ltcai 9.6.0 → 9.8.0

package/lattice_brain/quality.py

@@ -142,6 +142,46 @@ class RerankerInterface:
 # -----------------------------
 # 3. Memory Candidate Extraction / Scoring / Dedupe / Merge / Conflict / Retention
 # -----------------------------
+
+# Public content-signature helpers (v9.6.x graph-layer proactive seam).
+# Extracted from MemoryQualityManager so the graph layer
+# (lattice_brain.graph.proactive) and future ingestion gating can reuse the
+# exact same dedupe semantics without instantiating the manager. Behaviour is
+# byte-for-byte identical to the pre-existing private logic.
+
+_SIGNATURE_STOPWORDS = {
+    "a", "an", "and", "for", "i", "is", "it", "mode", "the", "to",
+    "user", "users", "does", "do", "not", "like", "likes", "prefer",
+    "prefers", "want", "wants",
+}
+
+
+def dedupe_key(content: str) -> str:
+    """Stable near-exact signature for a piece of content.
+
+    sha256 prefix over the normalized text head plus a coarse length bucket —
+    the same key ``MemoryQualityManager.dedupe`` uses to collapse duplicates.
+    Two texts with the same key are treated as exact/near-exact duplicates.
+    """
+    text = str(content or "")
+    norm = " ".join(text.lower().split())[:200]
+    return hashlib.sha256((norm + f"|{len(text)//50}").encode()).hexdigest()[:16]
+
+
+def content_signature(content: str) -> set:
+    """Token-set signature (stopword-filtered) for overlap/jaccard comparison.
+
+    Mirrors ``MemoryQualityManager._content_signature`` — kept public so
+    graph-layer duplicate/contradiction detection shares one definition.
+    """
+    tokens = set(re.findall(r"\w+", str(content or "").lower()))
+    return {
+        token
+        for token in tokens
+        if len(token) > 2 and token not in _SIGNATURE_STOPWORDS
+    }
+
+
 @dataclass
 class MemoryCandidate:
     id: str
@@ -193,8 +233,7 @@ class MemoryQualityManager:
         kept = []
         seen = set()
         for c in cands:
-            norm = " ".join(c.content.lower().split())[:200]
-            h = hashlib.sha256((norm + f"|{len(c.content)//50}").encode()).hexdigest()[:16]
+            h = dedupe_key(c.content)
             if h not in seen:
                 seen.add(h)
                 kept.append(c)
@@ -247,13 +286,7 @@ class MemoryQualityManager:
         return any(pattern in lowered for pattern in self._POSITIVE_PATTERNS)
 
     def _content_signature(self, content: str) -> set[str]:
-        stopwords = {
-            "a", "an", "and", "for", "i", "is", "it", "mode", "the", "to",
-            "user", "users", "does", "do", "not", "like", "likes", "prefer",
-            "prefers", "want", "wants",
-        }
-        tokens = set(re.findall(r"\w+", content.lower()))
-        return {token for token in tokens if len(token) > 2 and token not in stopwords}
+        return content_signature(content)
 
     # --- Large candidate #4 slice: proactive / temporal contradiction detection ---
     def detect_temporal_contradictions(self, memories: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
@@ -516,6 +549,8 @@ class LatticeBrainQuality:
 __all__ = [
     "BM25Scorer",
     "ContextGuardrails",
+    "content_signature",
+    "dedupe_key",
     "EmbeddingFallbackLabeller",
     "EmbeddingLabel",
     "GraphEdgeQuality",

package/lattice_brain/runtime/multi_agent.py

@@ -10,6 +10,33 @@ the operational objects first-class: handoffs, context packets, review/retry
 history, replayable timeline events, and explicit planning records. The default
 runner is still deterministic and LLM-free so tests, local demos, and Community
 installations can exercise the full Planner -> Executor -> Reviewer loop.
+
+Consistency with the single-agent harness (latticeai.core.agent)
+----------------------------------------------------------------
+Both runtimes expose the shared ``agent-run-contract/v1`` envelope
+(:mod:`.contracts`), and every terminal status this orchestrator emits
+(``ok`` / ``retried_ok`` / ``failed``) is a member of
+``statuses.RUN_TERMINAL_STATUSES``. Three differences are intentional design,
+not drift:
+
+* **Tool dispatch** — this orchestrator is pure and never executes tools
+  itself. Tool work reachable from a multi-agent step flows through the
+  *injected* ``workflow_runner`` / ``plugin_runner`` seams (wired in
+  ``latticeai.services.platform_runtime``), and those seams route every call
+  through the same shared ``hooks.dispatch_tool`` pre_tool/post_tool lifecycle
+  the single-agent loop uses.
+* **Change governance** — the single-agent loop stages mutations of existing
+  content as review proposals (``AgentDeps.change_governor``); the injected
+  workflow tool node instead pauses non-auto-approve tools into
+  ``awaiting_approval`` (``ApprovalRequired``). Different mechanisms, same
+  fail-closed outcome: no unapproved mutation executes from either runtime.
+* **Tracing** — the single-agent loop records a ``LoopTrace`` event stream;
+  this runtime records replayable ``timeline`` events. Both surface uniformly
+  as the contract's ``timeline``.
+
+Run-level ``pre_run`` / ``post_run`` hooks fire in
+``lattice_brain.runtime.agent_runtime.AgentRuntime``, which wraps this
+orchestrator for the product ``/agents`` surface.
 """
 
 from __future__ import annotations
@@ -21,7 +48,7 @@ from .contracts import multi_agent_contract
 from ..utils import now_iso as _now
 
 
-MULTI_AGENT_VERSION = "9.6.0"
+MULTI_AGENT_VERSION = "9.8.0"
 
 AGENT_ROLES = ("researcher", "planner", "executor", "reviewer", "release")
 CORE_PIPELINE = ("planner", "executor", "reviewer")
@@ -742,7 +769,16 @@ class MultiAgentOrchestrator:
             # let downstream roles review stale or missing output and could
             # incorrectly convert a failed run into an approved one.
             if str(role_result.get("status") or "").lower() == "error":
-                reason = str(role_result.get("error") or f"{role} role failed")
+                # Both role-error result shapes are honored: a raised exception
+                # (``_run_role``) carries ``error``; an llm_role_runner failure
+                # carries ``reason`` (with the raw model output preserved in
+                # ``ctx.review``). Either way the terminal timeline event names
+                # the real cause instead of a generic placeholder.
+                reason = str(
+                    role_result.get("error")
+                    or role_result.get("reason")
+                    or f"{role} role failed"
+                )
                 existing_review = dict(ctx.review or {})
                 ctx.review = existing_review or {
                     "outcome": "reject",

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "9.6.0"
+__version__ = "9.8.0"

package/latticeai/api/brain_intelligence.py

@@ -18,6 +18,15 @@ from latticeai.services.brain_intelligence import BrainIntelligenceService
 
 class ConsolidateRequest(BaseModel):
     apply: bool = False
+    # v9.6.x additive alias: dry_run=true means apply=false. When provided it
+    # takes precedence over ``apply`` (explicit intent wins); omitted keeps the
+    # v9.3.0 contract unchanged. Default behaviour is always a dry run.
+    dry_run: Optional[bool] = None
+
+    def effective_apply(self) -> bool:
+        if self.dry_run is not None:
+            return not self.dry_run
+        return self.apply
 
 
 def create_brain_intelligence_router(
@@ -48,11 +57,39 @@ def create_brain_intelligence_router(
         scope = gate_read(request)
         return service.contradictions(user_email=user, workspace_id=scope)
 
+    @router.get("/api/brain/vector-freshness")
+    async def brain_vector_freshness(request: Request):
+        """Vector index freshness summary (read-only, never raises).
+
+        Fixed contract consumed by the frontend:
+        ``{"status": "ready"|"pending"|"unavailable", "pending_items": int,
+        "total_items": int, "detail": str}``.
+        """
+        user = require_user(request)
+        scope = gate_read(request)
+        return service.vector_freshness(user_email=user, workspace_id=scope)
+
+    @router.get("/api/brain/duplicates")
+    async def brain_duplicates(request: Request):
+        """Graph-layer duplicate node candidates (read-only)."""
+        user = require_user(request)
+        scope = gate_read(request)
+        return service.graph_duplicates(user_email=user, workspace_id=scope)
+
+    @router.get("/api/brain/quality-report")
+    async def brain_quality_report(request: Request):
+        """Combined graph quality report: duplicates, contradictions, stale
+        nodes, edge quality (read-only)."""
+        user = require_user(request)
+        scope = gate_read(request)
+        return service.quality_report(user_email=user, workspace_id=scope)
+
     @router.post("/api/brain/consolidate")
     async def brain_consolidate(req: ConsolidateRequest, request: Request):
         user = require_user(request)
-        scope = gate_write(request) if req.apply else gate_read(request)
-        result = service.consolidate(apply=req.apply, user_email=user, workspace_id=scope)
+        apply = req.effective_apply()
+        scope = gate_write(request) if apply else gate_read(request)
+        result = service.consolidate(apply=apply, user_email=user, workspace_id=scope)
         append_audit_event(
             "brain_consolidate",
             user_email=user,

package/latticeai/api/change_proposals.py

@@ -13,10 +13,17 @@ from __future__ import annotations
 from typing import Callable, Optional
 
 from fastapi import APIRouter, HTTPException, Request
+from pydantic import BaseModel
 
 from latticeai.services.change_proposals import ChangeProposalService
 
 
+class RejectProposalRequest(BaseModel):
+    """Optional rejection context — kept in the item's provenance."""
+
+    reason: str = ""
+
+
 def create_change_proposals_router(
     *,
     service: ChangeProposalService,
@@ -32,6 +39,23 @@ def create_change_proposals_router(
         scope = gate_read(request)
         return service.pending(user_email=user, workspace_id=scope)
 
+    # NOTE: declared before /api/proposals/{item_id} so "counts" never
+    # resolves as an item id.
+    @router.get("/api/proposals/counts")
+    async def proposal_counts(request: Request):
+        user = require_user(request)
+        scope = gate_read(request)
+        return service.counts(user_email=user, workspace_id=scope)
+
+    @router.get("/api/proposals/{item_id}")
+    async def get_proposal(item_id: str, request: Request):
+        require_user(request)
+        scope = gate_read(request)
+        try:
+            return service.get_proposal(item_id, workspace_id=scope)
+        except (KeyError, FileNotFoundError) as exc:
+            raise HTTPException(status_code=404, detail=str(exc))
+
     @router.post("/api/proposals/{item_id}/approve")
     async def approve_proposal(item_id: str, request: Request):
         user = require_user(request)
@@ -46,15 +70,20 @@ def create_change_proposals_router(
             raise HTTPException(status_code=400, detail=str(exc))
 
     @router.post("/api/proposals/{item_id}/reject")
-    async def reject_proposal(item_id: str, request: Request):
+    async def reject_proposal(
+        item_id: str, request: Request, req: Optional[RejectProposalRequest] = None
+    ):
         user = require_user(request)
         scope = gate_write(request)
         try:
-            return service.reject(item_id, user_email=user, workspace_id=scope)
+            return service.reject(
+                item_id, user_email=user, workspace_id=scope,
+                reason=(req.reason if req else ""),
+            )
         except (KeyError, FileNotFoundError) as exc:
             raise HTTPException(status_code=404, detail=str(exc))
 
     return router
 
 
-__all__ = ["create_change_proposals_router"]
+__all__ = ["create_change_proposals_router", "RejectProposalRequest"]

package/latticeai/api/chat.py

@@ -28,6 +28,7 @@ from latticeai.api.chat_documents import (
 )
 from latticeai.api.chat_helpers import (
     _LANG_HINT,
+    build_context_quality,
     build_recent_chat_context,
     detect_language,
     file_action_target,
@@ -64,6 +65,7 @@ __all__ = [
     "AgentResumeRequest",
     "ChatRequest",
     "create_chat_router",
+    "build_context_quality",
     "build_recent_chat_context",
     "pair_user_history",
     "detect_language",
@@ -358,6 +360,19 @@ def create_chat_router(context: AppContext) -> APIRouter:
         if context_trace is not None and isinstance(trace_seed, dict):
             trace_seed["context_assembly"] = context_trace
 
+        # v9.8.0 honest RAG signal: how well the graph grounded this answer.
+        # Rides the same channel as sources/evidence (the answer trace) and is
+        # additionally exposed top-level on both response shapes below.
+        context_quality = build_context_quality(
+            req.message,
+            knowledge_graph=context.knowledge_graph
+            if (context.enable_graph and context.knowledge_graph)
+            else None,
+            allowed_workspaces={workspace_id} if workspace_id else None,
+        )
+        if isinstance(trace_seed, dict):
+            trace_seed["context_quality"] = context_quality
+
         history_message = (
             f"{req.message}\n[Image attached]" if req.image_data else req.message
         )
@@ -407,6 +422,7 @@ def create_chat_router(context: AppContext) -> APIRouter:
                     history_meta=history_meta,
                     model_id=selected_model_id,
                     workspace_id=workspace_id,
+                    context_quality=context_quality,
                 ),
                 media_type="text/event-stream",
                 headers={"X-Model": selected_model_id},
@@ -462,6 +478,7 @@ def create_chat_router(context: AppContext) -> APIRouter:
                 "response": response_text,
                 "trace_id": trace_record["id"],
                 "trace": trace_record,
+                "context_quality": context_quality,
             }
         )
 

package/latticeai/api/chat_helpers.py

@@ -197,6 +197,54 @@ def format_network_status(info: Dict) -> str:
         lines.extend(["", note])
     return "\n".join(lines)
 
+def build_context_quality(
+    query: str,
+    *,
+    knowledge_graph=None,
+    allowed_workspaces=None,
+    limit: int = 6,
+) -> Dict[str, object]:
+    """Honest RAG context-quality signal for chat responses (v9.8.0, additive).
+
+    Returns ``{"mode": "hybrid"|"lexical_only"|"none", "nodes": int,
+    "limited": bool, "reason": str|None}``. ``limited`` is true when the
+    graph produced 0–1 matches, when vector retrieval fell back to
+    lexical-only, or when retrieval failed entirely — so the frontend can
+    tell the user the answer is weakly grounded instead of implying rich
+    graph context. Never raises.
+    """
+    from lattice_brain.graph.retrieval import context_quality_signal
+
+    query = str(query or "").strip()
+    if knowledge_graph is None or not query:
+        return context_quality_signal(
+            "none", 0, reason="지식 그래프 컨텍스트를 사용하지 않았습니다"
+        )
+    scope_kwargs = (
+        {"allowed_workspaces": allowed_workspaces}
+        if allowed_workspaces is not None
+        else {}
+    )
+    hybrid_fn = getattr(knowledge_graph, "hybrid_search", None)
+    if callable(hybrid_fn):
+        try:
+            result = hybrid_fn(query, top_k=limit, **scope_kwargs) or {}
+        except Exception:  # noqa: BLE001 — signal building must never fail chat
+            return context_quality_signal("none", 0, reason="그래프 검색에 실패했습니다")
+        matches = result.get("matches") or []
+        return context_quality_signal(
+            str(result.get("mode") or "hybrid"), len(matches)
+        )
+    # Lexical-only stores without the hybrid mixin.
+    try:
+        matches = (
+            knowledge_graph.search(query, limit=limit, **scope_kwargs) or {}
+        ).get("matches") or []
+    except Exception:  # noqa: BLE001 — signal building must never fail chat
+        return context_quality_signal("none", 0, reason="그래프 검색에 실패했습니다")
+    return context_quality_signal("lexical_only", len(matches))
+
+
 def workspace_scope_from_request(request: Request) -> Optional[str]:
     header = request.headers.get("X-Workspace-Id")
     if header and header.strip():

package/latticeai/api/chat_stream.py

@@ -52,8 +52,14 @@ async def stream_chat(
     history_meta: Optional[Dict[str, Any]] = None,
     model_id: Optional[str] = None,
     workspace_id: Optional[str] = None,
+    context_quality: Optional[Dict[str, Any]] = None,
 ) -> AsyncIterator[str]:
-    """Stream model chunks and persist exactly one finalized answer."""
+    """Stream model chunks and persist exactly one finalized answer.
+
+    ``context_quality`` (v9.8.0, additive) is echoed on the final trailer
+    event alongside the answer trace so streaming clients receive the same
+    honest RAG signal as the non-streaming JSON response.
+    """
 
     full_response = ""
     stream_error: Optional[str] = None
@@ -106,6 +112,8 @@ async def stream_chat(
     trailer: Dict[str, Any] = {"chunk": "", "model": model_id}
     if trace_record:
         trailer.update({"trace_id": trace_record["id"], "trace": trace_record})
+    if context_quality is not None:
+        trailer["context_quality"] = context_quality
     if stream_error:
         trailer["error"] = stream_error
     yield f"data: {json.dumps(trailer, ensure_ascii=False)}\n\n"

package/latticeai/api/local_files.py

@@ -10,7 +10,7 @@ from datetime import datetime
 from pathlib import Path
 from typing import Optional
 
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, BackgroundTasks, HTTPException, Request
 from fastapi.responses import FileResponse
 from pydantic import BaseModel
 
@@ -37,6 +37,18 @@ class LocalWriteRequest(BaseModel):
     approval_token: Optional[str] = None
 
 
+class FolderIngestRequest(BaseModel):
+    path: str
+    recursive: bool = True
+    background: bool = False
+    workspace_id: Optional[str] = None
+    # Local filesystem reads follow the standard approval dance (same as
+    # /local/read and /knowledge-graph/local/index): the first call returns a
+    # permission_required payload with an approval token.
+    approved: bool = False
+    approval_token: Optional[str] = None
+
+
 def create_local_files_router(
     *,
     require_user,
@@ -194,6 +206,107 @@ def create_local_files_router(
             raise HTTPException(status_code=404, detail="File not found")
         return FileResponse(str(target))
 
+    # ── v9.8.0 ingestion jobs API (frozen paths — consumed by the frontend) ───
+    def _require_pipeline():
+        if ingestion_pipeline is None or not ingestion_pipeline.available():
+            raise HTTPException(status_code=503, detail="Knowledge Graph ingestion is disabled.")
+
+    def _ingestion_write_workspace(request: Request, body_workspace: Optional[str], user: str) -> Optional[str]:
+        header = request.headers.get("X-Workspace-Id")
+        header = header.strip() if header and header.strip() else None
+        supplied = [value for value in (body_workspace, header) if value]
+        if len(set(supplied)) > 1:
+            raise HTTPException(status_code=403, detail="Workspace selectors must match.")
+        requested = supplied[0] if supplied else None
+        if workspace_service is None:
+            return requested
+        try:
+            return workspace_service.resolve_write_scope(requested, user or None)
+        except PermissionError as exc:
+            raise HTTPException(status_code=403, detail=str(exc)) from exc
+
+    @router.get("/api/ingestion/jobs")
+    async def ingestion_jobs(request: Request, limit: int = 20):
+        """Recent background ingestion jobs (newest first)."""
+        require_user(request)
+        _require_pipeline()
+        limit = max(1, min(int(limit or 20), 100))
+        return {"jobs": ingestion_pipeline.list_background_jobs(limit=limit)}
+
+    @router.get("/api/ingestion/jobs/{job_id}")
+    async def ingestion_job_detail(job_id: str, request: Request):
+        """One job with its progress counters and (capped) error records."""
+        require_user(request)
+        _require_pipeline()
+        job = ingestion_pipeline.get_background_job(job_id)
+        if job is None:
+            raise HTTPException(status_code=404, detail="ingestion job not found")
+        return job.as_dict()
+
+    @router.post("/api/ingestion/jobs/{job_id}/resume")
+    async def ingestion_job_resume(job_id: str, request: Request, background_tasks: BackgroundTasks):
+        """Resume an interrupted/partial/failed job from its remaining items."""
+        user = require_user(request)
+        _require_pipeline()
+        job = ingestion_pipeline.get_background_job(job_id)
+        if job is None:
+            raise HTTPException(status_code=404, detail="ingestion job not found")
+        if job.status == "running":
+            return {"status": "already_running", "job_id": job_id, "job": job.as_dict()}
+        remaining = len(job.remaining_indices())
+        if remaining == 0 and job.status == "completed":
+            return {"status": "nothing_to_resume", "job_id": job_id, "job": job.as_dict()}
+        background_tasks.add_task(
+            ingestion_pipeline.resume_background_job, job_id, user_email=user or None,
+        )
+        return {
+            "status": "resuming",
+            "job_id": job_id,
+            "remaining": remaining,
+            "job": job.as_dict(),
+        }
+
+    @router.post("/api/ingestion/folder")
+    async def ingestion_folder(req: FolderIngestRequest, request: Request, background_tasks: BackgroundTasks):
+        """Ingest a local folder through the unified pipeline.
+
+        Reads local disk, so it follows the same approval dance as
+        ``/local/read`` and ``/knowledge-graph/local/index``: without
+        ``approved`` + ``approval_token`` the response is a
+        ``permission_required`` payload. ``background=true`` schedules a job
+        (summary includes ``job_id``) and executes it after the response.
+        """
+        current_user = permission_gateway.require_local_user(request)
+        _require_pipeline()
+        workspace_id = _ingestion_write_workspace(request, req.workspace_id, current_user)
+        path = (req.path or "").strip()
+        if not path:
+            raise HTTPException(status_code=400, detail="path is required.")
+        if not req.approved:
+            return permission_gateway.local_permission_response(path, "read", current_user)
+        permission_gateway.require_local_approval(
+            token=req.approval_token,
+            path=path,
+            action="read",
+            user_email=current_user,
+        )
+        summary = ingestion_pipeline.ingest_folder(
+            path,
+            recursive=req.recursive,
+            background=req.background,
+            owner=current_user or None,
+            workspace_id=workspace_id,
+            user_email=current_user or None,
+        )
+        job_id = summary.get("job_id")
+        if req.background and job_id:
+            # Execute after the response is sent; progress is visible via
+            # GET /api/ingestion/jobs/{job_id}.
+            background_tasks.add_task(
+                ingestion_pipeline.run_background_job, job_id, user_email=current_user or None,
+            )
+        return summary
+
     @router.post("/local/write")
     async def local_write_endpoint(req: LocalWriteRequest, request: Request):
         current_user = permission_gateway.require_local_user(request)
@@ -238,4 +351,9 @@ def create_local_files_router(
     return router
 
 
-__all__ = ["LocalAccessRequest", "LocalWriteRequest", "create_local_files_router"]
+__all__ = [
+    "FolderIngestRequest",
+    "LocalAccessRequest",
+    "LocalWriteRequest",
+    "create_local_files_router",
+]

package/latticeai/api/review_queue.py

@@ -56,6 +56,18 @@ class SnoozeRequest(BaseModel):
     until: str
 
 
+class DismissRequest(BaseModel):
+    """Optional dismissal context (e.g. why a change proposal was rejected)."""
+
+    reason: str = ""
+
+
+class ReviewCounts(BaseModel):
+    pending: int = 0
+    snoozed: int = 0
+    pending_by_source: Dict[str, int] = Field(default_factory=dict)
+
+
 def create_review_queue_router(
     *,
     service: ReviewQueueService,
@@ -64,7 +76,13 @@ def create_review_queue_router(
     gate_write: Callable[[Request], Optional[str]],
     run_review_item: Callable[..., Any],
     append_audit_event: Callable[..., None],
+    change_proposals: Any = None,
 ) -> APIRouter:
+    """``change_proposals`` (optional) closes the governance loop: approving a
+    ``change_proposal`` item from the Review Center applies the staged content
+    via :class:`~latticeai.services.change_proposals.ChangeProposalService`
+    instead of merely flipping the status — the same single application path
+    the /api/proposals surface uses."""
     router = APIRouter()
 
     @router.get("/automation/reviews", response_model=ReviewItemList)
@@ -95,6 +113,14 @@ def create_review_queue_router(
         append_audit_event("review_item_created", user_email=user, item_id=item["id"])
         return item
 
+    # NOTE: declared before /automation/reviews/{item_id} so "counts" never
+    # resolves as an item id.
+    @router.get("/automation/reviews/counts", response_model=ReviewCounts)
+    async def review_counts(request: Request):
+        user = require_user(request)
+        scope = gate_read(request)
+        return service.counts(workspace_id=scope, user_email=user)
+
     @router.get("/automation/reviews/{item_id}", response_model=ReviewItem)
     async def get_item(item_id: str, request: Request):
         require_user(request)
@@ -106,11 +132,49 @@ def create_review_queue_router(
 
     @router.post("/automation/reviews/{item_id}/approve", response_model=ReviewItem)
     async def approve_item(item_id: str, request: Request):
+        user = require_user(request)
+        scope = gate_write(request)
+        # change_proposal items must apply the staged content on approve —
+        # otherwise the item flips to "approved" while nothing hits disk.
+        if change_proposals is not None:
+            try:
+                stored = service.get(item_id, workspace_id=scope)
+            except FileNotFoundError as exc:
+                raise HTTPException(status_code=404, detail="review item not found") from exc
+            if stored.get("source") == "change_proposal":
+                if stored.get("effective_status") not in ("pending", "snoozed"):
+                    raise HTTPException(
+                        status_code=409,
+                        detail=f"cannot 'approve' a review item in status {stored.get('status')!r}",
+                    )
+                try:
+                    applied = change_proposals.approve_and_apply(
+                        item_id, user_email=user, workspace_id=scope
+                    )
+                except (KeyError, FileNotFoundError) as exc:
+                    raise HTTPException(status_code=404, detail=str(exc)) from exc
+                except ValueError as exc:
+                    raise HTTPException(status_code=400, detail=str(exc)) from exc
+                append_audit_event("review_item_approve", user_email=user, item_id=item_id)
+                return applied["item"]
         return _act(request, item_id, "approve")
 
     @router.post("/automation/reviews/{item_id}/dismiss", response_model=ReviewItem)
-    async def dismiss_item(item_id: str, request: Request):
-        return _act(request, item_id, "dismiss")
+    async def dismiss_item(
+        item_id: str, request: Request, req: Optional[DismissRequest] = None
+    ):
+        user = require_user(request)
+        scope = gate_write(request)
+        try:
+            item = service.dismiss(
+                item_id, workspace_id=scope, reason=(req.reason if req else None)
+            )
+        except FileNotFoundError as exc:
+            raise HTTPException(status_code=404, detail="review item not found") from exc
+        except InvalidReviewTransition as exc:
+            raise HTTPException(status_code=409, detail=str(exc)) from exc
+        append_audit_event("review_item_dismiss", user_email=user, item_id=item_id)
+        return item
 
     @router.post("/automation/reviews/{item_id}/snooze", response_model=ReviewItem)
     async def snooze_item(item_id: str, req: SnoozeRequest, request: Request):

package/latticeai/app_factory.py

@@ -1194,6 +1194,9 @@ def _build(config: "Optional[Config]" = None) -> Dict[str, Any]:
         gate_write=PLATFORM.gate_write,
         run_review_item=run_review_item,
         append_audit_event=append_audit_event,
+        # Approving a change_proposal from the Review Center applies the
+        # staged content through the same service the agent governor uses.
+        change_proposals=CHANGE_PROPOSALS,
         create_browser_router=create_browser_router,
         ingestion_pipeline=INGESTION_PIPELINE,
         workspace_service=WORKSPACE_SERVICE,