ltcai 4.0.0 → 4.1.0

package/README.md

@@ -56,10 +56,10 @@ workspace around the work itself:
   LM Studio; nothing leaves your machine unless you opt in.
 - **Use cloud models only when you choose** — bring an API key for cloud LLMs
   when you want them, not by default.
-- **Inspect every agent run** — the built-in runner persists plans, reviews,
-  retries, and results as replayable run records. Today that runner is
-  deterministic and does not call a model; LLM-driven execution is the v4
-  runtime, in progress.
+- **Inspect every agent run** — runs persist queued/running/final state, plans,
+  reviews, retries, cancellation, and replayable logs. With a loaded model the
+  v4 runner uses it; without one, deterministic simulation mode is explicitly
+  labeled and does not call a model.
 
 Lattice AI is not a clone of ChatGPT, Claude, Cursor, Obsidian, or Notion. It
 sits in a different place: a **workspace** that ties local/self-hosted AI, your
@@ -75,8 +75,8 @@ and workflows together — and runs on your own hardware.
   Knowledge Graph.
 - Run local models through MLX, Ollama, or LM Studio, and use cloud LLMs only when
   you want to.
-- Define agent workflows and replay their run records step by step (execution
-  is deterministic scaffolding today — it does not yet call a model).
+- Define agent workflows and replay their run records step by step, including
+  live tool execution, approval pauses, and cooperative cancellation.
 - Separate personal work from organization work.
 - Switch between Basic, Advanced, and Admin modes depending on your role.
 
@@ -115,9 +115,9 @@ connect — context that stays useful even when you switch models.
 ![Lattice AI agent run with roles, logs, review, and retry](docs/assets/v3.4.0/agent-run.png)
 
 The agent runner turns a goal into an inspectable, replayable run record — roles,
-logs, review, and retry — that you can read back step by step. The runner shown
-here is deterministic and LLM-free; real model-driven execution is the v4
-runtime, currently in progress.
+logs, review, retry, and cancellation state — that you can read back step by
+step. Runs execute asynchronously and use the loaded model when one is available;
+otherwise they are labeled as simulation.
 
 ### Extend with hooks and the local runtime
 
@@ -203,34 +203,34 @@ npm run dev
 
 ## Latest Release
 
-### v3.6.0 — Knowledge Graph First
-
-- **Unified ingestion pipeline** — one entrypoint normalizes every source
-  (file, folder, web URL, browser tab, text/markdown/code) into the graph,
-  idempotent by content hash and bracketed by the `pre_tool`/`post_tool` hook
-  lifecycle.
-- **Formalized entity/relationship model** — first-class `Source`, `Repository`,
-  `Meeting`, `Organization`, `Workflow`, `Agent` entities and `indexed_from`,
-  `modified_by`, `belongs_to_project`, `part_of`, `discussed_in`, `decided_by`,
-  `generated_by`, `used_by_agent` relationships.
-- **Browser & web ingestion** — `POST /api/browser/read-url` and
-  `/ingest-current-tab`, plus a local Manifest V3 extension that posts only to
-  `127.0.0.1`.
-- **Portability** — local Knowledge Graph export/import (versioned JSON) and
-  binary backup/restore (DB + blobs, integrity-checked). No cloud required.
-- **Provenance** — every node records where it came from; a queryable audit trail
-  makes the graph explainable.
-- **Knowledge Graph as the primary surface** — the view becomes your digital brain
-  with Status, Sources, Capture, and Backup tabs.
-
-See [RELEASE_NOTES_v3.6.0.md](RELEASE_NOTES_v3.6.0.md),
+### v4.1.0 RC — Frontend & Desktop Rebuild
+
+- **React desktop SPA** — `/app` is now a React + TypeScript + Vite application
+  with TanStack Query, Zustand, React Flow, Cytoscape.js, Tailwind CSS, and
+  local shadcn-style primitives.
+- **Generated API client** — frontend JSON calls consume the existing FastAPI
+  contract through a generated OpenAPI TypeScript client; streaming chat and
+  multipart upload remain honest fetch special cases.
+- **Tauri-first desktop shell** — Tauri 2.0 is the primary desktop target,
+  launching the local backend by default; Electron is retained as a fallback
+  shell only.
+- **Graph-first navigation** — the primary surfaces are Brain, Ask, Capture,
+  Act, Library, and System, with old `/app#...` routes mapped into the new
+  capability groups.
+- **No CDN / offline-capable** — shipped app assets are built into
+  `static/app`, service-worker precached, and verified to avoid CDN
+  dependencies.
+- **v4.0.1 capability preservation** — Brain Core, storage, agent/workflow
+  runtime, privacy model, local-first operation, and backend API contracts are
+  preserved.
+
+See [RELEASE_NOTES_v4.1.0.md](RELEASE_NOTES_v4.1.0.md),
 [docs/kg-schema.md](docs/kg-schema.md),
-[docs/RUNTIME_HOOK_COVERAGE_v3.6.0.md](docs/RUNTIME_HOOK_COVERAGE_v3.6.0.md), and
 [FEATURE_STATUS.md](FEATURE_STATUS.md).
 
 ## How it works — every source converges into the graph
 
-As of v3.6.0, all data sources flow through **one unified ingestion pipeline** into
+As of v4.1.0, data sources flow through the brain ingestion pipeline into
 the Knowledge Graph — no source bypasses it, none becomes an isolated silo:
 
 ```text
@@ -264,6 +264,9 @@ For the deeper design, see [ARCHITECTURE.md](ARCHITECTURE.md) and
 
 - [ARCHITECTURE.md](ARCHITECTURE.md) — workspace, graph, pipeline, and model overview
 - [docs/architecture.md](docs/architecture.md) — full architecture reference
+- [docs/V4_1_FRONTEND_ARCHITECTURE_REVIEW.md](docs/V4_1_FRONTEND_ARCHITECTURE_REVIEW.md) — v4.1.0 frontend and desktop architecture review
+- [docs/V4_1_FRONTEND_MIGRATION_REPORT.md](docs/V4_1_FRONTEND_MIGRATION_REPORT.md) — v4.1.0 capability migration report
+- [docs/V4_1_VALIDATION_REPORT.md](docs/V4_1_VALIDATION_REPORT.md) — v4.1.0 validation report
 - [docs/V3_BACKEND_ARCHITECTURE.md](docs/V3_BACKEND_ARCHITECTURE.md) — backend storage, search, and retrieval
 
 ### Knowledge and retrieval
@@ -282,6 +285,9 @@ For the deeper design, see [ARCHITECTURE.md](ARCHITECTURE.md) and
 ### Releases
 
 - [RELEASE_NOTES.md](RELEASE_NOTES.md) — current release notes
+- [RELEASE_NOTES_v4.1.0.md](RELEASE_NOTES_v4.1.0.md)
+- [RELEASE_NOTES_v4.0.1.md](RELEASE_NOTES_v4.0.1.md)
+- [RELEASE_NOTES_v4.0.0.md](RELEASE_NOTES_v4.0.0.md)
 - [RELEASE_NOTES_v3.6.0.md](RELEASE_NOTES_v3.6.0.md)
 - [RELEASE_NOTES_v3.5.0.md](RELEASE_NOTES_v3.5.0.md)
 - [RELEASE_NOTES_v3.4.1.md](RELEASE_NOTES_v3.4.1.md)
@@ -292,7 +298,10 @@ For the deeper design, see [ARCHITECTURE.md](ARCHITECTURE.md) and
 
 | Version | Theme |
 | --- | --- |
-| **3.6.0** | Knowledge Graph First — unified ingestion pipeline, formalized entity/relationship model, browser/web ingestion, local export/import/backup, provenance, KG as the primary surface |
+| **4.1.0** | Frontend & Desktop Rebuild RC — React/Vite/OpenAPI desktop SPA, Tauri 2.0 primary shell, graph-first navigation, and legacy static frontend removal |
+| **4.0.1** | Digital Brain Platform maintenance — closes post-tag v4 gaps with durable async runs, stable identity/workspace state, full `/app` parity, and legacy UI retirement |
+| **4.0.0** | Digital Brain Platform — decomposed brain store, v2 write-mastered Knowledge Graph, durable memory/context, real workflow/agent foundations, signed brain exchange |
+| 3.6.0 | Knowledge Graph First — unified ingestion pipeline, formalized entity/relationship model, browser/web ingestion, local export/import/backup, provenance, KG as the primary surface |
 | 3.5.0 | Foundation stabilization & verification — OIDC verifier, trusted-proxy gating, runtime hook coverage, `tools/` package, reproducible artifacts |
 | 3.4.1 | Runtime completion — full hooks lifecycle, real Local Agent probes, Connect Folder and Folder Watch verified end-to-end |
 | 3.4.0 | Platform completion — hooks execution, uploads in Files, vision image input, agent run trigger, on-device Local Agent / Connect Folder / Folder Watch |

package/desktop/electron/main.cjs

@@ -0,0 +1,44 @@
+const { app, BrowserWindow } = require("electron");
+const { spawn } = require("node:child_process");
+const path = require("node:path");
+
+const origin = process.env.LATTICEAI_DESKTOP_BACKEND_ORIGIN || "http://127.0.0.1:8765";
+let backend = null;
+
+function startBackend() {
+  if (process.env.LATTICEAI_DESKTOP_NO_BACKEND) return;
+  const command = process.env.LATTICEAI_DESKTOP_BACKEND_CMD || "python3 ltcai_cli.py --host 127.0.0.1 --port 8765";
+  const [bin, ...args] = command.split(/\s+/).filter(Boolean);
+  if (!bin) return;
+  backend = spawn(bin, args, {
+    cwd: process.env.LATTICEAI_DESKTOP_BACKEND_CWD || path.resolve(__dirname, "../.."),
+    env: { ...process.env, LATTICEAI_HOST: "127.0.0.1", LATTICEAI_PORT: "8765", LATTICEAI_TUNNEL: "false" },
+    stdio: "ignore",
+  });
+}
+
+function createWindow() {
+  const win = new BrowserWindow({
+    width: 1440,
+    height: 920,
+    minWidth: 1024,
+    minHeight: 720,
+    title: "Lattice AI",
+    webPreferences: {
+      contextIsolation: true,
+      nodeIntegration: false,
+      sandbox: true,
+    },
+  });
+  win.loadURL(`${origin}/app`);
+}
+
+app.whenReady().then(() => {
+  startBackend();
+  createWindow();
+});
+
+app.on("window-all-closed", () => {
+  if (backend) backend.kill();
+  if (process.platform !== "darwin") app.quit();
+});

package/docs/CHANGELOG.md

@@ -1,5 +1,111 @@
 # Changelog
 
+## [4.1.0] - 2026-06-12
+
+> Frontend & Desktop Rebuild release candidate. The existing FastAPI backend,
+> Brain Core, storage architecture, and agent/workflow runtime remain the
+> source of truth; the frontend and desktop shell are replaced by a React/Vite
+> desktop architecture.
+
+### Added
+
+- React + TypeScript + Vite SPA under `frontend/`, using TanStack Query,
+  Zustand, React Flow, Cytoscape.js, Tailwind CSS, local shadcn-style
+  primitives, and a generated OpenAPI TypeScript client.
+- Tauri 2.0 desktop shell under `src-tauri/` that launches the local backend
+  and exposes the backend origin to the SPA; Electron fallback shell retained
+  under `desktop/electron/`.
+- Primary graph-first navigation: Brain, Ask, Capture, Act, Library, System.
+- OpenAPI export/generation script and frontend lint guard for generated-client
+  usage, no-CDN static assets, and stale frontend references.
+
+### Changed
+
+- `/app` now serves the built React/Vite bundle from `static/app`.
+- Legacy static v3 frontend assets and v3 build/lint scripts are removed after
+  capability parity was migrated into the new React surfaces.
+- Release/build scripts now build Vite app assets and preserve Python, npm, and
+  VSIX packaging flows at version `4.1.0`.
+- npm Python-backed scripts use `scripts/run_python.mjs` to prefer
+  `LTCAI_PYTHON` or the repo virtualenv before falling back to system Python.
+
+### Validation Scope
+
+- Python compile check, ruff, unit tests, live integration tests, frontend lint,
+  TypeScript build, Playwright visual tests, desktop shell checks, no-CDN
+  verification, release artifact validation, wheel smoke, and npm pack dry-run.
+
+### Expected Artifacts
+
+- `dist/ltcai-4.1.0-py3-none-any.whl`
+- `dist/ltcai-4.1.0.tar.gz`
+- `dist/ltcai-4.1.0.vsix`
+- `ltcai-4.1.0.tgz`
+
+## [4.0.1] - 2026-06-12
+
+> Digital Brain Platform maintenance release for commits on `main` after tag
+> `v4.0.0`. This release does not publish to PyPI, npm, the VS Code
+> Marketplace, or Open VSX; artifacts are built and attached to GitHub Release
+> `v4.0.1` only.
+
+### Added
+
+- Durable async run executor for agent/workflow runs, including persisted
+  queued/running/final states, realtime SSE progress, cooperative cancellation,
+  and startup reconciliation of orphaned active runs.
+- Stable user UUID migration, centralized policy enforcement, local invitation
+  tokens, and SQLite-backed Workspace OS state with JSON compatibility
+  mirroring.
+- Complete `/app` SPA parity surfaces for account/profile/password, workspace
+  and organization administration, invitations, snapshots/time-machine with
+  merge-restore, activity/presence, run approvals/cancellation, workflow
+  triggers, Brain Network pairing/push, chat context trace, and Knowledge Graph
+  provenance coverage.
+
+### Changed
+
+- Retired legacy static HTML/CSS/JS UI pages and legacy visual specs. Legacy GET
+  routes now redirect into the matching `/app` surface.
+- Added en/ko i18n runtime coverage for the shell, routes, and new parity views,
+  guarded by `scripts/lint_v3.mjs`.
+- Bumped synchronized package/runtime versions to `4.0.1`.
+
+### Expected Artifacts
+
+- `dist/ltcai-4.0.1-py3-none-any.whl`
+- `dist/ltcai-4.0.1.tar.gz`
+- `dist/ltcai-4.0.1.vsix`
+- `ltcai-4.0.1.tgz`
+
+## [4.0.0] - 2026-06-12
+
+> Digital Brain Platform. The Knowledge Graph is now the durable brain store
+> spine: focused `latticeai/brain/` modules own graph storage, schema, ingestion,
+> provenance, retrieval, and document structure, while root modules remain
+> compatibility shims.
+
+### Changed
+
+- Decomposed the monolithic Knowledge Graph implementation into focused
+  `latticeai/brain/` modules, with every new module kept below 1,500 lines.
+- Flipped graph writes to `nodes_v2` / `edges_v2` as the authoritative write
+  path; legacy tables are maintained as a compatibility projection.
+- Added one-time pre-flip SQLite backup, `PRAGMA user_version=4`, schema-version
+  reporting, and fail-closed protection for newer DB formats.
+- Added the durable async run executor for agent/workflow runs: persisted
+  queued/running/final states, realtime SSE progress, cooperative cancellation,
+  and startup reconciliation of orphaned active runs.
+- Added stable user UUID migration, centralized RBAC policy enforcement, local
+  invitation tokens, and SQLite-backed Workspace OS state with JSON compatibility
+  mirroring and no durable-history truncation.
+- Retired the legacy static UI pages in favor of the v4 `/app` SPA. Legacy GET
+  routes redirect into `/app`; new parity views cover token-native account,
+  workspace/org management, invitations, snapshots/time-machine with
+  merge-restore, activity/presence, run approvals/cancellation, workflow
+  triggers, Brain Network peer pairing/push, chat context trace, and Knowledge
+  Graph provenance coverage, with en/ko i18n gated by frontend lint.
+
 ## [3.6.0] - 2026-06-10
 
 > Knowledge Graph First. The Knowledge Graph becomes the primary architecture:

package/docs/REALTIME_COLLABORATION.md

@@ -41,7 +41,7 @@ The bus is **in-process** (one server, local-first) and fans events out to
 in-memory subscriber queues.
 
 > **Compatibility.** This subsystem is purely additive. It introduces new
-> `/realtime/*` endpoints and an `/activity` page, and it attaches to the
+> `/realtime/*` endpoints and an `/app#/activity` page, and it attaches to the
 > existing `WorkspaceOSStore` through an optional `event_sink` hook. No v1.x
 > data shape, API, or behavior changes. With zero subscribers the bus is a
 > no-op, so single-user local mode behaves exactly as before.
@@ -274,8 +274,8 @@ router is mounted in `server_app.py` with the live bus, the auth helpers, and
 
 ### `GET /activity`
 
-Serves the Activity UI page (`static/activity.html`). Returns `404` if the UI
-file or static directory is not available.
+Compatibility redirect to `/app#/activity`. The Activity UI is part of the v4
+SPA and reads `/realtime/feed`, `/realtime/presence`, and `/workspace/time-machine`.
 
 ### `GET /realtime/stream`
 

package/docs/V3_FRONTEND.md

@@ -6,9 +6,9 @@
 
 Entry point: **`/app`** (served by `latticeai/api/static_routes.py` →
 `static/v3/index.html`). Login, auto-login after registration, SSO callback, and
-the PWA manifest land on `/app`. The legacy multi-page screens (`/workspace`,
-`/chat`, `/graph`, `/admin`, …) remain reachable only as compatibility/debug
-routes; normal user workflows stay in `/app`.
+the PWA manifest land on `/app`. Legacy multi-page static screens have been
+deleted; compatibility routes (`/workspace`, `/chat`, `/graph`, `/admin`, …)
+redirect into their `/app#/...` views.
 
 ---
 
@@ -31,11 +31,12 @@ One declarative table (`static/v3/js/core/routes.js`) drives the nav rail, the
 command palette, the router, breadcrumbs, and lazy view loading.
 
 ```
-Workspace      Home · Chat
-Retrieval      Knowledge Graph · Hybrid Search
-Data           Files · Pipeline*
-Compute        Agents* · Models · My Computer*
-System         Settings
+Brain          Knowledge Graph · Hybrid Search · Memory
+Ask            Chat
+Capture        Files · Pipeline*
+Act            Agents* · Runs* · Workflows* · Planning* · Hooks*
+Library        Models · Skills* · MCP* · Marketplace*
+System         Overview · Account · Workspaces · Snapshots · Activity · Network* · Settings · My Computer*
 Administration Users · Permissions · Audit Logs · Security · Policies · Private VPC   (admin mode)
 ```
 

package/docs/V4_1_FRONTEND_ARCHITECTURE_REVIEW.md

@@ -0,0 +1,65 @@
+# v4.1.0 Frontend Architecture Review
+
+## Scope
+
+This review covers the v4.1.0 replacement of the `/app` frontend and desktop
+shell. It does not redesign Brain Core, storage, backend API contracts, or the
+agent/workflow runtime.
+
+## Baseline
+
+v4.0.1 served a static frontend assembled under `static/v3` with bespoke build
+and lint scripts. Capability parity existed, but the implementation duplicated
+view systems, carried legacy static route assumptions, and could not cleanly
+share typed API contracts with the FastAPI backend.
+
+## Target Architecture
+
+- Desktop shell: Tauri 2.0 primary, Electron fallback only.
+- Frontend: React, TypeScript, Vite, TanStack Query, Zustand, React Flow,
+  Cytoscape.js, Tailwind CSS, local shadcn-style primitives.
+- API: generated OpenAPI TypeScript client from the existing FastAPI app.
+- Runtime: single client-side SPA, no SSR, no CDN.
+- Backend: existing FastAPI app remains the source of truth.
+
+## Implemented Architecture
+
+- `frontend/` owns the React/Vite source.
+- `frontend/src/api/openapi.ts` is generated from `frontend/openapi.json`.
+- `frontend/src/api/client.ts` wraps generated-client JSON calls and keeps
+  streaming chat plus multipart upload as explicit fetch special cases.
+- `frontend/src/routes.ts` defines Brain, Ask, Capture, Act, Library, System and
+  maps legacy hash routes into those groups.
+- `static/app` is the shipped build output and is served by `/app`.
+- `src-tauri/` contains the Tauri 2.0 shell and backend-origin bridge.
+- `desktop/electron/` contains the fallback shell.
+- `static/sw.js` precaches the React app manifest/assets for offline-capable
+  local startup.
+
+## Boundary Decisions
+
+- The backend contract was preserved; only the frontend consumer changed.
+- Brain Core and storage modules were not modified for UI convenience.
+- No CDN fallback was introduced; all visual/runtime dependencies are bundled.
+- No demo-only controls were added. Unavailable capabilities render explicit
+  unavailable/error states based on API responses.
+- npm runtime installs are kept lean: React/Vite/Tauri/Electron toolchains are
+  development dependencies because the distributable app ships built assets.
+
+## Capability Mapping
+
+| v4.0.1 capability | v4.1.0 surface |
+| --- | --- |
+| Knowledge Graph, hybrid search, memory, provenance, portability | Brain |
+| Chat, conversations, context trace, attachments | Ask |
+| Uploads, connected folders, local runtime, URL capture, index pipeline | Capture |
+| Agents, runs, approvals, workflows, triggers, hooks, tools | Act |
+| Models, embeddings, skills, MCP, templates/plugins | Library |
+| Account, auth, workspaces, snapshots, activity, network, settings, admin/security | System |
+
+## Residual Risk
+
+- The first Vite bundle is larger than 500 kB after minification because graph,
+  workflow, and app shell libraries are included in the initial desktop SPA
+  bundle. This is a performance optimization target, not a capability blocker,
+  and the build remains fully local/offline.

package/docs/V4_1_FRONTEND_MIGRATION_REPORT.md

@@ -0,0 +1,70 @@
+# v4.1.0 Frontend Migration Report
+
+## Objective
+
+Replace the v4.0.1 static frontend implementation with the Digital Brain
+desktop architecture while preserving capabilities, user data, backend API
+contracts, and local-first/offline operation.
+
+## Migration Summary
+
+- Added React + TypeScript + Vite source under `frontend/`.
+- Added generated OpenAPI schema/client files under `frontend/openapi.json` and
+  `frontend/src/api/openapi.ts`.
+- Added React capability pages for Brain, Ask, Capture, Act, Library, System.
+- Added Tauri 2.0 desktop shell under `src-tauri/`.
+- Added Electron fallback shell under `desktop/electron/`.
+- Replaced `/app` static serving with `static/app/index.html`.
+- Replaced v3 asset build/lint scripts with Vite build and frontend lint guards.
+- Removed `static/v3` and retired `scripts/build_v3_assets.mjs` /
+  `scripts/lint_v3.mjs`.
+- Updated package metadata so Python wheel/sdist, npm tgz, and VSIX builds ship
+  the new `static/app` assets.
+
+## Compatibility
+
+- Existing FastAPI routes are preserved.
+- The generated OpenAPI client is produced from the live app schema.
+- Legacy app hash routes are mapped into the new primary navigation groups.
+- Service worker caching now targets the Vite app manifest instead of v3 assets.
+- User data formats, Brain database files, Workspace OS state, snapshots,
+  conversations, memories, and graph data are not migrated or destructively
+  changed by the frontend rebuild.
+
+## Capability Parity
+
+| Capability | Migration result |
+| --- | --- |
+| Brain graph exploration | Cytoscape.js graph view in Brain |
+| Hybrid search | Brain search tab backed by `/api/search/hybrid` |
+| Memory recall | Brain memory tab backed by memory APIs |
+| Provenance and portability | Brain provenance/portability actions |
+| Chat and context trace | Ask surface with streaming chat and context panel |
+| Conversation management | Ask history backed by conversation APIs |
+| Document upload | Capture upload using multipart backend endpoint |
+| Connected folders/local runtime | Capture desktop/local runtime APIs |
+| Index pipeline and URL capture | Capture pipeline/browser ingestion APIs |
+| Agents and run records | Act agents/runs/approvals backed by runtime APIs |
+| Workflow graph | Act React Flow visualization and workflow APIs |
+| Triggers, hooks, tools | Act surfaces backed by trigger/hook/tool APIs |
+| Models and embeddings | Library model/embedding APIs |
+| Skills, MCP, templates/plugins | Library registry APIs |
+| Account/auth/profile/password | System account APIs |
+| Workspaces/invitations | System workspace APIs |
+| Snapshots/time-machine | System snapshot APIs |
+| Activity/presence/network | System activity and network APIs |
+| Admin/security/settings | System admin and settings APIs |
+
+## Removed Frontend Debt
+
+- Duplicate static v3 view modules.
+- Legacy frontend build pipeline.
+- Legacy v3 frontend lint script.
+- Static v3 asset tree in release packages.
+- Direct current-release references to v4.0.1 in latest docs.
+
+## Data Preservation
+
+No user data migration is required for v4.1.0. All persisted state remains owned
+by the existing backend stores. The frontend rebuild only changes the client and
+desktop shell used to access those stores.

package/docs/V4_1_VALIDATION_REPORT.md

@@ -0,0 +1,47 @@
+# v4.1.0 Validation Report
+
+## Summary
+
+v4.1.0 RC validation passed for the React/Vite frontend, Tauri desktop shell,
+FastAPI backend compatibility, release artifacts, and installed-wheel smoke.
+
+## Commands Run
+
+| Area | Command | Result |
+| --- | --- | --- |
+| OpenAPI generation | `npm run frontend:openapi` | Pass; generated 308 paths |
+| Static app build | `npm run build:assets` | Pass; wrote `static/app/asset-manifest.json` |
+| Frontend lint / no CDN / API compatibility | `npm run lint` | Pass; scanned 28 frontend/static files; OpenAPI exposes 308 paths |
+| TypeScript build | `npm run typecheck` | Pass; frontend TS + VS Code extension build |
+| Python compile | `npm run check:python` | Pass; compiled 206 modules |
+| Ruff | `node scripts/run_python.mjs -m ruff check .` | Pass |
+| Unit tests | `npm run test:unit -- --tb=short` | Pass; 585 passed, 2 warnings |
+| Live integration tests | `LTCAI_TEST_BASE_URL=http://127.0.0.1:8899 npm run test:integration -- --tb=short` | Pass; 9 passed |
+| Playwright visual/offline tests | `npx playwright test tests/visual/v3.spec.js` | Pass; 12 passed |
+| Tauri cargo check | `npm run desktop:tauri:check` | Pass |
+| Tauri desktop build | `LATTICEAI_DESKTOP_NO_BACKEND=1 npm run desktop:tauri:build` | Pass; built `.app` and DMG |
+| Electron fallback syntax/version | `node --check desktop/electron/main.cjs && npx electron --version` | Pass; Electron v42.4.0 |
+| Release artifacts | `npm run release:artifacts` plus resumed `npm pack && npm run package:vsix` | Pass |
+| Artifact validation | `npm run release:validate` | Pass; exact v4.1.0 wheel/sdist/VSIX/tgz found |
+| Wheel smoke | `node scripts/run_python.mjs scripts/wheel_smoke.py --wheel dist/ltcai-4.1.0-py3-none-any.whl` | Pass; imports 19 modules and `/health` reports 4.1.0 |
+| npm pack dry-run | `npm pack --dry-run` | Pass; `ltcai-4.1.0.tgz`, 259 files, 2.9 MB |
+
+## Generated Artifacts
+
+- `dist/ltcai-4.1.0-py3-none-any.whl`
+- `dist/ltcai-4.1.0.tar.gz`
+- `dist/ltcai-4.1.0.vsix`
+- `ltcai-4.1.0.tgz`
+- `src-tauri/target/release/bundle/macos/Lattice AI.app`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_4.1.0_aarch64.dmg`
+
+## Notes
+
+- Vite reports one large initial bundle warning after minification. The app
+  remains fully local/offline and passes visual/offline startup validation.
+- `cargo check` reports a future-incompatibility warning in transitive
+  `block v0.1.6`; the current Tauri 2.0 build passes on Rust 1.96.
+- Release artifact validation warns that historical artifacts remain in
+  `dist/`; this is expected and reinforces the rule to upload only exact
+  v4.1.0 filenames, never `dist/*`.
+- No external registry publish was performed.