ltcai 4.0.0 → 4.0.1

package/latticeai/services/workspace_service.py

@@ -26,7 +26,7 @@ Guardrail summary (v1.2.0):
 
 from __future__ import annotations
 
-from typing import Any, Dict, Optional
+from typing import Any, Callable, Dict, Optional
 
 from latticeai.core.workspace_os import WorkspaceOSStore
 
@@ -38,13 +38,20 @@ class WorkspaceService:
     # partitioned per workspace. Surfaced so the UI / docs can be explicit.
     SHARED_GLOBAL_AREAS = ("graph", "skills")
 
-    def __init__(self, store: WorkspaceOSStore):
+    def __init__(self, store: WorkspaceOSStore, *, resolve_user_id: Optional[Callable[[Optional[str]], Optional[str]]] = None):
         self.store = store
+        self._resolve_user_id = resolve_user_id or (lambda user_id: user_id)
+
+    def _identity(self, user_id: Optional[str]) -> Optional[str]:
+        if isinstance(user_id, str) and user_id.startswith("user:"):
+            return user_id
+        return self._resolve_user_id(user_id)
 
     # ── scope resolution + gating ────────────────────────────────────────
 
     def _ensure_permission(self, workspace_id: str, user_id: Optional[str], permission: str) -> None:
-        if not self.store.has_permission(workspace_id, user_id, permission):
+        resolved_user = self._identity(user_id)
+        if not self.store.has_permission(workspace_id, resolved_user, permission):
             raise PermissionError(
                 f"'{user_id or 'anonymous'}' lacks '{permission}' on workspace '{workspace_id}'"
             )
@@ -67,10 +74,10 @@ class WorkspaceService:
         return workspace_id
 
     def can_read(self, workspace_id: str, user_id: Optional[str]) -> bool:
-        return self.store.has_permission(workspace_id, user_id, "read")
+        return self.store.has_permission(workspace_id, self._identity(user_id), "read")
 
     def can_write(self, workspace_id: str, user_id: Optional[str]) -> bool:
-        return self.store.has_permission(workspace_id, user_id, "write")
+        return self.store.has_permission(workspace_id, self._identity(user_id), "write")
 
     # ── record-level authorization (by-id access must not bypass gating) ──
 
@@ -93,12 +100,13 @@ class WorkspaceService:
         """
         owner = (record or {}).get("user_email")
         workspace_id = (record or {}).get("workspace_id")
-        if owner and owner == user_id:
+        resolved_user = self._identity(user_id)
+        if owner and owner in {user_id, resolved_user}:
             return
         if workspace_id:
-            self._ensure_permission(workspace_id, user_id, "write")
+            self._ensure_permission(workspace_id, resolved_user, "write")
             return
-        if owner and owner != user_id:
+        if owner and owner not in {user_id, resolved_user}:
             raise PermissionError(
                 f"'{user_id or 'anonymous'}' is not the owner of memory '{record.get('id')}'"
             )
@@ -107,42 +115,42 @@ class WorkspaceService:
 
     def summary(self, user_id: Optional[str]) -> Dict[str, Any]:
         data = self.store.summary()
-        data["workspace_registry"] = self.store.list_workspaces(user_id=user_id)
+        data["workspace_registry"] = self.store.list_workspaces(user_id=self._identity(user_id))
         data["shared_global_areas"] = list(self.SHARED_GLOBAL_AREAS)
         return data
 
     def list_workspaces(self, user_id: Optional[str]) -> Dict[str, Any]:
-        return self.store.list_workspaces(user_id=user_id)
+        return self.store.list_workspaces(user_id=self._identity(user_id))
 
     def get_workspace(self, workspace_id: str, user_id: Optional[str]) -> Dict[str, Any]:
         # Reading workspace metadata requires read access to that workspace.
         self._ensure_permission(workspace_id, user_id, "read")
-        return self.store.get_workspace(workspace_id, user_id=user_id)
+        return self.store.get_workspace(workspace_id, user_id=self._identity(user_id))
 
     def workspace_summary(self, workspace_id: str, user_id: Optional[str]) -> Dict[str, Any]:
         self._ensure_permission(workspace_id, user_id, "read")
-        return self.store.workspace_summary(workspace_id, user_id=user_id)
+        return self.store.workspace_summary(workspace_id, user_id=self._identity(user_id))
 
     # ── organization workspace management (delegates with actor) ─────────
 
     def create_organization_workspace(self, *, name: str, owner_user_id: Optional[str], settings: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
-        return self.store.create_organization_workspace(name=name, owner_user_id=owner_user_id, settings=settings)
+        return self.store.create_organization_workspace(name=name, owner_user_id=self._identity(owner_user_id), settings=settings)
 
     def update_workspace(self, workspace_id: str, *, name=None, settings=None, actor=None) -> Dict[str, Any]:
-        return self.store.update_workspace(workspace_id, name=name, settings=settings, actor=actor)
+        return self.store.update_workspace(workspace_id, name=name, settings=settings, actor=self._identity(actor))
 
     def archive_workspace(self, workspace_id: str, *, actor=None) -> Dict[str, Any]:
-        return self.store.archive_workspace(workspace_id, actor=actor)
+        return self.store.archive_workspace(workspace_id, actor=self._identity(actor))
 
     def add_member(self, workspace_id: str, *, user_id: str, role: str = "member", actor=None) -> Dict[str, Any]:
-        return self.store.add_member(workspace_id, user_id=user_id, role=role, actor=actor)
+        return self.store.add_member(workspace_id, user_id=self._identity(user_id) or user_id, role=role, actor=self._identity(actor))
 
     def update_member_role(self, workspace_id: str, *, user_id: str, role: str, actor=None) -> Dict[str, Any]:
-        return self.store.update_member_role(workspace_id, user_id=user_id, role=role, actor=actor)
+        return self.store.update_member_role(workspace_id, user_id=self._identity(user_id) or user_id, role=role, actor=self._identity(actor))
 
     def remove_member(self, workspace_id: str, *, user_id: str, actor=None) -> Dict[str, Any]:
-        return self.store.remove_member(workspace_id, user_id=user_id, actor=actor)
+        return self.store.remove_member(workspace_id, user_id=self._identity(user_id) or user_id, actor=self._identity(actor))
 
     def set_active_workspace(self, workspace_id: str, user_id: Optional[str]) -> Dict[str, Any]:
         # Membership is enforced inside the store for organization workspaces.
-        return self.store.set_active_workspace(workspace_id, user_id=user_id)
+        return self.store.set_active_workspace(workspace_id, user_id=self._identity(user_id))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ltcai",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Lattice AI — local-first Digital Brain Platform (knowledge graph, durable memory, hybrid search, agents, signed brain exchange)",
   "homepage": "https://github.com/TaeSooPark-PTS/LatticeAI#readme",
   "repository": {
@@ -21,7 +21,7 @@
     "build:assets": "node scripts/build_v3_assets.mjs",
     "build:python": "python3 -m build",
     "check:python": "python3 scripts/check_python.py",
-    "lint": "node --check static/scripts/account.js && node --check static/scripts/admin.js && node --check static/scripts/chat.js && node --check static/scripts/graph.js && node --check static/scripts/platform.js && node --check static/scripts/ux.js && node --check static/scripts/workspace.js && node --check tests/visual/mock_server.cjs && node --check tests/visual/v3.spec.js && npm run lint:v3",
+    "lint": "node --check tests/visual/mock_server.cjs && node --check tests/visual/v3.spec.js && npm run lint:v3",
     "lint:v3": "node scripts/lint_v3.mjs",
     "typecheck": "cd vscode-extension && npm run build",
     "test": "python3 -m pytest tests/ -v",
@@ -74,21 +74,9 @@
     "mcp_registry.py",
     "latticeai/**/*.py",
     "skills/",
-    "static/account.html",
-    "static/chat.html",
-    "static/admin.html",
-    "static/graph.html",
-    "static/workspace.html",
-    "static/plugins.html",
-    "static/workflows.html",
-    "static/agents.html",
-    "static/activity.html",
     "static/favicon.ico",
     "static/manifest.json",
     "static/sw.js",
-    "static/workspace.css",
-    "static/platform.css",
-    "static/scripts/",
     "static/css/",
     "static/v3/",
     "static/icons/",

package/scripts/lint_v3.mjs

@@ -8,6 +8,8 @@
  *     style.color = "#…" literals).
  *  4. Privacy: zero CDN/external URLs in shipped static HTML/CSS/JS —
  *     fonts/icons/libs are vendored under static/vendor.
+ *  5. i18n: routes, shell, and new v4 parity views must use the SPA i18n
+ *     runtime instead of inert localStorage-only language toggles.
  * Exits non-zero on any failure. */
 import { readdirSync, statSync, readFileSync } from "node:fs";
 import { join, dirname, relative } from "node:path";
@@ -90,6 +92,27 @@ for (const file of walk(staticRoot, [".html", ".css", ".js"]).sort()) {
 }
 console.log(`privacy: ${shippedChecked} shipped static files scanned for CDN URLs`);
 
+// ── 5. i18n acceptance for T9 surfaces ──────────────────────────────────
+const i18nRequired = [
+  "static/v3/js/core/routes.js",
+  "static/v3/js/core/shell.js",
+  "static/v3/js/views/account.js",
+  "static/v3/js/views/workspace-admin.js",
+  "static/v3/js/views/snapshots.js",
+  "static/v3/js/views/activity.js",
+  "static/v3/js/views/runs.js",
+  "static/v3/js/views/network.js",
+];
+let i18nChecked = 0;
+for (const rel of i18nRequired) {
+  const file = join(repo, rel);
+  const text = readFileSync(file, "utf8");
+  i18nChecked++;
+  if (!/i18n\.js/.test(text)) fail(`${rel}: missing i18n runtime import`);
+  if (!/\bt\(/.test(text)) fail(`${rel}: no translation lookup found`);
+}
+console.log(`i18n: ${i18nChecked} route/shell/parity modules checked`);
+
 if (failed) {
   console.error(`\nv3 frontend lint: ${failed} failure(s)`);
   process.exit(1);

package/static/v3/asset-manifest.json

@@ -1,8 +1,8 @@
 {
-  "version": "4.0.0",
+  "version": "4.0.1",
   "generated_at": "deterministic",
   "entrypoints": {
-    "app": "/static/v3/js/app.356e6452.js",
+    "app": "/static/v3/js/app.c5c80c46.js",
     "styles": [
       "/static/css/tokens.3ba22e37.css",
       "/static/v3/css/lattice.tokens.304cbc40.css",
@@ -19,38 +19,45 @@
     "static/v3/css/lattice.components.css": "/static/v3/css/lattice.components.cde18231.css",
     "static/v3/css/lattice.shell.css": "/static/v3/css/lattice.shell.29d36d85.css",
     "static/v3/css/lattice.views.css": "/static/v3/css/lattice.views.0a18b6c5.css",
-    "static/v3/js/app.js": "/static/v3/js/app.356e6452.js",
-    "static/v3/js/core/api.js": "/static/v3/js/core/api.7a308b89.js",
+    "static/v3/js/app.js": "/static/v3/js/app.c5c80c46.js",
+    "static/v3/js/core/api.js": "/static/v3/js/core/api.ba0fbf14.js",
     "static/v3/js/core/components.js": "/static/v3/js/core/components.f25b3b93.js",
     "static/v3/js/core/dom.js": "/static/v3/js/core/dom.a2773eb0.js",
+    "static/v3/js/core/i18n.js": "/static/v3/js/core/i18n.880e1fec.js",
     "static/v3/js/core/router.js": "/static/v3/js/core/router.584570f2.js",
-    "static/v3/js/core/routes.js": "/static/v3/js/core/routes.7222343d.js",
-    "static/v3/js/core/shell.js": "/static/v3/js/core/shell.a1657f20.js",
-    "static/v3/js/core/store.js": "/static/v3/js/core/store.204a08b2.js",
+    "static/v3/js/core/routes.js": "/static/v3/js/core/routes.37522821.js",
+    "static/v3/js/core/shell.js": "/static/v3/js/core/shell.e3f6bbfa.js",
+    "static/v3/js/core/store.js": "/static/v3/js/core/store.7b2aa044.js",
+    "static/v3/js/views/account.js": "/static/v3/js/views/account.eff40715.js",
+    "static/v3/js/views/activity.js": "/static/v3/js/views/activity.0d271ef9.js",
     "static/v3/js/views/admin-audit.js": "/static/v3/js/views/admin-audit.660a1fb1.js",
     "static/v3/js/views/admin-permissions.js": "/static/v3/js/views/admin-permissions.a7ae5f09.js",
     "static/v3/js/views/admin-policies.js": "/static/v3/js/views/admin-policies.3658fd86.js",
     "static/v3/js/views/admin-private-vpc.js": "/static/v3/js/views/admin-private-vpc.7d342d36.js",
     "static/v3/js/views/admin-security.js": "/static/v3/js/views/admin-security.07c66b72.js",
-    "static/v3/js/views/admin-users.js": "/static/v3/js/views/admin-users.03bac88c.js",
-    "static/v3/js/views/agents.js": "/static/v3/js/views/agents.014d0b74.js",
-    "static/v3/js/views/chat.js": "/static/v3/js/views/chat.e6dd7dd0.js",
+    "static/v3/js/views/admin-users.js": "/static/v3/js/views/admin-users.f7ac7b43.js",
+    "static/v3/js/views/agents.js": "/static/v3/js/views/agents.17c5288d.js",
+    "static/v3/js/views/chat.js": "/static/v3/js/views/chat.e250e2cc.js",
     "static/v3/js/views/files.js": "/static/v3/js/views/files.adad14c1.js",
     "static/v3/js/views/graph-canvas.js": "/static/v3/js/views/graph-canvas.17c15d65.js",
     "static/v3/js/views/home.js": "/static/v3/js/views/home.24f8b8ae.js",
     "static/v3/js/views/hooks.js": "/static/v3/js/views/hooks.37895880.js",
     "static/v3/js/views/hybrid-search.js": "/static/v3/js/views/hybrid-search.2fb63ed9.js",
-    "static/v3/js/views/knowledge-graph.js": "/static/v3/js/views/knowledge-graph.5e40cbeb.js",
+    "static/v3/js/views/knowledge-graph.js": "/static/v3/js/views/knowledge-graph.4d09c537.js",
     "static/v3/js/views/marketplace.js": "/static/v3/js/views/marketplace.ab0583d4.js",
     "static/v3/js/views/mcp.js": "/static/v3/js/views/mcp.99b5c6a7.js",
     "static/v3/js/views/memory.js": "/static/v3/js/views/memory.4ebdf474.js",
     "static/v3/js/views/models.js": "/static/v3/js/views/models.a1ffa147.js",
     "static/v3/js/views/my-computer.js": "/static/v3/js/views/my-computer.d9d9ae1c.js",
+    "static/v3/js/views/network.js": "/static/v3/js/views/network.52a4f181.js",
     "static/v3/js/views/pipeline.js": "/static/v3/js/views/pipeline.c522f1ce.js",
-    "static/v3/js/views/planning.js": "/static/v3/js/views/planning.9ac3e313.js",
-    "static/v3/js/views/settings.js": "/static/v3/js/views/settings.8631fa5e.js",
+    "static/v3/js/views/planning.js": "/static/v3/js/views/planning.4876fd77.js",
+    "static/v3/js/views/runs.js": "/static/v3/js/views/runs.b63b2afa.js",
+    "static/v3/js/views/settings.js": "/static/v3/js/views/settings.b7140634.js",
     "static/v3/js/views/skills.js": "/static/v3/js/views/skills.c6c2f965.js",
+    "static/v3/js/views/snapshots.js": "/static/v3/js/views/snapshots.6f5db095.js",
     "static/v3/js/views/tools.js": "/static/v3/js/views/tools.e4f11276.js",
-    "static/v3/js/views/workflows.js": "/static/v3/js/views/workflows.26c57290.js"
+    "static/v3/js/views/workflows.js": "/static/v3/js/views/workflows.7752225a.js",
+    "static/v3/js/views/workspace-admin.js": "/static/v3/js/views/workspace-admin.c466029b.js"
   }
 }

package/static/v3/js/{app.356e6452.js → app.c5c80c46.js}

@@ -3,7 +3,7 @@
  * Boots the shell. Views are lazy-loaded by the router (see core/routes.js).
  * ========================================================================== */
 
-import { boot } from "./core/shell.a1657f20.js";
+import { boot } from "./core/shell.e3f6bbfa.js";
 
 const root = document.getElementById("app");
 if (root) boot(root);

package/static/v3/js/core/{api.7a308b89.js → api.ba0fbf14.js}

@@ -11,7 +11,7 @@
  *           "unavailable" → endpoint missing/down; no fake payload
  * ========================================================================== */
 
-import { store } from "./store.204a08b2.js";
+import { store } from "./store.7b2aa044.js";
 
 const TIMEOUT_MS = 8000;
 const EMPTY_INDEX_STATUS = { generated_at: null, pipelines: {}, sources: [] };
@@ -279,6 +279,53 @@ export const api = {
 
   /* ── Organization workspaces (real backend: /workspace/orgs) ────────── */
   createOrg(name) { return raw("/workspace/orgs", { method: "POST", body: { name } }); },
+  workspaceRegistry() { return withFallback("/workspace/registry", {}, { workspaces: [], roles: [], permissions: {} }); },
+  activateWorkspace(workspace_id) { return raw("/workspace/activate", { method: "POST", body: { workspace_id } }); },
+  workspaceDetail(workspace_id) { return raw(`/workspace/orgs/${encodeURIComponent(workspace_id)}`); },
+  updateWorkspace(workspace_id, body) { return raw(`/workspace/orgs/${encodeURIComponent(workspace_id)}`, { method: "PATCH", body }); },
+  archiveWorkspace(workspace_id) { return raw(`/workspace/orgs/${encodeURIComponent(workspace_id)}/archive`, { method: "POST", body: {} }); },
+  addWorkspaceMember(workspace_id, user_id, role) {
+    return raw(`/workspace/orgs/${encodeURIComponent(workspace_id)}/members`, { method: "POST", body: { user_id, role } });
+  },
+  updateWorkspaceMember(workspace_id, user_id, role) {
+    return raw(`/workspace/orgs/${encodeURIComponent(workspace_id)}/members/${encodeURIComponent(user_id)}`, { method: "PATCH", body: { role } });
+  },
+  removeWorkspaceMember(workspace_id, user_id) {
+    return raw(`/workspace/orgs/${encodeURIComponent(workspace_id)}/members/${encodeURIComponent(user_id)}`, { method: "DELETE" });
+  },
+  invitations() { return withFallback("/invitations", {}, { invitations: [] }); },
+  createInvitation(body) { return raw("/invitations", { method: "POST", body }); },
+  acceptInvitation(token) { return raw(`/invitations/${encodeURIComponent(token)}/accept`, { method: "POST", body: {} }); },
+
+  /* ── Account / token-native auth ───────────────────────────────────── */
+  profile() { return raw("/account/profile"); },
+  login(email, password) { return raw("/login", { method: "POST", body: { email, password } }); },
+  register(body) { return raw("/register", { method: "POST", body }); },
+  logout() { return raw("/logout", { method: "POST", body: {} }); },
+  updateProfile(body) { return raw("/account/profile", { method: "PATCH", body }); },
+  changePassword(current_password, new_password) {
+    return raw("/account/change-password", { method: "POST", body: { current_password, new_password } });
+  },
+  ssoConfig() { return withFallback("/auth/sso/config", {}, { enabled: false, providers: [] }); },
+
+  /* ── Snapshots, Time Machine, realtime ─────────────────────────────── */
+  snapshots() { return withFallback("/workspace/snapshots", {}, { snapshots: [] }); },
+  createSnapshot(name) { return raw("/workspace/snapshots", { method: "POST", body: { name } }); },
+  compareSnapshots(before_id, after_id) { return raw("/workspace/snapshots/compare", { method: "POST", body: { before_id, after_id } }); },
+  snapshotExport(snapshot_id) { return raw(`/workspace/snapshots/${encodeURIComponent(snapshot_id)}/export`, { method: "POST", body: {} }); },
+  snapshotRestore(snapshot_id) { return raw(`/workspace/snapshots/${encodeURIComponent(snapshot_id)}/restore`, { method: "POST", body: {} }); },
+  timeMachine(limit = 100) { return withFallback(`/workspace/time-machine?limit=${encodeURIComponent(limit)}`, {}, { events: [] }); },
+  realtimeFeed(limit = 50) { return withFallback(`/realtime/feed?limit=${encodeURIComponent(limit)}`, {}, { events: [], stats: {} }); },
+  presence() { return withFallback("/realtime/presence", {}, { presence: [], stats: {} }); },
+
+  /* ── Approval + Brain Network surfaces ─────────────────────────────── */
+  permissionsPending() { return withFallback("/permissions/pending", {}, { pending: {}, count: 0 }); },
+  denyPermission(token) { return raw(`/permissions/deny/${encodeURIComponent(token)}`, { method: "POST" }); },
+  networkIdentity() { return withFallback("/network/identity", {}, {}); },
+  networkPeers() { return withFallback("/network/peers", {}, { peers: [] }); },
+  pairPeer(body) { return raw("/network/peers", { method: "POST", body }); },
+  unpairPeer(peer_id) { return raw(`/network/peers/${encodeURIComponent(peer_id)}`, { method: "DELETE" }); },
+  pushPeer(peer_id, workspace_id) { return raw(`/network/push/${encodeURIComponent(peer_id)}`, { method: "POST", body: { workspace_id } }); },
 
   /* ── Chat (real backend: SSE /chat + /history/*) ────────────────────── */
 
@@ -402,9 +449,15 @@ export const api = {
   // Workflow Agents (Part 5)
   workflowDefinitions() { return withFallback("/workflows/api/definitions", {}, { workflows: [] }); },
   createWorkflow(body) { return raw("/workflows/api/definitions", { method: "POST", body }); },
+  updateWorkflow(id, body) { return raw(`/workflows/api/definitions/${encodeURIComponent(id)}`, { method: "PATCH", body }); },
   runWorkflow(id, body = {}) { return raw(`/workflows/api/definitions/${encodeURIComponent(id)}/run`, { method: "POST", body }); },
   workflowRuns() { return withFallback("/workflows/api/runs", {}, { runs: [] }); },
   workflowReplay(runId) { return raw(`/workflows/api/runs/${encodeURIComponent(runId)}/replay`); },
+  stopWorkflowRun(runId) { return raw(`/workflows/api/runs/${encodeURIComponent(runId)}/stop`, { method: "POST" }); },
+  resumeWorkflowRun(runId, approved = true) {
+    return raw(`/workflows/api/runs/${encodeURIComponent(runId)}/resume`, { method: "POST", body: { approved } });
+  },
+  workflowTriggers() { return withFallback("/workflows/api/triggers", {}, { running: false, armed: [] }); },
 
   // Long-Term Memory + Memory Manager (Parts 7, 8)
   memoryManager() { return withFallback("/api/memory/manager", {}, { sources: [], tiers: [], usage: {} }); },
@@ -532,6 +585,10 @@ export const api = {
     return withFallback(`/api/knowledge-graph/provenance${qs}`, {}, { items: [], count: 0 });
   },
 
+  kgProvenanceCoverage() {
+    return withFallback("/knowledge-graph/provenance/coverage", {}, { total_nodes: 0, nodes_with_provenance: 0, coverage_ratio: 0 });
+  },
+
   /** POST /api/knowledge-graph/export — logical JSON export of the whole graph. */
   graphExport() { return raw("/api/knowledge-graph/export", { method: "POST", body: {} }); },
 

package/static/v3/js/core/api.js

@@ -279,6 +279,53 @@ export const api = {
 
   /* ── Organization workspaces (real backend: /workspace/orgs) ────────── */
   createOrg(name) { return raw("/workspace/orgs", { method: "POST", body: { name } }); },
+  workspaceRegistry() { return withFallback("/workspace/registry", {}, { workspaces: [], roles: [], permissions: {} }); },
+  activateWorkspace(workspace_id) { return raw("/workspace/activate", { method: "POST", body: { workspace_id } }); },
+  workspaceDetail(workspace_id) { return raw(`/workspace/orgs/${encodeURIComponent(workspace_id)}`); },
+  updateWorkspace(workspace_id, body) { return raw(`/workspace/orgs/${encodeURIComponent(workspace_id)}`, { method: "PATCH", body }); },
+  archiveWorkspace(workspace_id) { return raw(`/workspace/orgs/${encodeURIComponent(workspace_id)}/archive`, { method: "POST", body: {} }); },
+  addWorkspaceMember(workspace_id, user_id, role) {
+    return raw(`/workspace/orgs/${encodeURIComponent(workspace_id)}/members`, { method: "POST", body: { user_id, role } });
+  },
+  updateWorkspaceMember(workspace_id, user_id, role) {
+    return raw(`/workspace/orgs/${encodeURIComponent(workspace_id)}/members/${encodeURIComponent(user_id)}`, { method: "PATCH", body: { role } });
+  },
+  removeWorkspaceMember(workspace_id, user_id) {
+    return raw(`/workspace/orgs/${encodeURIComponent(workspace_id)}/members/${encodeURIComponent(user_id)}`, { method: "DELETE" });
+  },
+  invitations() { return withFallback("/invitations", {}, { invitations: [] }); },
+  createInvitation(body) { return raw("/invitations", { method: "POST", body }); },
+  acceptInvitation(token) { return raw(`/invitations/${encodeURIComponent(token)}/accept`, { method: "POST", body: {} }); },
+
+  /* ── Account / token-native auth ───────────────────────────────────── */
+  profile() { return raw("/account/profile"); },
+  login(email, password) { return raw("/login", { method: "POST", body: { email, password } }); },
+  register(body) { return raw("/register", { method: "POST", body }); },
+  logout() { return raw("/logout", { method: "POST", body: {} }); },
+  updateProfile(body) { return raw("/account/profile", { method: "PATCH", body }); },
+  changePassword(current_password, new_password) {
+    return raw("/account/change-password", { method: "POST", body: { current_password, new_password } });
+  },
+  ssoConfig() { return withFallback("/auth/sso/config", {}, { enabled: false, providers: [] }); },
+
+  /* ── Snapshots, Time Machine, realtime ─────────────────────────────── */
+  snapshots() { return withFallback("/workspace/snapshots", {}, { snapshots: [] }); },
+  createSnapshot(name) { return raw("/workspace/snapshots", { method: "POST", body: { name } }); },
+  compareSnapshots(before_id, after_id) { return raw("/workspace/snapshots/compare", { method: "POST", body: { before_id, after_id } }); },
+  snapshotExport(snapshot_id) { return raw(`/workspace/snapshots/${encodeURIComponent(snapshot_id)}/export`, { method: "POST", body: {} }); },
+  snapshotRestore(snapshot_id) { return raw(`/workspace/snapshots/${encodeURIComponent(snapshot_id)}/restore`, { method: "POST", body: {} }); },
+  timeMachine(limit = 100) { return withFallback(`/workspace/time-machine?limit=${encodeURIComponent(limit)}`, {}, { events: [] }); },
+  realtimeFeed(limit = 50) { return withFallback(`/realtime/feed?limit=${encodeURIComponent(limit)}`, {}, { events: [], stats: {} }); },
+  presence() { return withFallback("/realtime/presence", {}, { presence: [], stats: {} }); },
+
+  /* ── Approval + Brain Network surfaces ─────────────────────────────── */
+  permissionsPending() { return withFallback("/permissions/pending", {}, { pending: {}, count: 0 }); },
+  denyPermission(token) { return raw(`/permissions/deny/${encodeURIComponent(token)}`, { method: "POST" }); },
+  networkIdentity() { return withFallback("/network/identity", {}, {}); },
+  networkPeers() { return withFallback("/network/peers", {}, { peers: [] }); },
+  pairPeer(body) { return raw("/network/peers", { method: "POST", body }); },
+  unpairPeer(peer_id) { return raw(`/network/peers/${encodeURIComponent(peer_id)}`, { method: "DELETE" }); },
+  pushPeer(peer_id, workspace_id) { return raw(`/network/push/${encodeURIComponent(peer_id)}`, { method: "POST", body: { workspace_id } }); },
 
   /* ── Chat (real backend: SSE /chat + /history/*) ────────────────────── */
 
@@ -402,9 +449,15 @@ export const api = {
   // Workflow Agents (Part 5)
   workflowDefinitions() { return withFallback("/workflows/api/definitions", {}, { workflows: [] }); },
   createWorkflow(body) { return raw("/workflows/api/definitions", { method: "POST", body }); },
+  updateWorkflow(id, body) { return raw(`/workflows/api/definitions/${encodeURIComponent(id)}`, { method: "PATCH", body }); },
   runWorkflow(id, body = {}) { return raw(`/workflows/api/definitions/${encodeURIComponent(id)}/run`, { method: "POST", body }); },
   workflowRuns() { return withFallback("/workflows/api/runs", {}, { runs: [] }); },
   workflowReplay(runId) { return raw(`/workflows/api/runs/${encodeURIComponent(runId)}/replay`); },
+  stopWorkflowRun(runId) { return raw(`/workflows/api/runs/${encodeURIComponent(runId)}/stop`, { method: "POST" }); },
+  resumeWorkflowRun(runId, approved = true) {
+    return raw(`/workflows/api/runs/${encodeURIComponent(runId)}/resume`, { method: "POST", body: { approved } });
+  },
+  workflowTriggers() { return withFallback("/workflows/api/triggers", {}, { running: false, armed: [] }); },
 
   // Long-Term Memory + Memory Manager (Parts 7, 8)
   memoryManager() { return withFallback("/api/memory/manager", {}, { sources: [], tiers: [], usage: {} }); },
@@ -532,6 +585,10 @@ export const api = {
     return withFallback(`/api/knowledge-graph/provenance${qs}`, {}, { items: [], count: 0 });
   },
 
+  kgProvenanceCoverage() {
+    return withFallback("/knowledge-graph/provenance/coverage", {}, { total_nodes: 0, nodes_with_provenance: 0, coverage_ratio: 0 });
+  },
+
   /** POST /api/knowledge-graph/export — logical JSON export of the whole graph. */
   graphExport() { return raw("/api/knowledge-graph/export", { method: "POST", body: {} }); },