Skip to content

feat(cipher): add TAC tree for Cipher Memory integration #1023

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
POWERFULMOVES merged 1 commit into from
Mar 19, 2026
Merged

feat(cipher): add TAC tree for Cipher Memory integration #1023

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
257 changes: 257 additions & 0 deletions pmoves/configs/tac_trees/cipher-memory.tac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,257 @@
# TAC Tree: Cipher Memory — Knowledge Graph Memory for Agents
# Audits Neo4j backend, MCP bridge, embedding pipeline, NATS integration, gateway routing

name: "Cipher Memory"
version: "1.0.0"
description: "Verify Cipher Memory (port 8096): Neo4j-backed knowledge graph, MCP bridge, embedding-first storage, gateway integration, and BoTZ agent memory patterns"

root:
id: cipher-memory
task: "Cipher Memory system review"
context: "pmoves/services/cipher-api/ + pmoves-cipher-mcp/"
agent_hint: codex
children:

# =========================================================================
# Phase 1: Core Service
# =========================================================================
- id: cipher.service
task: "Cipher API service"
context: "pmoves/docker-compose.yml"
agent_hint: codex
children:
- id: cipher.service.compose
task: "Cipher API defined in compose"
action:
type: grep
target: "pmoves/docker-compose.yml"
pattern: "cipher-api:"
expect: "Service on port 8096"
context: "Knowledge-graph memory for Claude Code and agents"
agent_hint: codex

- id: cipher.service.healthcheck
task: "Health endpoint configured"
action:
type: http
target: "http://localhost:8096/health"
Comment on lines +36 to +37

@chatgpt-codex-connector chatgpt-codex-connector Bot Mar 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Replace unsupported http TAC action types

When this tree is executed by pmoves/tools/tac_runner.py or /tac:review, this node never performs the health check because the TAC schema and runner only implement file_exists, grep, command, and manual actions (pmoves/configs/tac_schema.yaml, pmoves/tools/tac_runner.py:evaluate_node). The result stays pending, and pending nodes do not make the runner exit nonzero, so a broken Cipher /health or Neo4j endpoint can still produce a successful audit. The same issue appears again at cipher.botz.knowledge-graph.

Useful? React with 👍 / 👎.

expect: "HTTP 200"
context: "GET /health"
agent_hint: codex

- id: cipher.service.neo4j-dep
task: "Neo4j dependency declared"
action:
type: grep
target: "pmoves/docker-compose.yml"
pattern: "cipher.*neo4j|depends_on.*neo4j"
expect: "cipher-api depends on neo4j service_healthy"
Comment on lines +42 to +48

@coderabbitai coderabbitai Bot Mar 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Neo4j dependency check is brittle and can false-fail.

The current regex assumes cross-line matching in nested YAML, so valid depends_on -> neo4j -> condition: service_healthy config can be missed.

🔧 Suggested adjustment 
-        - id: cipher.service.neo4j-dep
-          task: "Neo4j dependency declared"
-          action:
-            type: grep
-            target: "pmoves/docker-compose.yml"
-            pattern: "cipher.*neo4j|depends_on.*neo4j"
-            expect: "cipher-api depends on neo4j service_healthy"
+        - id: cipher.service.neo4j-uri
+          task: "Neo4j backend URI configured"
+          action:
+            type: grep
+            target: "pmoves/docker-compose.yml"
+            pattern: "NEO4J_URI=bolt://neo4j:7687"
+            expect: "Cipher API points to Neo4j backend"
+
+        - id: cipher.service.neo4j-dep
+          task: "Neo4j dependency declared"
+          action:
+            type: grep
+            target: "pmoves/docker-compose.yml"
+            pattern: "condition: service_healthy"
+            expect: "Neo4j dependency is health-gated in compose"
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@pmoves/configs/tac_trees/cipher-memory.tac.yaml` around lines 42 - 48, The
grep rule under id cipher.service.neo4j-dep (action.type: grep, pattern) is
brittle because it assumes cross-line regex matching and can miss a valid nested
depends_on -> neo4j -> condition: service_healthy block; replace the simple grep
with a YAML-aware assertion (parse the compose YAML and verify service
cipher-api has depends_on.neo4j.condition == "service_healthy") or, if keeping
grep, change the check to either a DOTALL-enabled regex (e.g., use a (?s) /s
flag to allow newlines) or split into sequential checks that confirm
"depends_on:" exists, that "neo4j" is listed under it, and that "condition:
service_healthy" appears in that service block so the nested structure is
correctly validated.

context: "Neo4j (7474/7687) is the persistence backend"
agent_hint: codex

# =========================================================================
# Phase 2: Embedding Pipeline — Dark Matter Grade
# =========================================================================
- id: cipher.embeddings
task: "Embedding pipeline quality"
context: "pmoves/libs/providers/embedding.py"
agent_hint: codex
children:
- id: cipher.embeddings.model
task: "Embedding model is production-grade"
action:
type: grep
target: "pmoves/libs/providers/embedding.py"
pattern: "qwen3-embedding"
expect: "Default Ollama embed model is qwen3-embedding:8b, not nomic-embed-text or all-MiniLM"
context: "Embeddings are dark matter gold — drives Hi-RAG, Cipher, prosodic cross-dimensional"
agent_hint: codex

- id: cipher.embeddings.tensorzero-route
task: "Embeddings route through TensorZero gateway"
action:
type: grep
target: "pmoves/libs/providers/embedding.py"
pattern: "TENSORZERO_BASE"
expect: "TensorZero is first provider in fallback chain"
context: "Gateway routing ensures observability on all embedding calls"
agent_hint: codex

- id: cipher.embeddings.named-vectors
task: "Named vectors enabled for multi-dimensional"
action:
type: grep
target: "pmoves/services/extract-worker/worker.py"
pattern: "QDRANT_USE_NAMED_VECTORS"
expect: "Feature flag exists for semantic + prosodic named vectors"
context: "PR #1010 (named vectors) + #1011 (prosodic) now merged"
agent_hint: codex

- id: cipher.embeddings.reflexive-loadout
task: "GPU model registry has embedding in reflexive loadout"
action:
type: grep
target: "pmoves/config/gpu-models.yaml"
pattern: "Reflexive Loadout.*Qwen3 Embedding"
expect: "qwen3-embedding:8b at priority 10"
context: "Must auto-load at GPU orchestrator startup"
agent_hint: codex

# =========================================================================
# Phase 3: MCP Bridge
# =========================================================================
- id: cipher.mcp
task: "MCP bridge for Claude Code and agents"
context: "pmoves-cipher-mcp/"
agent_hint: codex
children:
- id: cipher.mcp.transport
task: "MCP bridge uses stdio transport"
action:
type: grep
target: "pmoves-cipher-mcp/"
pattern: "stdio"
expect: "stdio transport for Claude Code integration"
context: "Runs as sidecar process, not HTTP"
agent_hint: codex
Comment on lines +108 to +116

@coderabbitai coderabbitai Bot Mar 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Transport assertion conflicts with current deployment wiring.

This node enforces stdio, but cipher-api in compose is configured with --mcp-transport-type sse. The TAC should validate the active runtime mode (or allow both modes explicitly).

🔧 Suggested adjustment 
-        - id: cipher.mcp.transport
-          task: "MCP bridge uses stdio transport"
+        - id: cipher.mcp.transport
+          task: "MCP transport mode explicitly configured"
           action:
             type: grep
-            target: "pmoves-cipher-mcp/"
-            pattern: "stdio"
-            expect: "stdio transport for Claude Code integration"
+            target: "pmoves/docker-compose.yml"
+            pattern: "--mcp-transport-type.*(sse|stdio)"
+            expect: "MCP transport mode is explicit for deployment/runtime"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- id: cipher.mcp.transport
task: "MCP bridge uses stdio transport"
action:
type: grep
target: "pmoves-cipher-mcp/"
pattern: "stdio"
expect: "stdio transport for Claude Code integration"
context: "Runs as sidecar process, not HTTP"
agent_hint: codex
- id: cipher.mcp.transport
task: "MCP transport mode explicitly configured"
action:
type: grep
target: "pmoves/docker-compose.yml"
pattern: "--mcp-transport-type.*(sse|stdio)"
expect: "MCP transport mode is explicit for deployment/runtime"
context: "Runs as sidecar process, not HTTP"
agent_hint: codex
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@pmoves/configs/tac_trees/cipher-memory.tac.yaml` around lines 108 - 116, The
TAC node with id "cipher.mcp.transport" currently asserts only "stdio" (task
"MCP bridge uses stdio transport", action grep target "pmoves-cipher-mcp"
pattern "stdio"), which conflicts with compose using "--mcp-transport-type sse";
update this node to validate the actual runtime mode or accept both modes by
changing the action to check for either "stdio" or "sse" (or add a conditional
that inspects the running args/env and then asserts the matching transport), and
update the expect/context messages accordingly so the check covers both valid
deployment wiring options.


- id: cipher.mcp.tools
task: "MCP tools registered"
action:
type: grep
target: "pmoves-cipher-mcp/"
pattern: "pmoves_cipher_store|pmoves_cipher_search|pmoves_cipher_store_reasoning|pmoves_cipher_reasoning_patterns"
expect: "4 MCP tools: store, search, store_reasoning, reasoning_patterns"
context: "Tools callable by Claude Code CLI and Agent Zero"
agent_hint: codex

# =========================================================================
# Phase 4: Gateway Integration
# =========================================================================
- id: cipher.gateway
task: "Gateway and TensorZero integration"
context: "pmoves/services/gateway/"
agent_hint: codex
children:
- id: cipher.gateway.chit-route
task: "CHIT endpoints route through gateway"
action:
type: grep
target: "pmoves/services/gateway/gateway/api/chit.py"
pattern: "cipher|memory"
expect: "Gateway CHIT API can delegate to Cipher for storage"
Comment on lines +139 to +142

@chatgpt-codex-connector chatgpt-codex-connector Bot Mar 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Make the CHIT→Cipher check specific enough to avoid false passes

This regex is too broad to verify the behavior described in expect. In the current repo it already matches the unrelated cryptography.hazmat.primitives.ciphers.aead import in pmoves/services/gateway/gateway/api/chit.py, so this node can pass even if the gateway has no Cipher-memory delegation at all. That gives the TAC runner a green result for a feature it did not actually validate.

Useful? React with 👍 / 👎.

context: "Always cipher with gateway — embeddings flow through both"
agent_hint: codex

- id: cipher.gateway.tensorzero-obs
task: "Embedding calls logged in TensorZero"
action:
type: grep
target: "pmoves/tensorzero/config/tensorzero.toml"
pattern: "embed"
expect: "Embedding model configured in TensorZero for observability"
context: "Every embedding call tracked: tokens, latency, provider"
agent_hint: codex

# =========================================================================
# Phase 5: NATS Event Integration
# =========================================================================
- id: cipher.nats
task: "NATS event bus integration"
context: "pmoves/services/cipher-api/"
agent_hint: codex
children:
- id: cipher.nats.publish
task: "Cipher publishes memory events"
action:
type: grep
target: "pmoves/services/cipher-api/"
pattern: "nats.*publish|NATS"
Comment on lines +168 to +169

@chatgpt-codex-connector chatgpt-codex-connector Bot Mar 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Point the NATS audit at the actual Cipher codebase

These checks target pmoves/services/cipher-api/, but that path does not exist in this repo. The cipher-api service is built from ../Pmoves-cipher (pmoves/docker-compose.yml:2108-2133), and the NATS publishing logic lives under pmoves-cipher-mcp/cipher_mcp/nats_events.py. As written, both Phase 5 greps will always fail with target not found, so the tree reports a regression even when Cipher’s NATS integration is present.

Useful? React with 👍 / 👎.

expect: "Publishes memory store/search events for agent coordination"
context: "BoTZ agents subscribe to cipher events for knowledge sync"
agent_hint: codex

- id: cipher.nats.subscribe
task: "Cipher subscribes to agent trail events"
action:
type: grep
target: "pmoves/services/cipher-api/"
pattern: "agent.graphiti.signed"
expect: "Subscribes to Graphiti trail for automatic memory ingestion"
Comment on lines +159 to +180

@coderabbitai coderabbitai Bot Mar 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Verify TAC targets exist =="
for p in \
  pmoves/services/cipher-api \
  pmoves-cipher-mcp \
  pmoves/services/gateway/gateway/api/chit.py \
  pmoves/services/hi-rag-gateway-v2/app.py \
  pmoves/config/agent_registry.yaml \
  pmoves/tensorzero/config/tensorzero.toml \
  pmoves/docker-compose.yml
do
  if [ -e "$p" ]; then
    echo "FOUND   $p"
  else
    echo "MISSING $p"
  fi
done

echo
echo "== Show cipher-api source wiring in compose =="
rg -n -C2 'cipher-api:|build:|context:|mcp-transport-type' pmoves/docker-compose.yml

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 12590

Remove or correct TAC checks targeting non-existent cipher-api path.

The TAC checks at lines 159-180 target pmoves/services/cipher-api/, which does not exist in this repository. Cipher-api is built from an external repository (../Pmoves-cipher, as seen in docker-compose.yml line 2111), so these grep patterns will not find the source code. Either remove these checks or adjust them to reference the correct external repository path if cipher-api source is included elsewhere.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@pmoves/configs/tac_trees/cipher-memory.tac.yaml` around lines 159 - 180, The
TAC checks under ids cipher.nats, cipher.nats.publish and cipher.nats.subscribe
reference a non-existent target value ("pmoves/services/cipher-api/") so their
grep actions will always fail; either remove these TAC entries or update their
action.target to point to the actual cipher-api source location (the external
cipher repo used by docker-compose) and/or adjust the grep patterns
(action.pattern) accordingly; ensure any retained checks correctly reference the
repository where cipher-api lives and validate that expect messages still match
the code found.

context: "Agent trail entries auto-stored in Cipher knowledge graph"
agent_hint: codex

# =========================================================================
# Phase 6: BoTZ Agent Memory Patterns
# =========================================================================
- id: cipher.botz
task: "BoTZ agent memory integration"
context: "pmoves/config/agent_registry.yaml"
agent_hint: codex
children:
- id: cipher.botz.agent-registry
task: "Cipher registered as agent capability"
action:
type: grep
target: "pmoves/config/agent_registry.yaml"
pattern: "cipher"
expect: "cipher_api agent in registry with memory capabilities"
context: "All BoTZ agents should use Cipher for persistent memory"
agent_hint: codex

- id: cipher.botz.reasoning-traces
task: "Reasoning trace storage via MCP"
action:
type: grep
target: "pmoves-cipher-mcp/"
pattern: "store_reasoning|reasoning_patterns"
expect: "Reasoning traces stored in Neo4j with CHIT attribution"
context: "Enables pattern discovery across agent sessions"
agent_hint: codex

- id: cipher.botz.knowledge-graph
task: "Neo4j graph supports relationship traversal"
action:
type: http
target: "http://localhost:7474/db/neo4j/health"
expect: "HTTP 200 — Neo4j operational"
context: "Graph queries power Cipher search: entities, relationships, patterns"
agent_hint: codex

# =========================================================================
# Phase 7: Advanced Features (Post-Integration)
# =========================================================================
- id: cipher.advanced
task: "Advanced Cipher features roadmap"
context: "Future integration targets"
agent_hint: codex
children:
- id: cipher.advanced.cross-dimensional
task: "Cross-dimensional embedding queries"
action:
type: grep
target: "pmoves/services/hi-rag-gateway-v2/app.py"
pattern: "cross-dimensional|cross_dimensional"
expect: "Endpoint exists at /hirag/query/cross-dimensional"
context: "Cipher memories queryable in both semantic and prosodic spaces"
agent_hint: codex

- id: cipher.advanced.chit-encoding
task: "CHIT CGP encoding for memory provenance"
action:
type: grep
target: "pmoves/services/gateway/gateway/api/chit.py"
pattern: "cgp|CGP"
expect: "CGP packets encode memory provenance and attribution"
context: "Every Cipher memory entry traceable via CHIT trail"
agent_hint: codex

- id: cipher.advanced.multi-agent-sync
task: "Multi-agent memory synchronization"
action:
type: grep
target: "pmoves/config/agent_registry.yaml"
pattern: "cipher.*nats|memory.*sync"
expect: "Agents coordinate memory via NATS pub/sub"
context: "ClawZ, Crush, Agent Zero all share Cipher memory layer"
agent_hint: codex
Loading