fix(cipher): search() payload.memoryId + compose drift + TAC Phase 4 closure by POWERFULMOVES · Pull Request #2119 · POWERFULMOVES/PMOVES.AI

POWERFULMOVES · 2026-07-14T11:06:36Z

Summary

Follow-up to #2117 (merged). Three items:

Pmoves-cipher gitlink dc6f69a9 → 6f8150cf — search() complement to the HERMES Codex P1 fix. PR feat(cipher): Phase 4 — Qdrant embedding sidecar #2117 landed dc6f69a9 which correctly switched storeVector to a UUID point id with memoryId in payload, and deleteVector to filter by memoryId — but left search() reading with_payload:false and returning the raw UUID point id. Effect: vector hits mapped to MemoryManager.get(<uuid>), always threw "not found", silently filtered to [] — same silent-failure mode Codex flagged originally. 6f8150cf flips with_payload:true and extracts payload.memoryId so memory-routes.ts:58 can map hits back to the ByteRover memory id.
Regenerate docker-compose.agents.yml + docker-compose.base.yml — PR feat(cipher): Phase 4 — Qdrant embedding sidecar #2117 shipped the Phase 5 cipher-api stanza (new env vars, qdrant depends_on, pmoves_data network, cipher-data volume) without regenerating the split overlays, so Validate Compose Files drifted red on main. This commit clears the drift gate.
TAC_CIPHER.md closure — mark Phase 4 DONE, flip STATUS header to "Phases 1-5, 7-9 EXECUTED", resolve stale gitlink references (1c9b2851 → 6f8150cf), document the Codex P1 fix lineage (HERMES dc6f69a9 + complement 6f8150cf), mark Phase 6 PARTIAL (vps.override + port-mismatch fix deferred), record Phase 10 as research-complete / implementation-deferred.

Testing

tsc --noEmit clean on Pmoves-cipher/src/pmoves/ (zero new errors vs dc6f69a9).
split_compose.py regenerates byte-identical overlays on re-run (idempotent).
TAC renders clean (markdown lint pass).

Open follow-ups (separate lanes)

docker-compose.vps.override.yml + docker-compose.cache.yml — neither has a cipher-api stanza today; only needed if VPS/cache deploy wants the sidecar env vars.
CIPHER_URL host/container port mismatch (in-network services use :8105, container listens on :3000) — P1, tracked in TAC_CIPHER Phase 6.
Phase 10 (ByteRover Context Tree + AKL for PMOVES agent memory) — research documented in TAC_CIPHER §ByteRover Context Tree research; implementation deferred until operator reviews upstream thesis videos (T33iI6izAKw, R-5_2nsF_ZM).
Hi-RAG multi-dim embeddings (smaller + larger coexisting via named-vectors or cross-collection retrieval) — separate lane, not blocking this fix.

💘 Generated with Crush

Summary by CodeRabbit

New Features
- Added persistent storage for Cipher data.
- Expanded support for embedding, vector search, and external service configuration.
- Improved service startup coordination and health monitoring.
Bug Fixes
- Improved handling of vector identifiers and collection compatibility for more reliable search and deletion.
Documentation
- Updated Cipher execution status, verified revision details, deployment guidance, and outstanding configuration items.

Follow-up to #2117 (merged). Three items: 1. Pmoves-cipher gitlink dc6f69a9 -> 6f8150cf (search() complement). PR #2117 landed the HERMES Codex P1 fix (dc6f69a9) which correctly switched storeVector to a UUID point id with memoryId in payload, and deleteVector to filter by memoryId — but left search() reading with_payload:false and returning the raw UUID point id. Effect: vector hits mapped to MemoryManager.get(<uuid>), always threw "not found", silently filtered to [] — same failure mode Codex flagged originally. 6f8150cf flips with_payload:true and extracts payload.memoryId so memory-routes.ts:58 can map hits back to the ByteRover memory id. 2. Regenerate docker-compose.agents.yml + docker-compose.base.yml from docker-compose.yml. PR #2117 shipped the Phase 5 cipher-api stanza (OLLAMA_URL, TENSORZERO_URL, QDRANT_URL/API_KEY/COLLECTION, EMBEDDING_MODEL/DIM, qdrant depends_on, pmoves_data network, cipher-data volume) without regenerating the split overlays, so Validate Compose Files drifted red on main. This commit clears the drift gate. 3. TAC_CIPHER.md: mark Phase 4 DONE, flip STATUS header to "Phases 1-5, 7-9 EXECUTED", resolve stale gitlink references (1c9b2851 -> 6f8150cf), note the Codex P1 fix lineage (HERMES dc6f69a9 + complement 6f8150cf), mark Phase 6 PARTIAL (compose stanza + main overlay + gitlink promo done; vps.override + port-mismatch fix deferred), document Phase 10 as research-complete/implementation- deferred. Testing: - tsc --noEmit clean on Pmoves-cipher/src/pmoves/ (no new errors). - split_compose.py regenerates byte-identical overlays on re-run. - TAC renders clean (no markdown regressions).

github-actions · 2026-07-14T11:07:00Z

Docker Hardening Validation

Hardening Validation Report

Validated: Tue Jul 14 11:06:58 UTC 2026

Services Checked

PMOVES.AI Docker Hardening Validation

[INFO] Checking: pmoves/docker-compose.hardened.yml

[INFO] Validating: hi-rag-gateway-v2
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: extract-worker
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: langextract
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: presign
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: render-webhook
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: retrieval-eval
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pdf-ingest
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: jellyfin-bridge
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: invidious-companion-proxy
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: ffmpeg-whisper
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-video
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-audio
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-v2-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: deepresearch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supaserch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: publisher-discord
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: mesh-agent
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-req
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-res
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: comfy-watcher
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: grayjay-plugin-host
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: agent-zero
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: archon
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: channel-monitor
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pmoves-yt
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: notebook-sync
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supabase_service_role_key
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

[INFO] Validating: supabase_jwt_secret
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

======================================
Summary: 108 passed, 37 warnings, 0 errors

coderabbitai · 2026-07-14T11:07:10Z

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e124c80e-74d7-4f2d-9cf3-7bbb6add51ef

📥 Commits

Reviewing files that changed from the base of the PR and between f57e3c0 and ced8752.

📒 Files selected for processing (4)

Pmoves-cipher
pmoves/docker-compose.agents.yml
pmoves/docker-compose.base.yml
pmoves/docs/TAC/TAC_CIPHER.md

 _________________________________________________________________________________________________________________________________
< For a successful technology, reality must take precedence over public relations, for Nature cannot be fooled. - Richard Feynman >
 ---------------------------------------------------------------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/cipher-search-memoryid-followup

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ced8752fe4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-14T11:09:44Z

    - PMOVES_HOST=0.0.0.0
+    - OLLAMA_URL=http://pmoves-ollama:11434
+    - OLLAMA_EMBED_MODEL=${OLLAMA_EMBED_MODEL:-qwen3-embedding:4b}
+    - TENSORZERO_URL=http://tensorzero-gateway:3030


Use TensorZero's container port for Cipher

In split-overlay deployments, cipher-api resolves tensorzero-gateway through Docker DNS and must use the gateway's internal listener, not the host-published port. The gateway service publishes ${TENSORZERO_PORT:-3030}:3000 and healthchecks localhost:3000 in pmoves/docker-compose.core.yml, so this new :3030 URL makes Cipher's Phase 4 embedding calls connect to a closed port whenever the split overlays are used, causing vector memory storage/search to fall back or fail instead of using TensorZero embeddings.

Useful? React with 👍 / 👎.

Pmoves-cipher 6f8150cf → 7525c004: feat(pmoves): hybrid search — Qdrant BM25 sparse + dense RRF fusion Replaces dense-only vector search with hybrid retrieval: dense (Qwen3 semantic) + sparse (Qdrant BM25) → RRF fusion Eliminates ByteRover's in-memory MiniSearch (10K entry cap) in favor of Qdrant's built-in BM25 sparse tokenizer (model: "qdrant/bm25"). Zero external sparse model needed — Qdrant tokenizes text server-side. Collection schema migration: existing pmoves_cipher_memory collections (unnamed dense) are incompatible. Delete and recreate on first deploy. Cipher memory is ephemeral — no data migration needed. Stacks on top of PR #2119 (search() payload.memoryId complement).

…2128) Pmoves-cipher 6f8150cf → 7525c004: feat(pmoves): hybrid search — Qdrant BM25 sparse + dense RRF fusion Replaces dense-only vector search with hybrid retrieval: dense (Qwen3 semantic) + sparse (Qdrant BM25) → RRF fusion Eliminates ByteRover's in-memory MiniSearch (10K entry cap) in favor of Qdrant's built-in BM25 sparse tokenizer (model: "qdrant/bm25"). Zero external sparse model needed — Qdrant tokenizes text server-side. Collection schema migration: existing pmoves_cipher_memory collections (unnamed dense) are incompatible. Delete and recreate on first deploy. Cipher memory is ephemeral — no data migration needed. Stacks on top of PR #2119 (search() payload.memoryId complement). Co-authored-by: PMOVES-AGENT-ZERO-SPARK <pmoves-spark@powerfulmoves.com>

chatgpt-codex-connector Bot reviewed Jul 14, 2026

View reviewed changes

POWERFULMOVES merged commit 4c3d78c into main Jul 14, 2026
55 of 56 checks passed

POWERFULMOVES deleted the fix/cipher-search-memoryid-followup branch July 14, 2026 22:05

POWERFULMOVES mentioned this pull request Jul 14, 2026

feat(cipher): BM25 hybrid search — Qdrant sparse + dense RRF fusion #2128

Merged

coderabbitai Bot mentioned this pull request Jul 17, 2026

docs(fordham): ballot prior art + A2UI reconciliation — HMAC cannot sign a contested ballot #2154

Merged

coderabbitai Bot mentioned this pull request Jul 30, 2026

chore(submodule): promote Pmoves-cipher → 2b4c4f7 (Phase B PR 2 + MCP SSE fix) #2299

Merged

6 tasks

Navigation Menu

fix(cipher): search() payload.memoryId + compose drift + TAC Phase 4 closure - #2119

fix(cipher): search() payload.memoryId + compose drift + TAC Phase 4 closure#2119
POWERFULMOVES merged 1 commit into
mainfrom
fix/cipher-search-memoryid-followup

POWERFULMOVES commented Jul 14, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

github-actions Bot commented Jul 14, 2026

Uh oh!

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

POWERFULMOVES commented Jul 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Open follow-ups (separate lanes)

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Jul 14, 2026

Docker Hardening Validation

Hardening Validation Report

Validated: Tue Jul 14 11:06:58 UTC 2026

Services Checked

PMOVES.AI Docker Hardening Validation

Uh oh!

coderabbitai Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

POWERFULMOVES commented Jul 14, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading