fix(mcp): converge MCP config for B850 — agent-zero SSE, archon disabled, hostinger + tailscale - #2303
Conversation
github-actions
Bot
added
chit-aware
|
Warning Review limit reached
Next review available in: 16 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (11)
📝 WalkthroughWalkthroughAgent Zero now exposes tokenized MCP SSE endpoints, while MCP inventory and Crush generation support Archon, Hostinger, and disabled servers. Tailscale credentials are added to secret projections and the Agent Zero token is exported through environment collection. ChangesMCP configuration
Tailscale secret projection
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
⚔️ Resolve merge conflicts 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔏 CHIT-aware change — control-body routingThis PR touches a CHIT-aware service (ports 8086/8087/8103/8106/8113/9224 surface). Before a Control-Body ACK:
Advisory routing only — the blocking contract check is CHIT Contract. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pmoves/config/mcp_inventory.json`:
- Around line 41-52: The Archon MCP configuration is inconsistent across
generators and points to an unavailable endpoint. In
pmoves/config/mcp_inventory.json lines 41-52, remove the unsupported endpoint
metadata or align it with the future MCP contract while preserving disabled:
true; in pmoves/tools/crush_configurator.py lines 441-448, emit Archon as
disabled or consume the canonical inventory state instead of generating an
enabled HTTP entry on port 3090.
- Around line 7-8: Make the Agent Zero MCP fleet endpoint reachable by default:
in pmoves/config/mcp_inventory.json lines 7-8, retain the fleet URL only when
the MCP port is remotely reachable; in pmoves/docker-compose.agents.yml lines
98-100 and pmoves/docker-compose.yml lines 2781-2783, publish port 8081 using a
dedicated bind variable whose default is 0.0.0.0, preserving the corresponding
Agent Zero MCP service configuration.
- Around line 126-140: Update the Hostinger stdio configuration and its
rendering path so HOSTINGER_API_TOKEN reaches the pmz-hostinger container.
Prefer adding the Docker exec environment argument using the configured token,
or update render_crush() to materialize spec.env for stdio commands; ensure the
generated command includes the credential while preserving existing command and
args handling.
In `@pmoves/tools/crush_configurator.py`:
- Around line 651-655: Update the Agent Zero override in the configuration flow
to apply whenever spec.key == "agent-zero", rather than requiring the URL to
contain the literal "${TS_Z890}". Ensure it always sets the tokenized
/mcp/t-${AGENT_ZERO_MCP_TOKEN}/sse endpoint and "sse" type, replacing the legacy
Spark HTTP route.
In `@pmoves/tools/mcp_config_generator.py`:
- Around line 293-294: Update the generated MCP contract documentation/schema to
declare the optional disabled field emitted by the server-entry generation
logic, and add regression coverage for both disabled and normal entries to
verify the generated contract preserves each expected shape.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 3131a51f-168a-4a06-9f46-0282c36cd480
📒 Files selected for processing (7)
pmoves/chit/secrets_manifest.yamlpmoves/config/mcp_inventory.jsonpmoves/docker-compose.agents.ymlpmoves/docker-compose.ymlpmoves/scripts/crush-env.shpmoves/tools/crush_configurator.pypmoves/tools/mcp_config_generator.py
| if spec.disabled: | ||
| entry["disabled"] = True |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Document the new disabled field in the generated MCP contract.
This changes the generated crush.json schema. Update the relevant schema or contract documentation and add regression coverage for both disabled and normal server entries before merge.
As per coding guidelines, interface changes must update documentation and schemas and include relevant testing evidence in the pull request.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/tools/mcp_config_generator.py` around lines 293 - 294, Update the
generated MCP contract documentation/schema to declare the optional disabled
field emitted by the server-entry generation logic, and add regression coverage
for both disabled and normal entries to verify the generated contract preserves
each expected shape.
Source: Coding guidelines
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 95e46c83f6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - id: tailscale_api_key | ||
| source: | ||
| type: cgp | ||
| label: TAILSCALE_API_KEY |
There was a problem hiding this comment.
These entries are added only to the generated v1 manifest. The canonical secrets-funnel runs chit-manifest-sync, which rebuilds this file from secrets_manifest_v2.yaml; because neither ID exists there, the next funnel run deletes both entries before hydration, so TAILSCALE_API_KEY and TAILSCALE_TAILNET never reach env.tier-agent. Add them to the v2 source and regenerate the v1 file instead.
AGENTS.md reference: AGENTS.md:L92-L95
Useful? React with 👍 / 👎.
| if spec.key == "agent-zero" and "${TS_Z890}" in str(config.get("url", "")): | ||
| config["url"] = "http://localhost:8081/mcp/t-${AGENT_ZERO_MCP_TOKEN}/sse" | ||
| config["type"] = "sse" |
There was a problem hiding this comment.
On a Spark node, the preceding branch has already replaced this server's URL with http://localhost:8093/mcp, so the ${TS_Z890} condition is false and the new authenticated endpoint is never restored. Because the spec now retains type: "sse", Spark receives an SSE server pointed at the legacy HTTP path rather than /mcp/t-${AGENT_ZERO_MCP_TOKEN}/sse, breaking Agent Zero MCP connections on that node.
Useful? React with 👍 / 👎.
| MCPSpec( | ||
| key="archon", | ||
| config={ | ||
| "type": "http", | ||
| "url": "http://localhost:3090", |
There was a problem hiding this comment.
This new MCPSpec has no condition that sets disabled, so build_config() always emits Archon as an active HTTP MCP server even though the inventory identifies port 3090 as REST-only with no standard MCP transport. In the normal crush-fleet-bootstrap.sh flow, mini_cli crush setup runs after the inventory generator and overwrites its disabled Archon entry, causing Crush to attempt an invalid MCP connection.
Useful? React with 👍 / 👎.
| if spec.disabled: | ||
| entry["disabled"] = True |
There was a problem hiding this comment.
The new flag is applied only by render_crush; Claude, Kimi, OpenCode, and KiloCode ignore it, while Hermes unconditionally emits enabled: true. Consequently, generating any of those clients from the updated inventory activates the REST-only Archon entry despite its disabled: true declaration, producing an unusable MCP server instead of disabling or omitting it.
Useful? React with 👍 / 👎.
| HF_TOKEN \ | ||
| OLLAMA_BASE_URL; do | ||
| OLLAMA_BASE_URL \ | ||
| AGENT_ZERO_MCP_TOKEN; do |
There was a problem hiding this comment.
When the new Tailscale secrets are populated only in env.tier-agent, build_config() can read them from its environment-file cache and therefore enables the Tailscale MCP server, but crush-pmoves launches Crush with only the variables exported by this list. Since TAILSCALE_API_KEY and TAILSCALE_TAILNET are omitted, the inherited npx tailscale-mcp process starts without either credential and cannot authenticate.
Useful? React with 👍 / 👎.
…led, hostinger inventory, tailscale secrets
- agent-zero: switch from HTTP :8080 to SSE :8081/mcp/t-{token}/sse (the
actual MCP transport Agent Zero exposes when mcp_server_enabled=true)
- archon: disable by default — exposes REST-only MCP (/mcp/describe,
/mcp/execute), not standard MCP transport; reachable via A2A from Agent Zero
- hostinger: add to mcp_inventory.json so it's managed by the config generator
instead of only existing as a hand-written crush.json entry
- tailscale: add TAILSCALE_API_KEY + TAILSCALE_TAILNET to secrets manifest so
secrets-funnel can populate them from GitHub secrets
- mcp_config_generator: add disabled field support to ServerSpec and render_crush
- crush_configurator: add AGENT_ZERO_MCP_TOKEN to crush-env.sh exports, add
archon MCPSpec, add z890 safety guard for agent-zero URLs
- docker-compose: set A0_SET_mcp_server_enabled=true in both compose files
💘 Generated with Crush
…lscale to v2 manifest - docker-compose.amd-voice.yml: deploy.resources.reservations.devices: !reset [] Docker Compose v5 merges lists instead of replacing — plain [] leaves the NVIDIA reservation from docker-compose.media.yml intact, causing "could not select device driver nvidia" on AMD-only nodes. - secrets_manifest_v2.yaml: add tailscale_api_key (label TAILSCALE_APIKEY matching GH secret) and tailscale_tailnet entries 💘 Generated with Crush
- Dockerfile.rocm: new ROCm variant using pytorch/pytorch base with CUDA PyTorch swapped for ROCm PyTorch via pip (torch 2.10.0.dev+rocm6.3) - Dockerfile (CUDA): install requirements-ultimate-tts.txt (einops, omegaconf) which was defined but never installed — caused chatterbox/IndexTTS2 failures - Both Dockerfiles: fix conda ToS acceptance for newer miniconda versions - docker-compose.amd-voice.yml: wire Dockerfile.rocm build context, use !reset to clear NVIDIA device reservations (compose v5 merge fix) Verified on B850 (dual R9700, gfx1201/RDNA4): torch.cuda.is_available() = True device: AMD Radeon AI PRO R9700 (x2) einops 0.8.2, omegaconf 2.3.0 Gradio healthy at :7861 💘 Generated with Crush
ebfb6d8 to
870cbd1
Compare
Docker Hardening ValidationHardening Validation ReportValidated: Fri Jul 31 02:19:43 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: p7-room-orchestrator [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret [INFO] Validating: p7_control_token ====================================== |
Review fixes:
- crush_configurator: normalize agent-zero SSE URL unconditionally (Spark
included), not only when ${TS_Z890} is in the URL
- crush_configurator: archon MCPSpec now uses port 8051 (ARCHON_MCP_PORT)
and disabled:true by default — previously always emitted as active
- crush_configurator: preserve pre-existing disabled flag from config dict
via config.pop("disabled", False)
- mcp_config_generator: add disabled field to all renderers (claude/kimi,
kilocode, hermes), not just crush — hermes uses enabled:!disabled
- mcp_config_generator: add env serialization for stdio entries in
render_crush — docker exec entries (hostinger) now pass their env vars
- mcp_inventory.json: document the disabled field in the note
- Dockerfile + Dockerfile.rocm: add ca-certificates to runtime apt install
to fix huggingface-cli CA cert panic at runtime
Test evidence: 15/17 generator tests pass (2 pre-existing failures from
TS_Z890 env var expansion, unrelated to this change).
💘 Generated with Crush
Docker Hardening ValidationHardening Validation ReportValidated: Fri Jul 31 02:34:18 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: p7-room-orchestrator [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret [INFO] Validating: p7_control_token ====================================== |
… only Completes the Archon 0.6.0 migration: consumers now talk to the native REST service (compose `archon` on :3090, host ARCHON_API_PORT :8091) and the dead pre-rewrite surfaces are removed instead of port-forwarded. Removed — no live consumer, verified by probe + grep: - archon MCP entries: A0 seeder default entry + A0_MCP_ARCHON_ENDPOINT (env.shared.example carried dead archon-server variant), .claude/mcp.json + mcp_inventory.json archon entry (REST-only per fleet decision #2303; 0.6.0 exposes no MCP transport — the :8051 bridge died with the TS rewrite #2217), crush_configurator MCPSpec - pmoves/services/archon/orchestrator.py + test_archon_orchestrator.py + test_archon_mcp.py (imports a module that no longer exists) - tools/archon_smoke.py + make targets archon-smoke, archon-upload-smoke, archon-headless-smoke, archon-mcp-smoke (probed /healthz and /api/credentials/* — the native SPA catch-all answers 200 HTML, making these false PASSes), archon-mcp-evidence (/mcp/describe|commands|execute — same catch-all hazard) - scripts/credentials/set_archon_provider.py (POSTs /api/credentials/ provider → 404 on native; zero callers) - make up-archon-submodule + archon-submodule-extract (compose builds from ../PMOVES-Archon; extract was one-shot and done) - generate_ports.sh ARCHON_PROMETHEUS_PORT/ARCHON_GRPC_PORT (zero consumers) - test_docker_hardening.py archon rows (pointed at nonexistent pmoves/services/archon/Dockerfile — were skipping) - secrets_hardening_audit.py focus root (dir gone) Migrated: - codex_health_quick.py: :8091/healthz + dead :8051 fallback → :8091/api/health - archon-ui-smoke: API probe /healthz → /api/health - verify-all + agents-headless-smoke: archon-smoke/archon-headless-smoke → archon-native-health / archon-ui-smoke - env.shared.example A0_MCP_GATEWAY_ENDPOINT gateway:8086 (dead alias) → mcp-gateway:8091 (aligns example with #2851) Deliberately kept: the `archon-server` network alias (documented in the arm64 override; patching it breaks compose) and the follow-up submodule dedup of pmoves/integrations/archon (touches .gitmodules + all nodes — separate lane).
… only Completes the Archon 0.6.0 migration: consumers now talk to the native REST service (compose `archon` on :3090, host ARCHON_API_PORT :8091) and the dead pre-rewrite surfaces are removed instead of port-forwarded. Removed — no live consumer, verified by probe + grep: - archon MCP entries: A0 seeder default entry + A0_MCP_ARCHON_ENDPOINT (env.shared.example carried dead archon-server variant), .claude/mcp.json + mcp_inventory.json archon entry (REST-only per fleet decision #2303; 0.6.0 exposes no MCP transport — the :8051 bridge died with the TS rewrite #2217), crush_configurator MCPSpec - pmoves/services/archon/orchestrator.py + test_archon_orchestrator.py + test_archon_mcp.py (imports a module that no longer exists) — the crawl stub it carried echoed request metadata back as "completed" results; retire-vs-implement resolved to retire, nats-subjects.md updated to say the pair now has no subscriber - tools/archon_smoke.py + make targets archon-smoke, archon-upload-smoke, archon-headless-smoke, archon-mcp-smoke (probed /healthz and /api/credentials/* — the native SPA catch-all answers 200 HTML, making these false PASSes), archon-mcp-evidence (/mcp/describe|commands|execute — same catch-all hazard) - scripts/credentials/set_archon_provider.py (POSTs /api/credentials/ provider → 404 on native; zero callers) - make up-archon-submodule + archon-submodule-extract (compose builds from ../PMOVES-Archon; extract was one-shot and done) - generate_ports.sh ARCHON_PROMETHEUS_PORT/ARCHON_GRPC_PORT (zero consumers) - test_docker_hardening.py archon rows (pointed at nonexistent pmoves/services/archon/Dockerfile — were skipping) - secrets_hardening_audit.py focus root (dir gone) Migrated: - codex_health_quick.py: :8091/healthz + dead :8051 fallback → :8091/api/health - archon-ui-smoke: API probe /healthz → /api/health - verify-all + agents-headless-smoke: archon-smoke/archon-headless-smoke → archon-native-health / archon-ui-smoke - env.shared.example A0_MCP_GATEWAY_ENDPOINT gateway:8086 (dead alias) → mcp-gateway:8091 (aligns example with #2851) - docs anchoring the removed targets (testing-strategy, SMOKETESTS, CHIT_FLOW_INDEX, PMOVESCHIT README, CODEX home, stabilization checklist, audit dashboard, archon runbook/README) repointed to the native equivalents Deliberately kept: the `archon-server` network alias (documented in the arm64 override; patching it breaks compose) and the follow-up submodule dedup of pmoves/integrations/archon (touches .gitmodules + all nodes — separate lane).
… only Completes the Archon 0.6.0 migration: consumers now talk to the native REST service (compose `archon` on :3090, host ARCHON_API_PORT :8091) and the dead pre-rewrite surfaces are removed instead of port-forwarded. Removed — no live consumer, verified by probe + grep: - archon MCP entries: A0 seeder default entry + A0_MCP_ARCHON_ENDPOINT (env.shared.example carried dead archon-server variant), .claude/mcp.json + mcp_inventory.json archon entry (REST-only per fleet decision #2303; 0.6.0 exposes no MCP transport — the :8051 bridge died with the TS rewrite #2217), crush_configurator MCPSpec - pmoves/services/archon/orchestrator.py + test_archon_orchestrator.py + test_archon_mcp.py (imports a module that no longer exists) — the crawl stub it carried echoed request metadata back as "completed" results; retire-vs-implement resolved to retire, nats-subjects.md updated to say the pair now has no subscriber - tools/archon_smoke.py + make targets archon-smoke, archon-upload-smoke, archon-headless-smoke, archon-mcp-smoke (probed /healthz and /api/credentials/* — the native SPA catch-all answers 200 HTML, making these false PASSes), archon-mcp-evidence (/mcp/describe|commands|execute — same catch-all hazard) - scripts/credentials/set_archon_provider.py (POSTs /api/credentials/ provider → 404 on native; zero callers) - make up-archon-submodule + archon-submodule-extract (compose builds from ../PMOVES-Archon; extract was one-shot and done) - generate_ports.sh ARCHON_PROMETHEUS_PORT/ARCHON_GRPC_PORT (zero consumers) - test_docker_hardening.py archon rows (pointed at nonexistent pmoves/services/archon/Dockerfile — were skipping) - secrets_hardening_audit.py focus root (dir gone) Migrated: - codex_health_quick.py: :8091/healthz + dead :8051 fallback → :8091/api/health - archon-ui-smoke: API probe /healthz → /api/health - verify-all + agents-headless-smoke: archon-smoke/archon-headless-smoke → archon-native-health / archon-ui-smoke - env.shared.example A0_MCP_GATEWAY_ENDPOINT gateway:8086 (dead alias) → mcp-gateway:8091 (aligns example with #2851) - docs anchoring the removed targets (testing-strategy, SMOKETESTS, CHIT_FLOW_INDEX, PMOVESCHIT README, CODEX home, stabilization checklist, audit dashboard, archon runbook/README) repointed to the native equivalents Deliberately kept: the `archon-server` network alias (documented in the arm64 override; patching it breaks compose) and the follow-up submodule dedup of pmoves/integrations/archon (touches .gitmodules + all nodes — separate lane).
…CP server test_the_real_roster_keeps_its_optional_credential_servers asserted archon in the dropped-on-empty-environment set, but archon left the MCP roster with the Python-Archon surface retirement (native 0.6.0 REST-only, fleet decision #2303). Expected dropped set is now pmoves-cipher + agent-zero only. 💘 Generated with Crush
… only Completes the Archon 0.6.0 migration: consumers now talk to the native REST service (compose `archon` on :3090, host ARCHON_API_PORT :8091) and the dead pre-rewrite surfaces are removed instead of port-forwarded. Removed — no live consumer, verified by probe + grep: - archon MCP entries: A0 seeder default entry + A0_MCP_ARCHON_ENDPOINT (env.shared.example carried dead archon-server variant), .claude/mcp.json + mcp_inventory.json archon entry (REST-only per fleet decision #2303; 0.6.0 exposes no MCP transport — the :8051 bridge died with the TS rewrite #2217), crush_configurator MCPSpec - pmoves/services/archon/orchestrator.py + test_archon_orchestrator.py + test_archon_mcp.py (imports a module that no longer exists) — the crawl stub it carried echoed request metadata back as "completed" results; retire-vs-implement resolved to retire, nats-subjects.md updated to say the pair now has no subscriber - tools/archon_smoke.py + make targets archon-smoke, archon-upload-smoke, archon-headless-smoke, archon-mcp-smoke (probed /healthz and /api/credentials/* — the native SPA catch-all answers 200 HTML, making these false PASSes), archon-mcp-evidence (/mcp/describe|commands|execute — same catch-all hazard) - scripts/credentials/set_archon_provider.py (POSTs /api/credentials/ provider → 404 on native; zero callers) - make up-archon-submodule + archon-submodule-extract (compose builds from ../PMOVES-Archon; extract was one-shot and done) - generate_ports.sh ARCHON_PROMETHEUS_PORT/ARCHON_GRPC_PORT (zero consumers) - test_docker_hardening.py archon rows (pointed at nonexistent pmoves/services/archon/Dockerfile — were skipping) - secrets_hardening_audit.py focus root (dir gone) Migrated: - codex_health_quick.py: :8091/healthz + dead :8051 fallback → :8091/api/health - archon-ui-smoke: API probe /healthz → /api/health - verify-all + agents-headless-smoke: archon-smoke/archon-headless-smoke → archon-native-health / archon-ui-smoke - env.shared.example A0_MCP_GATEWAY_ENDPOINT gateway:8086 (dead alias) → mcp-gateway:8091 (aligns example with #2851) - docs anchoring the removed targets (testing-strategy, SMOKETESTS, CHIT_FLOW_INDEX, PMOVESCHIT README, CODEX home, stabilization checklist, audit dashboard, archon runbook/README) repointed to the native equivalents Deliberately kept: the `archon-server` network alias (documented in the arm64 override; patching it breaks compose) and the follow-up submodule dedup of pmoves/integrations/archon (touches .gitmodules + all nodes — separate lane).
…CP server test_the_real_roster_keeps_its_optional_credential_servers asserted archon in the dropped-on-empty-environment set, but archon left the MCP roster with the Python-Archon surface retirement (native 0.6.0 REST-only, fleet decision #2303). Expected dropped set is now pmoves-cipher + agent-zero only. 💘 Generated with Crush
… only Completes the Archon 0.6.0 migration: consumers now talk to the native REST service (compose `archon` on :3090, host ARCHON_API_PORT :8091) and the dead pre-rewrite surfaces are removed instead of port-forwarded. Removed — no live consumer, verified by probe + grep: - archon MCP entries: A0 seeder default entry + A0_MCP_ARCHON_ENDPOINT (env.shared.example carried dead archon-server variant), .claude/mcp.json + mcp_inventory.json archon entry (REST-only per fleet decision #2303; 0.6.0 exposes no MCP transport — the :8051 bridge died with the TS rewrite #2217), crush_configurator MCPSpec - pmoves/services/archon/orchestrator.py + test_archon_orchestrator.py + test_archon_mcp.py (imports a module that no longer exists) — the crawl stub it carried echoed request metadata back as "completed" results; retire-vs-implement resolved to retire, nats-subjects.md updated to say the pair now has no subscriber - tools/archon_smoke.py + make targets archon-smoke, archon-upload-smoke, archon-headless-smoke, archon-mcp-smoke (probed /healthz and /api/credentials/* — the native SPA catch-all answers 200 HTML, making these false PASSes), archon-mcp-evidence (/mcp/describe|commands|execute — same catch-all hazard) - scripts/credentials/set_archon_provider.py (POSTs /api/credentials/ provider → 404 on native; zero callers) - make up-archon-submodule + archon-submodule-extract (compose builds from ../PMOVES-Archon; extract was one-shot and done) - generate_ports.sh ARCHON_PROMETHEUS_PORT/ARCHON_GRPC_PORT (zero consumers) - test_docker_hardening.py archon rows (pointed at nonexistent pmoves/services/archon/Dockerfile — were skipping) - secrets_hardening_audit.py focus root (dir gone) Migrated: - codex_health_quick.py: :8091/healthz + dead :8051 fallback → :8091/api/health - archon-ui-smoke: API probe /healthz → /api/health - verify-all + agents-headless-smoke: archon-smoke/archon-headless-smoke → archon-native-health / archon-ui-smoke - env.shared.example A0_MCP_GATEWAY_ENDPOINT gateway:8086 (dead alias) → mcp-gateway:8091 (aligns example with #2851) - docs anchoring the removed targets (testing-strategy, SMOKETESTS, CHIT_FLOW_INDEX, PMOVESCHIT README, CODEX home, stabilization checklist, audit dashboard, archon runbook/README) repointed to the native equivalents Deliberately kept: the `archon-server` network alias (documented in the arm64 override; patching it breaks compose) and the follow-up submodule dedup of pmoves/integrations/archon (touches .gitmodules + all nodes — separate lane).
…CP server test_the_real_roster_keeps_its_optional_credential_servers asserted archon in the dropped-on-empty-environment set, but archon left the MCP roster with the Python-Archon surface retirement (native 0.6.0 REST-only, fleet decision #2303). Expected dropped set is now pmoves-cipher + agent-zero only. 💘 Generated with Crush
… only (#2943) * refactor(archon): retire the old Python-Archon surface — native 0.6.0 only Completes the Archon 0.6.0 migration: consumers now talk to the native REST service (compose `archon` on :3090, host ARCHON_API_PORT :8091) and the dead pre-rewrite surfaces are removed instead of port-forwarded. Removed — no live consumer, verified by probe + grep: - archon MCP entries: A0 seeder default entry + A0_MCP_ARCHON_ENDPOINT (env.shared.example carried dead archon-server variant), .claude/mcp.json + mcp_inventory.json archon entry (REST-only per fleet decision #2303; 0.6.0 exposes no MCP transport — the :8051 bridge died with the TS rewrite #2217), crush_configurator MCPSpec - pmoves/services/archon/orchestrator.py + test_archon_orchestrator.py + test_archon_mcp.py (imports a module that no longer exists) — the crawl stub it carried echoed request metadata back as "completed" results; retire-vs-implement resolved to retire, nats-subjects.md updated to say the pair now has no subscriber - tools/archon_smoke.py + make targets archon-smoke, archon-upload-smoke, archon-headless-smoke, archon-mcp-smoke (probed /healthz and /api/credentials/* — the native SPA catch-all answers 200 HTML, making these false PASSes), archon-mcp-evidence (/mcp/describe|commands|execute — same catch-all hazard) - scripts/credentials/set_archon_provider.py (POSTs /api/credentials/ provider → 404 on native; zero callers) - make up-archon-submodule + archon-submodule-extract (compose builds from ../PMOVES-Archon; extract was one-shot and done) - generate_ports.sh ARCHON_PROMETHEUS_PORT/ARCHON_GRPC_PORT (zero consumers) - test_docker_hardening.py archon rows (pointed at nonexistent pmoves/services/archon/Dockerfile — were skipping) - secrets_hardening_audit.py focus root (dir gone) Migrated: - codex_health_quick.py: :8091/healthz + dead :8051 fallback → :8091/api/health - archon-ui-smoke: API probe /healthz → /api/health - verify-all + agents-headless-smoke: archon-smoke/archon-headless-smoke → archon-native-health / archon-ui-smoke - env.shared.example A0_MCP_GATEWAY_ENDPOINT gateway:8086 (dead alias) → mcp-gateway:8091 (aligns example with #2851) - docs anchoring the removed targets (testing-strategy, SMOKETESTS, CHIT_FLOW_INDEX, PMOVESCHIT README, CODEX home, stabilization checklist, audit dashboard, archon runbook/README) repointed to the native equivalents Deliberately kept: the `archon-server` network alias (documented in the arm64 override; patching it breaks compose) and the follow-up submodule dedup of pmoves/integrations/archon (touches .gitmodules + all nodes — separate lane). * fix(archon): roster regression guard no longer expects archon as an MCP server test_the_real_roster_keeps_its_optional_credential_servers asserted archon in the dropped-on-empty-environment set, but archon left the MCP roster with the Python-Archon surface retirement (native 0.6.0 REST-only, fleet decision #2303). Expected dropped set is now pmoves-cipher + agent-zero only. 💘 Generated with Crush * fix(archon): drop stale ratchet entry for the deleted test_archon_mcp Deleting pmoves/tests/services/test_archon_mcp.py (it tested the retired mcp_server surface) resolved its baselined collection error, and the ratchet now fails on the stale entry. Drop that one line so the same breakage cannot return silently. 💘 Generated with Crush * fix(archon): migrate runbook callers off the removed Python-Archon targets P1 review finding on #2943: README, docs/testing/TESTING.md, pmoves/AGENTS.md and docs/SUBMODULES.md still invoked archon-smoke, archon-mcp-smoke and up-archon-submodule after the surface retirement. Migrate to the native successors — archon-ui-smoke, archon-native-health, archon-rest-policy-smoke, up-archon-native — and drop the retired MCP-bridge section. Also covers the fordham spec's bring-up reference. Anchors + postdate validators pass. 💘 Generated with Crush --------- Co-authored-by: Agent Zero <agent.zero@pmoves.ai>
1 participant
Summary
:8080/mcpto SSE:8081/mcp/t-{token}/sse— the actual MCP transport Agent Zero exposes whenmcp_server_enabled=true. Bothmcp_inventory.jsonandcrush_configurator.pyupdated./mcp/describe,/mcp/execute), not standard MCP transport. Reachable via A2A from Agent Zero (A0_MCP_ARCHON_ENDPOINTalready wired internally).mcp_inventory.jsonso it's managed by the config generator instead of only surviving as a hand-written crush.json entry.TAILSCALE_API_KEY+TAILSCALE_TAILNETto secrets manifest somake -C pmoves secrets-funnelcan populate them from GitHub secrets.disabledfield support toServerSpecandrender_crushso disabled inventory entries propagate to generated configs.AGENT_ZERO_MCP_TOKENtocrush-env.shexports, add archon MCPSpec, add safety guard rewriting stale${TS_Z890}agent-zero URLs.A0_SET_mcp_server_enabled=truein both compose files so Agent Zero's MCP SSE server starts automatically.Testing evidence
GET http://localhost:8081/mcp/t-{token}/sse→ 200 ✓💘 Generated with Crush
Summary by CodeRabbit