ltcai 8.9.0 → 9.1.0

package/desktop/electron/README.md

@@ -0,0 +1,9 @@
+# Electron compatibility shell
+
+Electron is an experimental compatibility client. The supported desktop build
+is the Tauri application in `src-tauri/`; release artifacts and validation use
+that path. Electron shares the standard local backend at `127.0.0.1:4825` and
+can be launched for development with `npm run desktop:electron`.
+
+Override the backend only for development with
+`LATTICEAI_DESKTOP_BACKEND_ORIGIN` or `LATTICEAI_DESKTOP_BACKEND_CMD`.

package/desktop/electron/main.cjs

@@ -2,7 +2,9 @@ const { app, BrowserWindow, dialog, ipcMain } = require("electron");
 const { spawn } = require("node:child_process");
 const path = require("node:path");
 
-const origin = process.env.LATTICEAI_DESKTOP_BACKEND_ORIGIN || "http://127.0.0.1:8765";
+// Experimental compatibility shell. Tauri is the primary desktop client; use
+// the same backend port as every other Lattice client to avoid split defaults.
+const origin = process.env.LATTICEAI_DESKTOP_BACKEND_ORIGIN || "http://127.0.0.1:4825";
 let backend = null;
 
 ipcMain.handle("lattice:select-folder", async (event) => {
@@ -18,12 +20,12 @@ ipcMain.handle("lattice:select-folder", async (event) => {
 
 function startBackend() {
   if (process.env.LATTICEAI_DESKTOP_NO_BACKEND) return;
-  const command = process.env.LATTICEAI_DESKTOP_BACKEND_CMD || "python3 ltcai_cli.py --host 127.0.0.1 --port 8765";
+  const command = process.env.LATTICEAI_DESKTOP_BACKEND_CMD || "python3 ltcai_cli.py --host 127.0.0.1 --port 4825";
   const [bin, ...args] = command.split(/\s+/).filter(Boolean);
   if (!bin) return;
   backend = spawn(bin, args, {
     cwd: process.env.LATTICEAI_DESKTOP_BACKEND_CWD || path.resolve(__dirname, "../.."),
-    env: { ...process.env, LATTICEAI_HOST: "127.0.0.1", LATTICEAI_PORT: "8765", LATTICEAI_TUNNEL: "false" },
+    env: { ...process.env, LATTICEAI_HOST: "127.0.0.1", LATTICEAI_PORT: "4825", LATTICEAI_TUNNEL: "false" },
     stdio: "ignore",
   });
 }

package/docs/CHANGELOG.md

@@ -4,7 +4,226 @@ The top entry is either the current unreleased main-branch work or the current
 release line. Older entries are historical and may describe behavior as it
 existed at that release.
 
-## [Unreleased]
+## [9.1.0] - 2026-07-11
+
+### Added
+- Added required Telegram chat/callback allowlisting through
+  `LATTICEAI_TELEGRAM_ALLOWED_CHAT_IDS` and authenticated local API bridging
+  through `LATTICEAI_SERVER_SESSION_TOKEN`.
+- Added signed, expiring invitation authorization, explicit legacy-global graph
+  read opt-in, and fail-closed regression coverage for broken or unknown
+  Knowledge Graph scope.
+- Added optional permission-review deep links through
+  `LATTICEAI_PERMISSION_UI_URL` while keeping approval tokens out of outbound
+  notifications.
+- Added Vitest coverage for API empty/result shapes, Brain proof state,
+  conversation sessions, shared primitives, and i18n, plus visual assertions
+  for unavailable core services.
+- Added continuous vital rings, heartbeat echoes, neural sparks, body motion,
+  and Brain-to-graph particles whose speed and intensity reflect real listening,
+  recall, synthesis, and automation activity. Reduced-motion preferences still
+  disable nonessential animation.
+- Added a living knowledge flow that shows chat, files, folders, notes, and web
+  pages entering the Brain, then renders a lightweight graph from actual
+  Knowledge Graph nodes and edges on the first screen.
+- Added persistent conversation-to-knowledge traces, truthful ingestion
+  emergence counts and provenance, native desktop folder selection, and
+  evidence-linked Brain automation actions.
+- Added a consent-preserving recipe lifecycle: create a reviewable disabled
+  draft, inspect its memory focus and evidence, then explicitly enable it.
+- Added scoped MemoryService recall to workflow agents and researcher-first
+  execution for triggered and review-queue automation runs.
+- Added a visible task-oriented desktop navigation, mobile bottom navigation,
+  accessible secondary menu, skip link, focus trap/restoration, keyboard-driven
+  tabs, and reduced-motion behavior for the React workspace.
+- Added a dedicated human-first experience stylesheet that owns the product
+  shell, conversation canvas, shared content rhythm, responsive behavior, and
+  warm paper/ink/jade visual tokens.
+- Added regression gates for model-request concurrency, workspace/identity
+  authorization, graph ID isolation, command sandbox escapes, SSRF and redirect
+  rebinding, approval ownership, release archive hygiene, browser-extension byte
+  limits/timeouts, OpenAPI drift, and disposable test harness state.
+- Added a checked OpenAPI drift command and browser-extension test command to the
+  normal lint gate.
+
+### Changed
+- Replaced ambient app-factory namespace assembly with typed config, security,
+  Brain, model, and router stages while retaining an explicit compatibility
+  surface.
+- Replaced model-runtime dual globals with injected typed state and split chat
+  contracts, documents, history, and streaming into focused modules.
+- Split Brain feature hooks, translation namespaces, and experience CSS by
+  product surface; frontend version copy now comes from package metadata.
+- Consolidated shallow runtime pass-through modules, timestamps and run-status
+  constants, and moved setup/local-knowledge implementations behind package
+  owned modules with root compatibility shims.
+- Archived code-review documents under `docs/reviews/`, removed obsolete local
+  VSIX artifacts, and documented Electron as an experimental compatibility shell.
+- Compressed the empty Brain home into a single desktop/mobile viewport: the
+  living Brain, real graph, source dock, composer, primary grounded action, and
+  flow status remain visible without page scrolling. Conversation history,
+  deeper proof, and the complete automation action set now open in bounded
+  overlays instead of stacking below the fold.
+- Rebuilt Brain Home around the visible source-to-memory-to-graph-to-automation
+  journey, while keeping the greeting, composer, suggested starts, recent
+  conversations, and optional deeper Brain proof.
+- Renamed and regrouped the primary experience around Chat, Sources, Memory, and
+  Work. Memory now opens with search, basic Work leads with one goal composer,
+  and basic mode hides pipeline, agent-registry, runtime-metric, plugin, and
+  operator tabs until requested.
+- Synced major tab choices to canonical hash routes so refresh, browser history,
+  and bookmarked Sources, Memory, Work, Model, and Settings subviews preserve
+  the user's place.
+- Restyled shared panels, entity lists, empty states, statistics, onboarding,
+  source capture, and active messages to use solid surfaces, whitespace, and
+  separators instead of nested glass cards and dashboard grids.
+- Brain Home now fetches a bounded graph preview so it can show real knowledge
+  relationships immediately; heavier proof and the full graph explorer remain
+  deferred until requested.
+- Model generation, streaming, and document generation now use request-scoped
+  model snapshots without mutating the global selected model.
+- New workspace-scoped graph nodes derive IDs from workspace identity, preventing
+  identical messages/files/concepts in separate workspaces from overwriting or
+  reassigning one another while preserving legacy unscoped reads.
+- Workspace and identity transitions synchronously clear frontend query and
+  conversation state; the client-only egress toggle that claimed server-wide
+  enforcement was removed.
+- Hook/model/network/registry/whole-graph portability and graph-curation operations now use administrator
+  boundaries, and chat/browser/upload/KG writes resolve workspace write access.
+- MCP graph calls now enforce authenticated identity and workspace-scoped reads
+  and writes; local MCP environment values are never returned by the API, and
+  MCP/plugin tool dispatch cannot bypass the dedicated local-file approval flow.
+- Memory, hybrid-search, and garden-note context assembly now use the active
+  workspace instead of blending content from every workspace the user can access.
+- Document-generation RAG, answer traces, trace timeline events, and realtime
+  unscoped events now fail closed at the active workspace boundary.
+- Long-lived realtime streams revalidate the session and workspace membership
+  before replay, every queued event, and each heartbeat, so revocation takes
+  effect without waiting for the SSE connection to reconnect.
+- Realtime presence now validates workspace membership, prevents cross-user
+  client-id takeover/eviction, and assigns authenticated joins to an allowed
+  workspace instead of an unscoped global presence record.
+- Local data directories and atomic JSON/session files now use private POSIX
+  permissions where supported.
+- Docker packaging now uses a small build context, a non-root runtime user, and
+  a healthcheck; personal OpenClaw/bot bridge files are excluded from Git,
+  Docker, and every release archive while remaining available as ignored
+  machine-local files.
+
+### Fixed
+- Closed every actionable item in the July 11 code review across fail-closed
+  security, typed runtime/model/chat ownership, honest frontend failures/tests,
+  and repository hygiene.
+- Telegram now rejects unknown chats before registration; invitation gates no
+  longer trust a static cookie or built-in code, including SSO just-in-time
+  provisioning; and graph projection failures cannot expose cross-workspace
+  nodes.
+- Agent and Computer Use history/run persistence now retains authenticated
+  user and workspace ownership, and recent model context is selected through
+  fail-closed storage scopes before prompt assembly.
+- Desktop, knowledge, Obsidian, and network-status tools now use explicit
+  policy/capability/consent checks. Permission queues use atomic private writes,
+  notifications expose token hints only, and MCP paths are masked.
+- Failed API results no longer become quiet healthy Brain state, proof is not
+  synthesized after failure, and action success callbacks run only on success.
+- Fixed ingestion deltas that compared against truncated display lists instead
+  of complete graph/readiness baselines, and replaced simulated stage timers
+  with post-response memory and graph verification.
+- Fixed global Brain recall pulses being ignored by Brain instances without a
+  local callback, relationship visuals inventing fallback endpoints, and SVG
+  gradient IDs colliding when multiple living Brains appear on one page.
+- Fixed Brain automation hook/agent configuration mismatches, missing scoped
+  recall, trigger runs that skipped agent execution, and review-queue runs that
+  did not execute the workflow's agent node.
+- Fixed local-folder graph nodes and Brain events trusting unvalidated or absent
+  workspace scope, losing scope on watcher restart, appearing in another
+  workspace's graph/search, or waking another workspace/owner's recipe. Legacy
+  personal nodes are reprojected without changing their IDs.
+- Fixed recipe activation replacing reviewed user edits with the starter
+  definition, and stopped empty web captures from being presented as newly
+  remembered knowledge.
+- Blocked permission request self-approval, stale disabled/deleted-account
+  sessions, agent approval forgery and cross-user resume, body identity spoofing,
+  command traversal/symlink/interpreter escapes, and authenticated scope lookup
+  fail-open behavior.
+- Hardened URL ingestion against localhost/private/link-local/multicast/reserved
+  targets, mixed DNS answers, redirect-to-metadata attacks, environment proxies,
+  binary payloads, and unbounded response buffering.
+- Isolated integration and OpenAPI generation from real `~/.ltcai` state and
+  made missing required npm tarballs a release-validation failure.
+
+## [9.0.0] - 2026-07-08
+
+### Added
+- Added Brain Brief suggested questions that turn current memory, recall proof,
+  graph concepts, and conversation history into clickable first-screen prompts.
+- Suggested Brain questions now send immediately from the first screen instead
+  of only filling the composer.
+- Added one-click follow-up prompts under the latest Brain answer for turning a
+  reply into a checklist, evidence review, or prioritized next steps.
+- Added a Brain chat to Review Center handoff so users can save an answer as a
+  reviewable task draft and manage it alongside automation suggestions.
+- Added direct Brain-to-Agent delegation and successful agent-run synthesis into
+  durable Brain memory/graph context.
+- Surfaced recent agent-synthesis memories in Brain overview and memory rings
+  so delegated work is visibly reflected on the home screen.
+- Improved agent-run Brain synthesis quality by splitting successful results
+  into key facts, decisions, and follow-up memories with structured metadata.
+- Agent follow-ups now enter Review Center as task drafts so delegated work
+  produces actionable approval candidates instead of passive memory only.
+- Approving an Agent follow-up review item now promotes it into a manual
+  workflow draft with trigger, agent, and output nodes.
+- Added large-feature foundations for KG/Retrieval scale diagnostics,
+  background ingestion scheduling, offline multimodal image captions,
+  proactive contradiction detection, and ingestion bridge marketplace templates.
+- Added proactive Brain action cards that turn Brain Brief evidence into
+  one-click ask, Agent delegation, Review Center draft, or graph navigation
+  actions on the Brain home screen.
+- Added a visible proactive Brain action trail so one-click suggestions show
+  their running/completed/failed state after the user acts on them.
+
+### Changed
+- Continued app-factory decomposition by extracting user profile/API-key helper
+  wiring into `latticeai.runtime.user_key_runtime`, keeping the legacy
+  `server_app` callable surface while making keyring/plaintext fallback policy
+  independently testable.
+- Split additional runtime and static-data seams out of app, chat, MCP, model,
+  and Knowledge Graph modules while preserving re-export compatibility for
+  existing imports.
+- Routed Computer Use direct `/cu/*` actions through the shared ToolRegistry
+  policy gate and audit lifecycle, preserving route paths while blocking
+  non-admin direct desktop control by default.
+- Moved blocked-system-prefix protection into `tools.local_write` itself so
+  local filesystem writes fail closed even when called outside the HTTP approval
+  route.
+- Narrowed the lazy `server_app` compatibility namespace by filtering
+  app-factory scratch imports and runtime wiring dictionaries while preserving
+  explicit legacy helpers, and added a typed `RuntimeBundle` migration target
+  behind the legacy `_RUNTIME_BUNDLE` dict.
+
+### Fixed
+- Added regression coverage for provider API-key lookup/storage behavior,
+  including keyring precedence, plaintext fallback gating, legacy plaintext
+  cleanup after keyring writes, and identity creation on plaintext fallback.
+- Added regression coverage for Computer Use policy enforcement, audit-safe
+  typed-text metadata, and direct local-write system-prefix blocking.
+- Fixed functional findings from the July 8 code review: file generation now
+  fails cleanly when no model is loaded, chat/document streams preserve a
+  terminal SSE event on generation errors, agent runs persist failed status on
+  executor exceptions, Brain delegation treats HTTP failures as failures, and
+  local permission expiry cleanup no longer corrupts the active token lookup.
+- Tightened non-security chat intent detection, Telegram bot server URL
+  configuration, LATTICE_TZ-aware runtime audit timestamps, local embedding
+  dimension consistency, and stale Brain UI version copy.
+- Paid down the remaining July 8 cleanup debt by moving duplicated JSON/ISO/hash
+  and setup detection helpers into shared modules, switching runtime audit
+  appends to JSONL while preserving legacy JSON reads, making the legacy runtime
+  namespace allowlist-based, clarifying static-vs-SPA design token ownership,
+  and consolidating duplicated frontend helper functions.
+- Reduced the remaining chat-router risk by extracting repeated chat history,
+  bridge notification, no-model, single-answer, direct-file, and agent-file
+  response paths out of the main `/chat` handler, with regression coverage for
+  the shared fast-path epilogue.
 
 ## [8.9.0] - 2026-07-06
 
@@ -233,7 +452,7 @@ existed at that release.
 - Updated architecture and product readiness targets to 8.0.0.
 - Synchronized package/runtime/static/Tauri metadata to 8.0.0.
 - Updated current-release docs and exact artifact names to 8.0.0 while
-  preserving historical 7.x entries.
+  setting 8.0.0 as the oldest retained release-history entry.
 
 ### Fixed
 - Made logical Knowledge Graph `replace` imports transactional so malformed
@@ -242,239 +461,3 @@ existed at that release.
   `relationship_search`, and `traverse`.
 - Preserved colliding legacy edge labels during logical import/backfill while
   keeping native write-door synonym dedupe canonical.
-
-## [7.9.0] - 2026-06-23
-
-### Changed
-- Added `SingleAgentRuntime` as the explicit name for the legacy single-agent
-  state machine while preserving `AgentRuntime` as a compatibility alias.
-- Updated tool dispatch to build `SingleAgentRuntime` directly.
-- Moved single-agent git rollback behind an injected `rollback_file` port owned
-  by `ToolDispatchService`, keeping shell execution out of the core state
-  machine.
-- Added a shared `runtime-boundary/v1` descriptor so product and single-agent
-  runtime boundaries are machine-readable in config/tests.
-- Added `RuntimeBoundaryProtocol` as the minimal shared inspection surface for
-  runtime-boundary-aware dependency injection.
-- Updated architecture and product readiness targets to 7.9.0.
-
-## [7.8.0] - 2026-06-22
-
-### Changed
-- Rebuilt Brain Chat Home around immediate conversation: chat purpose, starter
-  prompts, and the composer now occupy the first viewport.
-- Collapsed source ingestion, readiness, proof, timeline, overview, model
-  continuity, and care controls behind one utility drawer.
-- Kept workspace navigation visible on the default Brain surface.
-- Hid default depth controls until the user intentionally travels deeper.
-- Integrated the six post-7.7 UX drafts into the canonical Brain experience:
-  first-run value cards, stronger recommendation affordances, product-toned
-  Brain Home copy, and routed legacy Brain conversation entry points to the
-  canonical Brain Home surface.
-- Removed obsolete Brain conversation and first-run guide components.
-- Moved draft onboarding polish out of inline styles and into the shared design
-  stylesheet with responsive behavior and bilingual copy.
-- Updated architecture and product readiness targets to 7.8.0.
-- Refreshed 7.8.0 release screenshots, walkthrough video/GIF, and capture
-  notes under `output/release/v7.8.0/`.
-
-## [7.7.0] - 2026-06-22
-
-> 7.7.0 marks the complete, finished product stage for Lattice AI.
-> After 7.6.0 architecture closure, this release polishes every surface so that anyone looking at the code, UI, docs, or running app immediately recognizes: "this is now a product".
-
-Lattice AI v7.7 delivers the Living Brain as the undeniable center, production-grade runtime contracts, stable ToolRegistry, full ingestion-to-graph flows, bilingual professional UX, and zero-beta signals. Classifiers moved to Production/Stable. All prior gates remain enforced under finished product contract.
-
-Package metadata, Tauri, frontend, Python all aligned to 7.7.0. UI/UX microcopy and signals updated to convey finished professional tool.
-
-### Productization Highlights
-- Extreme self + claude-code (pts_claudecode) used for polish, evaluation, iteration.
-- "This is a product" bar: clear durable knowledge ownership, no loose ends.
-- Validation: typecheck, unit, cargo, build scripts exercised.
-
-### Changed
-- Package/runtime/static metadata synchronized to 7.7.0.
-- Development status to Production/Stable.
-- All current-release references point to 7.7.0.
-
-## [7.6.0] - 2026-06-22
-
-> Brain-Centered UX & Architecture Closure. Incorporates the two local review
-> files into the release line with a Wake Brain first-run surface, memory rings
-> plus direct depth controls, and machine-checkable architecture readiness gates.
-
-### Added
-- Wake Brain first-run entry before owner/profile setup, reducing onboarding to
-  the product promise first and the setup mechanics second.
-- Concentric memory rings around Brain Home plus direct controls for Now, Memory,
-  Topics, Relationships, and Full Graph navigation.
-- `latticeai.services.architecture_readiness.architecture_readiness()` and
-  `tests/unit/test_v76_review_completion.py` to keep AgentRuntime, ToolRegistry,
-  Config, server decomposition, KG hardening, and Brain UX review closure under
-  test.
-
-### Changed
-- Package/runtime/static metadata is synchronized to 7.6.0; package publish and
-  deployment remain owner-run only.
-- README and release docs now describe 7.6.0 as the current release and point to
-  refreshed 7.6.0 screenshots, walkthrough GIF, and release evidence index under
-  `output/release/v7.6.0/`.
-
-## [7.5.0] - 2026-06-20
-
-> Runtime Debt Burn-down & Release Risk Cleanup. Turns the 7.4.0 contract
-> envelope into a consumed API surface, expands retrieval quality to a 250+
-> record local corpus fixture, and removes release/security warnings.
-
-### Added
-- `extract_contract`, `require_contract`, `contract_view`, and `contract_views`
-  helpers for consumers that need a surface-agnostic `agent-run-contract/v1`
-  projection.
-- AgentRuntime status/list/detail/events and realtime feed responses now expose
-  compact `contracts` views alongside legacy payloads.
-- Deterministic 250+ record retrieval benchmark corpus while keeping 12 judged
-  queries and real `KnowledgeGraphStore` + `SearchService` execution.
-- Refreshed README release evidence screenshots and walkthrough GIF under
-  `output/release/v7.5.0/`.
-
-### Changed
-- Tauri Rust/CLI dependencies are updated within the Tauri 2 line, removing the
-  old transitive `block v0.1.6` future-incompatibility warning.
-- npm dependency overrides move `js-yaml` to a non-vulnerable version; `npm
-  audit` reports 0 vulnerabilities.
-- CI lint compatibility is restored for the Brain quality gate script.
-- Local MLX model preparation now recognizes valid existing Hugging Face cache
-  snapshots, avoiding an unnecessary re-download when the model already exists
-  outside Lattice's managed `~/.ltcai/hf-models` directory.
-- Package/runtime/static metadata is synchronized to 7.5.0; package publish and
-  deployment remain owner-run only.
-
-## [7.4.0] - 2026-06-20
-
-> Runtime Contract Convergence & Corpus Retrieval. Completes the
-> agent-run-contract/v1 family across run storage, workflow execution, audit
-> events, realtime events, and a real corpus-scale retrieval quality gate.
-
-### Added
-- Persisted agent and workflow run rows now carry refreshed contract metadata
-  for queued, running, terminal, cancelled, and interrupted states.
-- Workflow engine results, replay payloads, audit log events, and realtime SSE
-  feed events now expose the same `agent-run-contract/v1` family envelope while
-  preserving existing top-level compatibility fields.
-- Corpus-scale retrieval fixture with 30+ documents, judged queries,
-  must-include expectations, and thresholds for recall, precision, NDCG, and
-  hit rate.
-- `scripts/brain_quality_eval.py` now exercises the real local
-  `KnowledgeGraphStore` + `SearchService` hybrid retrieval path before scoring.
-
-### Changed
-- `RetrievalBenchmarkRunner` reports dynamic metric aliases for the selected
-  `top_k` and a `must_include_hit_rate`.
-- Package/runtime/static metadata is synchronized to 7.4.0; package publish and
-  deployment remain owner-run only.
-
-## [7.3.0] - 2026-06-20
-
-> Runtime Contract & Retrieval Quality. Turns the next AgentRuntime extraction
-> step and the uploaded roadmap's hybrid-search quality goals into a small,
-> tested release: shared run contracts and deterministic recall regression.
-
-### Added
-- `lattice_brain.runtime.contracts.AgentRunContract`, a serializable
-  `agent-run-contract/v1` payload shared by single-agent and multi-agent
-  execution paths.
-- Multi-agent API result/run patches now include the shared contract with
-  runtime, mode, status, roles, retries, timeline, and terminal-state data.
-- Single-agent runtime exposes the same contract helper for UI/API/storage
-  convergence in the next extraction pass.
-- `scripts/brain_quality_eval.py` now runs deterministic hybrid recall/ranking
-  regression checks with recall and precision thresholds.
-
-### Changed
-- Package/runtime/static metadata is synchronized to 7.3.0; package publish and
-  deployment remain owner-run only.
-
-## [7.2.0] - 2026-06-20
-
-> Runtime Trust Baseline. Adds execution preview and registry diagnostics so
-> agent runs and tool permissions become inspectable contracts before action.
-
-### Added
-- `POST /agents/api/run/preview` for AgentRuntime readiness, role selection,
-  input keys, retry clamping, and blocking reasons without starting a run.
-- `GET /tools/registry` for the live ToolRegistry manifest across dispatch
-  handlers, governance policy, catalog descriptions, and permissions.
-- `GET /tools/registry/diagnostics` for a compact drift check suitable for CI,
-  admin views, and runtime health panels.
-- Unit coverage for AgentRuntime preview and ToolRegistry manifest diagnostics.
-
-### Changed
-- Tool governance now covers `read_document`, and the catalog describes
-  `create_web_project`, closing the current dispatch/governance/catalog drift.
-- Package/runtime/static metadata is synchronized to 7.2.0; package publish and
-  deployment remain owner-run only.
-
-## [7.1.0] - 2026-06-20
-
-> Brain Usability Completion. Completes the 7.1.0 first-run through editor-sync
-> usability pass: clear onboarding, visible ingestion, graph controls, inline
-> proof, workspace/admin discovery, feedback states, and VS Code sync status.
-
-### Added
-- Hardware visualization, expected timing, install timeline, and next-action
-  copy in first-run onboarding.
-- Brain Home ingestion stage disclosure and memory emergence timeline for file,
-  folder, note, and URL sources.
-- Knowledge Graph search suggestions, entity type filters, recent/all-time time
-  exploration, focus clearing, and neighbor highlighting.
-- Inline answer citation markers with keyboard-accessible proof cards.
-- Workspace/profile switcher, Admin Console gate, consent revoke feedback, and
-  shared empty/error feedback surfaces in the Brain shell.
-- VS Code extension heartbeat/status endpoint plus extension and main-app sync
-  indicators for connected/indexing/synced/offline states.
-
-### Changed
-- Package/runtime/static metadata is synchronized to 7.1.0; package publish and
-  deployment remain owner-run only.
-
-## [7.0.0] - 2026-06-18
-
-> Brain Productization Loop. Turns the Brain proof work into a first-five-minute
-> product flow: add sources, ask a question, see proof/citations, and verify the
-> same Brain evidence after switching models.
-
-### Added
-- Brain Home ingestion panel for files, local folder paths, notes, and web URLs,
-  all backed by existing workspace-scoped ingestion routes.
-- Answer-level Memory proof and source citation cards rendered under assistant
-  responses after Brain proof refreshes for the user's query.
-- Model-continuity demo strip that lets the user recheck the same Brain
-  evidence and jump to model switching from the Brain flow.
-- Deterministic `scripts/brain_quality_eval.py` recall/KG quality gate, wired
-  into CI after the unit suite.
-- Visual mock coverage for Brain proof, document upload, note ingest, folder
-  indexing, and web URL ingestion endpoints.
-
-### Changed
-- Brain Home is now ingestion-first instead of chat-first: first screen action
-  labels are files/folders/notes/web, with deeper graph/model/settings still
-  reachable from the shell.
-- Package/runtime/static metadata is synchronized to 7.0.0; package publish and
-  deployment remain owner-run only.
-
-- Completed ALL Recommended next refactor items from report #15 in this session:
-  - Server decomp wave (model_runtime globals/wiring): model_loading.py for prepare_and_load and stream, _MODEL_RUNTIME_STATE, model_engines.
-  - Deeper WorkspaceOSStore (timeline + plugins + snapshots + memory).
-  - KG embed: set_embed_dim.
-- All refactoring needed finished this session per AGENTS. 767 tests, builds, greps clean.
-
-### Added (this session features)
-- `vision_analyze` tool: new multimodal vision analysis tool using screenshot b64 + prompt. Leverages existing VLM support (image_data in generate). Added to computer-use agent prompt and general tools. Fits seamlessly with computer_use, agent runtime, tool registry, and VLM models without affecting text-only paths.
-- More recent multimodal models in user recommendations (Llama 3.2 11B Vision, Phi-3.5 Vision, Qwen2.5-VL 7B, Moondream2) + family order update in model_recommendation. Expanded curated list in model_capability_registry for better local VLM choices on Apple Silicon and other.
-- All additions checked for compatibility with existing KG (descriptions can be ingested), agents/tools dispatch, chat/computer_use (image pass-through), model rec logic, and non-multimodal fallbacks.
-
-- Perfect completion of report #15 recommended refactor:
-  - Server decomp wave: ModelRuntimeState class (not dict) for globals/wiring in model_runtime; sync_to_module_globals for compat; further clean.
-  - Deeper WorkspaceOSStore: timeline/plugins managers fully delegated and composed (record, has_permission etc all through).
-  - KG embed: set_embed_dim available for optional central handling.
-- All changes preserve legacy exactly, full composition, small modules.

package/docs/COMMUNITY_AND_PLUGINS.md

@@ -1,11 +1,12 @@
 # Community And Plugins
 
-Current release: **8.9.0 — Scoped Memory & Tool Policy Hardening**.
+Current release: **9.1.0 — Code Review Completion & Fail-Closed Runtime**.
 
 LatticeAI defines the path from a strong local-first framework (8.4.0
 action-aware baseline, 8.5.0 registry+DI hardening, 8.6.0 capture/navigation
 reliability, 8.7.0 runtime-state hygiene, 8.8.0 Brain Core extraction
-readiness, and 8.9.0 scoped Tool API hardening) to a product ecosystem. The
+readiness, 8.9.0 scoped Tool API hardening, 9.0.0 cleanup closure, and 9.1.0
+fail-closed review completion) to a product ecosystem. The
 immediate goal is small and practical: make it clear how
 contributors can extend the Brain without weakening local-first trust,
 workspace scoping, or release quality.

package/docs/DEVELOPMENT.md

@@ -1,10 +1,10 @@
 # Lattice AI Development
 
-Current release: **8.9.0 — Scoped Memory & Tool Policy Hardening**.
+Current release: **9.1.0 — Code Review Completion & Fail-Closed Runtime**.
 
 This document is for contributors working on the local-first Digital Brain
 codebase. Product positioning and quick start stay in `README.md`; release
-history is intentionally limited to 7.0.0-8.9.0 in `docs/CHANGELOG.md` and
+history is intentionally limited to 8.0.0-9.1.0 in `docs/CHANGELOG.md` and
 `RELEASE.md`.
 
 ## Product Contract
@@ -51,12 +51,14 @@ API, UI, or release work, run:
 npm run check:python
 npm run lint
 npm run typecheck
+npm run test:frontend
 npm run test:unit
 npm run docs:check-links
 ```
 
 `npm run lint` runs the Python Ruff baseline, frontend TypeScript lint gate,
-visual smoke syntax checks, and i18n literal checks.
+visual smoke syntax checks, an exact generated-OpenAPI drift check, i18n literal
+checks, and browser-extension syntax/behavior tests.
 
 Use these when the change touches the relevant surface:
 
@@ -64,10 +66,42 @@ Use these when the change touches the relevant surface:
 npm run test:integration
 npm run test:visual
 npm run desktop:tauri:check
+npm run release:evidence
 npm run release:artifacts
 npm run release:validate
 ```
 
+Run `npm run build:assets` before `npm run release:evidence`. The capture command
+reads the current package version, writes only to `output/release/vX.Y.Z/`, and
+requires Playwright Chromium plus `ffmpeg` for the checked-in GIF/WebM evidence.
+
+`npm run test:integration` starts its own loopback server with disposable HOME,
+data, Brain, agent, XDG, temp, SQLite, and vault paths. It refuses non-loopback
+external base URLs so validation cannot mutate a developer's real local Brain.
+
+Regenerate committed API artifacts with `npm run frontend:openapi`; CI and
+`npm run lint` fail when either `frontend/openapi.json` or
+`frontend/src/api/openapi.ts` differs from a fresh isolated export.
+
+## Frontend Experience Ownership
+
+`frontend/src/styles/tokens.css` owns React color tokens and
+`frontend/src/styles/experience.css` imports the focused shell, conversation,
+graph, capture, and responsive layers under `frontend/src/styles/experience/`.
+Keep ownership in the narrowest surface file; do not add another competing
+shell or composer rule to `styles.css`.
+
+Brain behavior belongs in the focused `useBrainChat`, `useBrainHistory`,
+`useBrainIngestion`, and `useBrainProof` hooks. Translation namespaces live in
+`frontend/src/i18n/`. Failed `ApiResult` values must remain unavailable/error
+states rather than being normalized to healthy empty data, and affected paths
+must have Vitest coverage.
+
+Default mode should expose user tasks and outcomes. Runtime metrics, registry
+identifiers, pipeline controls, and administrator tools belong in progressive
+disclosure or advanced/admin mode. New navigation and tabs must preserve
+keyboard access, visible focus, mobile safe areas, and reduced-motion behavior.
+
 ## Runtime Assembly
 
 `latticeai.app_factory` is the composition root. Keep it import-safe:
@@ -77,13 +111,18 @@ npm run release:validate
 - no filesystem writes at module import time;
 - no external network calls at module import time.
 
-Runtime assembly seams live under `latticeai.runtime`:
+Runtime assembly seams live under `latticeai.runtime` as typed stages:
 
-- `config_runtime.py` derives app config values from `Config`;
+- `config_runtime.py` derives immutable app config values from `Config`;
 - `security_runtime.py` applies trusted proxy/security-derived settings;
-- `brain_runtime.py` constructs Brain Core and conversation primitives.
-- model/runtime, ToolRegistry/MCP, router, static asset, and lifespan seams
-  should continue moving out of monolithic app-factory helpers.
+- `brain_runtime.py` constructs Brain Core and conversation primitives;
+- model, platform, and router stages receive explicit dependencies and return
+  typed bundles rather than ambient `locals()` maps.
+
+The module-level `server_app` compatibility surface is an explicit allowlist.
+Model services use injected state, and HTTP exceptions belong at the API
+boundary. Readiness tests should reject forbidden patterns instead of treating
+symbol presence alone as architectural completion.
 
 Future extraction should continue with AgentRuntime, ToolRegistry, config,
 server decomposition, and Knowledge Graph stabilization in that order when
@@ -114,10 +153,10 @@ For user-facing, API, runtime, release, or packaging changes, check:
 Release/publish examples must use exact target-version filenames. Do not
 document wildcard artifact upload commands.
 
-For 8.9.0 release work, exact artifacts are:
+For 9.1.0 release work, exact artifacts are:
 
-- `dist/ltcai-8.9.0-py3-none-any.whl`
-- `dist/ltcai-8.9.0.tar.gz`
-- `ltcai-8.9.0.tgz`
-- `dist/ltcai-8.9.0.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_8.9.0_aarch64.dmg`
+- `dist/ltcai-9.1.0-py3-none-any.whl`
+- `dist/ltcai-9.1.0.tar.gz`
+- `ltcai-9.1.0.tgz`
+- `dist/ltcai-9.1.0.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_9.1.0_aarch64.dmg`