ltcai 8.8.0 → 8.9.0

package/README.md

@@ -1,6 +1,6 @@
 # Lattice AI
 
-**Lattice AI 8.8.0 is the local-first Digital Brain platform. This release removes internal-only Brain compatibility layers, strengthens recall proof quality, and keeps package, desktop, extension, static app, and documentation metadata synchronized to the 8.8.0 line.**
+**Lattice AI 8.9.0 is the local-first Digital Brain platform. This release hardens authenticated history and graph scoping, blocks unapproved direct Tool API execution paths, makes local permission approvals and installer/process execution safer to audit, and keeps package, desktop, extension, static app, and documentation metadata synchronized to the 8.9.0 line.**
 
 **Lattice AI는 모델이 바뀌어도 내 지식과 맥락을 보존하는 로컬 우선 AI 브레인입니다.**
 
@@ -67,7 +67,9 @@ You need Lattice AI when:
 The screenshots below are the latest checked-in visual evidence captures. They
 keep the first-run Brain flow, memory graph, source capture, model library,
 system view, admin console, and review center visible as release gates while
-8.8.0 focuses on Brain Core extraction readiness and recall proof hardening.
+8.9.0 focuses on scoped memory isolation, direct Tool API policy enforcement,
+AgentRuntime human-approval semantics, confirmation-token guarded installer
+execution, and frontend/runtime maintainability.
 
 ### 1. Wake Brain
 
@@ -169,7 +171,9 @@ pip install "ltcai[local]"
 - **Backend**: FastAPI on localhost is the UI source of truth.
 - **Brain Core**: independent `lattice_brain` package for graph, memory,
   context, conversations, ingestion, runtime, workflow, storage, and portability.
-- **Storage**: SQLite default; PostgreSQL/pgvector is optional scale mode.
+- **Storage**: SQLite is the live local Brain store; PostgreSQL/pgvector tooling
+  is optional scale-mode planning/migration support, not the default live graph
+  backend.
 - **Portability**: encrypted `.latticebrain` archives plus backup, restore,
   inspect, verify, import dry-run, and confirmed restore/import flows.
 - **Trust boundary**: local-first by default; cloud calls, downloads, Telegram,
@@ -206,38 +210,40 @@ See [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md) for developer workflow details.
 
 ## Current Release
 
-The current release is **8.8.0 — Brain Core Extraction & Recall Proof Hardening**:
-
-- Internal-only Brain shim layers are removed: pre-graph flat modules,
-  the deprecated `latticeai.brain` namespace, and the service-layer
-  AgentRuntime alias are tracked as intentional 8.8.0 removals.
-- Root compatibility shims remain managed for external entrypoints while Brain
-  Core now has one physical import surface guarded by isolation tests.
-- AgentRuntime rejects unknown roles at the boundary, exposes contract envelopes
-  for legacy run rows, and persists clamped retry budgets.
-- Brain Chat adds resumable conversation history, stop/regenerate/copy actions,
-  richer ingestion panels, and answer proof explainability with matched terms
-  and confidence labels.
-- Memory recall drops zero-evidence noise when lexical evidence exists, so
-  citations explain why each source was selected.
-
-Expected artifacts for 8.8.0 release must use exact filenames:
-
-- `dist/ltcai-8.8.0-py3-none-any.whl`
-- `dist/ltcai-8.8.0.tar.gz`
-- `ltcai-8.8.0.tgz`
-- `dist/ltcai-8.8.0.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_8.8.0_aarch64.dmg`
+The current release is **8.9.0 — Scoped Memory & Tool Policy Hardening**:
+
+- Conversation history reads and deletes now scope by authenticated user and
+  readable workspace, while preserving legacy-global rows only in no-auth or
+  explicitly compatible flows.
+- Knowledge Graph search, graph traversal, relationships, node reads, and chat
+  context now apply workspace scope at the graph/service boundary.
+- Direct HTTP/MCP Tool API calls enforce ToolRegistry policy before hooks or
+  handlers run; destructive paths and non-auto-approved user writes are blocked.
+- AgentRuntime no longer treats “requires approval” plans as implicitly
+  approved, and rollback now handles tool results that omit `success`.
+- Local permission approvals hash tokens at rest, use atomic queue writes, and
+  reject write approvals for blocked system prefixes.
+- Frontend API base handling, Tauri credentials, workspace clearing, CSS tokens,
+  and i18n literal checks are split into safer maintainability seams.
+
+Expected artifacts for 8.9.0 release must use exact filenames:
+
+- `dist/ltcai-8.9.0-py3-none-any.whl`
+- `dist/ltcai-8.9.0.tar.gz`
+- `ltcai-8.9.0.tgz`
+- `dist/ltcai-8.9.0.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_8.9.0_aarch64.dmg`
 
 Do not use wildcard artifact uploads. Package registry publishing remains owner-run.
 
 See [docs/ROADMAP_RECOMMENDATIONS.md](docs/ROADMAP_RECOMMENDATIONS.md) for the
-strategic roadmap slices applied through 8.8.0 and the follow-up tracks.
+strategic roadmap slices applied through 8.9.0 and the follow-up tracks.
 
 ## Known Limitations
 
 - External package registries are owner-published and can lag behind GitHub.
-- PostgreSQL/pgvector is optional scale mode. SQLite is the default local Brain.
+- PostgreSQL/pgvector is optional scale/migration tooling. SQLite remains the
+  live local Brain store in 8.9.0.
 - Docker, model downloads, cloud model calls, Telegram, Brain Network, and update
   checks require explicit user action.
 - Conversation does not fabricate answers when no model is loaded.
@@ -249,6 +255,7 @@ strategic roadmap slices applied through 8.8.0 and the follow-up tracks.
 
 | Version | Theme |
 | --- | --- |
+| 8.9.0 | Scoped Memory & Tool Policy Hardening: authenticated history/KG reads are workspace-scoped, direct Tool API paths enforce registry policy, local approvals hash tokens at rest, AgentRuntime approval semantics are explicit, and frontend/runtime seams are split |
 | 8.8.0 | Brain Core Extraction & Recall Proof Hardening: internal-only Brain shim layers are removed, AgentRuntime run contracts/retry budgets are tighter, Brain Chat gains conversation controls, and citation recall exposes matched evidence |
 | 8.7.0 | Runtime State Hygiene & Release Evidence Refresh: model-runtime internals prefer typed state over legacy globals, compatibility sync is deprecated, 8.7.0 visual evidence is refreshed, and all release metadata/docs are synchronized |
 | 8.6.0 | Desktop Capture & Navigation Reliability: native folder selection works from the Tauri localhost app, picker failures surface in Capture, web saving remains one-action, and the Brain shell sidebar/admin flow is CI-covered |

package/auto_setup.py

@@ -25,7 +25,7 @@ Lattice AI — Zero-Config Auto Setup
 python3 auto_setup.py probe                  # 1단계만
 python3 auto_setup.py recommend              # 1+2단계
 python3 auto_setup.py plan                   # 1+2+3 (설치 계획 출력)
-python3 auto_setup.py plan --apply           # 실제 설치 실행 (위험)
+python3 auto_setup.py plan --apply --confirm-token <token>
 python3 auto_setup.py verify                 # 4단계 단독
 python3 auto_setup.py preset                 # 5단계
 python3 auto_setup.py all                    # 전체 흐름
@@ -47,6 +47,14 @@ from dataclasses import asdict, dataclass, field
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple
 
+from latticeai.services.process_audit import (
+    CommandConfirmationError,
+    append_process_audit_event,
+    command_plan,
+    command_plan_for_commands,
+    require_command_confirmation,
+)
+
 __all__ = [
     "SystemProfile", "Recommendation", "InstallPlan",
     "probe", "recommend", "plan", "verify", "preset", "run_all",
@@ -547,6 +555,21 @@ class InstallStep:
     command: List[str]
     requires_admin: bool = False
 
+    def to_json(self) -> Dict[str, Any]:
+        return {
+            "name": self.name,
+            "why": self.why,
+            "command": self.command,
+            "requires_admin": self.requires_admin,
+            "command_plan": command_plan(
+                self.command,
+                name=self.name,
+                purpose="auto_setup_install",
+                requires_admin=self.requires_admin,
+                metadata={"why": self.why},
+            ),
+        }
+
 
 @dataclass
 class InstallPlan:
@@ -555,10 +578,18 @@ class InstallPlan:
     notes: List[str] = field(default_factory=list)
 
     def to_json(self) -> Dict[str, Any]:
+        plan_summary = command_plan_for_commands(
+            [step.command for step in self.steps],
+            name="auto_setup_plan",
+            purpose="auto_setup_install",
+            metadata={"package_manager": self.package_manager},
+        )
         return {
             "package_manager": self.package_manager,
-            "steps": [asdict(s) for s in self.steps],
+            "steps": [s.to_json() for s in self.steps],
             "notes": self.notes,
+            "command_plan": plan_summary,
+            "confirmation_token": plan_summary["confirmation_token"],
         }
 
 
@@ -661,23 +692,55 @@ def plan(profile: SystemProfile, rec: Recommendation) -> InstallPlan:
     return InstallPlan(package_manager=pm, steps=steps, notes=notes)
 
 
-def apply_plan(plan_obj: InstallPlan, *, confirm: bool = False) -> List[Dict[str, Any]]:
-    """위험: 실제로 설치 명령을 실행한다. ``confirm=True`` 필수."""
+def apply_plan(
+    plan_obj: InstallPlan,
+    *,
+    confirm: bool = False,
+    confirmation_token: Optional[str] = None,
+) -> List[Dict[str, Any]]:
+    """위험: 실제로 설치 명령을 실행한다. ``confirm`` and token are required."""
     if not confirm:
         raise RuntimeError("refuse to apply: pass confirm=True")
+    expected = plan_obj.to_json().get("confirmation_token")
+    if str(confirmation_token or "").strip() != expected:
+        raise CommandConfirmationError("refuse to apply: confirmation token mismatch")
     results: List[Dict[str, Any]] = []
     for step in plan_obj.steps:
+        step_plan = command_plan(
+            step.command,
+            name=step.name,
+            purpose="auto_setup_install",
+            requires_admin=step.requires_admin,
+            metadata={"why": step.why},
+        )
         try:
+            require_command_confirmation(
+                step.command,
+                step_plan["confirmation_token"],
+                purpose="auto_setup_install",
+            )
+            append_process_audit_event("installer_command", plan=step_plan, status="started")
             r = subprocess.run(step.command, capture_output=True, text=True,
                                timeout=300, check=False)
+            append_process_audit_event(
+                "installer_command",
+                plan=step_plan,
+                status="finished",
+                returncode=r.returncode,
+                stdout=r.stdout,
+                stderr=r.stderr,
+            )
             results.append({
                 "name": step.name,
+                "command_hash": step_plan["command_hash"],
+                "command_preview": step_plan["command_preview"],
                 "returncode": r.returncode,
                 "stdout_tail": (r.stdout or "")[-2000:],
                 "stderr_tail": (r.stderr or "")[-2000:],
             })
         except Exception as exc:
-            results.append({"name": step.name, "error": str(exc)})
+            append_process_audit_event("installer_command", plan=step_plan, status="error", error=str(exc))
+            results.append({"name": step.name, "command_hash": step_plan["command_hash"], "error": str(exc)})
     return results
 
 
@@ -780,13 +843,13 @@ def preset(profile: SystemProfile, rec: Recommendation) -> Dict[str, Any]:
 
 
 # ── orchestrator ────────────────────────────────────────────────────────────
-def run_all(*, apply_install: bool = False) -> Dict[str, Any]:
+def run_all(*, apply_install: bool = False, confirmation_token: Optional[str] = None) -> Dict[str, Any]:
     p = probe()
     r = recommend(p)
     pl = plan(p, r)
     install_results = None
     if apply_install:
-        install_results = apply_plan(pl, confirm=True)
+        install_results = apply_plan(pl, confirm=True, confirmation_token=confirmation_token)
     v = verify(p, r)
     ps = preset(p, r)
     return {
@@ -809,6 +872,8 @@ def _main() -> int:
     sp_plan = sub.add_parser("plan")
     sp_plan.add_argument("--apply", action="store_true",
                          help="actually run the install commands (DANGER)")
+    sp_plan.add_argument("--confirm-token", default=None,
+                         help="confirmation token from the dry-run plan output")
     sub.add_parser("verify")
     sub.add_parser("preset")
     sub.add_parser("all")
@@ -825,7 +890,7 @@ def _main() -> int:
         p = probe(); r = recommend(p); pl = plan(p, r)
         out: Dict[str, Any] = {"plan": pl.to_json()}
         if args.apply:
-            out["install"] = apply_plan(pl, confirm=True)
+            out["install"] = apply_plan(pl, confirm=True, confirmation_token=args.confirm_token)
         print(json.dumps(out, indent=2, ensure_ascii=False)); return 0
     if args.cmd == "verify":
         p = probe(); r = recommend(p)

package/docs/CHANGELOG.md

@@ -6,6 +6,43 @@ existed at that release.
 
 ## [Unreleased]
 
+## [8.9.0] - 2026-07-06
+
+### Added
+- Added authenticated user/workspace scoping to durable conversation history
+  reads and deletes.
+- Added workspace-aware Knowledge Graph search, traversal, relationship, node,
+  and chat-context reads.
+- Added direct HTTP/MCP Tool API policy enforcement for registry-governed tools.
+- Added permission approval queue hashing and atomic writes so raw tokens are
+  not persisted at rest.
+- Added confirmation-token guarded installer/process command plans with redacted
+  local process audit events.
+- Added regression coverage for scoped history, graph scoping, tool policy
+  gates, AgentRuntime approval semantics, permission tokens, session TTL
+  injection, and model-download runtime config.
+
+### Changed
+- AgentRuntime now requires explicit human approval for non-auto-approved plans
+  and rolls back git-governed tool results even when `success` is omitted.
+- Model download consent now uses configured runtime state instead of direct
+  environment-variable reads.
+- Frontend API base logic, CSS token/base rules, and i18n literal checks were
+  split into smaller maintainability seams.
+- Version bumped to 8.9.0 across Python, npm, VS Code extension, Tauri, static
+  metadata, readiness gates, release notes, and current-release documentation.
+- Documentation now states that SQLite is the live local Brain store; Postgres
+  remains optional scale/migration tooling.
+
+### Fixed
+- Conversation store migration now creates the workspace index only after the
+  scope columns exist.
+- Direct `write_file`/`edit_file` policy lookup now blocks system write
+  prefixes consistently with local-file approvals.
+- Workspace selection clearing now removes the persisted workspace id.
+- Tauri/local API fetches now include credentials for localhost backend
+  sessions.
+
 ## [8.8.0] - 2026-07-06
 
 ### Added