ltcai 9.9.1 → 9.9.2

package/README.md

@@ -11,7 +11,7 @@
 [![CI Status](https://github.com/TaeSooPark-PTS/LatticeAI/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/TaeSooPark-PTS/LatticeAI/actions/workflows/ci.yml)
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 
-![v9.9.1 Living Brain walkthrough](output/release/v9.9.1/gifs/v9.9.1-living-brain-walkthrough.gif)
+![v9.9.2 Living Brain walkthrough](output/release/v9.9.2/gifs/v9.9.2-living-brain-walkthrough.gif)
 
 Chat, files, folders, notes, and web pages all flow into one durable knowledge
 graph on your computer. Any model — local MLX or cloud — can speak with that
@@ -24,9 +24,9 @@ memory. Nothing leaves your machine without explicit consent.
 
 | | |
 | --- | --- |
-| **Chat with a Brain that remembers** — every conversation grows durable, source-linked memory ![Brain Chat](output/release/v9.9.1/screenshots/04-brain-chat-home.png) | **See how knowledge connects** — a real relationship graph, not a file list ![Memory Graph](output/release/v9.9.1/screenshots/05-memory-graph.png) |
-| **Capture anything** — files, whole folders, notes, screenshots, web pages ![Capture](output/release/v9.9.1/screenshots/06-capture.png) | **Automate with review** — agent changes become proposals you approve first ![Review Center](output/release/v9.9.1/screenshots/12-review-center.png) |
-| **Pick a model in one click** — recommended local models for your hardware ![Recommended Models](output/release/v9.9.1/screenshots/02-recommended-models.png) | **Stay in control** — audit, roles, retention in a separate admin surface ![Admin Console](output/release/v9.9.1/screenshots/10-admin-console.png) |
+| **Chat with a Brain that remembers** — every conversation grows durable, source-linked memory ![Brain Chat](output/release/v9.9.2/screenshots/04-brain-chat-home.png) | **See how knowledge connects** — a real relationship graph, not a file list ![Memory Graph](output/release/v9.9.2/screenshots/05-memory-graph.png) |
+| **Capture anything** — files, whole folders, notes, screenshots, web pages ![Capture](output/release/v9.9.2/screenshots/06-capture.png) | **Automate with review** — agent changes become proposals you approve first ![Review Center](output/release/v9.9.2/screenshots/12-review-center.png) |
+| **Pick a model in one click** — recommended local models for your hardware ![Recommended Models](output/release/v9.9.2/screenshots/02-recommended-models.png) | **Stay in control** — audit, roles, retention in a separate admin surface ![Admin Console](output/release/v9.9.2/screenshots/10-admin-console.png) |
 
 ## Why Lattice AI
 
@@ -57,14 +57,14 @@ First-run flow — wake the Brain, pick the owner, load a recommended model:
 
 | | | |
 | --- | --- | --- |
-| ![Login](output/release/v9.9.1/screenshots/01-login.png) | ![Model install](output/release/v9.9.1/screenshots/03-install-load-progress.png) | ![Model library](output/release/v9.9.1/screenshots/07-model-library.png) |
+| ![Login](output/release/v9.9.2/screenshots/01-login.png) | ![Model install](output/release/v9.9.2/screenshots/03-install-load-progress.png) | ![Model library](output/release/v9.9.2/screenshots/07-model-library.png) |
 
 Screenshot index and capture notes:
-[output/release/v9.9.1/SCREENSHOT_INDEX.md](output/release/v9.9.1/SCREENSHOT_INDEX.md)
+[output/release/v9.9.2/SCREENSHOT_INDEX.md](output/release/v9.9.2/SCREENSHOT_INDEX.md)
 
 ## Current Release
 
-The current release is **9.9.1 — Clean Foundations**:
+The current release is **9.9.2 — Artifact Trust**:
 
 - **A clean core.** The historical repo-root compatibility shims are gone
   (only `server.py` remains for `uvicorn server:app`); packaging ships exactly
@@ -93,13 +93,13 @@ The current release is **9.9.1 — Clean Foundations**:
 
 Release notes: [RELEASE.md](RELEASE.md) · Full history: [docs/CHANGELOG.md](docs/CHANGELOG.md)
 
-Expected artifacts for 9.9.1 release must use exact filenames:
+Expected artifacts for 9.9.2 release must use exact filenames:
 
-- `dist/ltcai-9.9.1-py3-none-any.whl`
-- `dist/ltcai-9.9.1.tar.gz`
-- `ltcai-9.9.1.tgz`
-- `dist/ltcai-9.9.1.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_9.9.1_aarch64.dmg`
+- `dist/ltcai-9.9.2-py3-none-any.whl`
+- `dist/ltcai-9.9.2.tar.gz`
+- `ltcai-9.9.2.tgz`
+- `dist/ltcai-9.9.2.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_9.9.2_aarch64.dmg`
 
 Do not use wildcard artifact uploads. Package registry publishing remains owner-run.
 
@@ -119,7 +119,7 @@ See [ARCHITECTURE.md](ARCHITECTURE.md) for details and
 
 - External package registries are owner-published and can lag behind GitHub.
 - PostgreSQL/pgvector is optional scale/migration tooling. SQLite remains the
-  live local Brain store in 9.9.1.
+  live local Brain store in 9.9.2.
 - Docker, model downloads, cloud model calls, Telegram, Brain Network, and
   update checks require explicit user action.
 - Conversation does not fabricate answers when no model is loaded. Agent and
@@ -131,6 +131,7 @@ See [ARCHITECTURE.md](ARCHITECTURE.md) for details and
 
 | Version | Theme |
 | --- | --- |
+| 9.9.2 | Artifact Trust |
 | 9.9.1 | Clean Foundations |
 | 9.9.0 | Fail-Closed Trust |
 | 9.8.0 | Honest Knowledge Pipeline |

package/docs/CHANGELOG.md

@@ -4,6 +4,42 @@ The top entry is either the current unreleased main-branch work or the current
 release line. Older entries are historical and may describe behavior as it
 existed at that release.
 
+## [9.9.2] - 2026-07-21
+
+### Added
+- ArtifactWritePipeline: `sanitize_write_content` in
+  `latticeai/core/file_generation.py` — a conservative validate-first →
+  extract → repair gate. The agent executor applies it to every `write_file`
+  `args.content` before dispatch, records a `content_sanitize` verdict on the
+  transcript, and tags `artifact_sanitize`/`artifact_repair` in the loop trace.
+- Artifact-first chat contract: direct file-creation responses and agent runs
+  carry an `artifacts[]` array (`kind/path/filename/bytes/previewable/valid/
+  repaired`) via `collect_artifacts(transcript)`.
+- Direct-path overwrite protection: an existing target is auto-suffixed
+  (`generated_page_2.html`) and announced, instead of silently overwritten.
+- Generated files are optionally indexed into the Brain through the unified
+  `IngestionPipeline` (`workspace://` provenance, `origin: generated_file`);
+  disable with `LATTICEAI_INGEST_GENERATED=0`. The response reports an honest
+  `brain_ingest` status; ingest failures never fail the file creation.
+- Plan schema enforcement (`normalize_plan`): non-empty goal, junk-step
+  filtering, `estimated_steps` clamping, and a deterministic single
+  `write_file` step for file-intent requests whose plan came back empty.
+- Memory quality filter (`filter_learnings`): trivial and duplicate agent
+  learnings are dropped before entering the Brain.
+- FG harness `tests/unit/test_artifact_write_scenarios.py` (FG-01..FG-08):
+  intent gating, filename inference, dirty-output extraction, truncated-HTML
+  repair, agent-path sanitization, how-to non-routing, scaffold validity.
+- Frontend honesty surfaces: "Auto-repaired" badge on file cards
+  (`generation.repaired`), and a distinct warning strip for `NEEDS_REVIEW` /
+  `FAILED` terminal agent states (`role="alert"`, ko/en, dark/light).
+
+### Changed
+- HTML file validation now rejects documents wrapped in prose or Markdown
+  fences, so extraction gets a chance to slice out the real document instead
+  of the wrapper being saved as "valid".
+- `product_readiness` `action-aware-chat` gate additionally proves the
+  ArtifactWritePipeline evidence (module, agent seam, FG harness test).
+
 ## [9.9.1] - 2026-07-21
 
 ### Removed

package/docs/COMMUNITY_AND_PLUGINS.md

@@ -1,6 +1,6 @@
 # Community And Plugins
 
-Current release: **9.9.1 — Clean Foundations**.
+Current release: **9.9.2 — Artifact Trust**.
 
 LatticeAI defines the path from a strong local-first framework (8.4.0
 action-aware baseline, 8.5.0 registry+DI hardening, 8.6.0 capture/navigation

package/docs/DEVELOPMENT.md

@@ -3,7 +3,7 @@
 > **Status: canonical** — current contributor guidance, kept in sync with the
 > current release.
 
-Current release: **9.9.1 — Clean Foundations**.
+Current release: **9.9.2 — Artifact Trust**.
 
 This document is for contributors working on the local-first Digital Brain
 codebase. Product positioning and quick start stay in `README.md`; release

package/docs/ONBOARDING.md

@@ -1,6 +1,6 @@
 # Lattice AI Onboarding
 
-Current release: **9.9.1 — Clean Foundations**.
+Current release: **9.9.2 — Artifact Trust**.
 
 The first-run goal is a five-minute path from "I opened the app" to "my Brain
 has a source, a question, and proof." This page is the product contract behind

package/docs/OPERATIONS.md

@@ -1,4 +1,4 @@
-# Lattice AI — Operations Guide (v9.9.1)
+# Lattice AI — Operations Guide (v9.9.2)
 
 > **Status: canonical** — kept in sync with the current release. Storage layout
 > below reflects the SQLite live Brain store and workspace scoping, not the

package/docs/TRUST_MODEL.md

@@ -1,6 +1,6 @@
 # Lattice AI Trust Model
 
-Current release: **9.9.1 — Clean Foundations**.
+Current release: **9.9.2 — Artifact Trust**.
 
 Lattice AI is local-first, explicit about external communication, and honest
 when a capability is unavailable.

package/docs/WHY_LATTICE.md

@@ -1,6 +1,6 @@
 # Why Lattice AI Exists
 
-Current release: **9.9.1 — Clean Foundations**.
+Current release: **9.9.2 — Artifact Trust**.
 
 **Lattice AI is a local-first Digital Brain that keeps your knowledge durable
 across any AI model.**

package/docs/kg-schema.md

@@ -1,6 +1,6 @@
 # Knowledge Graph Schema
 
-Current release: **9.9.1 — Clean Foundations**.
+Current release: **9.9.2 — Artifact Trust**.
 
 명세 출처: `lattice_ai_full_spec.pptx` 슬라이드 20·21·22
 구현: `lattice_brain/graph/schema.py`

package/lattice_brain/__init__.py

@@ -26,7 +26,7 @@ from .storage import (
     storage_from_env,
 )
 
-__version__ = "9.9.1"
+__version__ = "9.9.2"
 
 __all__ = [
     "AgentRuntime",

package/lattice_brain/runtime/multi_agent.py

@@ -48,7 +48,7 @@ from .contracts import multi_agent_contract
 from ..utils import now_iso as _now
 
 
-MULTI_AGENT_VERSION = "9.9.1"
+MULTI_AGENT_VERSION = "9.9.2"
 
 AGENT_ROLES = ("researcher", "planner", "executor", "reviewer", "release")
 CORE_PIPELINE = ("planner", "executor", "reviewer")

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "9.9.1"
+__version__ = "9.9.2"

package/latticeai/api/chat.py

@@ -208,6 +208,7 @@ def create_chat_router(context: AppContext) -> APIRouter:
         execute_tool=execute_tool,
         agent_controller=agent_controller,
         agent_root=AGENT_ROOT,
+        ingestion_pipeline=context.ingestion_pipeline,
     )
     document_coordinator = DocumentGenerationCoordinator(
         model_router=model_router,
@@ -276,6 +277,8 @@ def create_chat_router(context: AppContext) -> APIRouter:
             direct_response = await intent_controller.direct_file_action(
                 req,
                 model_id=selected_model_id,
+                effective_email=effective_email,
+                workspace_id=workspace_id,
             )
             if direct_response is not None:
                 return direct_response

package/latticeai/api/chat_agent_http.py

@@ -18,7 +18,7 @@ from lattice_brain.runtime.hooks import dispatch_tool
 from latticeai.api.chat_contracts import AgentEvalRequest, AgentRequest, AgentResumeRequest
 from latticeai.api.chat_helpers import _LANG_HINT, detect_language, workspace_scope_from_request
 from latticeai.core.agent import AgentRunContext, AgentState
-from latticeai.services.tool_dispatch import collect_created_files
+from latticeai.services.tool_dispatch import collect_artifacts, collect_created_files
 
 
 class AgentHTTPController:
@@ -307,6 +307,7 @@ class AgentHTTPController:
             "state_history": ctx.state_history,
             "final_state": ctx.state.value,
             "created_files": collect_created_files(ctx.transcript),
+            "artifacts": collect_artifacts(ctx.transcript),
             "loop": ctx.trace.summary(),
         }
 

package/latticeai/api/chat_intents.py

@@ -3,8 +3,10 @@
 from __future__ import annotations
 
 import logging
+import os
+import re
 from pathlib import Path
-from typing import Any, Dict, Optional
+from typing import Any, Dict, List, Optional
 
 from fastapi import HTTPException, Request
 from fastapi.responses import JSONResponse, StreamingResponse
@@ -17,7 +19,43 @@ from latticeai.api.chat_helpers import (
 )
 from latticeai.api.chat_stream import agent_payload_stream, single_answer_response
 from latticeai.core.agent import AgentState
-from latticeai.core.file_generation import generate_file_content, infer_file_target
+from latticeai.core.file_generation import (
+    PREVIEWABLE_EXTENSIONS,
+    generate_file_content,
+    infer_file_target,
+)
+
+
+def next_available_path(root: Path, target: str) -> str:
+    """Return ``target`` unchanged, or a ``name_2.ext``-style variant when the
+    file already exists in the workspace.
+
+    The direct chat write path must never silently overwrite an existing file:
+    overwrites belong to the reviewable-proposal flow. Deterministic suffixing
+    keeps "make me an html page" repeatable without a 409 dead end.
+    """
+    candidate = (root / target)
+    if not candidate.exists():
+        return target
+    stem, suffix = candidate.stem, candidate.suffix
+    # An earlier auto-suffix run may have produced name_2 already; restart the
+    # numbering from the base name so we fill the first free slot.
+    base = re.sub(r"_\d+$", "", stem) or stem
+    for index in range(2, 100):
+        variant = candidate.with_name(f"{base}_{index}{suffix}")
+        if not variant.exists():
+            return str(Path(target).with_name(variant.name))
+    raise HTTPException(
+        status_code=409,
+        detail=f"'{target}' 이름의 파일이 너무 많습니다. 다른 이름을 지정해 주세요.",
+    )
+
+
+def ingest_generated_enabled() -> bool:
+    """Feature toggle for auto-indexing generated files into the Brain."""
+    return os.environ.get("LATTICEAI_INGEST_GENERATED", "1").strip().lower() not in {
+        "0", "false", "off", "no",
+    }
 
 
 class ChatIntentController:
@@ -41,6 +79,7 @@ class ChatIntentController:
         execute_tool: Any,
         agent_controller: Any,
         agent_root: Path,
+        ingestion_pipeline: Any = None,
     ) -> None:
         self.router = model_router
         self.config = config
@@ -59,6 +98,7 @@ class ChatIntentController:
         self.execute_tool = execute_tool
         self.agent_controller = agent_controller
         self.agent_root = Path(agent_root)
+        self.ingestion_pipeline = ingestion_pipeline
 
     def no_model_response(self) -> JSONResponse:
         detail = "No model loaded. Call /models/load first."
@@ -184,13 +224,25 @@ class ChatIntentController:
         )
         return single_answer_response(req, answer, model="client_url")
 
-    async def direct_file_action(self, req: Any, *, model_id: Optional[str]):
+    async def direct_file_action(
+        self,
+        req: Any,
+        *,
+        model_id: Optional[str],
+        effective_email: Optional[str] = None,
+        workspace_id: Optional[str] = None,
+    ):
         # An explicit path ("report.txt") wins; otherwise infer one from an
         # explicit type keyword ("html 파일 만들어줘") so weak models never
         # have to drive the JSON tool loop just to create a file.
         target_path = file_action_target(req.message) or infer_file_target(req.message)
         if not target_path:
             return None
+        # Never silently overwrite: an existing target gets a _2/_3 suffix so
+        # regeneration is safe and repeatable without the proposal flow.
+        deduped_path = next_available_path(self.agent_root, target_path)
+        renamed = deduped_path != target_path
+        target_path = deduped_path
         content = inline_file_action_content(req.message)
         generation_meta: Optional[Dict[str, Any]] = None
         if content is None and not model_id:
@@ -227,19 +279,43 @@ class ChatIntentController:
             )
         except self.tool_error as exc:
             raise HTTPException(status_code=400, detail=str(exc)) from exc
-        answer = f"{result.get('path') or target_path} 파일을 만들었습니다."
-        if generation_meta and generation_meta.get("repaired"):
+        final_path = result.get("path") or target_path
+        answer = f"{final_path} 파일을 만들었습니다."
+        if renamed:
+            answer += " (같은 이름의 파일이 있어 새 이름으로 저장했습니다.)"
+        repaired = bool(generation_meta and generation_meta.get("repaired"))
+        if repaired:
             answer += (
                 " (모델 출력이 불완전해 자동 보정을 거쳐 유효한 파일로 저장했습니다.)"
             )
         created_files = [
             {
-                "path": result.get("path") or target_path,
-                "filename": Path(result.get("path") or target_path).name,
+                "path": final_path,
+                "filename": Path(final_path).name,
                 "bytes": result.get("bytes", 0),
                 "action": "write_file",
             }
         ]
+        # Artifact-first contract: every file the request produced, with the
+        # honesty flags the UI needs (valid vs repaired scaffold, previewable).
+        artifacts: List[Dict[str, Any]] = [
+            {
+                "kind": "file",
+                "path": final_path,
+                "filename": Path(final_path).name,
+                "bytes": result.get("bytes", 0),
+                "previewable": Path(final_path).suffix.lower() in PREVIEWABLE_EXTENSIONS,
+                "valid": True,
+                "repaired": repaired,
+            }
+        ]
+        brain_ingest = self._ingest_generated_file(
+            final_path,
+            content,
+            effective_email=effective_email,
+            workspace_id=workspace_id,
+            conversation_id=getattr(req, "conversation_id", None),
+        )
         self.notify("user", req.message, req.source)
         self.notify("assistant", answer, req.source)
         payload = {
@@ -257,11 +333,14 @@ class ChatIntentController:
             "state_history": [AgentState.EXECUTING.value, AgentState.DONE.value],
             "final_state": AgentState.DONE.value,
             "created_files": created_files,
+            "artifacts": artifacts,
             "routed_to_agent": True,
             "action_route": "direct_write_file",
         }
         if generation_meta is not None:
             payload["generation"] = generation_meta
+        if brain_ingest is not None:
+            payload["brain_ingest"] = brain_ingest
         if req.stream:
             return StreamingResponse(
                 agent_payload_stream(
@@ -275,6 +354,50 @@ class ChatIntentController:
             )
         return JSONResponse(content=payload)
 
+    def _ingest_generated_file(
+        self,
+        rel_path: str,
+        content: Optional[str],
+        *,
+        effective_email: Optional[str],
+        workspace_id: Optional[str],
+        conversation_id: Optional[str],
+    ) -> Optional[Dict[str, Any]]:
+        """Optionally index a just-generated file into the Brain.
+
+        The knowledge promise is "what Lattice makes, Lattice remembers":
+        without this, generated files are invisible to recall until the user
+        re-uploads them. Best-effort and additive — ingestion problems never
+        fail the file creation, and LATTICEAI_INGEST_GENERATED=0 disables it.
+        """
+        if self.ingestion_pipeline is None or not ingest_generated_enabled():
+            return None
+        try:
+            from lattice_brain.ingestion import IngestionItem
+
+            item = IngestionItem(
+                source_type="file",
+                title=Path(rel_path).name,
+                text=content,
+                path=str(self.agent_root / rel_path),
+                source_uri=f"workspace://{rel_path}",
+                owner=effective_email,
+                workspace_id=workspace_id,
+                conversation_id=conversation_id,
+                metadata={"origin": "generated_file", "route": "direct_write_file"},
+            )
+            result = self.ingestion_pipeline.ingest(item, user_email=effective_email)
+            payload = result.as_dict() if hasattr(result, "as_dict") else dict(result or {})
+            return {
+                "status": payload.get("status"),
+                "node_id": payload.get("node_id"),
+                "chunk_count": payload.get("chunk_count", 0),
+                "duplicate": payload.get("duplicate", False),
+            }
+        except Exception as exc:  # noqa: BLE001 — indexing must never break creation
+            logging.warning("generated-file ingest failed: %s", exc)
+            return {"status": "failed", "detail": str(exc)[:200]}
+
     async def route_file_to_agent(
         self,
         req: Any,

package/latticeai/app_factory.py

@@ -911,6 +911,7 @@ def _build(config: "Optional[Config]" = None) -> Dict[str, Any]:
         chat_service=CHAT_SERVICE,
         context_assembler=CONTEXT_ASSEMBLER,
         brain_memory=BRAIN_MEMORY,
+        ingestion_pipeline=INGESTION_PIPELINE if ENABLE_GRAPH else None,
         chat_agent_runtime=CHAT_AGENT_RUNTIME,
         gardener=gardener,
         hooks=HOOKS_REGISTRY,

package/latticeai/core/agent.py

@@ -32,6 +32,7 @@ from typing import Any, Awaitable, Callable, Dict, FrozenSet, List, Optional, Tu
 from lattice_brain.runtime.hooks import dispatch_tool
 from lattice_brain.runtime.contracts import runtime_boundary_contract, single_agent_contract
 from latticeai.core.agent_trace import LoopTrace
+from latticeai.core.file_generation import infer_file_target, sanitize_write_content
 from latticeai.core.tool_registry import SCOPED_KNOWLEDGE_TOOLS
 from latticeai.tools import ToolError
 
@@ -141,6 +142,91 @@ def extract_action(raw: str) -> Dict:
     return action
 
 
+def normalize_plan(plan: Any, user_message: str) -> Tuple[Dict[str, Any], List[str]]:
+    """Enforce the minimal plan schema so execution never starts adrift.
+
+    A weak planner that returns junk steps / a missing goal previously flowed
+    straight into the executor, which then had to reconstruct intent from the
+    raw request. Normalization keeps the loop honest: ``goal`` is always a
+    non-empty string, ``steps`` only contains dicts with an ``action``, and an
+    empty plan for an obvious file-creation request gets a deterministic
+    single ``write_file`` step instead of leaving the executor to improvise.
+
+    Returns ``(plan, fixes)`` where ``fixes`` names every applied repair —
+    the loop trace records them so plan quality is observable per model.
+    """
+    fixes: List[str] = []
+    if not isinstance(plan, dict):
+        plan = {}
+        fixes.append("plan_not_object")
+    plan = dict(plan)
+
+    goal = str(plan.get("goal") or "").strip()
+    if not goal:
+        plan["goal"] = user_message
+        fixes.append("goal_defaulted")
+
+    raw_steps = plan.get("steps")
+    steps = [
+        s for s in (raw_steps if isinstance(raw_steps, list) else [])
+        if isinstance(s, dict) and s.get("action")
+    ]
+    if raw_steps and steps != raw_steps:
+        fixes.append("steps_filtered")
+    if not steps:
+        inferred = infer_file_target(user_message)
+        if inferred:
+            steps = [{
+                "action": "write_file",
+                "args": {"path": inferred},
+                "description": f"Create {inferred} for: {user_message[:120]}",
+            }]
+            fixes.append("heuristic_file_step")
+    plan["steps"] = steps
+
+    try:
+        estimated = int(plan.get("estimated_steps") or 0)
+    except (TypeError, ValueError):
+        estimated = 0
+        fixes.append("estimated_steps_invalid")
+    plan["estimated_steps"] = max(1, estimated, len(steps))
+    plan["requires_approval"] = bool(plan.get("requires_approval", False))
+    if not isinstance(plan.get("rollback_strategy"), str):
+        plan["rollback_strategy"] = "none"
+    return plan, fixes
+
+
+_TRIVIAL_LEARNING_RE = re.compile(
+    r"^(파일(을|이)?\s*(만들|생성|작성|저장)|작업(을|이)?\s*(완료|성공)|성공적으로"
+    r"|task\s+(was\s+)?complet|file\s+(was\s+)?(creat|written|saved)"
+    r"|(successfully\s+)?(created|completed|finished|done)\b)",
+    re.IGNORECASE,
+)
+
+
+def filter_learnings(learnings: List[Any]) -> List[str]:
+    """Drop trivial/duplicate learnings before they enter the brain.
+
+    "파일을 만들었다"-class statements restate what the transcript already
+    records and pollute recall. A learning survives when it is long enough to
+    carry information and is not a bare completion announcement.
+    """
+    kept: List[str] = []
+    seen: set = set()
+    for raw in learnings or []:
+        text = str(raw or "").strip()
+        if len(text) < 12:
+            continue
+        if _TRIVIAL_LEARNING_RE.match(text) and len(text) < 48:
+            continue
+        key = text.lower()
+        if key in seen:
+            continue
+        seen.add(key)
+        kept.append(text)
+    return kept
+
+
 @dataclass
 class AgentDeps:
     """The ports a :class:`SingleAgentRuntime` needs from the outside world.
@@ -258,6 +344,9 @@ class SingleAgentRuntime:
                 "goal": req.message, "steps": [],
                 "requires_approval": False, "rollback_strategy": "none", "estimated_steps": 1,
             }
+        plan, plan_fixes = normalize_plan(plan, req.message)
+        if plan_fixes:
+            ctx.trace.repair("plan", repairs=plan_fixes)
         ctx.plan = plan
         ctx.transcript.append({
             "state": AgentState.PLANNING.value,
@@ -266,6 +355,7 @@ class SingleAgentRuntime:
             "requires_approval": plan.get("requires_approval", False),
             "rollback_strategy": plan.get("rollback_strategy", "none"),
             "estimated_steps": plan.get("estimated_steps", 1),
+            **({"plan_fixes": plan_fixes} if plan_fixes else {}),
         })
         ctx.state = AgentState.WAITING_APPROVAL
 
@@ -557,6 +647,26 @@ class SingleAgentRuntime:
     ) -> None:
         """Role check + shared tool lifecycle, recorded on the transcript either way."""
         d = self.deps
+        sanitize_meta: Optional[Dict[str, Any]] = None
+        if name == "write_file" and isinstance(args.get("content"), str):
+            # ArtifactWritePipeline: the executor's args.content is untrusted
+            # model output. The same extract→validate→repair guarantee as the
+            # direct chat path applies here, so a weak model driving the JSON
+            # loop can never persist fenced/chatty/truncated payloads.
+            cleaned, meta = sanitize_write_content(
+                str(args.get("path") or ""), args["content"],
+                user_request=str(ctx.plan.get("goal") or thoughts or name),
+            )
+            if meta.get("sanitized"):
+                args = dict(args)
+                args["content"] = cleaned
+                sanitize_meta = meta
+                ctx.trace.repair(
+                    "execute",
+                    repairs=[
+                        "artifact_repair" if meta.get("repaired") else "artifact_sanitize"
+                    ],
+                )
         try:
             d.check_role(name, current_user)
             # Shared tool lifecycle: pre_tool (may block) → execute → post_tool.
@@ -570,6 +680,7 @@ class SingleAgentRuntime:
                 "state": AgentState.EXECUTING.value, "action": name,
                 "thoughts": thoughts, "args": args,
                 "risk": risk, "governance": dict(policy), "result": result,
+                **({"content_sanitize": sanitize_meta} if sanitize_meta else {}),
             })
         except (ToolError, KeyError, TypeError, PermissionError) as exc:
             ctx.trace.tool("execute", name=name, outcome="error", risk=risk)
@@ -791,8 +902,9 @@ class SingleAgentRuntime:
                 context=context, max_tokens=256, temperature=0.1,
             )
             mem = extract_action(str(raw))
-            if mem.get("save_to_knowledge") and mem.get("learnings"):
-                learnings = "\n".join(mem["learnings"])
+            kept_learnings = filter_learnings(mem.get("learnings") or [])
+            if mem.get("save_to_knowledge") and kept_learnings:
+                learnings = "\n".join(kept_learnings)
                 if d.brain_memory is not None:
                     # This runtime is LLM-driven — its learnings are real
                     # experiences and enter the brain with provenance.