ltcai 9.0.0 → 9.1.0

package/latticeai/services/platform_runtime.py

@@ -20,7 +20,9 @@ from fastapi import HTTPException, Request
 from lattice_brain.runtime.hooks import dispatch_tool
 from lattice_brain.runtime.multi_agent import MultiAgentOrchestrator, default_role_runner, llm_role_runner
 from lattice_brain.workflow import ApprovalRequired, WorkflowEngine
-from tools import execute_tool
+from latticeai.core.tool_registry import SCOPED_KNOWLEDGE_TOOLS
+from latticeai.services.tool_dispatch import enforce_tool_policy
+from latticeai.tools import execute_tool
 
 
 class PlatformRuntime:
@@ -38,6 +40,7 @@ class PlatformRuntime:
         llm_generate: Optional[Callable[..., str]] = None,
         llm_available: Optional[Callable[[], bool]] = None,
         agent_registry: Any = None,
+        memory_recall: Optional[Callable[..., Dict[str, Any]]] = None,
     ):
         self.store = store
         self.svc = workspace_service
@@ -55,6 +58,7 @@ class PlatformRuntime:
         self.llm_generate = llm_generate
         self.llm_available = llm_available or (lambda: False)
         self.agent_registry = agent_registry
+        self.memory_recall = memory_recall
 
     # ── request gating ────────────────────────────────────────────────────
 
@@ -75,7 +79,12 @@ class PlatformRuntime:
             workspaces = self.svc.list_workspaces(user or None).get("workspaces", [])
             return {ws.get("workspace_id") for ws in workspaces if ws.get("workspace_id")}
         except Exception:
-            return None
+            # ``None`` deliberately means "unscoped local/no-auth mode" to
+            # search and realtime consumers. Returning it for an authenticated
+            # account on a storage/service failure would therefore fail open
+            # and expose every workspace. Authenticated failures see nothing;
+            # only the explicit anonymous local mode keeps legacy semantics.
+            return set() if user else None
 
     # ── plugin lifecycle hooks ────────────────────────────────────────────
 
@@ -86,7 +95,7 @@ class PlatformRuntime:
 
     # ── shared node runners ───────────────────────────────────────────────
 
-    def _tool_node_runner(self):
+    def _tool_node_runner(self, user=None, scope=None):
         """Workflow tool node: EXECUTES the tool under governance (v4).
 
         Auto-approve tools run immediately through the shared dispatch_tool
@@ -99,9 +108,12 @@ class PlatformRuntime:
         def runner(*, node, context):
             cfg = node.get("config") or {}
             name = cfg.get("tool") or ""
-            args = cfg.get("args") or {}
+            args = dict(cfg.get("args") or {})
             if not name:
                 raise ValueError("tool node has no tool configured")
+            if name in SCOPED_KNOWLEDGE_TOOLS:
+                args["workspace_id"] = scope or "personal"
+                args["user_email"] = user or "local"
             try:
                 permission = dict(self.get_tool_permission(name, args))
             except TypeError:
@@ -142,6 +154,31 @@ class PlatformRuntime:
 
     def _context_provider(self, user, scope):
         def provider(goal: str):
+            recall = getattr(self, "memory_recall", None)
+            if recall is not None:
+                try:
+                    payload = recall(
+                        goal,
+                        user_email=user,
+                        workspace_id=scope,
+                        limit=8,
+                    )
+                    results = payload.get("results") or payload.get("items") or []
+                    evidence = []
+                    for item in results[:8]:
+                        if not isinstance(item, dict):
+                            continue
+                        source = str(item.get("source") or "memory")
+                        title = str(item.get("title") or item.get("kind") or "Memory")
+                        snippet = str(item.get("snippet") or item.get("content") or "").strip()
+                        if snippet:
+                            evidence.append(f"[{source}] {title}: {snippet[:240]}")
+                    if evidence:
+                        return evidence
+                except Exception:
+                    # Recall is an enrichment seam; the legacy store fallback
+                    # keeps agent execution available if it degrades.
+                    pass
             try:
                 mems = self.store.search_memories(goal, user_email=user, workspace_id=scope).get("memories", [])
                 ctx = [str(m.get("content") or "")[:180] for m in mems[:6]]
@@ -152,6 +189,14 @@ class PlatformRuntime:
                     ctx = synth + ctx
                 except Exception:
                     pass
+                if not ctx:
+                    try:
+                        recent = self.store.list_memories(user_email=user, workspace_id=scope).get("memories", [])
+                        # list_memories is newest-first; automation should ground
+                        # itself in the knowledge that just entered the Brain.
+                        ctx = [str(m.get("content") or "")[:180] for m in recent[:8]]
+                    except Exception:
+                        pass
                 return ctx[:8]
             except Exception:
                 return []
@@ -169,15 +214,20 @@ class PlatformRuntime:
             tool = args.get("tool") or (manifest.provides.get("tools") or [None])[0]
             if not tool:
                 raise ValueError(f"plugin '{plugin_id}' run_tool needs a tool name")
-            permission = dict(self.get_tool_permission(tool))
-            if permission.get("requires_approval"):
-                raise ApprovalRequired(
-                    f"plugin tool '{tool}' requires explicit approval",
-                    tool=tool, args=args, permission=permission,
-                )
+            args = dict(args)
+            if tool in SCOPED_KNOWLEDGE_TOOLS:
+                args["workspace_id"] = scope or "personal"
+                args["user_email"] = user or "local"
+            policy = enforce_tool_policy(
+                tool,
+                args,
+                current_user=user or "",
+                source="plugin",
+            )
+            permission = dict(self.get_tool_permission(tool, args))
             result = dispatch_tool(self.hooks, tool, args, lambda: execute_tool(tool, args),
                                    source=f"plugin:{plugin_id}")
-            return {"plugin": plugin_id, "tool": tool, "permission": permission,
+            return {"plugin": plugin_id, "tool": tool, "permission": permission, "policy": dict(policy),
                     "executed": True, "result": result}
 
         def run_workflow(*, plugin_id, action, args, manifest):
@@ -206,8 +256,18 @@ class PlatformRuntime:
     def _agent_node_runner(self, user, scope):
         def runner(*, node, context):
             cfg = node.get("config") or {}
-            goal = cfg.get("goal") or context.get("goal") or "Run agent"
-            return self.run_agent(goal, user, scope, with_workflow=False, roles=cfg.get("roles"), inputs=context.get("inputs"))
+            goal = cfg.get("goal") or cfg.get("prompt") or context.get("goal") or "Run agent"
+            roles = cfg.get("roles")
+            if not roles and (cfg.get("mode") == "draft" or cfg.get("prompt")):
+                roles = ["researcher", "planner", "executor", "reviewer"]
+            return self.run_agent(
+                goal,
+                user,
+                scope,
+                with_workflow=False,
+                roles=roles,
+                inputs=context.get("inputs"),
+            )
         return runner
 
     # ── cross-system runs ─────────────────────────────────────────────────
@@ -218,7 +278,7 @@ class PlatformRuntime:
         except FileNotFoundError:
             return {"error": f"workflow not found: {workflow_id}"}
         runners = {
-            "tool": self._tool_node_runner(),
+            "tool": self._tool_node_runner(user, scope),
             "skill": self._skill_node_runner(),
             "plugin": self._plugin_node_runner(user, scope),
         }
@@ -236,12 +296,8 @@ class PlatformRuntime:
         return {"workflow_run_id": run["id"], "status": result.status}
 
     def run_agent(self, goal, user, scope, *, with_workflow: bool, roles=None, inputs=None) -> Dict[str, Any]:
-        role_runner = default_role_runner(
-            workflow_runner=(lambda wf_ref, ctx: self.run_workflow_by_id(wf_ref, user, scope, with_agent=False, inputs=ctx.inputs)) if with_workflow else None,
-            plugin_runner=lambda pid, ctx: self.registry.execute_action(pid, "run_skill", {}, runners=self.plugin_capability_runners(user, scope), workspace_id=scope).as_dict(),
-            context_provider=self._context_provider(user, scope),
-        )
-        result = MultiAgentOrchestrator(role_runner=role_runner).run(
+        orchestrator = self.build_orchestrator(user, scope, with_workflow=with_workflow)
+        result = orchestrator.run(
             goal, user_email=user, workspace_id=scope, roles=roles, inputs=inputs or {}
         )
         run = self.store.record_agent_run(
@@ -259,14 +315,18 @@ class PlatformRuntime:
 
     def build_workflow_runners(self, user, scope) -> Dict[str, Callable[..., Any]]:
         return {
-            "tool": self._tool_node_runner(),
+            "tool": self._tool_node_runner(user, scope),
             "skill": self._skill_node_runner(),
             "plugin": self._plugin_node_runner(user, scope),
             "agent": self._agent_node_runner(user, scope),
         }
 
-    def build_orchestrator(self, user, scope) -> MultiAgentOrchestrator:
-        workflow_runner = lambda wf_ref, ctx: self.run_workflow_by_id(wf_ref, user, scope, with_agent=False, inputs=ctx.inputs)  # noqa: E731
+    def build_orchestrator(self, user, scope, *, with_workflow: bool = True) -> MultiAgentOrchestrator:
+        workflow_runner = (
+            (lambda wf_ref, ctx: self.run_workflow_by_id(wf_ref, user, scope, with_agent=False, inputs=ctx.inputs))
+            if with_workflow
+            else None
+        )
         plugin_runner = lambda pid, ctx: self.registry.execute_action(pid, "run_skill", {}, runners=self.plugin_capability_runners(user, scope), workspace_id=scope).as_dict()  # noqa: E731
         context_provider = self._context_provider(user, scope)
         custom_agents = {}

package/latticeai/services/product_readiness.py

@@ -1,4 +1,4 @@
-"""Machine-checkable *product* readiness gates for the 8.4 line.
+"""Machine-checkable product readiness gates for the current release.
 
 Where ``architecture_readiness`` proves the internal structure is sound, this
 module answers the product question the 8.4 release exists to settle: *does the
@@ -18,7 +18,7 @@ from typing import Any, Dict, List
 
 from latticeai.services.architecture_readiness import architecture_readiness
 
-PRODUCT_VERSION_TARGET = "9.0.0"
+PRODUCT_VERSION_TARGET = "9.1.0"
 
 
 @dataclass(frozen=True)
@@ -37,11 +37,12 @@ PRODUCT_GATES: List[ProductGate] = [
         evidence=[
             "docs/ONBOARDING.md::five-minute",
             "frontend/src/components/ProductFlow.tsx::WakeBrainScreen",
-            "frontend/src/features/brain/BrainConversation.tsx::ProductCommandCenter",
+            "frontend/src/features/brain/BrainConversation.tsx::brain-home-insights",
             "frontend/src/features/brain/BrainConversation.tsx::BrainBriefPanel",
             "frontend/src/features/brain/BrainHome.tsx",
-            "auto_setup.py",
-            "setup_wizard.py",
+            "frontend/src/App.tsx::brain-mobile-nav",
+            "latticeai/setup/auto_setup.py",
+            "latticeai/setup/wizard.py",
         ],
     ),
     ProductGate(
@@ -57,7 +58,8 @@ PRODUCT_GATES: List[ProductGate] = [
         title="File action requests create artifacts instead of code-only answers",
         evidence=[
             "latticeai/api/chat.py::is_file_action_request",
-            "latticeai/api/chat.py::direct_write_file",
+            "latticeai/api/chat_intents.py::direct_file_action",
+            "latticeai/api/chat_intents.py::direct_write_file",
             "tests/unit/test_chat_telegram_decoupling.py::test_chat_file_creation_intent_writes_real_file",
         ],
     ),
@@ -76,10 +78,10 @@ PRODUCT_GATES: List[ProductGate] = [
         evidence=[
             "package.json::release:artifacts",
             "package.json::release:validate",
-            "README.md::dist/ltcai-9.0.0-py3-none-any.whl",
-            "README.md::dist/ltcai-9.0.0.tar.gz",
-            "README.md::dist/ltcai-9.0.0.vsix",
-            "README.md::ltcai-9.0.0.tgz",
+            f"README.md::dist/ltcai-{PRODUCT_VERSION_TARGET}-py3-none-any.whl",
+            f"README.md::dist/ltcai-{PRODUCT_VERSION_TARGET}.tar.gz",
+            f"README.md::dist/ltcai-{PRODUCT_VERSION_TARGET}.vsix",
+            f"README.md::ltcai-{PRODUCT_VERSION_TARGET}.tgz",
             "scripts/validate_release_artifacts.py",
             "scripts/release_smoke.py",
             "Dockerfile",
@@ -95,14 +97,14 @@ PRODUCT_GATES: List[ProductGate] = [
         title="Release story is documented and honest",
         evidence=[
             "README.md",
-            "README.md::The current release is **9.0.0",
-            "SECURITY.md::9.0.x (latest)",
-            "vscode-extension/README.md::**9.0.0",
-            "docs/CHANGELOG.md::## [9.0.0]",
+            f"README.md::The current release is **{PRODUCT_VERSION_TARGET}",
+            f"SECURITY.md::{'.'.join(PRODUCT_VERSION_TARGET.split('.')[:2])}.x (latest)",
+            f"vscode-extension/README.md::**{PRODUCT_VERSION_TARGET}",
+            f"docs/CHANGELOG.md::## [{PRODUCT_VERSION_TARGET}]",
             "FEATURE_STATUS.md",
-            "RELEASE_NOTES_v9.0.0.md",
+            f"RELEASE_NOTES_v{PRODUCT_VERSION_TARGET}.md",
             "latticeai/core/agent.py::SingleAgentRuntime",
-            "latticeai/core/agent.py::AgentRuntime = SingleAgentRuntime",
+            "lattice_brain/runtime/agent_runtime.py::class AgentRuntime",
             "lattice_brain/runtime/contracts.py::runtime-boundary/v1",
             "lattice_brain/runtime/contracts.py::RuntimeBoundaryProtocol",
             "lattice_brain/runtime/agent_runtime.py::def boundary",
@@ -115,7 +117,7 @@ PRODUCT_GATES: List[ProductGate] = [
         id="ecosystem-path",
         title="Community and plugin growth path is explicit",
         evidence=[
-            "docs/COMMUNITY_AND_PLUGINS.md::9.0.0",
+            f"docs/COMMUNITY_AND_PLUGINS.md::{PRODUCT_VERSION_TARGET}",
             "docs/PLUGIN_SDK.md",
             "plugins/README.md",
             "plugins/hello-world/plugin.json",

package/latticeai/services/review_queue.py

@@ -49,6 +49,14 @@ def review_queue_opted_in(workflow: Dict[str, Any]) -> bool:
             continue
         if (node.get("config") or {}).get("review_queue") is True:
             return True
+    metadata = workflow.get("metadata") or {}
+    # Compatibility for recipe drafts installed before review_queue became an
+    # explicit trigger flag. They are local-only and already consent-gated.
+    if (
+        metadata.get("created_from") == "brain_automation_recipe"
+        and metadata.get("external_actions") is False
+    ):
+        return True
     return False
 
 
@@ -307,6 +315,10 @@ def _extract_run_id(result: Any) -> Optional[str]:
     if isinstance(result, dict):
         if result.get("run_id"):
             return str(result["run_id"])
+        if result.get("workflow_run_id"):
+            return str(result["workflow_run_id"])
+        if result.get("agent_run_id"):
+            return str(result["agent_run_id"])
         run = result.get("run")
         if isinstance(run, dict) and run.get("id"):
             return str(run["id"])

package/latticeai/services/router_context.py

@@ -34,6 +34,7 @@ class ToolRouterContext:
     install_mcp: Any
     mcp_public_item: Any
     hooks: Any = None
+    workspace_service: Any = None
     # Resolves a caller email to their allowed workspace set (None = no scoping,
     # i.e. single-user / no-auth mode). Threaded to the knowledge-graph router so
     # its read endpoints enforce the same workspace boundary as /api/search.

package/latticeai/services/run_executor.py

@@ -10,18 +10,13 @@ from __future__ import annotations
 
 import asyncio
 from dataclasses import dataclass
-from datetime import datetime
 from typing import Any, Callable, Dict, Optional
 
+from lattice_brain.runtime.statuses import (
+    RUN_ACTIVE_STATUSES as ACTIVE_STATUSES,
+)
 from lattice_brain.workflow import WorkflowEngine
-
-
-ACTIVE_STATUSES = {"queued", "running", "in_progress", "retrying", "cancelling"}
-TERMINAL_STATUSES = {"ok", "retried_ok", "failed", "rejected", "cancelled", "interrupted", "partial"}
-
-
-def _now() -> str:
-    return datetime.now().isoformat(timespec="seconds")
+from latticeai.core.timeutil import now_iso as _now
 
 
 @dataclass