Skip to content

chore(submodules): promote nested submodule pointers + PMOVES.AI integration#12

Merged
POWERFULMOVES merged 37 commits intomainfrom
chore/promote-nested-submodule-pointers
Apr 19, 2026
Merged

chore(submodules): promote nested submodule pointers + PMOVES.AI integration#12
POWERFULMOVES merged 37 commits intomainfrom
chore/promote-nested-submodule-pointers

Conversation

@POWERFULMOVES
Copy link
Copy Markdown
Owner

Summary

Promotes the PMOVES.AI-Edition-Hardened integration work (36 commits) including:

  • Nested submodule pointer promotions (HiRAG +1, BotZ-gateway +1)
  • GitHub App token minting and client
  • Security hardening (USER directive, NATS auth, PBKDF2 iterations)
  • Hi-RAG v2 semantic expansion integration
  • Prometheus metrics endpoint
  • Claude Code MCP adapter
  • Persona service and API routes

Nested submodule promotions (latest commit)

Submodule Old SHA New SHA Change
external/PMOVES-HiRAG 89d4abf e904b12 CHIT + geometry bus context (PR #4)
pmoves_multi_agent_pro_pack/PMOVES-BotZ-gateway 40e1e33 2565022 Log identifier sanitization (PR #4)

Both commits are merged on their respective origin/main branches.

Context

Part of Phase 5 close-out (superproject submodule triage). The 4 remaining nested subs (BoTZ, Deep-Serch, tensorzero, docling) have matching gitlinks but internal dirty content — no pointer promotion needed.

Test plan

  • Verify nested submodule pointers resolve correctly
  • CI passes

🤖 Generated with Claude Code

leex279 and others added 30 commits November 8, 2025 18:31
Remove the standalone Docusaurus documentation website to simplify the project structure and reduce maintenance overhead.

Changes:
- Delete /docs directory (480MB freed) containing all Docusaurus files
- Remove docker-compose.docs.yml (optional docs service)
- Remove ARCHON_DOCS_PORT from .env.example
- Update .github/workflows/release-notes.yml (remove docs section)
- Update .github/test-release-notes.sh (remove docs section)

Preserved:
- Project documents feature (archon-ui-main/src/features/projects/documents/)
- Backend document service (python/src/server/services/projects/document_service.py)
- Project documents API endpoints (/api/projects/{id}/docs)

Benefits:
- Eliminates redundancy (content duplicated in /PRPs/ai_docs/)
- Reduces complexity (removes 480MB dependencies and configuration)
- Simplifies deployment (eliminates optional Docker service on port 3838)
- Lowers maintenance burden (single documentation source)

All validation tests passed:
✓ File system validation
✓ Backend imports verification
✓ Docker Compose integration testing
✓ CI/CD workflow validation
✓ Project documents API still functional

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Implements OpenRouter as an embedding provider option, enabling access to multiple
embedding models (OpenAI, Google Gemini, Qwen3, Mistral) through a single API key.

Backend changes:
- Add validate_openrouter_api_key() for API key validation (sk-or-v1- format)
- Add OpenRouterErrorAdapter for error sanitization
- Add openrouter to valid providers in llm_provider_service
- Create openrouter_discovery_service with hardcoded model list
- Create /api/openrouter/models endpoint for model discovery
- Register OpenRouter router in FastAPI main app

Frontend changes:
- Create openrouterService.ts for model discovery API client
- Add OpenRouter to RAGSettings.tsx provider options
- Configure default models with provider prefix (openai/text-embedding-3-small)
- Add OpenRouter to embedding-capable providers list

Documentation:
- Update .env.example with OPENROUTER_API_KEY documentation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Tests cover:
- Model list validation (non-empty, valid types)
- Provider prefix validation (all models have provider/)
- Data validation (positive dimensions, non-negative pricing)
- Provider validation (valid provider names)
- Specific provider models (OpenAI, Qwen)
- Model ID validation (requires prefix)

All 11 tests passing.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Changed grid-cols-3 to grid-cols-4 for embedding provider selection
so all 4 embedding-capable providers (OpenAI, Google, OpenRouter, Ollama)
fit on one line, matching the chat provider layout.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Added 'openrouter' to embedding_capable_providers set in credential_service.py
to prevent it from being rejected and falling back to OpenAI.

Fixes: 'Invalid embedding provider openrouter doesn't support embeddings' error

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
1. Lazy initialization of baseUrl via getBaseUrl() method
   - Allows API URL to be updated at runtime without stale URL issues

2. Runtime validation of API response structure
   - Validates embedding_models array exists before caching
   - Prevents invalid responses from being cached

Addresses CodeRabbit nitpick comments on PR coleam00#852

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Implemented comprehensive validation to prevent crashes from corrupted cache:
- Created isCacheEntry() type guard to validate cache structure
- Parse JSON into unknown type (TypeScript strict mode compliant)
- Validate timestamp is number and data has OpenRouterModelListResponse shape
- Validate each model has all required fields with correct types
- Remove corrupted cache entries to avoid repeated failures
- No 'any' types used, full strict mode compliance

Prevents crashes from malformed cache data while maintaining type safety.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Enhanced validation to catch malformed responses early:
- Validate total_count is non-negative number
- Verify total_count matches embedding_models.length
- Validate first model has required fields (id, provider, dimensions)
- Check dimensions are positive numbers
- Validate provider names are from expected set
- Provide specific error messages for each validation failure

Prevents caching invalid data and provides better debugging information.

Addresses CodeRabbit nitpick comment on PR coleam00#852

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
…us-documentation

Remove Docusaurus documentation system
…ddings-support

Add OpenRouter Embeddings Support
Adds repository security files:
- CODEOWNERS for PR review routing
- dependabot.yml for automated security updates

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…ation

- Add .gitmodules with 7 nested integrations:
  - PMOVES-Agent-Zero (agent orchestration)
  - PMOVES-BoTZ (MCP tools)
  - PMOVES-HiRAG (knowledge retrieval)
  - PMOVES-Deep-Serch (deep research)
  - docling (document processing)
  - PMOVES-BotZ-gateway (MCP gateway)
  - PMOVES-tensorzero (TensorZero client)

- Fix PydanticAI Agent initialization (remove invalid result_type parameter)

Enables Archon to run standalone with PMOVES.AI service connections.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New module: python/pmoves_mcp/
- claude_code_adapter.py: Async MCP adapter for Claude Code CLI
- __init__.py: Module exports

Features:
- Execute TAC slash commands via Agent Zero's MCP interface
- ClaudeCodeMCPAdapter with async httpx client
- CommandResult dataclass for structured responses
- ARCHON_MCP_TOOLS registration for Archon integration

Available commands through adapter:
- /search:hirag, /search:supaserch, /search:deepresearch
- /health:check-all, /health:metrics
- /agents:status, /agents:mcp-query
- /deploy:smoke-test, /deploy:services, /deploy:up
- /botz:init, /botz:profile, /botz:mcp, /botz:secrets

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove HTTPException catch that was allowing uploads to proceed with invalid credentials
- Aligns with beta guidelines: authentication failures should halt execution
- Addresses code review feedback from PR #1

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Bump revision from 1 to 3
- Add upload-time fields for PyPI packages
- Sync with latest uv dependency resolution

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add /metrics endpoint for Prometheus scraping with:
- HTTP request counter (by method, endpoint, status)
- HTTP request duration histogram
- Knowledge operations counter
- MCP commands execution counter

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add optional Hi-RAG v2 integration for knowledge-aware keyword discovery
- Enable semantic keyword expansion via PMOVES knowledge graph
- Add hirag_url parameter to KeywordExtractor for knowledge graph queries
- Improves search relevance with ontology-driven term expansion

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(pmoves-ai): Add PMOVES.AI integration patterns

- Add CHIT secrets manifest (chit/secrets_manifest_v2.yaml)
- Add tier-based environment loading (env.shared, env.tier-agent.sh)
- Add health check module (pmoves_health/)
- Add NATS service announcer (pmoves_announcer/)
- Add service registry client (pmoves_registry/)
- Add Docker Compose YAML anchors (docker-compose.pmoves.yml)
- Add integration documentation (PMOVES.AI_INTEGRATION.md)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(integration): Apply Phase 1 critical bug fixes

- Fix deprecated datetime.utcnow() → datetime.now(timezone.utc)
- Fix YAML environment merge (list → map for proper merging)
- Fix health check decorator accumulation bug
- Fix health endpoint status codes (return 503 when unhealthy)
- Remove APP/UI tiers (stick to 6-tier architecture)
- Fix resource leaks in NATS connections (try/finally)

* fix(security): Remove hardcoded credential defaults

- Neo4j: Remove neo4j:neo4j default credentials
- MinIO: Remove minioadmin:minioadmin default credentials
- ClickHouse: Remove tensorzero:tensorzero default credentials
- Fix typo: export_CACHE_TTL → export CACHE_TTL

Empty defaults now require explicit configuration for production use.

* refactor(code-quality): Phase 3 & 4 improvements

Phase 3: Code Quality
- Add pmoves_common shared types module (ServiceTier, HealthStatus)
- Update ServiceTier imports with fallback to shared module
- Remove duplicate ServiceTier enum definitions

Phase 4: Documentation
- Add comprehensive module docstrings to all integration modules
- Create .coderabbit.yaml for automated PR reviews
- Enable reviews on feat/* and fix/* branches
- Set docstring coverage target to 80%

This reduces code duplication and improves type consistency across
the PMOVES.AI ecosystem.

---------

Co-authored-by: POWERFULMOVES <POWERFULMOVES@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Add CI/CD workflows: ci.yml, claude-fix.yml, claude-review.yml, release-notes.yml
- Update submodule references to latest commits

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Fix dependabot.yml: Point pip to /python, npm to /archon-ui-main
- Add branch = main to docling submodule in .gitmodules
- Add prometheus-client>=0.20.0 to all dependency group

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…les, persona service

Syncs 4 commits from main to PMOVES.AI-Edition-Hardened:

- Claude Code MCP adapter for PMOVES.AI integration
- CODEOWNERS configuration (security)
- Nested submodule integrations for standalone operation
- Persona service and API routes for agent creation

Includes CodeRabbit review fixes:
- Fixed route ordering (/thread-types before /{persona_id})
- Added proper error handling and validation
- Removed Git conflict markers
- Fixed .coderabbit.yaml configuration

🤖 Generated with Claude Code
Kept HEAD (Hardened) improvements:
- openrouter_router inclusion in main.py
- thread-types endpoint before /{persona_id} (correct FastAPI routing order)
- 404 detection for persona-not-found errors
- field_validator for behavior_weights range [0.0, 1.0]
- AgentZeroCreateResponse model for upstream validation
- ValidationError handling in persona deserialization
- Sanitized error logging (no response.text in logs)

Kept main additions:
- PersonaCreateRequest model in persona_service.py

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove `export` prefix from all variables (incompatible with Docker env_file)
- Update NATS_URL default to include pmoves credentials
- Update usage comment to reflect Docker Compose env_file pattern

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
POWERFULMOVES and others added 6 commits March 2, 2026 05:38
Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Shaela Bello <slbello@uncg.edu>
Run as non-root user (uid 65532) to satisfy BuildKit audit and
defense-in-depth container hardening requirements.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Implements GitHub App integration for agent work orders with:
- Token minting with JWT RS256 signing (10-min lifetime)
- Installation token exchange via GitHub API
- Token caching with 50-minute expiry window
- GitHubClient with App token + gh CLI fallback
- Full test coverage for token minting and PR operations

Environment variables required:
- GH_APP_ID: GitHub App numeric ID
- GH_APP_SEC: PEM private key (handles double-escaped env values)
- GH_APP_INSTALLATION_ID: Installation ID for org access

Key features:
- mint_installation_token(): Creates short-lived JWT + exchanges for token
- get_installation_token(): Cached token retrieval with force_refresh option
- clear_token_cache(): Manual cache invalidation
- GitHubClient.list_pull_requests(): API-first with CLI fallback
- Graceful degradation when credentials unavailable

Security considerations:
- PEM keys stored in env.tier-agent (plaintext - production hardening needed)
- No persistent token storage (in-memory cache only)
- Short-lived tokens (JWT <10min, installation tokens = 1 hour)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…eway)

- external/PMOVES-HiRAG: 89d4abf→e904b12 (CHIT + geometry bus context, PR #4)
- pmoves_multi_agent_pro_pack/PMOVES-BotZ-gateway: 40e1e33→2565022 (log sanitizer, PR #4)

Both commits are merged on their respective origin/main branches.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 17, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1fd24de7-9f69-4fa0-948b-e3f180c3d4b4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/promote-nested-submodule-pointers

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e04f02feba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +44 to +45
if self._token:
return self._token
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Refresh GitHub App token when cached token expires

_get_token returns self._token forever once it is set, but installation tokens are short-lived and the minter module is designed to rotate them (it caches for 50 minutes ahead of GitHub’s 60-minute lifetime). In a long-running service, this client-level cache will eventually reuse an expired token and GitHub API calls will start failing with auth errors until restart; call get_installation_token() each time (or track expiry in this class) so rotation can occur.

Useful? React with 👍 / 👎.

Comment on lines +175 to +176
"--json",
"--limit",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Provide field list for gh pr list JSON output

The gh-CLI fallback passes --json without the required field list, so the next token (--limit) is consumed as the argument and the command fails instead of returning PRs. This breaks the exact fallback path used when app-token auth is unavailable; gh pr list should be called with --json <fields> (for example number,title,state,...) before --limit.

Useful? React with 👍 / 👎.

- Recovered 3 wiped nested subs: Deep-Serch (88 files), tensorzero
  (2906 files), docling (839 files) — same wipe pattern as Phase 5
- Recovered 6 wiped sub-sub-subs inside nested BoTZ copy
- Promoted 7 skill repo pointer advances in nested BoTZ copy

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@POWERFULMOVES POWERFULMOVES merged commit 166afac into main Apr 19, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants