Skip to content

docs(agents): AGNOTE4482 claim — fleet networking + SSH hardening #1127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
POWERFULMOVES merged 1 commit into from
Mar 27, 2026
Merged

docs(agents): AGNOTE4482 claim — fleet networking + SSH hardening #1127

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,9 @@ Required handoff fields:
- `2026-03-21T22:15:00Z` RELEASE `5090-CLAUDE` scope: 28→0 COMPLETE. BoTZ PR #79 merged (fail-closed JWT auth with CHIT attestation, PUBLIC_ENDPOINTS frozenset, corrected endpoint docs). Supabase PR #1 merged (pmoves_auth module). Parent PR #1062 merged. Zero submodule drift confirmed. AGNOTEs updated. No open PRs on main repo. BoTZ has 2 Dependabot PRs (#89, #91) remaining.
- `2026-03-22T21:00:00Z` CLAIM `5090-CLAUDE` scope: Voice stack activation — 14-engine validation (13/14 load, 11/14 synth), Flute-Gateway UltimateTTSProvider Gradio 4.x migration (dead `/api/` path + 92→121 param alignment), 10-engine Flute sweep, 6 STT round-trips, pterm lifecycle validation, PR #1069.
- `2026-03-22T21:15:00Z` RELEASE `5090-CLAUDE` scope: Voice stack activated. PR #1069 pushed. 10/14 engines pass through Flute-Gateway REST API. STT round-trip proven (Flute TTS → Whisper = exact text match). Delegations issued: z890-claude (container rebuilds, Flute image rebuild), 4090-claude (P7→TTS Tailscale test, mobile agent test — both UNBLOCKED). Fish S2 Pro needs timeout increase. Pipecat WebSocket (8056) ready for implementation.
- `2026-03-25T14:00:00Z` CLAIM `Z890-CLAUDE` scope: Hostinger VPS fleet activation — KVM4-1 full stack (SSH key via Hostinger REST API, Tailscale mesh, Claude Code v2.1.83, Ollama 0.18.2, gh 2.73.0, wrangler 4.77.0, claw config with 8-binary exec-approvals). SSH keys injected into all 3 VMs (KVM4-1, KVM4-2, KVM2) via API password reset + paramiko. 5090+4090 agentic scope configs created (PRs #1097, #1098). nvidia-5090.mk populated. Fly.io instance decommissioned (offline, rx 0). Memory updated.
- `2026-03-26T04:00:00Z` CLAIM `Z890-CLAUDE` scope: Full fleet networking session. SSH key injection for 5090 (LAN .65, RTX 5090 32GB), 4090 laptop (LAN .234, RTX 4090 16GB), both Jetsons (.110 pmovesnvme-desktop, .144 pmoves-nano-2) via RustDesk terminal. SSH hardening across all 7 remote nodes (password auth disabled, MaxAuthTries 3). 5090 claw config deployed (SCP). RustDesk self-hosted server stood up on Z890 (hbbs+hbbr, key generated). Tailscale mesh expanded: KVM4-2 (100.124.50.76) + KVM2 (100.74.146.76) joined. 5090 renamed to pmoves-5090. 10 PRs merged/queued (#1097, #1098, #1113, #1115-#1119, #1121-#1124). LAN fully mapped (.234=4090 laptop identified). Bootstrap scripts created (enable-ssh-windows.ps1, enable-ssh-wsl.sh, setup-glances.sh, bootstrap-node.sh). Core vision + networking feedback committed to memory.

@coderabbitai coderabbitai Bot Mar 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Remove real IP addresses from claim text.

Line 86 contains multiple real IP addresses (LAN: .65, .234, .110, .144; Tailscale: 100.124.50.76, 100.74.146.76), violating the explicit guideline to avoid real IPs in claim text. The PR test plan checklist also states "No real IPs in the claim text."

As per coding guidelines: "Ensure the claim/register content remains collision-safe and validation-friendly for this PR's checks: keep DECLARATION ordering chronological and avoid 'real IPs' in any claim text (topology/IP sanitization is explicitly expected in this lane)."

🔒 Proposed fix: Sanitize IP addresses

Replace specific IP addresses with node identifiers or sanitized references:

-- `2026-03-26T04:00:00Z` CLAIM `Z890-CLAUDE` scope: Full fleet networking session. SSH key injection for 5090 (LAN .65, RTX 5090 32GB), 4090 laptop (LAN .234, RTX 4090 16GB), both Jetsons (.110 pmovesnvme-desktop, .144 pmoves-nano-2) via RustDesk terminal. SSH hardening across all 7 remote nodes (password auth disabled, MaxAuthTries 3). 5090 claw config deployed (SCP). RustDesk self-hosted server stood up on Z890 (hbbs+hbbr, key generated). Tailscale mesh expanded: KVM4-2 (100.124.50.76) + KVM2 (100.74.146.76) joined. 5090 renamed to pmoves-5090. 10 PRs merged/queued (`#1097`, `#1098`, `#1113`, `#1115-`#1119, `#1121-`#1124). LAN fully mapped (.234=4090 laptop identified). Bootstrap scripts created (enable-ssh-windows.ps1, enable-ssh-wsl.sh, setup-glances.sh, bootstrap-node.sh). Core vision + networking feedback committed to memory.
+- `2026-03-26T04:00:00Z` CLAIM `Z890-CLAUDE` scope: Full fleet networking session. SSH key injection for 5090 (RTX 5090 32GB), 4090 laptop (RTX 4090 16GB), both Jetsons (pmovesnvme-desktop, pmoves-nano-2) via RustDesk terminal. SSH hardening across all 7 remote nodes (password auth disabled, MaxAuthTries 3). 5090 claw config deployed (SCP). RustDesk self-hosted server stood up on Z890 (hbbs+hbbr, key generated). Tailscale mesh expanded: KVM4-2 + KVM2 joined. 5090 renamed to pmoves-5090. 10 PRs merged/queued (`#1097`, `#1098`, `#1113`, `#1115-`#1119, `#1121-`#1124). LAN nodes mapped and identified. Bootstrap scripts created (enable-ssh-windows.ps1, enable-ssh-wsl.sh, setup-glances.sh, bootstrap-node.sh). Core vision + networking feedback committed to memory.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- `2026-03-26T04:00:00Z` CLAIM `Z890-CLAUDE` scope: Full fleet networking session. SSH key injection for 5090 (LAN .65, RTX 5090 32GB), 4090 laptop (LAN .234, RTX 4090 16GB), both Jetsons (.110 pmovesnvme-desktop, .144 pmoves-nano-2) via RustDesk terminal. SSH hardening across all 7 remote nodes (password auth disabled, MaxAuthTries 3). 5090 claw config deployed (SCP). RustDesk self-hosted server stood up on Z890 (hbbs+hbbr, key generated). Tailscale mesh expanded: KVM4-2 (100.124.50.76) + KVM2 (100.74.146.76) joined. 5090 renamed to pmoves-5090. 10 PRs merged/queued (#1097, #1098, #1113, #1115-#1119, #1121-#1124). LAN fully mapped (.234=4090 laptop identified). Bootstrap scripts created (enable-ssh-windows.ps1, enable-ssh-wsl.sh, setup-glances.sh, bootstrap-node.sh). Core vision + networking feedback committed to memory.
- `2026-03-26T04:00:00Z` CLAIM `Z890-CLAUDE` scope: Full fleet networking session. SSH key injection for 5090 (RTX 5090 32GB), 4090 laptop (RTX 4090 16GB), both Jetsons (pmovesnvme-desktop, pmoves-nano-2) via RustDesk terminal. SSH hardening across all 7 remote nodes (password auth disabled, MaxAuthTries 3). 5090 claw config deployed (SCP). RustDesk self-hosted server stood up on Z890 (hbbs+hbbr, key generated). Tailscale mesh expanded: KVM4-2 + KVM2 joined. 5090 renamed to pmoves-5090. 10 PRs merged/queued (`#1097`, `#1098`, `#1113`, `#1115-`#1119, `#1121-`#1124). LAN nodes mapped and identified. Bootstrap scripts created (enable-ssh-windows.ps1, enable-ssh-wsl.sh, setup-glances.sh, bootstrap-node.sh). Core vision + networking feedback committed to memory.
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md` at line 86, The claim text for
`Z890-CLAUDE` includes real IP addresses and must be sanitized: locate the claim
string mentioning pmoves-5090, 4090 laptop, the two Jetsons (pmovesnvme-desktop,
pmoves-nano-2) and KVM4-2/KVM2 in the same claim and replace all literal IPs
(LAN and Tailscale) with anonymized identifiers or hostnames (e.g., <node>-lan,
<node>-tailscale or NODE_IDs) so the statement remains chronological and
collision-safe; ensure the SSH/key/bootstrap items and PR list (`#1097`, etc.) are
preserved exactly while removing any numeric IPs from the claim text.

- `2026-03-26T20:00:00Z` RELEASE `Z890-CLAUDE` scope: 8/8 nodes SSH hardened (key-only). 11 Tailscale nodes online (added KVM4-2+KVM2, cross-mesh 9ms verified). Claw configs deployed on KVM4-1+5090. RustDesk server built (clients on public pending migration). 10 PRs merged. Handoff: 5090-claude merging #1114 cascade (#1126); 4090/Jetson hostname renames via admin console; RustDesk client migration after SSH hardening confirmed.
Comment on lines +85 to +87

@coderabbitai coderabbitai Bot Mar 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Fix chronological ordering violation in Active Claim Register.

The new claim entries (dated 2026-03-25 and 2026-03-26) are inserted before line 89, which contains an earlier entry dated 2026-03-22. This violates the chronological ordering requirement for the Active Claim Register.

As per coding guidelines: "Ensure the claim/register content remains collision-safe and validation-friendly for this PR's checks: keep DECLARATION ordering chronological."

📅 Proposed fix: Reorder entries chronologically

Move lines 85-87 to appear after the 2026-03-22 entry and all subsequent entries that precede 2026-03-25. The correct position would be after line 90 (2026-03-23T04:00:00Z RELEASE) and before any entries dated after 2026-03-26T20:00:00Z.

The chronological sequence should be:

  • ... (earlier entries)
  • 2026-03-22T22:00:00Z (line 89)
  • 2026-03-23T04:00:00Z (line 90)
  • [INSERT 2026-03-25T14:00:00Z CLAIM here]
  • [INSERT 2026-03-26T04:00:00Z CLAIM here]
  • [INSERT 2026-03-26T20:00:00Z RELEASE here]
  • ... (later entries if any)
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md` around lines 85 - 87, The three new
entries with timestamps `2026-03-25T14:00:00Z` (CLAIM Z890-CLAUDE),
`2026-03-26T04:00:00Z` (CLAIM Z890-CLAUDE), and `2026-03-26T20:00:00Z` (RELEASE
Z890-CLAUDE) are out of chronological order; move these three contiguous entries
so they appear after the existing `2026-03-23T04:00:00Z` entry and after the
`2026-03-22T22:00:00Z` entry (i.e., insert them between the 2026-03-23 entry and
any later entries) to restore strict chronological ordering for the Active Claim
Register.


- `2026-03-22T22:00:00Z` CLAIM `Z890-CLAUDE` scope: P7 playground gate clearance + network topology review + CodeRabbit sweep. python3 hook fix (hookify plugin). P7 requirements validated (pterm 0.0.24, ffmpeg 7.0.2). TOPOLOGY.md IP sanitization (zero real IPs in public doc). PRs #1063-#1064 created+merged. PR #1069 conflict resolution+merge. PR #1070 CodeRabbit sweep (12 findings, 2 critical). Jetson/3D printer topology documented. 7 memory files updated.
- `2026-03-23T04:00:00Z` RELEASE `Z890-CLAUDE` scope: PRs #1063 (P7 docs), #1064 (28 gitlinks), #1068 (topology sanitize), #1069 (Flute Gradio 4.x merge), #1070 (12 CR findings) — all merged. PR #1071 (TTS service runners + prosodic endpoint) open with CR fixes applied. 4090-claude pr-trimmed #1070 (3 follow-up commits). Announcer persona + service runners config. Prosodic ear spec created. NATS subjects documented (voice.ear.*). Container rebuilds + Jetson onboarding deferred to next session.
Expand Down
Loading