ltcai 9.0.0 → 9.1.0

package/lattice_brain/portability.py

@@ -19,7 +19,6 @@ import shutil
 import sqlite3
 import tempfile
 import zipfile
-from datetime import datetime, timezone
 from pathlib import Path, PurePosixPath
 from typing import Any, Dict, Optional
 
@@ -30,18 +29,15 @@ from .storage import (
     SQLiteToPostgresMigrator,
 )
 from .utils import sha256_file as _sha256_file
+from .utils import utc_now_iso
 
 FORMAT = "latticeai.kg.export"
 FORMAT_VERSION = 1
 BACKUP_FORMAT = "latticeai.kg.backup"
 
 
-def _now_iso() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
 def _stamp() -> str:
-    return _now_iso().replace(":", "").replace("-", "").replace(".", "")[:15]
+    return utc_now_iso().replace(":", "").replace("-", "").replace(".", "")[:15]
 
 
 def _safe_zip_names(names) -> None:
@@ -160,15 +156,24 @@ class KGPortabilityService:
             raise RuntimeError("Knowledge Graph is disabled (LATTICEAI_ENABLE_GRAPH).")
 
     # ── logical export / import ──────────────────────────────────────────────
-    def export(self, *, workspace_id: Optional[str] = None) -> Dict[str, Any]:
+    def export(
+        self,
+        *,
+        workspace_id: Optional[str] = None,
+        include_legacy_global: bool = False,
+    ) -> Dict[str, Any]:
         self._require()
-        data = self._kg.export_graph_data(workspace_id=workspace_id)
+        data = self._kg.export_graph_data(
+            workspace_id=workspace_id,
+            include_legacy_global=include_legacy_global,
+        )
         header = {
             "format": FORMAT,
             "format_version": FORMAT_VERSION,
             **self._kg.schema_versions(),
-            "exported_at": _now_iso(),
+            "exported_at": utc_now_iso(),
             "workspace_id": workspace_id,
+            "include_legacy_global": bool(include_legacy_global),
             "counts": data.get("counts"),
         }
         artifact = {"header": header, **data}
@@ -176,8 +181,17 @@ class KGPortabilityService:
             artifact["signature"] = self._identity.sign_manifest(header)
         return artifact
 
-    def export_to_file(self, path=None, *, workspace_id: Optional[str] = None) -> Dict[str, Any]:
-        artifact = self.export(workspace_id=workspace_id)
+    def export_to_file(
+        self,
+        path=None,
+        *,
+        workspace_id: Optional[str] = None,
+        include_legacy_global: bool = False,
+    ) -> Dict[str, Any]:
+        artifact = self.export(
+            workspace_id=workspace_id,
+            include_legacy_global=include_legacy_global,
+        )
         self._exports_dir.mkdir(parents=True, exist_ok=True)
         path = Path(path) if path else self._exports_dir / f"kg-export-{_stamp()}.json"
         path.write_text(json.dumps(artifact, ensure_ascii=False, indent=2), encoding="utf-8")
@@ -204,7 +218,7 @@ class KGPortabilityService:
         if not dry_run:
             try:
                 self._kg.record_provenance(
-                    node_id="import:" + str((artifact.get("header") or {}).get("exported_at") or _now_iso()),
+                    node_id="import:" + str((artifact.get("header") or {}).get("exported_at") or utc_now_iso()),
                     source_type="bundle_import",
                     pipeline="kg-portability",
                     owner=None,
@@ -232,7 +246,7 @@ class KGPortabilityService:
                 "format": BACKUP_FORMAT,
                 "format_version": FORMAT_VERSION,
                 **self._kg.schema_versions(),
-                "created_at": _now_iso(),
+                "created_at": utc_now_iso(),
                 "db_sha256": _sha256_file(db_copy),
                 "has_blobs": Path(self._kg.blob_dir).exists(),
             }
@@ -333,7 +347,7 @@ class KGPortabilityService:
             "storage": self.storage_status().get("active", {}),
             "snapshot": self.snapshot_metadata(),
             "device_identity": self._identity.describe() if self._identity is not None else {},
-            "provenance": {"exported_at": _now_iso(), "source": "kg-portability"},
+            "provenance": {"exported_at": utc_now_iso(), "source": "kg-portability"},
         }
         archive = EncryptedBrainArchive(
             BrainArchivePaths(

package/lattice_brain/runtime/agent_runtime.py

@@ -28,7 +28,6 @@ it, the frontend) now depends on this boundary instead of internal paths.
 
 from __future__ import annotations
 
-from datetime import datetime
 from typing import Any, Callable, Dict, List, Optional
 
 from .multi_agent import (
@@ -45,6 +44,11 @@ from .contracts import (
     run_record_contract,
     runtime_boundary_contract,
 )
+from .statuses import (
+    RUN_ACTIVE_STATUSES as _ACTIVE_STATUSES,
+    RUN_TERMINAL_STATUSES as _TERMINAL_STATUSES,
+)
+from ..utils import now_iso as _now
 
 ROLE_DESCRIPTIONS = {
     "researcher": "Gathers workspace context and memory for the goal.",
@@ -57,14 +61,6 @@ ROLE_DESCRIPTIONS = {
 # Run statuses the orchestrator can emit that mean "still working". The default
 # orchestrator runs synchronously, so persisted runs are always terminal; this
 # set lets the runtime report live work if a future async runner lands.
-_ACTIVE_STATUSES = {"running", "in_progress", "queued", "retrying", "cancelling"}
-_TERMINAL_STATUSES = {"ok", "retried_ok", "failed", "rejected", "cancelled", "interrupted", "partial"}
-
-
-def _now() -> str:
-    return datetime.now().isoformat(timespec="seconds")
-
-
 def _compact_text(value: Any, *, limit: int) -> str:
     return " ".join(str(value or "").split())[:limit]
 

package/lattice_brain/runtime/hooks.py

@@ -25,6 +25,7 @@ order.
 from __future__ import annotations
 
 import json
+import logging
 import os
 import shlex
 import subprocess
@@ -32,10 +33,14 @@ import tempfile
 import threading
 import time
 from collections import deque
-from datetime import datetime
 from pathlib import Path
 from typing import Any, Callable, Dict, List, Optional
 
+from ..utils import now_iso as _now
+
+
+LOGGER = logging.getLogger(__name__)
+
 
 HOOK_KINDS = (
     "pre_run",
@@ -63,10 +68,6 @@ LEGACY_KIND_ALIASES = {
 HOOK_STATUSES = ("ok", "blocked", "error", "skipped", "advisory")
 
 
-def _now() -> str:
-    return datetime.now().isoformat(timespec="seconds")
-
-
 class HookContext:
     """Mutable execution context handed to every hook in a dispatch.
 
@@ -213,7 +214,8 @@ def dispatch_tool(
         return run_fn()
     try:
         arg_keys = list(args.keys()) if isinstance(args, dict) else []
-    except Exception:
+    except Exception as exc:
+        LOGGER.debug("tool argument metadata could not be inspected: %s", exc)
         arg_keys = []
     pre = hooks.fire_hook(
         "pre_tool", f"tool.{tool_name}",
@@ -341,8 +343,8 @@ class HooksRegistry:
                     data.setdefault("custom", [])
                     data.setdefault("overrides", {})
                     return data
-            except Exception:
-                pass
+            except (OSError, json.JSONDecodeError, TypeError, ValueError) as exc:
+                LOGGER.warning("hook registry state is unreadable at %s: %s", self._path, exc)
         return {"custom": [], "overrides": {}}
 
     def _save(self) -> None:
@@ -626,6 +628,7 @@ class HooksRegistry:
                 user_email=user_email, workspace_id=workspace_id, metadata=metadata,
             )
         except Exception as exc:  # pragma: no cover - defensive
+            LOGGER.exception("hook dispatch failed before execution: %s", kind)
             return {"kind": kind, "event": event or kind, "ran": 0, "blocked": False,
                     "block_reason": "", "error": str(exc), "results": [], "generated_at": _now()}
 
@@ -694,7 +697,21 @@ class HooksRegistry:
         if not argv:
             return "skipped", "empty command", "", False
         ctx_json = json.dumps(context.as_dict(), ensure_ascii=False)
-        env = dict(os.environ)
+        # Command hooks run with an intentionally small environment. In
+        # particular, provider keys, database credentials, session secrets,
+        # and arbitrary PYTHON*/NODE* injection variables from the server
+        # process must never be inherited by a child process. The retained
+        # entries are the minimum needed for executable lookup, home-relative
+        # tools, locale handling, temporary files, and Windows process startup.
+        allowed_env_keys = {
+            "PATH", "HOME", "LANG", "LC_ALL", "LC_CTYPE",
+            "TMPDIR", "TMP", "TEMP", "SYSTEMROOT", "WINDIR", "PATHEXT",
+        }
+        env = {
+            key: value
+            for key, value in os.environ.items()
+            if key.upper() in allowed_env_keys
+        }
         env.update({
             "LATTICE_HOOK_KIND": context.kind,
             "LATTICE_HOOK_EVENT": context.event,
@@ -726,8 +743,8 @@ class HooksRegistry:
                     data = json.load(fh)
                 if isinstance(data, list):
                     return data
-        except Exception:
-            pass
+        except (OSError, json.JSONDecodeError, TypeError, ValueError) as exc:
+            LOGGER.warning("hook run history is unreadable at %s: %s", self._runs_path, exc)
         return []
 
     def _save_runs(self) -> None:
@@ -737,8 +754,8 @@ class HooksRegistry:
             with os.fdopen(fd, "w", encoding="utf-8") as fh:
                 json.dump(list(self._runs), fh, ensure_ascii=False, indent=2)
             os.replace(tmp, self._runs_path)
-        except Exception:  # pragma: no cover - the run log is best-effort
-            pass
+        except OSError as exc:  # pragma: no cover - the run log is best-effort
+            LOGGER.warning("hook run history write failed at %s: %s", self._runs_path, exc)
 
     def _record_run(self, result: HookResult, context: HookContext) -> None:
         entry = result.as_dict()

package/lattice_brain/runtime/multi_agent.py

@@ -15,13 +15,13 @@ installations can exercise the full Planner -> Executor -> Reviewer loop.
 from __future__ import annotations
 
 from dataclasses import dataclass, field
-from datetime import datetime
 from typing import Any, Callable, Dict, List, Optional
 
 from .contracts import multi_agent_contract
+from ..utils import now_iso as _now
 
 
-MULTI_AGENT_VERSION = "9.0.0"
+MULTI_AGENT_VERSION = "9.1.0"
 
 AGENT_ROLES = ("researcher", "planner", "executor", "reviewer", "release")
 CORE_PIPELINE = ("planner", "executor", "reviewer")
@@ -50,10 +50,6 @@ REVIEW_OUTCOMES = ("approve", "reject", "retry")
 _SECRET_KEYS = ("secret", "token", "password", "api_key", "apikey", "credential")
 
 
-def _now() -> str:
-    return datetime.now().isoformat(timespec="seconds")
-
-
 def _redact(value: Any) -> Any:
     """Return a JSON-safe value with obvious secret fields redacted."""
     if isinstance(value, dict):
@@ -668,7 +664,7 @@ class MultiAgentOrchestrator:
             result = self.role_runner(role, ctx) or {}
             status = result.get("status", "ok")
         except Exception as exc:
-            result = {"error": str(exc)}
+            result = {"status": "error", "error": str(exc)}
             status = "error"
         if role == "reviewer":
             review = dict(ctx.review or result)
@@ -739,9 +735,32 @@ class MultiAgentOrchestrator:
             role = pipeline[index]
             if previous is not None:
                 ctx.handoff(previous, role)
-            self._run_role(role, ctx)
+            role_result = self._run_role(role, ctx)
             roles_run.append(role)
 
+            # A role exception is terminal for this attempt. Continuing would
+            # let downstream roles review stale or missing output and could
+            # incorrectly convert a failed run into an approved one.
+            if str(role_result.get("status") or "").lower() == "error":
+                reason = str(role_result.get("error") or f"{role} role failed")
+                existing_review = dict(ctx.review or {})
+                ctx.review = existing_review or {
+                    "outcome": "reject",
+                    "verdict": "fail",
+                    "reason": reason,
+                    "notes": [f"{role} did not complete"],
+                    "reviewed_at": _now(),
+                }
+                ctx.timeline.append(
+                    {
+                        "event": "execution_failed",
+                        "role": role,
+                        "reason": reason,
+                        "timestamp": _now(),
+                    }
+                )
+                break
+
             if role == "reviewer":
                 review = dict(ctx.review or {})
                 outcome = _review_outcome(review)

package/lattice_brain/runtime/statuses.py

@@ -0,0 +1,10 @@
+"""Canonical lifecycle states shared by persisted agent and workflow runs."""
+
+RUN_ACTIVE_STATUSES = frozenset(
+    {"queued", "running", "in_progress", "retrying", "cancelling"}
+)
+RUN_TERMINAL_STATUSES = frozenset(
+    {"ok", "retried_ok", "failed", "rejected", "cancelled", "interrupted", "partial"}
+)
+
+__all__ = ["RUN_ACTIVE_STATUSES", "RUN_TERMINAL_STATUSES"]

package/lattice_brain/utils.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import hashlib
-from datetime import datetime
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import Optional
 
@@ -17,6 +17,24 @@ def parse_iso(value: Optional[str]) -> Optional[datetime]:
         return None
 
 
+def local_now() -> datetime:
+    """Return local wall-clock time for legacy local persistence formats."""
+
+    return datetime.now()
+
+
+def now_iso(*, timespec: str = "seconds") -> str:
+    """Return one consistently formatted local timestamp."""
+
+    return local_now().isoformat(timespec=timespec)
+
+
+def utc_now_iso(*, timespec: str = "auto") -> str:
+    """Return an offset-aware UTC timestamp."""
+
+    return datetime.now(timezone.utc).isoformat(timespec=timespec)
+
+
 def sha256_file(path: Path) -> str:
     digest = hashlib.sha256()
     with open(path, "rb") as fh:
@@ -25,4 +43,4 @@ def sha256_file(path: Path) -> str:
     return digest.hexdigest()
 
 
-__all__ = ["parse_iso", "sha256_file"]
+__all__ = ["local_now", "now_iso", "parse_iso", "sha256_file", "utc_now_iso"]

package/lattice_brain/workflow.py

@@ -24,10 +24,10 @@ a linear node chain so existing workflow history keeps working.
 from __future__ import annotations
 
 from dataclasses import dataclass, field
-from datetime import datetime
 from typing import Any, Callable, Dict, List, Optional
 
 from lattice_brain.runtime.contracts import runtime_boundary_contract, workflow_run_contract
+from lattice_brain.utils import now_iso as _now
 
 
 WORKFLOW_ENGINE_VERSION = "2.2.0"
@@ -59,10 +59,6 @@ class WorkflowError(Exception):
     """Raised for invalid workflow definitions."""
 
 
-def _now() -> str:
-    return datetime.now().isoformat(timespec="seconds")
-
-
 def normalize_definition(workflow: Dict[str, Any]) -> Dict[str, Any]:
     """Return a node-based definition, lifting legacy ``steps`` lists if needed.
 

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "9.0.0"
+__version__ = "9.1.0"

package/latticeai/api/admin.py

@@ -259,7 +259,7 @@ def create_admin_router(
                 {"id": "model_egress", "label": "Model egress",
                  "value": "Local-only by default (no external inference in local mode)", "enforced": True},
                 {"id": "invite_gate", "label": "Invite gate",
-                 "value": "Required for new accounts" if invite_gate_enabled else "Open registration",
+                 "value": "Signed access gate" if invite_gate_enabled else "Disabled",
                  "enforced": bool(invite_gate_enabled)},
                 {"id": "log_retention", "label": "Log retention",
                  "value": "90 day local audit window with manual export before pruning", "enforced": True},

package/latticeai/api/agent_registry.py

@@ -14,6 +14,7 @@ from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
 from latticeai.core.agent_registry import AgentRegistry
+from latticeai.core.security import redact_secrets
 
 
 class AgentRegisterRequest(BaseModel):
@@ -34,6 +35,7 @@ def create_agent_registry_router(
     *,
     registry: AgentRegistry,
     require_user: Callable[[Request], str],
+    require_admin: Callable[[Request], Any],
     append_audit_event: Callable[..., None],
 ) -> APIRouter:
     router = APIRouter()
@@ -41,7 +43,7 @@ def create_agent_registry_router(
     @router.get("/agents/api/registry")
     async def list_registry(request: Request, type: Optional[str] = None):
         require_user(request)
-        return registry.list(agent_type=type)
+        return redact_secrets(registry.list(agent_type=type))
 
     @router.get("/agents/api/registry/capabilities")
     async def registry_capabilities(request: Request):
@@ -51,11 +53,11 @@ def create_agent_registry_router(
     @router.get("/agents/api/registry/discover")
     async def registry_discover(request: Request, capability: str = ""):
         require_user(request)
-        return {"capability": capability, "agents": registry.discover(capability)}
+        return {"capability": capability, "agents": redact_secrets(registry.discover(capability))}
 
     @router.post("/agents/api/registry")
     async def register_agent(req: AgentRegisterRequest, request: Request):
-        user = require_user(request)
+        user, _ = require_admin(request)
         try:
             entry = registry.register(
                 name=req.name,
@@ -68,7 +70,7 @@ def create_agent_registry_router(
         except ValueError as exc:
             raise HTTPException(status_code=400, detail=str(exc)) from exc
         append_audit_event("agent_register", user_email=user, agent_id=entry["id"], type=entry["type"])
-        return {"agent": entry}
+        return {"agent": redact_secrets(entry)}
 
     @router.get("/agents/api/registry/{agent_id:path}")
     async def get_agent(agent_id: str, request: Request):
@@ -76,21 +78,21 @@ def create_agent_registry_router(
         agent = registry.get(agent_id)
         if agent is None:
             raise HTTPException(status_code=404, detail=f"Agent not found: {agent_id}")
-        return {"agent": agent}
+        return {"agent": redact_secrets(agent)}
 
     @router.patch("/agents/api/registry/{agent_id:path}")
     async def update_agent(agent_id: str, req: AgentConfigRequest, request: Request):
-        user = require_user(request)
+        user, _ = require_admin(request)
         try:
             agent = registry.update_config(agent_id, req.config, enabled=req.enabled)
         except KeyError as exc:
             raise HTTPException(status_code=404, detail=f"Agent not found: {agent_id}") from exc
         append_audit_event("agent_config", user_email=user, agent_id=agent_id)
-        return {"agent": agent}
+        return {"agent": redact_secrets(agent)}
 
     @router.delete("/agents/api/registry/{agent_id:path}")
     async def remove_agent(agent_id: str, request: Request):
-        user = require_user(request)
+        user, _ = require_admin(request)
         try:
             result = registry.remove(agent_id)
         except KeyError as exc:

package/latticeai/api/agents.py

@@ -17,6 +17,24 @@ from pydantic import BaseModel
 from latticeai.api.ui_redirects import app_redirect
 
 
+_CORE_EXECUTION_ROLES = ["planner", "executor", "reviewer"]
+_MEMORY_GROUNDED_ROLES = ["researcher", *_CORE_EXECUTION_ROLES]
+
+
+def _memory_grounded_roles(roles: List[str]) -> Optional[List[str]]:
+    """Ground standard user-initiated agent runs in Brain recall first.
+
+    Explicit specialist/custom pipelines keep their requested shape. The
+    desktop Brain and Work surfaces both send the historical three-role core
+    sequence, so normalizing it at the API boundary upgrades existing clients
+    without a frontend-only compatibility branch.
+    """
+    requested = list(roles or _CORE_EXECUTION_ROLES)
+    if requested == _CORE_EXECUTION_ROLES:
+        return list(_MEMORY_GROUNDED_ROLES)
+    return requested or None
+
+
 class AgentRunRequest(BaseModel):
     goal: str
     roles: List[str] = []
@@ -160,13 +178,14 @@ def create_agents_router(
     async def agent_run(req: AgentRunRequest, request: Request):
         current_user = require_user(request)
         scope = gate_write(request)
+        grounded_roles = _memory_grounded_roles(req.roles)
         try:
             if run_executor is not None:
                 return await run_executor.start_agent(
                     req.goal,
                     user_email=current_user or None,
                     scope=scope,
-                    roles=req.roles or None,
+                    roles=grounded_roles,
                     inputs=req.inputs,
                     max_retries=req.max_retries,
                 )
@@ -180,7 +199,7 @@ def create_agents_router(
                 req.goal,
                 user_email=current_user or None,
                 scope=scope,
-                roles=req.roles or None,
+                roles=grounded_roles,
                 inputs=req.inputs,
                 max_retries=req.max_retries,
             )
@@ -199,7 +218,7 @@ def create_agents_router(
         return runtime.preview(
             req.goal,
             scope=scope,
-            roles=req.roles or None,
+            roles=_memory_grounded_roles(req.roles),
             inputs=req.inputs,
             max_retries=req.max_retries,
         )