
+                    "data: "
+                    + json.dumps({"error": str(exc)}, ensure_ascii=False)
+                    + "\n\n"
+                )
+            yield "data: [DONE]\n\n"
+
+        return StreamingResponse(_frames(), media_type="text/event-stream")
+
+    return router
+
+
+__all__ = [
+    "LlmStreamRequest",
+    "create_worker_seams_router",
+    "probe_gpu_memory",
+]

package/latticeai/app_factory.py

@@ -1,150 +1,40 @@
-"""Lattice AI application factory.
-
-``create_app`` performs *all* construction that ``latticeai.server_app``
-historically ran at import time: MLX/GPU device init, config parsing,
-singleton construction (knowledge graph, workspace OS, registries, pipelines,
-gardener) and router assembly. Importing this module — like importing
-``latticeai.server_app`` — has **no side effects**: nothing heavy is imported
-and no file is created until ``create_app``/``build_runtime`` is called.
-
-``build_runtime`` returns the full constructed namespace (every name the
-legacy module-level assembly exposed); ``latticeai.server_app`` proxies it
-lazily via module ``__getattr__`` for backwards compatibility.
-
-The assembly itself lives in :mod:`latticeai.runtime.build_phases` as ten
-ordered phases sharing a :class:`~latticeai.runtime.runtime_context.RuntimeContext`.
-This module is now only the *orchestrator*: run the phases, then select the
-explicit compatibility surface. It used to be a single 1,300-line ``_build``
-closure, which worked because closures resolve free variables at call time —
-the RuntimeContext preserves exactly that property while naming the state.
+"""Lattice AI AI-Worker application factory.
+
+``build_context`` performs *all* construction the worker process needs: MLX/GPU
+device init, config parsing, the seam gate, the embedder and multi-modal ports,
+the LLM router, and the compute routers. Importing this module has **no side
+effects**: nothing heavy is imported and no file is created until
+``build_context`` is called.
+
+The assembly itself lives in :mod:`latticeai.runtime.build_phases` as seven
+ordered phases sharing a
+:class:`~latticeai.runtime.runtime_context.RuntimeContext`. This module is now
+only the *orchestrator*: run the phases and hand back the context.
+
+``create_app`` used to live here and built the 464-route product server.
+v11.6.0 moved that whole surface into ``lattice-host`` (plan §설계 결정 1) and
+WP-P1 deleted its Python side, so there is exactly one application in this
+package now — :func:`latticeai.worker_app.create_worker_app`, which is
+``build_context`` plus the worker profile.
 """
 
 from __future__ import annotations
 
-import threading
-from dataclasses import dataclass
-from typing import TYPE_CHECKING, Any, Dict, Optional
+from typing import TYPE_CHECKING, Optional
 
 from latticeai.runtime.build_phases import BUILD_PHASES
-from latticeai.runtime.namespace_runtime import RuntimeBundle, build_runtime_namespace
-from latticeai.runtime.router_registration import build_router_bundle
 from latticeai.runtime.runtime_context import RuntimeContext
 
 if TYPE_CHECKING:  # imports for annotations only — keep module import light
-    from fastapi import FastAPI
-
     from latticeai.core.config import Config
 
 
-def _legacy_exports(ctx: RuntimeContext) -> Dict[str, Any]:
-    """The explicit, allowlisted compatibility surface for ``server_app``.
-
-    Two kinds of name appear here: values the phases produced (read off the
-    context) and pass-through re-exports of module functions that historical
-    callers reached through ``server_app``. Keeping them in one function makes
-    the surface countable — ``namespace_runtime`` rejects anything not on its
-    allowlist.
-    """
-    from latticeai.api.security_dashboard import (
-        create_security_router as _create_security_router,
-    )
-    from latticeai.api.workspace import _workspace_scope_from_request
-    from latticeai.core.audit import (
-        build_admin_audit_report as _build_admin_audit_report,
-    )
-    from latticeai.core.audit import (
-        build_sensitivity_report as _build_sensitivity_report,
-    )
-    from latticeai.core.audit import (
-        classify_sensitive_message as _classify_sensitive_message,
-    )
-    from latticeai.core.audit import get_audit_log as _get_audit_log
-    from latticeai.core.mcp_registry import _fetch_skills_marketplace
-    from latticeai.core.model_compat import (
-        list_cached_profiles as _list_compat_profiles,
-    )
-    from latticeai.core.security import (
-        check_ip_rate_limit as _check_ip_rate_limit,
-    )
-    from latticeai.core.security import hash_password, verify_password
-    from latticeai.core.security import (
-        redact_secret_text as _redact_secret_text,
-    )
-    from latticeai.core.tool_registry import TOOL_CATALOG_BRIEF as _TOOL_CATALOG_BRIEF
-    from latticeai.core.users import user_id_for_email as _user_id_for_email
-    from latticeai.services.model_runtime import (
-        ENGINE_MODEL_CATALOG,
-        filter_lower_family_versions,
-        normalize_local_model_request,
-    )
-    from latticeai.services.tool_dispatch import (
-        LOCAL_WRITE_BLOCKED_PREFIXES as _LOCAL_WRITE_BLOCKED_PREFIXES,
-    )
-    from latticeai.services.tool_dispatch import TOOL_GOVERNANCE
-    from latticeai.services.tool_dispatch import (
-        TOOL_GOVERNANCE_DEFAULT as _TOOL_GOVERNANCE_DEFAULT,
-    )
-    from latticeai.services.tool_dispatch import agent_risk as _agent_risk
-    from latticeai.services.tool_dispatch import check_tool_role as _check_tool_role
-    from latticeai.services.tool_dispatch import tool_response as _tool_response
-
-    return {
-        # ── pass-through re-exports ──────────────────────────────────────
-        "ENGINE_MODEL_CATALOG": ENGINE_MODEL_CATALOG,
-        "TOOL_GOVERNANCE": TOOL_GOVERNANCE,
-        "filter_lower_family_versions": filter_lower_family_versions,
-        "hash_password": hash_password,
-        "normalize_local_model_request": normalize_local_model_request,
-        "verify_password": verify_password,
-        "_LOCAL_WRITE_BLOCKED_PREFIXES": _LOCAL_WRITE_BLOCKED_PREFIXES,
-        "_TOOL_CATALOG_BRIEF": _TOOL_CATALOG_BRIEF,
-        "_TOOL_GOVERNANCE_DEFAULT": _TOOL_GOVERNANCE_DEFAULT,
-        "_agent_risk": _agent_risk,
-        "_build_admin_audit_report": _build_admin_audit_report,
-        "_build_sensitivity_report": _build_sensitivity_report,
-        "_check_ip_rate_limit": _check_ip_rate_limit,
-        "_check_tool_role": _check_tool_role,
-        "_classify_sensitive_message": _classify_sensitive_message,
-        "_create_security_router": _create_security_router,
-        "_fetch_skills_marketplace": _fetch_skills_marketplace,
-        "_get_audit_log": _get_audit_log,
-        "_list_compat_profiles": _list_compat_profiles,
-        "_redact_secret_text": _redact_secret_text,
-        "_tool_response": _tool_response,
-        "_user_id_for_email": _user_id_for_email,
-        "_workspace_scope_from_request": _workspace_scope_from_request,
-        # ── values the phases produced ───────────────────────────────────
-        "enforce_rate_limit": ctx.enforce_rate_limit,
-        "_RATE_LIMIT_ENABLED": ctx._RATE_LIMIT_ENABLED,
-        "_SESSION_TTL": ctx._SESSION_TTL,
-        "_allowed_workspaces_for": ctx._allowed_workspaces_for,
-        "_bytes_match_extension": ctx._bytes_match_extension,
-        "_check_rate_limit": ctx._check_rate_limit,
-        "_client_ip": ctx._client_ip,
-        "_embedding_info": ctx._embedding_info,
-        "_get_sso_discovery": ctx._get_sso_discovery,
-        "_graph_stats_safe": ctx._graph_stats_safe,
-        "_host_is_loopback": ctx._host_is_loopback,
-        "_llm_generate_sync": ctx._llm_generate_sync,
-        "_product_hardening_status": ctx._product_hardening_status,
-        "_recent_chat_context": ctx._recent_chat_context,
-        "_require_graph": ctx._require_graph,
-        "_scoped_hybrid_search": ctx._scoped_hybrid_search,
-        "_security_audit_events_safe": ctx._security_audit_events_safe,
-        "_security_list_uploaded_files": ctx._security_list_uploaded_files,
-        "_spawn": ctx._spawn,
-        "_workspace_graph": ctx._workspace_graph,
-        "_workspace_models_payload": ctx._workspace_models_payload,
-        "_workspace_settings_payload": ctx._workspace_settings_payload,
-    }
-
-
 def build_context(config: "Optional[Config]" = None) -> RuntimeContext:
     """Run every build phase in order and return the populated context.
 
-    Exposed separately from :func:`build_runtime` so tests can inspect the
-    assembly (which phase produced what) without going through the legacy
-    namespace adapter.
+    Exposed separately from :func:`latticeai.worker_app.create_worker_app` so
+    tests can inspect the assembly (which phase produced what) without building
+    an application.
     """
     ctx = RuntimeContext(config)
     for phase in BUILD_PHASES:
@@ -152,103 +42,4 @@ def build_context(config: "Optional[Config]" = None) -> RuntimeContext:
     return ctx
 
 
-def _build(config: "Optional[Config]" = None) -> Dict[str, Any]:
-    """Assemble the application and return its explicit export namespace."""
-    ctx = build_context(config)
-    runtime_bundle = RuntimeBundle(
-        app=ctx.app,
-        CONFIG=ctx.CONFIG,
-        KNOWLEDGE_GRAPH=ctx.KNOWLEDGE_GRAPH,
-        INGESTION_PIPELINE=ctx.INGESTION_PIPELINE,
-        AGENT_RUNTIME=ctx.AGENT_RUNTIME,
-        HOOKS_REGISTRY=ctx.HOOKS_REGISTRY,
-        REVIEW_QUEUE=ctx.REVIEW_QUEUE,
-        AGENT_REGISTRY=ctx.AGENT_REGISTRY,
-        model_router=ctx.model_router,
-        build_runtime=build_runtime,
-        get_shared_runtime=get_shared_runtime,
-        create_app=create_app,
-        config_runtime=ctx.config_runtime,
-        security_runtime=ctx.security_runtime,
-        brain_runtime=ctx.brain_runtime,
-        model_runtime=ctx.model_runtime,
-        router_bundle=build_router_bundle(ctx.app, ctx.app_context),
-    )
-    return build_runtime_namespace(
-        runtime_bundle=runtime_bundle,
-        legacy_exports=_legacy_exports(ctx),
-    )
-
-
-@dataclass(frozen=True)
-class LegacyRuntimeNamespace:
-    """Compatibility adapter for the historical module-level runtime surface."""
-
-    namespace: Dict[str, Any]
-
-    def bind(self, runtime: "AppRuntime") -> None:
-        runtime.__dict__.update(self.namespace)
-
-
-class AppRuntime:
-    """The constructed application namespace.
-
-    Exposes every name the legacy import-time ``server_app`` module defined
-    (``app``, ``KNOWLEDGE_GRAPH``, ``load_users``, …) as attributes.
-    """
-
-    # Declared because they are bound dynamically from the namespace dict;
-    # these two are the ones this module itself reads back.
-    app: Any
-    CONFIG: Any
-
-    def __init__(self, namespace: Dict[str, Any]) -> None:
-        self._legacy_namespace = LegacyRuntimeNamespace(namespace)
-        self._legacy_namespace.bind(self)
-
-
-_runtime_lock = threading.RLock()
-_shared_runtime: "Optional[AppRuntime]" = None
-
-
-def build_runtime(config: "Optional[Config]" = None) -> AppRuntime:
-    """Construct a fresh runtime (all singletons + FastAPI app)."""
-    return AppRuntime(_build(config))
-
-
-def get_shared_runtime() -> AppRuntime:
-    """The process-wide runtime backing ``latticeai.server_app`` / ``server``.
-
-    Built once, on first access — never at import time.
-    """
-    global _shared_runtime
-    if _shared_runtime is None:
-        with _runtime_lock:
-            if _shared_runtime is None:
-                _shared_runtime = build_runtime()
-    return _shared_runtime
-
-
-def create_app(config: "Optional[Config]" = None) -> "FastAPI":
-    """Build and return the FastAPI application (the factory entrypoint)."""
-    return build_runtime(config).app
-
-
-def main() -> None:
-    """Serve the shared runtime (``python -m latticeai.server_app``).
-
-    This used to call ``get_shared_runtime().main()``, but ``main`` was a local
-    inside the old ``_build`` closure and was never on the export allowlist, so
-    the call raised ``AttributeError`` — the module entrypoint was broken.
-    Serving from here needs no export at all.
-    """
-    import uvicorn
-
-    runtime = get_shared_runtime()
-    config = runtime.CONFIG
-    host, port = config.host, config.port
-    print(
-        f"🧠 Lattice AI Server starting in {config.app_mode} mode "
-        f"on http://{host}:{port}"
-    )
-    uvicorn.run(runtime.app, host=host, port=port, log_level="info")
+__all__ = ["build_context"]