docs(workorder): archon fork-sync + NATS-auth batch lanes

[POWERFULMOVES]

Work-order for the two remaining SPARK KIMI handoff lanes (Lane A base-image Trivy is done — #12/#5/#50 + gitlinks #1671):

1. Archon fork-sync — corrects the handoff (base is node:18-alpine, not bun) and captures DARKXSIDE's history: not two archons — vendored pmoves/integrations/archon → promoted submodule PMOVES-Archon (the canonical fork). Procedure: sync fork ← coleam00/Archon main (not dev), preserve PMOVES customizations, then node:18→22-alpine + retire the vendored pin.
2. NATS-auth batch — real ~17-file scope (not the inflated 111), per owning repo, split: ~10 Python connection-defaults + ~7 compose (via the PR feat(known-road): extend compose domain to submodule compose files #1665 submodule-compose Known Road) + 3 generated env.shared (pipeline only).

Includes the AGNOTE RELEASE row for Lane A.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Added release entry documenting execution and results of base-image security vulnerability remediation efforts.
  • Created comprehensive work-order documentation outlining upcoming infrastructure improvements: archon synchronization with security updates and migration to authenticated NATS communication.
  • Corrected previously identified handoff documentation inaccuracies.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 40ffc750-bfc2-4816-ad1e-1bb41ca872c9

📥 Commits

Reviewing files that changed from the base of the PR and between 7c108cd and 9000365.

📒 Files selected for processing (2)

• pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md
• pmoves/docs/handoffs/WORKORDER-archon-fork-sync-and-nats-auth-2026-06-01.md

---

📝 Walkthrough

Walkthrough

This PR documents the completion of Lane A (base-image Trivy fixes) in the Z890-CLAUDE agent note with two corrected handoff details, then creates a comprehensive work-order outlining two parallel follow-up lanes: Archon fork-sync and NATS-auth batch migration.

Changes

Lane A Release and Deferred Work-Order

Layer / File(s)	Summary
Lane A Completion Entry and Work-Order Introduction pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md, pmoves/docs/handoffs/WORKORDER-archon-fork-sync-and-nats-auth-2026-06-01.md	Z890-CLAUDE Lane A completion (Trivy base-image CVE fixes) is recorded with corrected archon base-image and NATS count details, explicitly deferring archon and NATS work to a new two-lane work-order document covering follow-up execution.
Archon Fork-Sync Procedure (Lane 1) pmoves/docs/handoffs/WORKORDER-archon-fork-sync-and-nats-auth-2026-06-01.md	Lane 1 details the Archon fork-sync process from upstream main while preserving PMOVES customizations, reconciling the legacy vendored pin, Trivy base-image update requirements for synced archon-ui, and explicit gotchas around Dockerfile presence and mislabeling.
NATS-Auth Batch Plan (Lane 2) pmoves/docs/handoffs/WORKORDER-archon-fork-sync-and-nats-auth-2026-06-01.md	Lane 2 defines NATS-auth migration from unauthenticated to authenticated URLs, editable-files breakdown across repos, rules prohibiting manual env.shared edits (requires regeneration via secrets-funnel pipeline), and per-repo PR batching with rate-limit considerations.
Work-Order References and Source Tracking pmoves/docs/handoffs/WORKORDER-archon-fork-sync-and-nats-auth-2026-06-01.md	Internal reference documents and originating PR/review row establish audit context and traceability for the work-order.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• POWERFULMOVES/PMOVES.AI#1418: Both PRs update pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md by extending AGNOTE4482 Lane A/B handoff records.
• POWERFULMOVES/PMOVES.AI#1435: Both PRs involve reconciliation of the pmoves/integrations/archon vendored gitlink pin referenced in the archon fork-sync work-order.
• POWERFULMOVES/PMOVES.AI#1375: Both PRs document migration of NATS connectivity from unauthenticated to authenticated URLs (main PR in the NATS-auth lane; retrieved PR across NATS URL docs and templates).

Suggested reviewers

• hunnibear

Poem

🐰 Lane A hops to completion with fixes so fine,
Two lanes defer to a work-order's design;
Archon shall fork-sync, and NATS shall auth bright,
Handoffs are corrected, the documentation's right! 🎯

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/workorder-archon-nats-2026-06-01

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9000365d4a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Correct the Archon gitlink mapping

This history reverses the current gitlinks, which can send the follow-up lane to compare or retire the wrong tree: in this checkout git ls-tree HEAD PMOVES-Archon pmoves/integrations/archon shows PMOVES-Archon at d4d52ecc... and pmoves/integrations/archon at 604b6fac..., while this line describes 604b6fa as the promoted top-level fork and the vendored path as f4bd252. Since the work-order is specifically for a cold pickup of the Archon fork-sync, the stale SHA mapping makes the reconciliation instructions unreliable.

Useful? React with 👍 / 👎.