fix(secrets): route remaining CHIT_PASSPHRASE reads through services.common.env - #2125
Conversation
…common.env Replaces raw os.environ.get/os.getenv calls with get_secret so Docker *_FILE secrets are supported across the fleet. Services updated: - graph-linker/chit_signer - a2ui-nats-bridge/bridge - tokenism-simulator/services/chit_encoder - consciousness-service/chr_algorithm - hi-rag-gateway/gateway - hi-rag-gateway-v2/config Tests updated: - graph-linker: CHIT_PASSPHRASE_FILE signing roundtrip - a2ui-nats-bridge: signature gate with CHIT_PASSPHRASE_FILE
|
Warning Review limit reached
Next review available in: 57 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (10)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9c7883c279
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| from services.common.env import get_secret | ||
| except ImportError: # pragma: no cover - narrow test/sys.path contexts | ||
| from pmoves.services.common.env import get_secret |
There was a problem hiding this comment.
When this runs in the image built by pmoves/services/consciousness-service/Dockerfile, the image only copies services/consciousness-service/*.py plus a minimal pmoves/tools namespace, not services/common or pmoves/services/common. Since main.py imports chr_algorithm at startup, this new top-level import raises ModuleNotFoundError before the API can boot; copy services/common/env.py into that image or keep a local fallback.
Useful? React with 👍 / 👎.
| from services.common.env import get_secret | ||
| except ImportError: # pragma: no cover - narrow test/sys.path contexts | ||
| from pmoves.services.common.env import get_secret |
There was a problem hiding this comment.
The tokenism image built by pmoves/services/tokenism-simulator/Dockerfile copies the simulator tree and only a minimal pmoves/tools namespace, so neither services.common.env nor pmoves.services.common.env exists in the container. Because app.py imports services.simulation_engine, which imports this module during gunicorn startup, this new import aborts the service before /healthz is available; include the shared env helper in the image or add a standalone fallback.
Useful? React with 👍 / 👎.
…m images Both services import 'from services.common.env import get_secret' for CHIT passphrase access, but their Docker images don't include the services/common/ directory. This causes ModuleNotFoundError at boot. Add COPY for services/common/__init__.py + env.py to both Dockerfiles. (Codex P1 × 2)
github-actions
Bot
added
chit-aware
Docker Hardening ValidationHardening Validation ReportValidated: Wed Jul 15 00:38:30 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
🔏 CHIT-aware change — control-body routingThis PR touches a CHIT-aware service (ports 8086/8087/8103/8106/8113/9224 surface). Before a Control-Body ACK:
Advisory routing only — the blocking contract check is CHIT Contract. |
…ng the way (#2184) * docs(design): combined PMOVES Pinokio customization architecture spec Aggregation Model A (submodule) reconciling combined PMOVES-pinokio fork with distributed per-service launchers (crush, claude-code) + forked plugin/code. Captures the closed-CLI constraint (claude-code integration via extension surface + Agent SDK, not a binary fork). Design approved verbally; pending written-spec review before writing-plans. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(design): resolve auto-cli + submodule-recurse verification items auto-cli = Pinokio's built-in CLI launcher generator (use installable variant for claude-code/crush). Submodule recurse handled by explicit git submodule update --init --recursive in each launcher install.js (no Pinokio-clone dependency). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(plan): combined PMOVES Pinokio customization implementation plan 5 atomic tasks (code fork+claude repoint, pmoves-claude-code launcher/scaffold, PMOVES-pinokio assembly, meta-repo pbnj submodule, install repoint+validation). Self-review fix: pmoves-claude-code launcher at repo root so its api submodule places pinokio.js correctly. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(plan): crush integration via thin api entry + sources/ submodule Respects PMOVES-crush's nested launcher structure; keeps version-pinning. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(damage-control): exempt git-rm from filesystem-delete + no-delete guards git-rm is a reversible git-index removal, categorically different from a recursive filesystem delete. Adds (?<!git\s) to the four recursive/force delete patterns (patterns.yaml) and the DELETE matcher (bash-tool-damage-control.py), mirroring the existing docker/podman exclusion. Verified: git-index removals pass; real recursive filesystem deletes and no-delete-path deletes still block. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(z890): carry node skills + launcher + profile example (reconciled onto main) 5 pmoves-* skills (legal-assist, folder-monitor, email-organizer, yt-monitor, n8n-archon-bridge), pmoves/launcher/, launcher_profile_select.py, and the profile .env.example (placeholders only). Node-local .env + .hermes stay untracked. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * reconcile(z890): known-roads topic domain + trail merge onto main - Add topic domain predicate (_is_topic_target) for pmoves/contracts/topics.json and register it in DOMAIN_PATTERNS alongside main's existing compose/schema/dockerfile domains (schema was already merged upstream; dockerfile untouched). - Append 7 local trail lines (schema + topic grants) to known-roads.jsonl, additive only, no overlap with main's existing entries. z890-coordinator.yaml needed no change: main already has the Intel Core Ultra 7 265K hardware fix (commit 0f578bb), superseding the stale AMD Ryzen values in the local WIP snapshot. z890-infra.room.fabric.json left uncommitted: the local WIP version fails validation against main's current room schema ('stage' is a required property, missing from the WIP file). Not forced — needs a human decision on the correct stage value. * reconcile(z890): carry room manifest + add required stage field (schema conformance) * fix(tokenism): repoint image to real CI-built tag + explicit PYTHONPATH (CHIT signing) Build context/dockerfile path and pmoves.tools packaging were already fixed on main via #2070/#2125. The remaining gap: docker-compose.yml's TOKENISM_IMAGE default pointed at an orphan tag (ghcr.io/powerfulmoves/pmoves-tokenism:pmoves-latest) that no CI workflow ever builds. pmoves/images.yaml defines the real matrix entry (name: pmoves-tokenism-simulator, context: pmoves, dockerfile: services/tokenism-simulator/Dockerfile) which build-images.yml tags as :edge. Repoint the default to that name/tag. Also add explicit ENV PYTHONPATH=/app to the Dockerfile, mirroring the hi-rag-gateway-v2 house pattern, so the pmoves.tools.* / services.common.* imports resolve independent of invocation cwd. * fix(evo-controller): use get_secret for CHIT signing key (unblocks secrets-audit) Line 63 read the CHIT signing secret via os.getenv while the rest of the file already uses the get_secret helper. get_secret is a strict superset (env var first, then KEY_FILE indirection), so behavior is preserved and Docker secret file-mounting now works. Unblocks the secrets-audit hard-gate in secrets-funnel. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(2184): address review threads — planned-status apps, valid make targets, dry-run mkdir + verified CodeQL suppressions - room manifest: mark legal/email/n8n panels status:planned until routes exist (Codex) - launcher profile: up-archon->up-archon-native (valid target); drop skills that arent make targets (Codex) - launcher_profile_select.py: dry-run no longer creates the Hermes profile dir; lgtm suppressions for env_content writes/logs (KEY NAMES only, values blank) (Codex + CodeQL) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2 participants
Summary
Replaces raw
os.environ.get/os.getenvreads ofCHIT_PASSPHRASEwithservices.common.env.get_secret()so Docker*_FILEsecrets are supported consistently across the fleet.Services updated
graph-linker/chit_signera2ui-nats-bridge/bridgetokenism-simulator/services/chit_encoderconsciousness-service/chr_algorithmhi-rag-gateway/gatewayhi-rag-gateway-v2/configTests updated
graph-linker/tests/test_neo4j_chit_signer.py:CHIT_PASSPHRASE_FILEsigning roundtripa2ui-nats-bridge/tests/test_signature_gate.py: signature gate withCHIT_PASSPHRASE_FILEVerification
Related
Follow-up to #2124 (evo-controller fix). This should close the remaining CHIT secrets-audit warnings.