ltcai 9.0.0 → 9.1.0

package/desktop/electron/README.md

@@ -0,0 +1,9 @@
+# Electron compatibility shell
+
+Electron is an experimental compatibility client. The supported desktop build
+is the Tauri application in `src-tauri/`; release artifacts and validation use
+that path. Electron shares the standard local backend at `127.0.0.1:4825` and
+can be launched for development with `npm run desktop:electron`.
+
+Override the backend only for development with
+`LATTICEAI_DESKTOP_BACKEND_ORIGIN` or `LATTICEAI_DESKTOP_BACKEND_CMD`.

package/desktop/electron/main.cjs

@@ -2,7 +2,9 @@ const { app, BrowserWindow, dialog, ipcMain } = require("electron");
 const { spawn } = require("node:child_process");
 const path = require("node:path");
 
-const origin = process.env.LATTICEAI_DESKTOP_BACKEND_ORIGIN || "http://127.0.0.1:8765";
+// Experimental compatibility shell. Tauri is the primary desktop client; use
+// the same backend port as every other Lattice client to avoid split defaults.
+const origin = process.env.LATTICEAI_DESKTOP_BACKEND_ORIGIN || "http://127.0.0.1:4825";
 let backend = null;
 
 ipcMain.handle("lattice:select-folder", async (event) => {
@@ -18,12 +20,12 @@ ipcMain.handle("lattice:select-folder", async (event) => {
 
 function startBackend() {
   if (process.env.LATTICEAI_DESKTOP_NO_BACKEND) return;
-  const command = process.env.LATTICEAI_DESKTOP_BACKEND_CMD || "python3 ltcai_cli.py --host 127.0.0.1 --port 8765";
+  const command = process.env.LATTICEAI_DESKTOP_BACKEND_CMD || "python3 ltcai_cli.py --host 127.0.0.1 --port 4825";
   const [bin, ...args] = command.split(/\s+/).filter(Boolean);
   if (!bin) return;
   backend = spawn(bin, args, {
     cwd: process.env.LATTICEAI_DESKTOP_BACKEND_CWD || path.resolve(__dirname, "../.."),
-    env: { ...process.env, LATTICEAI_HOST: "127.0.0.1", LATTICEAI_PORT: "8765", LATTICEAI_TUNNEL: "false" },
+    env: { ...process.env, LATTICEAI_HOST: "127.0.0.1", LATTICEAI_PORT: "4825", LATTICEAI_TUNNEL: "false" },
     stdio: "ignore",
   });
 }

package/docs/CHANGELOG.md

@@ -4,9 +4,153 @@ The top entry is either the current unreleased main-branch work or the current
 release line. Older entries are historical and may describe behavior as it
 existed at that release.
 
-## [Unreleased]
+## [9.1.0] - 2026-07-11
 
-No unreleased changes yet.
+### Added
+- Added required Telegram chat/callback allowlisting through
+  `LATTICEAI_TELEGRAM_ALLOWED_CHAT_IDS` and authenticated local API bridging
+  through `LATTICEAI_SERVER_SESSION_TOKEN`.
+- Added signed, expiring invitation authorization, explicit legacy-global graph
+  read opt-in, and fail-closed regression coverage for broken or unknown
+  Knowledge Graph scope.
+- Added optional permission-review deep links through
+  `LATTICEAI_PERMISSION_UI_URL` while keeping approval tokens out of outbound
+  notifications.
+- Added Vitest coverage for API empty/result shapes, Brain proof state,
+  conversation sessions, shared primitives, and i18n, plus visual assertions
+  for unavailable core services.
+- Added continuous vital rings, heartbeat echoes, neural sparks, body motion,
+  and Brain-to-graph particles whose speed and intensity reflect real listening,
+  recall, synthesis, and automation activity. Reduced-motion preferences still
+  disable nonessential animation.
+- Added a living knowledge flow that shows chat, files, folders, notes, and web
+  pages entering the Brain, then renders a lightweight graph from actual
+  Knowledge Graph nodes and edges on the first screen.
+- Added persistent conversation-to-knowledge traces, truthful ingestion
+  emergence counts and provenance, native desktop folder selection, and
+  evidence-linked Brain automation actions.
+- Added a consent-preserving recipe lifecycle: create a reviewable disabled
+  draft, inspect its memory focus and evidence, then explicitly enable it.
+- Added scoped MemoryService recall to workflow agents and researcher-first
+  execution for triggered and review-queue automation runs.
+- Added a visible task-oriented desktop navigation, mobile bottom navigation,
+  accessible secondary menu, skip link, focus trap/restoration, keyboard-driven
+  tabs, and reduced-motion behavior for the React workspace.
+- Added a dedicated human-first experience stylesheet that owns the product
+  shell, conversation canvas, shared content rhythm, responsive behavior, and
+  warm paper/ink/jade visual tokens.
+- Added regression gates for model-request concurrency, workspace/identity
+  authorization, graph ID isolation, command sandbox escapes, SSRF and redirect
+  rebinding, approval ownership, release archive hygiene, browser-extension byte
+  limits/timeouts, OpenAPI drift, and disposable test harness state.
+- Added a checked OpenAPI drift command and browser-extension test command to the
+  normal lint gate.
+
+### Changed
+- Replaced ambient app-factory namespace assembly with typed config, security,
+  Brain, model, and router stages while retaining an explicit compatibility
+  surface.
+- Replaced model-runtime dual globals with injected typed state and split chat
+  contracts, documents, history, and streaming into focused modules.
+- Split Brain feature hooks, translation namespaces, and experience CSS by
+  product surface; frontend version copy now comes from package metadata.
+- Consolidated shallow runtime pass-through modules, timestamps and run-status
+  constants, and moved setup/local-knowledge implementations behind package
+  owned modules with root compatibility shims.
+- Archived code-review documents under `docs/reviews/`, removed obsolete local
+  VSIX artifacts, and documented Electron as an experimental compatibility shell.
+- Compressed the empty Brain home into a single desktop/mobile viewport: the
+  living Brain, real graph, source dock, composer, primary grounded action, and
+  flow status remain visible without page scrolling. Conversation history,
+  deeper proof, and the complete automation action set now open in bounded
+  overlays instead of stacking below the fold.
+- Rebuilt Brain Home around the visible source-to-memory-to-graph-to-automation
+  journey, while keeping the greeting, composer, suggested starts, recent
+  conversations, and optional deeper Brain proof.
+- Renamed and regrouped the primary experience around Chat, Sources, Memory, and
+  Work. Memory now opens with search, basic Work leads with one goal composer,
+  and basic mode hides pipeline, agent-registry, runtime-metric, plugin, and
+  operator tabs until requested.
+- Synced major tab choices to canonical hash routes so refresh, browser history,
+  and bookmarked Sources, Memory, Work, Model, and Settings subviews preserve
+  the user's place.
+- Restyled shared panels, entity lists, empty states, statistics, onboarding,
+  source capture, and active messages to use solid surfaces, whitespace, and
+  separators instead of nested glass cards and dashboard grids.
+- Brain Home now fetches a bounded graph preview so it can show real knowledge
+  relationships immediately; heavier proof and the full graph explorer remain
+  deferred until requested.
+- Model generation, streaming, and document generation now use request-scoped
+  model snapshots without mutating the global selected model.
+- New workspace-scoped graph nodes derive IDs from workspace identity, preventing
+  identical messages/files/concepts in separate workspaces from overwriting or
+  reassigning one another while preserving legacy unscoped reads.
+- Workspace and identity transitions synchronously clear frontend query and
+  conversation state; the client-only egress toggle that claimed server-wide
+  enforcement was removed.
+- Hook/model/network/registry/whole-graph portability and graph-curation operations now use administrator
+  boundaries, and chat/browser/upload/KG writes resolve workspace write access.
+- MCP graph calls now enforce authenticated identity and workspace-scoped reads
+  and writes; local MCP environment values are never returned by the API, and
+  MCP/plugin tool dispatch cannot bypass the dedicated local-file approval flow.
+- Memory, hybrid-search, and garden-note context assembly now use the active
+  workspace instead of blending content from every workspace the user can access.
+- Document-generation RAG, answer traces, trace timeline events, and realtime
+  unscoped events now fail closed at the active workspace boundary.
+- Long-lived realtime streams revalidate the session and workspace membership
+  before replay, every queued event, and each heartbeat, so revocation takes
+  effect without waiting for the SSE connection to reconnect.
+- Realtime presence now validates workspace membership, prevents cross-user
+  client-id takeover/eviction, and assigns authenticated joins to an allowed
+  workspace instead of an unscoped global presence record.
+- Local data directories and atomic JSON/session files now use private POSIX
+  permissions where supported.
+- Docker packaging now uses a small build context, a non-root runtime user, and
+  a healthcheck; personal OpenClaw/bot bridge files are excluded from Git,
+  Docker, and every release archive while remaining available as ignored
+  machine-local files.
+
+### Fixed
+- Closed every actionable item in the July 11 code review across fail-closed
+  security, typed runtime/model/chat ownership, honest frontend failures/tests,
+  and repository hygiene.
+- Telegram now rejects unknown chats before registration; invitation gates no
+  longer trust a static cookie or built-in code, including SSO just-in-time
+  provisioning; and graph projection failures cannot expose cross-workspace
+  nodes.
+- Agent and Computer Use history/run persistence now retains authenticated
+  user and workspace ownership, and recent model context is selected through
+  fail-closed storage scopes before prompt assembly.
+- Desktop, knowledge, Obsidian, and network-status tools now use explicit
+  policy/capability/consent checks. Permission queues use atomic private writes,
+  notifications expose token hints only, and MCP paths are masked.
+- Failed API results no longer become quiet healthy Brain state, proof is not
+  synthesized after failure, and action success callbacks run only on success.
+- Fixed ingestion deltas that compared against truncated display lists instead
+  of complete graph/readiness baselines, and replaced simulated stage timers
+  with post-response memory and graph verification.
+- Fixed global Brain recall pulses being ignored by Brain instances without a
+  local callback, relationship visuals inventing fallback endpoints, and SVG
+  gradient IDs colliding when multiple living Brains appear on one page.
+- Fixed Brain automation hook/agent configuration mismatches, missing scoped
+  recall, trigger runs that skipped agent execution, and review-queue runs that
+  did not execute the workflow's agent node.
+- Fixed local-folder graph nodes and Brain events trusting unvalidated or absent
+  workspace scope, losing scope on watcher restart, appearing in another
+  workspace's graph/search, or waking another workspace/owner's recipe. Legacy
+  personal nodes are reprojected without changing their IDs.
+- Fixed recipe activation replacing reviewed user edits with the starter
+  definition, and stopped empty web captures from being presented as newly
+  remembered knowledge.
+- Blocked permission request self-approval, stale disabled/deleted-account
+  sessions, agent approval forgery and cross-user resume, body identity spoofing,
+  command traversal/symlink/interpreter escapes, and authenticated scope lookup
+  fail-open behavior.
+- Hardened URL ingestion against localhost/private/link-local/multicast/reserved
+  targets, mixed DNS answers, redirect-to-metadata attacks, environment proxies,
+  binary payloads, and unbounded response buffering.
+- Isolated integration and OpenAPI generation from real `~/.ltcai` state and
+  made missing required npm tarballs a release-validation failure.
 
 ## [9.0.0] - 2026-07-08
 

package/docs/COMMUNITY_AND_PLUGINS.md

@@ -1,11 +1,12 @@
 # Community And Plugins
 
-Current release: **9.0.0 — Code Review Closure & Runtime Cleanup**.
+Current release: **9.1.0 — Code Review Completion & Fail-Closed Runtime**.
 
 LatticeAI defines the path from a strong local-first framework (8.4.0
 action-aware baseline, 8.5.0 registry+DI hardening, 8.6.0 capture/navigation
 reliability, 8.7.0 runtime-state hygiene, 8.8.0 Brain Core extraction
-readiness, 8.9.0 scoped Tool API hardening, and 9.0.0 cleanup closure) to a product ecosystem. The
+readiness, 8.9.0 scoped Tool API hardening, 9.0.0 cleanup closure, and 9.1.0
+fail-closed review completion) to a product ecosystem. The
 immediate goal is small and practical: make it clear how
 contributors can extend the Brain without weakening local-first trust,
 workspace scoping, or release quality.

package/docs/DEVELOPMENT.md

@@ -1,10 +1,10 @@
 # Lattice AI Development
 
-Current release: **9.0.0 — Code Review Closure & Runtime Cleanup**.
+Current release: **9.1.0 — Code Review Completion & Fail-Closed Runtime**.
 
 This document is for contributors working on the local-first Digital Brain
 codebase. Product positioning and quick start stay in `README.md`; release
-history is intentionally limited to 8.0.0-9.0.0 in `docs/CHANGELOG.md` and
+history is intentionally limited to 8.0.0-9.1.0 in `docs/CHANGELOG.md` and
 `RELEASE.md`.
 
 ## Product Contract
@@ -51,12 +51,14 @@ API, UI, or release work, run:
 npm run check:python
 npm run lint
 npm run typecheck
+npm run test:frontend
 npm run test:unit
 npm run docs:check-links
 ```
 
 `npm run lint` runs the Python Ruff baseline, frontend TypeScript lint gate,
-visual smoke syntax checks, and i18n literal checks.
+visual smoke syntax checks, an exact generated-OpenAPI drift check, i18n literal
+checks, and browser-extension syntax/behavior tests.
 
 Use these when the change touches the relevant surface:
 
@@ -64,10 +66,42 @@ Use these when the change touches the relevant surface:
 npm run test:integration
 npm run test:visual
 npm run desktop:tauri:check
+npm run release:evidence
 npm run release:artifacts
 npm run release:validate
 ```
 
+Run `npm run build:assets` before `npm run release:evidence`. The capture command
+reads the current package version, writes only to `output/release/vX.Y.Z/`, and
+requires Playwright Chromium plus `ffmpeg` for the checked-in GIF/WebM evidence.
+
+`npm run test:integration` starts its own loopback server with disposable HOME,
+data, Brain, agent, XDG, temp, SQLite, and vault paths. It refuses non-loopback
+external base URLs so validation cannot mutate a developer's real local Brain.
+
+Regenerate committed API artifacts with `npm run frontend:openapi`; CI and
+`npm run lint` fail when either `frontend/openapi.json` or
+`frontend/src/api/openapi.ts` differs from a fresh isolated export.
+
+## Frontend Experience Ownership
+
+`frontend/src/styles/tokens.css` owns React color tokens and
+`frontend/src/styles/experience.css` imports the focused shell, conversation,
+graph, capture, and responsive layers under `frontend/src/styles/experience/`.
+Keep ownership in the narrowest surface file; do not add another competing
+shell or composer rule to `styles.css`.
+
+Brain behavior belongs in the focused `useBrainChat`, `useBrainHistory`,
+`useBrainIngestion`, and `useBrainProof` hooks. Translation namespaces live in
+`frontend/src/i18n/`. Failed `ApiResult` values must remain unavailable/error
+states rather than being normalized to healthy empty data, and affected paths
+must have Vitest coverage.
+
+Default mode should expose user tasks and outcomes. Runtime metrics, registry
+identifiers, pipeline controls, and administrator tools belong in progressive
+disclosure or advanced/admin mode. New navigation and tabs must preserve
+keyboard access, visible focus, mobile safe areas, and reduced-motion behavior.
+
 ## Runtime Assembly
 
 `latticeai.app_factory` is the composition root. Keep it import-safe:
@@ -77,13 +111,18 @@ npm run release:validate
 - no filesystem writes at module import time;
 - no external network calls at module import time.
 
-Runtime assembly seams live under `latticeai.runtime`:
+Runtime assembly seams live under `latticeai.runtime` as typed stages:
 
-- `config_runtime.py` derives app config values from `Config`;
+- `config_runtime.py` derives immutable app config values from `Config`;
 - `security_runtime.py` applies trusted proxy/security-derived settings;
-- `brain_runtime.py` constructs Brain Core and conversation primitives.
-- model/runtime, ToolRegistry/MCP, router, static asset, and lifespan seams
-  should continue moving out of monolithic app-factory helpers.
+- `brain_runtime.py` constructs Brain Core and conversation primitives;
+- model, platform, and router stages receive explicit dependencies and return
+  typed bundles rather than ambient `locals()` maps.
+
+The module-level `server_app` compatibility surface is an explicit allowlist.
+Model services use injected state, and HTTP exceptions belong at the API
+boundary. Readiness tests should reject forbidden patterns instead of treating
+symbol presence alone as architectural completion.
 
 Future extraction should continue with AgentRuntime, ToolRegistry, config,
 server decomposition, and Knowledge Graph stabilization in that order when
@@ -114,10 +153,10 @@ For user-facing, API, runtime, release, or packaging changes, check:
 Release/publish examples must use exact target-version filenames. Do not
 document wildcard artifact upload commands.
 
-For 9.0.0 release work, exact artifacts are:
+For 9.1.0 release work, exact artifacts are:
 
-- `dist/ltcai-9.0.0-py3-none-any.whl`
-- `dist/ltcai-9.0.0.tar.gz`
-- `ltcai-9.0.0.tgz`
-- `dist/ltcai-9.0.0.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_9.0.0_aarch64.dmg`
+- `dist/ltcai-9.1.0-py3-none-any.whl`
+- `dist/ltcai-9.1.0.tar.gz`
+- `ltcai-9.1.0.tgz`
+- `dist/ltcai-9.1.0.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_9.1.0_aarch64.dmg`

package/docs/LEGACY_COMPATIBILITY.md

@@ -1,6 +1,6 @@
 # Legacy Compatibility Map
 
-Current target: **9.0.0 — Code Review Closure & Runtime Cleanup**.
+Current target: **9.1.0 — Code Review Completion & Fail-Closed Runtime**.
 
 Lattice AI is moving toward a smaller, modular architecture centered on
 `lattice_brain`, `latticeai.services`, `latticeai.api`, and `latticeai.runtime`.
@@ -56,14 +56,14 @@ standalone package:
 | `knowledge_graph.py` | `lattice_brain.graph` / `lattice_brain.knowledge` | Compatibility for older graph imports and historical tooling |
 | `knowledge_graph_api.py` | `latticeai.api.memory`, `latticeai.api.search`, graph-related API routers | Compatibility for older API import paths |
 | `kg_schema.py` | `lattice_brain` storage/schema modules | Compatibility for graph schema references |
-| `auto_setup.py` | setup/model recommendation services | Compatibility for zero-config setup probes and historical auto-setup commands |
+| `auto_setup.py` | `latticeai.setup.auto_setup` | Thin compatibility shim for zero-config setup probes and historical commands |
 | `llm_router.py` | `latticeai.models.router` | Compatibility for older local model routing imports |
 | `ltcai_cli.py` | package console entrypoint (`ltcai`) | Compatibility for the installed CLI contract |
 | `mcp_registry.py` | `latticeai.core.mcp_registry` and service-backed registries | Compatibility for MCP/skills lookup entrypoints |
-| `local_knowledge_api.py` | `lattice_brain.ingestion`, workspace capture APIs | Compatibility for local folder/file watcher flows |
+| `local_knowledge_api.py` | `latticeai.services.local_knowledge` | Thin compatibility shim for local folder/file watcher flows |
 | `p_reinforce.py` | gardener/maintenance service direction | Compatibility for existing Brain gardening runtime hooks |
 | `telegram_bot.py` | opt-in integration package or disabled-by-default connector | Compatibility only; Telegram must remain opt-in |
-| `setup_wizard.py` | setup and model recommendation services | Compatibility for first-run recommendation calls |
+| `setup_wizard.py` | `latticeai.setup.wizard` | Thin compatibility shim for first-run recommendation calls |
 | `server.py` | lazy proxy to `latticeai.server_app` / `latticeai.app_factory` | Preserves historical `server.app` imports without import-time construction |
 
 ## Inner Shim Layers (removed in 8.8.0)

package/docs/ONBOARDING.md

@@ -1,6 +1,6 @@
 # Lattice AI Onboarding
 
-Current release: **9.0.0 — Code Review Closure & Runtime Cleanup**.
+Current release: **9.1.0 — Code Review Completion & Fail-Closed Runtime**.
 
 The first-run goal is a five-minute path from "I opened the app" to "my Brain
 has a source, a question, and proof." This page is the product contract behind
@@ -21,8 +21,16 @@ read the docs first.
 ## Product Promises
 
 - The user starts in the Brain, not in an admin dashboard.
+- The first screen asks what the user wants to do, then prioritizes one composer,
+  a few starters, and recent conversations over scores or system status.
+- Chat, Sources, Memory, and Work stay one visible navigation action away on
+  desktop and mobile; models and administration do not compete with them.
+- Memory starts with search. The connection map appears only when the user asks
+  to inspect relationships.
 - Empty states suggest one concrete next action without claiming proof that does
   not exist yet.
+- Core-service failures show an unavailable/error state and recovery guidance;
+  they are never presented as an empty or healthy Brain.
 - Upload, note, browser, and message ingestion all converge through the unified
   ingestion pipeline when it is available.
 - Workspace-scoped content must not leak or overwrite another workspace's graph
@@ -32,7 +40,7 @@ read the docs first.
 
 ## Release Gate
 
-9.0.0 treats onboarding as a release gate, not marketing copy. The current
+9.1.0 treats onboarding as a release gate, not marketing copy. The current
 machine-checkable product readiness report requires this five-minute contract,
 the Brain Home surface, setup helpers, graph ingestion tests, and exact release
 artifact documentation before the release can be called complete.

package/docs/OPERATIONS.md

@@ -1,10 +1,10 @@
-# Lattice AI — Operations Guide
+# Lattice AI — Operations Guide (v9.1.0)
 
 ## 1. 데이터 파일 위치
 
 | 파일 | 용도 |
 |------|------|
-| `~/.ltcai/users.json` | 사용자 계정 (bcrypt 해시 저장) |
+| `~/.ltcai/users.json` | 사용자 계정 (scrypt 해시 저장) |
 | `~/.ltcai/history.json` | 대화 히스토리 |
 | `~/.ltcai/audit.json` | 감사 로그 (agent 실행, 사용자 변경 등) |
 | `~/.ltcai/brain/` | Knowledge Graph 노드 (Markdown) |
@@ -95,7 +95,7 @@ Cookie: session_id=<admin-session>
 
 ### 5.3 비밀번호 정책
 - 최소 8자
-- bcrypt (cost 12) 해시로 저장
+- scrypt 해시로 저장
 - 평문은 저장되지 않음
 
 ## 6. 업그레이드 마이그레이션
@@ -120,11 +120,15 @@ pip install --upgrade ltcai
 공개 인터넷에 노출할 경우 반드시 확인:
 
 - [ ] `LATTICEAI_SECRET_KEY` 환경변수 설정 (32자 이상 랜덤 문자열)
+- [ ] `LATTICEAI_MODE=public` 및 HTTPS에서 Secure cookie 동작 확인
+- [ ] 초대 게이트 사용 시 랜덤 invite code 또는 생성된 설치별 secret 영구 보관
 - [ ] `LATTICEAI_ENABLE_GRAPH=false` (불필요 시 Graph 비활성화)
 - [ ] `HTTPS` 종단 프록시 설정 (nginx / Caddy)
 - [ ] `CSRF_TRUSTED_ORIGINS` 화이트리스트 설정
 - [ ] `ALLOWED_COMMANDS` 검토 — python3/node 등 불필요한 실행 도구 제거
-- [ ] 방화벽으로 8899 포트를 프록시만 접근 허용
+- [ ] 방화벽으로 4825 포트를 프록시만 접근 허용
+- [ ] Telegram 활성화 시 `LATTICEAI_TELEGRAM_ALLOWED_CHAT_IDS`와
+  `LATTICEAI_SERVER_SESSION_TOKEN` 설정
 
 ## 8. 사용자 데이터 격리
 

package/docs/PRODUCT_DIRECTION_REVIEW.md

@@ -21,6 +21,10 @@ Already aligned:
 - First launch follows Login -> Environment Analysis -> Recommended Models ->
   Install & Load -> Brain.
 - The post-setup home is the living Brain plus conversation.
+- The empty home presents the Brain, incoming sources, real relationship graph,
+  composer, and next grounded action in one viewport. Its life signal and motion
+  are driven by listening, recall, synthesis, and action state rather than being
+  a decorative loop; history and technical proof remain progressively disclosed.
 - The graph appears only after progressive depth: Brain -> Memories ->
   Knowledge -> Relationships -> Graph.
 - Brain Core, SQLite live local storage, optional PostgreSQL/pgvector

package/docs/TRUST_MODEL.md

@@ -1,6 +1,6 @@
 # Lattice AI Trust Model
 
-Current release: **9.0.0 — Code Review Closure & Runtime Cleanup**.
+Current release: **9.1.0 — Code Review Completion & Fail-Closed Runtime**.
 
 Lattice AI is local-first, explicit about external communication, and honest
 when a capability is unavailable.
@@ -26,7 +26,8 @@ External communication requires configuration plus a user/admin action:
 
 - cloud model calls after keys are configured and a cloud model is selected;
 - model downloads from registries after install consent;
-- Telegram bridge after the integration is enabled;
+- Telegram bridge after the integration is enabled, the chat is allowlisted,
+  and a dedicated server session bearer is configured;
 - Brain Network peer actions after pairing;
 - Docker/Postgres setup after opt-in scale configuration;
 - update checks only when enabled;
@@ -49,6 +50,8 @@ Lattice AI should fail closed or show an unavailable state for:
 - dry-run versus real execution;
 - no graph/context evidence available;
 - unavailable external integration;
+- unknown or unreadable Knowledge Graph workspace scope;
+- missing Telegram chat allowlist or dedicated server session token;
 - wrong archive passphrase;
 - archive tampering, unsupported archive versions, or path traversal.
 

package/docs/WHY_LATTICE.md

@@ -1,6 +1,6 @@
 # Why Lattice AI Exists
 
-Current release: **9.0.0 — Code Review Closure & Runtime Cleanup**.
+Current release: **9.1.0 — Code Review Completion & Fail-Closed Runtime**.
 
 **Lattice AI is a local-first Digital Brain that keeps your knowledge durable
 across any AI model.**
@@ -28,15 +28,20 @@ Lattice AI keeps conversations, documents, memories, decisions, relationships,
 and source provenance in a private local Brain. Models can be local, cloud,
 current, or future. The Brain remains.
 
-The graph matters, but it is not the product identity. The product identity is a
-local-first Digital Brain: a place where the user can talk, add sources, watch
-memory grow, and inspect the Knowledge Graph when they need proof.
-
-In 9.0.0 the first screen is intentionally not a dashboard. The living Brain,
-conversation composer, evidence-backed Brain Brief, scoped memory isolation,
-and five-minute onboarding
-path appear together so the user immediately knows what matters, what to add,
-and why the answer is grounded in local memory.
+The graph matters as visible proof, but a graph editor is not the product
+identity. The product identity is a local-first Digital Brain: the user talks or
+adds a source, watches it enter memory, sees the real relationships that emerge,
+and uses those memories to drive reviewed automation.
+
+The current main-branch experience is intentionally not a dashboard. The first
+screen leads with a living knowledge journey around the conversation composer:
+chat, file, folder, note, and web inputs flow into the Brain; a bounded real
+graph makes new connections visible; and grounded next actions explain which
+memory and evidence they use. Evidence-backed Brain Brief, deeper memory rings,
+and runtime detail remain available without turning the first screen into an
+operator console. Primary navigation follows human tasks — Chat, Sources,
+Memory, and Work — while models, workspace controls, and administration stay
+secondary.
 
 ## Practical Reasons To Use It
 

package/docs/WORKFLOW_DESIGNER.md

@@ -20,6 +20,28 @@ The engine version is exported as:
 WORKFLOW_ENGINE_VERSION = "2.2.0"
 ```
 
+## Memory-grounded Brain automation
+
+Brain Home turns recalled knowledge into suggested actions and automation
+recipes without silently enabling work. A recipe is first installed as a
+disabled, reviewable workflow draft. The user can inspect its memory focus,
+source, evidence, and agent roles, then explicitly enable the same workflow in
+place; activation does not create a duplicate recipe or replace the user's
+reviewed name, prompt, roles, or node edits.
+
+When an enabled recipe receives a successful workspace-scoped Brain ingestion
+event, the workflow runs a researcher-first agent chain:
+
+```text
+Brain event -> researcher recall -> planner -> executor -> reviewer -> review queue
+```
+
+The researcher receives scoped `MemoryService.recall` context. Trigger identity,
+workspace, source provenance, and run ID remain attached through execution and
+review. Chat, upload, local-folder, note, web, and compatible legacy ingestion
+events are normalized; failed ingestion never triggers a recipe. Generated work
+is staged for review rather than performing an unreviewed external action.
+
 ## v2.2 hardening
 
 - Agent node output is captured in workflow context and can flow into a later

package/docs/kg-schema.md

@@ -1,6 +1,6 @@
 # Knowledge Graph Schema
 
-Current release: **9.0.0 — Code Review Closure & Runtime Cleanup**.
+Current release: **9.1.0 — Code Review Completion & Fail-Closed Runtime**.
 
 명세 출처: `lattice_ai_full_spec.pptx` 슬라이드 20·21·22
 구현: `kg_schema.py`
@@ -137,6 +137,10 @@ provenance(source_type, source_uri, content_hash, captured_at, modified_at,
 - 모든 콘텐츠 노드는 `SOURCE` 노드로 `INDEXED_FROM` 엣지를 가져 **출처를 항상 설명 가능**하다.
 - provenance 는 노드 `metadata.provenance` 에 임베드되며, 동시에 감사 가능한
   `ingestion_provenance` 테이블에 기록된다 (`KnowledgeGraphStore.get_provenance(node_id)`).
+- 로컬 폴더 수집은 Computer/Drive/Folder/File/Chunk/Concept/semantic 노드 전체에
+  동일한 `workspace_id`를 투영하고 신규 ID도 워크스페이스별로 분리한다. 기존
+  범위 없는 로컬 폴더는 개인 Brain으로 재투영하되 기존 노드 ID는 보존하며,
+  같은 폴더를 다른 워크스페이스로 조용히 재할당하지 않는다.
 
 구현: `lattice_brain/ingestion.py` (`IngestionPipeline`) 가 단일 진입점이며,
 파일/로컬폴더/URL/브라우저 탭/텍스트를 모두 이 형태로 정규화한다.
@@ -257,9 +261,16 @@ print(KGStoreV2(store.db_path).stats())
 
 ### v4 컬럼 (T3b/T3c)
 
-- `nodes_v2.workspace_id` — `NULL` = legacy-global (스코프 도입 이전 데이터)
+- `nodes_v2.workspace_id` — `NULL` = legacy-global (스코프 도입 이전 데이터).
+  9.1.0부터 일반 workspace 읽기에는 자동 포함하지 않으며
+  `include_legacy_global=True`를 명시한 호환 읽기에서만 포함
 - `nodes_v2.visibility` — 신규 스코프 쓰기는 `workspace`/`private`,
   스코프 없는 쓰기는 `legacy` (기존 공유 데이터를 몰래 private 으로
   만들지 않는다)
 - `nodes_v2.superseded_by` — 개정 체인 (`mark_superseded`)
 - `edge_occurrences` — 관계의 모든 관측 기록 (observed_at/weight/source)
+
+workspace projection 조회가 실패하거나 node의 scope를 확인할 수 없으면 해당
+node는 비공개로 취급해 빈 결과를 반환하거나 오류를 전파합니다. projection 장애를
+legacy-global로 해석해 다른 workspace에 노출하는 fail-open 경로는 허용하지
+않습니다.

package/docs/mcp-tools.md

@@ -1,4 +1,4 @@
-# MCP 도구 카탈로그
+# MCP 도구 카탈로그 (v9.1.0)
 
 Lattice AI는 MCP(Model Context Protocol) 서버로 동작하여 Claude Desktop, Cursor 등에서 직접 도구를 사용할 수 있습니다.
 
@@ -31,7 +31,7 @@ Lattice AI는 MCP(Model Context Protocol) 서버로 동작하여 Claude Desktop,
 
 | 도구 | 설명 | 위험도 |
 |------|------|--------|
-| `run_command` | 셸 명령 실행 (위험 패턴 차단) | 높음 |
+| `run_command` | shell 없이 고정 read-only 명령 allowlist 실행 | 높음 |
 | `run_terminal_command` | 터미널 명령 (별칭) | 높음 |
 
 ### 작업 관리
@@ -45,10 +45,11 @@ Lattice AI는 MCP(Model Context Protocol) 서버로 동작하여 Claude Desktop,
 
 | 도구 | 설명 | 위험도 |
 |------|------|--------|
-| `computer_screenshot` | 화면 캡처 | 낮음 |
+| `computer_screenshot` | 화면 캡처 (desktop-control capability 및 정책 승인 필요) | 높음 |
+| `computer_status` | 데스크톱 제어 상태 조회 (동일 capability/policy 적용) | 중간 |
 | `computer_open_app` | 앱 실행 | 중간 |
 | `computer_open_url` | URL 열기 | 낮음 |
-| `network_status` | IP, Wi-Fi 정보 | 낮음 |
+| `network_status` | IP, Wi-Fi 정보 (인증 및 ToolRegistry 정책 적용) | 중간 |
 
 ### 문서
 
@@ -91,13 +92,18 @@ curl -b "session=<token>" \
 curl -b "session=<token>" -X POST \
   http://localhost:4825/tools/run_command \
   -H "Content-Type: application/json" \
-  -d '{"command": "python -m pytest tests/ -v"}'
+  -d '{"command": "rg TODO ."}'
 ```
 
+`run_command`는 `pwd`, `ls`, `find`, `cat`, `head`, `tail`, `wc`, `rg`만 허용합니다.
+Python/Node/npm/npx/sed, shell operator, 실행 파일 경로, 절대 경로, `..` traversal,
+workspace 밖 symlink, `rg --pre`, `find -exec/-delete`는 거부됩니다. 빌드와 테스트는
+별도의 허용된 project-script 도구를 사용합니다.
+
 ## 도구 카탈로그 조회
 
 ```bash
-curl http://localhost:4825/mcp/tools
+curl -b "session=<token>" http://localhost:4825/mcp/tools
 ```
 
 응답:
@@ -114,3 +120,8 @@ curl http://localhost:4825/mcp/tools
   ]
 }
 ```
+
+도구 카탈로그는 인증이 필요하며 서버의 절대 `AGENT_ROOT`를 반환하지 않습니다.
+MCP/plugin dispatch도 각 도구의 사용자·workspace·capability·승인 정책을 우회할
+수 없습니다. knowledge/Obsidian 계열 읽기는 명시적 사용자 동의와 scope를
+사용합니다.