ltcai 4.1.0 → 4.3.0

package/docs/V4_3_VALIDATION_REPORT.md

@@ -0,0 +1,58 @@
+# Lattice AI v4.3.0 Validation Report
+
+> Status: passed for v4.3.0 RC artifacts on 2026-06-12. No package registry,
+> marketplace, GitHub Release, or tag publish was performed.
+
+## Target Artifacts
+
+- `dist/ltcai-4.3.0-py3-none-any.whl`
+- `dist/ltcai-4.3.0.tar.gz`
+- `ltcai-4.3.0.tgz`
+- `dist/ltcai-4.3.0.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_4.3.0_aarch64.dmg`
+
+## Validation Matrix
+
+| Gate | Command | Result |
+| --- | --- | --- |
+| Python compile check | `npm run check:python` | PASS — compiled 238 modules |
+| Ruff | `node scripts/run_python.mjs -m ruff check .` | PASS |
+| Unit tests | `npm run test:unit` | PASS — 598 passed, 2 warnings |
+| Integration tests | `LTCAI_TEST_BASE_URL=http://127.0.0.1:8899 npm run test:integration` | PASS — 9 passed, 1 skipped; backend was started on loopback with tunnel, Telegram, autoload, and network CORS disabled |
+| Frontend lint | `npm run lint:frontend` | PASS — frontend TS, no-CDN scan, OpenAPI path guard; 318 paths |
+| TypeScript typecheck | `npm run typecheck` | PASS — frontend and VS Code extension build |
+| Playwright visual/offline | `npm run test:visual` | PASS — 12 passed |
+| Tauri check | `npm run desktop:tauri:check` | PASS |
+| Tauri build | `npm run release:artifacts` | PASS — built app and DMG through `desktop:tauri:build` |
+| Archive export/import/restore | `tests/unit/test_v42_brain_storage.py`, `tests/unit/test_kg_portability.py` | PASS |
+| Backup/restore corruption | `tests/unit/test_kg_portability.py` | PASS |
+| Signature/version mismatch | `tests/unit/test_v42_brain_storage.py`, `tests/unit/test_t8_brain_network.py` | PASS |
+| Default startup no-network | `tests/unit/test_config.py`, `tests/unit/test_v43_product_hardening.py`, `tests/unit/test_v43_cli_privacy.py`, integration startup banner | PASS |
+| Release artifact validation | `npm run release:validate` | PASS — exact 4.3.0 files found; warning retained for historical artifacts in `dist/` |
+| Wheel smoke | `node scripts/run_python.mjs scripts/wheel_smoke.py --wheel dist/ltcai-4.3.0-py3-none-any.whl` | PASS |
+| npm pack dry-run | `npm pack --dry-run` | PASS |
+
+## Artifact Hashes
+
+| Artifact | SHA-256 |
+| --- | --- |
+| `dist/ltcai-4.3.0-py3-none-any.whl` | `c6fb5457bff312ebf694ccf83e53f82124de2b6d83f7f988a4f672b39475cf27` |
+| `dist/ltcai-4.3.0.tar.gz` | `c7830b7db62ea0e6e7de2107f3c0903d17546cf9bfa199596fdb930d372a0aaf` |
+| `dist/ltcai-4.3.0.vsix` | `939a2839f2b5551136df14321fbfe3da0460e35f76be3a1fea5306628c640df0` |
+| `ltcai-4.3.0.tgz` | `e4c94d6331482dd913525c24198d95fef693667a85df88b73548ec281ac1cb16` |
+| `src-tauri/target/release/bundle/dmg/Lattice AI_4.3.0_aarch64.dmg` | `bda5020dd556cd918cc3ef448468f175934e95ab4a7665a37db195faac7fc5fb` |
+
+## Notes
+
+- The v4.2 live Docker/pgvector integration test was skipped because no v4.3
+  Docker consent was requested for this release-candidate validation pass.
+- A direct `npm run test:integration` without a live server fails by design; the
+  passing run above used the documented `LTCAI_TEST_BASE_URL` against an
+  isolated loopback server.
+- Tauri/Cargo emitted a dependency future-incompatibility warning for `block
+  v0.1.6`; it did not fail `cargo check` or the release build.
+
+## Registry Policy
+
+No PyPI, npm Registry, VS Code Marketplace, Open VSX, or other external
+registry publish is part of this RC.

package/docs/V4_DIGITAL_BRAIN_RECOVERY.md

@@ -5,30 +5,28 @@
 > completed analysis. **Update this file before ending any phase and before any
 > likely session/context/usage limit.**
 >
-> Last updated: 2026-06-12 — v4.1.0 frontend/desktop rebuild RC; Remaining Gaps remain empty
+> Last updated: 2026-06-12 — v4.3.0 Portability/Product Hardening RC; Remaining Gaps remain empty
 
 ---
 
-## 0. RC STATUS (v4.1.0 RC)
-
-**v4.1.0 replaces the frontend implementation and desktop shell on top of
-`main @ v4.0.1`; implementation gaps remain empty.**
-Latest implementation milestone: `/app` is now a React + TypeScript + Vite SPA
-with TanStack Query, Zustand, generated OpenAPI client usage, Cytoscape.js
-Brain graph, React Flow Act graph, Tailwind CSS, and local shadcn-style
-primitives. Tauri 2.0 is the primary desktop shell; Electron is fallback only.
-The existing FastAPI backend, Brain Core, storage architecture, and
-agent/workflow runtime remain the source of truth.
-The v4.1.0 RC process builds and validates local artifacts only. It does not
-publish to PyPI, npm Registry, VS Code Marketplace, Open VSX, or production
-deployment targets.
-v4.1.0 validation completed: OpenAPI generation (308 paths), Python compile,
-ruff, 585 unit tests, 9 live integration tests, frontend lint/no-CDN/API
-compatibility, TypeScript build, 12 Playwright visual/offline tests, Tauri
-cargo check, Tauri `.app` + DMG build, Electron fallback syntax/version check,
-Python wheel/sdist build, npm tgz build, VSIX build, release artifact
-validation, wheel smoke, and npm pack dry-run all passed. See
-`docs/V4_1_VALIDATION_REPORT.md`.
+## 0. RELEASE STATUS (v4.3.0 RC)
+
+**v4.3.0 hardens the v4.2 Brain Core/storage architecture into a portable,
+user-safe desktop release candidate; implementation gaps remain empty.**
+Latest implementation milestone: `.latticebrain` archive format v2 is the
+primary portable brain format and carries encrypted graph DB, blobs, portable
+JSON state, signed bundles, storage metadata, provenance, public device identity
+metadata, manifest hashes, inspect, verify, import, restore, and dry-run restore.
+Restore/import requires explicit confirmation unless dry-run. Live
+SQLite-to-Postgres migration now creates and verifies a pre-migration backup
+before copying data. Tauri exposes backend status/restart/shutdown and starts
+the sidecar with loopback/default-off guards. Admin product hardening status
+reports local-only startup posture, storage, backup health, device identity,
+permissions, and opt-in external integration state.
+The v4.3.0 RC process builds validated artifacts only. It does not tag, create a
+GitHub Release, publish to PyPI, npm Registry, VS Code Marketplace, Open VSX, or
+deploy to production targets.
+v4.3.0 validation report: `docs/V4_3_VALIDATION_REPORT.md`.
 Remaining implementation gaps: **none**.
 Owner-only blockers: pptx history rewrite (requires force-push/owner decision)
 and consent-gated production embedder provisioning (silent default download is
@@ -36,12 +34,12 @@ not permitted).
 
 ## Remaining Gaps
 
-None. v4.1.0 closes the frontend/desktop rebuild on top of the already-empty
-v4.0.1 gap list: legacy static v3 frontend assets are removed, `/app` is served
-from `static/app`, Brain/Ask/Capture/Act/Library/System cover the existing
-capability surface, and every visible control either calls an existing backend
-API or presents an honest unavailable/error state. Owner-only blockers above
-are intentionally not implementation gaps.
+None. v4.3.0 preserves the already-empty v4.2.0 gap list and closes the
+portability/product-hardening work: `.latticebrain` archives are verified,
+inspectable, dry-runnable, and confirmation-gated; default startup is local-only
+and token-inert; backup health and product hardening are admin-visible; release
+artifact validation includes the exact Tauri DMG. Owner-only blockers above are
+intentionally not implementation gaps.
 
 ## 1. Program Charter (from the user's v4.0.0 directive)
 
@@ -227,9 +225,9 @@ Track log (update at every track boundary):
   and KG provenance coverage. en/ko i18n runtime backs routes, shell, and new
   parity views; `scripts/lint_v3.mjs` gates it. Visual coverage moved to the
   v3 surface and legacy-page specs were retired.
-- T9-canvas agent left static/v3/js/views/graph-canvas.js (509 lines,
-  node --check passes) but NEVER rewired knowledge-graph.js — file kept
-  uncommitted in tree; integration outstanding.
+- Superseded note: an early T9-canvas handoff left a static v3 graph-canvas file
+  unrewired, but this is no longer active work. v4.1.0 removed `static/v3` and
+  replaced the graph surface with the React/Vite/Cytoscape Brain view.
 - NOTE: The old T3d queue is closed. T9 parity surfaces remain active with
   full contracts in this file + the plan.
   - **T3e**: docs/kg-schema.md regenerated from enums.
@@ -285,9 +283,9 @@ the canonical Phase A record.**
      services, 27 API routers + `server_app.py` at 1,554 lines). Legacy root
      modules ~6,720 lines incl. `knowledge_graph.py` **4,633 lines**,
      `kg_schema.py` 521, `llm_router.py` 775, `mcp_registry.py` 791.
-   - Frontend: `/app` v3 SPA (`static/v3/`, token-native) is primary; legacy
-     static HTML pages were later removed and compatibility routes redirect
-     into `/app`.
+  - Historical frontend baseline: `/app` static v3 SPA (`static/v3/`,
+     token-native) was primary at v3.6.0. v4.1.0 later replaced it with the
+     React/Vite SPA in `frontend/` and `static/app/`.
    - Repo root clutter: ~30 `ltcai-*.tgz` tarballs, `ltcai-0.3.1/` extracted copy,
      logs, `chat_history.json`, 15MB pptx — most likely untracked; verify with
      `git ls-files` before cleaning.

package/frontend/openapi.json

@@ -686,6 +686,121 @@
         "title": "CuTypeRequest",
         "type": "object"
       },
+      "DockerPostgresRequest": {
+        "properties": {
+          "consent": {
+            "default": false,
+            "title": "Consent",
+            "type": "boolean"
+          },
+          "dry_run": {
+            "default": false,
+            "title": "Dry Run",
+            "type": "boolean"
+          },
+          "port": {
+            "default": 5432,
+            "title": "Port",
+            "type": "integer"
+          }
+        },
+        "title": "DockerPostgresRequest",
+        "type": "object"
+      },
+      "EncryptedArchiveRequest": {
+        "properties": {
+          "passphrase": {
+            "title": "Passphrase",
+            "type": "string"
+          },
+          "path": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Path"
+          }
+        },
+        "required": [
+          "passphrase"
+        ],
+        "title": "EncryptedArchiveRequest",
+        "type": "object"
+      },
+      "EncryptedInspectRequest": {
+        "properties": {
+          "passphrase": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Passphrase"
+          },
+          "path": {
+            "title": "Path",
+            "type": "string"
+          }
+        },
+        "required": [
+          "path"
+        ],
+        "title": "EncryptedInspectRequest",
+        "type": "object"
+      },
+      "EncryptedRestoreRequest": {
+        "properties": {
+          "confirm": {
+            "default": false,
+            "title": "Confirm",
+            "type": "boolean"
+          },
+          "dry_run": {
+            "default": false,
+            "title": "Dry Run",
+            "type": "boolean"
+          },
+          "passphrase": {
+            "title": "Passphrase",
+            "type": "string"
+          },
+          "path": {
+            "title": "Path",
+            "type": "string"
+          }
+        },
+        "required": [
+          "path",
+          "passphrase"
+        ],
+        "title": "EncryptedRestoreRequest",
+        "type": "object"
+      },
+      "EncryptedVerifyRequest": {
+        "properties": {
+          "passphrase": {
+            "title": "Passphrase",
+            "type": "string"
+          },
+          "path": {
+            "title": "Path",
+            "type": "string"
+          }
+        },
+        "required": [
+          "path",
+          "passphrase"
+        ],
+        "title": "EncryptedVerifyRequest",
+        "type": "object"
+      },
       "ExportRequest": {
         "properties": {
           "filters": {
@@ -1883,6 +1998,16 @@
       },
       "RestoreRequest": {
         "properties": {
+          "confirm": {
+            "default": false,
+            "title": "Confirm",
+            "type": "boolean"
+          },
+          "dry_run": {
+            "default": false,
+            "title": "Dry Run",
+            "type": "boolean"
+          },
           "path": {
             "title": "Path",
             "type": "string"
@@ -1899,6 +2024,29 @@
         "title": "RestoreRequest",
         "type": "object"
       },
+      "SQLiteToPostgresRequest": {
+        "properties": {
+          "dry_run": {
+            "default": true,
+            "title": "Dry Run",
+            "type": "boolean"
+          },
+          "dsn": {
+            "title": "Dsn",
+            "type": "string"
+          },
+          "schema_name": {
+            "default": "lattice_brain",
+            "title": "Schema Name",
+            "type": "string"
+          }
+        },
+        "required": [
+          "dsn"
+        ],
+        "title": "SQLiteToPostgresRequest",
+        "type": "object"
+      },
       "SearchRequest": {
         "properties": {
           "limit": {
@@ -3395,7 +3543,7 @@
   },
   "info": {
     "title": "Lattice AI Server (local)",
-    "version": "4.1.0"
+    "version": "4.3.0"
   },
   "openapi": "3.1.0",
   "paths": {
@@ -3677,6 +3825,22 @@
         "summary": "Admin Policies"
       }
     },
+    "/admin/product-hardening": {
+      "get": {
+        "operationId": "admin_product_hardening_admin_product_hardening_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Admin Product Hardening"
+      }
+    },
     "/admin/roles": {
       "get": {
         "operationId": "admin_roles_admin_roles_get",
@@ -5102,6 +5266,94 @@
         "summary": "Agent Runtime Status"
       }
     },
+    "/api/brain/storage": {
+      "get": {
+        "operationId": "brain_storage_status_api_brain_storage_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Brain Storage Status"
+      }
+    },
+    "/api/brain/storage/migrate-postgres": {
+      "post": {
+        "operationId": "migrate_sqlite_to_postgres_api_brain_storage_migrate_postgres_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SQLiteToPostgresRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Migrate Sqlite To Postgres"
+      }
+    },
+    "/api/brain/storage/postgres/docker": {
+      "post": {
+        "operationId": "setup_postgres_docker_api_brain_storage_postgres_docker_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DockerPostgresRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Setup Postgres Docker"
+      }
+    },
     "/api/browser/ingest-current-tab": {
       "post": {
         "description": "Ingest a payload captured from the local browser extension.",
@@ -5946,6 +6198,186 @@
         "summary": "Index Status"
       }
     },
+    "/api/knowledge-graph/archive": {
+      "post": {
+        "operationId": "encrypted_archive_api_knowledge_graph_archive_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/EncryptedArchiveRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Encrypted Archive"
+      }
+    },
+    "/api/knowledge-graph/archive/import": {
+      "post": {
+        "operationId": "import_encrypted_archive_api_knowledge_graph_archive_import_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/EncryptedRestoreRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Import Encrypted Archive"
+      }
+    },
+    "/api/knowledge-graph/archive/inspect": {
+      "post": {
+        "operationId": "inspect_encrypted_archive_api_knowledge_graph_archive_inspect_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/EncryptedInspectRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Inspect Encrypted Archive"
+      }
+    },
+    "/api/knowledge-graph/archive/restore": {
+      "post": {
+        "operationId": "restore_encrypted_archive_api_knowledge_graph_archive_restore_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/EncryptedRestoreRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Restore Encrypted Archive"
+      }
+    },
+    "/api/knowledge-graph/archive/verify": {
+      "post": {
+        "operationId": "verify_encrypted_archive_api_knowledge_graph_archive_verify_post",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/EncryptedVerifyRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Verify Encrypted Archive"
+      }
+    },
     "/api/knowledge-graph/backup": {
       "post": {
         "operationId": "backup_graph_api_knowledge_graph_backup_post",
@@ -5982,6 +6414,22 @@
         "summary": "Backup Graph"
       }
     },
+    "/api/knowledge-graph/backup-health": {
+      "get": {
+        "operationId": "backup_health_api_knowledge_graph_backup_health_get",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            },
+            "description": "Successful Response"
+          }
+        },
+        "summary": "Backup Health"
+      }
+    },
     "/api/knowledge-graph/export": {
       "post": {
         "description": "Logical JSON export of the whole graph (read-only).",