ltcai 3.6.0 → 4.0.0

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "3.6.0"
+__version__ = "4.0.0"

package/latticeai/api/admin.py

@@ -2,7 +2,7 @@
 
 import logging
 from collections import defaultdict
-from typing import Any, Callable, Dict, List, Optional
+from typing import Callable, Dict, List, Optional
 
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel

package/latticeai/api/agents.py

@@ -163,7 +163,13 @@ def create_agents_router(
         current_user = require_user(request)
         scope = gate_write(request)
         try:
-            return runtime.start(
+            # Worker thread: an LLM-backed run blocks on model generation and
+            # must not stall the event loop (the sync model bridge also
+            # requires a loop-free thread).
+            import asyncio
+
+            return await asyncio.to_thread(
+                runtime.start,
                 req.goal,
                 user_email=current_user or None,
                 scope=scope,

package/latticeai/api/auth.py

@@ -1,5 +1,7 @@
 """Authentication API router: register, login, logout, SSO, profile."""
 
+import base64
+import hashlib
 import logging
 import secrets
 import time
@@ -69,11 +71,22 @@ def create_auth_router(
 ) -> APIRouter:
     router = APIRouter()
 
+    def _enforce_password_policy(password: str) -> None:
+        # Real policy (v4): length >= 8 with letters AND digits. A 4-char
+        # minimum was not a policy.
+        pw = str(password or "")
+        if len(pw) < 8 or not any(c.isalpha() for c in pw) or not any(c.isdigit() for c in pw):
+            raise HTTPException(
+                status_code=400,
+                detail="비밀번호는 8자 이상이며 영문자와 숫자를 모두 포함해야 합니다.",
+            )
+
     @router.post("/register")
     async def register(req: UserRegister, request: Request):
         check_ip_rate_limit(client_ip(request), "register", max_calls=5, window_secs=3600)
         if not open_registration:
             raise HTTPException(status_code=403, detail="회원가입이 비활성화되어 있습니다. 관리자에게 문의하세요.")
+        _enforce_password_policy(req.password)
         users = load_users()
         if req.email in users:
             raise HTTPException(status_code=400, detail="이미 존재하는 이메일입니다.")
@@ -123,7 +136,15 @@ def create_auth_router(
             raise HTTPException(status_code=503, detail="SSO가 설정되지 않았습니다.")
         state = secrets.token_urlsafe(16)
         nonce = secrets.token_urlsafe(16)
-        _sso_states[state] = (time.time(), nonce)
+        # PKCE (S256): bind the token exchange to this login, so an
+        # intercepted authorization code is useless without the verifier.
+        code_verifier = secrets.token_urlsafe(48)
+        code_challenge = (
+            base64.urlsafe_b64encode(hashlib.sha256(code_verifier.encode("ascii")).digest())
+            .rstrip(b"=")
+            .decode("ascii")
+        )
+        _sso_states[state] = (time.time(), nonce, code_verifier)
         params = urlencode({
             "client_id": settings["client_id"],
             "response_type": "code",
@@ -131,6 +152,8 @@ def create_auth_router(
             "scope": settings.get("scopes") or "openid email profile",
             "state": state,
             "nonce": nonce,
+            "code_challenge": code_challenge,
+            "code_challenge_method": "S256",
         })
         return RedirectResponse(f"{discovery['authorization_endpoint']}?{params}")
 
@@ -141,7 +164,7 @@ def create_auth_router(
         entry = _sso_states.pop(state, None)
         if entry is None or time.time() - entry[0] > 300:
             raise HTTPException(status_code=400, detail="유효하지 않은 SSO 상태입니다.")
-        _, nonce = entry
+        _, nonce, code_verifier = entry
         settings = get_sso_settings()
         discovery = await get_sso_discovery()
         if not settings.get("enabled") or not discovery:
@@ -154,6 +177,7 @@ def create_auth_router(
                 "redirect_uri": settings["redirect_uri"],
                 "client_id": settings["client_id"],
                 "client_secret": settings["client_secret"],
+                "code_verifier": code_verifier,
             }, headers={"Accept": "application/json"}, timeout=15)
             tokens = r.json()
         id_token = tokens.get("id_token")
@@ -214,8 +238,7 @@ def create_auth_router(
         email = require_user(request)
         if not email:
             raise HTTPException(status_code=401, detail="인증이 필요합니다.")
-        if len(req.new_password) < 4:
-            raise HTTPException(status_code=400, detail="새 비밀번호는 4자 이상이어야 합니다.")
+        _enforce_password_policy(req.new_password)
         users = load_users()
         user = users.get(email)
         if not user:

package/latticeai/api/chat.py

@@ -25,9 +25,8 @@ from latticeai.core.agent import AgentRunContext, AgentState
 from latticeai.core.context_builder import format_sources_footnote, retrieve_context_for_generation
 from latticeai.core.document_generator import DocumentGenerationSession, detect_document_intent
 from latticeai.core.hooks import dispatch_tool
-from latticeai.services.chat_service import ChatService
+from latticeai.services.app_context import AppContext
 from latticeai.services.tool_dispatch import build_agent_runtime, collect_created_files
-from telegram_bot import broadcast_web_chat
 from tools import AGENT_ROOT, ToolError, ensure_agent_root, execute_tool, knowledge_save, local_read, network_status
 
 class ChatRequest(BaseModel):
@@ -71,6 +70,28 @@ class AgentEvalRequest(BaseModel):
     skill: str
     case_id: Optional[str] = None
 
+def pair_user_history(history: List[Dict], user_email: str) -> List[Dict]:
+    """Restrict history to one user's exchange.
+
+    Keeps the user's own messages plus assistant replies that directly follow
+    them. A bare role=="assistant" pass would leak every other user's replies
+    into this user's prompt context.
+    """
+    paired: List[Dict] = []
+    include_next_assistant = False
+    for item in history:
+        if item.get("role") == "assistant":
+            if include_next_assistant:
+                paired.append(item)
+                include_next_assistant = False
+        elif item.get("user_email") == user_email:
+            paired.append(item)
+            include_next_assistant = True
+        else:
+            include_next_assistant = False
+    return paired
+
+
 def detect_language(text: str) -> str:
     """Detect language: 'ko' (Korean) or 'en' (English)."""
     total = max(len(text), 1)
@@ -120,46 +141,57 @@ async def single_text_stream(text: str, model: str = "system") -> AsyncIterator[
     yield "data: [DONE]\n\n"
 
 
-def create_chat_router(
-    *,
-    config,
-    model_router,
-    chat_service: ChatService,
-    workspace_store,
-    workspace_graph,
-    gardener,
-    require_user,
-    enforce_rate_limit,
-    get_history_user,
-    save_to_history,
-    append_audit_event,
-    clear_history,
-    clear_conversation,
-    get_history,
-    group_history_conversations,
-    get_conversation_messages,
-    conversation_title,
-    load_users,
-    get_user_role,
-    enable_graph: bool,
-    knowledge_graph,
-    public_model: str,
-    base_dir: Path,
-    hooks=None,
-) -> APIRouter:
+def create_chat_router(context: AppContext) -> APIRouter:
+    """Build the chat/history/agent router from the typed application context.
+
+    Replaces the historical ~25-kwarg factory signature: ``context``
+    (:class:`latticeai.services.app_context.AppContext`) carries the same
+    dependencies as typed fields.
+    """
     api_router = APIRouter()
-    router = model_router
-    CONFIG = config
-    CHAT_SERVICE = chat_service
-    WORKSPACE_OS = workspace_store
-    ENABLE_GRAPH = enable_graph
-    KNOWLEDGE_GRAPH = knowledge_graph
-    PUBLIC_MODEL = public_model
-    BASE_DIR = base_dir
+    router = context.model_router
+    hooks = context.hooks
+    workspace_graph = context.workspace_graph
+    context_assembler = context.context_assembler
+    require_user = context.require_user
+    enforce_rate_limit = context.enforce_rate_limit
+    get_history_user = context.get_history_user
+    save_to_history = context.save_to_history
+    append_audit_event = context.append_audit_event
+    clear_history = context.clear_history
+    clear_conversation = context.clear_conversation
+    get_history = context.get_history
+    group_history_conversations = context.group_history_conversations
+    get_conversation_messages = context.get_conversation_messages
+    conversation_title = context.conversation_title
+
+    CONFIG = context.config
+    CHAT_SERVICE = context.chat_service
+    WORKSPACE_OS = context.workspace_store
+    ENABLE_GRAPH = context.enable_graph
+    KNOWLEDGE_GRAPH = context.knowledge_graph
+    PUBLIC_MODEL = context.public_model
+    BASE_DIR = context.base_dir
     _doc_gen_sessions: dict = {}
     _pending_agents: dict[str, tuple] = {}
     _pending_agents_lock = threading.Lock()
 
+    on_chat_message = context.on_chat_message
+
+    def notify_chat_message(role: str, text: str, source: Optional[str]) -> None:
+        """Mirror a chat exchange to the injected external bridge, if any.
+
+        ``on_chat_message`` is registered by ``create_app`` only when
+        ENABLE_TELEGRAM is truthy; exchanges that originated *from* telegram
+        are never echoed back. No bridge registered → no-op.
+        """
+        if on_chat_message is None or source == "telegram":
+            return
+        try:
+            on_chat_message(role, text, source)
+        except Exception as exc:
+            logging.warning("chat message bridge failed: %s", exc)
+
     def build_recent_chat_context(
         limit: int = 10,
         include_image_missing_replies: bool = True,
@@ -170,7 +202,7 @@ def create_chat_router(
         if conversation_id:
             history = [item for item in history if item.get("conversation_id") == conversation_id]
         if user_email:
-            history = [item for item in history if item.get("user_email") == user_email or item.get("role") == "assistant"]
+            history = pair_user_history(history, user_email)
         history = history[-limit:]
         lines = []
         for item in history:
@@ -250,6 +282,7 @@ def create_chat_router(
         knowledge_save=knowledge_save,
         audit=append_audit_event,
         hooks=hooks,
+        brain_memory=context.brain_memory,
     )
 
     @api_router.post("/chat")
@@ -272,9 +305,8 @@ def create_chat_router(
             except ToolError as exc:
                 answer = f"네트워크 정보를 확인하지 못했습니다: {exc}"
             save_to_history("assistant", answer, source=req.source or "web", conversation_id=req.conversation_id, **history_user)
-            if req.source != "telegram":
-                asyncio.create_task(broadcast_web_chat("user", req.message))
-                asyncio.create_task(broadcast_web_chat("assistant", answer))
+            notify_chat_message("user", req.message, req.source)
+            notify_chat_message("assistant", answer, req.source)
             if req.stream:
                 return StreamingResponse(
                     single_text_stream(answer),
@@ -332,9 +364,8 @@ def create_chat_router(
             answer = f"현재 페이지 URL: {req.client_url}"
             save_to_history("user", req.message, source=req.source or "web", conversation_id=req.conversation_id, **history_user)
             save_to_history("assistant", answer, source=req.source or "web", conversation_id=req.conversation_id, **history_user)
-            if req.source != "telegram":
-                asyncio.create_task(broadcast_web_chat("user", req.message))
-                asyncio.create_task(broadcast_web_chat("assistant", answer))
+            notify_chat_message("user", req.message, req.source)
+            notify_chat_message("assistant", answer, req.source)
             if req.stream:
                 return StreamingResponse(
                     single_text_stream(answer),
@@ -364,32 +395,38 @@ def create_chat_router(
     
         lang = detect_language(req.message)
         context = f"[LANGUAGE: {_LANG_HINT[lang]}]\n" + (req.context or "")
+        # v4 Context System: one budgeted, provenance-carrying assembly
+        # (workspace memories + hybrid search + garden notes) replaces the
+        # ad-hoc vault-scan + LIKE-search concatenation. The trace records
+        # why each section is in the prompt.
+        context_trace = None
         try:
-            knowledge_context = gardener.get_relevant_context(req.message)
-            if knowledge_context:
-                context += f"\n\n[LOCAL KNOWLEDGE BASE]\n{knowledge_context}"
-                print(f"📖 Context reinforced with local knowledge.")
+            if context_assembler is not None:
+                assembled = context_assembler.assemble(
+                    req.message,
+                    user_email=effective_email,
+                    conversation_id=req.conversation_id,
+                    budget=2000,
+                )
+                context_trace = assembled.trace()
+                if assembled.text:
+                    context += "\n\n" + assembled.text
         except Exception as e:
-            logging.warning("Knowledge reinforcement skipped: %s", e)
-    
+            logging.warning("Context assembly skipped: %s", e)
+
         is_doc_gen = detect_document_intent(req.message)
         doc_gen_context_result = None
-    
+
         try:
-            if ENABLE_GRAPH and KNOWLEDGE_GRAPH:
-                if is_doc_gen:
-                    doc_gen_context_result = retrieve_context_for_generation(
-                        KNOWLEDGE_GRAPH, req.message, max_results=10, max_hops=2,
-                    )
-                    graph_md = doc_gen_context_result.get("context_markdown", "")
-                    if graph_md:
-                        context += f"\n\n[KNOWLEDGE GRAPH — Document Generation Context]\n{graph_md}"
-                        print("📝 Document generation context retrieved from knowledge graph.")
-                else:
-                    graph_context = KNOWLEDGE_GRAPH.context_for_query(req.message)
-                    if graph_context:
-                        context += f"\n\n[KNOWLEDGE GRAPH]\n{graph_context}"
-                        print("🕸️ Context reinforced with knowledge graph.")
+            if ENABLE_GRAPH and KNOWLEDGE_GRAPH and is_doc_gen:
+                # Specialized multi-hop retrieval for document generation.
+                doc_gen_context_result = retrieve_context_for_generation(
+                    KNOWLEDGE_GRAPH, req.message, max_results=10, max_hops=2,
+                )
+                graph_md = doc_gen_context_result.get("context_markdown", "")
+                if graph_md:
+                    context += f"\n\n[KNOWLEDGE GRAPH — Document Generation Context]\n{graph_md}"
+                    print("📝 Document generation context retrieved from knowledge graph.")
         except Exception as e:
             logging.warning("Knowledge graph reinforcement skipped: %s", e)
     
@@ -416,11 +453,14 @@ def create_chat_router(
             KNOWLEDGE_GRAPH if (ENABLE_GRAPH and KNOWLEDGE_GRAPH) else None,
             context,
         )
+        if context_trace is not None and isinstance(trace_seed, dict):
+            # Persisted with the answer trace: 'why is this in my context?'
+            # is answerable from the stored record (UI surface lands in T9b).
+            trace_seed["context_assembly"] = context_trace
     
         history_message = f"{req.message}\n[Image attached]" if req.image_data else req.message
         save_to_history("user", history_message, source=req.source or "web", conversation_id=req.conversation_id, **history_user)
-        if req.source != "telegram":
-            asyncio.create_task(broadcast_web_chat("user", req.message))
+        notify_chat_message("user", req.message, req.source)
     
         if is_doc_gen and ENABLE_GRAPH and KNOWLEDGE_GRAPH:
             conv_key = req.conversation_id or "default"
@@ -456,8 +496,7 @@ def create_chat_router(
                         user_email=effective_email,
                         trace=trace_seed,
                     )
-                    if req.source != "telegram":
-                        asyncio.create_task(broadcast_web_chat("assistant", full_text))
+                    notify_chat_message("assistant", full_text, req.source)
                     yield f"data: {json.dumps({'text': '', 'trace_id': trace_record['id'], 'trace': trace_record}, ensure_ascii=False)}\n\n"
                     yield "data: [DONE]\n\n"
                 return StreamingResponse(
@@ -482,8 +521,7 @@ def create_chat_router(
                     user_email=effective_email,
                     trace=trace_seed,
                 )
-                if req.source != "telegram":
-                    asyncio.create_task(broadcast_web_chat("assistant", str(result)))
+                notify_chat_message("assistant", str(result), req.source)
                 return JSONResponse(content={"response": str(result), "trace_id": trace_record["id"], "trace": trace_record})
     
         if req.stream:
@@ -519,8 +557,7 @@ def create_chat_router(
                 user_email=effective_email,
                 trace=trace_seed,
             )
-            if req.source != "telegram":
-                asyncio.create_task(broadcast_web_chat("assistant", str(result)))
+            notify_chat_message("assistant", str(result), req.source)
     
             return JSONResponse(content={"response": str(result), "trace_id": trace_record["id"], "trace": trace_record})
     
@@ -627,8 +664,7 @@ def create_chat_router(
                 context,
             ),
         )
-        if req.source != "telegram":
-            asyncio.create_task(broadcast_web_chat("assistant", full_response))
+        notify_chat_message("assistant", full_response, req.source)
         yield f"data: {json.dumps({'chunk': '', 'model': router.current_model_id, 'trace_id': trace_record['id'], 'trace': trace_record}, ensure_ascii=False)}\n\n"
         yield "data: [DONE]\n\n"
 
@@ -751,7 +787,7 @@ def create_chat_router(
                 user_email=current_user or None,
                 timeline=ctx.transcript,
                 relationships=["agent:planner", "agent:reviewer"],
-                graph=_workspace_graph(),
+                graph=workspace_graph(),
             )
         except Exception as exc:
             logging.warning("workspace agent run record failed: %s", exc)

package/latticeai/api/health.py

@@ -8,7 +8,7 @@ endpoints (install / verify-cloud / pull-model) stay in server_app for now.
 from __future__ import annotations
 
 import asyncio
-from typing import Any, Callable, List, Optional
+from typing import Callable, List, Optional
 
 from fastapi import APIRouter, Request
 

package/latticeai/api/hooks.py

@@ -8,7 +8,7 @@ the API.
 
 from __future__ import annotations
 
-from typing import Any, Callable, List, Optional
+from typing import Callable, List, Optional
 
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel

package/latticeai/api/knowledge_graph.py

@@ -0,0 +1,146 @@
+"""Knowledge graph page and API routes.
+
+Relocated from the root ``knowledge_graph_api.py`` in v4 (T2); the root module
+remains as a deprecation shim. Route paths and response shapes are frozen by
+``tests/unit/test_knowledge_graph_router_parity.py`` — the ``/knowledge-graph/*``
+data endpoints back the v3 SPA (Files, Hybrid Search, graph explorer).
+"""
+
+from pathlib import Path
+from typing import Any, Callable, Dict, Optional
+
+from fastapi import APIRouter, HTTPException, Request
+from fastapi.responses import FileResponse
+from pydantic import BaseModel
+
+
+class KnowledgeGraphIngestRequest(BaseModel):
+    type: str
+    content: str = ""
+    role: Optional[str] = None
+    title: Optional[str] = None
+    source: Optional[str] = None
+    conversation_id: Optional[str] = None
+    user_email: Optional[str] = None
+    user_nickname: Optional[str] = None
+    metadata: Optional[Dict[str, Any]] = None
+
+
+def create_knowledge_graph_router(
+    *,
+    get_graph: Callable[[], Any],
+    require_graph: Callable[[], None],
+    require_user: Callable[[Request], str],
+    static_dir: Path,
+) -> APIRouter:
+    router = APIRouter()
+
+    def graph():
+        require_graph()
+        return get_graph()
+
+    @router.get("/graph")
+    async def knowledge_graph_page(request: Request):
+        """Serve the interactive knowledge graph canvas UI."""
+        graph()
+        require_user(request)
+        response = FileResponse(static_dir / "graph.html")
+        response.headers["Cache-Control"] = "no-cache, no-store, must-revalidate"
+        response.headers["Pragma"] = "no-cache"
+        response.headers["Expires"] = "0"
+        return response
+
+    @router.get("/knowledge-graph")
+    async def knowledge_graph_legacy_page(request: Request):
+        """Backward-compatible route for the graph page."""
+        graph()
+        require_user(request)
+        response = FileResponse(static_dir / "graph.html")
+        response.headers["Cache-Control"] = "no-cache, no-store, must-revalidate"
+        response.headers["Pragma"] = "no-cache"
+        response.headers["Expires"] = "0"
+        return response
+
+    @router.post("/knowledge-graph/curate")
+    async def knowledge_graph_curate(request: Request):
+        require_user(request)
+        return graph().curate()
+
+    @router.get("/knowledge-graph/provenance/coverage")
+    async def knowledge_graph_provenance_coverage(request: Request):
+        require_user(request)
+        return graph().provenance_coverage()
+
+    @router.get("/knowledge-graph/stats")
+    async def knowledge_graph_stats(request: Request):
+        require_user(request)
+        return graph().stats()
+
+    @router.get("/knowledge-graph/schema")
+    async def knowledge_graph_schema(request: Request):
+        require_user(request)
+        stats = graph().stats()
+        return {
+            "legacy_schema_version": stats.get("schema_version"),
+            "v2_schema_available": stats.get("v2_schema_available"),
+            "v2": stats.get("v2"),
+        }
+
+    @router.get("/knowledge-graph/graph")
+    async def knowledge_graph_data(request: Request, limit: int = 300):
+        require_user(request)
+        return graph().graph(limit)
+
+    @router.get("/knowledge-graph/documents")
+    async def knowledge_graph_documents(request: Request, limit: int = 200):
+        """Ingested documents (uploads + indexed local docs) with index state.
+
+        Backs the Files view so uploaded content is visible end-to-end:
+        upload → Files → Knowledge Graph → Hybrid Search → Chat.
+        """
+        require_user(request)
+        return graph().list_documents(limit)
+
+    @router.get("/knowledge-graph/search")
+    async def knowledge_graph_search(q: str, request: Request, limit: int = 30):
+        require_user(request)
+        if not q or not q.strip():
+            return {"query": q, "matches": []}
+        return graph().search(q, limit)
+
+    @router.get("/knowledge-graph/context")
+    async def knowledge_graph_context(q: str, request: Request, limit: int = 6):
+        require_user(request)
+        return {"query": q, "context": graph().context_for_query(q, limit)}
+
+    @router.get("/knowledge-graph/neighbors/{node_id:path}")
+    async def knowledge_graph_neighbors(node_id: str, request: Request):
+        require_user(request)
+        if not node_id:
+            raise HTTPException(status_code=400, detail="node_id required")
+        return graph().neighbors(node_id)
+
+    @router.post("/knowledge-graph/ingest")
+    async def knowledge_graph_ingest(req: KnowledgeGraphIngestRequest, request: Request):
+        current_user = require_user(request)
+        kg = graph()
+        event_type = (req.type or "").strip().lower()
+        if event_type not in {"message", "ai_response", "note"}:
+            raise HTTPException(status_code=400, detail="지원하는 type: message, ai_response, note")
+        role = req.role or ("assistant" if event_type == "ai_response" else "user")
+        return kg.ingest_message(
+            role,
+            req.content,
+            user_email=req.user_email or current_user,
+            user_nickname=req.user_nickname,
+            source=req.source or "mcp",
+            conversation_id=req.conversation_id,
+            raw={
+                "type": req.type,
+                "title": req.title,
+                "content": req.content,
+                "metadata": req.metadata or {},
+            },
+        )
+
+    return router

package/latticeai/api/local_files.py

@@ -14,7 +14,7 @@ from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import FileResponse
 from pydantic import BaseModel
 
-from knowledge_graph_api import create_knowledge_graph_router
+from latticeai.api.knowledge_graph import create_knowledge_graph_router
 from local_knowledge_api import create_local_knowledge_router
 from tools import local_list, local_read, local_write
 

package/latticeai/api/mcp.py

@@ -17,11 +17,12 @@ from datetime import datetime
 from pathlib import Path
 from typing import Any, Callable, Dict, List, Optional
 
+from latticeai.services.ingestion import IngestionItem
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
-import mcp_registry
-from mcp_registry import (
+import latticeai.core.mcp_registry as mcp_registry
+from latticeai.core.mcp_registry import (
     _get_combined_registry,
     _fetch_skills_marketplace,
     _fetch_plugin_directory,
@@ -76,6 +77,7 @@ def create_mcp_router(
     tool_response: Callable[..., Any],
     require_graph: Callable[[], Any],
     knowledge_graph: Any,
+    ingestion_pipeline: Any,
     data_dir: Path,
 ) -> APIRouter:
     router = APIRouter()
@@ -290,7 +292,7 @@ def create_mcp_router(
             if not skill_md.exists():
                 continue
             lines = skill_md.read_text(encoding="utf-8").splitlines()
-            desc = next((l.split(":", 1)[1].strip() for l in lines if l.startswith("description:")), "")
+            desc = next((ln.split(":", 1)[1].strip() for ln in lines if ln.startswith("description:")), "")
             comment = lines[0] if lines else ""
             if "anthropics/claude-plugins-official" in comment:
                 source = "anthropic"
@@ -357,15 +359,25 @@ def create_mcp_router(
         args = req.args or {}
         if req.action == "knowledge_graph_ingest":
             _require_graph()
-            return KNOWLEDGE_GRAPH.ingest_message(
-                args.get("role") or ("assistant" if args.get("type") == "ai_response" else "user"),
-                args.get("content") or "",
-                user_email=args.get("user_email") or current_user,
-                user_nickname=args.get("user_nickname"),
-                source=args.get("source") or "mcp",
-                conversation_id=args.get("conversation_id"),
-                raw=args,
+            # v4: MCP messages enter the brain through the unified ingestion
+            # pipeline (provenance + hook lifecycle), not a direct store call.
+            owner = args.get("user_email") or current_user
+            result = ingestion_pipeline.ingest(
+                IngestionItem(
+                    source_type="mcp_message",
+                    text=args.get("content") or "",
+                    owner=owner,
+                    conversation_id=args.get("conversation_id"),
+                    metadata={
+                        "role": args.get("role") or ("assistant" if args.get("type") == "ai_response" else "user"),
+                        "user_nickname": args.get("user_nickname"),
+                        "source": args.get("source") or "mcp",
+                        "raw": args,
+                    },
+                ),
+                user_email=owner,
             )
+            return result.as_dict()
         if req.action == "knowledge_graph_search":
             _require_graph()
             return KNOWLEDGE_GRAPH.search(args.get("query") or args.get("q") or "", args.get("limit", 30))

package/latticeai/api/memory.py

@@ -7,7 +7,7 @@ operations (prune / compact / rebuild / clear). Full paths in decorators.
 
 from __future__ import annotations
 
-from typing import Any, Callable, List, Optional
+from typing import Callable, List, Optional
 
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel