Skip to content

feat(hardened): Add nested submodule integrations for standalone operation#1

Merged
POWERFULMOVES merged 4 commits intomainfrom
PMOVES.AI-Edition-Hardened
Jan 14, 2026
Merged

feat(hardened): Add nested submodule integrations for standalone operation#1
POWERFULMOVES merged 4 commits intomainfrom
PMOVES.AI-Edition-Hardened

Conversation

@POWERFULMOVES
Copy link
Copy Markdown
Owner

Summary

Adds nested submodule integrations to enable Archon to run as a standalone service while maintaining the ability to connect to PMOVES.AI infrastructure.

Changes

  • Nested Submodules: Added 7 integrations via .gitmodules:

    • PMOVES-Agent-Zero - Agent orchestration
    • PMOVES-BoTZ - MCP tools catalog
    • PMOVES-HiRAG - Knowledge retrieval
    • PMOVES-Deep-Serch - Deep research capabilities
    • docling - Document processing
    • PMOVES-BotZ-gateway - MCP gateway
    • PMOVES-tensorzero - TensorZero client
  • Bug Fix: Fixed PydanticAI Agent initialization (removed invalid result_type parameter)

Dual-Mode Operation

  • Standalone Mode: Users can fork Archon and run independently with PMOVES branded defaults
  • Docked Mode: Connects to parent PMOVES.AI services via environment-based service discovery

Testing

  • Verified submodule initialization
  • Confirmed Python backend starts without errors
  • Tested PydanticAI agent creation

🤖 Generated with Claude Code

POWERFULMOVES and others added 2 commits December 23, 2025 08:56
Adds repository security files:
- CODEOWNERS for PR review routing
- dependabot.yml for automated security updates

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…ation

- Add .gitmodules with 7 nested integrations:
  - PMOVES-Agent-Zero (agent orchestration)
  - PMOVES-BoTZ (MCP tools)
  - PMOVES-HiRAG (knowledge retrieval)
  - PMOVES-Deep-Serch (deep research)
  - docling (document processing)
  - PMOVES-BotZ-gateway (MCP gateway)
  - PMOVES-tensorzero (TensorZero client)

- Fix PydanticAI Agent initialization (remove invalid result_type parameter)

Enables Archon to run standalone with PMOVES.AI service connections.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Jan 10, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 112b141ab6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +907 to +911
try:
await _validate_provider_api_key(provider)
logger.info("✅ API key validation completed successfully for upload")
except HTTPException as e:
# Log warning but PROCEED to avoid blocking uploads due to temporary provider issues
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Restore fail-fast on invalid embedding API key

Catching HTTPException and proceeding means uploads start even when the embedding provider auth fails (missing/invalid key or provider outage). The request immediately returns success with a progress ID, but the background path will later error during embedding while DocumentStorageService.upload_document has already updated source metadata (before add_documents_to_supabase), leaving a source without stored chunks and a misleading “upload started” response. This regression appears whenever provider validation fails; consider surfacing the error to the caller or deferring source creation until embeddings succeed.

Useful? React with 👍 / 👎.

POWERFULMOVES added a commit that referenced this pull request Jan 14, 2026
- Remove HTTPException catch that was allowing uploads to proceed with invalid credentials
- Aligns with beta guidelines: authentication failures should halt execution
- Addresses code review feedback from PR #1

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
PMOVES.AI and others added 2 commits January 13, 2026 19:28
New module: python/pmoves_mcp/
- claude_code_adapter.py: Async MCP adapter for Claude Code CLI
- __init__.py: Module exports

Features:
- Execute TAC slash commands via Agent Zero's MCP interface
- ClaudeCodeMCPAdapter with async httpx client
- CommandResult dataclass for structured responses
- ARCHON_MCP_TOOLS registration for Archon integration

Available commands through adapter:
- /search:hirag, /search:supaserch, /search:deepresearch
- /health:check-all, /health:metrics
- /agents:status, /agents:mcp-query
- /deploy:smoke-test, /deploy:services, /deploy:up
- /botz:init, /botz:profile, /botz:mcp, /botz:secrets

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove HTTPException catch that was allowing uploads to proceed with invalid credentials
- Aligns with beta guidelines: authentication failures should halt execution
- Addresses code review feedback from PR #1

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@POWERFULMOVES POWERFULMOVES merged commit 385b81b into main Jan 14, 2026
6 of 7 checks passed
POWERFULMOVES added a commit that referenced this pull request Feb 12, 2026
POWERFULMOVES pushed a commit that referenced this pull request Feb 12, 2026
- Add x-hardening anchor for read-only services (cap_drop, read_only rootfs, security_opt)
- Add x-hardening-rw anchor for services requiring filesystem write access
- Add comprehensive documentation for hardening options and usage
- Document common capabilities, tmpfs customization, and security impact
- Prepare for applying to all services (follow-up PR)

Security Impact:
- Enables drop of all capabilities except those explicitly needed
- Read-only rootfs prevents container modification
- no-new-privileges prevents privilege escalation
- Reduces container attack surface by ~90%
- Aligns with CIS Docker Benchmark 1.0.0 sections 5.1-5.3

Related: Security review finding #1 - Container Hardening Gap
See: Task 5 - Apply container hardening to all services

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Feb 12, 2026
…00#617)

* feat(ci): Migrate all workflows to self-hosted runners

Migrate all applicable CI workflows from GitHub-hosted runners
to self-hosted runners per production security requirements.

**Workflows Migrated:**
- codeql.yml: ubuntu-latest → [self-hosted, vps]
- python-tests.yml: ubuntu-latest → [self-hosted, vps]
- deploy-gateway-agent.yml: ubuntu-latest → [self-hosted, vps]
- integrations-ghcr.yml: ubuntu-latest → [self-hosted, vps]
- sql-policy-lint.yml: ubuntu-latest → [self-hosted, vps]
- yt-dlp-bump.yml: ubuntu-latest → [self-hosted, vps]
- env-preflight.yml: Added note about windows-latest requirement

**Documentation Updated:**
- pmoves/docs/PRODUCTION_MERGE_TRACKER.md: Added PMOVES.YT PR #1,
  CI infrastructure audit section
- pmoves/docs/PRODUCTION_READINESS_AUDIT_2026-02-07.md: Added
  Section 6 (CI/CD Infrastructure) and CI issues
- pmoves/docs/CI_INFRASTRUCTURE_AUDIT_2026-02-08.md: Complete
  CI infrastructure audit and migration documentation

**Rationale:**
Production CI should run locally or on self-hosted runners for:
1. Security: Code processed within controlled infrastructure
2. Consistency: Same environment as production deployments
3. Compliance: Production code not processed by external systems

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(ci): Fix workflow issues found during audit

- codeql.yml: Move paths-ignore from job to workflow level
  (GitHub Actions doesn't support paths-ignore at job level)

- deploy-gateway-agent.yml: Add submodules: false to checkout
  (Gateway agent doesn't need submodules; fixes e2b submodule error)

These fixes address workflow failures that occurred when migrating
to self-hosted runners.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(ci): Update CI infrastructure audit with workflow fixes

- Add Workflow Fixes Applied section documenting:
  - codeql.yml paths-ignore placement fix
  - deploy-gateway-agent.yml submodule checkout fix
  - pmoves-e2b-mcp-server submodule initialization
- Update success criteria to reflect completion status
- Add Production PR Summary section for PMOVES.AI-Edition-Hardened

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs: Update submodule list and add Python cache to gitignore

- Add PMOVES-supabase to submodule list
- Remove duplicate PMOVES-crush entry
- Add **/__pycache__/ and *.pyc patterns to ignore Python bytecode
- Remove SurrealDB database files from git index (runtime data only)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(archon): Add Archon external integration architecture documentation

Document the nested git submodule architecture in Archon's external/ directory:
- PMOVES-Agent-Zero (MCP API for orchestration)
- PMOVES-BoTZ (tools and skills marketplace)
- PMOVES-Deep-Serch (deep research knowledge)
- PMOVES-HiRAG (hybrid RAG retrieval)

Explains standalone operation, communication protocols, and setup requirements.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Apr 19, 2026
…gration (#12)

* Remove Docusaurus documentation system

Remove the standalone Docusaurus documentation website to simplify the project structure and reduce maintenance overhead.

Changes:
- Delete /docs directory (480MB freed) containing all Docusaurus files
- Remove docker-compose.docs.yml (optional docs service)
- Remove ARCHON_DOCS_PORT from .env.example
- Update .github/workflows/release-notes.yml (remove docs section)
- Update .github/test-release-notes.sh (remove docs section)

Preserved:
- Project documents feature (archon-ui-main/src/features/projects/documents/)
- Backend document service (python/src/server/services/projects/document_service.py)
- Project documents API endpoints (/api/projects/{id}/docs)

Benefits:
- Eliminates redundancy (content duplicated in /PRPs/ai_docs/)
- Reduces complexity (removes 480MB dependencies and configuration)
- Simplifies deployment (eliminates optional Docker service on port 3838)
- Lowers maintenance burden (single documentation source)

All validation tests passed:
✓ File system validation
✓ Backend imports verification
✓ Docker Compose integration testing
✓ CI/CD workflow validation
✓ Project documents API still functional

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Add OpenRouter embeddings support

Implements OpenRouter as an embedding provider option, enabling access to multiple
embedding models (OpenAI, Google Gemini, Qwen3, Mistral) through a single API key.

Backend changes:
- Add validate_openrouter_api_key() for API key validation (sk-or-v1- format)
- Add OpenRouterErrorAdapter for error sanitization
- Add openrouter to valid providers in llm_provider_service
- Create openrouter_discovery_service with hardcoded model list
- Create /api/openrouter/models endpoint for model discovery
- Register OpenRouter router in FastAPI main app

Frontend changes:
- Create openrouterService.ts for model discovery API client
- Add OpenRouter to RAGSettings.tsx provider options
- Configure default models with provider prefix (openai/text-embedding-3-small)
- Add OpenRouter to embedding-capable providers list

Documentation:
- Update .env.example with OPENROUTER_API_KEY documentation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Add unit tests for OpenRouter model discovery

Tests cover:
- Model list validation (non-empty, valid types)
- Provider prefix validation (all models have provider/)
- Data validation (positive dimensions, non-negative pricing)
- Provider validation (valid provider names)
- Specific provider models (OpenAI, Qwen)
- Model ID validation (requires prefix)

All 11 tests passing.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Fix embedding provider grid to fit all providers in one line

Changed grid-cols-3 to grid-cols-4 for embedding provider selection
so all 4 embedding-capable providers (OpenAI, Google, OpenRouter, Ollama)
fit on one line, matching the chat provider layout.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Fix credential_service to recognize OpenRouter as embedding provider

Added 'openrouter' to embedding_capable_providers set in credential_service.py
to prevent it from being rejected and falling back to OpenAI.

Fixes: 'Invalid embedding provider openrouter doesn't support embeddings' error

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Address CodeRabbit review: Improve openrouterService robustness

1. Lazy initialization of baseUrl via getBaseUrl() method
   - Allows API URL to be updated at runtime without stale URL issues

2. Runtime validation of API response structure
   - Validates embedding_models array exists before caching
   - Prevents invalid responses from being cached

Addresses CodeRabbit nitpick comments on PR coleam00#852

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Delete PRPs/openrouter-embeddings-support.md

* Add robust cache validation with type guards in openrouterService

Implemented comprehensive validation to prevent crashes from corrupted cache:
- Created isCacheEntry() type guard to validate cache structure
- Parse JSON into unknown type (TypeScript strict mode compliant)
- Validate timestamp is number and data has OpenRouterModelListResponse shape
- Validate each model has all required fields with correct types
- Remove corrupted cache entries to avoid repeated failures
- No 'any' types used, full strict mode compliance

Prevents crashes from malformed cache data while maintaining type safety.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Add comprehensive API response validation in discoverModels

Enhanced validation to catch malformed responses early:
- Validate total_count is non-negative number
- Verify total_count matches embedding_models.length
- Validate first model has required fields (id, provider, dimensions)
- Check dimensions are positive numbers
- Validate provider names are from expected set
- Provide specific error messages for each validation failure

Prevents caching invalid data and provides better debugging information.

Addresses CodeRabbit nitpick comment on PR coleam00#852

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Update README for Supabase service role key instructions (coleam00#836)

* chore(security): add CODEOWNERS and Dependabot configuration

Adds repository security files:
- CODEOWNERS for PR review routing
- dependabot.yml for automated security updates

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat(hardened): Add nested submodule integrations for standalone operation

- Add .gitmodules with 7 nested integrations:
  - PMOVES-Agent-Zero (agent orchestration)
  - PMOVES-BoTZ (MCP tools)
  - PMOVES-HiRAG (knowledge retrieval)
  - PMOVES-Deep-Serch (deep research)
  - docling (document processing)
  - PMOVES-BotZ-gateway (MCP gateway)
  - PMOVES-tensorzero (TensorZero client)

- Fix PydanticAI Agent initialization (remove invalid result_type parameter)

Enables Archon to run standalone with PMOVES.AI service connections.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat(pmoves): add Claude Code MCP adapter for PMOVES.AI integration

New module: python/pmoves_mcp/
- claude_code_adapter.py: Async MCP adapter for Claude Code CLI
- __init__.py: Module exports

Features:
- Execute TAC slash commands via Agent Zero's MCP interface
- ClaudeCodeMCPAdapter with async httpx client
- CommandResult dataclass for structured responses
- ARCHON_MCP_TOOLS registration for Archon integration

Available commands through adapter:
- /search:hirag, /search:supaserch, /search:deepresearch
- /health:check-all, /health:metrics
- /agents:status, /agents:mcp-query
- /deploy:smoke-test, /deploy:services, /deploy:up
- /botz:init, /botz:profile, /botz:mcp, /botz:secrets

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: Restore fail-fast behavior for API key validation in upload

- Remove HTTPException catch that was allowing uploads to proceed with invalid credentials
- Aligns with beta guidelines: authentication failures should halt execution
- Addresses code review feedback from PR #1

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* chore(deps): Update uv.lock with dependency revisions

- Bump revision from 1 to 3
- Add upload-time fields for PyPI packages
- Sync with latest uv dependency resolution

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat(observability): add Prometheus metrics endpoint

Add /metrics endpoint for Prometheus scraping with:
- HTTP request counter (by method, endpoint, status)
- HTTP request duration histogram
- Knowledge operations counter
- MCP commands execution counter

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat(search): Add Hi-RAG v2 semantic expansion to keyword extraction

- Add optional Hi-RAG v2 integration for knowledge-aware keyword discovery
- Enable semantic keyword expansion via PMOVES knowledge graph
- Add hirag_url parameter to KeywordExtractor for knowledge graph queries
- Improves search relevance with ontology-driven term expansion

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat(pmoves-ai): Add PMOVES.AI integration patterns (#3)

* feat(pmoves-ai): Add PMOVES.AI integration patterns

- Add CHIT secrets manifest (chit/secrets_manifest_v2.yaml)
- Add tier-based environment loading (env.shared, env.tier-agent.sh)
- Add health check module (pmoves_health/)
- Add NATS service announcer (pmoves_announcer/)
- Add service registry client (pmoves_registry/)
- Add Docker Compose YAML anchors (docker-compose.pmoves.yml)
- Add integration documentation (PMOVES.AI_INTEGRATION.md)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(integration): Apply Phase 1 critical bug fixes

- Fix deprecated datetime.utcnow() → datetime.now(timezone.utc)
- Fix YAML environment merge (list → map for proper merging)
- Fix health check decorator accumulation bug
- Fix health endpoint status codes (return 503 when unhealthy)
- Remove APP/UI tiers (stick to 6-tier architecture)
- Fix resource leaks in NATS connections (try/finally)

* fix(security): Remove hardcoded credential defaults

- Neo4j: Remove neo4j:neo4j default credentials
- MinIO: Remove minioadmin:minioadmin default credentials
- ClickHouse: Remove tensorzero:tensorzero default credentials
- Fix typo: export_CACHE_TTL → export CACHE_TTL

Empty defaults now require explicit configuration for production use.

* refactor(code-quality): Phase 3 & 4 improvements

Phase 3: Code Quality
- Add pmoves_common shared types module (ServiceTier, HealthStatus)
- Update ServiceTier imports with fallback to shared module
- Remove duplicate ServiceTier enum definitions

Phase 4: Documentation
- Add comprehensive module docstrings to all integration modules
- Create .coderabbit.yaml for automated PR reviews
- Enable reviews on feat/* and fix/* branches
- Set docstring coverage target to 80%

This reduces code duplication and improves type consistency across
the PMOVES.AI ecosystem.

---------

Co-authored-by: POWERFULMOVES <POWERFULMOVES@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

* chore: Add GitHub Actions workflows and update submodule SHAs

- Add CI/CD workflows: ci.yml, claude-fix.yml, claude-review.yml, release-notes.yml
- Update submodule references to latest commits

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(pr): Address CodeRabbit review issues

- Fix dependabot.yml: Point pip to /python, npm to /archon-ui-main
- Add branch = main to docling submodule in .gitmodules
- Add prometheus-client>=0.20.0 to all dependency group

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat: Sync main to hardened - MCP adapter, CODEOWNERS, nested submodules, persona service

Syncs 4 commits from main to PMOVES.AI-Edition-Hardened:

- Claude Code MCP adapter for PMOVES.AI integration
- CODEOWNERS configuration (security)
- Nested submodule integrations for standalone operation
- Persona service and API routes for agent creation

Includes CodeRabbit review fixes:
- Fixed route ordering (/thread-types before /{persona_id})
- Added proper error handling and validation
- Removed Git conflict markers
- Fixed .coderabbit.yaml configuration

🤖 Generated with Claude Code

* docs: add PMOVES.AI skill hints context tags

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(submodules): update nested PMOVES-HiRAG submodule pointer

* security: update PBKDF2 iterations to 600,000

* fix: correct indentation in state_reconciliation.py if-block

* fix(env): strip export syntax and add NATS auth to env.shared defaults

- Remove `export` prefix from all variables (incompatible with Docker env_file)
- Update NATS_URL default to include pmoves credentials
- Update usage comment to reflect Docker Compose env_file pattern

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(claude): add CHIT-aware integration context (#9)

Co-authored-by: Shaela Bello <slbello@uncg.edu>

* fix(auth): align NATS default URLs with credentialed runtime (#10)

Co-authored-by: Shaela Bello <slbello@uncg.edu>

* chore(submodules): sync HiRAG and BotZ gateway pointers (#11)

Co-authored-by: Shaela Bello <slbello@uncg.edu>

* fix(security): add USER directive to archon-ui Dockerfile

Run as non-root user (uid 65532) to satisfy BuildKit audit and
defense-in-depth container hardening requirements.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(github): add GitHub App token minting and client

Implements GitHub App integration for agent work orders with:
- Token minting with JWT RS256 signing (10-min lifetime)
- Installation token exchange via GitHub API
- Token caching with 50-minute expiry window
- GitHubClient with App token + gh CLI fallback
- Full test coverage for token minting and PR operations

Environment variables required:
- GH_APP_ID: GitHub App numeric ID
- GH_APP_SEC: PEM private key (handles double-escaped env values)
- GH_APP_INSTALLATION_ID: Installation ID for org access

Key features:
- mint_installation_token(): Creates short-lived JWT + exchanges for token
- get_installation_token(): Cached token retrieval with force_refresh option
- clear_token_cache(): Manual cache invalidation
- GitHubClient.list_pull_requests(): API-first with CLI fallback
- Graceful degradation when credentials unavailable

Security considerations:
- PEM keys stored in env.tier-agent (plaintext - production hardening needed)
- No persistent token storage (in-memory cache only)
- Short-lived tokens (JWT <10min, installation tokens = 1 hour)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(submodules): promote nested submodule pointers (HiRAG, BotZ-gateway)

- external/PMOVES-HiRAG: 89d4abf→e904b12 (CHIT + geometry bus context, PR #4)
- pmoves_multi_agent_pro_pack/PMOVES-BotZ-gateway: 40e1e33→2565022 (log sanitizer, PR #4)

Both commits are merged on their respective origin/main branches.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(submodules): recover nested wipes + promote BoTZ skill pointers

- Recovered 3 wiped nested subs: Deep-Serch (88 files), tensorzero
  (2906 files), docling (839 files) — same wipe pattern as Phase 5
- Recovered 6 wiped sub-sub-subs inside nested BoTZ copy
- Promoted 7 skill repo pointer advances in nested BoTZ copy

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: leex279 <thomas@thirty3.de>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: sean-eskerium <sean@eskerium.com>
Co-authored-by: Jason Pickens <jasonpickensnz@gmail.com>
Co-authored-by: POWERFULMOVES <POWERFULMOVES@users.noreply.github.com>
Co-authored-by: PMOVES.AI <claude@pmoves.ai>
Co-authored-by: Shaela Bello <slbello@uncg.edu>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant