ltcai 3.1.0 → 3.2.0

package/README.md

@@ -16,7 +16,7 @@
 [![npm version](https://img.shields.io/npm/v/ltcai?label=npm)](https://www.npmjs.com/package/ltcai)
 [![VS Code Marketplace](https://vsmarketplacebadges.dev/version-short/parktaesoo.ltcai.svg)](https://marketplace.visualstudio.com/items?itemName=parktaesoo.ltcai)
 [![Open VSX](https://img.shields.io/open-vsx/v/parktaesoo/ltcai?label=Open%20VSX)](https://open-vsx.org/extension/parktaesoo/ltcai)
-[![GitHub release](https://img.shields.io/github/v/release/TaeSooPark-PTS/LatticeAI?label=GitHub%20release)](https://github.com/TaeSooPark-PTS/LatticeAI/releases/tag/v3.1.0)
+[![GitHub release](https://img.shields.io/github/v/release/TaeSooPark-PTS/LatticeAI?label=GitHub%20release)](https://github.com/TaeSooPark-PTS/LatticeAI/releases/tag/v3.2.0)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue)](https://www.python.org/)
 [![VS Code extension](https://img.shields.io/badge/VS%20Code-extension-blue?logo=visualstudiocode)](https://marketplace.visualstudio.com/items?itemName=parktaesoo.ltcai)
@@ -49,7 +49,7 @@ Install the coding extension:
 
 - [VS Code Marketplace: parktaesoo.ltcai](https://marketplace.visualstudio.com/items?itemName=parktaesoo.ltcai)
 - [Open VSX: parktaesoo.ltcai](https://open-vsx.org/extension/parktaesoo/ltcai)
-- [GitHub Release v3.1.0](https://github.com/TaeSooPark-PTS/LatticeAI/releases/tag/v3.1.0)
+- [GitHub Release v3.2.0](https://github.com/TaeSooPark-PTS/LatticeAI/releases/tag/v3.2.0)
 
 ## Quick Start
 
@@ -122,11 +122,36 @@ and disconnected automations. Lattice AI keeps those parts together:
 - multi-agent workflows leave behind replayable plans, reviews, retries, and
   outcomes.
 
-## v3.1.0 Highlights
-
-Lattice AI v3.1.0 completes the non-enterprise local-first workspace platform
-around `/app`: Classic is retired from normal workflows, retrieval is wired
-through a shared service layer, and browser assets are hash-manifested.
+## v3.2.0 Highlights
+
+Lattice AI v3.2.0 is the feature-complete release for all non-enterprise use
+cases. Every platform capability is operable from `/app` with no Classic
+dependency — built on real backends with honest live/unavailable states (never
+fabricated data).
+
+- **Multi-agent collaboration** — Planner → Researcher → Executor → Reviewer
+  with handoffs, shared context packets, and replayable timelines.
+- **Agent Registry** — every agent (built-in role + custom) carries registry
+  metadata: type, version, capabilities, and configuration. No hardcoded lists.
+- **Marketplace & Templates** — an offline catalog with five named agent
+  templates (Research Assistant, Coding Assistant, Knowledge Curator,
+  Documentation Writer, Workflow Builder) plus clone / export / import / install.
+- **Workflow Agents** — trigger → agent chain → tools → memory → result, with a
+  run ledger and replay.
+- **Autonomous Planning** — goal → plan → execute → review → replan, with
+  inspect/replay and bounded-retry safeguards.
+- **Long-Term Memory + Memory Manager** — workspace, project, agent,
+  conversation, graph, and vector tiers unified behind one service, with
+  recall, inspect, prune, compact, rebuild, and clear.
+- **Skills, Hooks, Tool Registry, and MCP Manager** — install/enable/disable
+  skills; lifecycle hooks across runs/tools/agents/pipelines/workflows; a
+  governed tool registry; and connected MCP servers, tools, and health.
+
+The earlier v3.1 work (Classic retired from normal workflows, retrieval wired
+through a shared service layer, hash-manifested assets) remains the foundation.
+
+Release audit: [docs/V3_2_AUDIT.md](docs/V3_2_AUDIT.md) records the v3.2.0
+claim audit, fixes, tests, real-app browser validation, and artifact checks.
 
 - Native v3 Chat lives inside `/app#/chat` and streams through the real
   `POST /chat` backend while showing friendly setup guidance when no model is
@@ -265,7 +290,8 @@ Core areas:
 
 | Version | Theme |
 | --- | --- |
-| **3.1.0** | Mainline platform completion — native `/app` workflows, Classic retired from normal paths, production embedding profiles, AgentRuntime/registries, hashed v3 assets |
+| **3.2.0** | Feature-complete platform — multi-agent collaboration, agent registry, marketplace + templates, workflow agents, autonomous planning, long-term memory + manager, skills/hooks/tool registries, MCP manager, all operable from `/app` |
+| 3.1.0 | Mainline platform completion — native `/app` workflows, Classic retired from normal paths, production embedding profiles, AgentRuntime/registries, hashed v3 assets |
 | 3.0.1 | Release-blocker remediation — provider-backed embeddings (Hash/MLX/Ollama/OpenAI/Custom), unified AgentRuntime boundary, every v3 surface connected or clearly unavailable |
 | 3.0.0 | v3 local-first AI workspace platform — `/app`, Native Chat, Knowledge Graph, Vector Index, Hybrid Search, workspace modes |
 | 2.2.7 | Visual system stabilization — cohesive dark/light screens, crisp chat composer, dark graph canvas, Workspace OS polish |

package/docs/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## [3.2.0] - 2026-06-08
+
+> v3.2 — Feature-Complete Platform. Multi-agent collaboration, an agent
+> registry, marketplace + templates, workflow agents, autonomous planning, a
+> long-term memory platform + manager, and skills/hooks/tool/MCP registries are
+> all operable from `/app`. Enterprise (SSO/SCIM/RBAC/compliance/DLP/VPC/
+> governance/multi-tenant controls) remains future work.
+
+### Added
+
+- **Agent Registry** — `latticeai/core/agent_registry.py` +
+  `/agents/api/registry*`: built-in roles projected from `multi_agent`,
+  persisted custom agents, capability discovery, and per-agent config.
+- **Hooks platform** — `latticeai/core/hooks.py` + `/api/hooks/*`: persisted
+  lifecycle registry (pre_run/post_run/pre_tool/post_tool/agent/pipeline/
+  workflow) with enable/disable/reorder/register/inspect.
+- **Long-term memory platform + Memory Manager** —
+  `latticeai/services/memory_service.py` + `/api/memory/*`: unifies workspace
+  memories, agent snapshots, conversation history, and KG graph/vector behind
+  one façade; recall/inspect/prune/compact/rebuild/clear + usage/sources/health.
+- **Agent templates** — five named templates in `latticeai/core/marketplace.py`
+  plus a `clone` endpoint; `MARKETPLACE_VERSION`/`PLUGIN_SDK_VERSION`/
+  `MULTI_AGENT_VERSION` → `3.2.0`.
+- **MCP Manager surface** — `create_mcp_router` mounted through the tools router
+  in `server_app`, reviving `/mcp/*`, `/skills/marketplace`,
+  `/plugins/directory`, `/mcp/call`.
+- **Eight `/app` views** — memory, planning, workflows, marketplace, skills,
+  hooks, tools, mcp; a Platform nav group; fallback-safe `api.js` adapters.
+- **Release claim audit** — `docs/V3_2_AUDIT.md` records a strict 20-claim
+  PASS/PARTIAL/FAIL matrix with implementation evidence, fixes, validation,
+  artifact readiness, and release metadata policy.
+
+### Changed
+
+- Version bumped to 3.2.0 across Python, npm, the VS Code extension, the v3
+  asset manifest, and runtime version constants.
+- `/app#/agents` now exposes the Agent Registry API directly, including
+  registry metadata, capability discovery, enablement, and custom-agent
+  registration.
+- `/app#/skills` now normalizes the live `/workspace/skills` response shape
+  (`installed`, `available`, and object/array `registry`) instead of only a
+  legacy `skills` array.
+- MCP/skills/plugin-directory routes are mounted once through the tools router;
+  route compatibility tests now guard against duplicate public path/method
+  registrations.
+
+### Notes
+
+- Validation covered lint, typecheck, Python compile, 365 unit tests, live
+  integration tests, 90 Playwright tests, real `/app` browser route validation,
+  Python/npm/VSIX builds, and exact-version release artifact validation.
+- No packages were published and nothing was deployed.
+
 ## [3.1.0] - 2026-06-07
 
 > v3.1 — Mainline Product Platform Completion. `/app` is now the full

package/docs/V3_2_AUDIT.md

@@ -0,0 +1,82 @@
+# Lattice AI v3.2.0 Release Claim Audit
+
+Audit date: 2026-06-08
+Target version: 3.2.0
+Scope: code, API routes, frontend views, adapters, tests, runtime/browser behavior, artifacts, tag/release metadata.
+
+## Verdict
+
+Final source verdict: PASS after release-hardening fixes.
+
+The audit found two UI wiring gaps and one release-route hygiene issue:
+
+- `/app#/agents` showed AgentRuntime state but did not expose the Agent Registry controls and capability index from `/agents/api/registry*`.
+- `/app#/skills` called the live skill registry but only normalized a legacy `{ skills: [...] }` shape, so the real `{ installed, available, registry }` payload rendered as empty.
+- `server_app` registered the MCP router twice because `create_tools_router` already mounted the MCP/skills/plugin-directory routes.
+
+All three were fixed and covered by tests. No product scope was added.
+
+## PASS / PARTIAL / FAIL Matrix
+
+| # | Claim | Status | Evidence |
+|---|---|---|---|
+| 1 | Multi-Agent Collaboration | PASS | `latticeai/core/multi_agent.py`, `latticeai/services/agent_runtime.py`, `/agents/api/run`, handoffs/context packets/replay tests in `tests/unit/test_multi_agent.py` and `tests/unit/test_agent_platform_maturity.py`. |
+| 2 | Agent Registry | PASS | `latticeai/core/agent_registry.py`, `latticeai/api/agent_registry.py`, `/agents/api/registry*`, `/app#/agents` registry section, visual coverage in `tests/visual/v3.spec.js`. |
+| 3 | Agent Marketplace | PASS | `latticeai/core/marketplace.py`, `latticeai/api/marketplace.py`, `/marketplace/templates`, `/app#/marketplace`. Offline local catalog; no cloud marketplace is claimed. |
+| 4 | Agent Templates | PASS | Five named agent templates: Research Assistant, Coding Assistant, Knowledge Curator, Documentation Writer, Workflow Builder; clone/export/import/install covered in `tests/unit/test_v32_platform.py`. |
+| 5 | Workflow Agents | PASS | `latticeai/core/workflow_engine.py`, `latticeai/api/workflow_designer.py`, `PlatformRuntime.build_workflow_runners`, `/app#/workflows`, workflow run/replay tests. |
+| 6 | Autonomous Planning | PASS | Planner/executor/reviewer flow via `/agents/api/run`, bounded retry/replan history in `MultiAgentOrchestrator`, `/app#/planning`, retry tests. |
+| 7 | Long-Term Memory Platform | PASS | `latticeai/services/memory_service.py` unifies workspace/project/agent/conversation/graph/vector tiers; `/api/memory/*`. |
+| 8 | Memory Manager | PASS | Usage/sources/health plus recall/inspect/prune/compact/rebuild/clear in `MemoryService` and `/app#/memory`. |
+| 9 | Skills Registry | PASS | `WorkspaceOSStore.list_skill_registry`, `/workspace/skills*`, `/app#/skills`; fixed live payload normalization and added visual coverage. |
+| 10 | Hooks Registry | PASS | `latticeai/core/hooks.py`, `latticeai/api/hooks.py`, `/api/hooks*`, `/app#/hooks`, unit tests for toggle/register/inspect/remove. |
+| 11 | Tool Registry | PASS | `latticeai/core/tool_registry.py`, `latticeai/services/tool_dispatch.py`, `/tools/permissions`, `/mcp/tools`, `/app#/tools`, route duplicate guard. |
+| 12 | MCP Foundation / MCP Manager | PASS | `latticeai/api/mcp.py`, `/mcp/tools`, `/mcp/installed`, `/mcp/custom`, `/mcp/claude-code-servers`, `/app#/mcp`; duplicate mount removed. |
+| 13 | Retrieval & Memory Integration | PASS | `latticeai/api/search.py`, `latticeai/services/search_service.py`, `MemoryService.recall`, `/api/search/hybrid`, `/api/index/status`, `/api/graph`, `/api/memory/recall`. |
+| 14 | UX Completion Pass | PASS | `/app` routes render without Classic dependency, console errors, app 404/500 responses, or horizontal overflow in real browser validation. Light/dark toggle validated. |
+| 15 | Documentation refresh | PASS | README, release notes/changelogs, release guide, and this audit document updated for the hardening pass. |
+| 16 | Architecture refresh | PASS | Architecture docs already describe the v3.2 runtime/registry boundaries; code now matches those boundaries without duplicate MCP route registration. |
+| 17 | Version 3.2.0 consistency | PASS | `package.json`, `pyproject.toml`, `vscode-extension/package.json`, runtime constants, and expected artifacts remain at 3.2.0. |
+| 18 | Tests | PASS | Lint/typecheck/python compile, 365 unit tests, live integration tests, 90 Playwright tests, and real-app browser route validation passed. |
+| 19 | Build artifacts | PASS | Rebuilt Python sdist/wheel, npm tarball, VSIX, and validated exact v3.2.0 artifact names. |
+| 20 | Git tag and GitHub Release metadata | PASS | Source policy keeps version 3.2.0; tag/release metadata should point at the final validated main commit. No package assets were attached or published. |
+
+## Fixes Applied
+
+### Agent Registry UI wiring
+
+- Finding: Agent Registry backend and adapter existed, but `/app#/agents` only rendered the runtime roster.
+- Affected files: `static/v3/js/views/agents.js`, hashed v3 assets, `tests/visual/v3.spec.js`, `tests/visual/mock_server.cjs`.
+- Expected behavior: `/app#/agents` exposes built-in/custom registry metadata, versions, capabilities, enabled state, and registration.
+- Actual behavior before fix: Registry data was reachable only through API/adapters, not the product view.
+- Fix: Added a live Agent Registry section, custom-agent registration controls, capability index display, enable/disable/remove actions, and Playwright coverage.
+
+### Skills registry live payload normalization
+
+- Finding: `/workspace/skills` returned `{ installed, available, registry }`, but `/app#/skills` only accepted a legacy `{ skills }` array.
+- Affected files: `static/v3/js/views/skills.js`, hashed v3 assets, `tests/visual/v3.spec.js`, `tests/visual/mock_server.cjs`.
+- Expected behavior: installed and available skills render from the real registry payload.
+- Actual behavior before fix: live registry payload could render as an empty state.
+- Fix: Normalized installed, available, array registry, and object registry shapes with de-duplication by skill name.
+
+### Duplicate MCP route registration
+
+- Finding: `create_tools_router` already included the MCP router, and `server_app` mounted it again.
+- Affected files: `latticeai/server_app.py`, `tests/unit/test_route_compatibility.py`.
+- Expected behavior: every public path/method has one handler.
+- Actual behavior before fix: duplicate MCP/skills/plugin-directory path registrations.
+- Fix: Removed the second MCP include and added a route duplicate guard.
+
+## Validation Summary
+
+- `npm run lint`: PASS
+- `npm run typecheck`: PASS
+- `npm run check:python`: PASS
+- `./venv/bin/python -m pytest tests/unit -v`: PASS, 365 passed
+- `LTCAI_TEST_BASE_URL=http://127.0.0.1:8899 ./venv/bin/python -m pytest tests/integration -v`: PASS, 9 passed
+- `npx playwright test`: PASS, 90 passed
+- Real app browser validation: PASS for `/app`, `/app#/chat`, `/app#/planning`, `/app#/workflows`, `/app#/marketplace`, `/app#/memory`, `/app#/skills`, `/app#/hooks`, `/app#/tools`, `/app#/mcp`, `/app#/agents`, `/app#/models`, `/app#/knowledge-graph`, `/app#/hybrid-search`, `/app#/settings` across desktop/mobile, including no console/page errors, no app 404/500 responses, no horizontal overflow, no Classic dependency text, and light/dark toggle.
+
+## Release Readiness
+
+READY FOR MANUAL PACKAGE PUBLICATION once the v3.2.0 tag and GitHub Release notes point at the final validated main commit. No package publication or deployment was performed by this audit.

package/docs/V3_FRONTEND.md

@@ -98,7 +98,7 @@ first and returns `{ ok, status, data, source }` where `source` is `"live"` or
 `"unavailable"`. Unavailable responses carry empty data so primary surfaces do
 not invent counters, sample graphs, fake health, or fake run history.
 
-Live surfaces wired in v3.1.0:
+Core live surfaces established before v3.2.0:
 
 | Adapter | Endpoint | Unavailable state |
 | --- | --- | --- |

package/docs/architecture.md

@@ -1,5 +1,11 @@
 # Lattice AI Architecture
 
+> v3.2.0 — feature-complete for non-enterprise use cases. The agent ecosystem
+> (registry, marketplace + templates, workflow agents, autonomous planning),
+> the long-term memory platform + manager, and the skills/hooks/tool/MCP
+> registries are all operable from `/app`. Enterprise controls remain future
+> work.
+
 Lattice AI is a local-first **AI workspace, AI pipeline platform, Knowledge
 Graph platform, and multi-agent workflow platform**. The architecture is
 organized around one durable center: the Knowledge Graph. Models, tools,

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "3.1.0"
+__version__ = "3.2.0"

package/latticeai/api/agent_registry.py

@@ -0,0 +1,103 @@
+"""Agent Registry API router (v3.2.0).
+
+Exposes :class:`~latticeai.core.agent_registry.AgentRegistry` so registration,
+discovery, metadata, versioning, capabilities, and configuration are reachable
+from the /app Agents view. Paths sit under ``/agents/api/registry`` alongside
+the existing runtime endpoints. Full paths in decorators (no ``prefix=``).
+"""
+
+from __future__ import annotations
+
+from typing import Any, Callable, Dict, List, Optional
+
+from fastapi import APIRouter, HTTPException, Request
+from pydantic import BaseModel
+
+from latticeai.core.agent_registry import AgentRegistry
+
+
+class AgentRegisterRequest(BaseModel):
+    name: str
+    type: str = "custom"
+    description: str = ""
+    capabilities: List[str] = []
+    config: Dict[str, Any] = {}
+    version: str = "1.0.0"
+
+
+class AgentConfigRequest(BaseModel):
+    config: Dict[str, Any] = {}
+    enabled: Optional[bool] = None
+
+
+def create_agent_registry_router(
+    *,
+    registry: AgentRegistry,
+    require_user: Callable[[Request], str],
+    append_audit_event: Callable[..., None],
+) -> APIRouter:
+    router = APIRouter()
+
+    @router.get("/agents/api/registry")
+    async def list_registry(request: Request, type: Optional[str] = None):
+        require_user(request)
+        return registry.list(agent_type=type)
+
+    @router.get("/agents/api/registry/capabilities")
+    async def registry_capabilities(request: Request):
+        require_user(request)
+        return {"capabilities": registry.capabilities()}
+
+    @router.get("/agents/api/registry/discover")
+    async def registry_discover(request: Request, capability: str = ""):
+        require_user(request)
+        return {"capability": capability, "agents": registry.discover(capability)}
+
+    @router.post("/agents/api/registry")
+    async def register_agent(req: AgentRegisterRequest, request: Request):
+        user = require_user(request)
+        try:
+            entry = registry.register(
+                name=req.name,
+                agent_type=req.type,
+                description=req.description,
+                capabilities=req.capabilities,
+                config=req.config,
+                version=req.version,
+            )
+        except ValueError as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+        append_audit_event("agent_register", user_email=user, agent_id=entry["id"], type=entry["type"])
+        return {"agent": entry}
+
+    @router.get("/agents/api/registry/{agent_id:path}")
+    async def get_agent(agent_id: str, request: Request):
+        require_user(request)
+        agent = registry.get(agent_id)
+        if agent is None:
+            raise HTTPException(status_code=404, detail=f"Agent not found: {agent_id}")
+        return {"agent": agent}
+
+    @router.patch("/agents/api/registry/{agent_id:path}")
+    async def update_agent(agent_id: str, req: AgentConfigRequest, request: Request):
+        user = require_user(request)
+        try:
+            agent = registry.update_config(agent_id, req.config, enabled=req.enabled)
+        except KeyError as exc:
+            raise HTTPException(status_code=404, detail=f"Agent not found: {agent_id}") from exc
+        append_audit_event("agent_config", user_email=user, agent_id=agent_id)
+        return {"agent": agent}
+
+    @router.delete("/agents/api/registry/{agent_id:path}")
+    async def remove_agent(agent_id: str, request: Request):
+        user = require_user(request)
+        try:
+            result = registry.remove(agent_id)
+        except KeyError as exc:
+            raise HTTPException(status_code=404, detail=f"Agent not found: {agent_id}") from exc
+        except ValueError as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+        append_audit_event("agent_remove", user_email=user, agent_id=agent_id)
+        return result
+
+    return router

package/latticeai/api/hooks.py

@@ -0,0 +1,113 @@
+"""Hooks platform API router (v3.2.0).
+
+Exposes the lifecycle :class:`~latticeai.core.hooks.HooksRegistry` over HTTP so
+the /app Hooks view can list, inspect, enable/disable, reorder, and register
+hooks. Full paths live in the decorators (no ``prefix=``), matching the rest of
+the API.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Callable, List, Optional
+
+from fastapi import APIRouter, HTTPException, Request
+from pydantic import BaseModel
+
+from latticeai.core.hooks import HooksRegistry
+
+
+class HookToggleRequest(BaseModel):
+    hook_id: str
+    enabled: bool = True
+
+
+class HookReorderRequest(BaseModel):
+    kind: str
+    ordered_ids: List[str] = []
+
+
+class HookRegisterRequest(BaseModel):
+    name: str
+    kind: str
+    description: str = ""
+    command: str = ""
+    order: Optional[int] = None
+    enabled: bool = True
+
+
+def create_hooks_router(
+    *,
+    registry: HooksRegistry,
+    require_user: Callable[[Request], str],
+    append_audit_event: Callable[..., None],
+) -> APIRouter:
+    router = APIRouter()
+
+    @router.get("/api/hooks")
+    async def list_hooks(request: Request, kind: Optional[str] = None):
+        require_user(request)
+        return registry.list(kind=kind)
+
+    @router.get("/api/hooks/{hook_id:path}")
+    async def inspect_hook(hook_id: str, request: Request):
+        require_user(request)
+        try:
+            return {"hook": registry.inspect(hook_id)}
+        except KeyError as exc:
+            raise HTTPException(status_code=404, detail=f"Hook not found: {hook_id}") from exc
+
+    @router.post("/api/hooks/enable")
+    async def enable_hook(req: HookToggleRequest, request: Request):
+        user = require_user(request)
+        try:
+            hook = registry.set_enabled(req.hook_id, req.enabled)
+        except KeyError as exc:
+            raise HTTPException(status_code=404, detail=f"Hook not found: {req.hook_id}") from exc
+        append_audit_event("hook_toggle", user_email=user, hook_id=req.hook_id, enabled=req.enabled)
+        return {"hook": hook}
+
+    @router.post("/api/hooks/disable")
+    async def disable_hook(req: HookToggleRequest, request: Request):
+        user = require_user(request)
+        try:
+            hook = registry.set_enabled(req.hook_id, False)
+        except KeyError as exc:
+            raise HTTPException(status_code=404, detail=f"Hook not found: {req.hook_id}") from exc
+        append_audit_event("hook_toggle", user_email=user, hook_id=req.hook_id, enabled=False)
+        return {"hook": hook}
+
+    @router.post("/api/hooks/reorder")
+    async def reorder_hooks(req: HookReorderRequest, request: Request):
+        require_user(request)
+        return registry.reorder(req.kind, req.ordered_ids)
+
+    @router.post("/api/hooks/register")
+    async def register_hook(req: HookRegisterRequest, request: Request):
+        user = require_user(request)
+        try:
+            entry = registry.register(
+                name=req.name,
+                kind=req.kind,
+                description=req.description,
+                command=req.command,
+                order=req.order,
+                enabled=req.enabled,
+            )
+        except ValueError as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+        append_audit_event("hook_register", user_email=user, hook_id=entry["id"], kind=entry["kind"])
+        return {"hook": entry}
+
+    @router.delete("/api/hooks/{hook_id:path}")
+    async def remove_hook(hook_id: str, request: Request):
+        user = require_user(request)
+        try:
+            result = registry.remove(hook_id)
+        except KeyError as exc:
+            raise HTTPException(status_code=404, detail=f"Hook not found: {hook_id}") from exc
+        except ValueError as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+        append_audit_event("hook_remove", user_email=user, hook_id=hook_id)
+        return result
+
+    return router

package/latticeai/api/marketplace.py

@@ -16,6 +16,10 @@ class TemplateInstallRequest(BaseModel):
     data: Dict[str, Any] = {}
 
 
+class TemplateCloneRequest(BaseModel):
+    name: Optional[str] = None
+
+
 def create_marketplace_router(
     *,
     store,
@@ -72,6 +76,15 @@ def create_marketplace_router(
             raise HTTPException(status_code=400, detail=str(exc)) from exc
         return {"installed": installed}
 
+    @router.post("/marketplace/templates/{kind}/{template_id}/clone")
+    async def clone_template(kind: str, template_id: str, req: TemplateCloneRequest, request: Request):
+        require_user(request)
+        gate_read(request)
+        try:
+            return {"template": catalog.clone_template(kind, template_id, req.name)}
+        except MarketplaceError as exc:
+            raise HTTPException(status_code=404, detail=str(exc)) from exc
+
     @router.get("/marketplace/templates/registry")
     async def template_registry(request: Request):
         require_user(request)

package/latticeai/api/memory.py

@@ -0,0 +1,109 @@
+"""Memory platform + Memory Manager API router (v3.2.0).
+
+Exposes :class:`~latticeai.services.memory_service.MemoryService` so the /app
+Memory view can inspect every memory tier, recall across them, and run manager
+operations (prune / compact / rebuild / clear). Full paths in decorators.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Callable, List, Optional
+
+from fastapi import APIRouter, HTTPException, Request
+from pydantic import BaseModel
+
+from latticeai.services.memory_service import MemoryService
+
+
+class RecallRequest(BaseModel):
+    query: str = ""
+    limit: int = 20
+
+
+class PruneRequest(BaseModel):
+    ids: List[str] = []
+    kind: Optional[str] = None
+
+
+class RebuildRequest(BaseModel):
+    target: str = "vector"
+
+
+class ClearRequest(BaseModel):
+    scope: str
+    confirm: bool = False
+
+
+def create_memory_router(
+    *,
+    service: MemoryService,
+    require_user: Callable[[Request], str],
+    get_current_user: Callable[[Request], Optional[str]],
+    gate_read: Callable[[Request], Optional[str]],
+    gate_write: Callable[[Request], Optional[str]],
+    append_audit_event: Callable[..., None],
+) -> APIRouter:
+    router = APIRouter()
+
+    @router.get("/api/memory/manager")
+    async def memory_manager(request: Request):
+        user = require_user(request)
+        scope = gate_read(request)
+        return service.manager(user_email=user, workspace_id=scope)
+
+    @router.get("/api/memory/tiers")
+    async def memory_tiers(request: Request):
+        require_user(request)
+        return service.tiers()
+
+    @router.get("/api/memory/inspect")
+    async def memory_inspect(request: Request, source: str, limit: int = 50):
+        user = require_user(request)
+        scope = gate_read(request)
+        try:
+            return service.inspect(source, user_email=user, workspace_id=scope, limit=limit)
+        except KeyError as exc:
+            raise HTTPException(status_code=404, detail=f"Unknown memory source: {source}") from exc
+
+    @router.post("/api/memory/recall")
+    async def memory_recall(req: RecallRequest, request: Request):
+        user = require_user(request)
+        scope = gate_read(request)
+        return service.recall(req.query, user_email=user, workspace_id=scope, limit=req.limit)
+
+    @router.post("/api/memory/prune")
+    async def memory_prune(req: PruneRequest, request: Request):
+        user = require_user(request)
+        gate_write(request)
+        result = service.prune(ids=req.ids, kind=req.kind, user_email=user)
+        append_audit_event("memory_prune", user_email=user, count=result.get("count", 0))
+        return result
+
+    @router.post("/api/memory/compact")
+    async def memory_compact(request: Request):
+        user = require_user(request)
+        gate_write(request)
+        result = service.compact(user_email=user)
+        append_audit_event("memory_compact", user_email=user, compacted=result.get("compacted", 0))
+        return result
+
+    @router.post("/api/memory/rebuild")
+    async def memory_rebuild(req: RebuildRequest, request: Request):
+        user = require_user(request)
+        gate_write(request)
+        result = service.rebuild(req.target)
+        append_audit_event("memory_rebuild", user_email=user, target=req.target, status=result.get("status"))
+        return result
+
+    @router.post("/api/memory/clear")
+    async def memory_clear(req: ClearRequest, request: Request):
+        user = require_user(request)
+        gate_write(request)
+        try:
+            result = service.clear(scope=req.scope, confirm=req.confirm, user_email=user)
+        except ValueError as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+        append_audit_event("memory_clear", user_email=user, scope=req.scope)
+        return result
+
+    return router