docs(agnote): W0 Substrate lane brief — cross-platform node onboarding - #1441
Merged
Merged
Conversation
Opens a new substrate lane (W0, foundational beneath W1-W5) for cross-platform hardware scan + network sanity probe. Trigger: Z890 dual-NIC fix (PR #1432, 4a970a7) revealed a system-agnostic gap. User is rolling new systems through Unifi networking and needs accurate-config-on-first-boot rather than hand-rolled per-host audits. Files: - pmoves/docs/AGENTS/AGNOTE4482PHI.W0-SUBSTRATE.md (new) Full lane brief with PR-1..PR-6 series, reuse signals, gap statement, worked example, handoff notes, open operator questions. - pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md (CLAIM + RELEASE entries) Adds "W0 Substrate Lane — Cross-Platform Node Onboarding (OPEN)" section with Z890-CLAUDE CLAIM and immediate RELEASE so the lane is claim-able by 4090-CLAUDE / shift crew / Codex without further gating. Reuse signals identified (all currently stranded in worktrees): - feat/glances-autodetect (700-line bash detector, stable JSON, emits suggested_node_type) - feat/phase-c-hw-profiles (YAML profile schema with hardware.{cpu,gpu}, model_bundles, compose_overrides, tailscale.role) Gap delta: - No Windows hardware-detection parity (PR-3) - No same-subnet ghost detector module (PR-4) — would have caught Z890 dual-NIC class before container drama - No Unifi controller awareness (PR-5) - No auto-write of profile YAML from JSON (PR-6) - None of the above on main yet (PR-1, PR-2 land the prerequisites) Companion PR: docs/same-subnet-ghost-pattern lands the platform-agnostic version of the Z890 fix runbook (SAME_SUBNET_GHOST_PATTERN.md). Cited from this brief. Recommended primary owner: 4090-CLAUDE per feedback_operator_agent_approval_gates.md and the precedent of 4090-CLAUDE handling cross-fleet operability work. Z890-CLAUDE retains only test-validation interest on PR-3 (Windows companion) since Z890 is the live trigger node. Per Village Rule: any agent claiming any PR in this series posts a fresh CLAIM entry in t1.md naming both their agent ID and the PR number scope before opening the PR. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
POWERFULMOVES
added a commit
that referenced
this pull request
May 10, 2026
Adds a single Pattern reference blockquote at the top of FLEET_INVENTORY_LIVE.md § "Phase 2 — Z890 Dual-NIC Fix Runbook" pointing readers to: - pmoves/docs/operations/SAME_SUBNET_GHOST_PATTERN.md (PR #1440) Cross-platform pattern reference (Windows / Linux / macOS). - pmoves/docs/AGENTS/AGNOTE4482PHI.W0-SUBSTRATE.md (PR #1441) W0 Substrate lane brief that defines the auto-detector roadmap. Rationale: a reader landing on the Z890 Phase 2 runbook should know within the first paragraph that (a) the same bug class affects non-Windows hosts and the cross-platform diagnosis lives elsewhere, and (b) the auto-detector is a planned lane, not a stranded artifact. Atomic 2-line addition. Stages only this file — leaves the 23 submodule pointer modifications in the working tree alone (those are tracked separately and not part of this concern). Companion to: PR #1432 (this PR's parent), #1440 (pattern doc), #1441 (W0 brief). Closes task #9 from the W0 lane plan. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Per code-reviewer subagent finding (2026-05-10): line 194 contained a URL-encoded local-machine path (C%3A/Users/DARKXSIDE/...) pointing at an operator-private Cipher memory file. That path leaked the operator's username + filesystem layout into a public-repo doc. Replaced the broken cross-repo link with a description-only line: the memory file is now mentioned by NAME and CONTEXT (Docker Desktop 29.4.0 bind bug, fixed in >=29.5) without exposing where it lives on disk. Operators with Cipher memory access can find it; the public doc no longer broadcasts the path. Same redaction-policy spirit as feedback_lan_ip_redaction_in_committed_docs.md (no LAN IPs in committed docs) extended to local-machine paths containing usernames. No other content changes. PR #1441 supersedes 1293a4b with this fix-up. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
POWERFULMOVES
marked this pull request as ready for review
May 10, 2026 10:37
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 66eaf36eaa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+191
to
+192
| - [FLEET_INVENTORY_LIVE.md](../operations/FLEET_INVENTORY_LIVE.md) — Z890 Phase 2 worked example | ||
| - [SAME_SUBNET_GHOST_PATTERN.md](../operations/SAME_SUBNET_GHOST_PATTERN.md) — Cross-platform pattern reference (companion PR) |
There was a problem hiding this comment.
The related-reference links point to ../operations/FLEET_INVENTORY_LIVE.md and ../operations/SAME_SUBNET_GHOST_PATTERN.md, but neither file exists in this repository state (repo-wide rg --files returns no match), so these links resolve to 404 on main. That makes the lane brief’s navigation and stated link-validation test plan fail for readers right after merge; use links that exist on this branch (or external PR/commit URLs) until those docs are actually present.
Useful? React with 👍 / 👎.
4 tasks
POWERFULMOVES
added a commit
that referenced
this pull request
May 11, 2026
…#1432) * docs(launch): Stage 0 — initial layout validation for launch readiness Establishes the launch-readiness substrate before any Stage 1+ edits: - pmoves/configs/tac_trees/pmoves-launch-readiness.tac.yaml — 12-stage TAC tree mirroring the pinokio-p7.tac.yaml convention (name/version/root with hierarchical children, action.type/expect, status, agent_hint). Stages 0-3 + 7-11 launch-blocking; Stages 4-6 (Longbow, viz, retrace lifeline) v1.1. - pmoves/docs/launch/PLIGHT_AND_PLAN.md — narrative + milestones M0-M6 + outstanding owner-decision table; body of the GitHub plight-and-plan issue. - pmoves/docs/launch/PR_BACKLOG_CLASSIFICATION.md — 9 open PRs classified as critical-path (#1381 sign-trail, #1371 A2A activation), opportunistic (#1385/86/87 docs), auto-merge (#1388/#1372 dependabots), or v1.1-deferred (#1373/#1374 drafts). - scripts/validate_launch_layout.py — TAC-walking validator. Supports file_exists, file_or, manual, gh_issue, pytest, script, nats_subject, pr_state, supabase_migration, nats_messages_seen check types. Outputs pmoves/docs/launch/LAYOUT_VALIDATION_REPORT.md. - pmoves/docs/launch/LAYOUT_VALIDATION_REPORT.md — first-run baseline showing 11/45 blocking nodes pass (Stage 0 deliverables green; Stage 1+ pending). Cross-cutting principle established in the plan: every gate junction emits both syntactic and semantic measure; drift goes to a gate_drift_dynamo Qdrant collection (drift-as-dynamo). Defense-in-stance for Stage 8: parallel work-attestation stub + TradFi+Web3 hybrid token tracks. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(launch): close Stage 0 — issue #1389 filed, all 5 nodes green GitHub plight-and-plan tracking issue filed at #1389. Validation report refreshed to reflect closed gate: 12/45 blocking nodes now pass (Stage 0 contributing 5/5). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(audit): credential + naming-drift coherence gate (5×5 trail handshake) Lands the foundation for the 5×5 trail handshake invariant: agent emit / operator confirm / CI verify / trail record all read the same signing_card_id. Converts ten naming-drift sites from a recurring CodeRabbit/owl annoyance into an enforceable contract. Phase 1: CREDENTIAL_AND_DRIFT_SITREP — factual snapshot of PAT state, GitHub App migration gap, commit-signing posture, runner secrets pipeline, and the 10-row drift inventory with severity ranking. Phase 2: signing_identity_cards.yaml (16 cards: 1 operator, 9 agents, 1 service-account, 5 runners) + SIGNING_IDENTITY_CARDS.md operator explainer. Schema validation embedded in audit gate (canonical schema file pending damage-control policy carve-out for new versioned files). Phase 3: CANONICAL_NAMES.md decision log + bootstrap/registry.json canonical_aliases structured block. Audit gate prefers the JSON form; markdown is the human-facing fallback. Phase 4: audit_naming_drift.py (666 lines, 6 surface checks) + 10-test suite + naming-drift-check / naming-drift-strict make targets. Currently detects 7 P0 (GH_APP_SEC PEM misuse) and ~83 P1 (compose ${VAR:-} triage backlog made visible). Strict mode stays local-only per Owner-Decision E until P0 → 0. Phase 5: node_descriptions_diff scaffold (gitignored runtime artifact). Trail handshake (channel #4 of 5×5): sign_trail.py now reads cards on every signing call and stamps signing_card_id on the payload. Advisory mode per Owner-Decision D — missing card warns to stderr but doesn't block. Three-Body separation honored: - Delivery body: claude-opus produced phases 1-5 deliverables - Control body: z890-claude reviewed independently, closed 3 of 5 surfaced gaps in this commit (trail handshake, registry block, schema validation), filed 2 as deferred follow-ups - Memory body: cards seed + audit log artifacts feed the Cipher trail Files (11): pmoves/docs/operations/CREDENTIAL_AND_DRIFT_SITREP.md [NEW] pmoves/config/signing_identity_cards.yaml [NEW] pmoves/docs/operations/SIGNING_IDENTITY_CARDS.md [NEW] pmoves/docs/operations/CANONICAL_NAMES.md [NEW] pmoves/scripts/audit_naming_drift.py [NEW] pmoves/tests/test_audit_naming_drift.py [NEW] pmoves/tools/sign_trail.py [EDIT — card resolver + stamp] pmoves/bootstrap/registry.json [EDIT — canonical_aliases block only] pmoves/mk/preflight.mk [EDIT — naming-drift targets] pmoves/docs/AGENTS/AGNOTE4482.md [EDIT — Three-Body signoff entry] .gitignore [EDIT — runtime log artifacts] Owner-Decision surface (awaiting DARKXSIDE ACK on each): A. Operator SSH fingerprint capture timing — operator-driven B. PAT consolidation: 6→1 vs document-scope-per-name — document for now C. JWT alias deprecation window — 30 days, sunset 2026-05-26 D. 5×5 trail handshake mandatory vs advisory — advisory at first E. naming-drift-strict in CI promotion criteria — local-only first Deferred follow-ups: - signing-card.v1.schema.json at canonical path (needs damage-control patterns.yaml carve-out for new versioned schema files; coupling that policy change to a credential-audit PR is out-of-scope) - naming-drift-strict CI promotion (after one clean week local) - Operator SSH fingerprint backfill on signing_identity_cards.yaml Verification: uv run pytest pmoves/tests/test_audit_naming_drift.py -v # 10/10 PASS make -C pmoves naming-drift-check # exit 0 make -C pmoves naming-drift-strict # exit 1 (expected) python pmoves/tools/sign_trail.py --agent-id z890-claude # stamps card_id ACK::CLAUDE-OPUS::CREDENTIAL-AUDIT-PHASES-1-5::2026-04-26 ACK::Z890-CLAUDE::CREDENTIAL-AUDIT-REVIEW::2026-04-26 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(content-provenance): contracts + SPARK working parity Establishes the data layer for the SPARK-first content-provenance pipeline that gates HiRAG ingest behind shaping, attestation, and CHIT geometry. Pipeline shape (publishers → consumers covered in follow-up commits): channel-monitor | ffmpeg-whisper → content.raw.v1 → SPARK content-provenance-gate → content.lexicon.shaped.v1 → content.provenance.attested.v1 → content.hirag.accepted.v1 / rejected.v1 → hi-rag-gateway-v2 + hyperdimensions Adds: - 5 new content.* JSON schemas (raw, lexicon.shaped, provenance.attested, hirag.accepted, hirag.rejected) - 5 topics.json entries wiring publisher/subscriber contracts - pmoves/docs/architecture/PMOVES_SPARK_PROVENANCE_PARITY.md — canonical working contract for SPARK shaping, attestation, and HiRAG gating - AGNOTE-dgx-spark expanded from node stub into working-lane note with contract pointer and near-term sequence (deploy mesh.gpu.* streams → add content.* subjects → wire shaping worker → gate HiRAG → feed Hyperdimensions replay) - Hyperdimensions control plane: documents /hyperdimensions/provenance/ live save + viewer routes (consumers in Cluster 3) - CHIT_CHANGE_TRACKER + DOCUMENTATION_MAP: changelog entry + date refresh Z890 owns trust/infra edges (subjects, JetStream policy, HiRAG gates, canon). SPARK owns heavy-inference shaping. Hyperdimensions becomes the replay/control surface for shaped packets. Cluster 1 of 5 (split-by-cluster commit plan from C:\Users\DARKXSIDE\.claude\plans\lets-get-sitrep-plz-shiny-octopus.md). Originating draft of schemas + SPARK parity doc landed in working tree via Codex CLI on 2026-04-25; this commit promotes them to canon. Co-Authored-By: Codex CLI <codex@cataclysm.studios> Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(content-provenance): publishers — channel-monitor + ffmpeg-whisper emit content.raw.v1 Wires the source ends of the SPARK content-provenance pipeline. Both services now publish raw content envelopes onto NATS for downstream shaping, attestation, and HiRAG gating. channel-monitor: - New CHANNEL_MONITOR_CONTENT_RAW_PUBLISH toggle (default off; opt-in per node) - Persistent NATS client (best-effort connect; non-fatal on failure) - Publishes content.raw.v1 events on manual drops with correlation_id threading - Defensive guards when nats-py is not installed - Tests + README + requirements bump ffmpeg-whisper: - Existing CGP publisher path extended to also emit content.raw.v1 alongside transcript.ready.v1 when CGP_PUBLISH_ENABLED or CONTENT_RAW_PUBLISH_ENABLED is set - Single shared NATS client; publish failures stay non-fatal - Symbol rename in log lines: "CGP publish failed" → "NATS publish failed" (covers both subjects) Subject contract: content.raw.v1 schema in pmoves/contracts/schemas/content/raw.v1.schema.json (Cluster 1). Cluster 2 of 5. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(content-provenance): consumers + content-provenance-gate worker + JetStream config Wires the consumer end of the SPARK content-provenance pipeline: content-provenance-gate (NEW service): - Dockerfile + main.py (~21K) + requirements.in - Implements the SPARK shaping → attestation gate that lives between content.raw.v1 and content.hirag.{accepted,rejected}.v1 - Owns lexicon shaping, semantic scoring, CHIT geometry attestation, Merkle/Graphiti binding before HiRAG ingest hi-rag-gateway-v2: - New provenance_ingest.py: content.hirag.accepted.v1 listener + ProvenanceAcceptedItem upsert path that writes shaped lexicon + scorecard into Qdrant + Meilisearch - New provenance_geometry.py: extracts hyperdimensions save config from accepted CGP envelopes for /hyperdimensions/provenance/latest.json - New routes/provenance.py: dedicated upsert + status routes for callers that already hold weighted terms / favorite words / sections - routes/geometry.py: adds /hyperdimensions/provenance/{latest.json,view} for live save retrieval + redirect into Hyperdimensions UI - models.py: ProvenanceAcceptedItem + ProvenanceUpsertReq Pydantic types - geometry_bus.py + app.py: content.hirag.accepted.v1 listener task registered in lifespan (startup connect, graceful drain on shutdown) - New unit tests: test_provenance_geometry + test_provenance_ingest gateway: - Subscribe to content.raw.v1, content.hirag.accepted.v1, content.hirag.rejected.v1 alongside existing ingest.* topics NATS: - pmoves/nats/content_provenance_streams.yaml: JetStream stream policy for content.* subjects (referenced in AGNOTE-dgx-spark near-term lane) Tests: - pmoves/tests/services/test_content_provenance_gate.py Cluster 3 of 5. Hi-RAG gating and SPARK shaping worker now exist in canon; deployment of mesh.gpu.* + content.* JetStreams remains an operator step per AGNOTE-dgx-spark. Co-Authored-By: Codex CLI <codex@cataclysm.studios> Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(space-agent): NATS bridge — pmoves.space.action.v1 + pmoves.space.event.v1 Surfaces PMOVES-space-agent (Node.js customware bridge, port 3010) on the bus so space CRUD + lifecycle events can be observed and acted on by Agent Zero, attestation workers, and UI feeds. Subjects: - pmoves.space.action.v1 — published on /api/pmoves_bridge POST for create_space / update_widget / delete_space / list_spaces / read_space - pmoves.space.event.v1 — published on customware lifecycle changes (mutation succeeded, widget updated, space deleted). Stage 8 token-stub watches event for work-receipt minting. Wiring: - pmoves/bootstrap/registry.json: space-agent service entry with PMOVES_BRIDGE_API_KEY (random_hex 32, sensitive), SPACE_AGENT_BIND (default 127.0.0.1, opt-in LAN), SPACE_AGENT_PORT, SPACE_AGENT_SRC for submodule mount path - pmoves/config/agent_registry.yaml: space_agent agent entry with node_affinity [z890, 5090], orchestration team, agents compose profile, attribution_gated CHIT toggle - .claude/context/nats-subjects.md (×2 mirrors): canonical subject docs Lane fit (per agent-teams.yaml + operator roster): - z890 owns trust/infra + DoX + tokenomics - 5090 carries voice/media weight - space-agent's customware actions show up in both nodes' surfaces Cluster 4 of 5. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(a2ui-renderer): Pretext text-layout engine + ProvenanceLivingDoc composition + /render/provenance route Adds the 4090 display surface for the SPARK content-provenance pipeline. Captions, transcript overlays, provenance labels, and living-doc copy blocks now wrap deterministically inside the Remotion browser runtime. Pretext text-layout engine: - src/remotion/pretextLayout.ts — wraps @chenglou/pretext, falls back to browser whitespace handling when canvas measurement is unavailable - a2ui-animation-schema.json: text + heading elements may opt into text_layout.engine=pretext with maxWidth, lineHeight, letterSpacing, whiteSpace, wordBreak, maxLines, shrinkWrap, debugBoxes - src/remotion/A2UIComposition.tsx + index.tsx: integrate pretext layout per-element with layout_summary inventory in render response - skills/remotion-render/manifest.yaml: Pretext metadata + provenance endpoint listed as alternate (/render/provenance) ProvenanceLivingDoc composition: - src/remotion/ProvenanceLivingDoc.tsx — dedicated composition rendering title, summary, merkle root, shape id, weighted terms, favorite words, sections, and provenance refs into a living-doc artifact - src/provenanceLivingDoc.ts — server-side route handler - src/index.ts: POST /render/provenance route accepts a flat ProvenanceLivingDoc request (no A2UI scene-builder layer required) - a2ui.render.completed.v1 carries provenance_summary alongside layout_summary Tooling: - scripts/render-provenance-artifact.mjs — local helper to render a provenance artifact from a request JSON file (npm run build && node scripts/render-provenance-artifact.mjs <req.json> <out.png>) - demos/provenance_living_doc.request.json — request fixture - demos/provenance_living_doc.mof_example.json — MOF-themed sample - demos/.gitignore — ignores *.preview.{png,mp4,gif,webm} render outputs (regenerated locally via the helper script) CREATOR_PIPELINE.md: documents Living Docs Text Layout section, control seam (Pmoves-pretext fork tracked alongside @chenglou/pretext), usage pattern, and the dedicated /render/provenance route. Cluster 5 of 5 — closes the split-by-cluster commit plan. Working tree feature work for content-provenance + space-agent + Pretext is now in canon. Submodule drift reconciliation (Tasks 4-5-7) and rebase (Task 8) remain. Co-Authored-By: Codex CLI <codex@cataclysm.studios> Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(agnote4482): board entry — Z890-CLAUDE sitrep + drift audit + handoff matrix Adds CLAIM/REVIEW/RELEASE block to Active Claim Register restoring board coherence after 19-day quiet period (last entry: CLAUDE-OPUS 2026-04-21). CLAIM: Sitrep + drift audit on feature/launch-readiness-stage-0 identifying three drift classes — (A) 4 cross-main divergent submodule pointers incl. Pmoves-cipher + PMOVES-transcribe-and-fetch with origin/main commits force-pushed away upstream, (B) 20 working-tree submodule advances unique to neither branch HEAD nor main incl. ClawZ rewind, (C) 28+ files of uncommitted feature work — coherent SPARK content-provenance pipeline. REVIEW: Dependency graph mapped against documented agent lanes (AGNOTE4482_SITREP.md:106-117 + AGNOTE4482PHI.5090-SUBMODULE-AUDIT.md precedent). Critical path: Z890 commit feature work → 5090 Class B audit + bake → 5090 Archon+BotZ-gw promote → Z890 rebase. Parallel lanes: 4090 PR fixes, operator + submodule owners republish for cipher/transcribe-and-fetch, operator decisions A/C + §1.4 signoff. RELEASE: Sitrep + 5-cluster commit plan documented in C:\Users\DARKXSIDE\.claude\plans\lets-get-sitrep-plz-shiny-octopus.md. Handoffs proposed by lane signature: 5090-CLAUDE: Tasks 4-5-7 (submodule sync lane) 4090-CLAUDE: Tasks 2-3 (PR review / Shift Crew lane) CODEX-GPT5: Task 9 (§1.4 docs/prospectus signoff) OPERATOR: Tasks 6, 10, 11 (upstream republish, SSH fingerprint, JWT sunset) Z890-CLAUDE: Task 1 done (this commit set), Task 8 reserved. Cluster commit pairs (just landed): 500652d contracts + SPARK working parity 5153a0b publishers — channel-monitor + ffmpeg-whisper 2f908a0 consumers + content-provenance-gate + JetStream config 53abcd4 space-agent NATS bridge 2eed4a7 a2ui-renderer Pretext + ProvenanceLivingDoc + /render/provenance Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(a2ui-renderer): differentiate render:provenance:still vs :file scripts Both npm scripts invoked the bare CLI with no arguments, so they always produced identical .png stills regardless of script name. Pass explicit input + output args so :still emits PNG and :file emits MP4 — matching the script's extension-driven branch in render-provenance-artifact.mjs. Addresses CodeRabbit critical thread on PR #1415, package.json:12. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore(ci): disable self-hosted-builds.yml push + PR triggers Self-hosted runners (ai-lab/5090, kvm4) are not reliably online — the last 10+ runs of this workflow on push to main have all been cancelled since 2025-12. Mirroring the precedent set in self-hosted-builds-hardened.yml (lines 11-14): comment out both auto-triggers, keep workflow_dispatch as the operator escape hatch. Re-enable both blocks when: - 5090 node has completed submodule sync - pmoves-nats-1 is exposed to the host (4222/8222 portproxy fixed) - self-hosted runners pass a clean dispatch run Operators: trigger manually via gh workflow run self-hosted-builds.yml. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: address PR #1415 review findings (C1 H1 H2 H3 H4 M1 M3 M6) * fix(ci): suit-release-policy.yml YAML — bash continuation breaks block scalar Lines 45-46 + 54-55 had bash multi-line string continuations starting at column 1, which dropped them outside the `run: |` block scalar's 10-space indent. Result: YAML parser fails, every run reported as "workflow file issue" — gate has been broken since inception (7+ consecutive failed runs). Fix: replace literal newlines in TOUCHED_FILES assignment with bash ANSI-C quoting (\$'\n'), keeping the assignment on one YAML-safe line: TOUCHED_FILES="\$TOUCHED_FILES"\$'\n'"\$MATCHES" Verified locally with yaml.safe_load → triggers + jobs parse cleanly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(a2ui-renderer): make provenance helper source-backed and override-safe * fix: address CodeRabbit CRITICAL findings - Exception handler returns JSONResponse instead of HTTPException - NATS_URL access made conditional on CONTENT_PROVENANCE_DISABLE_NATS - Added JSONResponse import * docs(ops): live fleet inventory + Z890 dual-NIC fix runbook (Phase 1) Captures live ground-truth from Z890 against TOPOLOGY.md and the Tailscale fleet snapshot. Z890 verified at 20C/32GB (drift vs doc's 32C/128GB). Live Docker symptoms reproduced: pmoves-supabase-kong-1 NetworkSettings.Ports empty for 8000/8001 while hi-rag 8086 binds OK on same daemon; edge-functions Deno worker hits Temporary failure in name resolution. Root cause traced to a same-subnet ghost: the disconnected secondary adapter (Ethernet 4) holds a stale static address inside the same /24 as the active primary NIC, confusing Docker's port forwarder and WSL2 DNS resolver. Doc includes: - Per-node verified/blocked card for every Tailscale-online host - TOPOLOGY.md drift summary (6 deltas) - Phase 2 PowerShell runbook (Option A re-IP / Option B disable + rollback for both); placeholder LAN values per IP-redaction policy - Stale Tailscale entries cleanup candidates - Out-of-scope tags for Phases 3-5 Refs #1389 (LAUNCH readiness sweep) Refs #1410 (Z890 Health Phase 4 - Prometheus scrape predicate) Phase 2 (operator action) and TOPOLOGY.md reconciliation (PR 2) ship separately. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(ops): backlink Z890 runbook to cross-platform pattern doc Adds a single Pattern reference blockquote at the top of FLEET_INVENTORY_LIVE.md § "Phase 2 — Z890 Dual-NIC Fix Runbook" pointing readers to: - pmoves/docs/operations/SAME_SUBNET_GHOST_PATTERN.md (PR #1440) Cross-platform pattern reference (Windows / Linux / macOS). - pmoves/docs/AGENTS/AGNOTE4482PHI.W0-SUBSTRATE.md (PR #1441) W0 Substrate lane brief that defines the auto-detector roadmap. Rationale: a reader landing on the Z890 Phase 2 runbook should know within the first paragraph that (a) the same bug class affects non-Windows hosts and the cross-platform diagnosis lives elsewhere, and (b) the auto-detector is a planned lane, not a stranded artifact. Atomic 2-line addition. Stages only this file — leaves the 23 submodule pointer modifications in the working tree alone (those are tracked separately and not part of this concern). Companion to: PR #1432 (this PR's parent), #1440 (pattern doc), #1441 (W0 brief). Closes task #9 from the W0 lane plan. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Codex CLI <codex@cataclysm.studios> Co-authored-by: PMOVES-AGENT-ZERO-SPARK <pmoves-spark@powerfulmoves.com>
POWERFULMOVES
added a commit
that referenced
this pull request
May 11, 2026
Consolidates outbound work from a long Z890-CLAUDE session for clean pickup by 4090-CLAUDE, 5090-CLAUDE, KiloCode, and operator. Session output (context for downstream lanes): - 8 PRs in flight: #1432 (+ commit b3bc5f4 Z890 runbook backlink), #1440 cross-platform pattern doc, #1441 W0 Substrate brief, #1444 issue #1436 staleness fix, #1445 NATS auth fallback, #1446 rescue pr1371 (surgical re-do after contamination caught), #1447 rescue pr1385 CATALOG accuracy, #1448 rescue pr1391 typos. - 2 verified-already-done findings (no PR needed): AB-1 A2UI gitlink (gitlink at Hardened tip; AB-1 fix 2 commits behind), PBKDF2 (all callsites at OWASP-baseline 600,000). - 1 stash dropped (USB-PROVISIONING-SWEEP, work merged in #1413). Open lanes for receiving agents: 5090-CLAUDE (mic + voice-activated CHIT): - AB-4 keystone: make -C pmoves secrets-funnel-sync (highest-leverage blocker per KiloCode P0/P1 handoff; unblocks AB-5/AB-6/§9.4/A2A auth verify) - Agent Zero v1.13 boot validation (boot-only, no gitlink bump) - CHIT trail sign for today's session (PRs + ACKs above) 4090-CLAUDE (cross-fleet operability reach): - W0 PR-1..PR-6 from AGNOTE4482PHI.W0-SUBSTRATE.md - Worktree review (16 NEEDS_REVIEW characterized in handoff Lane 2, grouped: 1 stranded merged-PR (pr1390), 2 codex review trees, 2 phase deploy branches, 3 k8s/test branches, 5 docs branches, 3 unrooted feature branches) - 8 REMOVE_SAFE worktrees clear for prune when convenient Operator decisions (cannot be delegated): - 3 stashes remaining (CHIT bypass patterns 22 Apr / submodule integration docs 5 Apr / supabase bootstrap 1 Apr) - Upstream A2UI sync (8 commits behind upstream main on Hardened) - 3 W0 brief questions (CIDR convention / Unifi creds / profile naming) - KiloCode handoff staleness pattern flagged (2 of 4 quick-wins verified already done) Per Village Rule: receiving agents add CLAIM entries to AGNOTE4482PHI.t1.md § Active Claim Register before working a lane. t1.md not edited in this branch to avoid merge conflict with the W0 Substrate CLAIM/RELEASE that lands via PR #1441. The handoff doc itself is self-contained — receiving agents post their CLAIMs after #1441 merges. Trail unsigned locally (CHIT_PASSPHRASE voice-only on 5090; sign on 5090 side per Lane 3 of the handoff). Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pmoves/docs/AGENTS/AGNOTE4482PHI.W0-SUBSTRATE.md(full lane brief, 6 atomic PRs in series).pmoves/docs/AGENTS/AGNOTE4482PHI.t1.mdadds a Z890-CLAUDE CLAIM + immediate RELEASE so the lane is claim-able by 4090-CLAUDE / shift crew / Codex without further gating.Why W0 (foundational, not parallel)
W1-W5 are audience-facing (terminal theming, P7 IDE, Discord, website, enterprise). Cross-platform node onboarding sits beneath W1 — it decides which compose stack runs where, which model bundle the host can host, and whether the host's network is sane enough to bind container ports. Calling it W0 instead of inserting into the existing wave numbers keeps W1-W5 stable.
Trigger
Z890 dual-NIC fix (PR #1432, commit
4a970a71) revealed the gap. User is rolling new systems through Unifi networking and wants accurate-config-on-first-boot rather than hand-rolled per-host audits.PR series defined inside the brief
glances-autodetect.sh(Linux) on mainphase-c-hw-profilesYAML schema on mainglances-autodetect.ps1Each PR is independently reviewable. Reuse signals (currently stranded in worktrees
.worktrees/glances-autodetectand.worktrees/phase-c-hw-profiles) are PR-1 and PR-2 respectively.Companion PR
docs/same-subnet-ghost-patternadds the platform-agnostic pattern reference cited from this brief.Open questions for operator (non-blocking)
These can be answered during PR-1 / PR-2 review, not before claim:
10.99.99.0/24as fleet-wide convention for the dedicated direct-link CIDR (Option A of the same-subnet fix)?UNIFI_API_KEY+UNIFI_CONTROLLER_URL— through secrets-funnel (canonical) or per-host overrides?<hostname>.yamlvs<tailscale-name>.yamlvs class-name (existing convention is class-name likeworkstation-9850x3d-dual-r9700.yaml)?Test plan
Zsuffix, Z890-CLAUDE agent ID, GRAPHITI_MARK trailer comment)🤖 Generated with Claude Code