ltcai 9.9.4 → 9.9.9

package/README.md

@@ -11,7 +11,7 @@
 [![CI Status](https://github.com/TaeSooPark-PTS/LatticeAI/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/TaeSooPark-PTS/LatticeAI/actions/workflows/ci.yml)
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 
-![v9.9.4 Living Brain walkthrough](output/release/v9.9.4/gifs/v9.9.4-living-brain-walkthrough.gif)
+![v9.9.9 Living Brain walkthrough](output/release/v9.9.9/gifs/v9.9.9-living-brain-walkthrough.gif)
 
 Chat, files, folders, notes, and web pages all flow into one durable knowledge
 graph on your computer. Any model — local MLX or cloud — can speak with that
@@ -24,9 +24,9 @@ memory. Nothing leaves your machine without explicit consent.
 
 | | |
 | --- | --- |
-| **Chat with a Brain that remembers** — every conversation grows durable, source-linked memory ![Brain Chat](output/release/v9.9.4/screenshots/04-brain-chat-home.png) | **See how knowledge connects** — a real relationship graph, not a file list ![Memory Graph](output/release/v9.9.4/screenshots/05-memory-graph.png) |
-| **Capture anything** — files, whole folders, notes, screenshots, web pages ![Capture](output/release/v9.9.4/screenshots/06-capture.png) | **Automate with review** — agent changes become proposals you approve first ![Review Center](output/release/v9.9.4/screenshots/12-review-center.png) |
-| **Pick a model in one click** — recommended local models for your hardware ![Recommended Models](output/release/v9.9.4/screenshots/02-recommended-models.png) | **Stay in control** — audit, roles, retention in a separate admin surface ![Admin Console](output/release/v9.9.4/screenshots/10-admin-console.png) |
+| **Chat with a Brain that remembers** — every conversation grows durable, source-linked memory ![Brain Chat](output/release/v9.9.9/screenshots/04-brain-chat-home.png) | **See how knowledge connects** — a real relationship graph, not a file list ![Memory Graph](output/release/v9.9.9/screenshots/05-memory-graph.png) |
+| **Capture anything** — files, whole folders, notes, screenshots, web pages ![Capture](output/release/v9.9.9/screenshots/06-capture.png) | **Automate with review** — agent changes become proposals you approve first ![Review Center](output/release/v9.9.9/screenshots/12-review-center.png) |
+| **Pick a model in one click** — recommended local models for your hardware ![Recommended Models](output/release/v9.9.9/screenshots/02-recommended-models.png) | **Stay in control** — audit, roles, retention in a separate admin surface ![Admin Console](output/release/v9.9.9/screenshots/10-admin-console.png) |
 
 ## Why Lattice AI
 
@@ -57,52 +57,48 @@ First-run flow — wake the Brain, pick the owner, load a recommended model:
 
 | | | |
 | --- | --- | --- |
-| ![Login](output/release/v9.9.4/screenshots/01-login.png) | ![Model install](output/release/v9.9.4/screenshots/03-install-load-progress.png) | ![Model library](output/release/v9.9.4/screenshots/07-model-library.png) |
+| ![Login](output/release/v9.9.9/screenshots/01-login.png) | ![Model install](output/release/v9.9.9/screenshots/03-install-load-progress.png) | ![Model library](output/release/v9.9.9/screenshots/07-model-library.png) |
 
 Screenshot index and capture notes:
-[output/release/v9.9.4/SCREENSHOT_INDEX.md](output/release/v9.9.4/SCREENSHOT_INDEX.md)
+[output/release/v9.9.9/SCREENSHOT_INDEX.md](output/release/v9.9.9/SCREENSHOT_INDEX.md)
 
 ## Current Release
 
-The current release is **9.9.4 — Durable Loops**:
-
-- **Loops that survive restarts.** Paused `awaiting_approval` runs are
-  persisted to disk (hashed tokens, wall-clock expiry) and resume after a
-  server restart; expired approvals answer with a one-click replan hint, and
-  `GET /agent/approvals` re-surfaces pending runs. Approval cards show a live
-  TTL countdown.
-- **You can watch the loop work.** Streamed agent runs emit named
-  `agent_step` SSE events (plan → tools → verify → terminal) rendered as a
-  live step timeline; weak-model parse repairs are counted and surfaced
-  honestly ("모델 응답을 N회 보정했어요").
-- **One retrieval policy.** A single `RetrievalPolicy` module (rule-based
-  query rewrite, query-class weights, 14-day recency age-decay in a
-  [0.5, 1.0] band) feeds both the service and graph fusion layers, gated by
-  the benchmark CI test; embedder swaps now report `stale_embedder` instead
-  of silently emptying the vector channel.
-- **Retrieval quality at the chunk level.** Markdown chunks at heading
-  boundaries (with `heading_path` provenance), code at function boundaries,
-  PDF chunks carry page numbers, plain text stays byte-identical — and
-  cited source cards click through to the stored chunk text.
-- **Grounded answers, cited sources.** When retrieved context exists the
-  answer prompt instructs [1]-style citations; a synthetic grounding bench
-  gates the verdict heuristic in CI; briefings suggest periodic graph noise
-  curation, and an opt-in review mode stages curator promotions for human
-  approval.
-- **A wider harness.** Manifest-aware plan rewriting plus React/Vite and
-  Python-package manifests, a bounded executor context window, five
-  deterministic workflow scenarios, a funnel soft gate, and a weekly
-  fail-open real-model agent smoke with a report artifact.
+The current release is **9.9.9 — Lean Shell**:
+
+- **No `✖` left in the parity matrix.** Every gap 9.9.6 wrote down is closed,
+  and every remaining `—` states *why* it is a boundary
+  ([docs/SURFACE_PARITY.md](docs/SURFACE_PARITY.md)).
+- **VS Code watches the loop live.** `POST /agent` streams the same
+  `agent_step` frames the web app gets, and cited evidence turns into one-click
+  follow-ups in the editor.
+- **Telegram badges its recall and reviews changes.** The server's grounding
+  verdict is shown as-is, and `/review` approves or rejects staged proposals
+  inline.
+- **The browser extension recalls, not just captures.** Ask your Brain from the
+  popup with the same badge, and see how many runs await approval — still
+  posting only to `127.0.0.1`.
+- **A knowledge garden in four beds** — what arrived, what disagrees, what went
+  stale, what the rest leans on.
+- **A profile for small local models.** Under 4B, the loop shortens its window,
+  escalates sooner, and — when JSON tool calls keep failing — writes the
+  planned files directly instead of ending empty-handed.
+- **Folder memory state.** How much of each connected folder is really in your
+  Brain, what failed, and the reason it failed.
+- **Two skills that pay off on install** — meeting notes and a weekly review
+  written only from what the Brain actually recorded.
+- **Voice memos** go straight into the Brain; when no local transcriber exists
+  the memo is still stored and honestly marked not-searchable.
 
 Release notes: [RELEASE.md](RELEASE.md) · Full history: [docs/CHANGELOG.md](docs/CHANGELOG.md)
 
-Expected artifacts for 9.9.4 release must use exact filenames:
+Expected artifacts for 9.9.9 release must use exact filenames:
 
-- `dist/ltcai-9.9.4-py3-none-any.whl`
-- `dist/ltcai-9.9.4.tar.gz`
-- `ltcai-9.9.4.tgz`
-- `dist/ltcai-9.9.4.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_9.9.4_aarch64.dmg`
+- `dist/ltcai-9.9.9-py3-none-any.whl`
+- `dist/ltcai-9.9.9.tar.gz`
+- `ltcai-9.9.9.tgz`
+- `dist/ltcai-9.9.9.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_9.9.9_aarch64.dmg`
 
 Do not use wildcard artifact uploads. Package registry publishing remains owner-run.
 
@@ -122,7 +118,7 @@ See [ARCHITECTURE.md](ARCHITECTURE.md) for details and
 
 - External package registries are owner-published and can lag behind GitHub.
 - PostgreSQL/pgvector is optional scale/migration tooling. SQLite remains the
-  live local Brain store in 9.9.4.
+  live local Brain store in 9.9.5.
 - Docker, model downloads, cloud model calls, Telegram, Brain Network, and
   update checks require explicit user action.
 - Conversation does not fabricate answers when no model is loaded. Agent and
@@ -134,6 +130,11 @@ See [ARCHITECTURE.md](ARCHITECTURE.md) for details and
 
 | Version | Theme |
 | --- | --- |
+| 9.9.9 | Lean Shell |
+| 9.9.8 | Autonomy Dial |
+| 9.9.7 | No Gaps Left |
+| 9.9.6 | Same Brain Everywhere |
+| 9.9.5 | Closed Gaps |
 | 9.9.4 | Durable Loops |
 | 9.9.3 | Closed Loops |
 | 9.9.2 | Artifact Trust |

package/docs/CHANGELOG.md

@@ -4,6 +4,234 @@ The top entry is either the current unreleased main-branch work or the current
 release line. Older entries are historical and may describe behavior as it
 existed at that release.
 
+## [9.9.9] - 2026-07-27
+
+### Changed
+- i18n is split per lazy route. `frontend/src/i18n/registry.ts` holds a shared
+  mutable table; `shell` registers eagerly (app frame, language switcher,
+  generic `ui.*`) and `brain` / `workspace` / `onboarding` register themselves
+  when their module is imported, which happens inside the lazy chunk of the
+  route that needs them. Initial static JS drops from 150.0 KiB to 99.3 KiB
+  gzip (505.1 KiB → 317.3 KiB raw), and lazy chunks kept off first paint go
+  from 25 to 32.
+- The bundle budget returns to its original 150 KiB. 9.9.8 raised it to 152 KiB
+  because the shared i18n table made the ceiling unreachable without one; that
+  cause is gone.
+- The admin console is behind a `React.lazy` boundary. It is a rare, separate
+  surface and it was pulling the whole workspace copy namespace onto first
+  paint.
+- `brain.title` (the product wordmark) moved from the `brain` namespace to
+  `shell` — it renders in the app frame before any route resolves.
+
+### Added
+- `scripts/check_i18n_namespace_coverage.mjs`, wired into `npm run lint`. It
+  walks the real module graph and, for the eager root and every `React.lazy`
+  boundary, verifies each `t(lang, "key")` in that chunk's static closure is
+  covered by a namespace the chunk imports. Without it the split fails
+  silently: `t()` returns the raw key, so the UI shows `system.permission.title`
+  instead of Korean text with no error raised. Type-only imports are not
+  counted as runtime edges.
+- `frontend/src/test/setup.ts` registers every namespace, because a unit test
+  renders a component without its route. Production coverage is proven by the
+  script above, not by this file.
+
+## [9.9.8] - 2026-07-27
+
+### Added
+- Permission modes (`latticeai/core/permission_mode.py`): a `strict` /
+  `trusted` / `bypass` autonomy dial layered over ToolRegistry + Change
+  Governor. `strict` is the default and matches 9.9.7 behavior exactly.
+- `GET/POST /api/permission-mode` and `GET /api/permission-mode/catalog`,
+  backed by `PermissionModeService` (per-workspace > per-user > process
+  default, `LATTICEAI_PERMISSION_MODE` for the default). Switching to
+  `bypass` requires `acknowledge_risk=true` and is audited.
+- Mode-invariant circuit breakers: destructive risk, root/home paths,
+  `rm -rf /` style commands, and binary overwrites are denied in every mode.
+- `AgentRunContext.permission_mode`: the mode is resolved once per run and
+  persisted with a paused approval, so a plan and its execution are judged by
+  one dial even if the stored preference changes mid-run.
+- `PermissionModePanel` in 환경설정 → 에이전트 자율성: the dial is set from the
+  product, not only from the API. The selector renders the server's own
+  catalog instead of a hardcoded mode list and will not send a `bypass`
+  switch until the acknowledgement the server requires is ticked.
+
+### Fixed
+- Stored per-user and per-workspace modes never reached enforcement: the
+  bound resolver was called without a scope, so every caller collapsed onto
+  the process default and the dial had no effect. `enforce_policy` and the
+  agent tool gate now resolve with `user_email` / `workspace_id`.
+- Orphan change proposals under `trusted` / `bypass`: the gate called
+  `ChangeGovernor.review()` — which persists a proposal as a side effect —
+  and then discarded the verdict, applying the change *and* leaving a pending
+  proposal in the Review Center. The mode is now decided before the governor
+  is consulted.
+- `AgentRunContext` used `__slots__` with no `permission_mode` slot, making
+  the documented per-run override unreachable dead code.
+- `PermissionModeService.set_mode()` deadlocked: it held a non-reentrant
+  `threading.Lock` while calling `resolve()`, which takes the same lock, so
+  every mode change hung its worker thread forever.
+
+### Changed
+- `enforce_policy`: the two `fail_closed` branches that both raised 409 are
+  one branch again — a binary overwrite has no safe apply path in any mode.
+- `PermissionModeService.rebind_data_dir()` / `rebind_audit()`: explicit
+  wiring now rebinds an already-created singleton instead of being dropped,
+  so an early lazy caller cannot pin the store to `~/.ltcai` with no audit
+  sink.
+- Initial-JS bundle budget raised 150 KiB → 152 KiB gzip. The 9.9.7 tree sat
+  at 149.3 KiB and the new settings panel needed ~1.0 KiB, nearly all of it
+  bilingual copy: page components are lazy, but `frontend/src/i18n/*` is one
+  synchronous table, so every surface's copy is on the first-paint path by
+  construction. Splitting i18n per lazy route is the durable fix and is not in
+  this release.
+- The permission gates live in `SingleAgentRuntime` itself. `permission_mode`
+  is a real `AgentDeps` field, and `approval_requirements` /
+  `_blocked_by_gates` / `_governor_review` are mode-aware in place instead of
+  being replaced at construction time by a monkey-patch that would break
+  silently if those signatures changed.
+
+### Removed
+- `latticeai/core/agent_mode_patch.py` — the monkey-patch layer, folded into
+  `agent.py`.
+- Dead no-op `if ... pass` block in `is_circuit_breaker`.
+- `filter_governor_verdict`, unused after the governor fix.
+
+## [9.9.7] - 2026-07-27
+
+### Added
+- `POST /agent` accepts `stream: true` and emits the same named `agent_step`
+  SSE frames the web chat route already produced; the terminal payload is
+  identical to the JSON response (`tests/unit/test_agent_stream_parity.py`).
+- VS Code: `ltcai.runAgentLive` (live step timeline) and
+  `ltcai.evidenceActions` (one-click follow-ups from the last recall's cited
+  sources, file actions routed through the agent).
+- Telegram: grounding badge on every answer plus `/review` — a Review Center
+  over `/api/proposals` with inline approve/reject and honest 409 reporting.
+- Browser extension: "Ask your Brain" with the server's grounding verdict, and
+  pending-approval visibility. Still posts only to `127.0.0.1`.
+- `GET /api/brain/garden` + `KnowledgeGardenPanel`: the knowledge garden in
+  four beds (recent / contradictions / stale / frequent), where "frequent" is
+  real graph degree and Chunk nodes are excluded.
+- `latticeai/core/agent_profiles.py`: `standard` / `compact` agent profiles
+  selected from the model id (or `LATTICEAI_AGENT_PROFILE`), with a
+  direct-path fallback that writes the plan's files without any JSON tool call
+  when a small model cannot hold the protocol.
+- `GET /knowledge-graph/local/health` + `FolderMemoryHealthCard`: per-folder
+  indexing coverage, failures with their stored reasons, and one explicitly
+  global vector-freshness figure.
+- Skills `meeting_notes` and `weekly_review`, with a contract test that rejects
+  a skill whose `action` is not a registered tool.
+- `POST /api/capture/voice` + `GET /api/capture/voice/status`
+  (`latticeai/services/voice_capture.py`): voice memo ingestion with an
+  optional local transcriber and honest degradation when none exists.
+
+### Changed
+- `docs/SURFACE_PARITY.md` contains no `✖` entries; every remaining `—` states
+  why it is a design boundary.
+- The browser extension is no longer described as capture-only (manifest name,
+  popup, README).
+
+### Fixed
+- The VS Code SSE reader kept the `event:` name, so named `agent_step` frames
+  are no longer misread as chat chunks.
+- `garden_overview` clamps an explicit `limit=0` to 1 instead of silently
+  re-expanding it to the default.
+
+## [9.9.6] - 2026-07-27
+
+### Added
+- Surface parity for VS Code: `ltcai.askBrain` (grounding badge on recall),
+  `ltcai.reviewCenter` (list/approve/reject staged change proposals via
+  `/api/proposals`, 409 conflicts reported honestly), `ltcai.runAgent`
+  (post-run step + outcome summary). Parity logic lives in
+  `vscode-extension/surface.ts`, asserted by `tests/vscode-extension.test.cjs`
+  (wired into `npm run lint`).
+- `POST /api/evidence/actions` + `latticeai/services/evidence_actions.py`:
+  deterministic, model-free composition of evidence-scoped follow-up prompts
+  (summary / checklist / document / one-page) from an answer's citations.
+- `latticeai/core/run_explain.py`: deterministic plain-language run outcome
+  (`code`, `headline`, `details`, `model_strain`, `next_step`), returned as
+  `explanation` on `/agent` and rendered in the web app, VS Code, and Telegram.
+- `prose` chunking strategy (`lattice_brain/graph/_kg_common.py`): sentence and
+  paragraph-aware boundaries for `.txt/.pdf/.docx/.html/…`; `plain` stays
+  byte-identical to the legacy walk.
+- `citation_locator()` + chunk metadata on vector hits: citations name the
+  section/page they came from (`Guide > Setup · p.4`, `p.4–5` across a page
+  break) and stay silent when the chunk cannot prove it.
+- `infer_edge_relation()` + `plan_relation_noise_reduction()`: relations carry
+  an evidence class (`verb` | `cooccurrence`) with matching weights; the
+  curator can demote weak/hub co-occurrence edges without touching verb-backed
+  or legacy ones.
+- Project sessions: `latticeai/core/project_sessions.py` + `/api/projects`
+  (files produced, open TODOs, last honest verification, run history). `/agent`
+  accepts `project_id`, injects the project state into planning/execution, and
+  folds the run's outcome back in.
+- `latticeai/core/artifact_ledger.py` + a `Files created in this conversation`
+  context section: files a run just wrote are recallable before asynchronous
+  indexing catches up.
+- `requirement_coverage()`: a critic `PASS` that left a declared manifest file
+  unwritten now ends as `NEEDS_REVIEW`.
+- `funnel_alerts()`: `GET /api/admin/funnel-metrics` returns named, actionable
+  alerts with the triggering value; silent below 10 samples.
+- Stale-embedder recovery UI: names the problem and offers a one-click
+  re-index, with an honest failure message.
+- `lattice_brain/ingestion_jobs.py` and
+  `latticeai/core/workspace_review_items.py`: behaviour-preserving extractions.
+- Six additional multi-agent/workflow scenarios (retry exhaustion, recovery,
+  two-gate pause/resume, stale resume cursor, per-role observability, cross-run
+  role isolation).
+
+### Changed
+- Document generation shares chat's context contract: same `approx_tokens`
+  budget, same `context_quality` signal, same assembly `trace` shape.
+- `chunk_strategy_for()` routes prose document formats to the new `prose`
+  strategy (newly ingested `.txt/.pdf/.docx/.html` content gets different chunk
+  ids; existing indexed content is untouched).
+- The VS Code HTTP client rejects on 4xx/5xx instead of resolving an error body
+  as success.
+
+### Fixed
+- A verb-less sentence listing more than four concepts no longer manufactures
+  a chain of `관련됨` relations.
+- `stale_embedder` was computed but never surfaced in the UI.
+- PDF chunks that span a page break are labelled with the page range they
+  actually cover instead of only their starting page.
+
+## [9.9.5] - 2026-07-26
+
+### Added
+- Optional cross-encoder rerank (`lattice_brain/graph/rerank.py`): env
+  `LATTICEAI_CROSS_ENCODER_RERANK=1` (model via
+  `LATTICEAI_CROSS_ENCODER_MODEL`); hybrid_search returns additive `rerank`
+  meta; default path is identity with no model download.
+- Sidecar-backed Playwright first-value E2E: `tests/e2e/`,
+  `scripts/run_sidecar_e2e.mjs`, `npm run test:e2e:sidecar`, nightly
+  `.github/workflows/e2e-sidecar.yml`.
+- VS Code approval commands: `ltcai.listApprovals`, `ltcai.approveAgent`,
+  `ltcai.rejectAgent` with pause-token session cache.
+- Telegram approval handles both `waiting_approval` and `awaiting_approval`
+  with run_id+token resume preferred.
+- Agent loop L4/L5/L7 helpers: `artifact_checklist`, `files_written`,
+  snapshot rollback ports (`snapshot_file` / `restore_snapshot`) with
+  mode-tagged results (`git` | `snapshot` | `none`).
+- Knowledge-graph read surface decomposition:
+  `lattice_brain/graph/retrieval_reads.py` (`KnowledgeGraphReadsMixin`).
+
+### Changed
+- Legacy `human_in_loop` pauses now use the durable `AgentRunStore` path
+  (`legacy_context=True`); the separate in-memory `_pending` map is removed.
+  Wire contract (`status=waiting_approval`, `context_id`) is preserved.
+- Rollback recovers file-create actions via pre-write snapshots when git is
+  unavailable or not governed.
+- Critic verify prompts include a deterministic artifact checklist derived
+  from transcript sanitize/repair flags.
+- Executor prompts list files already written in the current run.
+- `docs/SURFACE_PARITY.md` marks VS Code/Telegram approval as provided.
+
+### Tests
+- `test_agent_loop_l4_l5_l7.py`, `test_cross_encoder_rerank.py`,
+  `test_snapshot_rollback_ports.py`, L1 approval flow extensions.
+
 ## [9.9.4] - 2026-07-26
 
 ### Added

package/docs/COMMUNITY_AND_PLUGINS.md

@@ -1,6 +1,6 @@
 # Community And Plugins
 
-Current release: **9.9.4 — Durable Loops**.
+Current release: **9.9.9 — Lean Shell**.
 
 LatticeAI defines the path from a strong local-first framework (8.4.0
 action-aware baseline, 8.5.0 registry+DI hardening, 8.6.0 capture/navigation

package/docs/DEVELOPMENT.md

@@ -3,7 +3,7 @@
 > **Status: canonical** — current contributor guidance, kept in sync with the
 > current release.
 
-Current release: **9.9.4 — Durable Loops**.
+Current release: **9.9.9 — Lean Shell**.
 
 This document is for contributors working on the local-first Digital Brain
 codebase. Product positioning and quick start stay in `README.md`; release

package/docs/ONBOARDING.md

@@ -1,6 +1,6 @@
 # Lattice AI Onboarding
 
-Current release: **9.9.4 — Durable Loops**.
+Current release: **9.9.9 — Lean Shell**.
 
 The first-run goal is a five-minute path from "I opened the app" to "my Brain
 has a source, a question, and proof." This page is the product contract behind

package/docs/OPERATIONS.md

@@ -1,4 +1,4 @@
-# Lattice AI — Operations Guide (v9.9.4)
+# Lattice AI — Operations Guide (v9.9.9)
 
 > **Status: canonical** — kept in sync with the current release. Storage layout
 > below reflects the SQLite live Brain store and workspace scoping, not the
@@ -14,6 +14,8 @@
 | `~/.ltcai/audit.json` | 감사 로그 (agent 실행, 사용자 변경 등) |
 | `~/.ltcai/chat_history.json` | 레거시 대화 히스토리 — 최초 1회 SQLite로 idempotent 임포트 후 미사용 |
 | `~/ltcai-agent/` | Agent workspace (agent가 생성한 파일) |
+| `~/.ltcai/agent_runs/` | 승인 대기 중인 에이전트 런 (재시작 생존, 토큰은 해시로만 저장) |
+| `~/.ltcai/project_sessions/` | 프로젝트 세션 (v9.9.6) — 프로젝트가 만든 파일, 남은 할 일, 마지막 검증 결과 |
 
 ## 2. 백업 및 복구
 

package/docs/PERMISSION_MODE.md

@@ -0,0 +1,107 @@
+# Permission Mode (v9.9.8)
+
+Frontier agents expose an autonomy dial. LatticeAI maps the same idea onto
+ToolRegistry + Change Governor without discarding fail-closed defaults.
+
+## Modes
+
+| Mode | Workspace writes | Knowledge reads | Exec / desktop control | Mutations |
+|------|------------------|-----------------|------------------------|-----------|
+| **strict** (default) | approval / proposal | gated | gated | Review proposals |
+| **trusted** | auto | auto | gated | auto-apply + audit |
+| **bypass** | auto | auto | auto (workspace) | auto-apply + audit |
+
+Hard circuit breakers always apply: destructive risk, `rm -rf /` / `~`,
+blocked path prefixes, binary overwrite without proposal support.
+
+Under **trusted** / **bypass** the governed mutation path is decided *before*
+`ChangeGovernor.review` runs. That call persists a proposal as a side effect, so
+reviewing first and discarding the verdict afterwards would apply the change
+*and* leave an orphan proposal pending in the Review Center.
+
+## API
+
+```http
+GET  /api/permission-mode
+GET  /api/permission-mode/catalog
+POST /api/permission-mode
+{"mode": "trusted"}
+{"mode": "bypass", "acknowledge_risk": true}
+```
+
+Scope: optional `workspace_id` query/body or `X-Workspace-Id` header.
+Per-workspace overrides per-user; both override the process default.
+
+Env default: `LATTICEAI_PERMISSION_MODE=strict|trusted|bypass`.
+
+## UI
+
+`PermissionModePanel` renders in **환경설정 → 에이전트 자율성** (`SystemPage`
+settings tab). It renders the catalog `/api/permission-mode` returns rather
+than a hardcoded mode list, so adding or renaming a mode server-side needs no
+frontend change, and it keeps the apply button disabled until
+
+* a *different* mode is selected, and
+* for a mode whose catalog entry sets `requires_ack`, the risk acknowledgement
+  is ticked — the same condition the server enforces, so the UI never sends a
+  request it knows will be refused.
+
+A failed change is surfaced with the server's own message; the panel never
+reports success it did not get.
+
+## Scope resolution
+
+Scope is not cosmetic — it is what makes a stored override take effect. Every
+enforcement point resolves the dial *with the caller's identity*:
+
+| Enforcement point | Scope passed |
+|-------------------|--------------|
+| `ToolDispatchService.enforce_policy` | `current_user` + `workspace_id` |
+| `SingleAgentRuntime` tool gate | `current_user` + `req.workspace_id` |
+| Agent plan gate | the run's stamped mode (see below) |
+
+`chat_agent_http` resolves the mode **once per run** and stamps it on
+`AgentRunContext.permission_mode`, so the plan the user approved and every tool
+step in that run are judged by the same dial even if the stored preference
+changes mid-run. A paused approval run persists that stamp, so it resumes under
+the mode it was approved with.
+
+A resolver bound into `ToolDispatchService.permission_mode` may accept
+`user_email`/`workspace_id` kwargs (preferred) or take no arguments; see
+`call_mode_source`. An unscoped resolver always returns the process default —
+which would make per-user and per-workspace overrides silently inert.
+
+## Wiring (automatic)
+
+No manual `app_factory` edits required. On startup:
+
+1. `build_chat_agent_runtime_from_context` binds dispatch + agent to the
+   shared mode resolver.
+2. `register_review_and_brain_tail_routers` mounts `/api/permission-mode`
+   and rebinds `PermissionModeService` onto the real `data_dir` + audit sink.
+
+Step 2 *rebinds* rather than "first caller wins": a tool dispatch that happens
+before routers are mounted would otherwise pin the store to the fallback
+`~/.ltcai` path with no audit sink.
+
+## Code map
+
+| Module | Role |
+|--------|------|
+| `latticeai/core/permission_mode.py` | Pure decision table |
+| `latticeai/core/agent_permission.py` | Agent plan/tool gate helpers |
+| `latticeai/core/agent.py` | `SingleAgentRuntime` gates (mode-aware in-line) |
+| `frontend/src/components/PermissionModePanel.tsx` | Settings selector |
+| `latticeai/services/permission_mode_service.py` | Persistence |
+| `latticeai/runtime/permission_mode_wiring.py` | Process-wide service + router mount |
+| `latticeai/runtime/chat_wiring.py` | Agent runtime injection |
+| `latticeai/runtime/router_registration.py` | HTTP mount |
+| `latticeai/services/tool_dispatch.py` | `enforce_policy` + `build_agent_runtime` |
+| `latticeai/api/permission_mode.py` | HTTP routes |
+
+## AGENTS.md note
+
+Under **strict**, the existing rule holds: never mutate existing user content
+directly — stage proposals. Under **trusted** / **bypass**, the user has
+explicitly raised autonomy; mutations auto-apply with audit, circuit breakers
+still deny destructive system actions.

package/docs/SURFACE_PARITY.md

@@ -2,6 +2,7 @@
 
 > **Status: reference**
 > 도입: v9.9.4 (2026-07-25, 리뷰 Wave 1.4 "표면 패리티 체크리스트").
+> 갱신: v9.9.7 — 표에 남아 있던 ✖ 갭을 **전부** 해소. Browser 확장도 캡처 전용 경계를 넘어 회상/승인 가시성을 갖췄다.
 > 목적: 각 표면(서피스)이 Brain 계약의 어디까지를 제공하는지 **정직하게** 기록한다.
 > "앱마다 다른 Lattice"를 방지하는 기준표이며, 기능을 과장하지 않는다.
 
@@ -12,7 +13,7 @@
 | Web `/app` | FastAPI sidecar가 서빙하는 SPA (`static/app`) | 1차 표면 — 모든 기능의 기준 |
 | Desktop | Tauri 셸 (`src-tauri/`) | 동일 SPA를 감싸는 셸 — 웹과 구조적 동일 |
 | VS Code | `vscode-extension/` (`ltcai.*` 커맨드) | 에디터 보조 표면 |
-| Browser | `browser-extension/` (Send to Lattice) | 캡처 전용 표면 |
+| Browser | `browser-extension/` | 캡처 + 회상 + 승인 가시성 (v9.9.7) |
 | Telegram | 봇 어댑터 | 대화 전용 표면 |
 
 ## 네 가지 루프 순간 × 표면
@@ -22,19 +23,24 @@
 | 루프 순간 | Web `/app` | Desktop | VS Code | Browser | Telegram |
 | --- | --- | --- | --- | --- | --- |
 | 첫 저장 (Capture) | ✅ DnD·폴더·웹 수집, 품질 경고 | ✅ (웹과 동일) | ◐ `sendToLattice` 선택 영역 전송 | ✅ 페이지 캡처 (단일 목적) | ◐ 메시지 수집 |
-| 첫 회상 (Recall) | ✅ 하이브리드 검색 + grounding 배지 + 출처→청크 | ✅ (동일) | ◐ `askCurrentFile` — 배지 없음 ✖ | — | ◐ 답변만, 배지 없음 |
-| 첫 산출물 (Artifact) | ✅ artifacts[] 카드·미리보기·Brain 기억 칩 | ✅ (동일) | ◐ `createFile` — 검증 파이프라인 경유, 카드 UI 없음 | — | ◐ 파일 전송만 |
-| 첫 보호 (Approval) | ✅ 승인 카드 + TTL 카운트다운 + 재시작 생존 | ✅ (동일) | ✖ 승인 UI 없음 — 웹으로 유도 | — | ✖ 승인 불가 — 웹으로 유도 |
+| 첫 회상 (Recall) | ✅ 하이브리드 검색 + grounding 배지 + 출처→청크 | ✅ (동일) | ✅ `askCurrentFile`/`askBrain` — 동일 `/chat` grounding 배지 | ✅ 팝업 질문 + 동일 grounding 배지 (v9.9.7) | ✅ 답변 + grounding 배지 (v9.9.7) |
+| 첫 산출물 (Artifact) | ✅ artifacts[] 카드·미리보기·Brain 기억 칩 | ✅ (동일) | ◐ `createFile` + `runAgent`/`runAgentLive` 스텝·파일 요약, 카드 UI 없음 | — (의도: 브라우저에서 파일 쓰기 없음) | ◐ 파일 전송만 |
+| 첫 보호 (Approval) | ✅ 승인 카드 + TTL 카운트다운 + 재시작 생존 | ✅ (동일) | ✅ List/Approve/Reject 커맨드 + 토큰 캐시 | ✅ 대기 건수 표시 (승인은 웹에서, v9.9.7) | ✅ 인라인 Done/Cancel + run_id/token 재개 |
 
 ## 기능 상세 × 표면
 
 | 기능 | Web `/app` | Desktop | VS Code | Browser | Telegram |
 | --- | --- | --- | --- | --- | --- |
-| 에이전트 스텝 타임라인 (v9.9.4) | ✅ 라이브 SSE | ✅ | — | — | — |
-| 승인 재개 (`/agent/resume`) | ✅ | ✅ | ✖ | — | ✖ |
-| 대기 중 승인 목록 (`GET /agent/approvals`, v9.9.4) | ✅ | ✅ | ✖ | — | — |
+| 에이전트 스텝 타임라인 (v9.9.4) | ✅ 라이브 SSE | ✅ | ✅ `runAgentLive` — `POST /agent` `stream:true`의 동일 `agent_step` 프레임 (v9.9.7) | — (의도) | — (의도) |
+| 실행 결과 평문 설명 (v9.9.6) | ✅ 메시지 하단 노트 | ✅ | ✅ `runAgent` 출력 채널 | — | ✅ 답변 뒤 요약 메시지 |
+| 근거 → 행동 원클릭 (v9.9.6) | ✅ 답변 근거 카드 | ✅ | ✅ `ltcai.evidenceActions` (v9.9.7) | — (의도) | — (의도) |
+| 지식 정원 4화단 (v9.9.7) | ✅ 홈 패널 | ✅ | — (의도) | — (의도) | — (의도) |
+| 폴더별 기억 상태 (v9.9.7) | ✅ Capture 카드 | ✅ | — (의도) | — (의도) | — (의도) |
+| 음성 메모 캡처 (v9.9.7) | ✅ `POST /api/capture/voice` | ✅ | — (의도) | — (의도) | — (의도) |
+| 승인 재개 (`/agent/resume`) | ✅ | ✅ | ✅ `ltcai.approveAgent` / `rejectAgent` | — | ✅ callback → resume |
+| 대기 중 승인 목록 (`GET /agent/approvals`, v9.9.4) | ✅ | ✅ | ✅ `ltcai.listApprovals` | — | — (봇 로컬 pending map) |
 | Watch 상태 신호 (v9.9.4) | ✅ 홈 카드 | ✅ | — | — | — |
-| Review Center (제안 승인/거절) | ✅ | ✅ | ✖ | — | — |
+| Review Center (제안 승인/거절) | ✅ | ✅ | ✅ `ltcai.reviewCenter` (409 충돌 정직 보고) | — (의도: 승인은 웹/에디터/봇에서) | ✅ `/review` + 인라인 승인/거절 (v9.9.7) |
 | 데모 코퍼스 First Value Loop | ✅ | ✅ | — | — | — |
 | 모델 로드/추천 | ✅ | ✅ | ◐ `loadModel` | — | — |
 | 코드 편집 보조 (edit/explain/refactor/tests) | — | — | ✅ | — | — |
@@ -43,5 +49,35 @@
 
 1. **API 계약이 기준이다.** 모든 표면은 동일한 sidecar API를 소비한다. 표면별 전용 API를 만들지 않는다.
 2. **◐/✖ 는 문서화된 상태로만 존재한다.** 새 기능을 Web에 추가할 때 이 표를 갱신하고, 다른 표면에 제공하지 않을 경우 "—(의도)" 인지 "✖(갭)" 인지 명시한다.
-3. **✖ 갭은 릴리스 노트의 Honest Limitations 후보다.** 현재 갭: VS Code/Telegram 승인 흐름(웹으로 유도하는 안내만 존재), VS Code 회상 배지.
+3. **✖ 갭은 릴리스 노트의 Honest Limitations 후보다.** v9.9.7 기준 표에 남은 ✖는 **없다**.
+   - 남은 "—"는 전부 **설계 경계**이며, 각 항목에 이유를 함께 적는다. 예: 브라우저 확장은 파일을 쓰지 않으므로 산출물 생성이 없고, 승인 *결정*은 서명된 토큰이 필요한 흐름이라 대기 건수만 보여 주고 승인은 웹/에디터/봇에서 한다.
+   - 경계를 새로 만들 때는 "왜 제공하지 않는가"를 이 문서에 남긴다. 이유 없는 "—"는 갭이지 경계가 아니다.
 4. 릴리스마다 이 표를 검토한다 (release checklist의 docs 단계).
+
+## VS Code / Telegram 승인 메모 (v9.9.5)
+
+- **토큰은 GET `/agent/approvals`에 다시 내려가지 않는다** (보안). Web은 일시 중지 응답의 토큰을 클라이언트에 보관하고, VS Code도 동일하게 pause 응답의 토큰을 확장 세션 캐시에 둔다. 캐시에 없으면 붙여넣기 또는 웹 UI로 유도한다.
+- **Telegram**은 `waiting_approval`(레거시 `human_in_loop`)과 `awaiting_approval`(토큰) 둘 다 인라인 키보드로 처리하며, resume 시 run_id+token을 우선한다.
+
+## VS Code 회상·검토 메모 (v9.9.6)
+
+- **회상 배지**: `askCurrentFile` / `askBrain`은 웹과 동일한 `POST /chat` 응답의 `grounding` 판정을 그대로 읽는다. 판정이 없으면 "근거 있음"으로 승격하지 않고 `unknown`으로 보고한다 (`vscode-extension/surface.ts::groundingBadge`).
+- **Review Center**: `ltcai.reviewCenter`는 웹과 같은 `/api/proposals` 표면을 쓴다. 승인은 검토한 내용 그대로 적용하고, 409(스테이징 이후 파일 변경)는 "아무것도 쓰지 않았다"고 정직하게 알린다.
+- **스텝 요약**: `ltcai.runAgent`는 실행 후 `steps`/`created_files`/`explanation`을 출력 채널에 요약한다. 라이브 SSE 타임라인은 아직 웹 전용이다 (◐).
+- 파싱 계약은 `tests/vscode-extension.test.cjs`가 sidecar 페이로드 모양 그대로 검증한다.
+
+## v9.9.7 — 남은 갭을 닫은 방법
+
+- **VS Code 라이브 스텝**: `POST /agent`에 `stream: true`가 생겼다. 웹이 채팅
+  경로로 받던 것과 **같은** `agent_step` 프레임을 그대로 내보내고, 마지막 프레임의
+  터미널 페이로드는 JSON 응답과 동일하다 (`tests/unit/test_agent_stream_parity.py`가
+  두 경로의 동등성을 고정한다).
+- **VS Code 근거→행동**: 회상 응답의 `grounding.cited`를 확장이 기억했다가
+  `/api/evidence/actions`로 보낸다. 파일을 만드는 액션은 에이전트로 흘려보내
+  실제 산출물이 나오게 하고, 대화 액션은 채팅 패널로 보낸다.
+- **Telegram 회상 배지 / Review Center**: 서버가 낸 판정을 그대로 렌더하고,
+  `/review`가 `/api/proposals`를 그대로 소비한다. 409는 "아무것도 쓰지 않았다"로
+  보고한다.
+- **Browser 확장**: 캡처 전용 경계를 넘어 `/chat` 질문과 `agent/approvals` 대기
+  건수를 보여 준다. **판정을 로컬에서 계산하지 않는다** — 판정이 없으면
+  "근거 확인 불가"이며 절대 "근거 있음"으로 승격하지 않는다.

package/docs/TRUST_MODEL.md

@@ -1,6 +1,6 @@
 # Lattice AI Trust Model
 
-Current release: **9.9.4 — Durable Loops**.
+Current release: **9.9.9 — Lean Shell**.
 
 Lattice AI is local-first, explicit about external communication, and honest
 when a capability is unavailable.

package/docs/WHY_LATTICE.md

@@ -1,6 +1,6 @@
 # Why Lattice AI Exists
 
-Current release: **9.9.4 — Durable Loops**.
+Current release: **9.9.9 — Lean Shell**.
 
 **Lattice AI is a local-first Digital Brain that keeps your knowledge durable
 across any AI model.**

package/docs/kg-schema.md

@@ -1,6 +1,6 @@
 # Knowledge Graph Schema
 
-Current release: **9.9.4 — Durable Loops**.
+Current release: **9.9.9 — Lean Shell**.
 
 명세 출처: `lattice_ai_full_spec.pptx` 슬라이드 20·21·22
 구현: `lattice_brain/graph/schema.py`