feat(z890): Container Agent diagnostic service - #1035
Conversation
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (9)
✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 380e02c0db
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - 'container-agent' | ||
| - 'nats-leaf' |
There was a problem hiding this comment.
bash-tool-damage-control.py treats any chitBypassPatterns match as a full skip of zero-access checks (re.search(...) at lines 224-231). Adding bare substrings like container-agent and nats-leaf here means any Bash command that merely mentions those names can now read protected env files; for example, grep nats-leaf pmoves/env.shared would bypass the repo's .env protections. These bypass entries need to target the specific trusted make/script entrypoints, not generic service names.
Useful? React with 👍 / 👎.
|
|
||
| UPSTREAM_SERVICES: Dict[str, Tuple[str, int, str]] = { | ||
| "host-gateway": ("host.docker.internal", 7422, "Host → 5090 NATS leafnode port"), | ||
| "host-nats-client": ("host.docker.internal", 4222, "Host → 5090 NATS client port (proxy)"), |
There was a problem hiding this comment.
The new diagnostic expects host.docker.internal:4222 to be a host-side proxy, but the canonical setup script for this stack only creates a 7422 -> 7422 portproxy rule (pmoves/scripts/z890_host_setup.ps1:46-48). On a node configured via make -C pmoves z890-host-setup, this host-nats-client check therefore stays closed even when the documented setup is correct, so /diagnostic cannot reach the advertised 5/5 services state without extra undocumented host networking.
Useful? React with 👍 / 👎.
| "dns": f"{dns_ok}/{len(dns_results)} resolved", | ||
| "services": f"{svc_ok}/{len(svc_results)} reachable", | ||
| "nats": "connected" if nats_result["ok"] else "disconnected", | ||
| "healthy": dns_ok > 0 and nats_result["ok"], |
There was a problem hiding this comment.
summary.healthy only checks dns_ok > 0 and a client connection to the local leaf node. If the Windows portproxy or upstream 5090 bridge breaks, check_nats() still succeeds against nats-leaf:4222 while the upstream probes fail, so /diagnostic and make diag-z890 will continue to report the node as healthy during the exact networking outage this sidecar is meant to catch.
Useful? React with 👍 / 👎.
Network diagnostic sidecar for Docker fleet networking. Runs on each node to probe inter-container connectivity, DNS, upstream reachability, and NATS health. - Add container-agent service (python:3.11-slim + aiohttp + nats-py) - Endpoints: GET /healthz, GET /diagnostic, GET /metrics - NATS heartbeat loop (mesh.container.agent.v1 every 30s) - Add to docker-compose.z890.yml on port 8111 - Add container_agent to infra team in agent-teams.yaml - Add diag-z890 Make target Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Register z890 infrastructure commands as Known Roads in the CHIT damage-control system so netsh operations route through the canonical Make targets. - Add netsh Known Roads ask-pattern directing to make z890-host-setup - Add z890/nats-leaf/container-agent to chitBypassPatterns - Add 13 permissions.allow rules for z890 Make targets and CA endpoints - Add netsh row to Known Roads table in CLAUDE.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
380e02c to
57f67bb
Compare
Docker Hardening ValidationHardening Validation ReportValidated: Thu Mar 19 21:28:21 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
🌿 PR Trim — Thread Classification
Summary: 2 fixes applied (security bypass tightening, health summary logic). The host-nats-client probe (#2) is informational — it reports what the container can reach, which is useful even when the portproxy isn't configured. Documentation update tracked separately. |
Addresses actionable review threads from 6 admin-merged PRs: - SKILL.md (cipher-beats): fix ffmeg→ffmpeg typo, add code block language tags, normalize analysed→analyzed spelling (#1031) - SKILL.md (holographic-blocks): add code block language tags, use canonical geometry.cgp.v1 subject name (#1031) - portal.js: preserve gateway URL scheme (http/https→ws/wss), replace fabricated Math.random() stats with "—" placeholder (#1033) - patterns.yaml: restrict CHIT bypass patterns from bare substrings to scoped make-target/file-path regexes (#1035) - container-agent/app.py: include upstream service probes in healthy summary assessment (#1035) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Root cause: PR #1035 merge accident introduced a byte-identical duplicate of the `container-agent:` service block. Git blame confirms both blocks were authored on 2026-03-19, 12 minutes apart: - e769a9d "feat(z890): add Container Agent diagnostic service" (17:16:42) - 615fbf1 "feat(z890): Container Agent diagnostic service (#1035)" (17:28:02) YAML strict-mode parsers reject duplicate keys at the same level: `line 80: mapping key "container-agent" already defined at line 45` This has silently broken `make -C pmoves up-z890` for ~8 weeks, meaning Container Agent + nats-leaf have never deployed on Z890 since the duplicate landed. Mesh Agent ran (no nats-leaf health dependency check at deploy time) but kept failing to connect to a non-existent local NATS leaf. Validation: diff <(sed -n '45,76p' compose) <(sed -n '80,111p' compose) # exit 0 docker compose -f pmoves/docker-compose.z890.yml config --services nats-leaf container-agent mesh-agent pmoves-ollama Authorization: Z890 CLAUDE infra coordinator per `feedback_extend_chit_tooling.md` (extend chitSafePaths instead of working around damage-control blocks). Adding `pmoves/docker-compose.z890.yml` to chitSafePaths with documented reason is the canonical bypass pattern matching existing entries in the file (e.g., PR #1347 MINIO_IMAGE fix, A2A activation enable). User explicitly authorized the patterns.yaml self-edit after auto-mode classifier gate. Post-fix: `make -C pmoves up-z890` parses cleanly, network/volumes created, 4 services deploy. nats-leaf reports unhealthy because upstream NATS leafnode endpoint on pmoves-powerfulmoves is currently unreachable — that's a separate cross-node issue, not introduced by this fix. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 participant
Summary
Changes
pmoves/services/container-agent/pmoves/docker-compose.z890.ymlpmoves/configs/agent-teams.yamlpmoves/Makefile.claude/hooks/damage-control/patterns.yaml.claude/settings.json.claude/CLAUDE.mdDepends on
Test plan
make diag-z890outputs formatted JSON diagnostic reportnetshand redirect tomake z890-host-setup🤖 Generated with Claude Code