ltcai 11.7.0 → 11.9.0

package/latticeai/api/models.py

@@ -2,15 +2,24 @@
 
 Extracted from ``server_app.py`` in v1.3.0 with the whole ``/models*`` +
 ``/engines*`` + ``/setup/set-api-key`` surface. v11.6.0 kept the eight routes
-that are *this interpreter's* business — loading, switching and unloading MLX
-models, and the resolve → download-if-consented → load → smoke prepare flow —
-and moved the rest to ``lattice-host``: engine installation and cloud-key
-verification are host operations, ``/setup/set-api-key`` is account state, and
-the two catalogue reads (``/models/compat-profiles``, ``/models/recommendations``)
-are product views.
+that are *this interpreter's* business and moved the rest to ``lattice-host``:
+engine installation and cloud-key verification are host operations,
+``/setup/set-api-key`` is account state, and the two catalogue reads
+(``/models/compat-profiles``, ``/models/recommendations``) are product views.
 
-The download itself stays because it is ``huggingface_hub`` / ``ollama``
-running here (v11.6.0 gateway integration §4a).
+v11.8.0 took three of those eight away, because nothing called them — not the
+Rust surface, not the SPA client, not either extension:
+
+* ``POST /engines/pull-model`` — every caller reaches a download through
+  ``/engines/prepare-model``, which resolves, downloads on consent, loads and
+  smoke-tests in one step. The bare pull was the older door, and with it went
+  this module's only use of ``huggingface_hub`` / ``ollama`` (both still run
+  here, under ``services/model_loading.py``, for the prepare flow).
+* ``POST /models/switch/{model_id:path}`` — ``/models/load`` is what every
+  surface sends, and it switches as part of loading.
+* ``DELETE /models/unload-all`` — unloading is per-model everywhere.
+
+What is left is list, load, unload-one and the two prepare flows.
 
 Mirrors the established router-factory convention: the heavy provider/runtime
 helpers are injected as bound service callables. This module owns the sole
@@ -21,14 +30,13 @@ from __future__ import annotations
 
 import asyncio
 import logging
-import subprocess
 from typing import Any, Callable, Dict, List, NoReturn, Optional
 
 from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import StreamingResponse
 from pydantic import BaseModel
 
-from latticeai.core.messages import http_error, resolve_language, translate
+from latticeai.core.messages import http_error, resolve_language
 from latticeai.services.model_errors import ModelRuntimeError
 
 
@@ -76,11 +84,6 @@ class LoadModelRequest(BaseModel):
 
 
 
-class PullModelRequest(BaseModel):
-    model: str
-    allow_download: bool = False
-
-
 class PrepareModelRequest(BaseModel):
     model: str
     engine: Optional[str] = None
@@ -94,13 +97,9 @@ def create_models_router(
     model_router: Any,
     require_user: Callable[[Request], str],
     require_admin: Callable[[Request], tuple],
-    normalize_local_model_request: Callable[..., str],
-    download_hf_model: Callable[..., Dict],
     prepare_and_load_model: Callable[..., Any],
     prepare_and_load_model_stream: Callable[..., Any],
     sse_event: Callable[[str, Dict], str],
-    ensure_ollama_server: Callable[[], None],
-    local_binary: Callable[[str], Optional[str]],
     engine_status: Callable[[], List[Dict]],
     filter_lower_family_versions: Callable[[List[Dict]], List[Dict]],
     list_compat_profiles: Callable[[], Any],
@@ -289,80 +288,6 @@ def create_models_router(
 
     # ── Engines ───────────────────────────────────────────────────────────
 
-
-    @router.post("/engines/pull-model")
-    async def pull_ollama_model(req: PullModelRequest, request: Request):
-        _authorize_model_admin(request)
-        if not req.allow_download:
-            raise HTTPException(
-                status_code=403,
-                detail=translate("models.download_consent_required", resolve_language(request)),
-            )
-        model_ref = normalize_local_model_request(req.model, None)
-        if not model_ref:
-            raise http_error(400, "models.identifier_empty", resolve_language(request))
-
-        if ":" in model_ref and model_ref.split(":", 1)[0].strip().lower() in {"ollama", "vllm", "lmstudio", "llamacpp", "local_mlx", "mlx"}:
-            provider, model_name = model_ref.split(":", 1)
-            provider = provider.strip().lower()
-            model_name = model_name.strip()
-        else:
-            provider, model_name = "local_mlx", model_ref
-
-        if not model_name:
-            raise http_error(400, "models.name_empty", resolve_language(request))
-
-        if provider == "ollama":
-            try:
-                # Starts the daemon and waits for it — blocking, like the pull
-                # below, and for the same reason it may not run on the loop.
-                await asyncio.to_thread(ensure_ollama_server)
-            except ModelRuntimeError as exc:
-                _raise_model_http(exc)
-            ollama = local_binary("ollama")
-            if not ollama:
-                raise http_error(400, "models.ollama_missing", resolve_language(request))
-            try:
-                # A model pull is minutes of network I/O. Held on the event loop
-                # it stalled every other request — including the health check the
-                # UI uses to decide the server is alive — until the pull finished.
-                completed = await asyncio.to_thread(
-                    lambda: subprocess.run(
-                        [ollama, "pull", model_name],
-                        capture_output=True, text=True, timeout=900, check=False,
-                    )
-                )
-            except subprocess.TimeoutExpired:
-                raise http_error(408, "models.download_timeout", resolve_language(request))
-            if completed.returncode != 0:
-                raise HTTPException(
-                    status_code=500,
-                    detail=completed.stderr[-2000:]
-                    or translate("models.pull_failed", resolve_language(request)),
-                )
-            return {"provider": provider, "model": model_name, "returncode": completed.returncode}
-
-        if provider == "lmstudio":
-            raise HTTPException(
-                status_code=400,
-                detail=(
-                    "LM Studio 모델은 Lattice에서 Hugging Face로 pull하지 않습니다. "
-                    "LM Studio 앱에서 모델을 다운로드하고 Local Server를 켠 뒤 모델을 로드하세요. "
-                    "그러면 모델 선택창에 실제 /v1/models 항목이 표시됩니다."
-                ),
-            )
-
-        if provider in {"vllm", "llamacpp", "local_mlx", "mlx"}:
-            download_provider = "local_mlx" if provider == "mlx" else provider
-            try:
-                # Multi-gigabyte Hugging Face download; same rule as the pull above.
-                result = await asyncio.to_thread(download_hf_model, model_name, download_provider)
-            except ModelRuntimeError as exc:
-                _raise_model_http(exc)
-            return {"provider": provider, "model": model_name, "returncode": 0, **result}
-
-        raise http_error(400, "models.download_not_automated", resolve_language(request), provider=provider)  # pragma: no cover — every prefix the check above accepts is handled, and the fallback is local_mlx
-
     @router.post("/engines/prepare-model")
     async def engines_prepare_model(req: PrepareModelRequest, request: Request):
         current_user = _authorize_model_admin(request, req.user_email)
@@ -484,27 +409,10 @@ def create_models_router(
                 detail=friendly_model_runtime_error(e, model_id=req.model_id, engine=req.engine),
             )
 
-    @router.post("/models/switch/{model_id:path}")
-    async def switch_model(model_id: str, request: Request):
-        _authorize_model_admin(request)
-        try:
-            _router.switch_model(model_id)
-            return {"status": "ok", "current": _router.current_model_id}
-        except KeyError:
-            raise http_error(404, "chat.model_not_loaded", resolve_language(request), model=model_id)
-
     @router.delete("/models/unload/{model_id:path}")
     async def unload_model(model_id: str, request: Request):
         _authorize_model_admin(request)
         _router.unload_model(model_id)
         return {"status": "ok", "unloaded": model_id}
 
-    @router.delete("/models/unload-all")
-    async def unload_all_models(request: Request):
-        _authorize_model_admin(request)
-        unloaded = _router.loaded_model_ids
-        _router.unload_all()
-        return {"status": "ok", "unloaded": unloaded}
-
-
     return router

package/latticeai/api/search.py

@@ -10,6 +10,11 @@ it is the one that was asked for.
 ``GET /api/embeddings/status`` therefore reports the **embedder**, not the
 index. Index completeness is a native jobs route now, and reporting it from
 here would have meant re-opening a store the worker no longer holds.
+
+It is now the module's only route. ``GET /api/embeddings/providers`` — the
+static catalogue of provider ids and the env vars each needs — was removed in
+v11.8.0: no surface in the tree asked for it, and a catalogue nothing reads is
+a second place for the provider list to go stale.
 """
 
 from __future__ import annotations
@@ -18,7 +23,6 @@ from typing import Any, Callable, Dict, NoReturn, Optional
 
 from fastapi import APIRouter, HTTPException, Request
 
-from latticeai.core.embedding_providers import embedding_provider_profiles
 from latticeai.services.search_service import SearchService
 
 
@@ -31,8 +35,8 @@ def create_search_router(
     router = APIRouter()
 
     def _raise_embedder_error(exc: Exception) -> NoReturn:
-        # NoReturn, not None: both handlers end with this in their except
-        # branch, and without it each one reads as a missing return.
+        # NoReturn, not None: the handler ends with this in its except branch,
+        # and without it the function reads as a missing return.
         raise HTTPException(status_code=404, detail=str(exc)) from exc
 
     @router.get("/api/embeddings/status")
@@ -44,31 +48,4 @@ def create_search_router(
         except ValueError as exc:
             _raise_embedder_error(exc)
 
-    @router.get("/api/embeddings/providers")
-    async def embeddings_providers(request: Request) -> Dict[str, Any]:
-        require_user(request)
-        resolved = embedding_info() if embedding_info else {}
-        profiles = resolved.get("profiles") or embedding_provider_profiles()
-        return {
-            "active": resolved.get("active_provider"),
-            "requested": resolved.get("requested_provider"),
-            "profile": resolved.get("profile") or "",
-            "profiles": profiles,
-            "providers": [
-                {"id": "hash", "label": "Local hash (fallback)", "grade": "fallback",
-                 "requires": [], "detail": "Deterministic offline vectors — always available."},
-                {"id": "mlx", "label": "MLX (Apple Silicon)", "grade": "production",
-                 "requires": ["LATTICEAI_EMBEDDING_MODEL"], "detail": "Local embedding model via MLX."},
-                {"id": "ollama", "label": "Ollama", "grade": "production",
-                 "requires": ["LATTICEAI_EMBEDDING_MODEL", "LATTICEAI_EMBEDDING_BASE_URL"],
-                 "detail": "Local/remote Ollama embedding server."},
-                {"id": "openai", "label": "OpenAI-compatible", "grade": "production",
-                 "requires": ["LATTICEAI_EMBEDDING_MODEL", "LATTICEAI_EMBEDDING_BASE_URL", "LATTICEAI_EMBEDDING_API_KEY"],
-                 "detail": "Any /v1/embeddings endpoint (OpenAI, LM Studio, vLLM, …)."},
-                {"id": "custom", "label": "Custom callable", "grade": "production",
-                 "requires": ["LATTICEAI_EMBEDDING_CUSTOM_TARGET"],
-                 "detail": "User-supplied module:callable returning vectors."},
-            ],
-        }
-
     return router

package/latticeai/api/worker_compute.py

@@ -3,8 +3,14 @@
 Plan §설계 결정 2 (revised) hands **every write** to Rust — platform state and
 the knowledge graph both. What is left for Python is the part Rust cannot do
 without shipping a model runtime and half of PyPI: turning text into vectors,
-turning a document into text, turning a spec into document bytes, turning audio
-into a transcript, and turning a picture into facts about it.
+turning a document into text, turning a spec into document bytes, and turning
+audio into a transcript.
+
+A ninth seam, ``POST /worker/multimodal/describe``, was here until v11.8.0. It
+wrapped :func:`lattice_brain.multimodal.extract_image_facts` for a native image
+ingest that was never built, so nothing in the tree ever called it — not
+``lattice-ingest``, not the gateway. The Brain Core functions behind it are
+untouched; what went is the door nobody opened.
 
 ``worker_seams.py`` holds the *state* seams (``/worker/chat/record-turn``,
 ``/worker/graph/mutate``) that Wave 2 codes against and Wave 2.5 §W3 retires.
@@ -13,7 +19,7 @@ here opens a database, writes a file, or reaches a store. Each handler is a
 function of its request body, so a caller can retry it, cache it, or run two of
 them at once without asking who else is writing.
 
-The five seams, and what each was extracted from:
+The eight seams, and what each was extracted from:
 
 ``POST /worker/embed``
     ``EmbeddingProvider.embed_batch`` on the *resolved* provider — the same
@@ -30,22 +36,15 @@ The five seams, and what each was extracted from:
 
 ``POST /worker/render/{docx,xlsx,pptx,pdf}``
     The *building* half of ``tools.documents.create_*`` — same libraries, same
-    layout decisions, same filename sanitising — with ``save(path)`` replaced by
-    ``save(BytesIO)``. Rust places the file; this seam never learns where.
+    layout decisions — with ``save(path)`` replaced by ``save(BytesIO)``. Rust
+    places the file, sanitises the name and resolves the target; this seam
+    never learns where and answers with bytes only.
 
 ``POST /worker/asr``
     ``VoiceCaptureService._transcribe``'s contract without the ingest: the same
     injected transcriber port, the same container whitelist and size ceiling,
     and the same refusal to call an empty transcript "text".
 
-``POST /worker/multimodal/describe``
-    :func:`lattice_brain.multimodal.extract_image_facts` plus
-    :func:`~lattice_brain.multimodal.image_quality_score` — exactly what
-    ``IngestionRoutingMixin._ingest_image`` computes before it writes a node.
-    The describe step *is* separable here because Brain Core already split it:
-    observing an image and writing it are two functions, and only the first one
-    is compute.
-
 ``POST /worker/extract``
     :func:`~lattice_brain.graph._kg_common.extraction._extract_concepts` (LLM-first),
     :func:`~lattice_brain.graph._kg_common.extraction._extract_triples` and
@@ -67,8 +66,10 @@ import asyncio
 import base64
 import binascii
 import contextlib
+import importlib.util
 import io
 import logging
+import sys
 import tempfile
 from pathlib import Path
 from typing import Any, Callable, Dict, Iterator, List, Optional, Tuple
@@ -85,7 +86,7 @@ from latticeai.services.voice_capture import (
     SUPPORTED_AUDIO_EXTENSIONS,
 )
 from latticeai.tools import _CJK_FONT_CANDIDATES, ToolError
-from latticeai.tools.documents import _body_to_str, _safe_filename, read_document
+from latticeai.tools.documents import _body_to_str, read_document
 
 logger = logging.getLogger(__name__)
 
@@ -107,16 +108,6 @@ EXTRACT_LIMITS: Dict[str, int] = {"message": 12, "document": 15}
 #: write-side module would tie this compute seam to a module W1 is replacing.
 PASSAGE_MAX_CHARS = 50_000
 
-#: Render kind → the suffix ``_safe_filename`` enforces. Same table as
-#: ``documents._DOCUMENT_TOOL_TARGETS``, minus the output directory: where the
-#: file lands is Rust's decision now, so this seam does not carry it.
-RENDER_SUFFIXES: Dict[str, str] = {
-    "docx": ".docx",
-    "xlsx": ".xlsx",
-    "pptx": ".pptx",
-    "pdf": ".pdf",
-}
-
 #: The CJK-capable fonts ``create_pdf`` looks for, as a module attribute so a
 #: test can point the probe at a font that exists (and at one that does not)
 #: instead of asserting whatever the host machine happens to have installed.
@@ -166,6 +157,29 @@ WORKER_COMPUTE_MESSAGES: Dict[str, Dict[str, str]] = {
 }
 
 
+def pointer_tools_available() -> bool:
+    """Whether this interpreter can import ``pyautogui``.
+
+    Cheap and side-effect free: ``find_spec`` does not load the module, so a
+    headless worker without a display is not punished for answering the
+    question. The platform computer-use status route reads this through
+    ``GET /worker/sysinfo`` rather than guessing from its own process.
+    """
+    return importlib.util.find_spec("pyautogui") is not None
+
+
+def sysinfo_payload_extras() -> Dict[str, Any]:
+    """Additive fields for ``GET /worker/sysinfo``.
+
+    Existing GPU keys stay owned by ``worker_seams.probe_gpu_memory``. This
+    dict is merged in; it must never reuse those names.
+    """
+    return {
+        "capabilities": {"pointer_tools": pointer_tools_available()},
+        "python_version": "{}.{}.{}".format(*sys.version_info[:3]),
+    }
+
+
 def register_worker_compute_messages() -> None:
     """Publish this module's messages into the one shared catalog."""
     for key, entry in WORKER_COMPUTE_MESSAGES.items():
@@ -415,16 +429,6 @@ class AsrRequest(BaseModel):
     filename: Optional[str] = None
 
 
-class DescribeRequest(BaseModel):
-    """One picture, with the two observation switches ``extract_image_facts`` takes."""
-
-    content_b64: str
-    mime: Optional[str] = None
-    filename: Optional[str] = None
-    ocr: bool = True
-    thumbnail: bool = True
-
-
 class ExtractRequest(BaseModel):
     """The text one ingest door would hand ``_extract_concepts``."""
 
@@ -484,18 +488,16 @@ def create_worker_compute_router(
     *,
     embedder: Any,
     transcriber: Optional[Callable[[str], str]] = None,
-    multimodal_ports: Any = None,
     require_user: Callable[[Request], Any],
     enforce_rate_limit: Callable[[str, str], None],
 ) -> APIRouter:
-    """The nine compute seams, wired to what this worker actually resolved.
+    """The eight compute seams, wired to what this worker actually resolved.
 
     ``embedder`` is the :class:`~latticeai.core.embedding_providers.text.ResolvedEmbedder`
     ``phase_brain`` built (``None`` ⇒ 503, because a worker with no embedder is
-    a configuration rather than a crash). ``transcriber`` and
-    ``multimodal_ports`` are the same injected ports the voice and ingestion
-    paths hold; absent, the relevant seam reports the absence instead of
-    inventing a transcript or a caption.
+    a configuration rather than a crash). ``transcriber`` is the injected port
+    the voice path holds; absent, ``/worker/asr`` reports the absence instead of
+    inventing a transcript.
     """
     router = APIRouter()
 
@@ -522,11 +524,18 @@ def create_worker_compute_router(
     async def _render(
         kind: str,
         builder: Callable[[], bytes],
-        filename: str,
         language: str,
         **extra: Any,
     ) -> Dict[str, Any]:
-        """Build one document off the event loop and hand back its bytes."""
+        """Build one document off the event loop and hand back its bytes.
+
+        The reply is the bytes and what they cost, and nothing about *where*
+        they go: ``lattice-agent``'s ``documents::document_output_target`` runs
+        its own ``safe_filename`` and ``Workspace::resolve`` over the request's
+        ``filename`` **before** it calls here, and writes to the target it
+        resolved. A second sanitisation on this side produced a name no caller
+        ever read — two spellings of one rule, one of them invisible.
+        """
         try:
             payload = await asyncio.to_thread(builder)
         except ToolError as exc:
@@ -541,7 +550,6 @@ def create_worker_compute_router(
                 500, "worker_compute.render_failed", language, kind=kind, reason=str(exc)
             ) from exc
         return {
-            "filename": _safe_filename(filename, RENDER_SUFFIXES[kind]),
             "content_b64": base64.b64encode(payload).decode("ascii"),
             "bytes": len(payload),
             **extra,
@@ -616,7 +624,6 @@ def create_worker_compute_router(
         return await _render(
             "docx",
             lambda: build_docx_bytes(req.title, req.body),
-            req.filename,
             resolve_language(request),
         )
 
@@ -628,7 +635,6 @@ def create_worker_compute_router(
         return await _render(
             "xlsx",
             lambda: build_xlsx_bytes(req.rows, req.sheet_name),
-            req.filename,
             resolve_language(request),
             rows=len(req.rows),
         )
@@ -641,7 +647,6 @@ def create_worker_compute_router(
         return await _render(
             "pptx",
             lambda: build_pptx_bytes(req.title, req.slides),
-            req.filename,
             resolve_language(request),
             slides=len(req.slides) + 1,
         )
@@ -654,7 +659,6 @@ def create_worker_compute_router(
         return await _render(
             "pdf",
             lambda: build_pdf_bytes(req.title, req.body),
-            req.filename,
             resolve_language(request),
         )
 
@@ -731,64 +735,6 @@ def create_worker_compute_router(
             "detail": "",
         }
 
-    @router.post("/worker/multimodal/describe")
-    async def worker_multimodal_describe(req: DescribeRequest, request: Request):
-        """Everything ``_ingest_image`` knows before it writes a node.
-
-        ``metadata`` is ``ImageFacts.as_metadata()`` — the exact dict
-        ``write_image_memory`` merges onto the node — and ``index_text`` is the
-        exact text it chunks. ``embedding`` is present only when a vision model
-        produced one, which is the one property an image vector must have.
-        """
-        _require_seam(request)
-        _admit(request)
-        language = resolve_language(request)
-        data = _decode(req.content_b64, language)
-        suffix = _suffix_for(req.filename, req.mime, ".png")
-
-        from lattice_brain.ingestion import _quality_level
-        from lattice_brain.multimodal import (
-            MODALITY_IMAGE,
-            MultimodalPorts,
-            extract_image_facts,
-            image_quality_score,
-        )
-
-        ports = multimodal_ports or MultimodalPorts()
-        with _temp_payload(data, suffix) as tmp_path:
-            facts = await asyncio.to_thread(
-                lambda: extract_image_facts(
-                    tmp_path, ports=ports, ocr=req.ocr, thumbnail=req.thumbnail
-                )
-            )
-        quality = image_quality_score(facts)
-        return {
-            "modality": MODALITY_IMAGE,
-            "readable": facts.readable,
-            "error": facts.error,
-            "width": facts.width,
-            "height": facts.height,
-            "format": facts.image_format,
-            "mode": facts.mode,
-            "ocr_status": facts.ocr_status,
-            "ocr_text": facts.ocr_text,
-            "ocr_detail": facts.ocr_detail,
-            "caption_status": facts.caption_status,
-            "caption": facts.caption,
-            "embedding_status": facts.embedding_status,
-            "embedding": facts.embedding,
-            "embedding_detail": facts.embedding_detail,
-            "thumbnail": facts.thumbnail,
-            "index_text": facts.index_text(),
-            "metadata": facts.as_metadata(),
-            "quality": {
-                "score": quality["score"],
-                "level": _quality_level(quality["score"]),
-                "reasons": quality["reasons"],
-            },
-            "ports": ports.describe(),
-        }
-
     @router.post("/worker/extract")
     async def worker_extract(req: ExtractRequest, request: Request):
         """Concepts, triples and Task/Decision items for this text.
@@ -821,10 +767,8 @@ __all__ = [
     "EXTRACT_KINDS",
     "EXTRACT_LIMITS",
     "PASSAGE_MAX_CHARS",
-    "RENDER_SUFFIXES",
     "WORKER_COMPUTE_MESSAGES",
     "AsrRequest",
-    "DescribeRequest",
     "EmbedRequest",
     "ExtractRequest",
     "ParseRequest",
@@ -838,5 +782,7 @@ __all__ = [
     "build_pptx_bytes",
     "build_xlsx_bytes",
     "create_worker_compute_router",
+    "pointer_tools_available",
     "register_worker_compute_messages",
+    "sysinfo_payload_extras",
 ]

package/latticeai/api/worker_seams.py

@@ -85,21 +85,36 @@ def probe_gpu_memory() -> Dict[str, Any]:
         total = _total_memory_bytes()
     except Exception as exc:  # noqa: BLE001 — an absent GPU is not a failure
         quiet("MLX unified-memory probe")
-        return {
+        payload = {
             "mlx_available": False,
             "gpu_mem_gb": 0.0,
             "gpu_mem_pct": 0.0,
             "total_bytes": 0,
             "detail": str(exc),
         }
+        payload.update(_sysinfo_extras())
+        return payload
     used = active + cached
-    return {
+    payload = {
         "mlx_available": True,
         "gpu_mem_gb": round(used / (1024 ** 3), 2),
         "gpu_mem_pct": round(used / total * 100, 1) if total else 0.0,
         "total_bytes": total,
         "detail": None,
     }
+    payload.update(_sysinfo_extras())
+    return payload
+
+
+def _sysinfo_extras() -> Dict[str, Any]:
+    """Additive capability / interpreter facts. Fail closed to empty extras."""
+    try:
+        from latticeai.api.worker_compute import sysinfo_payload_extras
+
+        extras = sysinfo_payload_extras()
+    except Exception:  # noqa: BLE001 — a missing extra must not hide the GPU reading
+        return {}
+    return extras if isinstance(extras, dict) else {}
 
 
 # ── request bodies ──────────────────────────────────────────────────────────

package/latticeai/core/http_origin.py

@@ -18,9 +18,9 @@ Threat model, so the rule is checkable rather than felt:
   :mod:`latticeai.core.csrf` already trusts it.  Honouring a forwarded host from
   the same caller widens nothing that was not already open.
 * **Anyone else is not trusted.**  Off-loopback the header is honoured only from
-  a peer the operator listed in ``LATTICEAI_TRUSTED_PROXIES`` — the same
-  allowlist ``latticeai.core.security.client_ip`` uses for the same reason, and
-  empty by default.
+  a peer the operator listed in ``LATTICEAI_TRUSTED_PROXIES`` — the allowlist
+  ``latticeai.core.security.configure_trusted_proxies`` holds, mirrored by
+  ``lattice-auth`` at the front door for the same reason, and empty by default.
 
 The functions are pure: the caller supplies the headers and the peer address, so
 the policy is testable without an ASGI app or a socket.

package/latticeai/core/messages.py

@@ -181,11 +181,6 @@ MESSAGES: Dict[str, Dict[str, str]] = {
 }
 
 
-def bilingual(ko: str, en: str) -> Dict[str, str]:
-    """One Korean/English phrase pair, in the shape every caller renders."""
-    return {"ko": ko, "en": en}
-
-
 def resolve_language(request: Any, default: str = DEFAULT_LANGUAGE) -> str:
     """Language for this request: the product's choice, then the browser's.
 

package/latticeai/core/policy.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from typing import Dict, Iterable, List, Set
+from typing import Dict, List, Set
 
 ROLE_CAPABILITIES: Dict[str, Set[str]] = {
     "owner": {"all"},
@@ -46,8 +46,3 @@ def role_has_capability(role: str, capability: str) -> bool:
 def require_capability(role: str, capability: str) -> None:
     if not role_has_capability(role, capability):
         raise PermissionError(f"role '{normalize_role(role)}' lacks capability '{capability}'")
-
-
-def policy_matrix(roles: Iterable[str] | None = None) -> List[Dict[str, object]]:
-    selected = list(roles or ROLE_CAPABILITIES.keys())
-    return [{"role": normalize_role(role), "caps": capabilities_for_role(role)} for role in selected]

package/latticeai/core/quiet.py

@@ -25,7 +25,6 @@ from __future__ import annotations
 
 import logging
 import sys
-import traceback
 from typing import Optional
 
 logger = logging.getLogger("latticeai.suppressed")
@@ -63,22 +62,4 @@ def quiet(reason: Optional[str] = None, *, level: int = logging.DEBUG) -> None:
         )
 
 
-def quiet_summary(reason: Optional[str] = None) -> str:
-    """One-line description of the live exception, for callers that report it."""
-    exc_type, exc, _ = sys.exc_info()
-    if exc is None:
-        return ""
-    name = getattr(exc_type, "__name__", "Exception")
-    text = str(exc).strip() or name
-    return f"{reason}: {text}" if reason else text
-
-
-def format_suppressed() -> str:
-    """Full traceback of the live exception as text (for diagnostics payloads)."""
-    exc_type, exc, tb = sys.exc_info()
-    if exc is None:
-        return ""
-    return "".join(traceback.format_exception(exc_type, exc, tb))
-
-
-__all__ = ["quiet", "quiet_summary", "format_suppressed"]
+__all__ = ["quiet"]