Skip to content

feat(hf): wire HF agents into compose, fix ModelFilter compat, add test suite - #2113

Merged
POWERFULMOVES merged 5 commits into
mainfrom
feat/hf-services-wiring-and-tests
Jul 13, 2026
Merged

POWERFULMOVES merged 5 commits into
mainfrom
feat/hf-services-wiring-and-tests

Conversation

@POWERFULMOVES

@POWERFULMOVES POWERFULMOVES commented Jul 13, 2026

Copy link
Copy Markdown
Owner

Summary

PR #2105's handoff doc (CRUSH_GLM52_LANES_2026-07-12.md) claimed Lanes C1, C2, and C5 needed work. Verification on current main showed the handoff was partially stale — most of the work was already done. This PR closes the real gaps that remained.

What the handoff got wrong (corrected in handoff doc)

Sub-Lane Handoff Claim Actual State
C1 (hf-agent service) "No service code exists" Already exists — full impl at pmoves/services/hf-agent/main.py. Naming drift: handoff used hf_agent (underscore), actual is hf-agent (hyphen).
C2 (hf-research-agent) "No service code exists" Already exists — full impl at pmoves/services/hf-research-agent/main.py.
C5 (huggingface-skills sync) "drift ea6ec9a6 → 221f5f78" Already done — submodule at 0190417b4, past target.

What was actually broken (fixed in this PR)

  1. Compose wiring missing — hf-agent and hf-research-agent had Dockerfiles and registry entries but no stanza in docker-compose.yml. Both now wired under ["agents", "research"] profiles with tier-agent-hardened anchors, NATS depends_on, healthchecks, HF_TOKEN secrets wiring.
  2. ModelFilter import broken with huggingface_hub ≥ 1.0ModelFilter was removed in huggingface_hub 1.x. hf-agent/main.py and hf-mcp-server/main.py both imported it. Fixed: hf-agent now has _build_list_models_kwargs() version-compat shim; hf-mcp-server's unused import removed.
  3. publish_dataset.py ClickHouse crash — Supabase path degraded gracefully on connection refused but ClickHouse path raised httpx.ConnectError. Now both return empty + warning.
  4. hf-mcp-server docs — README had stale compose path (docker-compose/hf-mcp-server.yml only, missing the main compose path); CLAUDE.md was missing entirely. Both fixed.

Test suite (C4 — was missing, now delivered)

19 unit tests in pmoves/tests/services/test_hf_services.py:

  • TestHFAgent (4 tests): NATS subject contract, discovery payload shape, _seen dedup, error swallowing
  • TestHFResearchAgent (6 tests): subject contract, scoring rubric (pass/fail/penalty/preferred), JSON serialisability
  • TestHFMcpServer (9 tests): catalog tier coverage, entry shape validation, path traversal rejection, search filters, metadata roundtrip

All 19 pass. Per-class skip guards ensure tests skip cleanly when optional deps (fastapi, huggingface_hub) aren't installed in the host env — they run inside the service containers.

Test plan

  • pytest pmoves/tests/services/test_hf_services.py -v → 19/19 pass
  • docker compose -f docker-compose.yml --profile research config → renders hf-agent + hf-research-agent cleanly
  • python3 scripts/publish_dataset.py --all --dry-run → graceful skip (no crash on missing ClickHouse)
  • Kong seeder tests still pass (27/27 combined)
  • Live compose bring-up on SPARK with --profile research up (operator)
  • First real dataset publish with live Supabase + ClickHouse + HF_TOKEN (C3 — needs full data stack)

💘 Generated with Crush

Summary by CodeRabbit

  • New Features

    • Added Hugging Face agent services for model discovery and research evaluation.
    • Added configurable polling, filtering, scoring, health checks, and NATS event publishing.
    • Added Compose support for standalone and research agent profiles.
  • Bug Fixes

    • Improved compatibility across Hugging Face Hub versions.
    • Dataset publishing now handles unavailable ClickHouse instances gracefully.
  • Documentation & Tests

    • Expanded setup, usage, and service documentation.
    • Added coverage for discovery, evaluation, catalog behavior, filtering, and safety checks.

…lter compat, add tests

The CRUSH_GLM52_LANES handoff doc claimed C1/C2 service code didn't exist and
C5 submodule needed syncing. Verification on main showed all three were stale:
- C1/C2 service code ALREADY EXISTS (hf-agent, hf-research-agent) — just never
  wired into docker-compose.yml. Handoff used underscore naming (hf_agent);
  actual paths use hyphens (hf-agent).
- C5 huggingface-skills submodule ALREADY past target SHA (0190417b4 > 221f5f78).

Real gaps fixed:
1. Compose wiring: hf-agent (8201) + hf-research-agent (8202) added under
   ["agents", "research"] profiles with tier-agent-hardened anchors, NATS
   depends_on, healthchecks, HF_TOKEN secrets wiring.
2. ModelFilter compat: huggingface_hub >= 1.0 removed ModelFilter. hf-agent
   now has _build_list_models_kwargs() shim supporting both old and new APIs.
   hf-mcp-server had unused ModelFilter import removed.
3. publish_dataset.py: ClickHouse path now degrades gracefully on connection
   refused (matches existing Supabase pattern).
4. hf-mcp-server: README compose/test paths fixed, CLAUDE.md added.
5. 19 unit tests covering all 3 HF services (discovery payload contract,
   scoring rubric, catalog shape, path traversal safety, search filters).

Tests: 19/19 pass. Compose renders clean for --profile research.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Warning

Review limit reached

@POWERFULMOVES, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 16 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 40a27ec3-5930-406a-8bc8-8c360c93a75b

📥 Commits

Reviewing files that changed from the base of the PR and between 3f8ab94 and 74b9d1d.

📒 Files selected for processing (7)
  • pmoves/docker-compose.agents.yml
  • pmoves/docker-compose.workers.yml
  • pmoves/docker-compose.yml
  • pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md
  • pmoves/scripts/publish_dataset.py
  • pmoves/services/hf-research-agent/main.py
  • pmoves/tests/services/test_hf_services.py
📝 Walkthrough

Walkthrough

Adds two HuggingFace agent services with NATS integration, version-compatible model discovery, resilient ClickHouse dataset publishing, MCP documentation updates, Compose classification, and comprehensive service tests.

Changes

HuggingFace service integration

Layer / File(s) Summary
Agent mesh service wiring
pmoves/docker-compose.yml, pmoves/docker-compose.agents.yml, pmoves/docker-compose.workers.yml, pmoves/scripts/split_compose.py
Adds hf-agent and hf-research-agent with profiles, ports, healthchecks, NATS dependencies, environment configuration, resource limits, and overlay classification.
Runtime compatibility and resilience
pmoves/services/hf-agent/main.py, pmoves/scripts/publish_dataset.py
Supports legacy and modern HuggingFace Hub filtering APIs and returns an empty result with a warning when ClickHouse requests fail.
Agent service contract tests
pmoves/tests/services/test_hf_services.py
Tests discovery publication, deduplication, error handling, research scoring, tag adjustments, JSON serialization, MCP catalog behavior, path safety, search filtering, cache handling, and metadata parsing.
MCP documentation and verification records
pmoves/services/hf-mcp-server/*, pmoves/docs/AGENTS/*, pmoves/docs/handoffs/*
Documents MCP endpoints, configuration, Compose usage, related agent events, testing, and Lane C verification results.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant hf-agent
  participant HuggingFace Hub
  participant NATS
  participant hf-research-agent
  hf-agent->>HuggingFace Hub: Poll filtered models
  HuggingFace Hub-->>hf-agent: Return model metadata
  hf-agent->>NATS: Publish hf.model.discovered.v1
  NATS->>hf-research-agent: Deliver discovered model
  hf-research-agent->>NATS: Publish hf.model.evaluated.v1
Loading

Possibly related PRs

Suggested reviewers: hunnibear

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly matches the main changes: HF compose wiring, ModelFilter compatibility, and test coverage.
Description check ✅ Passed The description is detailed and covers summary and testing, but it misses the template's bullet-style summary and several checklist sections.
Docstring Coverage ✅ Passed Docstring coverage is 84.62% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/hf-services-wiring-and-tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown
Contributor

Docker Hardening Validation

Hardening Validation Report

Validated: Mon Jul 13 20:14:51 UTC 2026

Services Checked

PMOVES.AI Docker Hardening Validation

[INFO] Checking: pmoves/docker-compose.hardened.yml

[INFO] Validating: hi-rag-gateway-v2
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: extract-worker
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: langextract
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: presign
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: render-webhook
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: retrieval-eval
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pdf-ingest
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: jellyfin-bridge
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: invidious-companion-proxy
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: ffmpeg-whisper
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-video
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-audio
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-v2-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: deepresearch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supaserch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: publisher-discord
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: mesh-agent
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-req
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-res
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: comfy-watcher
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: grayjay-plugin-host
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: agent-zero
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: archon
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: channel-monitor
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pmoves-yt
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: notebook-sync
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supabase_service_role_key
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

[INFO] Validating: supabase_jwt_secret
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

======================================
Summary: 108 passed, 37 warnings, 0 errors

…l entry

CLAIM/RELEASE block for PR #2113 (feat/hf-services-wiring-and-tests).
Documents the stale-handoff discovery and the 5 real gaps closed.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
@github-actions

Copy link
Copy Markdown
Contributor

Docker Hardening Validation

Hardening Validation Report

Validated: Mon Jul 13 20:15:32 UTC 2026

Services Checked

PMOVES.AI Docker Hardening Validation

[INFO] Checking: pmoves/docker-compose.hardened.yml

[INFO] Validating: hi-rag-gateway-v2
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: extract-worker
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: langextract
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: presign
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: render-webhook
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: retrieval-eval
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pdf-ingest
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: jellyfin-bridge
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: invidious-companion-proxy
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: ffmpeg-whisper
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-video
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-audio
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-v2-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: deepresearch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supaserch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: publisher-discord
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: mesh-agent
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-req
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-res
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: comfy-watcher
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: grayjay-plugin-host
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: agent-zero
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: archon
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: channel-monitor
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pmoves-yt
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: notebook-sync
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supabase_service_role_key
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

[INFO] Validating: supabase_jwt_secret
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

======================================
Summary: 108 passed, 37 warnings, 0 errors

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7ae3d10f47

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread pmoves/docker-compose.yml
Addresses Codex P1 review comment: adding hf-agent/hf-research-agent only to
docker-compose.yml left the generated overlays stale (compose-split-check drift
gate was failing).

Root cause: split_compose.py SERVICE_GROUPS had no entry for hf-agent or
hf-research-agent, so the splitter's fallback dumped them into docker-compose.core.yml.

Fix:
1. Added hf-agent + hf-research-agent to the "agents" group in SERVICE_GROUPS
2. Ran `make compose-split` to regenerate all overlays
3. Verified drift gate: hf-agent + hf-research-agent now in agents.yml (12 refs)
4. workers.yml normalised (pre-existing comment/deploy artifact cleaned by regen)

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
@github-actions

Copy link
Copy Markdown
Contributor

Docker Hardening Validation

Hardening Validation Report

Validated: Mon Jul 13 21:47:39 UTC 2026

Services Checked

PMOVES.AI Docker Hardening Validation

[INFO] Checking: pmoves/docker-compose.hardened.yml

[INFO] Validating: hi-rag-gateway-v2
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: extract-worker
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: langextract
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: presign
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: render-webhook
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: retrieval-eval
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pdf-ingest
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: jellyfin-bridge
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: invidious-companion-proxy
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: ffmpeg-whisper
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-video
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-audio
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-v2-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: deepresearch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supaserch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: publisher-discord
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: mesh-agent
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-req
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-res
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: comfy-watcher
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: grayjay-plugin-host
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: agent-zero
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: archon
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: channel-monitor
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pmoves-yt
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: notebook-sync
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supabase_service_role_key
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

[INFO] Validating: supabase_jwt_secret
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

======================================
Summary: 108 passed, 37 warnings, 0 errors

@POWERFULMOVES

Copy link
Copy Markdown
Owner Author

Codex P1 Resolved ✅

Regenerate split compose overlays — fixed in commit 3f8ab949f.

Root cause: split_compose.py SERVICE_GROUPS had no entry for hf-agent or hf-research-agent. The splitter's fallback logic dumped ungrouped services into docker-compose.core.yml instead of docker-compose.agents.yml.

Fix:

  1. Added hf-agent + hf-research-agent to the "agents" group in SERVICE_GROUPS
  2. Ran make compose-split to regenerate all overlays
  3. Verified: make compose-split-check passes (exit 0), 12 HF refs now in docker-compose.agents.yml

The overlay-up-agents target now correctly starts both HF agents.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 8

🧹 Nitpick comments (2)
pmoves/services/hf-agent/main.py (1)

23-35: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Comment misattributes the ModelFilter removal version; redundant _HAS_MODEL_FILTER assignment.

ModelFilter/DatasetFilter were actually removed in huggingface_hub 0.24.0, not ">= 1.0" as the comment states — official release notes confirm they are "completely removed" as of 0.24.0. Since this diff pins huggingface-hub 0.24.0, _HAS_MODEL_FILTER will always resolve to False in the currently pinned environment, making the "legacy" ModelFilter branch in _build_list_models_kwargs/_discover_models dead code that's never exercised by tests. Separately, _HAS_MODEL_FILTER = False is set redundantly in both branches of the first try/except — it only needs to be initialized once.

♻️ Proposed cleanup
-try:  # huggingface_hub >= 1.0 removed ModelFilter; list_models takes kwargs directly
-    from huggingface_hub import HfApi
-    _HAS_MODEL_FILTER = False
-except ImportError:  # pragma: no cover
-    HfApi = None  # type: ignore[misc,assignment]
-    _HAS_MODEL_FILTER = False
-
-try:
-    from huggingface_hub import ModelFilter  # type: ignore[import-not-found]
-    _HAS_MODEL_FILTER = True
-except ImportError:
-    ModelFilter = None  # type: ignore[assignment,misc]
+_HAS_MODEL_FILTER = False
+
+try:
+    from huggingface_hub import HfApi
+except ImportError:  # pragma: no cover
+    HfApi = None  # type: ignore[misc,assignment]
+
+try:  # ModelFilter/DatasetFilter were removed in huggingface_hub 0.24.0 (not 1.0)
+    from huggingface_hub import ModelFilter  # type: ignore[import-not-found]
+    _HAS_MODEL_FILTER = True
+except ImportError:
+    ModelFilter = None  # type: ignore[assignment,misc]

Given huggingface-hub's own v1.0 migration guide also removes tags/task/library/language params from list_models, it's worth double-checking the modern kwargs path (pipeline_tag, filter, author) against whichever huggingface-hub version actually ships in production, since neither "0.24.0" nor "1.0" match the comment as written.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pmoves/services/hf-agent/main.py` around lines 23 - 35, Correct the Hugging
Face compatibility comment to identify ModelFilter/DatasetFilter removal at
version 0.24.0, and initialize _HAS_MODEL_FILTER only once rather than assigning
False in both branches of the initial HfApi import. Verify the modern kwargs
used by _build_list_models_kwargs and _discover_models against the production
huggingface_hub version, preserving only the supported compatibility path.
pmoves/scripts/split_compose.py (1)

234-257: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy lift

Consider stripping/relocating leading comments when copying services into overlays.

Because overlay_services[svc_name] = svc (246) copies only the service value, not the parent map's comment tokens, ruamel's round-trip comment attachment can misattach a preceding block comment from the source document to whichever surviving key ends up adjacent in the new overlay — exactly what happened with the "HF Agent" comment leaking into docker-compose.workers.yml ahead of github-branch-naming. Since services are inserted/reordered between groups over time, this will keep recurring. Worth a follow-up to detect/strip orphaned leading comments during generation.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pmoves/scripts/split_compose.py` around lines 234 - 257, Update the
service-copy logic in the SERVICE_GROUPS generation loop to prevent leading
comments attached to the source services map from being carried into overlays
when assigning overlay_services[svc_name]. Detect and remove or relocate
orphaned comment tokens before inserting each copied service, while preserving
comments that belong to the service itself and the existing security_opt
handling.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pmoves/docker-compose.agents.yml`:
- Around line 933-976: Add a deploy.resources.limits block to the hf-agent
service, matching the established cpus and memory limits used by comparable
services such as hf-research-agent. Keep the existing service configuration
unchanged and ensure the resource ceiling follows this compose file’s fleet-wide
convention.
- Around line 977-1011: The hf-research-agent comments document an HF_MIN_SCORE
setting that is not passed to the worker. Add an HF_MIN_SCORE environment entry
using the documented default of 50 and update the worker’s threshold handling in
main.py to consume it instead of hardcoding the value, preserving the existing
pass/fail behavior by default.

In `@pmoves/docker-compose.yml`:
- Around line 2986-2989: Remove the stray HF Agent comment block from the
generated workers overlay by correcting the split_compose.py/ruamel comment
attachment around the hf-agent and github-branch-naming document-order keys.
Keep the comment attached only to the hf-agent service in docker-compose.yml and
ensure github-branch-naming receives no HuggingFace-specific comments in
docker-compose.workers.yml.
- Around line 2990-3022: Add a deploy.resources.limits block to the hf-agent
service, matching the established cpus and memory limits used by sibling agent
services such as hf-research-agent and the corresponding agents.yml overlay.
Keep the existing service configuration unchanged.
- Around line 3023-3057: Wire the HF_MIN_SCORE configuration through the
hf-research-agent service: add its environment variable in the compose service
and update the scoring logic in the main.py evaluation flow to read that value
instead of hardcoding 50. Preserve the documented default threshold of 50 when
HF_MIN_SCORE is unset.

In `@pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md`:
- Around line 1236-1240: The SPARK-KIMI CLAIM entry lacks the required expiry
metadata. Update the CLAIM record identified by agent_signature
ACK::SPARK-KIMI::LANE-C-CLAIM-2026-07-13 to include an explicit TTL, while
preserving its existing branch, scope, and handoff details.

In `@pmoves/scripts/publish_dataset.py`:
- Around line 105-116: Update the exception handling around the ClickHouse
request in the publish query function to catch httpx.TransportError, while
continuing to catch HTTPStatusError as appropriate. Preserve the existing
warning log and return [] graceful-degradation behavior for connection,
connect-timeout, read-timeout, and other transport failures.

In `@pmoves/tests/services/test_hf_services.py`:
- Around line 55-61: Replace pytest.importorskip("nats") in the module-loading
block with a direct import/module availability check that is handled by the
existing except Exception path. Preserve hf_agent_mod = None and
_hf_agent_skip_reason for unavailable dependencies, and remove the stale pragma
comment describing huggingface_hub-only failures.

---

Nitpick comments:
In `@pmoves/scripts/split_compose.py`:
- Around line 234-257: Update the service-copy logic in the SERVICE_GROUPS
generation loop to prevent leading comments attached to the source services map
from being carried into overlays when assigning overlay_services[svc_name].
Detect and remove or relocate orphaned comment tokens before inserting each
copied service, while preserving comments that belong to the service itself and
the existing security_opt handling.

In `@pmoves/services/hf-agent/main.py`:
- Around line 23-35: Correct the Hugging Face compatibility comment to identify
ModelFilter/DatasetFilter removal at version 0.24.0, and initialize
_HAS_MODEL_FILTER only once rather than assigning False in both branches of the
initial HfApi import. Verify the modern kwargs used by _build_list_models_kwargs
and _discover_models against the production huggingface_hub version, preserving
only the supported compatibility path.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7223a8ad-22e0-480d-a6e2-4deab99e6be0

📥 Commits

Reviewing files that changed from the base of the PR and between f8896fd and 3f8ab94.

📒 Files selected for processing (12)
  • pmoves/docker-compose.agents.yml
  • pmoves/docker-compose.workers.yml
  • pmoves/docker-compose.yml
  • pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md
  • pmoves/docs/handoffs/CRUSH_GLM52_LANES_2026-07-12.md
  • pmoves/scripts/publish_dataset.py
  • pmoves/scripts/split_compose.py
  • pmoves/services/hf-agent/main.py
  • pmoves/services/hf-mcp-server/CLAUDE.md
  • pmoves/services/hf-mcp-server/README.md
  • pmoves/services/hf-mcp-server/main.py
  • pmoves/tests/services/test_hf_services.py
💤 Files with no reviewable changes (1)
  • pmoves/services/hf-mcp-server/main.py

Comment thread pmoves/docker-compose.agents.yml
Comment thread pmoves/docker-compose.agents.yml Outdated
Comment thread pmoves/docker-compose.yml Outdated
Comment thread pmoves/docker-compose.yml
Comment thread pmoves/docker-compose.yml Outdated
Comment thread pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md
Comment thread pmoves/scripts/publish_dataset.py
Comment thread pmoves/tests/services/test_hf_services.py
1. [Major] hf-agent missing deploy.resources.limits — added cpus/memory cap
   matching sibling services.
2. [Minor] HF_MIN_SCORE hardcoded — wired through env var (compose + main.py):
   `HF_MIN_SCORE` (default 50) now controls the pass/fail threshold instead of
   a magic number.
3. [Minor] Stray "HF Agent" comment leaked into workers.yml — moved multi-line
   comments from inter-service position (2-space indent, where ruamel.yaml
   attaches them to the PRECEDING service) to inside-stanza position (4-space
   indent) so they travel with the correct service through split_compose.py.
   Also fixed pre-existing "A2UI NATS bridge" misnomer on notebooklm-agent and
   removed its duplicate deploy block.
4. [Major] publish_dataset.py: widened exception catch from httpx.ConnectError
   to httpx.TransportError (parent of ConnectTimeout, ReadTimeout, etc.) so
   slow/dropped connections degrade gracefully.
5. [Minor] CLAIM TTL missing — added ttl field to AGNOTE4482PHI.t1.md CLAIM.
6. [Major] test_hf_services.py: replaced pytest.importorskip("nats") (raises
   BaseException, uncatchable by except Exception) with direct `import nats`
   so missing dep skips only TestHFAgent, not the whole module.

Tests: 19/19 still pass. Compose drift check clean after regeneration.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
@github-actions

Copy link
Copy Markdown
Contributor

Docker Hardening Validation

Hardening Validation Report

Validated: Mon Jul 13 22:08:33 UTC 2026

Services Checked

PMOVES.AI Docker Hardening Validation

[INFO] Checking: pmoves/docker-compose.hardened.yml

[INFO] Validating: hi-rag-gateway-v2
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: extract-worker
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: langextract
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: presign
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: render-webhook
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: retrieval-eval
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pdf-ingest
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: jellyfin-bridge
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: invidious-companion-proxy
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: ffmpeg-whisper
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-video
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-audio
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-v2-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: deepresearch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supaserch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: publisher-discord
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: mesh-agent
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-req
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-res
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: comfy-watcher
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: grayjay-plugin-host
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: agent-zero
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: archon
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: channel-monitor
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pmoves-yt
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: notebook-sync
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supabase_service_role_key
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

[INFO] Validating: supabase_jwt_secret
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

======================================
Summary: 108 passed, 37 warnings, 0 errors

@POWERFULMOVES

Copy link
Copy Markdown
Owner Author

All Review Comments Addressed ✅

Commit c380d7fff fixes all 6 CodeRabbit findings + the Codex P1:

# Severity Finding Fix
1 Major hf-agent missing deploy.resources.limits Added cpus: '0.5', memory: 256M
2 Minor HF_MIN_SCORE hardcoded at 50 Wired through env var in compose + main.py
3 Minor Stray "HF Agent" comment in workers.yml Moved comments inside-stanza (4-space indent) to fix ruamel.yaml attachment
4 Major publish_dataset.py narrow exception catch Widened ConnectErrorTransportError
5 Minor CLAIM missing TTL Added ttl field to AGNOTE4482PHI.t1.md
6 Major pytest.importorskip("nats") skips whole module Replaced with direct import nats
7 P1 Split compose overlays stale (Codex) Added HF agents to SERVICE_GROUPS, regenerated overlays

Tests: 19/19 pass. Compose drift: clean. All 8 review threads resolved.

@github-actions

Copy link
Copy Markdown
Contributor

Docker Hardening Validation

Hardening Validation Report

Validated: Mon Jul 13 22:30:51 UTC 2026

Services Checked

PMOVES.AI Docker Hardening Validation

[INFO] Checking: pmoves/docker-compose.hardened.yml

[INFO] Validating: hi-rag-gateway-v2
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: extract-worker
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: langextract
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: presign
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: render-webhook
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: retrieval-eval
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pdf-ingest
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: jellyfin-bridge
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: invidious-companion-proxy
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: ffmpeg-whisper
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-video
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-audio
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-v2-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: deepresearch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supaserch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: publisher-discord
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: mesh-agent
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-req
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-res
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: comfy-watcher
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: grayjay-plugin-host
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: agent-zero
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: archon
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: channel-monitor
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pmoves-yt
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: notebook-sync
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supabase_service_role_key
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

[INFO] Validating: supabase_jwt_secret
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

======================================
Summary: 108 passed, 37 warnings, 0 errors

@POWERFULMOVES
POWERFULMOVES enabled auto-merge (squash) July 13, 2026 23:08
@POWERFULMOVES
POWERFULMOVES merged commit 55e03f7 into main Jul 13, 2026
32 checks passed
@POWERFULMOVES
POWERFULMOVES deleted the feat/hf-services-wiring-and-tests branch July 13, 2026 23:09
POWERFULMOVES pushed a commit that referenced this pull request Jul 28, 2026
…ndpoints

Completes HF handoff Lane C item C4 (hf-mcp-server test suite).

Covers gaps from PR #2113's existing test_hf_services.py which tested
internal functions only — no actual HTTP route testing. This new suite
uses FastAPI TestClient to exercise every endpoint:

- TestHealthMetrics: healthz, health alias, metrics format, download counter
- TestModelSearch: search all, search by tier, empty result
- TestModelInfo: from catalog, 404 not found
- TestModelList: empty cache, cached model with snapshots
- TestTensorZeroConfig: TOML generation
- TestSSETools: MCP tools/list via SSE (verifies all 4 tool names)
- TestConvertGGUF: 404 for uncached model

14/14 passing. Combined with PR #2113's 19 tests = 33 total HF service tests.

Generated with Crush

Assisted-by: GLM-5.2 via Crush <crush@charm.land>
POWERFULMOVES pushed a commit that referenced this pull request Jul 28, 2026
…ndpoints

Completes HF handoff Lane C item C4 (hf-mcp-server test suite).

Covers gaps from PR #2113's existing test_hf_services.py which tested
internal functions only — no actual HTTP route testing. This new suite
uses FastAPI TestClient to exercise every endpoint:

- TestHealthMetrics: healthz, health alias, metrics format, download counter
- TestModelSearch: search all, search by tier, empty result
- TestModelInfo: from catalog, 404 not found
- TestModelList: empty cache, cached model with snapshots
- TestTensorZeroConfig: TOML generation
- TestSSETools: MCP tools/list via SSE (verifies all 4 tool names)
- TestConvertGGUF: 404 for uncached model

14/14 passing. Combined with PR #2113's 19 tests = 33 total HF service tests.

Generated with Crush

Assisted-by: GLM-5.2 via Crush <crush@charm.land>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant