chore(submodules): hardened-branch fleet audit + 8 safe gitlink promotions - #1659
Conversation
Fleet-wide hardened-branch audit (38 submodules tracking PMOVES.AI-Edition-Hardened). Promotes 8 gitlinks where hardened already contains the default branch (zero drift, pure pin advancement, same operation as #1656): Pmoves-hyperdimensions, Pmoves-AgentGym-RL, PMOVES-surf, PMOVES-Ultimate-TTS-Studio, PMOVES-Tailscale, PMOVES-Neo4j, PMOVES-autoresearch, PMOVES-ToKenism-Multi (incl #49). Audit doc classifies all 38: 11 clean, 8 gate-OK-stale (this PR), 17 DRIFTED (hardened missing default-branch commits, incl. BoTZ #72 JWT auth-gate + BotZ-gateway #4 log-sanitize). Drifted tranche deferred to per-repo research-agent merge-safety verification. Refs: 5090 deep-bumblebee security handoff. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 39 minutes and 44 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (9)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f97463d5ab
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| **Scope:** All 38 submodules tracking `PMOVES.AI-Edition-Hardened` | ||
| **Trigger:** Security-backfill handoff found BoTZ JWT auth-gate fix (#72) merged to `main` | ||
| but absent from the `PMOVES.AI-Edition-Hardened` branch the parent actually pins. |
There was a problem hiding this comment.
This audit is used to drive security remediation, but it starts from the wrong inventory: .gitmodules currently defines 50 submodules, with only 34 configured for PMOVES.AI-Edition-Hardened (for example PMOVES-BoTZ and PMOVES-BotZ-gateway, called out below as hardened drift, are configured with branch main). In contexts that rely on this document to decide whether to merge default into hardened or fix the parent tracking configuration, this misclassification can send follow-up work to the wrong branch and leave the actual pinned/tracked path unaddressed.
Useful? React with 👍 / 👎.
1 participant
Fleet hardened-branch audit (38 submodules)
Triggered by the 5090 deep-bumblebee security handoff, which found BoTZ's JWT auth-gate fix (#72) merged to
mainbut absent from thePMOVES.AI-Edition-Hardenedbranch the parent actually pins — a silent security gap.The invariant
hardened ⊇ default— the hardened branch (what deploys) must contain every commit on the repo's default branch. When hardened falls behind, security fixes silently never reach production. 8 repos already enforce this structurally by making hardened their default branch (recommended fleet end-state).This PR (safe tranche only)
Promotes 8 gitlinks where hardened already ⊇ default (zero drift, pure pin advancement — same operation as #1656):
hyperdimensions, AgentGym-RL, surf, Ultimate-TTS-Studio, Tailscale, Neo4j, autoresearch, ToKenism-Multi(last one also captures the #49 doc fix).Deferred (NOT in this PR)
17 DRIFTED repos where hardened is missing default-branch commits — incl. BoTZ (#72 JWT auth-gate) and BotZ-gateway (#4 log-sanitize). These need per-repo merge-safety verification (does any hardened-only commit intentionally exclude something a merge-forward would reintroduce?) via the research-agent lane before reconciliation. Full classification in the audit doc.
See
pmoves/docs/audit/HARDENED_BRANCH_FLEET_AUDIT_2026-05-31.md.🤖 Generated with Claude Code