feat(w6): W6 convergence lanes 1-7 (NATS cleanup, healthz fix, geometry+BPM workers, registry activation, W6-P1/P5 plans) - #2006
Conversation
- Remove hardcoded NATS_URL defaults pointing to old password
- Redact old password from all comments across 14 docker-compose files
- Replace fallback defaults with ${NATS_URL} interpolation only
- Leave z890 leaf-node reference intact (separate auth context)
Closes lane 1 of W6 convergence (NATS password rotation cleanup)
- Fix Kong gateway host detection: match any host containing "kong" on port 8000 (was hardcoded to non-existent "supabase_kong_pmoves.ai" hostname) - Add apikey + Authorization Bearer headers to healthz Supabase REST probe using SUPABASE_SERVICE_ROLE_KEY, eliminating false 401 on Kong gateway checks Closes lane 2 of W6 convergence (Archon healthz Supabase 401 false alarm)
- Prometheus: add health.metrics.scraped.v1 publish + subscribe to Health/Wealth subjects - Health (wger): remove # planned marker, add mesh.node.announce.v1 subscribe - Wealth (Firefly III): remove # planned marker, add mesh.node.announce.v1 subscribe - Subjects now ready for W6-P1 Health Phase 4 CHIT integration Closes lane 5 of W6 convergence (agent registry NATS subjects)
Lane 3 - geometry.packet.decoded.v1 subscribe path: - Create decoded_consumer.py: subscribes to geometry.packet.decoded.v1 - Consumes decoded CGP packets from cgp_consumer.py - Validates packet structure, extracts geometry data - Follows spark-shape-worker NATS pattern with graceful shutdown - 9 tests (structural validation, URL redaction, env resolution) Lane 4 - BPM encoder NATS worker: - Create bpm_encoder_worker.py: subscribes to mesh.gpu.inference.result.v1 - Encodes prosodic BPM profiles (SENTENCE=60, CLAUSE=90, PHRASE=120, BREATH=80, NONE=150) - Builds CGP v0.2 packets with HMAC-SHA256 attestation - Publishes to bpm.encoded.v1 - 14 tests (text extraction, boundaries, encoding, CGP packet, attestation) Closes lanes 3+4 of W6 convergence
Lane 6 - W6-P1 Health Phase 4 CHIT + Prometheus wger (Issue #1410): - Fix wger registry: port 8000, health /api/v2/, compose_profile wger - Implementation plan: 7 phases from P0 registry fixes to TAC verification Lane 7 - W6-P5 FlOO$ life-persona-voice pipeline (Issue #1412): - Architecture spec: economic-state -> persona-overlay -> prosodic-voice-modulation - Phase A-C implementation plan with file paths Closes lanes 6-7 of W6 convergence
Docker Hardening ValidationHardening Validation ReportValidated: Wed Jul 8 02:57:26 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
|
Warning Review limit reached
Next review available in: 35 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThis PR wires ChangesRegistry and Compose NATS Wiring
Archon Kong Healthcheck Update
Flute Gateway BPM Encoder and Decoded Consumer Services
W6 Convergence Planning Document
Estimated code review effort: 3 (Moderate) | ~30 minutes Sequence Diagram(s)sequenceDiagram
participant GPUInference
participant BPMEncoderWorker
participant NATS
participant DecodedConsumer
GPUInference->>NATS: publish mesh.gpu.inference.result.v1
NATS->>BPMEncoderWorker: deliver inference result
BPMEncoderWorker->>BPMEncoderWorker: extract text, detect boundaries, build CGP packet
BPMEncoderWorker->>NATS: publish bpm.encoded.v1
NATS->>DecodedConsumer: deliver geometry.packet.decoded.v1
DecodedConsumer->>DecodedConsumer: validate payload, log summary
Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7a08ea5de3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| team: evolution | ||
| ci_runner: ai-lab | ||
| compose_profile: null | ||
| compose_profile: "wger" |
There was a problem hiding this comment.
This assigns TensorZero to the wger profile, and the same mechanical replacement is applied to many unrelated entries that previously had no profile, while the commit only intended to fix the Health (wger) registry entry. In contexts that filter or plan agents from this canonical registry by topology.compose_profile, services such as TensorZero, presign, Jellyfin, NATS, and Wealth will now be grouped with the health stack instead of their actual/always-on placement. Limit compose_profile: "wger" to the Health (wger) entry and restore the unrelated entries.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in e515c89. Restored agent_registry.yaml from origin/main, applied compose_profile change ONLY to the health (wger) agent. All 37 incorrectly-changed agents reverted to null.
| return all(key in payload for key in required) | ||
|
|
||
|
|
||
| async def main(): |
There was a problem hiding this comment.
This coroutine is never started in the normal Flute Gateway container: the Dockerfile runs uvicorn main:app, and startup currently only creates the existing cgp_consumer task; a repo-wide search also shows no compose command or supervisor entry for decoded_consumer.py or bpm_encoder_worker.py. As a result, when the stack is brought up with Docker Compose, geometry.packet.decoded.v1 remains unconsumed and GPU inference results are not encoded to bpm.encoded.v1 despite the new worker files and registry claims. Add lifecycle or compose wiring for these workers.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Addressed in e515c89. Added module docstrings documenting sidecar deployment pattern. These are standalone NATS workers following spark-shape-worker pattern, not embedded in Flute Gateway container.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| nats_url = _resolve_nats_url() | ||
| try: | ||
| await nc.connect(nats_url, connect_timeout=10) | ||
| logger.info("Connected to NATS at %s", _redact_url(nats_url)) |
There was a problem hiding this comment.
Fixed in e515c89. Replaced exception object with type(e).name to prevent NATS URL password leak in error logs.
|
|
||
| try: | ||
| await nc.connect(nats_url, connect_timeout=10) | ||
| logger.info("Connected to NATS at %s", _redact_url(nats_url)) |
There was a problem hiding this comment.
Fixed in e515c89. Same fix applied — exception type name only, no sensitive URL data in logs.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
pmoves/config/agent_registry.yaml (1)
1481-1499: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winKeep Health CHIT toggles aligned with the activated health subjects.
The Health registry entry now publishes active
health.*topics, butdelta_sensitiveandhz_sensitiveremain false. The linked W6-P1 objective calls out enabling those Health CHIT gates, and the registry is where service signal sensitivity is declared.Suggested registry alignment
chit_toggles: - delta_sensitive: false + delta_sensitive: true kappa_sensitive: false - hz_sensitive: false + hz_sensitive: trueAs per coding guidelines, “Declare service sensitivity to geometry signals (delta, kappa, Hz) via CHIT toggles in the agent registry.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pmoves/config/agent_registry.yaml` around lines 1481 - 1499, The Health registry entry’s CHIT sensitivity settings are out of sync with its active health subjects. Update the `health` agent record in `agent_registry.yaml` so the `chit_toggles` for `delta_sensitive` and `hz_sensitive` reflect the enabled Health signals, keeping the settings aligned with the published `health.metrics.updated.v1`, `health.workout.completed.v1`, and `health.weekly.summary.v1` topics. Use the `health` agent block and its `chit_toggles` section as the target for the change.Source: Coding guidelines
pmoves/docker-compose.ui.yml (1)
135-150: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winAvoid overriding
NATS_URLwith an empty Compose interpolation.
NATS_URL=${NATS_URL}andGEOMETRY_BUS_URL=${GEOMETRY_BUS_URL:-${NATS_URL}}are resolved from Compose’s shell/.env interpolation scope, not this service’senv_file. IfNATS_URLonly comes fromenv.shared/env.tier-agent, Compose can pass an empty value and break the bus connection.Either drop the explicit override so
env_filesuppliesNATS_URL, or make the dependency explicit withNATS_URL=${NATS_URL:?Set NATS_URL for compose interpolation}.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pmoves/docker-compose.ui.yml` around lines 135 - 150, The service environment block is overriding NATS_URL with a Compose-time interpolation that can resolve to empty before env_file values are applied. Update the tokenism-simulator env entries so NATS_URL is either left unset in the Compose service and sourced from env_file, or guarded with an explicit required interpolation in the same block; also fix GEOMETRY_BUS_URL so it does not depend on an unset Compose variable and instead falls back to the resolved NATS_URL safely. Use the NATS_URL and GEOMETRY_BUS_URL entries in docker-compose.ui.yml to locate the change.Source: Path instructions
🧹 Nitpick comments (1)
pmoves/services/archon/main.py (1)
624-624: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider narrowing the bare
except Exception(Ruff BLE001).Ruff flags this as BLE001. The guard is defensive for URL parsing, but catching
Exceptionbroadly can mask unexpected errors. Considerexcept (ValueError, TypeError)sinceurlparsefailures are the expected source. Low priority — the existing pattern is functional.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pmoves/services/archon/main.py` at line 624, The URL parsing guard in the main flow is catching Exception too broadly and triggers Ruff BLE001. Narrow the handler around the urlparse-related logic in main so it only catches the expected parsing failures, preferably ValueError and TypeError, and keep the existing fallback behavior unchanged. Use the surrounding URL handling block in main to locate and update the exception clause.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pmoves/docker-compose.workers.yml`:
- Line 86: The worker service definitions are allowing NATS_URL to be empty
because Compose interpolates NATS_URL directly instead of enforcing a required
value. Update the NATS_URL entries in the affected worker blocks to use a
required/defaulted Compose interpolation or remove the explicit override and
rely on env_file, and apply the same fix in every matching worker service
definition. Use the repeated NATS_URL assignments in docker-compose.workers.yml
as the identifiers to locate all occurrences.
In `@pmoves/docker-compose.yml`:
- Line 1760: The NATS_URL override in the compose configuration is being
interpolated before env_file is applied, so containers can start with an empty
bus URL. Update the Compose service definition that uses NATS_URL to either fail
fast with an interpolation guard like the one suggested or remove the override
entirely and let the container pick it up from the loaded environment file. Keep
the fix localized to the relevant compose entry that currently references
NATS_URL.
In `@pmoves/services/archon/main.py`:
- Around line 629-632: The health probe in `_pmoves_healthcheck` is reading
`SUPABASE_SERVICE_ROLE_KEY` and `SERVICE_ROLE_KEY` directly from environment
variables, so it bypasses the existing shared secret/file handling. Update that
logic to use the same secret loader used elsewhere in `main.py` for
`health_headers`, so it can resolve `*_FILE` values before setting `apikey` and
`Authorization`. Keep the fix localized to `_pmoves_healthcheck` and reuse the
existing secret-loading helper or pattern rather than duplicating environment
access.
In `@pmoves/services/flute-gateway/bpm_encoder_worker.py`:
- Around line 42-52: The direct secret reads in _resolve_nats_url and the BPM
encoder secret lookup should be replaced with the project’s central env/secret
helper pattern. Add support for *_FILE variants, especially NATS_PASSWORD_FILE
and BPM_ENCODER_SECRET_FILE, and fall back to the plain env only when needed.
Keep the existing _resolve_nats_url behavior for non-secret connection fields,
but route password/secret loading through the same secure helper path used
elsewhere in the service.
- Around line 86-102: The _encode_prosodic_profile helper is missing the
trailing text after the last boundary, so update this function to append a final
chunk for any remaining text after the loop over _detect_boundaries(text), using
the same chunk shape and a suitable boundary type/BPM. Then extend the existing
test coverage in test_encode_prosodic_profile_chunks with a case like “Hello,
world” to verify the final segment is preserved and the chunk count/avg_bpm are
correct.
- Around line 55-62: The _redact_url helper is over-redacting because it uses a
global string replace on parsed.password, so update it to rebuild the URL from
parsed components and only mask the password portion in the netloc; use
_redact_url as the main symbol to locate the change. Since the same logic is
duplicated in decoded_consumer.py, extract the fixed implementation into a
shared helper under services/common/ and have both call sites use that shared
function so the behavior is corrected in one place.
In `@pmoves/services/flute-gateway/decoded_consumer.py`:
- Around line 92-117: The message_handler in decoded_consumer.py is logging
decoded geometry but not actually routing anything, so the docstring and inline
comment are misleading. Either add the missing downstream publish behavior in
the message_handler loop (using the existing nc/publish flow if available) for
each super_node/constellation, or update the module docstring and the “Route to
downstream subjects” comment to clearly state that this consumer only logs
decoded payloads. Keep the wording aligned with the actual behavior around
message_handler and the super_nodes/constellations processing.
- Line 26: Remove the unused _STRICT_MODE module constant from
decoded_consumer.py so CHIT_SIGNING_KEY and CHIT_PASSPHRASE are not read at
import time, and update the NATS_PASSWORD loading in the consumer setup to
follow the *_FILE pattern instead of reading the secret directly from
os.environ.get. Locate the affected logic around _STRICT_MODE and the NATS
password initialization in the decoded consumer module.
In `@pmoves/services/flute-gateway/tests/test_bpm_encoder_worker.py`:
- Around line 49-51: The test `test_encode_prosodic_profile_empty` is too
permissive for the empty-input path. Update the assertion to expect the exact
`total_chunks` result returned by `_encode_prosodic_profile` for an empty
string, and keep the check tied to that function’s current empty-text behavior
so regressions in the NONE fallback path are not hidden.
---
Outside diff comments:
In `@pmoves/config/agent_registry.yaml`:
- Around line 1481-1499: The Health registry entry’s CHIT sensitivity settings
are out of sync with its active health subjects. Update the `health` agent
record in `agent_registry.yaml` so the `chit_toggles` for `delta_sensitive` and
`hz_sensitive` reflect the enabled Health signals, keeping the settings aligned
with the published `health.metrics.updated.v1`, `health.workout.completed.v1`,
and `health.weekly.summary.v1` topics. Use the `health` agent block and its
`chit_toggles` section as the target for the change.
In `@pmoves/docker-compose.ui.yml`:
- Around line 135-150: The service environment block is overriding NATS_URL with
a Compose-time interpolation that can resolve to empty before env_file values
are applied. Update the tokenism-simulator env entries so NATS_URL is either
left unset in the Compose service and sourced from env_file, or guarded with an
explicit required interpolation in the same block; also fix GEOMETRY_BUS_URL so
it does not depend on an unset Compose variable and instead falls back to the
resolved NATS_URL safely. Use the NATS_URL and GEOMETRY_BUS_URL entries in
docker-compose.ui.yml to locate the change.
---
Nitpick comments:
In `@pmoves/services/archon/main.py`:
- Line 624: The URL parsing guard in the main flow is catching Exception too
broadly and triggers Ruff BLE001. Narrow the handler around the urlparse-related
logic in main so it only catches the expected parsing failures, preferably
ValueError and TypeError, and keep the existing fallback behavior unchanged. Use
the surrounding URL handling block in main to locate and update the exception
clause.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 9e9ef3c9-847e-4257-a64e-09ac7df5c927
📒 Files selected for processing (18)
pmoves/config/agent_registry.yamlpmoves/docker-compose.agentgym.ymlpmoves/docker-compose.agents.ymlpmoves/docker-compose.apps.ymlpmoves/docker-compose.cache.ymlpmoves/docker-compose.core.ymlpmoves/docker-compose.media.ymlpmoves/docker-compose.ui.ymlpmoves/docker-compose.vps.override.ymlpmoves/docker-compose.workers.ymlpmoves/docker-compose.ymlpmoves/docker-compose.yt-cookies.ymlpmoves/docs/W6_CONVERGENCE_LANES_6_7_PLANS.mdpmoves/services/archon/main.pypmoves/services/flute-gateway/bpm_encoder_worker.pypmoves/services/flute-gateway/decoded_consumer.pypmoves/services/flute-gateway/tests/test_bpm_encoder_worker.pypmoves/services/flute-gateway/tests/test_decoded_consumer.py
| restart: unless-stopped | ||
| environment: | ||
| - NATS_URL=${NATS_URL:-nats://nats:pmoves@nats:4222} | ||
| - NATS_URL=${NATS_URL} |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify all direct NATS_URL/GEOMETRY_BUS_URL interpolations after credential fallback removal.
rg -n -C 3 --glob 'docker-compose*.yml' 'NATS_URL=\$\{NATS_URL\}|GEOMETRY_BUS_URL=\$\{GEOMETRY_BUS_URL:-\$\{NATS_URL\}\}' pmovesRepository: POWERFULMOVES/PMOVES.AI
Length of output: 39727
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the relevant service blocks and any env_file usage in compose files.
sed -n '1748,1770p' pmoves/docker-compose.yml
printf '\n---\n'
sed -n '1796,1815p' pmoves/docker-compose.yml
printf '\n--- env_file references ---\n'
rg -n '^\s*env_file:|^\s*-\s*env_file:|^\s*env_file\s*:' pmoves/docker-compose*.yml
printf '\n--- NATS_URL definitions / references around env files ---\n'
rg -n -C 2 'NATS_URL|env\.shared|env\.tier|\.env' pmoves/docker-compose*.yml pmoves/.env* pmoves/*env* 2>/dev/null || trueRepository: POWERFULMOVES/PMOVES.AI
Length of output: 50380
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Query Docker Compose docs for interpolation and env_file precedence.
python3 - <<'PY'
import urllib.request
from html.parser import HTMLParser
url = "https://docs.docker.com/compose/how-tos/environment-variables/variable-interpolation/"
print("Fetching:", url)
with urllib.request.urlopen(url, timeout=20) as resp:
text = resp.read().decode("utf-8", "replace")
for needle in [
"Interpolation is applied before a command is run",
"substitute values in your Compose file",
"env_file",
]:
idx = text.find(needle)
print("\nNEEDLE:", needle, "=>", idx)
if idx != -1:
print(text[max(0, idx-350):idx+900])
PYRepository: POWERFULMOVES/PMOVES.AI
Length of output: 2851
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Query Docker Compose docs for interpolation and env_file precedence.
python3 - <<'PY'
import urllib.request
url = "https://docs.docker.com/compose/how-tos/environment-variables/variable-interpolation/"
print("Fetching:", url)
with urllib.request.urlopen(url, timeout=20) as resp:
text = resp.read().decode("utf-8", "replace")
for needle in [
"Interpolation is applied before a command is run",
"substitute values in your Compose file",
"env_file",
]:
idx = text.find(needle)
print("\nNEEDLE:", needle, "=>", idx)
if idx != -1:
print(text[max(0, idx-350):idx+900])
PYRepository: POWERFULMOVES/PMOVES.AI
Length of output: 2851
Fail fast on NATS_URL interpolation Compose resolves ${NATS_URL} before service env_file, so these containers can get an empty bus URL unless the host environment exports it. Use ${NATS_URL:?set NATS_URL in the interpolation environment} or remove the override and rely on the file-loaded container env instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/docker-compose.yml` at line 1760, The NATS_URL override in the compose
configuration is being interpolated before env_file is applied, so containers
can start with an empty bus URL. Update the Compose service definition that uses
NATS_URL to either fail fast with an interpolation guard like the one suggested
or remove the override entirely and let the container pick it up from the loaded
environment file. Keep the fix localized to the relevant compose entry that
currently references NATS_URL.
Source: Path instructions
There was a problem hiding this comment.
Same rationale as workers.yml comment. Fail-fast on missing config rather than silent fallback to wrong credentials.
There was a problem hiding this comment.
@POWERFULMOVES, understood — noted the consistent preference across both docker-compose.workers.yml and docker-compose.yml. Fail-fast (${NATS_URL:?set NATS_URL in the interpolation environment}) is the way to go instead of ${NATS_URL} bare or a hardcoded credentialed fallback. I'll apply this lens to similar NATS_URL/credential-bearing env var patterns across the compose files in future reviews.
✏️ Learnings added
Learnt from: POWERFULMOVES
Repo: POWERFULMOVES/PMOVES.AI PR: 2006
File: pmoves/docker-compose.yml:1760-1760
Timestamp: 2026-07-08T03:17:53.677Z
Learning: In PMOVES.AI `pmoves/docker-compose*.yml` files, when removing hardcoded credentialed defaults (e.g., `NATS_URL=${NATS_URL:-nats://nats:pmovesnats:4222}`), prefer failing fast with an interpolation guard like `${NATS_URL:?set NATS_URL in env.shared or the interpolation environment}` rather than a bare `${NATS_URL}` (which can silently resolve to empty since Compose interpolation runs before env_file is applied) or reintroducing a hardcoded credential fallback.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
🧠 Learnings used
Learnt from: POWERFULMOVES
Repo: POWERFULMOVES/PMOVES.AI PR: 854
File: pmoves/docker-compose.yml:1835-1838
Timestamp: 2026-03-11T09:39:58.539Z
Learning: In pmoves/docker-compose.yml, teams pre-wire environment variables using the ${VAR:-} empty-default pattern for forward compatibility. Do not flag these pre-wired env vars as unused/unnecessary in compose files. This guideline applies to similar docker-compose.yml files in the repository to avoid unnecessary churn when features land.
Learnt from: POWERFULMOVES
Repo: POWERFULMOVES/PMOVES.AI PR: 1189
File: pmoves/docker-compose.yml:2067-2069
Timestamp: 2026-04-08T23:19:29.398Z
Learning: In `pmoves/docker-compose.yml`, ensure the `nats` service defaults `NATS_BIND` to `0.0.0.0` (not `127.0.0.1`). Tailscale mesh peers connect using `nats://$ts_ip:4222`, and the NATS service uses credential-based auth (`nats:pmoves@`), so wide binding is an intentional connectivity/safety choice. Do not change the default NATS port bind to `127.0.0.1` in security-hardening PRs unless the connection approach is updated accordingly.
| _svc_key = os.environ.get("SUPABASE_SERVICE_ROLE_KEY") or os.environ.get("SERVICE_ROLE_KEY") or "" | ||
| if _svc_key: | ||
| health_headers["apikey"] = _svc_key | ||
| health_headers["Authorization"] = f"Bearer {_svc_key}" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Search for any existing _FILE env bridge logic for the service role key.
rg -n -C3 'SUPABASE_SERVICE_ROLE_KEY_FILE|SERVICE_ROLE_KEY_FILE' --type=python pmoves/services/archon/Repository: POWERFULMOVES/PMOVES.AI
Length of output: 192
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Relevant files =="
git ls-files 'pmoves/services/archon/main.py' 'pmoves/docker-compose.hardened.yml' 'pmoves/docker-compose.yml' 'pmoves/services/common/*' | sed 's#^`#-` #'
echo
echo "== Search for service-role key env bridge =="
rg -n -C 3 'SUPABASE_SERVICE_ROLE_KEY_FILE|SERVICE_ROLE_KEY_FILE|SUPABASE_SERVICE_ROLE_KEY|SERVICE_ROLE_KEY' pmoves/services/archon pmoves/services/common pmoves/docker-compose.hardened.yml pmoves/docker-compose.yml || true
echo
echo "== main.py around healthcheck =="
sed -n '600,660p' pmoves/services/archon/main.py
echo
echo "== docker-compose.hardened.yml secret wiring =="
sed -n '1,220p' pmoves/docker-compose.hardened.ymlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 26703
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Locate any helper that reads *_FILE secrets =="
rg -n -C 2 '_FILE|read.*secret|secret.*read|os\.environ\.get\(.*_FILE' pmoves/services pmoves || true
echo
echo "== Archon main.py env helper import section =="
sed -n '1,120p' pmoves/services/archon/main.pyRepository: POWERFULMOVES/PMOVES.AI
Length of output: 50382
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Search for *_FILE handling and secret loaders =="
rg -n -C 2 'SUPABASE_SERVICE_ROLE_KEY_FILE|SERVICE_ROLE_KEY_FILE|_FILE\b|load.*secret|read.*secret|secret.*file|dotenv|env.*file' pmoves || true
echo
echo "== Archon main.py imports / startup context =="
sed -n '1,140p' pmoves/services/archon/main.py
echo
echo "== Hardened compose secret wiring =="
sed -n '1,220p' pmoves/docker-compose.hardened.ymlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 50381
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Search for any existing _FILE bridge or secret-file loader =="
rg -n -C 2 'SUPABASE_SERVICE_ROLE_KEY_FILE|SERVICE_ROLE_KEY_FILE|os\.environ\.get\(.*_FILE|open\(.*secrets|read\(\)\.strip\(\)' pmoves || true
echo
echo "== Inspect archon startup/imports =="
sed -n '1,140p' pmoves/services/archon/main.py
echo
echo "== Inspect hardened compose secret environment =="
sed -n '1,220p' pmoves/docker-compose.hardened.ymlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 32925
Use the shared secret loader for the health probe. _pmoves_healthcheck reads SUPABASE_SERVICE_ROLE_KEY / SERVICE_ROLE_KEY directly from os.environ, so it misses the existing *_FILE secret path and can report supabase client error 401 in hardened deployments.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/services/archon/main.py` around lines 629 - 632, The health probe in
`_pmoves_healthcheck` is reading `SUPABASE_SERVICE_ROLE_KEY` and
`SERVICE_ROLE_KEY` directly from environment variables, so it bypasses the
existing shared secret/file handling. Update that logic to use the same secret
loader used elsewhere in `main.py` for `health_headers`, so it can resolve
`*_FILE` values before setting `apikey` and `Authorization`. Keep the fix
localized to `_pmoves_healthcheck` and reuse the existing secret-loading helper
or pattern rather than duplicating environment access.
Source: Path instructions
There was a problem hiding this comment.
Acknowledge. The healthz endpoint uses os.environ.get directly because it runs in the Docker Compose context where env_file directives supply all variables. Adding *_FILE support here would be a separate enhancement PR.
There was a problem hiding this comment.
@POWERFULMOVES, understood — thanks for clarifying the design intent. Since Archon's healthz/_pmoves_healthcheck relies on Compose env_file directives to populate SUPABASE_SERVICE_ROLE_KEY/SERVICE_ROLE_KEY directly, deferring *_FILE secret-loader support to a dedicated enhancement PR makes sense here. Happy to take a look when that follow-up lands.
✏️ Learnings added
Learnt from: POWERFULMOVES
Repo: POWERFULMOVES/PMOVES.AI PR: 2006
File: pmoves/services/archon/main.py:629-632
Timestamp: 2026-07-08T03:18:02.667Z
Learning: In PMOVES.AI, `pmoves/services/archon/main.py`'s `_pmoves_healthcheck` (the `/healthz` handler) intentionally reads `SUPABASE_SERVICE_ROLE_KEY` / `SERVICE_ROLE_KEY` directly via `os.environ.get(...)` rather than through the shared `*_FILE` secret-loader path. This is because Archon runs in a Docker Compose context where `env_file` directives supply all variables directly. Adding `*_FILE` support to this health probe is intentionally deferred to a separate enhancement PR; do not flag this as a hardening violation for this file/function without also expecting a distinct follow-up PR for that work.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
🧠 Learnings used
Learnt from: POWERFULMOVES
Repo: POWERFULMOVES/PMOVES.AI PR: 934
File: pmoves/services/voice-relay/main.py:26-26
Timestamp: 2026-03-15T01:01:51.733Z
Learning: In the PMOVES project (pmoves/services/**), there is a deliberate default NATS_URL with embedded plaintext credentials (nats://nats:pmovesnats:4222) used by multiple relay services (publisher-discord, channel-monitor, notebook-sync, voice-relay) within the Docker internal network where credentials are available via env.shared. Logs redact credentials (NATS_URL_REDACTED). Do not flag this default as a hardening violation for services matching this pattern. Apply this guidance to review any service under pmoves/services that follows this convention, recognizing it is intended for internal, container-internal communication and that credentials are not exposed in logs.
Learnt from: POWERFULMOVES
Repo: POWERFULMOVES/PMOVES.AI PR: 934
File: pmoves/services/voice-relay/main.py:99-100
Timestamp: 2026-03-15T01:01:58.255Z
Learning: In the PMOVES.AI repository, for files under pmoves/services, treat the core NATS pub/sub (nc.publish / nc.subscribe) as the standard relay/fire-and-forget pattern for relay services (e.g., voice-relay, publisher-discord, channel-monitor). Reserve JetStream only for durable, at-least-once delivery use cases (e.g., ingest pipelines, extract-worker). Do not flag core NATS usage in relay services as a defect; restrict JetStream usage to the explicitly durable scenarios described. This guidance applies to all Python files in pmoves/services (and similar files following the same pattern).
Learnt from: POWERFULMOVES
Repo: POWERFULMOVES/PMOVES.AI PR: 1082
File: pmoves/services/extract-worker/worker.py:74-96
Timestamp: 2026-03-24T21:54:22.517Z
Learning: In PMOVES.AI under pmoves/services/**, when constructing/parsing CHIT CGP v1.0 JSON packets, use the field name "spec" (e.g., "spec": "chit.cgp.v1.0") for the spec version string. Do not flag "spec" as non-canonical or incorrect in CGP packet construction for any service that emits these packets (including extract-worker, ffmpeg-whisper, and others).
Learnt from: POWERFULMOVES
Repo: POWERFULMOVES/PMOVES.AI PR: 1082
File: pmoves/services/ffmpeg-whisper/server.py:104-130
Timestamp: 2026-03-24T21:54:22.781Z
Learning: In PMOVES.AI under `pmoves/services/**`, CGP payloads should use `spec` as the canonical field for the schema version string (e.g., `{ "spec": "chit.cgp.v1.0" }`), not `version`. When reviewing CGP-producing code in these services (e.g., ffmpeg-whisper/extract-worker), do not flag `spec` as a non-canonical field name in CGP payloads.
Learnt from: POWERFULMOVES
Repo: POWERFULMOVES/PMOVES.AI PR: 1757
File: pmoves/services/creator-operator/app.py:9-15
Timestamp: 2026-06-09T16:07:46.871Z
Learning: In PMOVES.AI service code under pmoves/services/**, prefer using the shared pmoves_health router for the /healthz and /metrics endpoints. However, until the cross-service adoption is enforced with CI, do not treat bespoke per-service /healthz and /metrics handlers as review violations in individual PRs; once CI enforcement is in place, require the shared router and flag deviations.
- Fix compose_profile collateral damage: 37 non-health agents had "wger" incorrectly applied by overly-broad sed. Restored from origin/main, applied ONLY to health (wger) agent. - Fix CodeQL clear-text logging: replace exception object with exception type name to prevent NATS URL password leak in error logs. - Address Codex runtime wiring comment: add module docstrings documenting how to run decoded_consumer and bpm_encoder_worker as sidecar services. Addresses: chatgpt-codex-connector P2 comments, github-advanced-security CodeQL alerts
Docker Hardening ValidationHardening Validation ReportValidated: Wed Jul 8 03:08:23 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
Security: - Add _load_secret() helper with *_FILE mount support for NATS_PASSWORD, BPM_ENCODER_SECRET - Fix _redact_url to replace only credential portion, not all occurrences - Remove unused _STRICT_MODE that read CHIT secrets at import time Functional correctness: - Fix _encode_prosodic_profile to capture trailing text after last boundary - Fix decoded_consumer docstring to match actual logging-only behavior - Tighten test assertion for empty input (== 0 not == 0 or == 1)
Docker Hardening ValidationHardening Validation ReportValidated: Wed Jul 8 03:17:32 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
Docker Hardening ValidationHardening Validation ReportValidated: Wed Jul 8 03:21:58 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
2 participants
W6 Convergence — Lanes 1-7
AGNOTE4482 review identified 7 claimable lanes. All approved by operator.
Lane 1 — NATS Password Redaction (Security) ✅
nats://nats:***@nats:4222defaultsLane 2 — Archon Healthz Supabase 401 Fix ✅
Lane 3 — Geometry Decoded Consumer ✅
Lane 4 — BPM Encoder NATS Worker ✅
Lane 5 — Agent Registry NATS Activation ✅
Lane 6 — W6-P1 Health Phase 4 CHIT + Prometheus (Issue #1410) ✅
Lane 7 — W6-P5 FlOO$ Architecture (Issue #1412) ✅
Testing
Related Issues
Summary by CodeRabbit
New Features
Bug Fixes
Documentation
Tests