ltcai 12.3.0 → 12.4.0

package/README.md

@@ -12,7 +12,7 @@
 [![CD Status](https://github.com/TaeSooPark-PTS/LatticeAI/actions/workflows/publish.yml/badge.svg)](https://github.com/TaeSooPark-PTS/LatticeAI/actions/workflows/publish.yml)
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 
-![v12.3.0 Living Brain walkthrough](output/release/v12.3.0/gifs/v12.3.0-living-brain-walkthrough.gif)
+![v12.4.0 Living Brain walkthrough](output/release/v12.4.0/gifs/v12.4.0-living-brain-walkthrough.gif)
 
 Lattice AI is a Digital Brain that lives on your computer. Chat, files,
 folders, notes, and web pages all land in one knowledge graph you own.
@@ -42,19 +42,19 @@ LTCAI                    # then open http://127.0.0.1:4825/app
 
 | | | |
 | --- | --- | --- |
-| ![Login](output/release/v12.3.0/screenshots/01-login.png) | ![Model install](output/release/v12.3.0/screenshots/03-install-load-progress.png) | ![Model library](output/release/v12.3.0/screenshots/07-model-library.png) |
+| ![Login](output/release/v12.4.0/screenshots/01-login.png) | ![Model install](output/release/v12.4.0/screenshots/03-install-load-progress.png) | ![Model library](output/release/v12.4.0/screenshots/07-model-library.png) |
 
 Screenshot index:
-[output/release/v12.3.0/SCREENSHOT_INDEX.md](output/release/v12.3.0/SCREENSHOT_INDEX.md)
+[output/release/v12.4.0/SCREENSHOT_INDEX.md](output/release/v12.4.0/SCREENSHOT_INDEX.md)
 
 ## What you can do
 
 | | |
 | --- | --- |
-| **See your Brain's story in time** — a growth curve, an activity heatmap, and each day's story ![Brain Chronicle](output/release/v12.3.0/screenshots/13-chronicle.png) | **Chat with a Brain that remembers** — every conversation grows durable, source-linked memory ![Brain Chat](output/release/v12.3.0/screenshots/04-brain-chat-home.png) |
-| **See how knowledge connects** — a real relationship graph, not a file list ![Memory Graph](output/release/v12.3.0/screenshots/05-memory-graph.png) | **Capture anything** — files, whole folders, notes, screenshots, web pages ![Capture](output/release/v12.3.0/screenshots/06-capture.png) |
-| **Automate with review** — agent changes become proposals you approve first ![Review Center](output/release/v12.3.0/screenshots/12-review-center.png) | **Pick a model in one click** — recommended local models for your hardware ![Recommended Models](output/release/v12.3.0/screenshots/02-recommended-models.png) |
-| **Watch a file become memory** — three named steps, not a pipeline diagram ![Material to memory](output/release/v12.3.0/screenshots/11-knowledge-journey.png) | **Say how much it may do alone** — one dial in plain words ![Settings](output/release/v12.3.0/screenshots/08-system.png) |
+| **See your Brain's story in time** — a growth curve, an activity heatmap, and each day's story ![Brain Chronicle](output/release/v12.4.0/screenshots/13-chronicle.png) | **Chat with a Brain that remembers** — every conversation grows durable, source-linked memory ![Brain Chat](output/release/v12.4.0/screenshots/04-brain-chat-home.png) |
+| **See how knowledge connects** — a real relationship graph, not a file list ![Memory Graph](output/release/v12.4.0/screenshots/05-memory-graph.png) | **Capture anything** — files, whole folders, notes, screenshots, web pages ![Capture](output/release/v12.4.0/screenshots/06-capture.png) |
+| **Automate with review** — agent changes become proposals you approve first ![Review Center](output/release/v12.4.0/screenshots/12-review-center.png) | **Pick a model in one click** — recommended local models for your hardware ![Recommended Models](output/release/v12.4.0/screenshots/02-recommended-models.png) |
+| **Watch a file become memory** — three named steps, not a pipeline diagram ![Material to memory](output/release/v12.4.0/screenshots/11-knowledge-journey.png) | **Say how much it may do alone** — one dial in plain words ![Settings](output/release/v12.4.0/screenshots/08-system.png) |
 
 ## Why this is yours
 
@@ -70,42 +70,41 @@ Screenshot index:
 
 ## Current Release
 
-The current release is **12.3.0 — Live Wire**:
-
-Model catalog routes, GGUF quantization tags, small-model tool/MCP calling,
-and HTML generation/inspection/download are verified end-to-end against live
-repositories and a loaded local model. The door is still **422 operations /
-41 families** over a **20-route worker**. Cloud is still optional and the
-default is still local.
-
-- **Verified Hugging Face GGUF tags & routes.** `ggml-org/gemma-4-*-GGUF`
-  uses `Q4_0`, `ggml-org/gpt-oss-20b-GGUF` uses `MXFP4`, and `Qwen3.5-9B` /
-  `Qwen3.6-35B-A3B` GGUF routes are wired across `ollama`, `lmstudio`, and
-  `llamacpp`.
-- **Auxiliary GGUF filtering, `--mmproj` companion load, and shard checks.**
-  `mmproj-`/`mtp-`/`dflash-`/`eagle3-`/`imatrix` GGUFs are excluded from
-  primary weight selection, companion `mmproj-*.gguf` files are downloaded
-  for `llama-server`, and `model.safetensors.index.json` shards are verified.
-- **Small-model tool calling & MCP calling hardening.** Expanded
-  `KNOWN_ACTIONS`, stringified `arguments` recovery, OpenAI `tool_calls`
-  array unwrapping, fenced HTML/code block salvage, and `adopt_named_args`
-  in `perform_action`.
-- **HTML structure inspection & RFC 5987 UTF-8 download.**
-  `POST /tools/inspect_html` extracts `title`, `links`, `scripts`,
-  `stylesheets`, `images`, `forms`, and `headings`; `GET /tools/download`
-  decodes UTF-8 paths and sends `filename*=UTF-8''...`.
+The current release is **12.4.0 — Sharp Weight**:
+
+The local and cloud model catalog adds **Qwen 3.8 27B 4-bit** and **Gemma 4 26B
+A4B QAT / QAT-OptiQ 4-bit** builds, closes all Python (`pillow>=13,<14`) and npm
+dependency security advisories, hardens engine URL scheme validation, and scopes
+Tailwind CSS v4's oxide scanner to `frontend/`. The door is still **422
+operations / 41 families** over a **20-route worker**. Cloud is still optional
+and the default is still local.
+
+- **Qwen 3.8 27B 4-bit local & cloud integration.** Added
+  `mlx-community/Qwen3.8-27B-4bit` (`16.1GB`, `qwen3_5`), wired GGUF/HF routes
+  (`ggml-org/Qwen3.8-27B-GGUF:Q4_K_M`, `Qwen/Qwen3.8-27B`) across all 5 local
+  engines, and added `Qwen/Qwen3.8-27B` / `qwen/qwen3.8-27b` to `together` and
+  `openrouter`.
+- **Gemma 4 26B A4B QAT & QAT-OptiQ 4-bit builds.** Added
+  `mlx-community/gemma-4-26B-A4B-it-qat-4bit` (`15.6GB`, routed to Google's
+  official QAT GGUF `google/gemma-4-26B-A4B-it-qat-q4_0-gguf:Q4_0`) and
+  `mlx-community/gemma-4-26B-A4B-it-qat-OptiQ-4bit` (`21.9GB`, sensitivity-guided
+  mixed 4-bit/8-bit `mlx-optiq` build).
+- **Dependency security audit closure & runtime hardening.** Upgraded `pillow`
+  to `>=13,<14`, resolved all npm lockfile advisories in root and
+  `vscode-extension`, enforced `http(s)://` scheme checks in `model_engines`,
+  and scoped `@import "tailwindcss" source("..");` in `frontend/src/styles.css`.
 
 Release notes live in [docs/releases/](docs/releases/). This version:
-[docs/releases/RELEASE_NOTES_v12.3.0.md](docs/releases/RELEASE_NOTES_v12.3.0.md).
+[docs/releases/RELEASE_NOTES_v12.4.0.md](docs/releases/RELEASE_NOTES_v12.4.0.md).
 Guide: [RELEASE.md](RELEASE.md) · History: [docs/CHANGELOG.md](docs/CHANGELOG.md).
 
-Expected artifacts for 12.3.0 must use exact filenames:
+Expected artifacts for 12.4.0 must use exact filenames:
 
-- `dist/ltcai-12.3.0-py3-none-any.whl`
-- `dist/ltcai-12.3.0.tar.gz`
-- `ltcai-12.3.0.tgz`
-- `dist/ltcai-12.3.0.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_12.3.0_aarch64.dmg`
+- `dist/ltcai-12.4.0-py3-none-any.whl`
+- `dist/ltcai-12.4.0.tar.gz`
+- `ltcai-12.4.0.tgz`
+- `dist/ltcai-12.4.0.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_12.4.0_aarch64.dmg`
 
 Do not use wildcard artifact uploads. Package registry publishing remains owner-run.
 
@@ -176,7 +175,7 @@ Validation via `npm run lint`, `npm run test:unit`, `npm run test:visual`.
   pending-only, no Self-Model refiner, `delete_node` leaving `PART_OF`,
   review events silent without an owner, KG-api ingest text-only, two
   store cycles per review mutation) are listed with their reasons in
-  [docs/releases/RELEASE_NOTES_v12.3.0.md](docs/releases/RELEASE_NOTES_v12.3.0.md)
+  [docs/releases/RELEASE_NOTES_v12.4.0.md](docs/releases/RELEASE_NOTES_v12.4.0.md)
   and prioritized in [docs/ROADMAP.md](docs/ROADMAP.md).
 
 ## Release History
@@ -188,6 +187,7 @@ same boundary. Earlier notes live in [docs/releases/](docs/releases/).
 
 | Version | Theme |
 | --- | --- |
+| 12.4.0 | Sharp Weight |
 | 12.3.0 | Live Wire |
 | 12.2.1 | True Count |
 | 12.2.0 | Small Voice |

package/docs/CHANGELOG.md

@@ -4,6 +4,37 @@ The top entry is either the current unreleased main-branch work or the current
 release line. Older entries are historical and may describe behavior as it
 existed at that release.
 
+## [12.4.0] - 2026-11-11 — Sharp Weight
+
+### Added
+- Added `mlx-community/Qwen3.8-27B-4bit` (`16.1GB`, `qwen3_5`) to the local
+  model capability registry, multi-engine GGUF/HF routes
+  (`ggml-org/Qwen3.8-27B-GGUF:Q4_K_M`, `Qwen/Qwen3.8-27B`), `together` and
+  `openrouter` cloud catalogs, and Rust `CATALOG_HINTS`.
+- Added `mlx-community/gemma-4-26B-A4B-it-qat-4bit` (`15.6GB`, routed to
+  Google's official QAT GGUF `google/gemma-4-26B-A4B-it-qat-q4_0-gguf:Q4_0` and
+  `google/gemma-4-26B-A4B-it-qat-q4_0-unquantized`) and
+  `mlx-community/gemma-4-26B-A4B-it-qat-OptiQ-4bit` (`21.9GB`, sensitivity-guided
+  mixed 4-bit/8-bit `mlx-optiq` build on Google's QAT base) to the capability
+  registry, engine routes, and Rust `CATALOG_HINTS`.
+
+### Changed
+- Upgraded `pillow` dependency constraint to `>=13,<14` in `pyproject.toml` and
+  `requirements.txt` (closing 39 CVEs in `pillow 12.3.0`), and synchronized
+  `reportlab>=4,<5` and `huggingface_hub>=1.0,<2` in `requirements.txt`.
+- Updated npm dependencies and lockfiles in root and `vscode-extension`
+  (`vitest` and `@vitest/coverage-v8` `^4.1.12`, `glob` `^14.0.4`, `minimatch`
+  `^11.0.7`) so `npm audit` reports 0 vulnerabilities.
+
+### Fixed
+- Hardened `_json_request` and `get_openai_compatible_server_models` in
+  `latticeai/services/model_engines.py` to reject non-`http(s)://` URL schemes.
+- Fixed `admin_log_retention` in `rust/lattice-platform/src/adminops/admin/handlers.rs`
+  to read `state.auth.clock().now()` instead of real wall-clock `unix_now()`,
+  eliminating wall-clock drift against deterministic audit fixtures.
+- Scoped `@import "tailwindcss" source("..");` in `frontend/src/styles.css` so
+  `@tailwindcss/oxide` only scans `frontend/` instead of walking `rust/target`.
+
 ## [12.3.0] - 2026-10-19 — Live Wire
 
 ### Added

package/docs/COMMUNITY_AND_PLUGINS.md

@@ -1,6 +1,6 @@
 # Community And Plugins
 
-Current release: **12.3.0 — Live Wire**.
+Current release: **12.4.0 — Sharp Weight**.
 
 LatticeAI defines the path from a strong local-first framework (8.4.0
 action-aware baseline, 8.5.0 registry+DI hardening, 8.6.0 capture/navigation

package/docs/DEVELOPMENT.md

@@ -3,7 +3,7 @@
 > **Status: canonical** — current contributor guidance, kept in sync with the
 > current release.
 
-Current release: **12.3.0 — Live Wire**.
+Current release: **12.4.0 — Sharp Weight**.
 
 This document is the contributor onboarding path: how to boot the tree, where
 a change belongs, which gates will go red, and the house rules that keep the
@@ -80,7 +80,7 @@ worker interpreter with `LTCAI_PYTHON` when both exist.
 `rust/target/release/lattice-host`, then `rust/target/debug/lattice-host`. If
 none exist it runs `cargo build -p lattice-host` (debug). A stale
 `rust/target/release/lattice-host` wins over a current debug binary — pin or
-rebuild (`cargo build -p lattice-host --release`) if `-V` is not 12.3.0.
+rebuild (`cargo build -p lattice-host --release`) if `-V` is not 12.4.0.
 
 Do not run `npm start` and `npm run dev` on the same port. The worker
 entrypoint defaults to `LATTICEAI_PORT` or **4825**, the same port as the
@@ -237,7 +237,7 @@ in `rust/`.
 Markdown) and `scripts/check_doc_status.mjs` (every relative link under the
 root canonical docs and `docs/**`). A red line is a broken relative path —
 fix the href or put the file where the href says. Canonical docs (this one
-included) must carry `Current release: **12.3.0 — …**` matching
+included) must carry `Current release: **12.4.0 — …**` matching
 `package.json`; do not bump that marker here ahead of the release lane.
 `npm run docs:check-current` is the release-set version pin
 ([`scripts/check_current_release_docs.mjs`](../scripts/check_current_release_docs.mjs)).
@@ -248,7 +248,7 @@ changelog entries that mention old versions stay.
 ### Release-evidence binding
 
 `scripts/check_release_evidence_bound.mjs` (lint member 9) checks that
-`output/release/v12.3.0/SCREENSHOT_INDEX.md` still names the live
+`output/release/v12.4.0/SCREENSHOT_INDEX.md` still names the live
 `static/app/asset-manifest.json` digest and the visual mock-server
 fingerprint. It exists so a later `npm run build:assets` cannot ship
 screenshots of an older UI, and so a mock-server edit cannot leave the
@@ -317,19 +317,19 @@ For user-facing, API, runtime, release, or packaging changes, check:
   appears
 
 The release-docs lane owns README / ARCHITECTURE / FEATURE_STATUS version
-bumps. Do not move this file's `Current release` marker off 12.3.0 ahead of
+bumps. Do not move this file's `Current release` marker off 12.4.0 ahead of
 that lane.
 
 Release/publish examples must use exact target-version filenames. Do not
 document wildcard artifact upload commands.
 
-For 12.3.0 release work, exact artifacts are:
+For 12.4.0 release work, exact artifacts are:
 
-- `dist/ltcai-12.3.0-py3-none-any.whl`
-- `dist/ltcai-12.3.0.tar.gz`
-- `ltcai-12.3.0.tgz`
-- `dist/ltcai-12.3.0.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_12.3.0_aarch64.dmg`
+- `dist/ltcai-12.4.0-py3-none-any.whl`
+- `dist/ltcai-12.4.0.tar.gz`
+- `ltcai-12.4.0.tgz`
+- `dist/ltcai-12.4.0.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_12.4.0_aarch64.dmg`
 
 The dmg is ad-hoc signed (effectively unsigned); `npm run release:validate`
 checks the names and presence, not a Developer ID signature.

package/docs/ONBOARDING.md

@@ -1,6 +1,6 @@
 # Lattice AI Onboarding
 
-Current release: **12.3.0 — Live Wire**.
+Current release: **12.4.0 — Sharp Weight**.
 
 The first-run goal is a five-minute path from "I opened the app" to "my Brain
 has a source, a question, and proof." This page is the product contract behind

package/docs/OPERATIONS.md

@@ -1,4 +1,4 @@
-# Lattice AI — Operations Guide (v12.3.0)
+# Lattice AI — Operations Guide (v12.4.0)
 
 > **Status: canonical** — kept in sync with the current release. Storage layout
 > below reflects the SQLite live Brain store and workspace scoping, not the

package/docs/ROADMAP.md

@@ -3,7 +3,7 @@
 > **Status: reference** — point-in-time inventory, redated at v12.0.0. Not a
 > canonical current-release document; version gates do not bind it.
 
-As of **2026-10-19**, against the 12.3.0 — Live Wire tree. The rows below
+As of **2026-11-11**, against the 12.4.0 — Sharp Weight tree. The rows below
 were gathered against 11.9.0 and re-checked when 12.0.0 shipped; what that
 release closed is marked closed rather than deleted, so the ledger still
 shows what was owed.

package/docs/TRUST_MODEL.md

@@ -1,6 +1,6 @@
 # Lattice AI Trust Model
 
-Current release: **12.3.0 — Live Wire**.
+Current release: **12.4.0 — Sharp Weight**.
 
 Lattice AI is local-first, explicit about external communication, and honest
 when a capability is unavailable.

package/docs/WHY_LATTICE.md

@@ -1,6 +1,6 @@
 # Why Lattice AI Exists
 
-Current release: **12.3.0 — Live Wire**.
+Current release: **12.4.0 — Sharp Weight**.
 
 **Lattice AI is a local-first Digital Brain that keeps your knowledge durable
 across any AI model.**

package/docs/kg-schema.md

@@ -1,6 +1,6 @@
 # Knowledge Graph Schema
 
-Current release: **12.3.0 — Live Wire**.
+Current release: **12.4.0 — Sharp Weight**.
 
 명세 출처: `lattice_ai_full_spec.pptx` 슬라이드 20·21·22
 구현: `lattice_brain/graph/schema.py`

package/lattice_brain/__init__.py

@@ -31,7 +31,7 @@ from .multimodal import (
     transcribe_audio,
 )
 
-__version__ = "12.3.0"
+__version__ = "12.4.0"
 
 __all__ = [
     "AudioFacts",

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "12.3.0"
+__version__ = "12.4.0"

package/latticeai/models/model_providers.py

@@ -84,6 +84,7 @@ PROVIDER_MODEL_CATALOG = {
         {"id": "anthropic/claude-opus-4.7", "name": "Claude Opus 4.7 via OpenRouter", "family": "Claude"},
         {"id": "anthropic/claude-sonnet-4.6", "name": "Claude Sonnet 4.6 via OpenRouter", "family": "Claude"},
         {"id": "anthropic/claude-haiku-4.5", "name": "Claude Haiku 4.5 via OpenRouter", "family": "Claude"},
+        {"id": "qwen/qwen3.8-27b", "name": "Qwen3.8 27B via OpenRouter", "family": "Qwen"},
         {"id": "qwen/qwen3.6-35b-a3b", "name": "Qwen3.6 35B A3B via OpenRouter", "family": "Qwen"},
         {"id": "google/gemma-4-12b-it", "name": "Gemma 4 12B via OpenRouter", "family": "Gemma"},
         {"id": "x-ai/grok-4.6", "name": "Grok 4.6 via OpenRouter", "family": "Grok"},
@@ -94,6 +95,7 @@ PROVIDER_MODEL_CATALOG = {
         {"id": "meta-llama/llama-4-scout-17b-16e-instruct", "name": "Llama 4 Scout", "family": "Llama"},
     ],
     "together": [
+        {"id": "Qwen/Qwen3.8-27B", "name": "Qwen3.8 27B", "family": "Qwen"},
         {"id": "Qwen/Qwen3.6-27B", "name": "Qwen3.6 27B", "family": "Qwen"},
         {"id": "google/gemma-4-12b-it", "name": "Gemma 4 12B", "family": "Gemma"},
         {"id": "meta-llama/Llama-4-Scout-17B-16E-Instruct", "name": "Llama 4 Scout", "family": "Llama"},

package/latticeai/services/architecture_readiness.py

@@ -19,7 +19,7 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Dict, List
 
-ARCHITECTURE_VERSION_TARGET = "12.3.0"
+ARCHITECTURE_VERSION_TARGET = "12.4.0"
 
 PREFERRED_REFACTORING_ORDER = [
     "agent-runtime",

package/latticeai/services/model_capability_registry.py

@@ -346,6 +346,32 @@ _REGISTRY: List[ModelCapability] = [
     ),
 
     # ── MoE tier (32GB+ RAM) ─────────────────────────────────────────────────
+    ModelCapability(
+        id="mlx-community/gemma-4-26B-A4B-it-qat-4bit",
+        hf_repo_id="mlx-community/gemma-4-26B-A4B-it-qat-4bit",
+        name="Gemma 4 26B A4B QAT Instruct",
+        family="Gemma 4",
+        tag="local-vlm",
+        size="15.6GB",
+        architecture="gemma4",
+        download_size_gb=15.64,
+        quantization="4bit",
+        provider_hints=["local_mlx", "ollama", "vllm", "lmstudio", "llamacpp"],
+        download_strategy="hf_hub",
+        load_strategy="mlx_vlm",
+        hardware=HardwareProfile(
+            min_ram_gb=22.0, recommended_ram_gb=32.0, apple_silicon_pref=True,
+            notes="Quantization-Aware Trained (QAT) 4-bit MoE with 8-bit shared MLP and router layers; higher accuracy than standard 4-bit PTQ on 32GB+ Apple Silicon.",
+        ),
+        source_country="미국", source_company="Google",
+        verification=VerificationStatus(
+            hf_exists=True, hf_last_checked="2026-11-11", has_config=True, has_tokenizer=True,
+            has_weights_hint=True, pipeline_tag="image-text-to-text", likes=9, license="apache-2.0",
+            notes="library_name=mlx, ungated, 3 safetensors shards, official Google QAT base.",
+            verified_by="hf-api-light",
+        ),
+        display_priority=48,
+    ),
     ModelCapability(
         id="mlx-community/gemma-4-26b-a4b-it-4bit",
         hf_repo_id="mlx-community/gemma-4-26b-a4b-it-4bit",
@@ -371,6 +397,32 @@ _REGISTRY: List[ModelCapability] = [
         ),
         display_priority=50,
     ),
+    ModelCapability(
+        id="mlx-community/gemma-4-26B-A4B-it-qat-OptiQ-4bit",
+        hf_repo_id="mlx-community/gemma-4-26B-A4B-it-qat-OptiQ-4bit",
+        name="Gemma 4 26B A4B QAT OptiQ Instruct",
+        family="Gemma 4",
+        tag="local-vlm",
+        size="21.9GB",
+        architecture="gemma4",
+        download_size_gb=21.89,
+        quantization="OptiQ-4bit",
+        provider_hints=["local_mlx"],
+        download_strategy="hf_hub",
+        load_strategy="mlx_vlm",
+        hardware=HardwareProfile(
+            min_ram_gb=28.0, recommended_ram_gb=48.0, apple_silicon_pref=True,
+            notes="Sensitivity-guided mixed 4-bit/8-bit OptiQ quantization built on Google's QAT Gemma 4 26B A4B base for higher reasoning and tool-calling fidelity.",
+        ),
+        source_country="미국", source_company="Google",
+        verification=VerificationStatus(
+            hf_exists=True, hf_last_checked="2026-11-11", has_config=True, has_tokenizer=True,
+            has_weights_hint=True, pipeline_tag="text-generation", likes=4, license="apache-2.0",
+            notes="library_name=mlx, ungated, 5 safetensors shards, mlx-optiq sensitivity-guided mixed 4/8-bit.",
+            verified_by="hf-api-light",
+        ),
+        display_priority=51,
+    ),
     ModelCapability(
         id="mlx-community/Qwen3.6-35B-A3B-4bit",
         hf_repo_id="mlx-community/Qwen3.6-35B-A3B-4bit",
@@ -398,6 +450,31 @@ _REGISTRY: List[ModelCapability] = [
     ),
 
     # ── Large tier (48GB+ RAM) ───────────────────────────────────────────────
+    ModelCapability(
+        id="mlx-community/Qwen3.8-27B-4bit",
+        hf_repo_id="mlx-community/Qwen3.8-27B-4bit",
+        name="Qwen3.8 27B",
+        family="Qwen3.8",
+        tag="local-vlm",
+        size="16.1GB",
+        architecture="qwen3_5",
+        download_size_gb=16.08,
+        quantization="4bit",
+        provider_hints=["local_mlx", "ollama", "vllm", "lmstudio", "llamacpp"],
+        download_strategy="hf_hub",
+        load_strategy="mlx_vlm",
+        hardware=HardwareProfile(
+            min_ram_gb=24.0, recommended_ram_gb=48.0, apple_silicon_pref=True,
+            notes="Latest Qwen 3.8 27B dense multimodal model; higher coding, reasoning, and agentic tool accuracy than Qwen 3.6 27B at identical 16.1GB 4-bit footprint.",
+        ),
+        source_country="중국", source_company="Alibaba",
+        verification=VerificationStatus(
+            hf_exists=True, hf_last_checked="2026-11-11", has_config=True, has_tokenizer=True,
+            has_weights_hint=True, pipeline_tag="image-text-to-text", likes=237, license="apache-2.0",
+            notes="library_name=mlx, ungated, 3 safetensors shards.", verified_by="hf-api-light",
+        ),
+        display_priority=52,
+    ),
     ModelCapability(
         id="mlx-community/Qwen3.6-27B-4bit",
         hf_repo_id="mlx-community/Qwen3.6-27B-4bit",

package/latticeai/services/model_catalog.py

@@ -135,15 +135,28 @@ _ENGINE_ROUTES: Dict[str, Dict[str, str]] = {
         "mlx-community/gemma-4-12B-it-4bit", "ggml-org/gemma-4-12B-it-GGUF", "google/gemma-4-12B-it",
         ollama_tag="Q4_0",
     ),
+    "mlx-community/gemma-4-26B-A4B-it-qat-4bit": _gguf_routes(
+        "mlx-community/gemma-4-26B-A4B-it-qat-4bit", "google/gemma-4-26B-A4B-it-qat-q4_0-gguf",
+        "google/gemma-4-26B-A4B-it-qat-q4_0-unquantized",
+        ollama_tag="Q4_0",
+    ),
     "mlx-community/gemma-4-26b-a4b-it-4bit": _gguf_routes(
         "mlx-community/gemma-4-26b-a4b-it-4bit", "ggml-org/gemma-4-26B-A4B-it-GGUF",
         "google/gemma-4-26B-A4B-it",
         ollama_tag="Q4_0",
     ),
+    "mlx-community/gemma-4-26B-A4B-it-qat-OptiQ-4bit": _gguf_routes(
+        "mlx-community/gemma-4-26B-A4B-it-qat-OptiQ-4bit", "unsloth/gemma-4-26B-A4B-it-GGUF",
+        "google/gemma-4-26B-A4B-it-qat-q4_0-unquantized",
+        ollama_tag="Q4_0",
+    ),
     "mlx-community/gemma-4-31b-it-4bit": _gguf_routes(
         "mlx-community/gemma-4-31b-it-4bit", "ggml-org/gemma-4-31B-it-GGUF", "google/gemma-4-31B-it",
         ollama_tag="Q4_0",
     ),
+    "mlx-community/Qwen3.8-27B-4bit": _gguf_routes(
+        "mlx-community/Qwen3.8-27B-4bit", "ggml-org/Qwen3.8-27B-GGUF", "Qwen/Qwen3.8-27B",
+    ),
     "mlx-community/Qwen3.6-27B-4bit": _gguf_routes(
         "mlx-community/Qwen3.6-27B-4bit", "ggml-org/Qwen3.6-27B-GGUF", "Qwen/Qwen3.6-27B",
     ),
@@ -164,6 +177,11 @@ _ENGINE_ROUTES: Dict[str, Dict[str, str]] = {
 # is no other Gemma 4 26B — and resolving that to nothing would be pedantry.
 _COMMON_MISNAMES: Dict[str, str] = {
     "gemma-4-26b-it-4bit": "mlx-community/gemma-4-26b-a4b-it-4bit",
+    "gemma-4-26b-qat-4bit": "mlx-community/gemma-4-26B-A4B-it-qat-4bit",
+    "gemma-4-26b-a4b-qat-4bit": "mlx-community/gemma-4-26B-A4B-it-qat-4bit",
+    "gemma-4-26b-optiq-4bit": "mlx-community/gemma-4-26B-A4B-it-qat-OptiQ-4bit",
+    "qwen-3.8-27b-4bit": "mlx-community/Qwen3.8-27B-4bit",
+    "qwen3.8-27b": "mlx-community/Qwen3.8-27B-4bit",
 }
 
 # Keyed by both the lowercase short name ("gemma-4-12b-it-4bit") and the

package/latticeai/services/model_engines.py

@@ -112,6 +112,8 @@ def _json_request(
     payload: Optional[Dict[str, Any]] = None,
     timeout: float = 10.0,
 ) -> Dict[str, Any]:
+    if not str(url).startswith(("http://", "https://")):
+        raise ValueError(f"Unsupported URL scheme in {url!r}")
     data = None
     req_headers = dict(headers or {})
     if payload is not None:
@@ -225,7 +227,7 @@ def get_openai_compatible_server_models(provider: str) -> List[str]:
     config = OPENAI_COMPATIBLE_PROVIDERS.get(provider) or {}
     base_url = os.getenv(config.get("base_url_env", "")) if config.get("base_url_env") else None
     base_url = (base_url or config.get("base_url") or "").rstrip("/")
-    if not base_url:
+    if not base_url or not base_url.startswith(("http://", "https://")):
         return []
 
     api_key = os.getenv(config.get("env_key", "")) or config.get("api_key_fallback") or provider

package/latticeai/services/product_readiness.py

@@ -28,7 +28,7 @@ from typing import Any, Dict, List
 
 from latticeai.services.architecture_readiness import architecture_readiness
 
-PRODUCT_VERSION_TARGET = "12.3.0"
+PRODUCT_VERSION_TARGET = "12.4.0"
 
 
 @dataclass(frozen=True)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ltcai",
-  "version": "12.3.0",
+  "version": "12.4.0",
   "description": "Lattice AI — local-first Digital Brain that keeps your knowledge durable across any AI model.",
   "homepage": "https://github.com/TaeSooPark-PTS/LatticeAI#readme",
   "repository": {
@@ -140,7 +140,7 @@
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
-    "@vitest/coverage-v8": "^4.1.10",
+    "@vitest/coverage-v8": "^4.1.12",
     "autoprefixer": "^10.5.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -157,7 +157,7 @@
     "tailwindcss": "^4.3.0",
     "typescript": "^5.9.3",
     "vite": "^8.0.16",
-    "vitest": "^4.1.10",
+    "vitest": "^4.1.12",
     "zustand": "^5.0.14"
   },
   "overrides": {

package/requirements.txt

@@ -2,10 +2,12 @@ fastapi>=0.110,<1
 uvicorn>=0.29,<1
 pydantic>=2.7,<3
 httpx>=0.27,<1
-pillow>=10,<13
+pillow>=13,<14
 openai>=1.30,<3
 python-docx>=1.1,<2
 openpyxl>=3.1,<4
 python-pptx>=0.6.23,<2
 keyring>=24,<26
 pdfplumber>=0.11,<0.12
+reportlab>=4,<5
+huggingface_hub>=1.0,<2

package/scripts/check_current_release_docs.mjs

@@ -6,7 +6,7 @@ const root = process.cwd();
 const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
 const version = pkg.version;
 const releaseDir = `output/release/v${version}`;
-const releaseTheme = "Live Wire";
+const releaseTheme = "Sharp Weight";
 const title = `${version} — ${releaseTheme}`;
 const escapedVersion = version.replaceAll(".", "\\.");
 

package/scripts/release_screen_claims.json

@@ -20,6 +20,17 @@
     "whole-image delta: naming where the change is makes the claim more",
     "specific, not less."
   ],
+  "12.4.0": {
+    "_why": [
+      "Sharp Weight is a model catalog and security audit release: Qwen 3.8 27B",
+      "4-bit and Gemma 4 26B A4B QAT / QAT-OptiQ 4-bit catalog expansion,",
+      "Pillow 13.0.0 and npm lockfile vulnerability closure, model_engines",
+      "URL scheme validation, and scoped Tailwind CSS v4 source scanning.",
+      "",
+      "No screen was redesigned. Empty claim set on purpose. Unclaimed screens",
+      "are still measured and printed; they are not gated."
+    ]
+  },
   "12.3.0": {
     "_why": [
       "Live Wire is a backend and runtime release: verified Hugging Face GGUF",