ltcai 9.9.9 → 10.2.0

package/lattice_brain/sensitivity.py

@@ -0,0 +1,94 @@
+"""Which local sources are never allowed to leave the machine.
+
+This lives in Brain Core rather than in the app layer because it is a property
+of the *data*, not of any transport: a node stamped never-leaves stays that way
+whether it is read by the cloud path, an export, or a future surface nobody has
+written yet. Brain Core cannot import from ``latticeai`` (see
+``tests/unit/test_import_guard.py``), so the app-layer network boundary imports
+this, not the other way round.
+
+Deliberately narrow. These are locations whose *entire purpose* is to hold
+secrets, so a match is a fact about the path rather than a guess about content.
+A broader heuristic — scanning text for things that look like keys — would
+produce false confidence in both directions: it would miss secrets in unusual
+shapes and quarantine ordinary notes that merely discuss credentials.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Optional
+
+# Path fragments checked case-insensitively against the POSIX form of the path.
+SENSITIVE_PATH_FRAGMENTS: tuple = (
+    "/.ssh/",
+    "/.gnupg/",
+    "/.aws/",
+    "/.kube/",
+    "/.docker/config.json",
+    "/.netrc",
+    "/.npmrc",
+    "/.pypirc",
+    "/.git-credentials",
+    "id_rsa",
+    "id_ed25519",
+    ".pem",
+    ".p12",
+    ".pfx",
+    ".keystore",
+)
+
+# Exact filenames (in any directory) that are secret-bearing by convention.
+SENSITIVE_FILENAMES: frozenset = frozenset({
+    ".env",
+    ".env.local",
+    ".env.production",
+    ".env.development",
+    "credentials",
+    "secrets.yaml",
+    "secrets.yml",
+    "secrets.json",
+})
+
+#: Metadata key stamped on a node that must never leave the machine.
+LOCAL_ONLY_FLAG = "local_only"
+#: Companion key holding the human-readable reason.
+LOCAL_ONLY_REASON = "local_only_reason"
+
+
+def sensitive_reason_for_path(path: Any) -> Optional[str]:
+    """Return why ``path`` is never-leaves, or ``None`` if it is ordinary."""
+    if not path:
+        return None
+    lowered = str(path).replace("\\", "/").lower()
+    name = lowered.rsplit("/", 1)[-1]
+    if name in SENSITIVE_FILENAMES:
+        return f"{name!r} is a secret-bearing filename"
+    for fragment in SENSITIVE_PATH_FRAGMENTS:
+        if fragment in lowered:
+            return f"path contains {fragment!r}"
+    return None
+
+
+def stamp_sensitivity(metadata: dict, path: Any) -> Optional[str]:
+    """Stamp never-leaves onto ``metadata`` when ``path`` warrants it.
+
+    Returns the reason it stamped, or ``None``. Never clears an existing flag —
+    a user or another rule may have set it for a reason this function cannot
+    see, and downgrading a never-leaves marker is not a decision code should
+    make on its own.
+    """
+    reason = sensitive_reason_for_path(path)
+    if reason:
+        metadata[LOCAL_ONLY_FLAG] = True
+        metadata.setdefault(LOCAL_ONLY_REASON, reason)
+    return reason
+
+
+__all__ = [
+    "SENSITIVE_PATH_FRAGMENTS",
+    "SENSITIVE_FILENAMES",
+    "LOCAL_ONLY_FLAG",
+    "LOCAL_ONLY_REASON",
+    "sensitive_reason_for_path",
+    "stamp_sensitivity",
+]

package/lattice_brain/storage/base.py

@@ -3,9 +3,10 @@
 from __future__ import annotations
 
 from abc import ABC, abstractmethod
+from contextlib import contextmanager
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Dict, Optional
+from typing import Any, Dict, Iterator, Optional
 
 
 class StorageUnavailable(RuntimeError):
@@ -58,7 +59,34 @@ class StorageEngine(ABC):
 
     @abstractmethod
     def connect(self) -> Any:
-        """Return a DB-API-like connection for this engine."""
+        """Return a DB-API-like connection for this engine.
+
+        The caller owns the connection and must close it. Prefer
+        :meth:`session`, which does that for you — a bare ``connect()`` is only
+        correct when the statement cannot run inside a transaction (``VACUUM``)
+        or when the connection must outlive one block.
+        """
+
+    @contextmanager
+    def session(self) -> Iterator[Any]:
+        """Transactional connection that is always closed.
+
+        ``with sqlite3.connect(...) as conn`` commits or rolls back — it does
+        **not** close. Every site that relied on that leaked a file descriptor
+        until the connection was garbage collected, which CPython usually did
+        promptly enough to hide it. Anything holding a frame alive (a coverage
+        tracer, a profiler, a logged traceback) delays that collection and the
+        descriptors accumulate until the process hits ``EMFILE``.
+
+        This yields inside ``with conn`` so commit/rollback semantics are
+        unchanged, then closes in ``finally``.
+        """
+        conn = self.connect()
+        try:
+            with conn:
+                yield conn
+        finally:
+            conn.close()
 
     @abstractmethod
     def backup(self, destination: Path) -> Dict[str, Any]:

package/lattice_brain/storage/migration.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import sqlite3
+from contextlib import closing
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Dict, List
@@ -52,7 +53,7 @@ class SQLiteToPostgresMigrator:
     def plan(self) -> Dict[str, Any]:
         if not self.sqlite_path.exists():
             raise FileNotFoundError(f"SQLite brain database not found: {self.sqlite_path}")
-        with sqlite3.connect(str(self.sqlite_path)) as conn:
+        with closing(sqlite3.connect(str(self.sqlite_path))) as conn, conn:
             conn.row_factory = sqlite3.Row
             table_names = [
                 row["name"]
@@ -119,7 +120,7 @@ class SQLiteToPostgresMigrator:
         schema = _quote_ident(self.target.config.schema)
         copied: Dict[str, int] = {}
         self.target.initialize()
-        with sqlite3.connect(str(self.sqlite_path)) as src, self.target.connect() as dst:
+        with closing(sqlite3.connect(str(self.sqlite_path))) as src, self.target.session() as dst:
             src.row_factory = sqlite3.Row
             with dst.cursor() as cur:
                 for table in plan["tables"]:

package/lattice_brain/storage/postgres.py

@@ -45,7 +45,7 @@ class PostgresEngine(StorageEngine):
 
     def initialize(self) -> Dict[str, Any]:
         schema = _quote_ident(self.config.schema)
-        with self.connect() as conn:
+        with self.session() as conn:
             with conn.cursor() as cur:
                 cur.execute("CREATE EXTENSION IF NOT EXISTS vector")
                 cur.execute(f"CREATE SCHEMA IF NOT EXISTS {schema}")
@@ -85,7 +85,7 @@ class PostgresEngine(StorageEngine):
 
     def capabilities(self) -> StorageCapabilities:
         try:
-            with self.connect() as conn:
+            with self.session() as conn:
                 with conn.cursor() as cur:
                     cur.execute("SELECT extname FROM pg_extension WHERE extname='vector'")
                     pgvector = cur.fetchone() is not None

package/lattice_brain/storage/sqlite.py

@@ -9,9 +9,11 @@ from __future__ import annotations
 
 import shutil
 import sqlite3
+from contextlib import closing
 from pathlib import Path
 from typing import Any, Dict, Optional
 
+from ..quiet import quiet
 from .base import StorageCapabilities, StorageEngine
 
 
@@ -23,7 +25,7 @@ def _load_sqlite_vec(conn: sqlite3.Connection) -> tuple[bool, Optional[str]]:
     try:
         conn.enable_load_extension(True)
     except Exception:
-        pass
+        quiet()
     try:
         sqlite_vec.load(conn)
     except Exception as exc:
@@ -53,7 +55,7 @@ class SQLiteEngine(StorageEngine):
         return conn
 
     def initialize(self) -> Dict[str, Any]:
-        with self.connect() as conn:
+        with self.session() as conn:
             conn.execute(
                 """
                 CREATE TABLE IF NOT EXISTS storage_meta (
@@ -86,7 +88,7 @@ class SQLiteEngine(StorageEngine):
             )
         # Probe on demand so status is accurate even before the graph opens.
         try:
-            with self.connect():
+            with self.session():
                 pass
         except Exception as exc:
             return StorageCapabilities(
@@ -122,7 +124,7 @@ class SQLiteEngine(StorageEngine):
     def backup(self, destination: Path) -> Dict[str, Any]:
         dest = Path(destination)
         dest.parent.mkdir(parents=True, exist_ok=True)
-        with self.connect() as src, sqlite3.connect(str(dest)) as dst:
+        with self.session() as src, closing(sqlite3.connect(str(dest))) as dst:
             src.backup(dst)
         return {"engine": self.name, "path": str(dest), "bytes": dest.stat().st_size}
 

package/lattice_brain/workflow.py

@@ -26,10 +26,12 @@ from __future__ import annotations
 from dataclasses import dataclass, field
 from typing import Any, Callable, Dict, List, Optional
 
-from lattice_brain.runtime.contracts import runtime_boundary_contract, workflow_run_contract
+from lattice_brain.runtime.contracts import (
+    runtime_boundary_contract,
+    workflow_run_contract,
+)
 from lattice_brain.utils import now_iso as _now
 
-
 WORKFLOW_ENGINE_VERSION = "2.2.0"
 
 # The node vocabulary a workflow can be built from. ``trigger`` and ``output``

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "9.9.9"
+__version__ = "10.2.0"

package/latticeai/api/admin.py

@@ -223,7 +223,7 @@ def create_admin_router(
     async def admin_roles(request: Request):
         _, users = require_admin(request)
         counts: Dict[str, int] = defaultdict(int)
-        for email, user in users.items():
+        for email, user in users.items():  # noqa: B007 — the key is the payload; the loop var documents the shape
             role = (get_user_role(email, users) or "user").lower()
             counts[role] += 1
         matrix = policy_matrix() if policy_matrix else [

package/latticeai/api/agents.py

@@ -16,7 +16,6 @@ from pydantic import BaseModel
 
 from latticeai.api.ui_redirects import app_redirect
 
-
 _CORE_EXECUTION_ROLES = ["planner", "executor", "reviewer"]
 _MEMORY_GROUNDED_ROLES = ["researcher", *_CORE_EXECUTION_ROLES]
 
@@ -63,8 +62,11 @@ def create_agents_router(
     agent_runtime: Any = None,
     run_executor: Any = None,
 ) -> APIRouter:
+    from lattice_brain.runtime.agent_runtime import (
+        AgentRuntime,
+        AgentRuntimeUnavailable,
+    )
     from lattice_brain.runtime.multi_agent import AGENT_ROLES, ROLE_AGENT_IDS
-    from lattice_brain.runtime.agent_runtime import AgentRuntime, AgentRuntimeUnavailable
 
     # Single AgentRuntime boundary: the router (and via it, the frontend) talks
     # to this façade instead of reaching into the orchestrator/store directly.

package/latticeai/api/auth.py

@@ -13,12 +13,16 @@ from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import JSONResponse, RedirectResponse
 from pydantic import BaseModel
 
-from latticeai.core.users import normalize_email
 from latticeai.core.oidc import (
     OIDCValidationError,
+)
+from latticeai.core.oidc import (
     fetch_jwks as _default_fetch_jwks,
+)
+from latticeai.core.oidc import (
     verify_id_token as _default_verify_id_token,
 )
+from latticeai.core.users import normalize_email
 
 
 class UserRegister(BaseModel):

package/latticeai/api/automation_intelligence.py

@@ -20,6 +20,7 @@ from typing import Any, Callable, Optional
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
+from latticeai.core.quiet import quiet
 from latticeai.services.automation_execution import (
     build_last_execution,
     dry_run_report,
@@ -162,7 +163,7 @@ def create_automation_intelligence_router(
                 workspace_id=scope,
             )
         except Exception:  # noqa: BLE001 — surfacing must never undo the run
-            pass
+            quiet()
 
     @router.post("/api/automation/run-now")
     async def automation_run_now(req: AutomationRunNowRequest, request: Request):

package/latticeai/api/browser.py

@@ -26,8 +26,9 @@ from urllib.parse import SplitResult, urljoin, urlsplit, urlunsplit
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
-from latticeai import __version__
 from lattice_brain.ingestion import IngestionItem, capture_quality_verdict
+from latticeai import __version__
+from latticeai.core.quiet import quiet
 
 MAX_TAB_BYTES = 4 * 1024 * 1024          # 4 MB per captured tab payload
 MAX_URL_FETCH_BYTES = 4 * 1024 * 1024    # 4 MB cap on a fetched page
@@ -95,7 +96,7 @@ def extract_readable_text(html: str) -> Tuple[str, str]:
     try:
         parser.feed(html or "")
     except Exception:  # noqa: BLE001 — malformed HTML must still yield best-effort text
-        pass
+        quiet()
     return parser.title.strip(), parser.text()
 
 

package/latticeai/api/chat.py

@@ -16,7 +16,6 @@ from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import JSONResponse, StreamingResponse
 
 from latticeai.api.chat_agent_http import AgentHTTPController
-from latticeai.core.project_sessions import ProjectSessionStore
 from latticeai.api.chat_contracts import (
     AgentEvalRequest,
     AgentRequest,
@@ -46,9 +45,14 @@ from latticeai.api.chat_helpers import (
     workspace_scope_from_request,
 )
 from latticeai.api.chat_history import HistoryRouteDependencies, register_history_routes
-from latticeai.core.run_store import AgentRunStore
+from latticeai.api.chat_hybrid import (
+    maybe_hybrid_stream_response,
+    resolve_request_network_mode,
+)
 from latticeai.api.chat_intents import ChatIntentController
 from latticeai.api.chat_stream import stream_chat
+from latticeai.core.project_sessions import ProjectSessionStore
+from latticeai.core.run_store import AgentRunStore
 from latticeai.services.app_context import AppContext
 from latticeai.services.chat_service import ChatService
 from latticeai.services.tool_dispatch import build_agent_runtime, enforce_tool_policy
@@ -61,7 +65,6 @@ from latticeai.tools import (
     network_status,
 )
 
-
 __all__ = [
     "AgentEvalRequest",
     "AgentRequest",
@@ -163,8 +166,6 @@ def create_chat_router(context: AppContext) -> APIRouter:
 
     agent_runtime = context.chat_agent_runtime
     if agent_runtime is None:
-        # Keep construction here so the historical monkeypatch/import seam on
-        # latticeai.api.chat.build_agent_runtime remains valid.
         agent_runtime = build_agent_runtime(
             model_router=model_router,
             execute_tool=execute_tool,
@@ -198,8 +199,6 @@ def create_chat_router(context: AppContext) -> APIRouter:
             if context.data_dir
             else None
         ),
-        # Multi-turn project loop (v9.9.6): optional — without a data dir the
-        # agent runs exactly as before, one run at a time with no project state.
         project_sessions=(
             ProjectSessionStore(Path(context.data_dir) / "project_sessions")
             if context.data_dir
@@ -293,8 +292,6 @@ def create_chat_router(context: AppContext) -> APIRouter:
         selected_model_id = request_model(req.model)
         file_intent = is_file_action_request(req.message)
         if file_intent and context.funnel_metrics is not None:
-            # UX funnel (backlog #16): one file-intent request counted once,
-            # regardless of which delivery path handles it below.
             context.funnel_metrics.increment("file_requests")
         if file_intent:
             direct_response = await intent_controller.direct_file_action(
@@ -386,9 +383,6 @@ def create_chat_router(context: AppContext) -> APIRouter:
         if context_trace is not None and isinstance(trace_seed, dict):
             trace_seed["context_assembly"] = context_trace
 
-        # v9.8.0 honest RAG signal: how well the graph grounded this answer.
-        # Rides the same channel as sources/evidence (the answer trace) and is
-        # additionally exposed top-level on both response shapes below.
         context_quality = build_context_quality(
             req.message,
             knowledge_graph=context.knowledge_graph
@@ -401,8 +395,6 @@ def create_chat_router(context: AppContext) -> APIRouter:
         if context.funnel_metrics is not None and int(
             context_quality.get("nodes") or 0
         ) > 0:
-            # UX funnel (backlog #16): a grounded answer is "first value" —
-            # the TTFV clock ends on the first successful recall.
             context.funnel_metrics.record_recall_success()
 
         history_message = (
@@ -428,6 +420,28 @@ def create_chat_router(context: AppContext) -> APIRouter:
         if document_response is not None:
             return document_response
 
+        # Hybrid Phase 2: cloud_allowed → minimal KG context → cloud stream.
+        network_mode = resolve_request_network_mode(
+            request_mode=getattr(req, "network_mode", None),
+            user_email=effective_email,
+            workspace_id=workspace_id,
+        )
+        hybrid_response = maybe_hybrid_stream_response(
+            req=req,
+            mode=network_mode,
+            knowledge_graph=context.knowledge_graph,
+            enable_graph=context.enable_graph,
+            effective_email=effective_email,
+            workspace_id=workspace_id,
+            history_meta=history_meta,
+            history_user=history_user,
+            chat_service=chat_service,
+            notify=notify_chat_message,
+            model_id=selected_model_id,
+        )
+        if hybrid_response is not None:
+            return hybrid_response
+
         if req.stream:
             recent_context = recent_chat_context(
                 user_email=effective_email,
@@ -493,9 +507,6 @@ def create_chat_router(context: AppContext) -> APIRouter:
             req.image_data,
         )
         response_text = str(result)
-        # Answer-citation binding (backlog #11): annotate — never block — how
-        # the answer relates to the retrieved sources. Recorded on the trace
-        # so the Review/proof surfaces see the same verdict as the client.
         grounding = assess_answer_grounding(
             response_text,
             trace=trace_seed if isinstance(trace_seed, dict) else None,

package/latticeai/api/chat_agent_http.py

@@ -17,10 +17,19 @@ from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import StreamingResponse
 
 from lattice_brain.runtime.hooks import dispatch_tool
-from latticeai.api.chat_contracts import AgentEvalRequest, AgentRequest, AgentResumeRequest
-from latticeai.api.chat_helpers import _LANG_HINT, detect_language, workspace_scope_from_request
+from latticeai.api.chat_contracts import (
+    AgentEvalRequest,
+    AgentRequest,
+    AgentResumeRequest,
+)
+from latticeai.api.chat_helpers import (
+    _LANG_HINT,
+    detect_language,
+    workspace_scope_from_request,
+)
 from latticeai.api.chat_stream import agent_live_stream
 from latticeai.core.agent import AgentRunContext, AgentState, normalize_plan
+from latticeai.core.quiet import quiet
 from latticeai.core.run_explain import explain_run
 from latticeai.core.run_store import (
     AgentRunStore,
@@ -139,7 +148,7 @@ class AgentHTTPController:
             try:
                 done.result()
             except asyncio.CancelledError:
-                pass
+                quiet()
             except Exception as exc:
                 logging.warning("background chat task failed: %s", exc)
 
@@ -188,7 +197,12 @@ class AgentHTTPController:
                     self.hooks,
                     action_name,
                     case_input,
-                    lambda: self.execute_tool(action_name, case_input),
+                    # Bound as defaults: the lambda is invoked inside this
+                    # iteration today, so late binding is harmless — until
+                    # someone defers it and every case runs the last input.
+                    lambda action_name=action_name, case_input=case_input: self.execute_tool(
+                        action_name, case_input
+                    ),
                     source="eval",
                 )
                 criteria = case.get("pass_criteria", "")
@@ -470,7 +484,7 @@ class AgentHTTPController:
                 try:
                     self.run_store.delete(run_id)
                 except Exception:  # noqa: BLE001 — hygiene only
-                    pass
+                    quiet()
 
     def pending_approvals(self, request: Request) -> Dict[str, Any]:
         """Unexpired paused runs for the current user (memory ∪ disk).
@@ -525,7 +539,7 @@ class AgentHTTPController:
             try:
                 self.run_store.delete(run_id)
             except Exception:  # noqa: BLE001
-                pass
+                quiet()
             raise HTTPException(
                 status_code=410,
                 detail={
@@ -724,7 +738,7 @@ class AgentHTTPController:
                 try:
                     self.run_store.delete(req.context_id)
                 except Exception:  # noqa: BLE001
-                    pass
+                    quiet()
                 raise HTTPException(
                     status_code=404,
                     detail="Agent context not found or expired. Start a new request.",
@@ -791,7 +805,7 @@ class AgentHTTPController:
                 try:
                     self.run_store.delete(req.run_id or "")
                 except Exception:  # noqa: BLE001
-                    pass
+                    quiet()
                 raise HTTPException(
                     status_code=410,
                     detail={

package/latticeai/api/chat_contracts.py

@@ -21,6 +21,10 @@ class ChatRequest(BaseModel):
     user_nickname: Optional[str] = None
     image_data: Optional[str] = None
     allow_file_context: bool = False
+    # Hybrid Phase 1: optional per-request override of NetworkBoundaryMode.
+    # When omitted, the persisted dial (user/workspace/default) is used.
+    # Values: "local_only" | "cloud_allowed"
+    network_mode: Optional[str] = None
 
 
 class AgentRequest(BaseModel):

package/latticeai/api/chat_documents.py

@@ -20,7 +20,11 @@ from latticeai.core.context_builder import (
     format_sources_footnote,
     retrieve_context_for_generation,
 )
-from latticeai.core.document_generator import DocumentGenerationSession, detect_document_intent
+from latticeai.core.document_generator import (
+    DocumentGenerationSession,
+    detect_document_intent,
+)
+from latticeai.core.quiet import quiet
 
 
 def extract_screenshot_context(image_data: Optional[str]) -> str:
@@ -77,7 +81,7 @@ def extract_screenshot_context(image_data: Optional[str]) -> str:
             try:
                 Path(temp_path).unlink()
             except OSError:
-                pass
+                quiet()
     return "\n".join(lines)
 
 

package/latticeai/api/chat_hybrid.py

@@ -0,0 +1,82 @@
+"""Chat-path helpers for hybrid cloud branching (Phase 2).
+
+Keeps the main chat router thin: resolve network mode, decide whether to
+enter the hybrid stream, and build the StreamingResponse.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+from fastapi.responses import StreamingResponse
+
+from latticeai.core.network_boundary import (
+    NetworkBoundaryMode,
+    normalize_network_mode,
+)
+from latticeai.runtime.network_boundary_wiring import resolve_active_network_mode
+from latticeai.services.hybrid_chat import stream_hybrid_cloud_turn
+
+
+def resolve_request_network_mode(
+    *,
+    request_mode: Optional[str],
+    user_email: Optional[str],
+    workspace_id: Optional[str],
+) -> NetworkBoundaryMode:
+    """Per-request override wins; otherwise use the persisted dial."""
+    if request_mode:
+        return normalize_network_mode(request_mode)
+    return normalize_network_mode(
+        resolve_active_network_mode(user_email=user_email, workspace_id=workspace_id)
+    )
+
+
+def maybe_hybrid_stream_response(
+    *,
+    req: Any,
+    mode: NetworkBoundaryMode,
+    knowledge_graph: Any,
+    enable_graph: bool,
+    effective_email: Optional[str],
+    workspace_id: Optional[str],
+    history_meta: Dict[str, Any],
+    history_user: Dict[str, Any],
+    chat_service: Any,
+    notify: Any,
+    model_id: Optional[str],
+) -> Optional[StreamingResponse]:
+    """Return a StreamingResponse when cloud path should run; else None."""
+    if mode != NetworkBoundaryMode.CLOUD_ALLOWED:
+        return None
+    if not (enable_graph and knowledge_graph is not None):
+        # Without a graph there is nothing minimal to send; fall back to local.
+        return None
+
+    return StreamingResponse(
+        stream_hybrid_cloud_turn(
+            user_message=req.message,
+            knowledge_graph=knowledge_graph,
+            mode=mode,
+            workspace_id=workspace_id,
+            user_email=effective_email,
+            model=model_id,
+            chat_service=chat_service,
+            history_meta=history_meta,
+            history_user=history_user,
+            notify=notify,
+            source=req.source,
+        ),
+        media_type="text/event-stream",
+        headers={
+            "X-Model": model_id or "cloud",
+            "X-Network-Mode": mode.value,
+            "X-Hybrid": "1",
+        },
+    )
+
+
+__all__ = [
+    "resolve_request_network_mode",
+    "maybe_hybrid_stream_response",
+]