ltcai 11.7.0 → 12.0.0

package/docs/ROADMAP.md

@@ -0,0 +1,113 @@
+# Lattice AI gap roadmap
+
+> **Status: reference** — point-in-time inventory, redated at v12.0.0. Not a
+> canonical current-release document; version gates do not bind it.
+
+As of **2026-08-18**, against the 12.0.0 — Open House tree. The rows below
+were gathered against 11.9.0 and re-checked when 12.0.0 shipped; what that
+release closed is marked closed rather than deleted, so the ledger still
+shows what was owed.
+
+The owner's v12.0.0 priority was complexity management. The crate maps that
+landed with that work are
+[`rust/lattice-agent/ARCHITECTURE.md`](../rust/lattice-agent/ARCHITECTURE.md)
+and
+[`rust/lattice-platform/ARCHITECTURE.md`](../rust/lattice-platform/ARCHITECTURE.md);
+the contributor path is [DEVELOPMENT.md](DEVELOPMENT.md). This page is the
+honest leftover list, gathered from
+[FEATURE_STATUS.md](../FEATURE_STATUS.md) Known Limitations and the §정직한
+고지 sections of
+[RELEASE_NOTES_v11.9.0.md](../RELEASE_NOTES_v11.9.0.md) and
+[RELEASE_NOTES_v12.0.0.md](../RELEASE_NOTES_v12.0.0.md).
+
+Four items those ledgers named **closed in 12.0.0**. They are kept below so
+they are not re-opened as work. Everything else is still open.
+
+Difficulty: **S** one focused change · **M** a vertical slice · **L** a
+program (credentials, a model harness, or an index format).
+
+## Closed in 12.0.0 — do not treat as open
+
+| 무엇 | 어떻게 닫혔나 | 11.9.0 장부에 적혀 있던 말 |
+| --- | --- | --- |
+| Restore-then-read in a long-lived process | **Closed.** The store carries a generation epoch: a restore bumps it, connections opened under the old generation are stale at their next checkout, and the next read sees restored bytes. No restart. | 복원 뒤 커넥션이 재활용되기 전까지 복원 전 바이트를 줄 수 있다. |
+| brew / pip setup items | **Closed, without turning into automation.** `/setup/install` runs brew/pip/uv for an item the request names *and* the server-derived allowlist contains; anything else is refused by name, and the default path is still manual. | 설계상 수동. |
+| `POST /mcp` outside the OpenAPI product contract | **Closed.** Declared in the mount table as one JSON-RPC envelope operation, so it generates into the spec; natively mounted, so it is never proxied to the worker. | 계약 밖은 설계. |
+| Pointer tools undeclared | **Closed.** `pip install "ltcai[pointer]"` is a named extra. A stock install still answers `pointer_tools=false` — the gap was the undeclared capability, not the default. | 재고 설치에서는 unavailable. |
+
+Two more moved a long way without closing, and their rows below say so
+rather than being deleted: the small-model harness (P1) and the HNSW index
+(P2).
+
+## P1 — default path is wrong or the headline lies
+
+| 무엇 | 왜 남았나 | 난이도 | 우선순위 | 제안 경로 |
+| --- | --- | --- | --- | --- |
+| **Small-model agent-run content quality** | **Half closed in 12.0.0.** The mechanical half is done: the `guided` profile stops asking for JSON, the dial is chosen by a measured probe, a run that produces nothing demotes itself downward mid-run, and a 0.5B model reached `DONE` in 3.9s with a real file. The half still open is the *writing* — a weak summary fails the critic and the run ends `FAILED` / `NEEDS_REVIEW`. The cross-model matrix is improving from 11 of 18. | L | **P1** — still the voice the product ships on 8GB, and still the reason a first run can end in a review state. | Keep measuring with the loop's own parser, not a second harness. New answers go under new fixture keys (`agent_loop` `*_extended`); do not rewrite frozen rows. The remaining lever is content, not format: better plan→content prompting and a critic that says *what* was thin, per-model hacks still forbidden. |
+| **Real-embedding default rollout** | **Narrowed in 12.0.0, not closed.** Auto-detection now adopts a real downloaded embedding model when one is present, the hash model is labelled `fallback` rather than presented as semantic, and vector identity is filtered by `(model, dim)` so two spaces cannot mix. What is still true: on a machine that has downloaded nothing, the default remains `lattice-local-hash-v1` (blake2 bag-of-features), and "semantic" recall is then a hash of tokens. | M | **P1** — recall is the product. Hash as a labelled fallback is fine; hash as the silent default is not. | Make the first-run flow offer the embedding model the way it offers a chat model, and keep the switch honest: drain the backlog through `lattice-jobs` so a change of embedder is a reindex, and report `stale_embedder` until the queue is empty. |
+| **Worker-side batch embed** | **Mostly closed in 12.0.0 on the drain path**: embedding moved ahead of the write transaction, so the writer no longer holds a lock while a model runs — ~66 → ~1,300 items/s, and a 991-item backlog drains in 15.3s instead of ~40 minutes. What remains is the ingest-time door: it batches only when `(model_id, dim)` already agrees, and the hash path still embeds inline, one node at a time. | M | **P1** — the backlog path is fast now; a real-embed default still needs the inline door not to serialise against the single MLX executor. | Make `GraphWriter::write_vectors_with` + one `/worker/embed` call the ingest-time path whenever a provider is bound. Keep the drain planner as the backlog path. Do not open a second embedder inside `lattice-core`. |
+
+## P2 — real, but the product still works without them
+
+| 무엇 | 왜 남았나 | 난이도 | 우선순위 | 제안 경로 |
+| --- | --- | --- | --- | --- |
+| **HNSW whole-rebuild** | **Closed in 12.0.0; the default is deliberately unchanged.** The sidecar appends incrementally instead of being invalidated by every write, and the index is now used in real search: `hnsw+rescore` fetches `k * 8` candidate ids (cap 200) from `POST /worker/vector/query` and rescores exactly those rows natively, so recall is approximate and ordering is exact. Failures fall back to the exact scan carrying their reason. | L | **P2 → resolved for scale; the default stays `brute`.** | Nothing to build. The remaining decision is when to flip the default, and that needs recall@10 re-measured against the exact scan on a Brain that has been ingesting continuously — not a synthetic corpus. |
+| **Unsigned DMG** | `Lattice AI_12.0.0_aarch64.dmg` is ad-hoc signed (= unsigned). First launch needs the Gatekeeper bypass. `npm run release:validate` checks names and presence, not a Developer ID. | M | **P2** — first-run tax on desktop, not a Brain bug. Needs an Apple identity. | Developer ID Application + notarization in the release path. Exact artifact name stays `dist/…` / `src-tauri/target/release/bundle/dmg/Lattice AI_X.Y.Z_aarch64.dmg`. Credentials stay off the tree. |
+| **`api_key` cloud path is mock-only** | Contract-tested against a mock server. Never live-called — no billing budget. Live E2E is `cli_oauth` (`agy` / `grok`) at zero API billing. | S | **P2** — the supported cloud path already works. This is the paid-key twin. | One live contract test against a real OpenAI-compatible endpoint once a budget exists. Do not call the mock path "verified" in FEATURE_STATUS. Keep `local_only` winning on the request. |
+| **Vault-watch full-resync** | **Largely closed in 12.0.0**: the ingest fingerprint (size + mtime + content sha256) is on the watch path, so an unchanged note is not re-read, re-chunked or re-embedded. The pass itself still runs once through the bridge, because link edges need node ids only a completed ingest has. Cap is still 2,000 notes/run (`truncated: true`), still off by default. | M | **P2** — the wasteful part is gone; the shape of the pass is unchanged. | Attach links from the ids that already landed so the bridge does not need a whole pass at all. Keep the 2,000 cap and the `truncated` flag. Inline `#tags` stay out of scope. Watch still never deletes — cleanup is the confirmed prune door. |
+| **Self-Model has no screen** | Writes were restored in 11.7.0. `GET/POST/DELETE /api/memory/self-model*` and Review Center proposals work. `/app` has no profile view — "Brain이 나에 대해 뭐라고 생각하나" is an API call. | M | **P2** — the data path is real; the reader cannot see it. | A panel under `frontend/src/features/brain/` + `frontend/src/i18n/brain/`, reading the existing API. No new writer. Vitest 100% `all: true`. |
+
+## P3 — honesty leftovers that should not grow
+
+| 무엇 | 왜 남았나 | 난이도 | 우선순위 | 제안 경로 |
+| --- | --- | --- | --- | --- |
+| **API 오류 영어 리터럴** | FEATURE_STATUS carried a 10.9.0 inventory (17 of 50 *Python* routers) until 12.0.0 corrected it. After 11.6.0 the product routers are Rust. The live ratchet (`scripts/check_server_i18n.mjs`) locks **4** worker routers and reports **2** unclaimed (`health`, `search`). The larger leftover is native Rust `detail` strings that never entered `latticeai/core/messages.py`. | M | **P3** — the everyday SPA path is Korean. This is the remaining API/error English. | Finish the two worker routers (add them to `LOCALIZED`). Then a Rust-side catalog + a ratchet over `lattice-platform` / `lattice-auth` refusals. The 10.9.0 sentence is gone from FEATURE_STATUS as of 12.0.0; do not reintroduce it. |
+| **Image evidence does not keep the original** | An `Image` citation shows the 96px inline `data:` thumbnail stored at ingest, capped at 24 KB. Serving the real file would need a new static route over the user's disk or a reuse of `/local/serve` (every read passes an explicit approval). | M | **P3** — the thumbnail is an honest preview, not a fake original. Missing the file is a proof gap, not a crash. | Approval-gated `/local/serve` (or a content-addressed blob route that still requires consent). Keep the `data:` thumbnail as the no-approval preview. Do not add an ungated static mount. |
+
+## Other leftovers — named, not dropped
+
+These stay on the honesty ledger through 12.0.0. They are not P1. Do not
+quietly delete the row.
+
+| 무엇 | 왜 남았나 | 난이도 | 우선순위 | 제안 경로 |
+| --- | --- | --- | --- | --- |
+| Self-Model extraction is a phrase table; no `refiner` is wired | First-person ko/en patterns only. Survivable because every candidate is a proposal. | M | P3 | Optional model `refiner` behind a flag; keep proposal-first. |
+| Self-Model `open_keys` accepts `pending` only | Python also accepted `snoozed`. Port narrowed on purpose. | S | P3 | Add `snoozed` only with a fixture row, not a silent widening. |
+| `delete_node` leaves the `PART_OF` edge | Same as Python. 12.0.0's prune door sidesteps it by using `delete_document_tree` (both directions, zero dangling); the primitive itself is unchanged. | S | P3 | Decide whether to cascade; do not "fix" it in one crate only. |
+| `POST /knowledge-graph/ingest` is text-only | Contract, not a missing parser. Binary ingest is `/upload/document` → `/worker/parse`. | — | — | Keep. Document, do not "open it up". |
+| Review mutation is two store cycles | One writer, two transactions. | M | P3 | Collapse only if a single txn can carry both without a second `workspace_os.json` writer. |
+| Review events silent without an installed owner | Standalone retrieval process has no owner to attribute. | S | P3 | Fail closed to "unsigned event", never invent an owner. |
+| Long download is not cancellable | Closing the tab leaves the pull running on its worker thread. | M | P3 | Cooperative cancel on `POST /models/load` / `prepare-model`. |
+| Quantized vector backend: no memory win, ~2.2× slower | int8 codes are 8× smaller; peak RSS barely moves because SQLite rows dominate. | L | P3 | Hold as the representation a disk-resident index would need. Do not recommend it. |
+| No vision or speech model ships; video needs `ffmpeg` | Runtime refusals, honestly labelled. | — | — | Keep. Nothing is fabricated to fill those fields. |
+| Image/video observation functions have no HTTP door | 11.8.0 deleted the only route; it wrapped a native ingest that was never built. | M | P3 | Do not restore a door nobody calls. Ingest-time observation stays in Brain Core under unit test. |
+| Text→image fusion needs a shared-space vision model | Off by default; the response says so when the tower is missing. | M | P3 | Keep the honesty. Do not return text-only ranking as if fusion ran. |
+| Interop bridges read exports, never a vendor API | Notion zip, local git, local `.eml`/`.ics`. No IMAP, no Notion API. | L | P3 | Stay "point me at what you exported". |
+| Reorganization is one topic level and has no one-click undo | `topics/<주제>/`; no delete path; putting files back is a new proposal. | M | P3 | A reverse proposal at apply-time if undo is wanted. |
+| Browser extension language follows the browser | Separate origin; cannot read `lattice.language`. | M | P3 | Server-side language preference, then both clients read it. |
+| No real-model CI runner | `agent-smoke.yml` was deleted because hosted runners have no MLX and the job failed open. | L | P3 | Restore only on a runner that actually loads a model. A fail-open job is worse than none. |
+| Conversation artifact ledger is process-local | Minutes, not days. After restart, retrieval covers it. | S | P3 | Persist only if a test shows a user-visible hole after reboot. |
+
+## Design boundaries — not a close-me
+
+These were removed or scoped on purpose. A roadmap item that "restores
+Telegram" or "turns hash embeddings back into the only story" is a product
+decision, not a bug.
+
+- Telegram bridge and SSO/OIDC login/callback — removed in 11.6.0 with the
+  platform code that became the worker. Password login is native; the SSO
+  *configuration* surface remains.
+- Python coverage gate is a **line floor of 90** (11.8.0). Measured coverage
+  is much higher; the enforced claim is the floor.
+- Frozen HTTP / agent / retrieval goldens keep keys for surfaces that no
+  longer exist. That is the point of a frozen record. Do not rewrite them to
+  match today's tree.
+
+## How to use this
+
+Close a row by changing the code, then moving the row into a release note
+— not by editing this file ahead of the work. 12.0.0 shipped, so the four
+rows it closed are marked closed above and the rows it moved say how far;
+FEATURE_STATUS and the release notes carry the same statements. This
+reference page is redated at each release, not silently rewritten to look
+current.

package/docs/TRUST_MODEL.md

@@ -1,6 +1,6 @@
 # Lattice AI Trust Model
 
-Current release: **11.7.0 — Clean Sweep**.
+Current release: **12.0.0 — Open House**.
 
 Lattice AI is local-first, explicit about external communication, and honest
 when a capability is unavailable.
@@ -24,10 +24,18 @@ Local data can include:
 
 External communication requires configuration plus a user/admin action:
 
-- cloud model calls after keys are configured and a cloud model is selected;
+- cloud model calls after credentials resolve (`cloud_provider.json` / env
+  key / locally OAuth-authenticated `agy` or `grok`) and the escalation
+  policy — or an explicit `/cloud` prefix — uses them. Every such turn
+  writes a shape-only egress audit (provider / model / reason, never
+  content) and stages extracted knowledge as a Review Center proposal;
 - model downloads from registries after install consent;
-- Telegram bridge after the integration is enabled, the chat is allowlisted,
-  and a dedicated server session bearer is configured;
+- package installs from `/setup/install` (brew / pip / uv) — only for an item
+  the request names that the **server-derived** allowlist also contains, with
+  the command taken from the server's own plan rather than from the request;
+  the default path remains manual;
+- Telegram bridge — removed in 11.6.0 with the platform code that became
+  the AI worker; nothing replaces it;
 - Brain Network peer actions after pairing;
 - Docker/Postgres setup after opt-in scale configuration;
 - update checks only when enabled;
@@ -51,9 +59,19 @@ Lattice AI should fail closed or show an unavailable state for:
 - no graph/context evidence available;
 - unavailable external integration;
 - unknown or unreadable Knowledge Graph workspace scope;
-- missing Telegram chat allowlist or dedicated server session token;
+- Telegram inbound (the bridge was removed in 11.6.0; nothing replaces it);
 - wrong archive passphrase;
-- archive tampering, unsupported archive versions, or path traversal.
+- archive tampering, unsupported archive versions, or path traversal;
+- a hash-fallback embedder standing in for a real one — it is labelled
+  `fallback`, never presented as semantic recall;
+- an opted-in approximate vector index that cannot answer — the search falls
+  back to the exact scan and carries the reason rather than returning a
+  shorter list;
+- a model that cannot produce a tool call — the run is guided through numbered
+  choices under the same gates, and an unverifiable result is still
+  `NEEDS_REVIEW`;
+- deleting knowledge — a vanished file is reported and only a confirmed prune
+  removes its subtree.
 
 ## Product Boundary
 
@@ -67,7 +85,10 @@ does not mean secrets should appear in clear text.
 - Local files are only as protected as the user's machine, OS account, backups,
   and disk encryption.
 - Cloud model prompts follow the selected provider's policy once the user
-  explicitly chooses that provider.
+  explicitly chooses that provider (or the `auto`/`always` escalation
+  policy does, behind `cloud_allowed`). The `api_key` path is
+  mock-verified only in this release; live OAuth used `cli_oauth` at
+  zero billing. Extracted cloud knowledge is proposal-first.
 - A local admin can inspect local files and process memory outside Lattice AI.
 - Marketplace and model registries are third-party services when explicitly
   contacted.

package/docs/USABILITY_AUDIT.md

@@ -86,6 +86,11 @@ Heuristics:
 
 ## Journey 4 — Brain hierarchy
 
+> **Dated snapshot (2026-07-21).** `DepthEmergence.tsx` was deleted in v11.8.0
+> when the Brain home was redesigned; the depth-tiered reveal it describes is no
+> longer how the home discloses structure. The findings below are kept as the
+> record of what was evaluated at the time, not as current-truth surface notes.
+
 Surface: `frontend/src/features/brain/DepthEmergence.tsx`,
 `.../BrainMemoryLayer.tsx`.
 

package/docs/WHY_LATTICE.md

@@ -1,6 +1,6 @@
 # Why Lattice AI Exists
 
-Current release: **11.7.0 — Clean Sweep**.
+Current release: **12.0.0 — Open House**.
 
 **Lattice AI is a local-first Digital Brain that keeps your knowledge durable
 across any AI model.**
@@ -25,8 +25,9 @@ material. That breaks down for real work:
 ## The Lattice Answer
 
 Lattice AI keeps conversations, documents, memories, decisions, relationships,
-and source provenance in a private local Brain. Models can be local, cloud,
-current, or future. The Brain remains.
+and source provenance in a private local Brain. Models can be local, or an
+optional cloud worker you hire (OAuth CLI or an API key). Default is local.
+The Brain remains.
 
 The graph matters as visible proof, but a graph editor is not the product
 identity. The product identity is a local-first Digital Brain: the user talks or
@@ -48,10 +49,17 @@ secondary.
 - Ask what the team decided and see the source.
 - Add documents and build a searchable private memory.
 - Prepare from old notes, project decisions, and files.
-- Preserve context when moving between models.
+- Preserve context when moving between models. Cloud is optional; default
+  is local.
 - Export or restore the Brain as an encrypted `.latticebrain` archive.
-- Use Korean or English without changing the underlying Brain.
+- Use Korean or English without changing the underlying Brain. Korean queries
+  are read as Korean, particles and all, rather than as strings that happen to
+  share a prefix.
 - Avoid fake answers when no model or evidence is available.
+- Run on the model your machine can actually hold. The loop measures what a
+  model can produce and adapts to it — a model too small to emit a tool call is
+  walked through numbered choices instead of being told it failed — with the
+  same permission gates and safeguards on every path.
 
 ## What Lattice AI Is Not
 

package/docs/WORKFLOW_DESIGNER.md

@@ -8,9 +8,9 @@ node to an injected *runner* that calls the real tool registry, skill registry,
 plugin registry, or multi-agent orchestrator.
 
 The execution model lives in
-[`rust/lattice-platform/src/workflow_designer/definition.rs`](../rust/lattice-platform/src/workflow_designer/definition.rs)
+[`rust/lattice-platform/src/governance/workflow_designer/definition.rs`](../rust/lattice-platform/src/governance/workflow_designer/definition.rs)
 (pure logic with injected runners) and the HTTP surface lives in
-[`rust/lattice-platform/src/workflow_designer/handlers.rs`](../rust/lattice-platform/src/workflow_designer/handlers.rs).
+[`rust/lattice-platform/src/governance/workflow_designer/handlers.rs`](../rust/lattice-platform/src/governance/workflow_designer/handlers.rs).
 Both moved from Python in 11.6.0.
 Persistence reuses the existing `WorkspaceOSStore`, so pre-2.0 workflow history
 is preserved.

package/docs/kg-schema.md

@@ -1,6 +1,6 @@
 # Knowledge Graph Schema
 
-Current release: **11.7.0 — Clean Sweep**.
+Current release: **12.0.0 — Open House**.
 
 명세 출처: `lattice_ai_full_spec.pptx` 슬라이드 20·21·22
 구현: `lattice_brain/graph/schema.py`
@@ -106,6 +106,7 @@ Edge {
 | `ORGANIZATION` | 조직 / 회사 / 팀 | `domain`, `members[]` |
 | `WORKFLOW` | 워크플로우 정의/실행 | `workflow_id`, `status` |
 | `AGENT` | 에이전트(역할/실행 주체) | `role`, `model_id` |
+| `SECTION` | 문서의 한 절 (제목 하나가 덮는 범위) | `heading_path`, `depth`, `document` — v12.0.0부터 실제로 쓰인다 |
 
 ### 추가 엣지 타입
 
@@ -115,11 +116,48 @@ Edge {
 | `MODIFIED_BY` | ANY → `PERSON` | 마지막 수정자 |
 | `BELONGS_TO_PROJECT` | ANY → `PROJECT` | 프로젝트 귀속 |
 | `PART_OF` | ANY → ANY | 구성요소 관계 |
+| `HAS_CHUNK` | `SECTION` → `CHUNK` | 이 절에 속한 텍스트 |
+| `CONTRADICTS` | ANY ↔ ANY | 두 진술이 서로 상충함 |
 | `DISCUSSED_IN` | `CONCEPT`·`DECISION` → `MEETING`·`CHAT` | 어디에서 논의됨 |
 | `DECIDED_BY` | `DECISION` → `PERSON` | 결정 주체 |
 | `GENERATED_BY` | ANY → `AGENT`·`MODEL`·`WORKFLOW` | 생성 주체 |
 | `USED_BY_AGENT` | ANY → `AGENT` | 에이전트가 사용함 |
 
+### 섹션 트리 (v12.0.0)
+
+`Section` 노드 타입과 `PART_OF` / `HAS_CHUNK` 엣지는 이전부터 분류 체계에
+있었지만 **쓰는 사람이 없었다**. v12.0.0부터 타입드 청커의 `heading_path`
+(`" > "`로 이어 붙인 제목 자취, 예: `아키텍처 > 저장소`)가 청크 메타데이터
+문자열에서 멈추지 않고 그래프의 나무가 된다:
+
+```
+Document ──◄PART_OF── Section(아키텍처) ──◄PART_OF── Section(아키텍처 > 저장소)
+                                                          │
+                                                          HAS_CHUNK
+                                                          ▼
+                                                        Chunk
+```
+
+| 요소 | 규칙 |
+|------|------|
+| `Section` 노드 | `label`은 그 절의 제목(마지막 마디), 전체 자취는 `attrs`에. id는 (문서, 제목 자취)의 결정적 해시라 재수집이 멱등이다 |
+| `Section —PART_OF→ Section`·`Document` | 목차의 등뼈. 부모가 없는 최상위 절은 문서에 직접 붙는다 |
+| `Section —HAS_CHUNK→ Chunk` | 어느 텍스트가 이 제목 아래 있는가 |
+| 제목이 없는 문서 | **섹션을 만들지 않는다.** 파일마다 "제목 없는 절"을 하나씩 지어내면, 저자가 쓴 적 없는 것의 이름을 그래프에 넣는 셈이다 |
+| 쓰기 경로 | 문서가 먼저 착지한 뒤 공개 `GraphWriter::upsert_nodes` / `upsert_edges` 문으로만 — 스키마는 넓어지지 않는다 |
+
+이로써 「이 사실은 어느 절에서 나왔나」와 「그 절에 또 뭐가 있나」가 둘 다
+답 가능한 질문이 된다. 릴리스 코퍼스 실측: 트리플 **555개 중 549개**가
+섹션 출처를 가진다.
+
+### 상충 관계와 근거 분류 (v12.0.0)
+
+`CONTRADICTS`도 어휘에만 있던 타입이었다. v12.0.0부터 추출이 `PART_OF`와
+`CONTRADICTS`를 **실제로 생산**하고, 엣지는 방향과 타입을 갖고 쓰이며,
+`evidence`는 그 관계가 동사에서 왔는지 공기(co-occurrence)에서 왔는지로
+분류되어 저장된다. 상충 자체는 자동으로 해소되지 않는다 — Review Center
+제안으로 올라가고, 사람이 승인해야 `valid_from`/`valid_to`가 찍힌다.
+
 ### 통합 수집 형태 (Unified Ingestion)
 
 모든 출처는 동일한 형태로 그래프에 들어온다:
@@ -142,8 +180,12 @@ provenance(source_type, source_uri, content_hash, captured_at, modified_at,
   범위 없는 로컬 폴더는 개인 Brain으로 재투영하되 기존 노드 ID는 보존하며,
   같은 폴더를 다른 워크스페이스로 조용히 재할당하지 않는다.
 
-구현: `lattice_brain/ingestion/` (`IngestionPipeline`) 가 단일 진입점이며,
-파일/로컬폴더/URL/브라우저 탭/텍스트를 모두 이 형태로 정규화한다.
+구현: 단일 진입점은 v11.6.0부터 Rust의 네이티브 ingest 문
+(`lattice-ingest` → `lattice_core::graph_write`)이며, 파일/로컬폴더/URL/
+브라우저 탭/텍스트를 모두 이 형태로 정규화한다. `lattice_brain/ingestion/`은
+양쪽이 공유하는 어휘 — 라우팅 상수, DTO, 콘텐츠 해시, 추출 품질 점수 — 만
+남았고, v11.8.0이 마지막 잔재였던 `IngestionPipeline` 능력 프로브 클래스를
+그 유일한 호출 라우트와 함께 삭제했다.
 
 ---
 
@@ -224,10 +266,18 @@ v2 로 백필한다. 기존 `nodes` / `edges` 테이블은 삭제하지 않는
 
 - 차원: 환경 변수 `LATTICEAI_EMBED_DIM` (기본 `1024`)
 - 저장: SQLite `BLOB` 컬럼, `struct.pack('<{n}f', …)` 직렬화
-- 검색: `knowledge_graph.KnowledgeGraphStore.vector_search` — 순수 Python
-  코사인 (sqlite-vec/ANN 인덱스는 아직 없음). 기본 임베더는 해시 기반
-  폴백(`grade='fallback'`)이며, 실제 임베딩 모델은 setup wizard 를 통해
-  사용자 동의 하에 프로비저닝한다.
+- 검색: 기본은 **정확 스캔(`brute`)** 코사인이다. v12.0.0부터
+  `LATTICEAI_VECTOR_INDEX=hnsw`를 켜면 워커 사이드카
+  (`POST /worker/vector/query`)가 `k * 8`개(최대 200) 후보 id를 주고,
+  네이티브 쪽이 **브루트와 같은 코사인으로 그 행들을 다시 채점**한다 —
+  근사 리콜, 정확 순서, 이름은 `hnsw+rescore`. 사이드카가 답하지 못하면
+  사유를 실은 채 정확 스캔으로 떨어진다. `.hnsw` 사이드카는 증분
+  append이므로 쓰기 한 번이 인덱스 전체를 무효화하지 않는다.
+- 임베더: v12.0.0부터 **자동 감지**한다 — 다운로드된 실제 임베딩 모델이
+  있으면 채택하고, 없으면 해시 기반 폴백(`grade='fallback'`)을 **폴백이라고
+  표기한 채** 쓴다. 해시를 의미 벡터로 부르지 않는다. 벡터 정체성은
+  `(model, dim)`으로 필터되므로 서로 다른 임베딩 공간이 조용히 섞이지
+  않는다.
 - 키워드 검색: v4 부터 FTS5 trigram 인덱스(`node_fts`) 가 LIKE 스캔을
   대체한다 (한국어 부분 문자열 리콜 유지). FTS5/trigram 이 없는 SQLite
   빌드에서는 LIKE 경로가 그대로 동작하며 `index_status().storage.fts_enabled`

package/docs/mcp-tools.md

@@ -4,7 +4,11 @@ Lattice AI는 MCP(Model Context Protocol) 서버로 동작하여 Claude Desktop,
 
 ## 연결 설정
 
-`claude_desktop_config.json` 또는 Cursor MCP 설정:
+The MCP surface is **streamable HTTP JSON-RPC** at `POST /mcp` on the
+loopback gateway (default `http://localhost:4825`). There is no separate
+stdio or SSE transport.
+
+`claude_desktop_config.json` or Cursor MCP settings:
 
 ```json
 {
@@ -16,112 +20,119 @@ Lattice AI는 MCP(Model Context Protocol) 서버로 동작하여 Claude Desktop,
 }
 ```
 
-## 도구 목록
-
-### 파일 시스템
-
-| 도구 | 설명 | 위험도 |
-|------|------|--------|
-| `read_file` | 파일 읽기 (라인 번호, offset/limit 지원) | 낮음 |
-| `edit_file` | 정밀 diff 편집 (`old_string` 유일성 검증) | 중간 |
-| `list_dir` | 디렉토리 목록 | 낮음 |
-| `grep` | 정규식 검색, glob 필터, context_lines | 낮음 |
-
-### 실행
+Auth is the same session gate as every other product route:
+
+- Loopback install with authentication off → the anonymous local owner (this
+  is what a localhost client such as Claude Desktop uses).
+- Authentication on → send the `session_token` cookie or
+  `Authorization: Bearer <token>`.
+
+Supported JSON-RPC methods: `initialize`, `notifications/initialized`,
+`tools/list`, `tools/call`. Unknown methods return `-32601`. Notifications
+have no result body (`202`).
+
+Every native tool call goes through the existing tool governor. A governance
+refusal is a JSON-RPC error (`-32001`), not a successful tool result.
+
+**Since v12.0.0 `POST /mcp` is inside the OpenAPI product contract.** It is
+declared in the gateway's mount table as a **single JSON-RPC envelope
+operation** — one path, one method, one request/response shape, with the
+method vocabulary above carried in the body rather than in the URL. Through
+v11.9.0 it sat outside the contract by design; being outside a contract is not
+the same as being safe to leave undescribed, so it is now generated into the
+spec like every other product route. Two consequences worth knowing:
+
+- The route is **natively mounted**, so it is answered in-process and never
+  proxied to the Python worker — the worker's committed allowlist does not
+  carry it, and the gateway forwards nothing that is not on that list.
+- The agent loop reaches the same governance. A run's unified tool catalog
+  exposes `mcp.<tool>` beside native tools and skills, and dispatching one
+  runs the very governance check this endpoint runs. A name the run already
+  governs takes the stricter native path instead, so the MCP prefix can never
+  be the quieter way to call the same tool.
 
-| 도구 | 설명 | 위험도 |
-|------|------|--------|
-| `run_command` | shell 없이 고정 read-only 명령 allowlist 실행 | 높음 |
-| `run_terminal_command` | 터미널 명령 (별칭) | 높음 |
-
-### 작업 관리
+## 도구 목록
 
-| 도구 | 설명 | 위험도 |
-|------|------|--------|
-| `todo_write` | TODO 항목 생성/업데이트 | 낮음 |
-| `todo_read` | TODO 목록 조회 | 낮음 |
+MCP exposes a **curated, read-oriented** subset of Lattice native tools,
+plus each installed skill as a prompt asset. Writes, shell, desktop control,
+and remote-install tools are **not** on this surface — use the REST `/tools/*`
+routes (with their own approval gates) for those.
 
-### 시스템
+### Native (governed)
 
 | 도구 | 설명 | 위험도 |
 |------|------|--------|
-| `computer_screenshot` | 화면 캡처 (desktop-control capability 및 정책 승인 필요) | 높음 |
-| `computer_status` | 데스크톱 제어 상태 조회 (동일 capability/policy 적용) | 중간 |
-| `computer_open_app` | 앱 실행 | 중간 |
-| `computer_open_url` | URL 열기 | 낮음 |
-| `network_status` | IP, Wi-Fi 정보 (인증 및 ToolRegistry 정책 적용) | 중간 |
+| `list_dir` | 워크스페이스 디렉터리 목록 (sandbox) | 낮음 |
+| `read_file` | 워크스페이스 UTF-8 파일 읽기 (offset/limit) | 낮음 |
+| `workspace_tree` | 재귀 트리 (깊이 제한) | 낮음 |
+| `grep` | 워크스페이스 정규식 검색 | 낮음 |
+| `knowledge_search` | 지식 정원 검색 (workspace scope, 승인 정책 적용) | 낮음 |
+| `knowledge_tree` | 지식 정원 파일 목록 (동일 정책) | 낮음 |
+| `git_status` | 워크스페이스 안 read-only `git status` | 낮음 |
 
-### 문서
+### Skills (prompt assets)
 
-| 도구 | 설명 | 위험도 |
-|------|------|--------|
-| `pdf_to_text` | PDF → 텍스트 변환 | 낮음 |
-| `pdf_pages` | PDF 페이지 수 조회 | 낮음 |
-| `read_docx` | Word 문서 읽기 | 낮음 |
-| `read_xlsx` | Excel 파일 읽기 | 낮음 |
-| `read_pptx` | PowerPoint 읽기 | 낮음 |
+Installed skills from the skills directory appear as `skill.<name>`
+(for example `skill.code_review`). `tools/list` serves the parsed
+`schema.json` input schema. `tools/call` returns the `SKILL.md` body plus
+the input echo — skills are not executables.
 
-### 지식 정원 (P-Reinforce)
+Typical names when the repo `skills/` tree is installed:
 
-| 도구 | 설명 | 위험도 |
-|------|------|--------|
-| `garden_save` | 지식 정원에 저장 | 낮음 |
-| `garden_tree` | 지식 트리 조회 | 낮음 |
-| `garden_read` | 정원 파일 읽기 | 낮음 |
+- `skill.code_review`
+- `skill.data_analysis`
+- `skill.file_edit`
+- `skill.meeting_notes`
+- `skill.summarize_document`
+- `skill.web_search`
+- `skill.weekly_review`
 
-## REST API 직접 호출
+## REST API
 
-MCP 대신 REST API로도 동일한 도구를 호출할 수 있습니다:
+The same governed subset is also reachable at `POST /mcp/call`
+(`{"action": "...", "args": {}}`) and the existing `/tools/*` routes.
 
 ```bash
-# read_file
-curl -b "session=<token>" \
-  "http://localhost:4825/tools/read_file?path=server.py"
+# MCP JSON-RPC initialize
+curl -s -X POST http://localhost:4825/mcp \
+  -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"curl","version":"0"}}}'
 
-# edit_file
-curl -b "session=<token>" -X POST \
-  http://localhost:4825/tools/edit_file \
+# MCP tools/call
+curl -s -b "session_token=<token>" -X POST http://localhost:4825/mcp \
   -H "Content-Type: application/json" \
-  -d '{"path": "server.py", "old_string": "old code", "new_string": "new code"}'
+  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_dir","arguments":{"path":"."}}}'
 
-# grep
-curl -b "session=<token>" \
-  "http://localhost:4825/tools/grep?pattern=def%20main&glob=*.py"
+# REST sibling (same dispatch)
+curl -s -b "session_token=<token>" -X POST http://localhost:4825/mcp/call \
+  -H "Content-Type: application/json" \
+  -d '{"action":"list_dir","args":{"path":"."}}'
 
-# run_command
-curl -b "session=<token>" -X POST \
-  http://localhost:4825/tools/run_command \
+# Full write/exec surface (not on MCP)
+curl -s -b "session_token=<token>" -X POST http://localhost:4825/tools/edit_file \
   -H "Content-Type: application/json" \
-  -d '{"command": "rg TODO ."}'
+  -d '{"path": "server.py", "old_string": "old code", "new_string": "new code"}'
 ```
 
-`run_command`는 `pwd`, `ls`, `find`, `cat`, `head`, `tail`, `wc`, `rg`만 허용합니다.
-Python/Node/npm/npx/sed, shell operator, 실행 파일 경로, 절대 경로, `..` traversal,
-workspace 밖 symlink, `rg --pre`, `find -exec/-delete`는 거부됩니다. 빌드와 테스트는
-별도의 허용된 project-script 도구를 사용합니다.
+`run_command` remains a REST-only admin tool. It allows `pwd`, `ls`, `find`,
+`cat`, `head`, `tail`, `wc`, `rg` only. Python/Node/npm/npx/sed, shell
+operators, executable paths, absolute paths, `..` traversal, workspace-outside
+symlinks, `rg --pre`, and `find -exec/-delete` are refused.
 
 ## 도구 카탈로그 조회
 
 ```bash
-curl -b "session=<token>" http://localhost:4825/mcp/tools
+curl -b "session_token=<token>" http://localhost:4825/mcp/tools
 ```
 
-응답:
-```json
-{
-  "tools": [
-    {
-      "name": "edit_file",
-      "description": "정밀 diff 편집. old_string이 파일에 유일해야만 성공.",
-      "risk": "medium",
-      "parameters": { ... }
-    },
-    ...
-  ]
-}
-```
+`GET /mcp/tools` lists Lattice's native tool catalog (names, descriptions,
+governance). `tools/list` on `POST /mcp` is the MCP-shaped list with JSON
+Schemas for the curated subset plus skills.
+
+`POST /mcp/install` enables a skill or plugin Lattice can actually flip in
+the workspace registry. Remote npm/pip/connector entries return
+`{"status":"manual_required", ...}` instead of a blank 404.
 
-도구 카탈로그는 인증이 필요하며 서버의 절대 `AGENT_ROOT`를 반환하지 않습니다.
-MCP/plugin dispatch도 각 도구의 사용자·workspace·capability·승인 정책을 우회할
-수 없습니다. knowledge/Obsidian 계열 읽기는 명시적 사용자 동의와 scope를
-사용합니다.
+The catalogs require authentication and do not return the absolute
+`AGENT_ROOT`. MCP/plugin dispatch cannot bypass user, workspace, capability,
+or approval policy. Knowledge-garden reads use explicit user/workspace scope.

package/docs/security-model.md

@@ -88,9 +88,12 @@ MAGIC_NUMBERS = {
 
 ## 수집 & 그래프 포터빌리티 보안 (v3.6.0)
 
-- **수집 라이프사이클**: 모든 수집은 `IngestionPipeline.ingest` → `dispatch_tool`
-  를 거쳐 `pre_tool`/`post_tool` 훅이 발화됩니다. `pre_tool`이 차단하면 수집은
-  정직하게 `status="blocked"`로 거부됩니다(권한 게이트·민감정보 가드 적용).
+- **수집 라이프사이클**: 모든 수집은 네이티브 ingest 문(`lattice-ingest` →
+  `lattice_core::graph_write`) → 도구 디스패치를 거쳐 `pre_tool`/`post_tool`
+  훅이 발화됩니다. `pre_tool`이 차단하면 수집은 정직하게 `status="blocked"`로
+  거부됩니다(권한 게이트·민감정보 가드 적용). v3.6.0에 이 계약을 세운 것은
+  Python `IngestionPipeline.ingest`였고, v11.6.0이 문을 Rust로 옮기면서 계약은
+  그대로 유지했습니다.
 - **웹 URL 읽기**(`/api/browser/read-url`): `http(s)`만 허용하고 DNS의 모든 결과에서
   loopback/private/link-local/multicast/reserved 주소를 거부합니다. 검증한 IP에 연결을
   고정해 DNS rebinding을 막고, redirect마다 재검증하며 환경 proxy를 사용하지

package/lattice_brain/__init__.py

@@ -31,7 +31,7 @@ from .multimodal import (
     transcribe_audio,
 )
 
-__version__ = "11.7.0"
+__version__ = "12.0.0"
 
 __all__ = [
     "AudioFacts",