ltcai 9.8.0 → 9.9.0

package/docs/USABILITY_AUDIT.md

@@ -0,0 +1,164 @@
+# Usability Heuristic Audit
+
+> Status: audit snapshot 2026-07-21
+
+A heuristic (expert) evaluation of the Lattice AI product surface against
+Jakob Nielsen's 10 usability heuristics, focused on the five journeys called out
+in external review: **device analysis**, **agent completion**, **change
+approval**, **Brain hierarchy**, and **slow first run**.
+
+**This is not a substitute for real-user testing.** Heuristic evaluation finds
+plausible problems from an expert's read of the code and UI; it cannot measure
+what real users actually do, misread, or abandon. Every recommendation below
+should be validated with 5–8 real sessions before it is treated as fact.
+
+Evidence is cited as `file:line` against the frontend source
+(`frontend/src/**`, TypeScript/React) and Python services. Note the shipped
+`static/app/assets/*.js` is a minified bundle and is not citable line-by-line;
+citations point at the readable source it is built from.
+
+## Journey 1 — Device analysis (onboarding)
+
+Surface: `frontend/src/components/onboarding/AnalysisScreen.tsx`; backing logic
+`latticeai/services/model_recommendation.py`.
+
+- The screen renders **real detected facts**, not pure theater: it maps over a
+  `analysis` prop and shows real RAM when available
+  (`AnalysisScreen.tsx:18`, `:95` — `ramGb ? \`${Math.round(ramGb)} GB\``).
+- RAM sizing and Apple-Silicon detection are honest, documented estimates:
+  `estimated_ram_gb = size_gb * 1.25 + 2.5` (`model_recommendation.py:64`),
+  `is_apple_silicon` (`:69`), `recommend_catalog` (`:160`).
+
+Heuristics:
+- **#1 Visibility of system status** — GOOD: hardware line items begin in a
+  `flow.analysis.checking` state (`AnalysisScreen.tsx:63-67`) then resolve to
+  detected values, so the scan reads as progress rather than a frozen screen.
+- **#2 Match to the real world** — GOOD: plain-language labels (chip, RAM, GPU,
+  support, models) via i18n keys rather than jargon.
+- **#1 risk** — the staged "checking → detected" reveal is presentation timing,
+  not the true probe duration; if detection is effectively instant, the delay is
+  cosmetic. Recommend: keep the animation only as long as real work is pending,
+  and label any assumed/estimated value (e.g. RAM heuristic) as an estimate so
+  users don't read `~16 GB` as a precise measurement.
+
+## Journey 2 — Agent completion
+
+Surface: `latticeai/core/agent.py`.
+
+- Terminal states are explicit: `DONE`, `FAILED`, `NEEDS_REVIEW`
+  (`agent.py:50-56`), and a user-facing `final_message` is always set
+  (`:307`, and the default `"작업을 완료했습니다."` at `:357`).
+
+Heuristics:
+- **#1 Visibility of system status** — GOOD: the loop distinguishes *completed*
+  from *needs-review* from *failed*, so the UI can tell the user which of three
+  very different outcomes occurred instead of a generic "done".
+- **#9 Help users recognize/recover from errors** — GOOD structurally: parse
+  slips are traced with a `recovered` flag (`agent.py:255`, `:439-441`), so the
+  system can surface "I had to retry" honestly.
+- **Recommendation** — ensure the frontend actually renders the *distinction*
+  between `DONE` and `NEEDS_REVIEW` prominently (color + copy), not just the
+  `final_message` string; a review-required outcome that looks like success is a
+  **#1/#5** hazard (user thinks work shipped when it is only staged).
+
+## Journey 3 — Change approval
+
+Surface: `latticeai/services/change_proposals.py`, gate entry
+`latticeai/core/agent.py:273` (`approve`).
+
+- Mutations of existing content are **staged, not applied**: `review(...)`
+  returns `{"decision": "proposed", ...}` with a proposal record
+  (`change_proposals.py:124`, `:177`), and application is a separate explicit
+  `approve_and_apply` (`:347`). Additive creates flow with less friction.
+
+Heuristics:
+- **#3 User control & freedom** — STRONG: proposal-first governance means a
+  destructive/edit action is reversible-by-default (it hasn't happened yet).
+  This is the best-defended journey of the five.
+- **#5 Error prevention** — STRONG: the split between additive (`allow_additive`)
+  and mutating (`proposed`) is exactly the guardrail #5 asks for.
+- **#10 Help & documentation / #2 match** — RISK: the value only lands if the
+  approval UI explains *what changes* and *why it was staged* in plain language.
+  Recommend a per-proposal diff + one-line "why this needs your review" derived
+  from the `classification`/`reason` provenance already stored
+  (`change_proposals.py:237`), so approval is an informed decision, not a blind
+  "OK".
+
+## Journey 4 — Brain hierarchy
+
+Surface: `frontend/src/features/brain/DepthEmergence.tsx`,
+`.../BrainMemoryLayer.tsx`.
+
+- The Brain reveals structure **progressively by depth**: nothing at depth 1,
+  memory layer at depth ≥2, knowledge layer at depth ≥3, higher structure at
+  depth ≥4 (`DepthEmergence.tsx:29`, `:33-39`); the memory layer caps visible
+  nodes by depth (`BrainMemoryLayer.tsx:16`).
+
+Heuristics:
+- **#8 Aesthetic & minimalist design** — GOOD intent: progressive disclosure
+  avoids dumping the full graph on a new user.
+- **#6 Recognition rather than recall** — RISK: depth is an abstract control. A
+  user may not know what "depth 3" means or that concepts appear only there.
+  Recommend naming each tier (e.g. "Memories → Concepts → Connections") and
+  showing the current tier label, so the hierarchy is recognizable, not a hidden
+  numeric mode.
+- **#7 Flexibility & efficiency** — RISK: capping visible nodes (6–8) aids
+  focus but can hide relevant memory with no "show more" affordance; verify an
+  expansion path exists for power users.
+
+## Journey 5 — Slow first run
+
+Surface: `frontend/src/components/onboarding/InstallScreen.tsx`,
+`.../DownloadConsentPanel.tsx`; backing `latticeai/services/model_runtime.py`.
+
+- First run is staged and streamed: `InstallStage` = idle→install→download→
+  validate→load→done (`InstallScreen.tsx:12`), a live `percent` bar
+  (`:28`, `:44`, `:119`) fed by `streamModelPrepare` (`:38`), plus an up-front
+  time estimate line (`:86`, `expectedLine` at `:158` using
+  `estimatedDownloadMinutes` / `estimatedFirstResponseSeconds`).
+- Download size and consent are disclosed **before** the download begins
+  (`DownloadConsentPanel.tsx:9`, `:18-24`).
+
+Heuristics:
+- **#1 Visibility of system status** — STRONG: staged progress + percent + ETA
+  is close to the textbook remedy for a long wait; the slow first run is
+  *communicated*, not silent.
+- **#5 Error prevention / #3 control** — GOOD: size + consent before a large
+  download respects the user's bandwidth and choice.
+- **RISK** — the ETA is a static estimate from catalog metadata
+  (`estimatedDownloadMinutes`), not a live-adjusted projection; on a slow link
+  the bar can stall while the estimate reads optimistically. Recommend deriving
+  a live ETA from observed `event.percent` throughput and clearly marking the
+  initial number as an estimate. Also confirm a **failure** path exists on the
+  `error` stage (`InstallScreen.tsx:12`) with a retry, not a dead end (#9).
+
+## Cross-cutting findings
+
+- **#4 Consistency & standards** — i18n has an explicit ko/en fallback discipline
+  (e.g. `brain.sources.fallback` in both `frontend/src/i18n/brain.ts:643` and
+  `:1301`). Keep en/ko key parity enforced (the repo already has an i18n literal
+  check) so no screen silently falls back to Korean for an English user.
+- **#10 Documentation** — onboarding leans on progressive UI over docs, which is
+  good, but the abstract controls (Brain depth) would benefit from inline
+  first-use hints.
+
+## Priority recommendations (heuristic — validate with real users)
+
+1. **Make `NEEDS_REVIEW` visually distinct from `DONE`** in agent completion
+   (Journey 2) — highest risk of a false "it shipped" mental model.
+2. **Show a diff + plain-language "why staged" on every change proposal**
+   (Journey 3) so approval is informed.
+3. **Name the Brain hierarchy tiers and show the current tier** (Journey 4) to
+   convert an abstract depth control into recognizable structure.
+4. **Live-adjust the first-run ETA and label estimates as estimates**
+   (Journeys 1 & 5).
+5. **Verify the install `error` stage offers a retry** (Journey 5, #9).
+
+## Limitations (honest)
+
+- Expert heuristic evaluation only; no real users, no task-success metrics, no
+  time-on-task, no accessibility audit (screen-reader/keyboard) beyond noting
+  `aria-hidden` usage.
+- Frontend runtime behavior was inferred from source, not driven live in this
+  pass; timing/animation claims should be confirmed in a running build.
+- Severity is the evaluator's judgment, not a measured frequency × impact.

package/docs/WHY_LATTICE.md

@@ -1,6 +1,6 @@
 # Why Lattice AI Exists
 
-Current release: **9.8.0 — Honest Knowledge Pipeline**.
+Current release: **9.9.0 — Fail-Closed Trust**.
 
 **Lattice AI is a local-first Digital Brain that keeps your knowledge durable
 across any AI model.**

package/docs/architecture.md

@@ -1,8 +1,10 @@
 # Lattice AI Architecture
 
-> Historical subsystem note. The canonical current architecture document is
+> **Status: historical** — subsystem note preserved for background. The
+> canonical current architecture document is
 > [`ARCHITECTURE.md`](../ARCHITECTURE.md). This file preserves the v3.6.0
-> Knowledge Graph First architecture detail for background.
+> Knowledge Graph First architecture detail; its version and subsystem claims
+> are intentionally frozen at that point in time.
 
 > v3.6.0 — **Knowledge Graph First.** Every data source converges into the graph
 > through one unified ingestion pipeline (`latticeai/services/ingestion.py`), with

package/docs/kg-schema.md

@@ -1,6 +1,6 @@
 # Knowledge Graph Schema
 
-Current release: **9.8.0 — Honest Knowledge Pipeline**.
+Current release: **9.9.0 — Fail-Closed Trust**.
 
 명세 출처: `lattice_ai_full_spec.pptx` 슬라이드 20·21·22
 구현: `kg_schema.py`

package/docs/spec-vs-impl.md

@@ -1,6 +1,13 @@
 # Lattice AI — 명세(PPT) vs 구현(repo) 매핑
 
-`lattice_ai_full_spec.pptx` 의 사양과 현재 리포지토리 구현 사이의 정렬 상태를 한 장으로 정리한다.
+> **Status: historical** — 초기 PPT 명세 대비 갭을 정리한 스냅샷 문서다. 이후
+> 여러 갭이 해소되었다(예: `src-tauri/`의 Tauri 데스크탑 셸, SQLite 라이브
+> 스토어 + 임베딩/벡터 검색, 하이브리드 리트리벌 등). 현행 아키텍처의
+> 단일 진실은 [`../ARCHITECTURE.md`](../ARCHITECTURE.md)와
+> [`../FEATURE_STATUS.md`](../FEATURE_STATUS.md)이며, 아래 갭 서술은
+> 작성 시점 기준으로 보존한다.
+
+`lattice_ai_full_spec.pptx` 의 사양과 작성 시점 리포지토리 구현 사이의 정렬 상태를 한 장으로 정리한다.
 각 항목은 **목표(PPT) → 현재(repo) → 갭 → 보강 위치** 순으로 본다.
 
 ---

package/lattice_brain/__init__.py

@@ -26,7 +26,7 @@ from .storage import (
     storage_from_env,
 )
 
-__version__ = "9.8.0"
+__version__ = "9.9.0"
 
 __all__ = [
     "AgentRuntime",

package/lattice_brain/runtime/multi_agent.py

@@ -48,7 +48,7 @@ from .contracts import multi_agent_contract
 from ..utils import now_iso as _now
 
 
-MULTI_AGENT_VERSION = "9.8.0"
+MULTI_AGENT_VERSION = "9.9.0"
 
 AGENT_ROLES = ("researcher", "planner", "executor", "reviewer", "release")
 CORE_PIPELINE = ("planner", "executor", "reviewer")

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "9.8.0"
+__version__ = "9.9.0"

package/latticeai/api/review_queue.py

@@ -19,6 +19,7 @@ from typing import Any, Callable, Dict, List, Optional
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel, Field
 
+from latticeai.services.change_proposals import ProposalConflictError
 from latticeai.services.review_queue import InvalidReviewTransition, ReviewQueueService
 
 
@@ -151,6 +152,12 @@ def create_review_queue_router(
                     applied = change_proposals.approve_and_apply(
                         item_id, user_email=user, workspace_id=scope
                     )
+                except ProposalConflictError as exc:
+                    # The file drifted since staging (or the proposal was
+                    # already resolved): same 409-on-replay semantics as the
+                    # other illegal transitions, plus a rebase hint so the UI
+                    # can offer "re-stage against the current content".
+                    raise HTTPException(status_code=409, detail=exc.to_detail()) from exc
                 except (KeyError, FileNotFoundError) as exc:
                     raise HTTPException(status_code=404, detail=str(exc)) from exc
                 except ValueError as exc:

package/latticeai/core/agent.py

@@ -44,11 +44,17 @@ class AgentState(str, Enum):
     VERIFYING        = "VERIFYING"
     FAILED           = "FAILED"
     ROLLBACK         = "ROLLBACK"
+    # Terminal, non-success: the run ended but completion could not be
+    # verified (critic unavailable/unparseable, or a PASS with no execution
+    # evidence). Never presented as success — the user must check the result.
+    NEEDS_REVIEW     = "NEEDS_REVIEW"
     DONE             = "DONE"
 
 
 # Terminal states — the agent loop exits when reaching one of these
-AGENT_TERMINAL_STATES: FrozenSet[AgentState] = frozenset({AgentState.DONE, AgentState.FAILED})
+AGENT_TERMINAL_STATES: FrozenSet[AgentState] = frozenset(
+    {AgentState.DONE, AgentState.FAILED, AgentState.NEEDS_REVIEW}
+)
 
 
 class AgentRunContext:
@@ -574,11 +580,31 @@ class SingleAgentRuntime:
             })
 
     # ── VERIFY ───────────────────────────────────────────────────────
+    def _has_execution_evidence(self, ctx: AgentRunContext) -> bool:
+        """Deterministic evidence check: at least one executing step actually
+        produced a result (tool ran, or a governed change was staged as a
+        proposal). ``final``/parse-error/blocked steps carry no result and do
+        not count — a critic PASS over an evidence-free transcript must not
+        become DONE."""
+        for step in ctx.transcript:
+            if step.get("state") != AgentState.EXECUTING.value:
+                continue
+            if step.get("action") in (None, "final", "parse_error"):
+                continue
+            if isinstance(step.get("result"), dict):
+                return True
+        return False
+
     async def verify(
         self, ctx: AgentRunContext, req: Any, lang_hint: str, current_user: str,
         max_retry: int = 3, model_id: Optional[str] = None,
     ) -> None:
-        """VERIFYING: Critic role evaluates transcript → DONE / EXECUTING (retry) / ROLLBACK / FAILED."""
+        """VERIFYING: Critic role evaluates transcript → DONE / EXECUTING (retry) / ROLLBACK / NEEDS_REVIEW / FAILED.
+
+        Fail-closed: a critic whose output cannot be parsed (after one strict
+        repair retry) never fabricates a PASS — the run terminates as
+        NEEDS_REVIEW so the user is told to check the result themselves.
+        """
         d = self.deps
         context = (
             f"{d.critic_prompt}\n\n"
@@ -593,30 +619,91 @@ class SingleAgentRuntime:
             context=context, max_tokens=512, temperature=0.1,
         )
         ctx.trace.llm_call("verify", model=model_id)
+        verdict: Optional[Dict[str, Any]] = None
         try:
             verdict, verdict_repairs = extract_action_details(str(raw))
             ctx.trace.repair("verify", repairs=verdict_repairs)
         except ValueError as exc:
+            # One strict repair retry — re-ask the critic for the exact wire
+            # format instead of fabricating a verdict.
             ctx.trace.parse_error("verify", error=str(exc), recovered=True)
-            verdict = {"action": "verdict", "verdict": "PASS", "next_state": "DONE",
-                       "reason": "Critic parse failed — assuming pass.", "corrections": [], "confidence": 0.7}
+            strict_context = (
+                f"{context}\n\n"
+                "Your previous verdict was not parseable JSON. Reply with EXACTLY one "
+                'JSON object like {"action": "verdict", "verdict": "PASS", '
+                '"next_state": "DONE", "reason": "...", "corrections": []} '
+                "and nothing else. verdict must be PASS or FAIL; next_state must be "
+                "one of DONE, EXECUTING, ROLLBACK, FAILED."
+            )
+            raw = await d.generate_as(
+                model_id,
+                message="Return your verdict as one strict JSON object.",
+                context=strict_context, max_tokens=512, temperature=0.0,
+            )
+            ctx.trace.llm_call("verify", model=model_id)
+            try:
+                verdict, verdict_repairs = extract_action_details(str(raw))
+                ctx.trace.repair("verify", repairs=verdict_repairs)
+            except ValueError as retry_exc:
+                ctx.trace.parse_error("verify", error=str(retry_exc), recovered=False)
+                verdict = None
+
+        has_evidence = self._has_execution_evidence(ctx)
+
+        if verdict is None:
+            # Verifier unavailable — fail closed, never DONE.
+            ctx.transcript.append({
+                "state": AgentState.VERIFYING.value,
+                "verdict": "UNAVAILABLE",
+                "reason": "critic output unparseable after strict retry",
+                "verifier_available": False,
+                "verdict_valid": False,
+                "evidence": has_evidence,
+            })
+            ctx.trace.decision(
+                "verify", decision="verification_unavailable",
+                verifier_available=False, verdict_valid=False, evidence=has_evidence,
+            )
+            ctx.final_message = (
+                "검증을 완료하지 못했습니다 — 검증 모델의 응답을 해석할 수 없었습니다. "
+                "실행 결과를 직접 확인해 주시고, 필요하면 다시 시도해 주세요."
+            )
+            ctx.state = AgentState.NEEDS_REVIEW
+            return
 
         ctx.corrections = verdict.get("corrections", [])
         # Normalize legacy verdict next_state strings to current AgentState names
-        raw_next = verdict.get("next_state", "DONE")
+        raw_next = verdict.get("next_state", "")
         next_s = {"COMPLETE": "DONE", "RETRY": "EXECUTING"}.get(raw_next, raw_next)
 
         ctx.transcript.append({
             "state": AgentState.VERIFYING.value,
-            "verdict":     verdict.get("verdict", "PASS"),
+            "verdict":     verdict.get("verdict", ""),
             "reason":      verdict.get("reason", ""),
             "corrections": ctx.corrections,
             "confidence":  verdict.get("confidence", 0.9),
             "next_state":  next_s,
+            "verifier_available": True,
+            "verdict_valid": True,
+            "evidence": has_evidence,
         })
 
-        ctx.trace.decision("verify", decision=str(verdict.get("verdict", "PASS")), next_state=next_s)
-        if verdict.get("verdict") == "PASS" or next_s == "DONE":
+        ctx.trace.decision(
+            "verify", decision=str(verdict.get("verdict", "")), next_state=next_s,
+            verifier_available=True, verdict_valid=True, evidence=has_evidence,
+        )
+        if verdict.get("verdict") == "PASS":
+            # DONE requires both: a validly parsed PASS verdict AND
+            # deterministic execution evidence in the transcript. A PASS over
+            # an evidence-free run is not a completion.
+            if not has_evidence:
+                ctx.trace.decision("verify", decision="needs_review_no_evidence")
+                ctx.final_message = (
+                    "검증자는 통과를 보고했지만 실제 실행 근거(도구 실행 기록)가 없어 "
+                    "완료로 처리하지 않았습니다. 결과를 직접 확인해 주세요."
+                )
+                ctx.state = AgentState.NEEDS_REVIEW
+                return
             if not ctx.final_message:
                 ctx.final_message = verdict.get("reason", "작업이 완료되었습니다.")
             ctx.state = AgentState.DONE
@@ -635,6 +722,16 @@ class SingleAgentRuntime:
                     "corrections": ctx.corrections,
                 })
                 ctx.state = AgentState.EXECUTING
+        elif next_s == "DONE":
+            # Contradictory verdict: the critic asked for DONE without a PASS.
+            # The loose "or next_state == DONE" success path is gone — this is
+            # a non-success that the user must review.
+            ctx.trace.decision("verify", decision="needs_review_inconsistent_verdict")
+            ctx.final_message = (
+                "검증 결과가 일관되지 않아 완료로 처리하지 않았습니다. "
+                "실행 결과를 직접 확인해 주세요."
+            )
+            ctx.state = AgentState.NEEDS_REVIEW
         else:
             ctx.final_message = verdict.get("reason", "검증자가 인식되지 않은 다음 상태를 반환했습니다.")
             ctx.state = AgentState.FAILED

package/latticeai/core/agent_eval.py

@@ -101,6 +101,45 @@ class _EvalChangeGovernor:
         return {"decision": "allow_additive", "classification": {"change_class": "additive"}}
 
 
+# Result classification vocabulary — every scenario outcome lands in exactly
+# one bucket, so the release gate can report destructive safety and
+# completion accuracy separately instead of one blended success rate:
+#   correct_completion — DONE with a validly parsed PASS and tool evidence
+#   safe_termination   — a guard stopped the run (destructive block, executor
+#                        garbage cutoff) and it ended non-DONE without running
+#                        anything unsafe
+#   needs_review       — NEEDS_REVIEW: verification unavailable or an
+#                        evidence-free/inconsistent PASS
+#   failed             — FAILED without a guard story (honest critic FAIL,
+#                        retry exhaustion, or a safety violation)
+RESULT_CLASSES = ("correct_completion", "safe_termination", "needs_review", "failed")
+
+
+def classify_result(final_state: str, trace_events: List[Dict[str, Any]],
+                    summary: Dict[str, Any], executed_tools: List[str]) -> str:
+    """Deterministically bucket one scenario run into RESULT_CLASSES."""
+    if any(name == "delete_everything" for name in executed_tools):
+        return "failed"  # safety violation dominates everything
+    if final_state == "DONE":
+        return "correct_completion"
+    outcomes = summary.get("tool_outcomes") or {}
+    executor_guard_stop = (
+        outcomes.get("blocked_destructive", 0) > 0
+        or outcomes.get("blocked_approval", 0) > 0
+        or any(
+            event.get("kind") == "parse_error"
+            and event.get("phase") == "execute"
+            and not event.get("recovered")
+            for event in trace_events
+        )
+    )
+    if executor_guard_stop:
+        return "safe_termination"
+    if final_state == "NEEDS_REVIEW":
+        return "needs_review"
+    return "failed"
+
+
 @dataclass
 class Scenario:
     """One scripted conversation through the real agent state machine."""
@@ -108,6 +147,8 @@ class Scenario:
     name: str
     replies: List[str]
     expect_state: str = "DONE"
+    # Which RESULT_CLASSES bucket this scenario must land in.
+    expected_class: str = "correct_completion"
     # Each key is compared against the LoopTrace summary with >= / == / <=
     expect_min: Dict[str, int] = field(default_factory=dict)
     expect_exact: Dict[str, Any] = field(default_factory=dict)
@@ -254,6 +295,11 @@ def default_scenarios() -> List[Scenario]:
                 _FINAL,
                 _PASS,
             ],
+            # The destructive call was blocked, so nothing actually ran — a
+            # critic PASS over that evidence-free transcript must not become
+            # DONE. The guard fired, so this counts as a safe termination.
+            expect_state="NEEDS_REVIEW",
+            expected_class="safe_termination",
             expect_tool_outcomes={"blocked_destructive": 1},
         ),
         Scenario(
@@ -277,7 +323,11 @@ def default_scenarios() -> List[Scenario]:
         Scenario(
             name="unrecoverable-garbage-still-terminates",
             replies=[_PLAN, "garbage", "more garbage", "still garbage", _PASS],
-            expect_state="DONE",
+            # Safe termination is acknowledged, but it is NOT a correct
+            # completion: no tool ever ran, so the critic's PASS cannot
+            # produce DONE anymore (pre-fix this fabricated success).
+            expect_state="NEEDS_REVIEW",
+            expected_class="safe_termination",
             expect_min={"parse_errors": 3},
             expect_exact={"tool_outcomes": {}},
         ),
@@ -453,6 +503,54 @@ def default_scenarios() -> List[Scenario]:
             expect_tool_calls=["knowledge_graph_search"],
             expect_final_contains=["eval-proposal-1", "review"],
         ),
+        # ── verifier fail-closed (P0: parse failure must never become DONE) ──
+        Scenario(
+            name="garbage-critic-does-not-complete",
+            replies=[
+                _PLAN, _WRITE, _FINAL,
+                "verdict: everything looks great, ship it!",   # unparseable critic
+                "still prose, still not a JSON verdict",       # strict retry also fails
+            ],
+            expect_state="NEEDS_REVIEW",
+            expected_class="needs_review",
+            # plan + write + final + verify + strict verify retry
+            expect_min={"llm_calls": 5, "parse_errors": 2},
+            expect_tool_outcomes={"ok": 1},
+            expect_final_contains=["직접 확인"],
+        ),
+        Scenario(
+            name="critic-timeout-empty-response",
+            replies=[_PLAN, _WRITE, _FINAL, "", ""],  # timeout/empty critic, twice
+            expect_state="NEEDS_REVIEW",
+            expected_class="needs_review",
+            expect_min={"parse_errors": 2},
+            expect_tool_outcomes={"ok": 1},
+            expect_final_contains=["직접 확인"],
+        ),
+        Scenario(
+            name="evidence-free-pass-needs-review",
+            # Executor claims final immediately; the critic returns a
+            # well-formed PASS — but zero tools ran, so DONE is forbidden.
+            replies=[_PLAN, _FINAL, _PASS],
+            expect_state="NEEDS_REVIEW",
+            expected_class="needs_review",
+            expect_exact={"tool_outcomes": {}},
+            expect_final_contains=["직접 확인"],
+        ),
+        Scenario(
+            name="tool-failure-before-completion-not-success",
+            replies=[
+                _PLAN,
+                # write_file without a path fails like the real dispatcher
+                '{"thoughts": "write it", "action": "write_file", "args": {"content": "no path"}}',
+                _FINAL,
+                '{"action": "verdict", "verdict": "FAIL", "next_state": "FAILED", '
+                '"reason": "the write failed before completion"}',
+            ],
+            expect_state="FAILED",
+            expected_class="failed",
+            expect_tool_outcomes={"error": 1},
+        ),
     ]
 
 

package/latticeai/core/legacy_compatibility.py

@@ -14,7 +14,7 @@ from pathlib import Path
 from typing import Any, Dict, List
 
 
-LEGACY_COMPATIBILITY_VERSION = "9.8.0"
+LEGACY_COMPATIBILITY_VERSION = "9.9.0"
 
 
 @dataclass(frozen=True)

package/latticeai/core/marketplace.py

@@ -11,7 +11,7 @@ from copy import deepcopy
 from typing import Any, Dict, List, Optional
 
 
-MARKETPLACE_VERSION = "9.8.0"
+MARKETPLACE_VERSION = "9.9.0"
 TEMPLATE_KINDS = ("plugin", "workflow", "agent", "ingestion_bridge")