ltcai 11.5.2 → 11.7.0

package/latticeai/runtime/build_phases/worker_profile.py

@@ -0,0 +1,244 @@
+"""The worker profile: which routes an AI-Worker process serves, and only those.
+
+v11.6.0 turns ``lattice-host`` into the product server (plan §설계 결정 1): 439
+of the 464 Python routes become native axum handlers, and the proxy fall-through
+is inverted into an allowlist that passes **only** the worker's own surface. The
+allowlist and this module's :data:`WORKER_ROUTES` are the same contract read from
+opposite ends, so it is written down once, here, as data.
+
+Two honest boundaries, because a reader will otherwise assume more:
+
+* **This profile shrinks the HTTP surface, not the construction.** WP-P1
+  deleted the keep-set's complement, so the six phases the worker runs now
+  build only what it serves and the filter below removes nothing — it has
+  become the assertion that nothing crept back. It stays because the allowlist
+  and the route table must keep being one fact read from two ends.
+
+* **The filter fails loudly.** A route named here that construction did not
+  produce raises at boot instead of yielding a worker that is quietly missing
+  its embedding surface. That is the failure mode a later WP will actually hit.
+
+The browser middleware (CORS, the CSRF origin guard) and the ``/static`` +
+``/icons`` mounts stay on the application object — they are attached by
+``phase_web`` — but the UI routes they serve are gone from the worker, which is
+correct: the worker is a loopback process the host starts for itself, and every
+seam on it is still behind ``require_user`` plus the seam switch.
+"""
+
+from __future__ import annotations
+
+from typing import Any, List, Set, Tuple
+
+#: ``(method, path)`` for each product route v11.6.0 leaves in Python —
+#: docs/v11.6.0_ONE_DOOR_PLAN.md §최종 Python 워커 표면, cross-checked against
+#: the KEEP_WORKER table of the route scout, then narrowed by §W3b (ingest,
+#: drain/rebuild, voice capture and the four document creators went native) and
+#: widened by §4a (the model pull came back). Paths are FastAPI's, converters
+#: included, so this compares to ``APIRoute.path`` without normalisation.
+#:
+#: This tuple, through :func:`worker_route_keys`, is the **one** source of the
+#: gateway's proxy allowlist. ``rust/fixtures/worker_allowlist.json`` is its
+#: committed projection, regenerated by
+#: ``scripts/gen_worker_allowlist_fixture.py`` and pinned by
+#: ``tests/unit/test_worker_allowlist.py`` — so a route added or removed here
+#: without regenerating fails CI instead of silently opening or closing a door
+#: in the Rust front door.
+WORKER_ROUTES: Tuple[Tuple[str, str], ...] = (
+    # AI-Worker seam (v11.5.1; /agent/change-proposal retired by WP-P1 —
+    # proposal state is native platform state and a stateless worker has no
+    # verdict to give)
+    ("POST", "/agent/llm"),
+    ("POST", "/agent/tool"),
+    # supervisor liveness + access posture
+    ("GET", "/health"),
+    # embedding production (drain/rebuild are native — W3b)
+    ("GET", "/api/embeddings/status"),
+    ("GET", "/api/embeddings/providers"),
+    # MLX model + engine lifecycle (in-process only)
+    ("GET", "/models"),
+    ("POST", "/models/load"),
+    ("POST", "/models/switch/{model_id:path}"),
+    ("DELETE", "/models/unload/{model_id:path}"),
+    ("DELETE", "/models/unload-all"),
+    ("POST", "/engines/prepare-model"),
+    ("POST", "/engines/prepare-model/stream"),
+    # The download itself is huggingface_hub / ollama running in *this*
+    # interpreter, which is the same reason the six lines above stay: model
+    # management is the worker's box. The gateway proxies it rather than
+    # shipping a native consent check in front of a 501 (v11.6.0 gateway
+    # integration §4a).
+    ("POST", "/engines/pull-model"),
+    # document parser (create_* + upload are native — W3b)
+    ("POST", "/tools/read_document"),
+    ("GET", "/tools/pdf_pages"),
+    ("GET", "/api/ingestion/multimodal"),
+    # local ASR status (POST /api/capture/voice is native — W3b)
+    ("GET", "/api/capture/voice/status"),
+)
+
+#: Retired by W3b — ingest is native. Kept as an empty tuple so imports
+#: (`GRAPH_WRITER_ROUTES`) and `worker_route_keys()` stay stable.
+GRAPH_WRITER_ROUTES: Tuple[Tuple[str, str], ...] = ()
+
+#: The seams v11.6.0 adds (WP-I6 + WP-R4's streaming completion). Mounted here
+#: and nowhere else. ``/worker/chat/record-turn`` was the third: WP-W3a moved
+#: the redact → audit → store → ingest chain into ``lattice-chat`` and proved
+#: the seam is requested zero times, and WP-P1 deleted the handler with the
+#: conversation store it wrote through.
+WORKER_SEAM_ROUTES: Tuple[Tuple[str, str], ...] = (
+    ("GET", "/worker/sysinfo"),
+    ("POST", "/worker/llm/stream"),
+)
+
+#: The pure-compute seams of Wave 2.5 §W2 (``latticeai/api/worker_compute.py``).
+#: Kept apart from :data:`WORKER_SEAM_ROUTES` because they age in the opposite
+#: direction: the state seams above are retired once §W3 lands the native write
+#: engine, while these nine are what the worker is *for* once Rust owns every
+#: write. Mounted here and nowhere else.
+WORKER_COMPUTE_ROUTES: Tuple[Tuple[str, str], ...] = (
+    ("POST", "/worker/embed"),
+    ("POST", "/worker/parse"),
+    ("POST", "/worker/render/docx"),
+    ("POST", "/worker/render/xlsx"),
+    ("POST", "/worker/render/pptx"),
+    ("POST", "/worker/render/pdf"),
+    ("POST", "/worker/asr"),
+    ("POST", "/worker/multimodal/describe"),
+    ("POST", "/worker/extract"),
+)
+
+
+def worker_route_keys() -> Set[Tuple[str, str]]:
+    """Every ``(method, path)`` a worker process may answer."""
+    return (
+        set(WORKER_ROUTES)
+        | set(GRAPH_WRITER_ROUTES)
+        | set(WORKER_SEAM_ROUTES)
+        | set(WORKER_COMPUTE_ROUTES)
+    )
+
+
+
+def _route_keys(route: Any) -> Set[Tuple[str, str]]:
+    """``{(method, path)}`` for one API route — every method it answers.
+
+    A route is kept only when *all* of its methods are on the allowlist, so a
+    path that also serves an un-allowlisted verb cannot slip through on the
+    strength of the one verb the worker wanted.
+    """
+    return {(str(method), str(route.path)) for method in route.methods}
+
+
+def phase_worker_routes(ctx: Any) -> None:
+    """Mount the v11.6.0 seams, then reduce the app to the worker surface.
+
+    Runs *after* the ordinary build phases: it needs the model router and the
+    resolved embedder. It publishes nothing onto the context — the profile is a
+    decision about the application object, not more assembly state.
+    """
+    from latticeai.api.worker_compute import create_worker_compute_router
+    from latticeai.api.worker_seams import create_worker_seams_router
+
+    app = ctx.app
+    app.include_router(
+        create_worker_seams_router(
+            require_user=ctx.require_user,
+            enforce_rate_limit=ctx.enforce_rate_limit,
+            model_router=getattr(ctx, "model_router", None),
+        )
+    )
+    # The compute seams take the *resolved* embedder and the same injected
+    # multimodal ports the ingestion path holds, so a vector or a caption
+    # produced through HTTP is the one this process would have produced
+    # in-process. ``getattr`` because a worker built without a Brain still boots
+    # — each seam reports the absence rather than failing construction.
+    ports = getattr(ctx, "MULTIMODAL_PORTS", None)
+    app.include_router(
+        create_worker_compute_router(
+            embedder=getattr(ctx, "EMBEDDER", None),
+            transcriber=getattr(ports, "transcriber", None),
+            multimodal_ports=ports,
+            require_user=ctx.require_user,
+            enforce_rate_limit=ctx.enforce_rate_limit,
+        )
+    )
+    apply_worker_route_filter(app)
+
+
+def _included_router(route: Any) -> Any:
+    """The router behind an ``include_router`` entry, or ``None``.
+
+    FastAPI ≥ 0.140 stopped flattening ``include_router`` into the application's
+    own route list and appends a ``_IncludedRouter`` wrapper instead. A filter
+    that only understood the flat shape saw *zero* API routes on the newer
+    release and raised "the build produced no route for …" for the entire
+    surface — a boot failure that depends on which FastAPI a fresh resolve
+    picked, which is the worst kind. Read through the wrapper by duck-typing
+    (``original_router``) rather than importing a private class, so neither
+    release is the one this file is written against.
+    """
+    inner = getattr(route, "original_router", None)
+    return inner if inner is not None and hasattr(inner, "routes") else None
+
+
+def apply_worker_route_filter(app: Any) -> None:
+    """Keep the worker's routes and FastAPI's own doc routes; drop the rest.
+
+    ``/openapi.json`` survives because the worker-only schema is one half of
+    the v11.6.0 OpenAPI composer (plan §설계 결정 4); the ``/static`` and
+    ``/icons`` mounts do not, because a worker serves no UI.
+
+    Since WP-P1 this removes nothing — construction produces exactly the worker
+    surface — so what it really is now is the assertion that nothing crept back
+    in, and that every route the allowlist promises was actually built.
+    """
+    from fastapi.routing import APIRoute
+    from starlette.routing import Mount
+
+    wanted = worker_route_keys()
+    present: Set[Tuple[str, str]] = set()
+
+    def _prune(routes: List[Any]) -> List[Any]:
+        kept: List[Any] = []
+        for route in list(routes):
+            included = _included_router(route)
+            if included is not None:
+                included.routes = _prune(included.routes)
+                if included.routes:
+                    kept.append(route)
+                continue
+            if isinstance(route, APIRoute):
+                keys = _route_keys(route)
+                if keys <= wanted:
+                    present.update(keys)
+                    kept.append(route)
+                continue
+            if isinstance(route, Mount):
+                # ``/static`` and ``/icons``: a worker serves no UI.
+                continue
+            # FastAPI's own ``/openapi.json``, ``/docs``, ``/redoc``.
+            kept.append(route)
+        return kept
+
+    kept = _prune(app.router.routes)
+    missing = sorted(wanted - present)
+    if missing:
+        raise RuntimeError(
+            "worker profile: the build produced no route for "
+            + ", ".join(f"{method} {path}" for method, path in missing)
+        )
+    app.router.routes = kept
+    # The schema was never generated at this point, but a caller that asked for
+    # it before pruning would otherwise be served the product route table.
+    app.openapi_schema = None
+
+
+__all__ = [
+    "GRAPH_WRITER_ROUTES",
+    "WORKER_COMPUTE_ROUTES",
+    "WORKER_ROUTES",
+    "WORKER_SEAM_ROUTES",
+    "apply_worker_route_filter",
+    "phase_worker_routes",
+    "worker_route_keys",
+]

package/latticeai/runtime/lifespan_runtime.py

@@ -1,4 +1,10 @@
-"""FastAPI lifespan assembly for app startup and shutdown tasks."""
+"""FastAPI lifespan assembly for worker startup and shutdown tasks.
+
+Two background tasks, both about the one thing this process holds that a
+restart would lose: the loaded model. The telegram bridge and the local
+knowledge watcher used to start here too — both are product surfaces
+``lattice-host`` owns now, and neither had anything to do with inference.
+"""
 
 from __future__ import annotations
 
@@ -11,7 +17,6 @@ from latticeai.core.quiet import quiet
 def build_lifespan_runtime(
     *,
     app_mode: str,
-    enable_telegram: bool,
     autoload_models: bool,
     is_public_mode: bool,
     public_model: str,
@@ -20,7 +25,6 @@ def build_lifespan_runtime(
     local_draft_model: str,
     model_idle_unload_seconds: int,
     model_router: Any,
-    local_kg_watcher: Any,
     local_server_processes: Dict[str, Any],
     logger: Any,
 ) -> Dict[str, Any]:
@@ -103,26 +107,13 @@ def build_lifespan_runtime(
     async def lifespan(_app):
         try:
             print(f"🧭 Lattice AI mode: {app_mode}")
-            if enable_telegram:
-                from latticeai.integrations.telegram_bot import run_bot
-
-                spawn(run_bot(), name="telegram_bot")
-                print("🚀 Telegram Bot Bridge activated!")
-            else:
-                print("⏭️ Telegram Bot Bridge disabled for this mode.")
             spawn(unload_idle_models_loop(), name="unload_idle_models")
             spawn(autoload_default_model(), name="autoload_default_model")
-            if local_kg_watcher:
-                restored = local_kg_watcher.restore_enabled_sources()
-                if restored.get("restored"):
-                    print(f"🕸️ Local knowledge watchers restored: {restored['restored']}")
         except Exception as e:  # pragma: no cover - startup diagnostics
             print(f"⚠️ Startup sequence failed: {e}")
         try:
             yield
         finally:
-            if local_kg_watcher:
-                local_kg_watcher.stop_all()
             model_router.unload_all()
             for proc in local_server_processes.values():
                 try:

package/latticeai/runtime/platform_services_runtime.py

@@ -22,18 +22,4 @@ def build_model_service(
     )
 
 
-def build_brain_network(
-    *,
-    identity: Any,
-    portability: Any,
-    data_dir: Any,
-) -> Any:
-    """Construct peer sync/network service for brain portability routes."""
-
-    from lattice_brain.graph.network import BrainNetwork
-
-    return BrainNetwork(
-        identity=identity,
-        portability=portability,
-        data_dir=data_dir,
-    )
+__all__ = ["build_model_service"]

package/latticeai/runtime/runtime_context.py

@@ -44,7 +44,6 @@ class RuntimeContext:
     IS_PUBLIC_MODE: bool
     DEFAULT_HOST: str
     DEFAULT_PORT: int
-    ENABLE_TELEGRAM: bool
     ENABLE_GRAPH: bool
     AUTOLOAD_MODELS: bool
     MODEL_IDLE_UNLOAD_SECONDS: Any
@@ -59,166 +58,50 @@ class RuntimeContext:
     PUBLIC_MODEL: str
     LOCAL_MODEL: Any
     LOCAL_DRAFT_MODEL: Any
-    OPEN_REGISTRATION: bool
-    SSO_DISCOVERY_URL: Any
-    SSO_CLIENT_ID: Any
-    SSO_CLIENT_SECRET: Any
-    SSO_REDIRECT_URI: Any
-    SSO_PROVIDER_NAME: Any
-    INVITE_CODE: Any
-    INVITE_COOKIE_SECRET: Any
-    INVITE_GATE_ENABLED: bool
-    SECURE_COOKIES: bool
+    RATE_LIMIT_ENABLED: bool
+    _RATE_LIMIT_ENABLED: bool
     BASE_DIR: Any
     DATA_DIR: Any
     STATIC_DIR: Any
     USERS_FILE: Any
-    HISTORY_FILE: Any
-    VPC_FILE: Any
-    AUDIT_FILE: Any
-    SSO_FILE: Any
     keyring: Any
 
-    # ── phase 3: identity, audit, history ────────────────────────────────
-    load_mcp_installs: Any
-    mcp_public_item: Any
-    recommend_mcps: Any
-    install_mcp: Any
-    _SESSION_TTL: Any
+    # ── phase 3: the seam gate ───────────────────────────────────────────
     _session_store: Any
-    create_session: Any
     get_session_email: Any
-    invalidate_session: Any
     load_users: Any
-    save_users: Any
     user_id_for_email: Any
-    verify_and_migrate_password: Any
-    redact_secret_text: Any
-    get_audit_log: Any
-    append_audit_event: Any
-    classify_sensitive_message: Any
-    build_sensitivity_report: Any
-    build_admin_audit_report: Any
     get_user_role: Any
     _extract_bearer_token: Any
     get_current_user: Any
     require_user: Any
     require_admin: Any
-    public_user: Any
-    _RATE_LIMIT_ENABLED: bool
     enforce_rate_limit: Any
-    _check_rate_limit: Any
-    _client_ip: Any
-    _bytes_match_extension: Any
-    _host_is_loopback: Any
-    get_history_user: Any
-    get_user_api_key: Any
-    set_user_api_key: Any
-    get_sso_settings: Any
-    public_sso_config: Any
-    save_sso_config: Any
-    _get_sso_discovery: Any
-    _sso_states: Any
-    _sso_env_defaults: Any
-    load_vpc_config: Any
-    save_vpc_config: Any
 
-    # ── phase 4: brain, persistence ──────────────────────────────────────
+    # ── phase 4: the compute ports ───────────────────────────────────────
     EMBEDDING_PROFILE: Any
     EMBEDDER: Any
-    STORAGE_ENGINE: Any
-    brain_runtime: Any
-    KNOWLEDGE_GRAPH: Any
-    CONVERSATIONS: Any
-    save_to_history: Any
-    HOOKS_REGISTRY: Any
-    LOCAL_KG_WATCHER: Any
-    REALTIME_BUS: Any
-    WORKSPACE_OS: Any
-    WORKSPACE_SERVICE: Any
-    INVITATION_STORE: Any
-    PLUGIN_REGISTRY: Any
-    TEMPLATE_CATALOG: Any
-    AGENT_REGISTRY: Any
-    MEMORY_SERVICE: Any
-    BRAIN_INTELLIGENCE: Any
-    AUTOMATION_INTELLIGENCE: Any
-    INGESTION_PIPELINE: Any
+    VOICE_CAPTURE: Any
     MULTIMODAL_PORTS: Any
-    DEVICE_IDENTITY: Any
-    KG_PORTABILITY: Any
-    FUNNEL_METRICS: Any
-    get_history: Any
-    conversation_title: Any
-    group_history_conversations: Any
-    get_conversation_messages: Any
-    clear_history: Any
-    clear_conversation: Any
-    _history_allowed_workspaces_for: Any
-    _history_include_legacy_global: Any
-    _require_graph: Any
-    _workspace_graph: Any
+    INGESTION_PIPELINE: Any
 
-    # ── phase 5: domain services ─────────────────────────────────────────
+    # ── phase 5: domain singletons ───────────────────────────────────────
     model_router: Any
-    gardener: Any
-    CHAT_SERVICE: Any
-    SEARCH_SERVICE: Any
-    BRAIN_MEMORY: Any
-    CONTEXT_ASSEMBLER: Any
-    ARTIFACT_LEDGER: Any
-    _scoped_hybrid_search: Any
-    CHAT_AGENT_RUNTIME: Any
-    on_chat_message: Any
-    _recent_chat_context: Any
-    _workspace_settings_payload: Any
-    _workspace_models_payload: Any
-    _embedding_info: Any
-    _allowed_workspaces_for: Any
-    app_context: Any
 
-    # ── phase 6: web app and foundation routers ──────────────────────────
+    # ── phase 6: the web shell ───────────────────────────────────────────
     _spawn: Any
     lifespan: Any
     app: Any
+    CORS_ALLOWED_ORIGINS: Any
+    CSRF_ALLOWED_ORIGINS: Any
     model_runtime_service: Any
-    STATIC_ROUTES: Any
-    ui_file_response: Any
-    local_sysinfo: Any
-    invite_authorized: Any
-    auth_router: Any
-    admin_router: Any
-    invitations_router: Any
-    security_router: Any
-    _graph_stats_safe: Any
-    _product_hardening_status: Any
-    _security_audit_events_safe: Any
-    _security_list_uploaded_files: Any
-
-    # ── phase 7: platform features ───────────────────────────────────────
-    _llm_generate_sync: Any
-    PLATFORM: Any
-    _automation_runtime: Any
-    REVIEW_QUEUE: Any
-    TRIGGER_SERVICE: Any
-    AGENT_RUNTIME: Any
-    RUN_EXECUTOR: Any
-    COMMAND_CENTER: Any
-    CHRONICLE: Any
-    CHANGE_PROPOSALS: Any
-    EVIDENCE_ACTIONS_SERVICE: Any
-    VOICE_CAPTURE: Any
-    PROJECT_SESSIONS: Any
 
-    # ── phase 8: interaction routers ─────────────────────────────────────
-    model_runtime: Any
-
-    # ── legacy compatibility surface (phase 9 reads these) ───────────────
-    legacy: Dict[str, Any]
+    # ── phase 7: the compute routers ─────────────────────────────────────
+    model_service: Any
+    _embedding_info: Any
 
     def __init__(self, config: Any = None) -> None:
         self.config_arg = config
-        self.legacy = {}
         self._produced: Dict[str, str] = {}
         self._phase: str = "<none>"
 

package/latticeai/runtime/security_runtime.py

@@ -1,13 +1,15 @@
-"""Security runtime assembly for app startup."""
+"""Security-derived runtime settings for the AI-Worker build.
+
+Everything this module used to resolve — SSO endpoints, the invitation gate's
+per-install secrets, the Secure-cookie decision — belonged to the login surface
+``lattice-auth`` owns now. One setting outlives it: whether the per-user rate
+limiter is armed, which the worker still enforces on every seam call.
+"""
 
 from __future__ import annotations
 
-import json
-import logging
-import secrets
 from dataclasses import dataclass
-from pathlib import Path
-from typing import TYPE_CHECKING, Dict
+from typing import TYPE_CHECKING
 
 from latticeai.runtime.stages import RuntimeStage
 
@@ -15,110 +17,15 @@ if TYPE_CHECKING:
     from latticeai.core.config import Config
 
 
-_SECURITY_SECRETS_FILE = "security_secrets.json"
-
-
 @dataclass(frozen=True)
 class SecurityRuntime(RuntimeStage):
-    SSO_DISCOVERY_URL: str
-    SSO_CLIENT_ID: str
-    SSO_CLIENT_SECRET: str
-    SSO_REDIRECT_URI: str
-    SSO_PROVIDER_NAME: str
     RATE_LIMIT_ENABLED: bool
-    OPEN_REGISTRATION: bool
-    INVITE_CODE: str
-    INVITE_COOKIE_SECRET: str
-    INVITE_GATE_ENABLED: bool
-    SECURE_COOKIES: bool
-
-
-def _stored_security_secrets(data_dir: Path) -> Dict[str, str]:
-    path = data_dir / _SECURITY_SECRETS_FILE
-    if not path.exists():
-        return {}
-    try:
-        payload = json.loads(path.read_text(encoding="utf-8"))
-    except Exception as exc:
-        # A corrupt secret store invalidates old invite cookies, but must never
-        # make startup fall back to a shared or predictable signing key.
-        logging.warning("invite-gate secret store is unreadable; rotating secrets: %s", exc)
-        return {}
-    if not isinstance(payload, dict):
-        return {}
-    return {
-        key: str(value)
-        for key, value in payload.items()
-        if key in {"invite_code", "invite_cookie_secret"} and value
-    }
-
-
-def _resolve_invite_gate_secrets(config: "Config") -> tuple[str, str]:
-    """Resolve stable, per-install invitation secrets.
-
-    No file is created while the invitation gate is disabled.  Once enabled,
-    missing values are generated with the OS CSPRNG and persisted atomically
-    with mode 0600 so restarts do not invalidate links or signed cookies.
-    Explicit environment values remain authoritative and are not copied to the
-    local secret file unnecessarily.
-    """
-
-    if not config.invite_gate_enabled:
-        return config.invite_code, config.invite_cookie_secret
-
-    from latticeai.core.io_utils import atomic_write_json
-
-    data_dir = Path(config.data_dir)
-    stored = _stored_security_secrets(data_dir)
-    invite_code = config.invite_code or stored.get("invite_code") or secrets.token_urlsafe(24)
-    cookie_secret = (
-        config.invite_cookie_secret
-        or stored.get("invite_cookie_secret")
-        or secrets.token_urlsafe(48)
-    )
-
-    persisted = dict(stored)
-    if not config.invite_code:
-        persisted["invite_code"] = invite_code
-    if not config.invite_cookie_secret:
-        persisted["invite_cookie_secret"] = cookie_secret
-    if persisted != stored:
-        atomic_write_json(data_dir / _SECURITY_SECRETS_FILE, persisted)
-    return invite_code, cookie_secret
 
 
 def build_security_runtime(config: "Config") -> SecurityRuntime:
-    """Build auth/security-derived runtime settings from the central config."""
-
-    from latticeai.core.security import configure_trusted_proxies
+    """Build the security-derived runtime settings from the central config."""
 
-    configure_trusted_proxies(config.trusted_proxies)
-    invite_code, invite_cookie_secret = _resolve_invite_gate_secrets(config)
-    secure_cookies = bool(config.is_public or config.network_exposed)
-    if secure_cookies:
-        logging.warning(
-            "Public/non-loopback mode: authentication and Secure cookies are forced; "
-            "serve Lattice AI through HTTPS/TLS or browser sessions will be rejected."
-        )
-    if config.invite_gate_enabled and not config.invite_code:
-        logging.warning(
-            "No LATTICEAI_INVITE_CODE was configured; generated a private per-install "
-            "invite code in %s.",
-            Path(config.data_dir) / _SECURITY_SECRETS_FILE,
-        )
-    return SecurityRuntime(
-        SSO_DISCOVERY_URL=config.sso_discovery_url,
-        SSO_CLIENT_ID=config.sso_client_id,
-        SSO_CLIENT_SECRET=config.sso_client_secret,
-        SSO_REDIRECT_URI=config.sso_redirect_uri,
-        SSO_PROVIDER_NAME=config.sso_provider_name,
-        RATE_LIMIT_ENABLED=config.rate_limit_enabled,
-        OPEN_REGISTRATION=config.open_registration,
-        INVITE_CODE=invite_code,
-        INVITE_COOKIE_SECRET=invite_cookie_secret,
-        INVITE_GATE_ENABLED=config.invite_gate_enabled,
-        SECURE_COOKIES=secure_cookies,
-    )
+    return SecurityRuntime(RATE_LIMIT_ENABLED=config.rate_limit_enabled)
 
 
 __all__ = ["SecurityRuntime", "build_security_runtime"]