ltcai 9.8.0 → 9.9.0

package/README.md

@@ -11,7 +11,7 @@
 [![CI Status](https://github.com/TaeSooPark-PTS/LatticeAI/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/TaeSooPark-PTS/LatticeAI/actions/workflows/ci.yml)
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 
-![v9.8.0 Living Brain walkthrough](output/release/v9.8.0/gifs/v9.8.0-living-brain-walkthrough.gif)
+![v9.9.0 Living Brain walkthrough](output/release/v9.9.0/gifs/v9.9.0-living-brain-walkthrough.gif)
 
 Chat, files, folders, notes, and web pages all flow into one durable knowledge
 graph on your computer. Any model — local MLX or cloud — can speak with that
@@ -24,9 +24,9 @@ memory. Nothing leaves your machine without explicit consent.
 
 | | |
 | --- | --- |
-| **Chat with a Brain that remembers** — every conversation grows durable, source-linked memory ![Brain Chat](output/release/v9.8.0/screenshots/04-brain-chat-home.png) | **See how knowledge connects** — a real relationship graph, not a file list ![Memory Graph](output/release/v9.8.0/screenshots/05-memory-graph.png) |
-| **Capture anything** — files, whole folders, notes, screenshots, web pages ![Capture](output/release/v9.8.0/screenshots/06-capture.png) | **Automate with review** — agent changes become proposals you approve first ![Review Center](output/release/v9.8.0/screenshots/12-review-center.png) |
-| **Pick a model in one click** — recommended local models for your hardware ![Recommended Models](output/release/v9.8.0/screenshots/02-recommended-models.png) | **Stay in control** — audit, roles, retention in a separate admin surface ![Admin Console](output/release/v9.8.0/screenshots/10-admin-console.png) |
+| **Chat with a Brain that remembers** — every conversation grows durable, source-linked memory ![Brain Chat](output/release/v9.9.0/screenshots/04-brain-chat-home.png) | **See how knowledge connects** — a real relationship graph, not a file list ![Memory Graph](output/release/v9.9.0/screenshots/05-memory-graph.png) |
+| **Capture anything** — files, whole folders, notes, screenshots, web pages ![Capture](output/release/v9.9.0/screenshots/06-capture.png) | **Automate with review** — agent changes become proposals you approve first ![Review Center](output/release/v9.9.0/screenshots/12-review-center.png) |
+| **Pick a model in one click** — recommended local models for your hardware ![Recommended Models](output/release/v9.9.0/screenshots/02-recommended-models.png) | **Stay in control** — audit, roles, retention in a separate admin surface ![Admin Console](output/release/v9.9.0/screenshots/10-admin-console.png) |
 
 ## Why Lattice AI
 
@@ -57,36 +57,45 @@ First-run flow — wake the Brain, pick the owner, load a recommended model:
 
 | | | |
 | --- | --- | --- |
-| ![Login](output/release/v9.8.0/screenshots/01-login.png) | ![Model install](output/release/v9.8.0/screenshots/03-install-load-progress.png) | ![Model library](output/release/v9.8.0/screenshots/07-model-library.png) |
+| ![Login](output/release/v9.9.0/screenshots/01-login.png) | ![Model install](output/release/v9.9.0/screenshots/03-install-load-progress.png) | ![Model library](output/release/v9.9.0/screenshots/07-model-library.png) |
 
 Screenshot index and capture notes:
-[output/release/v9.8.0/SCREENSHOT_INDEX.md](output/release/v9.8.0/SCREENSHOT_INDEX.md)
+[output/release/v9.9.0/SCREENSHOT_INDEX.md](output/release/v9.9.0/SCREENSHOT_INDEX.md)
 
 ## Current Release
 
-The current release is **9.8.0 — Honest Knowledge Pipeline**:
-
-- Every ingest (file, folder, web) now reports an extraction-quality score and
-  warns on low-quality captures before they pollute the Brain.
-- Background folder ingestion is robust: per-item errors don't kill the job,
-  progress (processed/total) is visible, and interrupted jobs resume — with a
-  jobs API (`/api/ingestion/jobs`) and UI progress.
-- The Brain signals honestly: chat answers carry a `context_quality` marker
-  when graph context is limited, and `/api/brain/vector-freshness` plus a UI
-  banner show when knowledge is still waiting for vector indexing.
-- The agent evaluation gate grew to 16 deterministic scenarios, adding
-  ingestion, concept-extraction, RAG-grounded answering, and automation
-  proposal paths; automation suggestions gain confidence scoring and dedup.
+The current release is **9.9.0 — Fail-Closed Trust**:
+
+- **Change proposals can't clobber your edits.** A proposal now records the
+  original content hash; if the file changed before you approve, the apply is
+  rejected with a conflict instead of silently overwriting your work, and the
+  write is atomic. Duplicate/concurrent approvals apply exactly once.
+- **A confused verifier never reports success.** If the agent's critic output
+  can't be parsed (after one strict retry), the run ends as `NEEDS_REVIEW`
+  instead of a fabricated "done"; completion now requires a valid PASS *and*
+  real execution evidence.
+- **Every mutating tool is governed.** A single-source inventory classifies
+  each side-effecting tool; a CI gate fails closed if a new mutator ships
+  ungoverned, and tools that would overwrite existing content without a
+  reviewable proposal are blocked rather than applied.
+- **Honest onboarding.** Device analysis is modeled as
+  `loading | ready | unavailable`; a failed probe no longer fabricates a
+  "supported, ready on this computer" model card — it shows the cause, a
+  retry, and "continue without a model."
+- **Leaner & audited.** Initial JS bundle is ~22% smaller (lazy-loaded heavy
+  views, with a CI budget), plus dependency/SBOM audit and scheduled
+  PostgreSQL integration workflows, a security-scan report, a model benchmark
+  harness, and current/architecture documentation classification.
 
 Release notes: [RELEASE.md](RELEASE.md) · Full history: [docs/CHANGELOG.md](docs/CHANGELOG.md)
 
-Expected artifacts for 9.8.0 release must use exact filenames:
+Expected artifacts for 9.9.0 release must use exact filenames:
 
-- `dist/ltcai-9.8.0-py3-none-any.whl`
-- `dist/ltcai-9.8.0.tar.gz`
-- `ltcai-9.8.0.tgz`
-- `dist/ltcai-9.8.0.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_9.8.0_aarch64.dmg`
+- `dist/ltcai-9.9.0-py3-none-any.whl`
+- `dist/ltcai-9.9.0.tar.gz`
+- `ltcai-9.9.0.tgz`
+- `dist/ltcai-9.9.0.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_9.9.0_aarch64.dmg`
 
 Do not use wildcard artifact uploads. Package registry publishing remains owner-run.
 
@@ -106,16 +115,19 @@ See [ARCHITECTURE.md](ARCHITECTURE.md) for details and
 
 - External package registries are owner-published and can lag behind GitHub.
 - PostgreSQL/pgvector is optional scale/migration tooling. SQLite remains the
-  live local Brain store in 9.8.0.
+  live local Brain store in 9.9.0.
 - Docker, model downloads, cloud model calls, Telegram, Brain Network, and
   update checks require explicit user action.
-- Conversation does not fabricate answers when no model is loaded; LLM-free
-  simulation is labeled as such.
+- Conversation does not fabricate answers when no model is loaded. Agent and
+  workflow simulation without a loaded LLM is deterministic and LLM-free (it
+  does not call a model) — labeled as such, never presented as autonomous
+  model success.
 
 ## Release History
 
 | Version | Theme |
 | --- | --- |
+| 9.9.0 | Fail-Closed Trust |
 | 9.8.0 | Honest Knowledge Pipeline |
 | 9.7.0 | Proactive Hybrid Brain |
 | 9.6.0 | Trusted Agent Loop |

package/docs/BENCHMARKS.md

@@ -0,0 +1,107 @@
+# Model Robustness Benchmarks
+
+> Status: reference 2026-07-21
+
+Methodology and results for `scripts/bench_models.py`, a harness that measures
+how well the agent loop turns model output into executable actions across model
+quality tiers. Companion to [CI & Release Gates](CI_AND_RELEASE_GATES.md).
+
+## What is measured
+
+The product claim is that the Brain stays durable "across any AI model": weaker
+models emit sloppier output, but the loop repairs it and still completes the
+task. The harness turns that into three numbers per tier:
+
+- **success_rate** — fraction of model outputs that become a valid agent action
+  (the task can proceed).
+- **repair_rate** — of the successful parses, the fraction that succeeded *only
+  because* the loop's tolerant parser had to repair the output. High = "this
+  tier leans hard on the loop's robustness".
+- **latency_ms** — see the honesty note below.
+
+Every output is fed through the **real** parser the production loop uses:
+`latticeai.core.agent.extract_action_details` (called from `agent.py` in the
+plan/execute/verify phases). The harness does not reimplement parsing — it
+measures the shipping code. Its known repair tolerances are: `think_strip`
+(strip `<think>` blocks), `fence` (unwrap ```` ```json ````), `slice` (extract
+the `{...}` span from prose), `trailing_comma`, and `python_literal`
+(`ast.literal_eval` of a single-quoted dict).
+
+An `agent-loop` reference row additionally runs the real
+`latticeai.core.agent_eval.run_agent_eval` state machine over its 20 scripted
+scenarios and reports its success and recovery rates.
+
+## Honesty note on latency
+
+In **scripted** mode, `latency_ms` is the **parse+repair cost only**
+(microseconds). It is **not** model inference time and must not be read as such.
+True generation latency is only meaningful in **live** mode against a real
+endpoint.
+
+## Modes
+
+1. **scripted** (default; no model, no network): a curated corpus of
+   model-realistic outputs per tier. Deterministic; proves the harness works and
+   exposes the loop's repair boundary. Some weak-tier entries are *intentionally
+   broken* past the repair boundary so `success_rate < 1.0` is a real finding,
+   not a rigged demo. A self-check asserts every corpus entry's expected
+   parse/fail outcome matches reality (0 mismatches = healthy).
+2. **live** (opt-in): sends a fixed prompt set to an OpenAI-compatible local
+   endpoint (LM Studio / llama.cpp / vLLM), runs the real completions through
+   the same parser, and reports **true** generation latency. Falls back to a
+   clear "SKIPPED" line if the endpoint is unreachable.
+
+## Running
+
+```bash
+# Scripted matrix (always works):
+.venv/bin/python scripts/bench_models.py
+
+# With machine-readable output:
+.venv/bin/python scripts/bench_models.py --json bench.json
+
+# Against a real local model (OpenAI-compatible endpoint):
+.venv/bin/python scripts/bench_models.py \
+    --live-endpoint http://127.0.0.1:1234/v1 --model my-local-model
+```
+
+Exit code is non-zero only if the harness self-check finds an inconsistency (a
+real bug); a low score on a weak tier is a finding, not a failure.
+
+## Reference results (scripted, 2026-07-21)
+
+Captured on the maintainer's machine; latency is parse-only.
+
+| Tier | success_rate | repair_rate | n | repairs exercised |
+|------|-------------:|------------:|--:|-------------------|
+| frontier (clean JSON) | 1.00 | 0.00 | 6 | — |
+| mid-local (fenced/prose/commas) | 1.00 | 1.00 | 6 | fence×3, slice×1, trailing_comma×2 |
+| weak-local (think/py-literal/broken) | 0.625 | 1.00 | 8 | think_strip×2, python_literal×2, fence×1, trailing_comma×1 |
+
+Agent-loop reference (real state machine): **success_rate 1.00**, **recovery_rate
+0.70** over 20 scenarios. Harness self-check: **0 mismatches**.
+
+Reading the matrix: the mid tier is fully recoverable — every output needed a
+repair, and all succeeded, which is exactly the "durable across models" claim in
+action. The weak tier's 0.625 is the honest boundary: the 3 genuinely broken
+outputs (pure prose, missing `action` field, truncated braces) cannot and should
+not parse.
+
+## Measurable vs not-measurable (honest scope)
+
+**This harness can measure:**
+- Whether a given model's raw output survives the loop's parser (success_rate).
+- How much the loop's repair layer is doing the work (repair_rate + which
+  tolerances fire).
+- Real end-to-end generation latency in `live` mode.
+- End-to-end loop completion over the scripted scenario suite.
+
+**This harness does NOT measure:**
+- Task *correctness* / answer quality — only that an action is well-formed and
+  executable, not that it is the *right* action.
+- Multi-turn reasoning quality or tool-selection accuracy beyond the scripted
+  scenarios.
+- Throughput/latency under concurrency or on other hardware.
+- Any cloud model (no keys are used; live mode targets local endpoints only).
+- A representative sample of "all models" — scripted tiers are archetypes, not a
+  statistical population. For real numbers on a specific model, use `live` mode.

package/docs/CHANGELOG.md

@@ -4,6 +4,41 @@ The top entry is either the current unreleased main-branch work or the current
 release line. Older entries are historical and may describe behavior as it
 existed at that release.
 
+## [9.9.0] - 2026-07-21
+
+### Fixed
+- Change proposals record the target's original content hash and existence;
+  approval re-hashes the disk and rejects a modified/deleted/created target
+  with a 409 conflict instead of overwriting newer content. Applies are atomic
+  (`os.replace`) and serialized so duplicate/concurrent approvals apply once.
+- The agent verifier no longer fabricates a PASS on unparseable critic output:
+  one strict repair retry, then the new terminal `NEEDS_REVIEW` state. `DONE`
+  now requires a valid PASS and deterministic execution evidence; the loose
+  `next_state == DONE` success path is removed.
+- Device analysis no longer fabricates a `supported: true` model card on probe
+  failure; the recommendation screen models `loading | ready | unavailable`
+  and offers retry / continue-without-a-model.
+
+### Added
+- `MUTATING_TOOL_INVENTORY` single-source governance classification for every
+  side-effecting tool, a fail-closed CI coverage gate, and dispatch-level
+  blocking (409) of existing-content overwrites that cannot be staged as a
+  reviewable proposal (`create_docx/xlsx/pptx/pdf`, `local_write`).
+- Agent-eval result classification (`correct_completion` / `safe_termination`
+  / `needs_review` / `failed`) and fail-closed verifier scenarios (20 total).
+- CI: `dependency-audit.yml` (pip-audit + npm audit + CycloneDX SBOM) and
+  scheduled `postgres-integration.yml`; all GitHub Actions SHA-pinned; a
+  frontend bundle-budget gate (150 KiB gzip).
+- `docs/SECURITY_AUDIT.md`, `docs/BENCHMARKS.md` + `scripts/bench_models.py`,
+  `docs/USABILITY_AUDIT.md`, `docs/CI_AND_RELEASE_GATES.md`, and a
+  documentation status/link gate (`scripts/check_doc_status.mjs`).
+
+### Changed
+- Initial JS bundle reduced ~22% (180.3 → 141.6 KiB gzip) via lazy-loaded
+  onboarding, Brain home, and command palette.
+- `ARCHITECTURE.md` verified against the real module layout and corrected;
+  stale 9.6-era operational/feature/development docs updated and classified.
+
 ## [9.8.0] - 2026-07-20
 
 ### Added

package/docs/CI_AND_RELEASE_GATES.md

@@ -0,0 +1,106 @@
+# CI & Release Gates
+
+> Status: reference 2026-07-21
+
+Reference for the GitHub Actions workflows that guard `main` and releases, the
+supply-chain hardening applied to them, and the recommended branch-protection
+configuration. Companion to [SECURITY_AUDIT.md](SECURITY_AUDIT.md) and
+[BENCHMARKS.md](BENCHMARKS.md).
+
+## Workflows
+
+| Workflow | File | Triggers | Purpose |
+|----------|------|----------|---------|
+| CI | `.github/workflows/ci.yml` | push/PR to `main` | Lint, typecheck, unit + integration tests, brain/agent eval gates, build + wheel smoke |
+| Release | `.github/workflows/release.yml` | tags `v*` / `[0-9]*` | Build & validate all artifacts (no publish) |
+| Visual Smoke | `.github/workflows/visual.yml` | push/PR, nightly cron, dispatch | Playwright visual smoke |
+| **Dependency Audit** | `.github/workflows/dependency-audit.yml` | push/PR, weekly cron, dispatch | pip-audit + npm audit + CycloneDX SBOMs |
+| **Postgres Integration** | `.github/workflows/postgres-integration.yml` | weekly cron, dispatch | Live SQLite→Postgres/pgvector migration test |
+
+The last two were added for the P2 deployment-trust / supply-chain workstream.
+
+## Supply-chain hardening: pinned actions
+
+Every third-party `uses:` in every workflow is pinned to an **immutable commit
+SHA**, with the human-readable version in a trailing comment. A moving tag
+(`@v4`) can be repointed by the action owner; a SHA cannot. SHAs were resolved
+from the authoritative upstream refs via `git ls-remote --tags` on 2026-07-21.
+
+| Action | Tag | Pinned commit SHA |
+|--------|-----|-------------------|
+| actions/checkout | v4.4.0 | `11d5960a326750d5838078e36cf38b85af677262` |
+| actions/checkout | v5.1.0 | `fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` |
+| actions/setup-python | v5.6.0 | `a26af69be951a213d495a4c3e4e4022e16d87065` |
+| actions/setup-python | v6.3.0 | `ece7cb06caefa5fff74198d8649806c4678c61a1` |
+| actions/setup-node | v5.0.0 | `a0853c24544627f65ddf259abe73b1d18a591444` |
+| actions/upload-artifact | v4.6.2 | `ea165f8d65b6e75b540449e92b4886f43607fa02` |
+
+Pinning coverage: **100% of current `uses:` entries** across `ci.yml`,
+`release.yml`, `visual.yml`, `dependency-audit.yml`, and
+`postgres-integration.yml`. All are first-party `actions/*`. If a third-party
+action is added later, resolve and pin its SHA the same way before merge.
+
+## Dependency-audit gate posture (conservative)
+
+The audit workflow is intentionally **non-blocking on day-to-day PRs** and
+**strict on the scheduled/dispatch run**:
+
+- `push` / `pull_request`: `pip-audit` and `npm audit` run with
+  `continue-on-error` keyed on the event name, so a newly-disclosed CVE in a
+  transitive dependency never reddens an unrelated PR. Findings still appear in
+  the job summary and uploaded report artifacts.
+- `schedule` (weekly) / `workflow_dispatch`: the same steps run **strict** —
+  `pip-audit --strict` fails on any known vuln; `npm audit --audit-level=high`
+  fails on high/critical. This is the loud channel for triage.
+
+CycloneDX SBOMs (`sbom-python.json`, `sbom-npm.json`) are produced every run and
+uploaded as artifacts. Regenerate locally with `scripts/generate_sbom.py`.
+
+**To promote to a required blocking PR check:** remove the `continue-on-error`
+expressions in `dependency-audit.yml` and add `python-audit` / `npm-audit` to
+the required-checks list below.
+
+## Postgres integration gate
+
+`postgres-integration.yml` runs the migration-integrity suite
+(`tests/integration/test_v42_postgres_migration_live.py`) that is skipped
+everywhere else. The suite is gated by `LTCAI_LIVE_POSTGRES_DOCKER_CONSENT=1`;
+the workflow sets that variable, and the test itself starts and tears down a
+`pgvector/pgvector:pg16` container via `docker compose` (preinstalled on
+GitHub-hosted `ubuntu-latest`). It is deliberately kept off the PR path (slow,
+image pull, needs Docker) and runs weekly + on demand.
+
+## Recommended branch protection for `main`
+
+Required status checks (blocking):
+
+- `CI / Test (Python 3.11)`
+- `CI / Test (Python 3.12)`
+- `CI / Integration smoke test`
+- `CI / Build package`
+- `Visual Smoke / Playwright visual smoke`
+
+Advisory / non-blocking today (promote when the team is ready):
+
+- `Dependency Audit / Python dependency audit (pip-audit)`
+- `Dependency Audit / npm dependency audit`
+
+Additional recommended settings: require PRs before merge, require branches to
+be up to date, require linear history, and dismiss stale approvals on new
+commits.
+
+## Release gate (publication safety)
+
+`release.yml` builds and validates artifacts only — it never publishes. Package
+publication (PyPI / npm / VS Code Marketplace / Open VSX) is a manual step
+(`npm run publish:*`) using **exact version filenames**, never a `dist/*` glob,
+so pushing a tag can never publish by accident. See
+[../RELEASE.md](../RELEASE.md) for the full procedure.
+
+## Limitations (honest)
+
+- Branch-protection rules are repository settings and cannot be committed from a
+  workflow; the list above is the recommended configuration to apply in GitHub
+  settings, not an enforced artifact.
+- The audit gate depends on upstream advisory databases (OSV, npm registry);
+  absence of findings means "nothing known", not "provably safe".

package/docs/COMMUNITY_AND_PLUGINS.md

@@ -1,6 +1,6 @@
 # Community And Plugins
 
-Current release: **9.8.0 — Honest Knowledge Pipeline**.
+Current release: **9.9.0 — Fail-Closed Trust**.
 
 LatticeAI defines the path from a strong local-first framework (8.4.0
 action-aware baseline, 8.5.0 registry+DI hardening, 8.6.0 capture/navigation

package/docs/DEVELOPMENT.md

@@ -1,10 +1,13 @@
 # Lattice AI Development
 
-Current release: **9.8.0 — Honest Knowledge Pipeline**.
+> **Status: canonical** — current contributor guidance, kept in sync with the
+> current release.
+
+Current release: **9.9.0 — Fail-Closed Trust**.
 
 This document is for contributors working on the local-first Digital Brain
 codebase. Product positioning and quick start stay in `README.md`; release
-history is intentionally limited to 8.0.0-9.6.0 in `docs/CHANGELOG.md` and
+history is intentionally limited to 8.0.0-9.9.0 in `docs/CHANGELOG.md` and
 `RELEASE.md`.
 
 ## Product Contract
@@ -153,10 +156,10 @@ For user-facing, API, runtime, release, or packaging changes, check:
 Release/publish examples must use exact target-version filenames. Do not
 document wildcard artifact upload commands.
 
-For 9.6.0 release work, exact artifacts are:
+For 9.9.0 release work, exact artifacts are:
 
-- `dist/ltcai-9.6.0-py3-none-any.whl`
-- `dist/ltcai-9.6.0.tar.gz`
-- `ltcai-9.6.0.tgz`
-- `dist/ltcai-9.6.0.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_9.6.0_aarch64.dmg`
+- `dist/ltcai-9.9.0-py3-none-any.whl`
+- `dist/ltcai-9.9.0.tar.gz`
+- `ltcai-9.9.0.tgz`
+- `dist/ltcai-9.9.0.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_9.9.0_aarch64.dmg`

package/docs/ONBOARDING.md

@@ -1,6 +1,6 @@
 # Lattice AI Onboarding
 
-Current release: **9.8.0 — Honest Knowledge Pipeline**.
+Current release: **9.9.0 — Fail-Closed Trust**.
 
 The first-run goal is a five-minute path from "I opened the app" to "my Brain
 has a source, a question, and proof." This page is the product contract behind

package/docs/OPERATIONS.md

@@ -1,13 +1,18 @@
-# Lattice AI — Operations Guide (v9.6.0)
+# Lattice AI — Operations Guide (v9.9.0)
+
+> **Status: canonical** — kept in sync with the current release. Storage layout
+> below reflects the SQLite live Brain store and workspace scoping, not the
+> earlier Markdown-per-node graph.
 
 ## 1. 데이터 파일 위치
 
 | 파일 | 용도 |
 |------|------|
 | `~/.ltcai/users.json` | 사용자 계정 (scrypt 해시 저장) |
-| `~/.ltcai/history.json` | 대화 히스토리 |
+| `~/.ltcai/knowledge_graph.sqlite` | Brain 라이브 스토어 — Knowledge Graph 노드/엣지/청크, 대화 히스토리, 프로비넌스 (workspace_id 스코프) |
+| `~/.ltcai/knowledge_graph_blobs/` | 업로드 원본/blob 저장소 |
 | `~/.ltcai/audit.json` | 감사 로그 (agent 실행, 사용자 변경 등) |
-| `~/.ltcai/brain/` | Knowledge Graph 노드 (Markdown) |
+| `~/.ltcai/chat_history.json` | 레거시 대화 히스토리 — 최초 1회 SQLite로 idempotent 임포트 후 미사용 |
 | `~/ltcai-agent/` | Agent workspace (agent가 생성한 파일) |
 
 ## 2. 백업 및 복구
@@ -112,8 +117,10 @@ pip install --upgrade ltcai
 
 ### 6.3 데이터 마이그레이션 주의사항
 - `users.json` 스키마 변경 시: 서버가 자동으로 누락 필드를 기본값으로 보완합니다.
-- `history.json` 스키마 변경 시: 하위 호환성 유지. 구버전 레코드는 무시됩니다.
-- `brain/` Knowledge Graph: Markdown 파일 기반이므로 별도 마이그레이션 없음.
+- 대화 히스토리: SQLite 라이브 스토어에 저장됩니다. 레거시 `chat_history.json`은
+  최초 실행 시 1회 idempotent 임포트된 뒤 사용되지 않습니다.
+- `knowledge_graph.sqlite` Knowledge Graph: SQLite 스키마 마이그레이션은 부팅 시
+  적용되며 읽기 호환성/롤백/동등성 테스트로 보호됩니다.
 
 ## 7. 공개 서버 체크리스트
 
@@ -135,7 +142,9 @@ pip install --upgrade ltcai
 - 대화 히스토리는 `user_email` 필드로 필터링됩니다.
 - Agent workspace (`~/ltcai-agent/`)는 현재 단일 공유 디렉토리입니다.  
   멀티 유저 환경에서는 `~/ltcai-agent/<email>/` 구조로 분리를 권장합니다.
-- Knowledge Graph (`brain/`) 역시 단일 공유 공간입니다.
+- Knowledge Graph는 `workspace_id`로 스코프됩니다. 알 수 없는 스코프의 노드는
+  기본 비공개(fail-closed)이며, 레거시 글로벌 읽기는 명시적 호환성 옵트인이
+  있을 때만 허용됩니다.
 
 ## 9. 서버 시작 / 종료
 

package/docs/PERFORMANCE.md

@@ -1,5 +1,13 @@
 # Knowledge Graph Performance Baseline
 
+> **Status: reference** — a synthetic regression baseline, not a
+> current-release measurement. The numbers below were last captured on the
+> v9.6.0 working tree (see provenance line) and are carried forward as the
+> comparison reference. The 9.7.0-9.8.0 line added graph-layer paths
+> (`hybrid_search`, vector freshness, extraction-quality scoring), so
+> regenerate with `scripts/profile_kg.py` on the current tree before treating
+> these as 9.8.0 numbers.
+
 Synthetic performance and memory baseline for `KnowledgeGraphStore`
 (`lattice_brain/graph/`). Measured with `scripts/profile_kg.py`.
 
@@ -34,7 +42,7 @@ Run it:
 .venv/bin/python scripts/profile_kg.py --json          # machine-readable
 ```
 
-## Measured baseline (2026-07-20, v9.6.0 working tree)
+## Measured baseline (last captured on the v9.6.0 working tree)
 
 Apple Silicon (darwin), Python 3.x from `.venv`, SQLite with FTS5 trigram
 available, tracemalloc enabled.

package/docs/SECURITY_AUDIT.md

@@ -0,0 +1,91 @@
+# Security Audit — Static Scan Snapshot
+
+> Status: audit snapshot 2026-07-21
+
+This is a point-in-time static-analysis snapshot for release **v9.8.0**. It
+records exactly which scanners ran, the raw findings, and an honest per-finding
+real-risk assessment. It is not a guarantee of absence of vulnerabilities; it is
+evidence of what the listed tools saw on the listed date.
+
+Related: [CI & Release Gates](CI_AND_RELEASE_GATES.md) documents how these scans
+are wired into continuous integration (`.github/workflows/dependency-audit.yml`).
+
+## Tooling & commands
+
+Scanners were installed into the project virtualenv only (`.venv`), never added
+to runtime dependencies:
+
+```
+.venv/bin/python -m pip install pip-audit bandit
+```
+
+| Tool      | Version | Command |
+|-----------|---------|---------|
+| pip-audit | 2.10.1  | `.venv/bin/python -m pip_audit -r requirements.txt --strict` |
+| pip-audit | 2.10.1  | `.venv/bin/python -m pip_audit` (installed environment) |
+| bandit    | 1.9.4   | `.venv/bin/python -m bandit -r latticeai lattice_brain -ll` |
+| npm audit | (npm 10)| `npm audit --audit-level=high` |
+
+## Dependency vulnerabilities (pip-audit / npm audit)
+
+**Result: no known vulnerabilities.**
+
+- `pip-audit -r requirements.txt --strict` → `No known vulnerabilities found`.
+- `pip-audit` over the installed environment → `No known vulnerabilities found`.
+- `npm audit --audit-level=high` → `found 0 vulnerabilities`.
+
+No dependency version changes were required. Because there were no actual
+vulnerable pins to fix, no dependency files were modified (per the honest-fix
+rule: only fix a real, safe-to-fix issue).
+
+## Static code analysis (bandit)
+
+Scanned **54,795 lines** across `latticeai/` and `lattice_brain/`. With the
+`-ll` display filter (MEDIUM severity and above), bandit reported **80 findings**:
+1 HIGH and 79 MEDIUM. Breakdown by rule:
+
+| Count | Severity | Rule | What it flags |
+|------:|----------|------|---------------|
+| 1  | HIGH   | B324 hashlib | Weak MD5 hash "for security" |
+| 58 | MEDIUM | B608 hardcoded_sql_expressions | SQL built via string formatting |
+| 7  | MEDIUM | B310 blacklist (urlopen) | `urllib.request.urlopen` with unrestricted scheme |
+| 5  | MEDIUM | B604 shell=True | A function called with `shell=True` |
+| 3  | MEDIUM | B108 hardcoded_tmp_directory | Hardcoded `/tmp` path |
+| 3  | MEDIUM | B104 hardcoded_bind_all_interfaces | Bind to `0.0.0.0` |
+| 2  | MEDIUM | B306 blacklist (mktemp) | `tempfile.mktemp()` |
+| 1  | MEDIUM | B615 huggingface_unsafe_download | `hf_hub_download` without a pinned revision |
+
+### Per-finding real-risk assessment
+
+| Rule | Location(s) | Verdict | Rationale |
+|------|-------------|---------|-----------|
+| **B324** MD5 | `lattice_brain/quality.py:44` | **False positive** | MD5 derives a deterministic *pseudo-label* for embedding clusters (`emb_cluster_<hash>`); not used for authentication, integrity, or secrets. Safe cosmetic fix would be `hashlib.md5(..., usedforsecurity=False)`; source is out of this task's edit scope, so documented only. |
+| **B604** shell=True | `latticeai/core/agent.py:539`, `latticeai/core/tool_registry.py:129/136/168/175` | **False positive** | These are `ToolPolicy(..., shell=True, ...)` dataclass *declarations* describing whether a tool is a shell tool — not `subprocess(..., shell=True)` calls. Bandit matches the keyword, not an actual shell invocation. |
+| **B108** /tmp | `lattice_brain/graph/_kg_constants.py:186/215`, `latticeai/core/agent_eval.py:240` | **False positive / benign** | The `_kg_constants` hits are `/tmp` entries in an **exclusion allowlist** of directories to skip during ingestion (a defensive list). The `agent_eval` hit is a test/eval default `agent_root`. No untrusted file is written to a predictable temp path here. |
+| **B104** 0.0.0.0 | `latticeai/cli/entrypoint.py:53/237/238` | **By design, low risk** | The bind switches to `0.0.0.0` only when the operator explicitly passes `--tunnel`; default remains `127.0.0.1`. Intentional and gated. |
+| **B310** urlopen | `latticeai/services/model_engines.py:120/234`, `latticeai/services/model_runtime.py:242` | **Low real risk** | Calls target operator-configured local inference engines (LM Studio / Ollama). URLs are not attacker-controlled in normal use. Recommendation: assert `http(s)` scheme before `urlopen` to close the `file:`/custom-scheme door. |
+| **B608** SQL f-strings | `lattice_brain/storage/postgres.py`, `.../migration.py`, `lattice_brain/graph/*.py`, `lattice_brain/conversations.py` | **Low real risk — review** | Interpolated fragments are overwhelmingly **schema/table identifiers** quoted through `lattice_brain.storage.postgres._quote_ident`, with row *values* passed as bound parameters. Not user-value injection. Standing recommendation: keep every interpolated identifier sourced from internal constants / allowlists, never from request input. |
+| **B306** mktemp | `latticeai/integrations/telegram_bot.py:450/568` | **Real, low severity** | `tempfile.mktemp()` has a documented create-time race; prefer `tempfile.mkstemp()` / `NamedTemporaryFile`. Impact is limited (local temp files for outbound Telegram media), but this is a genuine hardening item for a future source-owning change. |
+| **B615** HF download | `latticeai/services/model_runtime.py:601` | **Real, supply-chain relevant** | `hf_hub_download(...)` is called without `revision=`, so a mutated upstream model repo could serve a different artifact than expected. Recommendation: pin a commit/`revision` (or verify a hash) when fetching model weights. Ties directly into the P2 supply-chain theme. |
+
+## Actions taken vs deferred
+
+- **Fixed:** nothing — no dependency vulnerability existed to fix safely, and
+  the code-level findings live in source files outside this task's edit scope.
+- **Deferred (documented) hardening items**, for a future change that owns the
+  relevant source:
+  1. Pin a `revision` in `model_runtime.py` `hf_hub_download` (B615).
+  2. Replace `tempfile.mktemp()` in `integrations/telegram_bot.py` (B306).
+  3. Validate URL scheme before `urlopen` in the model engine paths (B310).
+  4. Optional cosmetic: `usedforsecurity=False` on the clustering MD5 (B324).
+
+## Limitations (honest)
+
+- Static analysis only. No dynamic/DAST, no fuzzing, no secret-scanning here.
+- bandit reasons syntactically; the false positives above were confirmed by
+  reading each site, not by suppression.
+- pip-audit resolves against the OSV/PyPI advisory database as of the snapshot
+  date; new advisories appear continuously — see the scheduled
+  `dependency-audit` workflow for the ongoing signal.
+- SBOMs (CycloneDX) for both ecosystems can be regenerated with
+  `.venv/bin/python scripts/generate_sbom.py`.

package/docs/TRUST_MODEL.md

@@ -1,6 +1,6 @@
 # Lattice AI Trust Model
 
-Current release: **9.8.0 — Honest Knowledge Pipeline**.
+Current release: **9.9.0 — Fail-Closed Trust**.
 
 Lattice AI is local-first, explicit about external communication, and honest
 when a capability is unavailable.