ltcai 11.7.0 → 11.9.0

package/docs/DEVELOPMENT.md

@@ -3,7 +3,7 @@
 > **Status: canonical** — current contributor guidance, kept in sync with the
 > current release.
 
-Current release: **11.7.0 — Clean Sweep**.
+Current release: **11.9.0 — Working Order**.
 
 This document is for contributors working on the local-first Digital Brain
 codebase. Product positioning and quick start stay in `README.md`; supported
@@ -32,15 +32,20 @@ Engineering work should preserve these boundaries:
 
 ```bash
 npm install
-npm run dev
+npm start
 ```
 
-The local app is served through the FastAPI sidecar at:
+`npm start` (or `bin/ltcai.js` / the `LTCAI` binary) is the product: it
+boots `lattice-host` and serves the SPA at:
 
 ```text
 http://127.0.0.1:4825/app
 ```
 
+`npm run dev` is **not** the product. It starts the 19-route Python AI
+worker with `--reload` (`latticeai.cli.entrypoint`). Use it when iterating
+on worker compute seams, not to serve the app.
+
 Apple Silicon local model extras:
 
 ```bash
@@ -53,7 +58,6 @@ Run the smallest affected gate while iterating. Before committing broad runtime,
 API, UI, or release work, run:
 
 ```bash
-npm run check:python
 npm run lint
 npm run typecheck
 npm run test:frontend
@@ -61,9 +65,21 @@ npm run test:unit
 npm run docs:check-links
 ```
 
-`npm run lint` runs the Python Ruff baseline, frontend TypeScript lint gate,
-visual smoke syntax checks, an exact generated-OpenAPI drift check, i18n literal
-checks, and browser-extension syntax/behavior tests.
+`npm run lint` is **ten** gates since 11.8.0, in order: `lint:python`
+(ruff + mypy), `lint:visual`, `lint:frontend`, `frontend:openapi:check`,
+`check_i18n_literals.mjs`, `check:i18n-namespaces`, `check:bundle`,
+`check:server-i18n`, `check_release_evidence_bound.mjs`, and
+`check:max-file-lines`. Three left in 11.8.0: `check:python` (ruff already
+parses every file on every CI test leg), `check:legacy-debt` (the mjs mirror had
+drifted from the Python test that states the same rule — the Python test is
+authoritative), and the extension tests, which CI now invokes directly on the
+3.11 + ubuntu leg.
+
+Coverage floors are not symmetrical, and the difference is deliberate rather
+than an oversight: **Python is a line-coverage floor of 90**
+(`[tool.coverage.report] fail_under = 90`, branch measurement off) and the
+frontend still pins **100% on all four vitest metrics**. Run
+`npm run test:coverage` / `npm run test:frontend:coverage` to see either.
 
 Use these when the change touches the relevant surface:
 
@@ -140,7 +156,8 @@ pre-tool/post-tool lifecycle:
 
 - browser `read-url` ingestion dispatches `tool.kg_ingest.*` events;
 - browser `ingest-current-tab` ingestion dispatches the same lifecycle;
-- `IngestionPipeline` remains the common ingestion boundary behind those routes.
+- the native ingest door in `lattice-ingest` (writing through `graph_write`)
+  remains the single ingestion boundary behind those routes.
 
 ## Documentation Sync
 
@@ -158,10 +175,13 @@ For user-facing, API, runtime, release, or packaging changes, check:
 Release/publish examples must use exact target-version filenames. Do not
 document wildcard artifact upload commands.
 
-For 9.9.0 release work, exact artifacts are:
+For 11.9.0 release work, exact artifacts are:
+
+- `dist/ltcai-11.9.0-py3-none-any.whl`
+- `dist/ltcai-11.9.0.tar.gz`
+- `ltcai-11.9.0.tgz`
+- `dist/ltcai-11.9.0.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_11.9.0_aarch64.dmg`
 
-- `dist/ltcai-9.9.0-py3-none-any.whl`
-- `dist/ltcai-9.9.0.tar.gz`
-- `ltcai-9.9.0.tgz`
-- `dist/ltcai-9.9.0.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_9.9.0_aarch64.dmg`
+The dmg is ad-hoc signed (effectively unsigned); `npm run release:validate`
+checks the names and presence, not a Developer ID signature.

package/docs/LEGACY_COMPATIBILITY.md

@@ -26,14 +26,18 @@ Removed layers stay listed in `legacy_compatibility.REMOVED_SHIMS` and in the
 
 ## Legacy Debt Gate
 
-Two gates keep the debt paid down:
+**One** gate keeps the debt paid down:
 
-- `scripts/check_legacy_debt.mjs` (part of `npm run lint`) — fails if a
-  disallowed root-level Python module reappears, or if any source tree imports
-  a removed root shim.
 - `tests/unit/test_legacy_root_shims.py` — asserts removed shims stay
-  unimportable, canonical replacements import, and the registry in
-  `latticeai.core.legacy_compatibility` matches reality.
+  unimportable and canonical replacements import.
+
+There used to be two. `scripts/check_legacy_debt.mjs` stated the same rule in
+JavaScript as part of `npm run lint`, and by 11.8.0 the two implementations had
+drifted apart — at which point having both was worse than having one, because
+neither could be trusted as the answer. The Python test is authoritative and the
+mjs mirror was deleted. `latticeai.core.legacy_compatibility` went with the
+platform code in 11.6.0; the registry it held described modules that no longer
+exist to shim.
 
 ## Root Module Map (removed in 9.9.1)
 

package/docs/ONBOARDING.md

@@ -1,6 +1,6 @@
 # Lattice AI Onboarding
 
-Current release: **11.7.0 — Clean Sweep**.
+Current release: **11.9.0 — Working Order**.
 
 The first-run goal is a five-minute path from "I opened the app" to "my Brain
 has a source, a question, and proof." This page is the product contract behind
@@ -10,8 +10,10 @@ read the docs first.
 ## Five-Minute Flow
 
 1. Wake the Brain and confirm the local owner profile.
-2. Let Lattice inspect local model/runtime readiness.
-3. Pick the recommended Brain voice or skip model loading.
+2. Let Lattice inspect local model/runtime readiness (`/setup/scan` is a
+   real probe; brew/pip items stay manual).
+3. Pick the recommended Brain voice (`/models/recommendations` probes RAM
+   and the worker catalog) or skip model loading.
 4. Add one source: upload a file, choose and scan a folder, save a note, or
    capture a browser/source event.
 5. Ask one grounded question and inspect the answer proof.

package/docs/OPERATIONS.md

@@ -1,4 +1,4 @@
-# Lattice AI — Operations Guide (v11.7.0)
+# Lattice AI — Operations Guide (v11.9.0)
 
 > **Status: canonical** — kept in sync with the current release. Storage layout
 > below reflects the SQLite live Brain store and workspace scoping, not the
@@ -29,6 +29,10 @@ tar -czf ltcai-backup-$(date +%Y%m%d).tar.gz ~/.ltcai ~/ltcai-agent
 tar -xzf ltcai-backup-YYYYMMDD.tar.gz -C ~
 ```
 
+인앱 복원(`.latticebrain` / `VACUUM INTO` 스냅샷)은 원자적입니다. **오래
+떠 있는 프로세스에서 복원하면 커넥션이 재활용되기 전까지 복원 전
+바이트를 줄 수 있습니다.** 복원 뒤에는 호스트를 재시작하십시오.
+
 ### 2.3 히스토리만 초기화
 ```bash
 rm ~/.ltcai/history.json

package/docs/PERMISSION_MODE.md

@@ -97,18 +97,23 @@ before routers are mounted would otherwise pin the store to the fallback
 
 ## Code map
 
+The dial is native. v11.6.0 moved the agent loop into `lattice-agent` and the
+routes into `lattice-platform`; v11.8.0 deleted the last Python module that
+still carried a copy of the gate helpers (`latticeai/core/agent_permission.py`,
+whose only readers were already ported).
+
 | Module | Role |
 |--------|------|
-| `latticeai/core/permission_mode.py` | Pure decision table |
-| `latticeai/core/agent_permission.py` | Agent plan/tool gate helpers |
-| `latticeai/core/agent/` | `SingleAgentRuntime` gates (mode-aware in-line: `planning.py` for the plan gate, `execution.py` for the per-tool gates) |
+| `rust/lattice-agent/src/mode.rs` | Pure decision table (port of `latticeai.core.permission_mode`) |
+| `rust/lattice-agent/src/permission.rs` | Plan/tool gate helpers — the ordered block-reason chain |
+| `rust/lattice-agent/src/breaker.rs` | Mode-invariant circuit breakers |
+| `rust/lattice-agent/src/agentloop/gates.rs` | The gates one executor step passes, in the order that decides it |
+| `rust/lattice-agent/src/agentloop/planning.rs` | The plan gate |
+| `rust/lattice-platform/src/permission_mode.rs` | HTTP routes + persistence (`permission_mode.json`, atomic replace) |
+| `rust/lattice-auth/src/policy.rs` | The tool policy table the gates read |
 | `frontend/src/components/PermissionModePanel.tsx` | Settings selector |
-| `latticeai/services/permission_mode_service.py` | Persistence |
-| `latticeai/runtime/permission_mode_wiring.py` | Process-wide service + router mount |
-| `latticeai/runtime/chat_wiring.py` | Agent runtime injection |
-| `latticeai/runtime/router_registration.py` | HTTP mount |
-| `latticeai/services/tool_dispatch.py` | `enforce_policy` + `build_agent_runtime` |
-| `latticeai/api/permission_mode.py` | HTTP routes |
+| `frontend/src/lib/permissionCopy.ts` | The plain-language wording for each mode |
+| `latticeai/core/permission_mode.py` | The worker's own `is_circuit_breaker`, asked by `POST /agent/tool` — the mode-invariant refusal holds on the executing side too, not only at the gate that dispatched |
 
 ## AGENTS.md note
 

package/docs/TRUST_MODEL.md

@@ -1,6 +1,6 @@
 # Lattice AI Trust Model
 
-Current release: **11.7.0 — Clean Sweep**.
+Current release: **11.9.0 — Working Order**.
 
 Lattice AI is local-first, explicit about external communication, and honest
 when a capability is unavailable.
@@ -24,10 +24,14 @@ Local data can include:
 
 External communication requires configuration plus a user/admin action:
 
-- cloud model calls after keys are configured and a cloud model is selected;
+- cloud model calls after credentials resolve (`cloud_provider.json` / env
+  key / locally OAuth-authenticated `agy` or `grok`) and the escalation
+  policy — or an explicit `/cloud` prefix — uses them. Every such turn
+  writes a shape-only egress audit (provider / model / reason, never
+  content) and stages extracted knowledge as a Review Center proposal;
 - model downloads from registries after install consent;
-- Telegram bridge after the integration is enabled, the chat is allowlisted,
-  and a dedicated server session bearer is configured;
+- Telegram bridge — removed in 11.6.0 with the platform code that became
+  the AI worker; nothing replaces it;
 - Brain Network peer actions after pairing;
 - Docker/Postgres setup after opt-in scale configuration;
 - update checks only when enabled;
@@ -51,7 +55,7 @@ Lattice AI should fail closed or show an unavailable state for:
 - no graph/context evidence available;
 - unavailable external integration;
 - unknown or unreadable Knowledge Graph workspace scope;
-- missing Telegram chat allowlist or dedicated server session token;
+- Telegram inbound (the bridge was removed in 11.6.0; nothing replaces it);
 - wrong archive passphrase;
 - archive tampering, unsupported archive versions, or path traversal.
 
@@ -67,7 +71,10 @@ does not mean secrets should appear in clear text.
 - Local files are only as protected as the user's machine, OS account, backups,
   and disk encryption.
 - Cloud model prompts follow the selected provider's policy once the user
-  explicitly chooses that provider.
+  explicitly chooses that provider (or the `auto`/`always` escalation
+  policy does, behind `cloud_allowed`). The `api_key` path is
+  mock-verified only in this release; live OAuth used `cli_oauth` at
+  zero billing. Extracted cloud knowledge is proposal-first.
 - A local admin can inspect local files and process memory outside Lattice AI.
 - Marketplace and model registries are third-party services when explicitly
   contacted.

package/docs/USABILITY_AUDIT.md

@@ -86,6 +86,11 @@ Heuristics:
 
 ## Journey 4 — Brain hierarchy
 
+> **Dated snapshot (2026-07-21).** `DepthEmergence.tsx` was deleted in v11.8.0
+> when the Brain home was redesigned; the depth-tiered reveal it describes is no
+> longer how the home discloses structure. The findings below are kept as the
+> record of what was evaluated at the time, not as current-truth surface notes.
+
 Surface: `frontend/src/features/brain/DepthEmergence.tsx`,
 `.../BrainMemoryLayer.tsx`.
 

package/docs/WHY_LATTICE.md

@@ -1,6 +1,6 @@
 # Why Lattice AI Exists
 
-Current release: **11.7.0 — Clean Sweep**.
+Current release: **11.9.0 — Working Order**.
 
 **Lattice AI is a local-first Digital Brain that keeps your knowledge durable
 across any AI model.**
@@ -25,8 +25,9 @@ material. That breaks down for real work:
 ## The Lattice Answer
 
 Lattice AI keeps conversations, documents, memories, decisions, relationships,
-and source provenance in a private local Brain. Models can be local, cloud,
-current, or future. The Brain remains.
+and source provenance in a private local Brain. Models can be local, or an
+optional cloud worker you hire (OAuth CLI or an API key). Default is local.
+The Brain remains.
 
 The graph matters as visible proof, but a graph editor is not the product
 identity. The product identity is a local-first Digital Brain: the user talks or
@@ -48,7 +49,8 @@ secondary.
 - Ask what the team decided and see the source.
 - Add documents and build a searchable private memory.
 - Prepare from old notes, project decisions, and files.
-- Preserve context when moving between models.
+- Preserve context when moving between models. Cloud is optional; default
+  is local.
 - Export or restore the Brain as an encrypted `.latticebrain` archive.
 - Use Korean or English without changing the underlying Brain.
 - Avoid fake answers when no model or evidence is available.

package/docs/kg-schema.md

@@ -1,6 +1,6 @@
 # Knowledge Graph Schema
 
-Current release: **11.7.0 — Clean Sweep**.
+Current release: **11.9.0 — Working Order**.
 
 명세 출처: `lattice_ai_full_spec.pptx` 슬라이드 20·21·22
 구현: `lattice_brain/graph/schema.py`
@@ -142,8 +142,12 @@ provenance(source_type, source_uri, content_hash, captured_at, modified_at,
   범위 없는 로컬 폴더는 개인 Brain으로 재투영하되 기존 노드 ID는 보존하며,
   같은 폴더를 다른 워크스페이스로 조용히 재할당하지 않는다.
 
-구현: `lattice_brain/ingestion/` (`IngestionPipeline`) 가 단일 진입점이며,
-파일/로컬폴더/URL/브라우저 탭/텍스트를 모두 이 형태로 정규화한다.
+구현: 단일 진입점은 v11.6.0부터 Rust의 네이티브 ingest 문
+(`lattice-ingest` → `lattice_core::graph_write`)이며, 파일/로컬폴더/URL/
+브라우저 탭/텍스트를 모두 이 형태로 정규화한다. `lattice_brain/ingestion/`은
+양쪽이 공유하는 어휘 — 라우팅 상수, DTO, 콘텐츠 해시, 추출 품질 점수 — 만
+남았고, v11.8.0이 마지막 잔재였던 `IngestionPipeline` 능력 프로브 클래스를
+그 유일한 호출 라우트와 함께 삭제했다.
 
 ---
 

package/docs/mcp-tools.md

@@ -4,7 +4,11 @@ Lattice AI는 MCP(Model Context Protocol) 서버로 동작하여 Claude Desktop,
 
 ## 연결 설정
 
-`claude_desktop_config.json` 또는 Cursor MCP 설정:
+The MCP surface is **streamable HTTP JSON-RPC** at `POST /mcp` on the
+loopback gateway (default `http://localhost:4825`). There is no separate
+stdio or SSE transport.
+
+`claude_desktop_config.json` or Cursor MCP settings:
 
 ```json
 {
@@ -16,112 +20,102 @@ Lattice AI는 MCP(Model Context Protocol) 서버로 동작하여 Claude Desktop,
 }
 ```
 
-## 도구 목록
-
-### 파일 시스템
+Auth is the same session gate as every other product route:
 
-| 도구 | 설명 | 위험도 |
-|------|------|--------|
-| `read_file` | 파일 읽기 (라인 번호, offset/limit 지원) | 낮음 |
-| `edit_file` | 정밀 diff 편집 (`old_string` 유일성 검증) | 중간 |
-| `list_dir` | 디렉토리 목록 | 낮음 |
-| `grep` | 정규식 검색, glob 필터, context_lines | 낮음 |
+- Loopback install with authentication off → the anonymous local owner (this
+  is what a localhost client such as Claude Desktop uses).
+- Authentication on → send the `session_token` cookie or
+  `Authorization: Bearer <token>`.
 
-### 실행
+Supported JSON-RPC methods: `initialize`, `notifications/initialized`,
+`tools/list`, `tools/call`. Unknown methods return `-32601`. Notifications
+have no result body (`202`).
 
-| 도구 | 설명 | 위험도 |
-|------|------|--------|
-| `run_command` | shell 없이 고정 read-only 명령 allowlist 실행 | 높음 |
-| `run_terminal_command` | 터미널 명령 (별칭) | 높음 |
+Every native tool call goes through the existing tool governor. A governance
+refusal is a JSON-RPC error (`-32001`), not a successful tool result.
 
-### 작업 관리
+## 도구 목록
 
-| 도구 | 설명 | 위험도 |
-|------|------|--------|
-| `todo_write` | TODO 항목 생성/업데이트 | 낮음 |
-| `todo_read` | TODO 목록 조회 | 낮음 |
+MCP exposes a **curated, read-oriented** subset of Lattice native tools,
+plus each installed skill as a prompt asset. Writes, shell, desktop control,
+and remote-install tools are **not** on this surface — use the REST `/tools/*`
+routes (with their own approval gates) for those.
 
-### 시스템
+### Native (governed)
 
 | 도구 | 설명 | 위험도 |
 |------|------|--------|
-| `computer_screenshot` | 화면 캡처 (desktop-control capability 및 정책 승인 필요) | 높음 |
-| `computer_status` | 데스크톱 제어 상태 조회 (동일 capability/policy 적용) | 중간 |
-| `computer_open_app` | 앱 실행 | 중간 |
-| `computer_open_url` | URL 열기 | 낮음 |
-| `network_status` | IP, Wi-Fi 정보 (인증 및 ToolRegistry 정책 적용) | 중간 |
+| `list_dir` | 워크스페이스 디렉터리 목록 (sandbox) | 낮음 |
+| `read_file` | 워크스페이스 UTF-8 파일 읽기 (offset/limit) | 낮음 |
+| `workspace_tree` | 재귀 트리 (깊이 제한) | 낮음 |
+| `grep` | 워크스페이스 정규식 검색 | 낮음 |
+| `knowledge_search` | 지식 정원 검색 (workspace scope, 승인 정책 적용) | 낮음 |
+| `knowledge_tree` | 지식 정원 파일 목록 (동일 정책) | 낮음 |
+| `git_status` | 워크스페이스 안 read-only `git status` | 낮음 |
 
-### 문서
+### Skills (prompt assets)
 
-| 도구 | 설명 | 위험도 |
-|------|------|--------|
-| `pdf_to_text` | PDF → 텍스트 변환 | 낮음 |
-| `pdf_pages` | PDF 페이지 수 조회 | 낮음 |
-| `read_docx` | Word 문서 읽기 | 낮음 |
-| `read_xlsx` | Excel 파일 읽기 | 낮음 |
-| `read_pptx` | PowerPoint 읽기 | 낮음 |
+Installed skills from the skills directory appear as `skill.<name>`
+(for example `skill.code_review`). `tools/list` serves the parsed
+`schema.json` input schema. `tools/call` returns the `SKILL.md` body plus
+the input echo — skills are not executables.
 
-### 지식 정원 (P-Reinforce)
+Typical names when the repo `skills/` tree is installed:
 
-| 도구 | 설명 | 위험도 |
-|------|------|--------|
-| `garden_save` | 지식 정원에 저장 | 낮음 |
-| `garden_tree` | 지식 트리 조회 | 낮음 |
-| `garden_read` | 정원 파일 읽기 | 낮음 |
+- `skill.code_review`
+- `skill.data_analysis`
+- `skill.file_edit`
+- `skill.meeting_notes`
+- `skill.summarize_document`
+- `skill.web_search`
+- `skill.weekly_review`
 
-## REST API 직접 호출
+## REST API
 
-MCP 대신 REST API로도 동일한 도구를 호출할 수 있습니다:
+The same governed subset is also reachable at `POST /mcp/call`
+(`{"action": "...", "args": {}}`) and the existing `/tools/*` routes.
 
 ```bash
-# read_file
-curl -b "session=<token>" \
-  "http://localhost:4825/tools/read_file?path=server.py"
+# MCP JSON-RPC initialize
+curl -s -X POST http://localhost:4825/mcp \
+  -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"curl","version":"0"}}}'
 
-# edit_file
-curl -b "session=<token>" -X POST \
-  http://localhost:4825/tools/edit_file \
+# MCP tools/call
+curl -s -b "session_token=<token>" -X POST http://localhost:4825/mcp \
   -H "Content-Type: application/json" \
-  -d '{"path": "server.py", "old_string": "old code", "new_string": "new code"}'
+  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_dir","arguments":{"path":"."}}}'
 
-# grep
-curl -b "session=<token>" \
-  "http://localhost:4825/tools/grep?pattern=def%20main&glob=*.py"
+# REST sibling (same dispatch)
+curl -s -b "session_token=<token>" -X POST http://localhost:4825/mcp/call \
+  -H "Content-Type: application/json" \
+  -d '{"action":"list_dir","args":{"path":"."}}'
 
-# run_command
-curl -b "session=<token>" -X POST \
-  http://localhost:4825/tools/run_command \
+# Full write/exec surface (not on MCP)
+curl -s -b "session_token=<token>" -X POST http://localhost:4825/tools/edit_file \
   -H "Content-Type: application/json" \
-  -d '{"command": "rg TODO ."}'
+  -d '{"path": "server.py", "old_string": "old code", "new_string": "new code"}'
 ```
 
-`run_command`는 `pwd`, `ls`, `find`, `cat`, `head`, `tail`, `wc`, `rg`만 허용합니다.
-Python/Node/npm/npx/sed, shell operator, 실행 파일 경로, 절대 경로, `..` traversal,
-workspace 밖 symlink, `rg --pre`, `find -exec/-delete`는 거부됩니다. 빌드와 테스트는
-별도의 허용된 project-script 도구를 사용합니다.
+`run_command` remains a REST-only admin tool. It allows `pwd`, `ls`, `find`,
+`cat`, `head`, `tail`, `wc`, `rg` only. Python/Node/npm/npx/sed, shell
+operators, executable paths, absolute paths, `..` traversal, workspace-outside
+symlinks, `rg --pre`, and `find -exec/-delete` are refused.
 
 ## 도구 카탈로그 조회
 
 ```bash
-curl -b "session=<token>" http://localhost:4825/mcp/tools
+curl -b "session_token=<token>" http://localhost:4825/mcp/tools
 ```
 
-응답:
-```json
-{
-  "tools": [
-    {
-      "name": "edit_file",
-      "description": "정밀 diff 편집. old_string이 파일에 유일해야만 성공.",
-      "risk": "medium",
-      "parameters": { ... }
-    },
-    ...
-  ]
-}
-```
+`GET /mcp/tools` lists Lattice's native tool catalog (names, descriptions,
+governance). `tools/list` on `POST /mcp` is the MCP-shaped list with JSON
+Schemas for the curated subset plus skills.
+
+`POST /mcp/install` enables a skill or plugin Lattice can actually flip in
+the workspace registry. Remote npm/pip/connector entries return
+`{"status":"manual_required", ...}` instead of a blank 404.
 
-도구 카탈로그는 인증이 필요하며 서버의 절대 `AGENT_ROOT`를 반환하지 않습니다.
-MCP/plugin dispatch도 각 도구의 사용자·workspace·capability·승인 정책을 우회할
-수 없습니다. knowledge/Obsidian 계열 읽기는 명시적 사용자 동의와 scope를
-사용합니다.
+The catalogs require authentication and do not return the absolute
+`AGENT_ROOT`. MCP/plugin dispatch cannot bypass user, workspace, capability,
+or approval policy. Knowledge-garden reads use explicit user/workspace scope.

package/docs/security-model.md

@@ -88,9 +88,12 @@ MAGIC_NUMBERS = {
 
 ## 수집 & 그래프 포터빌리티 보안 (v3.6.0)
 
-- **수집 라이프사이클**: 모든 수집은 `IngestionPipeline.ingest` → `dispatch_tool`
-  를 거쳐 `pre_tool`/`post_tool` 훅이 발화됩니다. `pre_tool`이 차단하면 수집은
-  정직하게 `status="blocked"`로 거부됩니다(권한 게이트·민감정보 가드 적용).
+- **수집 라이프사이클**: 모든 수집은 네이티브 ingest 문(`lattice-ingest` →
+  `lattice_core::graph_write`) → 도구 디스패치를 거쳐 `pre_tool`/`post_tool`
+  훅이 발화됩니다. `pre_tool`이 차단하면 수집은 정직하게 `status="blocked"`로
+  거부됩니다(권한 게이트·민감정보 가드 적용). v3.6.0에 이 계약을 세운 것은
+  Python `IngestionPipeline.ingest`였고, v11.6.0이 문을 Rust로 옮기면서 계약은
+  그대로 유지했습니다.
 - **웹 URL 읽기**(`/api/browser/read-url`): `http(s)`만 허용하고 DNS의 모든 결과에서
   loopback/private/link-local/multicast/reserved 주소를 거부합니다. 검증한 IP에 연결을
   고정해 DNS rebinding을 막고, redirect마다 재검증하며 환경 proxy를 사용하지

package/lattice_brain/__init__.py

@@ -31,7 +31,7 @@ from .multimodal import (
     transcribe_audio,
 )
 
-__version__ = "11.7.0"
+__version__ = "11.9.0"
 
 __all__ = [
     "AudioFacts",

package/lattice_brain/graph/_kg_common/__init__.py

@@ -119,35 +119,7 @@ from .relations import (  # noqa: E402
     _infer_edge,
     infer_edge_relation,
 )
-from .text import (  # noqa: E402
-    _CHUNK_STRATEGIES,
-    _CODE_BLANK_RUN_RE,
-    _CODE_BOUNDARY_LINE_RE,
-    _CODE_CHUNK_EXTENSIONS,
-    _MARKDOWN_CHUNK_EXTENSIONS,
-    _MARKDOWN_HEADING_RE,
-    _MARKDOWN_MIN_SECTION_CHARS,
-    _PROSE_CHUNK_EXTENSIONS,
-    _PROSE_MIN_SPAN_RATIO,
-    _PROSE_STRONG_BOUNDARY_RE,
-    _PROSE_WEAK_BOUNDARY_RE,
-    _chunks,
-    _clean_text,
-    _code_chunks,
-    _code_segment_spans,
-    _last_boundary,
-    _markdown_chunks,
-    _markdown_section_spans,
-    _merge_small_sections,
-    _plain_windows,
-    _prose_chunks,
-    chunk_strategy_for,
-    citation_locator,
-    page_for_offset,
-    pdf_page_offsets,
-    typed_chunk_meta_fields,
-    typed_chunks,
-)
+from .text import _chunks, _clean_text  # noqa: E402
 
 # Static export list. This used to be `[name for name in globals() if not
 # name.startswith("__")]`, which is invisible to a type checker: every
@@ -187,30 +159,17 @@ __all__ = [
     "Tuple",
     "VERB_EDGE_WEIGHT",
     "WINDOWS_EXCLUDED_NAMES",
-    "_CHUNK_STRATEGIES",
-    "_CODE_BLANK_RUN_RE",
-    "_CODE_BOUNDARY_LINE_RE",
-    "_CODE_CHUNK_EXTENSIONS",
     "_CONCEPT_STOP",
     "_KG_DB_FORMAT_KEY",
     "_KG_DB_FORMAT_VERSION",
     "_LLM_EXTRACT_CONCEPT_PROMPT",
     "_LLM_EXTRACT_TRIPLE_PROMPT",
-    "_MARKDOWN_CHUNK_EXTENSIONS",
-    "_MARKDOWN_HEADING_RE",
-    "_MARKDOWN_MIN_SECTION_CHARS",
     "_NOT_PERSON_WORDS",
     "_PROJECTION_VERSION",
-    "_PROSE_CHUNK_EXTENSIONS",
-    "_PROSE_MIN_SPAN_RATIO",
-    "_PROSE_STRONG_BOUNDARY_RE",
-    "_PROSE_WEAK_BOUNDARY_RE",
     "_V2_WRITE_MASTER_KEY",
     "_chunks",
     "_classify_node_type",
     "_clean_text",
-    "_code_chunks",
-    "_code_segment_spans",
     "_current_os_type",
     "_drive_id_for_path",
     "_excluded_directory_reason",
@@ -223,20 +182,14 @@ __all__ = [
     "_is_hidden_path",
     "_is_relative_to",
     "_json",
-    "_last_boundary",
     "_llm_extract_concepts",
     "_llm_extract_triples",
-    "_markdown_chunks",
-    "_markdown_section_spans",
-    "_merge_small_sections",
     "_node_type_for_category",
     "_now",
     "_parse_iso",
     "_parser_type_for_category",
     "_path_fingerprint",
     "_path_parts_lower",
-    "_plain_windows",
-    "_prose_chunks",
     "_recency_score",
     "_root_warning",
     "_safe_iso_from_stat_mtime",
@@ -250,8 +203,6 @@ __all__ = [
     "_slug",
     "_topic_candidates",
     "asyncio",
-    "chunk_strategy_for",
-    "citation_locator",
     "contextmanager",
     "datetime",
     "get_llm_router",
@@ -261,8 +212,6 @@ __all__ = [
     "logging",
     "math",
     "os",
-    "page_for_offset",
-    "pdf_page_offsets",
     "platform",
     "quiet",
     "re",
@@ -270,7 +219,5 @@ __all__ = [
     "shutil",
     "sqlite3",
     "time",
-    "typed_chunk_meta_fields",
-    "typed_chunks",
     "zipfile",
 ]