ltcai 5.6.0 → 6.1.0

package/README.md

@@ -69,35 +69,42 @@ You need Lattice AI when:
 Choose the owner of the Brain. The profile is not a SaaS account by default; it
 is the local identity for the knowledge you keep.
 
-![Login](output/release/v5.3.0/screenshots/01-login.png)
+![Login](output/release/v6.1.0/screenshots/01-login.png)
 
 ### 2. Environment Analysis
 
 See what kind of local AI experience this computer can support before choosing a
 model.
 
-![Environment Analysis](output/release/v5.3.0/screenshots/02-environment-analysis.png)
+![Environment Analysis](output/release/v6.1.0/screenshots/02-environment-analysis.png)
 
 ### 3. Recommended Models
 
 Start with a short list: safest recommendation, faster model, stronger model.
 Advanced details stay available without overwhelming first-time users.
 
-![Recommended Models](output/release/v5.3.0/screenshots/03-recommended-models.png)
+![Recommended Models](output/release/v6.1.0/screenshots/03-recommended-models.png)
 
 ### 4. Install And Load
 
 Download and load only after consent. Lattice explains model size, local
 execution, and network use before work starts.
 
-![Install and Load](output/release/v5.3.0/screenshots/04-install-load-progress.png)
+![Install and Load](output/release/v6.1.0/screenshots/04-install-load-progress.png)
 
 ### 5. Brain Chat
 
 Talk normally. Useful decisions and context become memory, then appear later as
 topics, relationships, and graph structure.
 
-![Brain Chat Home](output/release/v5.3.0/screenshots/05-brain-chat-home.png)
+![Brain Chat Home](output/release/v6.1.0/screenshots/05-brain-chat-home.png)
+
+### 6. Review Center
+
+Automation results are staged for review before they become durable decisions.
+Snooze, unsnooze, run now, approve, and dismiss actions stay explicit.
+
+![Review Center](output/release/v6.1.0/screenshots/13-review-center.png)
 
 ## Brain Depths
 
@@ -113,10 +120,10 @@ The user travels inward from everyday memory to deeper structure:
 
 Walkthrough:
 
-![v5.3.0 Living Brain walkthrough](output/release/v5.3.0/gifs/v5.3.0-living-brain-walkthrough.gif)
+![v6.1.0 Living Brain walkthrough](output/release/v6.1.0/gifs/v6.1.0-living-brain-walkthrough.gif)
 
 Screenshot index and capture notes:
-[output/release/v5.3.0/SCREENSHOT_INDEX.md](output/release/v5.3.0/SCREENSHOT_INDEX.md)
+[output/release/v6.1.0/SCREENSHOT_INDEX.md](output/release/v6.1.0/SCREENSHOT_INDEX.md)
 
 ## Install
 
@@ -193,24 +200,36 @@ See [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md) for developer workflow details.
 
 ## Current Release Preparation
 
-The current development target is **5.6.0 Brain Automation Review Center**:
-
-- Automation output now lands in a workspace-scoped Review inbox before users
-  approve, dismiss, snooze, or rerun suggestions.
-- `/automation/reviews` exposes source-aware review items with provenance,
-  `effective_status`, and guarded actions.
-- TriggerService and RunExecutor can enqueue review items only when workflows
-  explicitly opt in with `review_queue: true`.
-- Act now includes a Review tab under Runs for pending automation suggestions.
-- All package/runtime/static/OpenAPI versions are synchronized to 5.6.0.
-
-Expected artifacts for 5.6.0 release must use exact filenames:
-
-- `dist/ltcai-5.6.0-py3-none-any.whl`
-- `dist/ltcai-5.6.0.tar.gz`
-- `ltcai-5.6.0.tgz`
-- `dist/ltcai-5.6.0.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_5.6.0_aarch64.dmg`
+The current development target is **6.1.0 Product Hardening / Digital Brain Completion**:
+
+- First-run now lets users create or open the local Brain even when they defer
+  model setup, keeping the Brain durable while models stay replaceable.
+- Brain Home explains the first memory loop: save useful context, see it return
+  in the Brain state, then protect it with backup/export.
+- Review Center keeps Pending, Snoozed, and All filters while clarifying that
+  Run now is a preview/regenerate action, not approval.
+- `lattice_brain` has an AST import guard so Brain Core does not import
+  `latticeai` or `ltcai`.
+- Model download consent has a unit guard: token presence alone does not start
+  an external download path.
+- `ltcai_cli.py` keeps the root entrypoint while pure CLI runtime helpers live
+  under `latticeai.cli.runtime`.
+- Tool dispatch authorization now has an injectable service boundary around
+  the shared ToolRegistry, reducing app-factory reliance on module globals.
+- Chat agent runtime construction moved into app-factory assembly and is passed
+  through `AppContext`, so the chat router no longer owns production runtime
+  construction.
+- v6.1 documentation tracks backend hardening, frontend UX hardening, and the
+  baseline scan for version metadata, root legacy modules, Brain Core boundary,
+  and local-first trust gates.
+
+Expected artifacts for 6.1.0 release must use exact filenames:
+
+- `dist/ltcai-6.1.0-py3-none-any.whl`
+- `dist/ltcai-6.1.0.tar.gz`
+- `ltcai-6.1.0.tgz`
+- `dist/ltcai-6.1.0.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_6.1.0_aarch64.dmg`
 
 Do not upload `dist/*`. Package registry publishing remains owner-run.
 
@@ -229,6 +248,7 @@ Do not upload `dist/*`. Package registry publishing remains owner-run.
 
 | Version | Theme |
 | --- | --- |
+| 6.0.0 | Product Reset / Review Center Completion: Snoozed filter, Unsnooze, OpenAPI-derived Review typing, Review feature extraction, v6 docs and scorecard |
 | 5.6.0 | Brain Automation Review Center: workspace-scoped automation review inbox, source-aware provenance, guarded approve/dismiss/snooze/run_now actions, and Act Review tab |
 | 5.5.0 | Release Coordination: synchronized package/runtime/static versions and release docs for the 5.5.0 line while preserving v5.4.0 Brain Automation Scheduler behavior |
 | 5.4.0 | Brain Automation Scheduler: consent-first recipe drafts (Daily/Weekly/Follow-up), TriggerService with dedup/LATTICE_TZ/degraded, runtime graph cleanup, E2E scenarios |

package/docs/CHANGELOG.md

@@ -3,6 +3,80 @@
 The top entry is the current release-preparation target. Older entries are
 historical and may describe behavior as it existed at that release.
 
+## [6.1.0] - 2026-06-16
+
+> Product Hardening / Digital Brain Completion. Tightens the local-first Brain
+> flow, Brain Core boundary, backend trust gates, and release documentation
+> without adding broad new product surfaces.
+
+### Added
+- First-run path to open the Brain without installing or loading a model first.
+- Brain Home empty-state loop that shows first memory save, Brain state return,
+  and backup ownership.
+- AST import guard proving `lattice_brain` does not import `latticeai` or
+  `ltcai`.
+- Unit coverage for model download consent blocking in `model_runtime`.
+- `latticeai.cli.runtime` for pure CLI runtime helpers while preserving the root
+  `ltcai_cli.py` entrypoint.
+- v6.1 baseline, frontend UX, backend hardening, and instruction documents under
+  `docs/v6.1/`.
+
+### Changed
+- Review Center cards clarify that Run now previews/executes without approval.
+- Static app assets are refreshed for the v6.1 frontend hardening changes.
+- Tool dispatch authorization now uses an injectable service boundary around
+  the shared ToolRegistry while preserving the legacy module-level API.
+- Chat agent runtime construction moved out of `create_chat_router` for
+  production app assembly and is now injected through `AppContext`.
+- README release evidence screenshots and walkthrough GIF are refreshed under
+  `output/release/v6.1.0/`, including the Review Center surface.
+- README and release notes now describe v6.1.0 as the current hardening target
+  with exact expected artifact filenames.
+
+### Preserved
+- Package publish, deployment, tag creation, and main merge remain out of scope
+  unless explicitly requested.
+- Package/runtime version metadata is synchronized to 6.1.0; package publish,
+  deployment, tag creation, and main merge remain owner-run only.
+
+## [6.0.0] - 2026-06-15
+
+> Product Reset / Review Center Completion. Raises the Review Center from a
+> pending-only inbox into a reversible automation review surface while
+> documenting the v6 quality uplift honestly.
+
+### Added
+- Review Center status filters for Pending, Snoozed, and All.
+- Explicit `POST /automation/reviews/{item_id}/unsnooze` API and backend policy.
+- Frontend Unsnooze action and clear `snoozed_until` presentation.
+- `docs/v6/PLAN.md`, `ARCHITECTURE_REVIEW.md`, `UX_REVIEW.md`, and
+  `QUALITY_SCORECARD.md`.
+
+### Changed
+- Review Center frontend moved from `Act.tsx` into
+  `frontend/src/features/review/` components and helpers.
+- Review item frontend types now alias generated OpenAPI component schemas.
+- Review Center API calls now use generated OpenAPI operation paths for list,
+  approve, dismiss, snooze, unsnooze, and run_now actions.
+- `app_factory.py` runtime assembly moved behind session, hooks, web,
+  persistence, lifespan, automation, context/search, platform service, app
+  context, and router-registration seams while preserving the frozen 364-entry
+  route/mount snapshot.
+- First-run/onboarding copy now states local-first trust boundaries more
+  directly: local knowledge by default, explicit downloads, and explicit
+  external transfer.
+- README release evidence screenshots and walkthrough GIF are refreshed under
+  `output/release/v6.0.0/`, including the Review Center surface.
+- OpenAPI artifacts and synchronized package/runtime/static metadata now target
+  `6.0.0`.
+
+### Preserved
+- `run_now` remains preview/regenerate and does not approve.
+- Snooze expiry remains read-time only; explicit unsnooze is the only immediate
+  return-to-pending mutation.
+- Package publishing, GitHub Release creation, artifact upload, and merge to
+  `main` remain out of scope for this branch.
+
 ## [5.6.0] - 2026-06-15
 
 > Brain Automation Review Center. Adds a workspace-scoped review inbox for

package/docs/V4_1_FRONTEND_MIGRATION_REPORT.md

@@ -61,7 +61,7 @@ contracts, and local-first/offline operation.
 - Legacy frontend build pipeline.
 - Legacy v3 frontend lint script.
 - Static v3 asset tree in release packages.
-- Direct current-release references to v4.0.1 in latest docs.
+- Direct then-current release references to v4.0.1 in then-latest docs.
 
 ## Data Preservation
 

package/docs/V4_6_1_RELEASE_REFRESH_REPORT.md

@@ -8,7 +8,7 @@ architecture or add unrelated product features.
 
 ## Completed Refresh Areas
 
-- Synchronized current-release version metadata to `4.6.1`.
+- Synchronized then-current release version metadata to `4.6.1`.
 - Reframed README around the current Living Brain flow:
   Login -> Environment Analysis -> Recommended Models -> Install & Load ->
   Brain Chat.

package/docs/V4_7_0_ADMIN_SEPARATION_REPORT.md

@@ -19,7 +19,7 @@ maintenance. This release does not redesign Brain Core or the storage layer.
 - Added frontend API helpers for `/admin/stats` and `/admin/security/events`.
 - Updated visual validation to confirm the admin console is separate from the
   user Brain surface.
-- Synchronized current-release version metadata to `4.7.0`.
+- Synchronized then-current release version metadata to `4.7.0`.
 - Updated README, RELEASE.md, release notes, changelog, architecture, security,
   feature status, VS Code extension docs, and release evidence references.
 

package/docs/V4_7_1_ADMIN_OPERATIONS_REPORT.md

@@ -26,7 +26,7 @@ maintenance. This release does not redesign Brain Core or the storage layer.
   admin observability state remain separate in the frontend runtime.
 - Updated visual validation to confirm the admin console is separate from the
   user Brain surface.
-- Synchronized current-release version metadata to `4.7.1`.
+- Synchronized then-current release version metadata to `4.7.1`.
 - Updated README, RELEASE.md, release notes, changelog, architecture, security,
   feature status, VS Code extension docs, and release evidence references.
 

package/frontend/openapi.json

@@ -7867,6 +7867,45 @@
         "summary": "Snooze Item"
       }
     },
+    "/automation/reviews/{item_id}/unsnooze": {
+      "post": {
+        "operationId": "unsnooze_item_automation_reviews__item_id__unsnooze_post",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "item_id",
+            "required": true,
+            "schema": {
+              "title": "Item Id",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReviewItem"
+                }
+              }
+            },
+            "description": "Successful Response"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            },
+            "description": "Validation Error"
+          }
+        },
+        "summary": "Unsnooze Item"
+      }
+    },
     "/chat": {
       "get": {
         "operationId": "chat_page_chat_get",

package/frontend/src/App.tsx

@@ -382,6 +382,11 @@ function BrainHome({
                   </button>
                 ))}
               </div>
+              <div className="mind-empty-trail" aria-label={t(language, "brain.empty.trail.label")}>
+                <span>{t(language, "brain.empty.trail.save")}</span>
+                <span>{t(language, "brain.empty.trail.recall")}</span>
+                <span>{t(language, "brain.empty.trail.backup")}</span>
+              </div>
             </div>
           ) : (
             messages.map((message, index) => (

package/frontend/src/api/client.ts

@@ -1,5 +1,5 @@
 import createClient from "openapi-fetch";
-import type { paths } from "./openapi";
+import type { components, operations, paths } from "./openapi";
 import { useAppStore } from "@/store/appStore";
 
 export type ApiResult<T = unknown> = {
@@ -21,7 +21,19 @@ export type AdminAuditFilters = {
 };
 
 const TIMEOUT_MS = 10_000;
-const clients = new Map<string, ReturnType<typeof createClient<paths>>>();
+type OpenApiClient = ReturnType<typeof createClient<paths>>;
+type OperationJson200<Operation> = Operation extends {
+  responses: { 200: { content: { "application/json": infer Result } } };
+} ? Result : never;
+type ReviewListOperation = operations["list_items_automation_reviews_get"];
+type ReviewItemOperation =
+  | operations["approve_item_automation_reviews__item_id__approve_post"]
+  | operations["dismiss_item_automation_reviews__item_id__dismiss_post"]
+  | operations["run_now_item_automation_reviews__item_id__run_now_post"]
+  | operations["snooze_item_automation_reviews__item_id__snooze_post"]
+  | operations["unsnooze_item_automation_reviews__item_id__unsnooze_post"];
+
+const clients = new Map<string, OpenApiClient>();
 let desktopBase: Promise<string | null> | null = null;
 
 declare global {
@@ -145,6 +157,39 @@ async function apiJson<T>(
   }
 }
 
+async function openApiJson<T>(
+  shape: T,
+  execute: (client: OpenApiClient, signal: AbortSignal) => Promise<{ data?: T; error?: unknown; response: Response }>,
+): Promise<ApiResult<T>> {
+  const base = await apiBase();
+  const client = clientFor(base);
+  const ctrl = new AbortController();
+  const timer = window.setTimeout(() => ctrl.abort(), TIMEOUT_MS);
+  try {
+    const { data, error, response } = await execute(client, ctrl.signal);
+    if (response.ok && data !== undefined) {
+      return { ok: true, status: response.status, data, source: "live" };
+    }
+    return {
+      ok: false,
+      status: response.status,
+      data: emptyFor(shape),
+      source: "unavailable",
+      error: friendlyError(error, response.statusText),
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      status: 0,
+      data: emptyFor(shape),
+      source: "unavailable",
+      error: err instanceof Error ? err.message : String(err),
+    };
+  } finally {
+    window.clearTimeout(timer);
+  }
+}
+
 function get<T>(path: string, shape: T, query?: Query) {
   return apiJson<T>("GET", path, { query, shape });
 }
@@ -161,20 +206,10 @@ function del<T>(path: string, shape: T) {
   return apiJson<T>("DELETE", path, { shape });
 }
 
-export type ReviewItem = {
-  id: string;
-  status: string;
-  effective_status: string;
-  title: string;
-  summary?: string;
-  source?: string;
-  kind?: string;
-  payload?: Record<string, unknown>;
-  provenance?: Record<string, unknown>;
-  snoozed_until?: string | null;
-  created_at?: string | null;
-  updated_at?: string | null;
-};
+export type ReviewItem = components["schemas"]["ReviewItem"];
+export type ReviewItemList = components["schemas"]["ReviewItemList"];
+export type ReviewStatusFilter = "pending" | "snoozed" | "approved" | "dismissed" | "all";
+export type ReviewSourceFilter = "workflow_run" | "trigger" | "kg_change_digest" | "all";
 
 function reviewItemShape(): ReviewItem {
   return {
@@ -190,6 +225,53 @@ function reviewItemShape(): ReviewItem {
   };
 }
 
+function reviewItemListShape(): ReviewItemList {
+  return { items: [] };
+}
+
+function reviewList(query?: { status?: Exclude<ReviewStatusFilter, "all">; source?: Exclude<ReviewSourceFilter, "all"> }) {
+  return openApiJson<OperationJson200<ReviewListOperation>>(
+    reviewItemListShape(),
+    (client, signal) => client.GET("/automation/reviews", {
+      params: { query: query || {} },
+      headers: workspaceHeaders(),
+      signal,
+    }),
+  );
+}
+
+function reviewAction(
+  id: string,
+  action: "approve" | "dismiss" | "run_now" | "unsnooze",
+) {
+  return openApiJson<OperationJson200<ReviewItemOperation>>(
+    reviewItemShape(),
+    (client, signal) => {
+      const request = {
+        params: { path: { item_id: id } },
+        headers: workspaceHeaders(),
+        signal,
+      };
+      if (action === "approve") return client.POST("/automation/reviews/{item_id}/approve", request);
+      if (action === "dismiss") return client.POST("/automation/reviews/{item_id}/dismiss", request);
+      if (action === "run_now") return client.POST("/automation/reviews/{item_id}/run_now", request);
+      return client.POST("/automation/reviews/{item_id}/unsnooze", request);
+    },
+  );
+}
+
+function snoozeReview(id: string, until: string) {
+  return openApiJson<OperationJson200<operations["snooze_item_automation_reviews__item_id__snooze_post"]>>(
+    reviewItemShape(),
+    (client, signal) => client.POST("/automation/reviews/{item_id}/snooze", {
+      params: { path: { item_id: id } },
+      body: { until },
+      headers: workspaceHeaders(),
+      signal,
+    }),
+  );
+}
+
 async function uploadDocument(file: File): Promise<ApiResult<Record<string, unknown> | null>> {
   const base = await apiBase();
   const form = new FormData();
@@ -409,13 +491,12 @@ export const latticeApi = {
   hooks: () => get("/api/hooks", { hooks: [] }),
   hookRuns: () => get("/api/hooks/runs", { runs: [] }, { limit: 50 }),
   hookRun: (body: unknown) => post("/api/hooks/run", body, {}),
-  automationReviews: (query?: { status?: string; source?: string }) =>
-    get("/automation/reviews", { items: [] }, query),
-  approveReviewItem: (id: string) => post(`/automation/reviews/${encodeURIComponent(id)}/approve`, {}, reviewItemShape()),
-  dismissReviewItem: (id: string) => post(`/automation/reviews/${encodeURIComponent(id)}/dismiss`, {}, reviewItemShape()),
-  snoozeReviewItem: (id: string, until: string) =>
-    post(`/automation/reviews/${encodeURIComponent(id)}/snooze`, { until }, reviewItemShape()),
-  runNowReviewItem: (id: string) => post(`/automation/reviews/${encodeURIComponent(id)}/run_now`, {}, reviewItemShape()),
+  automationReviews: reviewList,
+  approveReviewItem: (id: string) => reviewAction(id, "approve"),
+  dismissReviewItem: (id: string) => reviewAction(id, "dismiss"),
+  snoozeReviewItem: snoozeReview,
+  unsnoozeReviewItem: (id: string) => reviewAction(id, "unsnooze"),
+  runNowReviewItem: (id: string) => reviewAction(id, "run_now"),
   permissionsPending: () => get("/permissions/pending", { pending: {}, count: 0 }),
   approvePermission: (token: string) => post(`/permissions/approve/${encodeURIComponent(token)}`, {}, {}),
   denyPermission: (token: string) => post(`/permissions/deny/${encodeURIComponent(token)}`, {}, {}),

package/frontend/src/api/openapi.ts

@@ -1914,6 +1914,23 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/automation/reviews/{item_id}/unsnooze": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Unsnooze Item */
+        post: operations["unsnooze_item_automation_reviews__item_id__unsnooze_post"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/chat": {
         parameters: {
             query?: never;
@@ -11054,6 +11071,37 @@ export interface operations {
             };
         };
     };
+    unsnooze_item_automation_reviews__item_id__unsnooze_post: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                item_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ReviewItem"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     chat_page_chat_get: {
         parameters: {
             query?: never;

package/frontend/src/components/FirstRunGuide.tsx

@@ -53,10 +53,10 @@ export function FirstRunGuide() {
     <section className="arrival-panel" aria-label="First 10 minutes">
       <div className="arrival-copy">
         <div className="page-kicker"><CheckCircle2 className="h-4 w-4" /> First 10 minutes</div>
-        <h2>Build your living Brain without guessing.</h2>
+        <h2>Start locally, with clear consent at each step.</h2>
         <p>
-          Start with a local Brain, let Lattice recommend a model voice, then add the first pieces of durable knowledge.
-          Every step keeps the next action visible.
+          Create the local Brain first, choose when to download a model, then add durable knowledge when you are ready.
+          Nothing needs cloud access unless you explicitly choose it.
         </p>
         <div className="arrival-actions">
           <Button onClick={() => go(nextStep.action)}>{nextStep.done ? "Open relationships" : `Continue: ${nextStep.label}`}</Button>

package/frontend/src/components/ProductFlow.tsx

@@ -123,6 +123,10 @@ export function ProductFlow({ onComplete }: { onComplete: () => void }) {
           <RecommendationScreen
             recommendations={recommendations}
             onBack={() => setStep("analysis")}
+            onSkipModel={() => {
+              try { localStorage.setItem(FLOW_COMPLETE_KEY, "true"); } catch {}
+              onComplete();
+            }}
             onSelect={(model) => {
               setSelected(model);
               setStep("install");
@@ -333,10 +337,12 @@ function AnalysisScreen({
 function RecommendationScreen({
   recommendations,
   onBack,
+  onSkipModel,
   onSelect,
 }: {
   recommendations: RecommendedModel[];
   onBack: () => void;
+  onSkipModel: () => void;
   onSelect: (model: RecommendedModel) => void;
 }) {
   const language = useAppStore((state) => state.language);
@@ -370,6 +376,7 @@ function RecommendationScreen({
 
       <div style={{ marginTop: "1.1rem", display: "flex", justifyContent: "center", gap: "1rem", alignItems: "center" }}>
         <Button variant="ghost" onClick={onBack}>{t(language, "flow.recommend.back")}</Button>
+        <Button variant="outline" onClick={onSkipModel}>{t(language, "flow.recommend.skip")}</Button>
         <div style={{ fontSize: "0.82rem", color: "hsl(var(--fg-muted))" }}>{t(language, "flow.recommend.hint")}</div>
       </div>
     </div>