ltcai 4.3.0 → 4.3.3

package/docs/CHANGELOG.md

@@ -1,5 +1,126 @@
 # Changelog
 
+The top entry is the current release-preparation target. Older entries are
+historical and may describe behavior as it existed at that release.
+
+## [4.3.3] - 2026-06-13
+
+> Dead-Code Cleanup release after the independent audit cleanup on top of
+> v4.3.2 release preparation.
+
+### Changed
+
+- Promoted the post-cleanup `main` tree to v4.3.3 so release artifacts are
+  exact-current-main after dead-code cleanup and documentation fixes.
+- Synchronized Python, npm, VS Code extension, Tauri, runtime constants,
+  generated OpenAPI metadata, visual mock metadata, and release docs to
+  `4.3.3`.
+- Updated README, architecture, feature status, release notes, and release guide
+  to describe v4.3.3 as the current release while preserving v4.3.2 audit
+  reports as historical evidence.
+
+### Fixed
+
+- Corrected architecture/documentation drift discovered by the independent
+  dead-code, architecture, and runtime audit.
+- Preserved Vercel/static-docs readiness so Vercel remains documentation-only
+  and does not auto-detect or deploy the localhost FastAPI runtime.
+- Kept README badge restoration and owner-published registry caveats aligned
+  with the release flow.
+
+### Validation
+
+- Python compile check, ruff, unit tests, live integration tests, frontend lint,
+  TypeScript typecheck, VS Code extension build, Playwright visual tests, Tauri
+  check/build, release artifact validation, wheel smoke, npm pack dry-run,
+  Markdown link check, Python package metadata check, and Vercel static build
+  passed for this release.
+
+### Artifacts
+
+- `dist/ltcai-4.3.3-py3-none-any.whl`
+- `dist/ltcai-4.3.3.tar.gz`
+- `dist/ltcai-4.3.3.vsix`
+- `ltcai-4.3.3.tgz`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_4.3.3_aarch64.dmg`
+
+## [4.3.2] - 2026-06-13
+
+> Product Polish & Graph UX Overhaul release candidate after v4.3.1.
+
+### Changed
+
+- Brain graph explorer now uses the existing Knowledge Graph and hybrid-search
+  APIs to provide semantic groups, type colors, importance/degree sizing,
+  search, min-importance filtering, focused neighborhoods, collapsible groups,
+  label modes, and query result panels.
+- Brain, Ask, Capture, Act, Library, and System product flows now render
+  structured cards, entity lists, readable status panels, and operation results
+  instead of normalizing user-facing runtime state into raw JSON dumps.
+- System portability controls now include `.latticebrain` import dry-run and
+  confirmed import alongside export, inspect, verify, restore dry-run, confirmed
+  restore, backup health, storage, Brain Network, and device identity status.
+- Static frontend assets, generated OpenAPI client, npm/Python/VSIX/Tauri
+  versions, and release artifacts are synchronized to `4.3.2`.
+- README publishing badges are restored for PyPI, npm, VS Code Marketplace,
+  Open VSX, CI, and license with explicit owner-controlled registry caveats.
+- `ARCHITECTURE.md` is rewritten as a diagram-first v4.3.2 system map.
+
+### Fixed
+
+- Tauri now also kills the FastAPI sidecar on app-level exit events, so a normal
+  macOS quit releases port 8765 after the rebuilt desktop app closes.
+- Vercel configuration now builds only a static documentation page and prevents
+  FastAPI auto-detection of `server.py`.
+
+### Validation
+
+- Python compile check, ruff, frontend lint, TypeScript build, VS Code extension
+  build, unit tests, live integration tests, Playwright visual tests, Tauri
+  check/build, release artifact validation, wheel smoke, npm pack dry-run, and
+  desktop startup/shutdown verification passed.
+- Markdown link check, README badge link validation, Mermaid structural sanity,
+  and Vercel static build/config validation passed.
+- End-user self-audit evidence is stored under `output/audits/v4.3.2-rc/`.
+
+### Artifacts
+
+- `dist/ltcai-4.3.2-py3-none-any.whl`
+- `dist/ltcai-4.3.2.tar.gz`
+- `dist/ltcai-4.3.2.vsix`
+- `ltcai-4.3.2.tgz`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_4.3.2_aarch64.dmg`
+
+## [4.3.1] - 2026-06-12
+
+> End-user audit repair release candidate for v4.3.0 artifacts.
+
+### Fixed
+
+- Tauri desktop startup now launches a visible shell, resolves the FastAPI
+  sidecar through installed or bundled runtime paths, reports backend status,
+  writes sidecar logs, and shuts down the child process on close.
+- npm clean install now ships `requirements.txt` and fails honestly when Python
+  dependency bootstrap cannot complete.
+- Model Load refuses implicit runtime installation and model downloads by
+  default, returning actionable unavailable states instead of hanging or making
+  unauthorized outbound requests.
+- Agent runtime API refuses simulation-mode execution when no LLM-backed model
+  is loaded, preventing fake success records.
+- Workflow UI exposes real create, import, export, and run paths backed by the
+  existing workflow API.
+- Runtime version labels, configured port reporting, SSO default redirect URI,
+  Postgres dependency status, sqlite-vec fallback reporting, and `.latticebrain`
+  bundle claims now match observed behavior.
+
+### Artifacts
+
+- `dist/ltcai-4.3.1-py3-none-any.whl`
+- `dist/ltcai-4.3.1.tar.gz`
+- `dist/ltcai-4.3.1.vsix`
+- `ltcai-4.3.1.tgz`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_4.3.1_aarch64.dmg`
+
 ## [4.3.0] - 2026-06-12
 
 > Portability & Product Hardening release candidate. v4.3.0 preserves the
@@ -10,9 +131,9 @@
 ### Added
 
 - `.latticebrain` archive format v2 with encrypted graph DB, blobs, portable
-  JSON state, signed bundles, storage metadata, provenance, public device
-  identity metadata, manifest hashes, inspect, verify, import, restore, and
-  restore dry-run.
+  JSON state, workspace export bundles when present, storage metadata,
+  provenance, public device identity metadata, manifest hashes, inspect,
+  verify, import, restore, and restore dry-run.
 - FastAPI routes for archive inspect/verify/import, backup health, and admin
   product-hardening status.
 - Product-hardening status for local-only startup, storage mode, backup health,

package/docs/V4_3_2_DEADCODE_AUDIT_REPORT.md

@@ -0,0 +1,174 @@
+# Lattice AI v4.3.2 — Independent Dead-Code, Architecture, and Runtime Audit
+
+Date: 2026-06-13. Performed by an independent reviewer (Claude) against the
+v4.3.2 release-preparation tree. Documents were treated as claims to verify,
+not as truth. This pass deletes only items classified DELETE NOW; it does not
+tag, create a GitHub Release, or publish to any registry.
+
+## Method
+
+- Built a reference graph over all 561 tracked files: Python import scan
+  (static + relative), npm/pyproject/MANIFEST packaging surfaces, CI workflows,
+  frontend imports, service-worker precache lists, and Markdown references.
+- Module-level orphan detection plus `vulture` (min-confidence 90) over
+  `latticeai`, `lattice_brain`, `tools`.
+- Full baseline validation BEFORE deletions (602/602 unit tests, ruff clean,
+  runtime smoke), repeated AFTER deletions.
+- Runtime audit against a live FastAPI backend built from the cleaned tree.
+
+## 1. Deleted files (DELETE NOW — all verified zero live references)
+
+| File | Why it is dead |
+| --- | --- |
+| `scripts/release-0.3.1.sh` | One-shot v0.3.1 commit/tag/push script; version-pinned, dangerous if re-run; referenced only by a historical audit JSON. |
+| `scripts/take_screenshots.js` | Captures retired legacy pages (`/`, `/admin`, `/graph`) deleted in the v4.1 SPA rebuild; those routes now 308-redirect. |
+| `scripts/capture/` (9 files incl. README) | Playwright capture tooling for retired legacy routes/selectors (e.g. waits on `#graph`, which no longer exists) and version-pinned v3.4.0/v2.2.x media scripts. Not used by CI, tests, or release flows. |
+| `scripts/generate_diagrams.py` | v3-era PNG diagram generator for `docs/images/`; outputs describe retired v3 UI; unreferenced outside historical audit JSON. |
+| `clear_logs.sh` | Resets v0.x-era root log files (`server.log`, `ai_server.log`, `chat_history.json`); nothing references it; current product logs elsewhere. |
+| `static/css/tokens.3ba22e37.css` | Byte-identical duplicate of `static/css/tokens.css`; zero references (verified `git grep`). |
+| `latticeai/api/deps.py` | Three type aliases, never imported anywhere since v1.4.0; confirmed by import scan. |
+
+Also removed: the five orphaned `capture:*` script entries in `package.json`.
+The deletions do not touch migrations, backup/restore code, compatibility
+shims, user data paths, v4.3.2 release artifacts, or README-linked docs.
+
+## 2. Kept for compatibility
+
+- Root deprecation shims (packaged in wheel/npm, imported by app and tests):
+  `server.py`, `kg_schema.py`, `knowledge_graph.py`, `knowledge_graph_api.py`,
+  `llm_router.py`, `mcp_registry.py`.
+- Live root modules (imported by `latticeai`): `auto_setup.py`,
+  `setup_wizard.py`, `local_knowledge_api.py`, `p_reinforce.py`,
+  `telegram_bot.py`, `ltcai_cli.py`.
+- `lattice_brain/*` one-line re-export modules (public Brain Core import
+  surface) and `latticeai/brain/*` (the physical implementation).
+- `desktop/electron/main.cjs` (documented fallback shell; `desktop:electron`).
+- `latticeai/api/ui_redirects.py` and frontend `routeAliases` (legacy
+  bookmark/hash-route compatibility — verified live by Playwright test
+  "legacy page URLs redirect into the replacement app").
+- `scripts/migrate_brain_storage.py` (migration tooling; protected class).
+- `static/vendor/fonts/*` and `static/vendor/icons/*` (precached by
+  `static/sw.js` offline shell; asserted by `test_t9_privacy_vendoring.py`).
+- Historical `RELEASE_NOTES_v*.md` and `docs/` reports (release-history
+  record; some linked from RELEASE_NOTES.md/CHANGELOG).
+
+## 3. Needs migration first
+
+- `static/vendor/chart.umd.min.js` and `static/vendor/marked.min.js`: no
+  shipped page references them since the v4.1 legacy-page retirement, but
+  they are pinned by `tests/unit/test_t9_privacy_vendoring.py`, pyproject
+  `data-files`/`package-data`, and `package.json` files. Safe removal requires
+  coordinated edits to that test and the packaging manifests in one change.
+- `static/sw.js` vendor-font precache entries: the React SPA does not
+  reference `/static/vendor/fonts` or tabler icons; if vendor assets are ever
+  pruned, the SHELL list and the t9 test must be updated together.
+- `get_conversation` parameter of
+  `latticeai/api/security_dashboard.py::create_security_router` is accepted
+  but never used (vulture, 100%); removing it changes a factory signature.
+
+## 4. Owner decision
+
+- `start_ai.sh` — legacy 24/7 uvicorn launcher (Korean-language, caffeinate
+  loop). Still functional against `server:app` but unreferenced and predates
+  the desktop product.
+- Root historical docs not linked from README: `PLATFORM_COMPLETION_REPORT_v3.4.0.md`,
+  `VISUAL_REBUILD_NOTES_v3.3.1.md`, `FIGMA_SPEC.md`, `STYLE_SYSTEM.md`,
+  `CLOUD_BOTS.md`, `AI_PHILOSOPHY.md`, `KNOWLEDGE_GRAPH.md`, `PUBLIC_MODE.md`,
+  `MODEL_POLICY.md`, plus unlinked old release notes (v3.3.0–v3.5.0, v4.0.0,
+  v4.1.0, v4.3.0). Historical record vs. clutter is an owner call.
+- `docs/images/` and `docs/assets/v3.4.0/` (tracked v3-era media used only by
+  historical docs; excluded from npm packaging).
+- Untracked local disk clutter (not part of the repo; not touched):
+  `ltcai-0.2.2.tgz` … `ltcai-4.3.1.tgz`, extracted `ltcai-0.3.1/`, historical
+  `dist/` artifacts, `server.log`, `ai_server.log`, `chat_history.json`,
+  `telegram_chats.json`, `venv/`, `.venv/`, `.build-venv/`, `agent_workspace/`,
+  local node_modules Electron payload. v4.3.2 artifacts must be preserved.
+- pptx history rewrite (pre-existing FEATURE_STATUS item; force-push only).
+
+## 5. Uncertain
+
+- None remaining at module/file granularity. Function-level dead branches
+  inside the large legacy single-file modules (`auto_setup.py`,
+  `setup_wizard.py`, `telegram_bot.py`) were not exhaustively proven dead and
+  were left untouched; ruff F-rules and vulture@90 report no findings there.
+
+## 6. Architecture mismatch report (code vs ARCHITECTURE.md)
+
+Verified as claimed: Tauri 2 primary shell with Electron fallback; React/Vite
+SPA shipped from `static/app` (asset manifest consistent with tracked
+assets); frontend speaks only generated-OpenAPI HTTP (318 paths, regenerated
+in lint); SQLite default `StorageEngine` with honest sqlite-vec fallback
+reporting; opt-in Postgres/Docker; encrypted `.latticebrain` format v2 with
+fail-closed wrong-passphrase (HTTP 400 observed); backup/restore dry-run and
+confirm gates; local-only startup posture per `/admin/product-hardening`;
+Vercel config is a docs-only static build.
+
+Mismatches found and addressed:
+
+1. "Independent Python package `lattice_brain`" was overstated: only
+   `core`, `archive`, and `storage/*` are standalone; graph/memory/context/
+   conversation modules physically live in `latticeai/brain/` and are
+   re-exported through `lattice_brain.*`. ARCHITECTURE.md now carries a
+   packaging note stating the boundary is an import-path contract. (Doc fix
+   only; no redesign.)
+2. Root `CHANGELOG.md` stub presented a stale `[4.0.1]` top entry while
+   `docs/CHANGELOG.md` is at 4.3.2; the stub now states the snapshot is
+   historical and points to the current changelog.
+3. Minor: the audit package's "Changed Files Since v4.3.1" manifest lists
+   `static/app/assets/index-BhPuj8rT.js{,.map}` and `index-yZswHE3d.css`,
+   which were superseded by the final tracked bundle
+   (`index-pdzil9ac.js` / `index-CHHal8Zl.css`). Historical claim; left as-is.
+
+## 7. Runtime audit results (post-cleanup tree, live backend)
+
+Backend built from the cleaned tree (uvicorn `server:app`, fresh data dir):
+
+- Startup/health: `/health` ok, version 4.3.2, mode local. `/app` serves the
+  SPA shell (HTTP 200).
+- Brain graph: `/knowledge-graph/graph` empty-state then populated after
+  ingestion; hybrid search returns real keyword/vector/graph channels.
+- Ask: `/history/conversations` durable store reachable; no-model state
+  honest (no fabricated answers; `current_model: null`).
+- Capture: `/upload/document` ingested a note; node appeared in the graph.
+- Act: workflow create persisted a real record; agent runtime reports
+  `ready:false, mode:simulation` with an honest unavailable reason.
+- Library: `/models` returns catalog with no runtime falsely loaded.
+- System: storage status (sqlite engine, honest brute-force-cosine fallback),
+  `/admin/product-hardening` local-only posture, backup health.
+- Backup/restore: backup created and verified; restore dry-run and confirmed
+  restore both succeeded with manifest verification.
+- `.latticebrain`: archive create (encrypted, format v2) → verify → import
+  dry-run → confirmed import all succeeded; wrong passphrase fails closed (400).
+- Desktop startup (Tauri DMG) and sidecar quit: not reproducible in this
+  Linux audit sandbox (no macOS/Rust toolchain). `src-tauri/` is untouched by
+  this cleanup, the v4.3.2 DMG passes artifact validation, and legacy-route
+  redirects plus the six product pages were exercised via Playwright instead.
+
+## 8. Validation results (after deletions)
+
+| Check | Result |
+| --- | --- |
+| Python compile (`scripts/check_python.py`) | OK — 236 modules |
+| Ruff (`ruff check .`) | All checks passed |
+| Unit tests (`pytest tests/unit`) | 602 passed, 0 failed |
+| Live integration (`pytest tests/integration` vs live server) | 9 passed, 1 skipped (live Postgres opt-in) |
+| Frontend lint (`scripts/lint_frontend.mjs`) | Pass (OpenAPI export: 318 paths) |
+| TypeScript typecheck (`tsc --noEmit`) | Clean |
+| vscode-extension build (`tsc -p .`) | Clean |
+| Playwright visual (`tests/visual/v3.spec.js`) | 12 passed |
+| Tauri check/build | Not run in sandbox (no Rust/macOS toolchain); Rust sources unchanged by cleanup |
+| Release artifact validation (`validate_release_artifacts.py 4.3.2 --require-vsix --require-tgz --require-dmg`) | OK (expected WARN: historical versions present in `dist/`) |
+| Wheel smoke | Adapted: wheel unpacked, all shipped modules byte-compiled, server booted from the installed-wheel tree, `/health` ok 4.3.2. Full `scripts/wheel_smoke.py` venv flow needs Python ≥3.11 (sandbox has 3.10). |
+| `npm pack --dry-run` | OK (291 files, 9.6 MB unpacked) |
+| Docs link check (`check_markdown_links.mjs`) | Pass (README + 15 linked files) |
+| Vercel static build | Pass |
+
+Environment caveat: Python checks ran on CPython 3.10 in the audit sandbox
+(project targets ≥3.11; CI runs 3.11/3.12). All 602 tests pass on 3.10 with a
+`tomllib` shim; no 3.11-only syntax exists in the tree.
+
+## 9. Scope guarantees
+
+No migrations, backup/restore/import code, compatibility shims, user data
+paths, or v4.3.2 release artifacts were deleted. No tag, GitHub Release, or
+registry publish was performed.

package/docs/V4_3_2_DOCUMENTATION_CLEANUP_REPORT.md

@@ -0,0 +1,81 @@
+# Lattice AI v4.3.2 Documentation Cleanup Report
+
+Date: 2026-06-13
+
+## Scope
+
+This release-preparation pass rewrote the public README and audited every
+Markdown file linked directly from it. The goal was publishing readiness, not
+feature work.
+
+## README Changes
+
+- Restored modern package/status badges for PyPI, npm, VS Code Marketplace,
+  Open VSX, CI, and license while keeping the v4.3.2 registry-publishing caveat.
+- Rewritten around observed v4.3.2 self-audit behavior.
+- Removed old v3 product-tour screenshots from the public tour.
+- Added GitHub-renderable screenshots/GIFs from
+  `output/audits/v4.3.2-rc/`.
+- Added required tour sections:
+  - Desktop startup
+  - Brain graph
+  - Ask
+  - Capture
+  - Act
+  - Library
+  - System
+  - Backup / Restore
+  - `.latticebrain` portability
+- Added current artifact list using exact v4.3.2 filenames.
+- Added known limitations and owner-controlled publishing caveats.
+
+## Linked Markdown Files Audited
+
+- `ARCHITECTURE.md`
+- `FEATURE_STATUS.md`
+- `RELEASE_NOTES.md`
+- `RELEASE_NOTES_v4.3.2.md`
+- `RELEASE.md`
+- `SECURITY.md`
+- `docs/CHANGELOG.md`
+- `docs/V4_3_2_GRAPH_UX_REPORT.md`
+- `docs/V4_3_2_PRODUCT_POLISH_REPORT.md`
+- `docs/V4_3_2_SELF_AUDIT_REPORT.md`
+- `docs/V4_3_2_VALIDATION_REPORT.md`
+- `docs/V4_3_2_DOCUMENTATION_CLEANUP_REPORT.md`
+- `docs/V4_3_2_GITHUB_VERCEL_CHECK_REPORT.md`
+- `docs/V4_3_2_INDEPENDENT_AUDIT_PACKAGE.md`
+- `docs/V4_DIGITAL_BRAIN_RECOVERY.md`
+
+## Updates Made
+
+- `ARCHITECTURE.md` is now a diagram-first system map covering Tauri startup,
+  the sidecar lifecycle, React/Vite, FastAPI, `lattice_brain`, StorageEngine,
+  SQLite default mode, PostgreSQL opt-in mode, archive portability,
+  backup/restore, privacy boundaries, release artifacts, and Vercel static docs.
+- `FEATURE_STATUS.md`, `RELEASE_NOTES.md`, and `docs/CHANGELOG.md` now make
+  clear that older sections are historical records.
+- `FEATURE_STATUS.md` now describes Vercel as a static documentation-only check
+  instead of the obsolete broken FastAPI deployment state.
+- `SECURITY.md` now references v4.3.2 and clarifies default local-only external
+  communication behavior.
+- `docs/V4_3_2_GITHUB_VERCEL_CHECK_REPORT.md` documents the `server.py`
+  auto-detection failure and the explicit static-only Vercel configuration.
+- `docs/V4_3_2_SELF_AUDIT_REPORT.md` now includes README-specific Ask and
+  Capture evidence.
+- `docs/V4_3_2_VALIDATION_REPORT.md` now includes Markdown-link and Vercel
+  build validation, README badge link validation, and Mermaid sanity checks.
+
+## Link Validation
+
+`npm run docs:check-links` validates README local links, README image/GIF paths,
+and links inside README-linked Markdown files. External web links are skipped by
+this local checker.
+
+README badge URLs were validated separately because the local Markdown checker
+intentionally skips external web links.
+
+## Result
+
+PASS. README-linked current documentation no longer contradicts the v4.3.2
+self-audit evidence, current architecture, feature status, or release notes.

package/docs/V4_3_2_GITHUB_VERCEL_CHECK_REPORT.md

@@ -0,0 +1,75 @@
+# Lattice AI v4.3.2 GitHub / Vercel Check Report
+
+Date: 2026-06-13
+
+## Decision
+
+Lattice AI v4.3.2 is a local-first desktop product. Vercel must not deploy the
+runtime, must not auto-detect `server.py` as a FastAPI entrypoint, and must not
+host a fake cloud product.
+
+Vercel is configured as a static documentation-only Git check.
+
+## Failure Addressed
+
+Observed Vercel failure:
+
+```text
+Found server.py but it does not define a top-level app FastAPI instance...
+```
+
+That detection path is wrong for this repository because the production runtime
+is the Tauri desktop app plus a localhost FastAPI sidecar.
+
+## Configuration
+
+`vercel.json` now explicitly sets:
+
+- `"framework": null` so the project uses Vercel's generic "Other" preset.
+- `"installCommand": "true"` as an explicit no-op install step; the static
+  status page uses only Node built-ins.
+- `"buildCommand": "node scripts/build_vercel_static.mjs"`.
+- `"outputDirectory": "vercel-static"`.
+- A rewrite from all routes to `/index.html`.
+
+The static build script writes `vercel-static/index.html`, a documentation page
+that explains the desktop/localhost runtime boundary. It does not import
+`server.py`, call FastAPI, run tests as an app, or expose placeholder product UI.
+
+This follows Vercel's documented project configuration model: `framework` can be
+set to `null` for the "Other" preset, and `buildCommand` / `outputDirectory`
+override project build settings.
+
+References:
+
+- https://vercel.com/docs/project-configuration/vercel-json
+- https://vercel.com/docs/builds/configure-a-build
+
+## GitHub Workflow Notes
+
+- `.github/workflows/ci.yml` runs Python compile, ruff, unit tests, integration
+  smoke, Python build, twine check, and wheel smoke.
+- `.github/workflows/visual.yml` runs Playwright visual smoke.
+- `.github/workflows/release.yml` builds and validates artifacts on tag push
+  only. It does not publish packages to external registries.
+
+## Validation
+
+Release-prep validation was rerun after the Vercel fix:
+
+- `npm run vercel:build`
+- Vercel config JSON parse check
+- README badge link validation
+- Markdown link check for README-linked docs
+- Mermaid block sanity check for `ARCHITECTURE.md`
+- `npx --yes vercel@54.12.2 build` reached local CLI project-linkage
+  validation and stopped with `project_settings_required` because this checkout
+  does not contain `.vercel` project settings or credentials. The committed
+  static build command itself passed.
+
+See `docs/V4_3_2_VALIDATION_REPORT.md` for the final command results.
+
+## Result
+
+PASS. Vercel is now an explicit static documentation-only check and should not
+try to auto-detect or deploy the local FastAPI sidecar.

package/docs/V4_3_2_GRAPH_UX_REPORT.md

@@ -0,0 +1,48 @@
+# Lattice AI v4.3.2 Graph UX Report
+
+Date: 2026-06-13
+
+## Scope
+
+v4.3.2 overhauls the Brain graph user experience without changing Brain Core,
+storage, or the FastAPI graph contract. The Brain page continues to consume the
+existing generated OpenAPI client and `/knowledge-graph/graph`.
+
+## Implemented
+
+- Semantic graph groups: Knowledge, Sources, Activity, Memory, People, System,
+  and Other.
+- Node styling by type, importance score, degree, and focus state.
+- Local search across title, id, summary, type, and metadata.
+- Backend hybrid-search integration for graph-related queries.
+- Minimum importance filtering with an honest visible count.
+- Group collapse/expand that preserves permanent access to hidden groups.
+- Focused neighborhoods from selected nodes.
+- Label mode controls for names, type, ids, and hidden labels.
+- Important-node list driven by graph degree and importance.
+
+## Data Contract
+
+The graph explorer uses existing runtime data only:
+
+- `/knowledge-graph/graph` for nodes and edges.
+- `/api/search/hybrid` for backend search results.
+- Existing stats, index status, memory, provenance, portability, backup, and
+  storage APIs for surrounding Brain panels.
+
+No demo graph, static graph, or placeholder graph data is used.
+
+## Evidence
+
+- Initial graph: `output/audits/v4.3.2-rc/screenshots/02-graph-explorer-before.png`
+- Search: `output/audits/v4.3.2-rc/screenshots/03-graph-search.png`
+- Group collapse: `output/audits/v4.3.2-rc/screenshots/04-graph-collapse-group.png`
+- Focus neighborhood: `output/audits/v4.3.2-rc/screenshots/05-graph-focus-neighborhood.png`
+- Walkthrough GIF: `output/audits/v4.3.2-rc/gifs/graph-product-walkthrough.gif`
+- Seeded graph log: `output/audits/v4.3.2-rc/logs/graph-after-upload.json`
+
+## Result
+
+PASS. The Brain graph is a real interactive view over persisted user data. The
+self-audit seeded the graph through the upload API, verified the resulting graph
+state, and exercised search, focus, collapse, backup, and portability flows.