ltcai 8.9.0 → 9.1.0

package/latticeai/core/timeutil.py

@@ -0,0 +1,10 @@
+"""Canonical application timestamp helpers.
+
+Brain Core owns the dependency-free implementation so it remains independently
+importable; the application layer exposes the same helpers from this stable
+location for all LatticeAI services.
+"""
+
+from lattice_brain.utils import local_now, now_iso, parse_iso, utc_now_iso
+
+__all__ = ["local_now", "now_iso", "parse_iso", "utc_now_iso"]

package/latticeai/core/tool_registry.py

@@ -16,11 +16,13 @@ __all__ = [
     "FILE_CREATE_ACTIONS",
     "LOCAL_WRITE_BLOCKED_PREFIXES",
     "RISK_LEVEL_MAP",
+    "SCOPED_KNOWLEDGE_TOOLS",
+    "KNOWLEDGE_WRITE_TOOLS",
     "ToolRegistry",
 ]
 
 from dataclasses import dataclass, field
-from typing import Any, Callable, Dict, Mapping, Optional, TypedDict
+from typing import Any, Callable, Dict, Mapping, NotRequired, Optional, TypedDict
 
 
 class ToolPolicy(TypedDict):
@@ -31,6 +33,8 @@ class ToolPolicy(TypedDict):
     auto_approve: bool
     sandbox: str
     rollback: str
+    capability: NotRequired[str]
+    scope: NotRequired[str]
 
 
 class ToolPermission(TypedDict):
@@ -38,6 +42,8 @@ class ToolPermission(TypedDict):
     risk: str
     requires_approval: bool
     network: bool
+    capability: NotRequired[str]
+    scope: NotRequired[str]
 
 
 TOOL_CATALOG_BRIEF = """
@@ -80,6 +86,17 @@ RISK_LEVEL_MAP = {
     "destructive": "high",
 }
 
+SCOPED_KNOWLEDGE_TOOLS = frozenset({
+    "knowledge_save",
+    "knowledge_search",
+    "knowledge_tree",
+    "obsidian_save",
+    "obsidian_search",
+    "obsidian_tree",
+})
+
+KNOWLEDGE_WRITE_TOOLS = frozenset({"knowledge_save", "obsidian_save"})
+
 
 def _r(sandbox: str = "workspace", rollback: str = "none") -> ToolPolicy:
     return ToolPolicy(
@@ -88,6 +105,25 @@ def _r(sandbox: str = "workspace", rollback: str = "none") -> ToolPolicy:
     )
 
 
+def _rc(
+    sandbox: str = "home",
+    rollback: str = "none",
+    *,
+    capability: str = "",
+    scope: str = "",
+) -> ToolPolicy:
+    """Read operation that still requires explicit human consent."""
+    policy = ToolPolicy(
+        risk="read", destructive=False, shell=False, network=False,
+        auto_approve=False, sandbox=sandbox, rollback=rollback,
+    )
+    if capability:
+        policy["capability"] = capability
+    if scope:
+        policy["scope"] = scope
+    return policy
+
+
 def _rs(sandbox: str = "workspace", rollback: str = "none") -> ToolPolicy:
     return ToolPolicy(
         risk="read", destructive=False, shell=True, network=False,
@@ -102,11 +138,22 @@ def _rn(sandbox: str = "system", rollback: str = "none") -> ToolPolicy:
     )
 
 
-def _w(sandbox: str = "workspace", rollback: str = "none") -> ToolPolicy:
-    return ToolPolicy(
+def _w(
+    sandbox: str = "workspace",
+    rollback: str = "none",
+    *,
+    capability: str = "",
+    scope: str = "",
+) -> ToolPolicy:
+    policy = ToolPolicy(
         risk="write", destructive=False, shell=False, network=False,
         auto_approve=False, sandbox=sandbox, rollback=rollback,
     )
+    if capability:
+        policy["capability"] = capability
+    if scope:
+        policy["scope"] = scope
+    return policy
 
 
 def _wa(sandbox: str = "workspace", rollback: str = "none") -> ToolPolicy:
@@ -146,21 +193,37 @@ TOOL_GOVERNANCE: Dict[str, ToolPolicy] = {
     "inspect_html": _r(),
     "preview_url": _r(),
     "todo_read": _r(),
-    "local_list": _r(sandbox="home"),
-    "local_read": _r(sandbox="home"),
-    "read_document": _r(sandbox="home"),
+    "local_list": _rc(sandbox="home"),
+    "local_read": _rc(sandbox="home"),
+    "read_document": _rc(sandbox="home"),
     "git_status": _rs(),
     "git_diff": _rs(),
     "git_log": _rs(),
     "git_show": _rs(),
-    "knowledge_search": _r(sandbox="home"),
-    "knowledge_tree": _r(sandbox="home"),
-    "obsidian_search": _r(sandbox="home"),
-    "obsidian_tree": _r(sandbox="home"),
-    "computer_screenshot": _r(sandbox="system"),
-    "computer_status": _r(sandbox="system"),
-    "chrome_status": _r(sandbox="system"),
-    "computer_use_status": _r(sandbox="system"),
+    "knowledge_search": _rc(
+        sandbox="workspace", capability="workspace:read", scope="workspace_user"
+    ),
+    "knowledge_tree": _rc(
+        sandbox="workspace", capability="workspace:read", scope="workspace_user"
+    ),
+    "obsidian_search": _rc(
+        sandbox="workspace", capability="workspace:read", scope="workspace_user"
+    ),
+    "obsidian_tree": _rc(
+        sandbox="workspace", capability="workspace:read", scope="workspace_user"
+    ),
+    "computer_screenshot": _rc(
+        sandbox="system", capability="desktop:control", scope="host"
+    ),
+    "computer_status": _rc(
+        sandbox="system", capability="desktop:control", scope="host"
+    ),
+    "chrome_status": _rc(
+        sandbox="system", capability="desktop:control", scope="host"
+    ),
+    "computer_use_status": _rc(
+        sandbox="system", capability="desktop:control", scope="host"
+    ),
     "network_status": _rn(),
     "write_file": _w(rollback="git"),
     "edit_file": _w(rollback="git"),
@@ -170,8 +233,12 @@ TOOL_GOVERNANCE: Dict[str, ToolPolicy] = {
     "create_pptx": _w(),
     "create_pdf": _w(),
     "todo_write": _w(),
-    "knowledge_save": _w(sandbox="home"),
-    "obsidian_save": _w(sandbox="home"),
+    "knowledge_save": _w(
+        sandbox="workspace", capability="workspace:write", scope="workspace_user"
+    ),
+    "obsidian_save": _w(
+        sandbox="workspace", capability="workspace:write", scope="workspace_user"
+    ),
     "local_write": _w(sandbox="home"),
     "run_command": _e(),
     "build_project": _e(),
@@ -315,7 +382,7 @@ class ToolRegistry:
             "status": "ok" if diagnostics["ready"] else "degraded",
             "boundary": {
                 "owner": "latticeai.core.tool_registry.ToolRegistry",
-                "dispatch_owner": "tools.DEFAULT_TOOL_REGISTRY",
+                "dispatch_owner": "latticeai.tools.DEFAULT_TOOL_REGISTRY",
                 "policy_owner": "latticeai.core.tool_registry.ToolRegistry",
                 "permission_owner": "latticeai.services.tool_dispatch.ToolDispatchService",
             },
@@ -354,12 +421,17 @@ class ToolRegistry:
 
     def permission(self, name: str, args: Optional[dict] = None) -> ToolPermission:
         policy = self.policy_for(name, args or {})
-        return ToolPermission(
+        permission = ToolPermission(
             tool=name,
             risk=self.risk_level(policy),
             requires_approval=not policy["auto_approve"],
             network=policy["network"],
         )
+        if policy.get("capability"):
+            permission["capability"] = policy["capability"]
+        if policy.get("scope"):
+            permission["scope"] = policy["scope"]
+        return permission
 
     def permissions(self) -> list[ToolPermission]:
         return [self.permission(name) for name in sorted(self.governance.keys())]

package/latticeai/core/users.py

@@ -6,23 +6,14 @@ import json
 import shutil
 import sqlite3
 import uuid
-from datetime import datetime
 from pathlib import Path
 from typing import Any, Dict, Optional
 
+from .io_utils import atomic_write_json
+from .timeutil import now_iso as _now
 
-USER_NAMESPACE = uuid.UUID("5d6d4480-cf79-49c3-a6d0-4c6eec3224d6")
-
-
-def _now() -> str:
-    return datetime.now().isoformat(timespec="seconds")
 
-
-def _atomic_write_json(path: Path, data: Dict[str, Any]) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    tmp = path.with_suffix(path.suffix + ".tmp")
-    tmp.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")
-    tmp.replace(path)
+USER_NAMESPACE = uuid.UUID("5d6d4480-cf79-49c3-a6d0-4c6eec3224d6")
 
 
 def normalize_email(email: str) -> str:
@@ -86,13 +77,13 @@ def load_users_file(path: Path) -> Dict[str, Any]:
             shutil.copy2(path, backup)
         except Exception:
             pass
-        _atomic_write_json(path, migrated)
+        atomic_write_json(path, migrated)
     return migrated
 
 
 def save_users_file(path: Path, users: Dict[str, Any]) -> None:
     migrated, _, _ = migrate_users(users)
-    _atomic_write_json(path, migrated)
+    atomic_write_json(path, migrated)
 
 
 def user_id_for_email(users: Dict[str, Any], email: Optional[str]) -> Optional[str]:

package/latticeai/core/workspace_graph_trace.py

@@ -3,7 +3,8 @@ from __future__ import annotations
 
 from typing import Any, Dict, List, Optional
 
-from .workspace_os_utils import _json_hash, _listify, _now
+from .timeutil import now_iso as _now
+from .workspace_os_utils import _json_hash, _listify
 
 
 class WorkspaceGraphTrace:
@@ -13,7 +14,15 @@ class WorkspaceGraphTrace:
     def __getattr__(self, name: str) -> Any:
         return getattr(self._store, name)
 
-    def build_graph_trace(self, question: str, graph: Any, context: str = "", *, limit: int = 8) -> Dict[str, Any]:
+    def build_graph_trace(
+        self,
+        question: str,
+        graph: Any,
+        context: str = "",
+        *,
+        limit: int = 8,
+        allowed_workspaces=None,
+    ) -> Dict[str, Any]:
         if graph is None:
             return {
                 "source_files": [],
@@ -31,7 +40,16 @@ class WorkspaceGraphTrace:
         matches: List[Dict[str, Any]] = []
         search_error = ""
         try:
-            matches = graph.search(question, limit=limit).get("matches", [])
+            scope_kwargs = (
+                {"allowed_workspaces": allowed_workspaces}
+                if allowed_workspaces is not None
+                else {}
+            )
+            matches = graph.search(
+                question,
+                limit=limit,
+                **scope_kwargs,
+            ).get("matches", [])
         except Exception as exc:
             search_error = str(exc)
             matches = []
@@ -67,7 +85,10 @@ class WorkspaceGraphTrace:
             if not node_id:
                 continue
             try:
-                for edge in graph.neighbors(node_id).get("edges", []):
+                for edge in graph.neighbors(
+                    node_id,
+                    **scope_kwargs,
+                ).get("edges", []):
                     key = (edge.get("from"), edge.get("to"), edge.get("type"))
                     if key in edge_seen:
                         continue
@@ -122,7 +143,12 @@ class WorkspaceGraphTrace:
         }
         state.setdefault("traces", []).append(record)
         self.save_state(state)
-        self.record_timeline_event("graph", "answer_trace", {"trace_id": trace_id, "conversation_id": conversation_id})
+        self.record_timeline_event(
+            "graph",
+            "answer_trace",
+            {"trace_id": trace_id, "conversation_id": conversation_id},
+            workspace_id=record["workspace_id"],
+        )
         return record
 
     def list_traces(self, conversation_id: Optional[str] = None, limit: int = 50, workspace_id: Optional[str] = None) -> Dict[str, Any]:

package/latticeai/core/workspace_memory.py

@@ -6,7 +6,8 @@ from __future__ import annotations
 
 from typing import Any, Dict, List, Optional
 
-from .workspace_os_utils import _json_hash, _listify, _now
+from .timeutil import now_iso as _now
+from .workspace_os_utils import _json_hash, _listify
 
 
 class WorkspaceMemory:
@@ -52,6 +53,7 @@ class WorkspaceMemory:
                     f"{kind}: {content[:80]}",
                     user_email=user_email,
                     source="workspace_os",
+                    workspace_id=record["workspace_id"],
                     metadata={"memory_id": memory_id, "kind": kind, "tags": tags or []},
                 )
                 record["graph_node_id"] = ingested.get("node_id")

package/latticeai/core/workspace_os.py

@@ -21,10 +21,10 @@ from .workspace_os_utils import (
     _deep_merge,
     _json_hash,
     _listify,
-    _now,
     _safe_slug,
     remove_skill_directory,
 )
+from .timeutil import now_iso as _now
 from .workspace_permissions import WorkspacePermissionManager, _member_role  # type: ignore
 from .workspace_timeline import WorkspaceTimeline
 from .workspace_plugins import WorkspacePluginManager
@@ -49,7 +49,7 @@ __all__ = [
     "remove_skill_directory",
 ]
 
-WORKSPACE_OS_VERSION = "8.9.0"
+WORKSPACE_OS_VERSION = "9.1.0"
 
 # Workspace types separate single-user Personal workspaces from shared
 # Organization workspaces. Both keep the same local-first JSON store; the type
@@ -126,9 +126,6 @@ EXECUTION_EVENT_TYPES = {
     "execution_interrupted",
 }
 
-RUN_ACTIVE_STATUSES = {"queued", "running", "in_progress", "retrying", "cancelling"}
-RUN_TERMINAL_STATUSES = {"ok", "retried_ok", "failed", "rejected", "cancelled", "interrupted", "partial"}
-
 DEFAULT_AGENTS = [
     {
         "id": "agent:planner",
@@ -830,8 +827,22 @@ class WorkspaceOSStore:
     # Graph answer traces
     # ------------------------------------------------------------------
 
-    def build_graph_trace(self, question: str, graph: Any, context: str = "", *, limit: int = 8) -> Dict[str, Any]:
-        return self.graph_trace.build_graph_trace(question, graph, context, limit=limit)
+    def build_graph_trace(
+        self,
+        question: str,
+        graph: Any,
+        context: str = "",
+        *,
+        limit: int = 8,
+        allowed_workspaces=None,
+    ) -> Dict[str, Any]:
+        return self.graph_trace.build_graph_trace(
+            question,
+            graph,
+            context,
+            limit=limit,
+            allowed_workspaces=allowed_workspaces,
+        )
 
     def record_trace(self, *args: Any, **kwargs: Any) -> Dict[str, Any]:
         return self.graph_trace.record_trace(*args, **kwargs)

package/latticeai/core/workspace_os_utils.py

@@ -7,15 +7,12 @@ store class and public constants while preserving exact behavior.
 from __future__ import annotations
 
 import json
-import os
 import shutil
-from datetime import datetime
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 
-
-def _now() -> str:
-    return datetime.now().isoformat(timespec="seconds")
+from .io_utils import atomic_write_json as _atomic_write_json  # noqa: F401 - legacy helper re-export
+from .io_utils import parse_iso as _parse_iso  # noqa: F401 - legacy helper re-export
 
 
 def _safe_slug(raw: str) -> str:
@@ -43,13 +40,6 @@ def _deep_merge(default: Any, loaded: Any) -> Any:
     return loaded
 
 
-def _atomic_write_json(path: Path, payload: Dict[str, Any]) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    tmp_path = path.with_suffix(path.suffix + ".tmp")
-    tmp_path.write_text(json.dumps(payload, ensure_ascii=False, indent=2), encoding="utf-8")
-    os.replace(tmp_path, path)
-
-
 def _listify(value: Any) -> List[Any]:
     return value if isinstance(value, list) else []
 
@@ -100,15 +90,6 @@ def _snapshot_graph_import_payload(graph_payload: Dict[str, Any], *, workspace_i
     }
 
 
-def _parse_iso(value: Optional[str]) -> Optional[datetime]:
-    if not value:
-        return None
-    try:
-        return datetime.fromisoformat(str(value))
-    except (TypeError, ValueError):
-        return None
-
-
 def _file_size(path: Path) -> int:
     try:
         return path.stat().st_size

package/latticeai/core/workspace_permissions.py

@@ -7,7 +7,8 @@ from __future__ import annotations
 
 from typing import Any, Dict, Optional
 
-from .workspace_os_utils import _listify, _now
+from .timeutil import now_iso as _now
+from .workspace_os_utils import _listify
 
 # Avoid circular at import time: pull constants lazily from parent module.
 def _get_role_permissions():

package/latticeai/core/workspace_plugins.py

@@ -6,7 +6,7 @@ from __future__ import annotations
 
 from typing import Any, Dict, Optional
 
-from .workspace_os_utils import _now
+from .timeutil import now_iso as _now
 
 
 class WorkspacePluginManager:

package/latticeai/core/workspace_runs.py

@@ -5,11 +5,10 @@ import json
 from typing import Any, Dict, List, Optional
 
 from lattice_brain.runtime.contracts import run_record_contract, workflow_run_contract
+from lattice_brain.runtime.statuses import RUN_ACTIVE_STATUSES, RUN_TERMINAL_STATUSES
 
-from .workspace_os_utils import _json_hash, _listify, _now
-
-RUN_ACTIVE_STATUSES = {"queued", "running", "in_progress", "retrying", "cancelling"}
-RUN_TERMINAL_STATUSES = {"ok", "retried_ok", "failed", "rejected", "cancelled", "interrupted", "partial"}
+from .timeutil import now_iso as _now
+from .workspace_os_utils import _json_hash, _listify
 
 
 class WorkspaceRuns:
@@ -80,6 +79,7 @@ class WorkspaceRuns:
                     f"{agent_id} {status}",
                     user_email=user_email,
                     source="workspace_os",
+                    workspace_id=resolved_workspace,
                     metadata={"run_id": run["id"], "agent_id": agent_id, "status": status, "mode": mode},
                 )
                 run["graph_node_id"] = ingested.get("node_id")
@@ -167,6 +167,7 @@ class WorkspaceRuns:
                     f"{run.get('agent_id')} {status}",
                     user_email=run.get("user_email"),
                     source="workspace_os",
+                    workspace_id=resolved_workspace,
                     metadata={
                         "run_id": run_id,
                         "agent_id": run.get("agent_id"),
@@ -250,6 +251,7 @@ class WorkspaceRuns:
                     workflow["name"],
                     user_email=user_email,
                     source="workspace_os",
+                    workspace_id=workflow["workspace_id"],
                     metadata={"workflow_id": workflow["id"], "steps": steps},
                 )
                 workflow["graph_node_id"] = ingested.get("node_id")
@@ -257,7 +259,12 @@ class WorkspaceRuns:
                 workflow["graph_error"] = str(exc)
         state.setdefault("workflows", []).append(workflow)
         self.save_state(state)
-        self.record_timeline_event("workflow", "workflow_created", {"workflow_id": workflow["id"], "name": workflow["name"]})
+        self.record_timeline_event(
+            "workflow",
+            "workflow_created",
+            {"workflow_id": workflow["id"], "name": workflow["name"]},
+            workspace_id=workflow["workspace_id"],
+        )
         return workflow
 
     def record_workflow_run(
@@ -304,6 +311,7 @@ class WorkspaceRuns:
                     f"{run['name']} {status}",
                     user_email=user_email,
                     source="workspace_os",
+                    workspace_id=resolved_workspace,
                     metadata={"run_id": run["id"], "workflow_id": workflow_id, "status": status, "mode": mode},
                 )
                 run["graph_node_id"] = ingested.get("node_id")
@@ -380,6 +388,7 @@ class WorkspaceRuns:
                     f"{run.get('name')} {status}",
                     user_email=run.get("user_email"),
                     source="workspace_os",
+                    workspace_id=resolved_workspace,
                     metadata={
                         "run_id": run_id,
                         "workflow_id": workflow_id,

package/latticeai/core/workspace_skills.py

@@ -5,7 +5,7 @@ import json
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 
-from .workspace_os_utils import _now
+from .timeutil import now_iso as _now
 
 
 class WorkspaceSkills:

package/latticeai/core/workspace_snapshots.py

@@ -10,7 +10,8 @@ from datetime import datetime
 from pathlib import Path
 from typing import Any, Dict, Iterable, Optional
 
-from .workspace_os_utils import _atomic_write_json, _json_hash, _listify, _now, _safe_slug
+from .timeutil import now_iso as _now
+from .workspace_os_utils import _atomic_write_json, _json_hash, _listify, _safe_slug
 
 
 class WorkspaceSnapshots:

package/latticeai/core/workspace_timeline.py

@@ -6,7 +6,8 @@ from __future__ import annotations
 
 from typing import Any, Dict, Iterable, List, Optional
 
-from .workspace_os_utils import _listify, _now, _parse_iso
+from .timeutil import now_iso as _now
+from .workspace_os_utils import _listify, _parse_iso
 
 
 def _audit_category(event: Dict[str, Any]) -> str: