docs: correct the record — Longbow deprecation + inverted yt-egress header - #2456
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 46 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
docs
Docker Hardening ValidationHardening Validation ReportValidated: Fri Aug 7 00:21:09 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: p7-room-orchestrator [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret [INFO] Validating: p7_control_token ====================================== |
PMOVES_LONGBOW_DEPRECATED.md asserted on main:
"No PMOVES-Longbow submodule exists in `.gitmodules`. No code was ever written."
Both clauses are false. Verified against git:
294ea52 2026-07-15 feat(submodule): add PMOVES--longbow (Arrow-Flight vector cache)
23af4df 2026-07-15 feat(longbow): Phase D — compose stanza + profile data wiring
Both authored by PMOVES-AGENT-ZERO-SPARK on origin/fix/cipher-search-memoryid-followup,
which is 345 commits behind main with no open PR. The work was never merged, so there is
no removal commit either — which is exactly why searching main alone finds nothing.
The cited justification was `TAC_CIPHER.md:402` ("LongBow is documentation-only — never
integrated"), dated 2026-07-13 — ONE DAY before that integration work landed. True when
written, stale when cited on 2026-07-30.
This corrects the FACTS, not the DECISION. Not adopting Longbow may well be right: Cipher
(Qdrant dense + BM25 sparse + RRF) and Hi-RAG v2 (dense + Meilisearch lexical + graph boost)
genuinely do deliver the hybrid retrieval it promised. The decision now rests on
superseded-by grounds rather than on a false premise, and the unmerged work is findable
instead of denied.
Also documents the naming collision the original conflated: "Longbow" is both an
Arrow-Flight vector cache (real, benchmarked, unmerged — positioned as an L1 cache IN FRONT
OF Qdrant, not a replacement) and an unrelated contextual-bandit model router (never built,
correctly abandoned). The router was rightly dropped; the vector cache was deprecated by
proxy.
Note for whoever owns launch-readiness: this doc satisfies the
`stage-4.longbow-or-deprecated` gate (pmoves-launch-readiness.tac.yaml:253). The gate
remains satisfied — but it was passed on a premise that was not true, which may warrant
re-examination rather than a silent patch.
The generalizable finding: an automated gate-closure that reads only `main` will miss
unmerged work and can write "never existed" into the permanent record as fact.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…be flags
docker-compose.yt-egress.yml:7-12 claimed this overlay routes YouTube traffic
through the KVM4-1 datacenter exit node "to bypass YouTube's residential-IP
anti-bot 403s", asserting that "home residential fingerprints are invisible to
YouTube once every yt-dlp request ... resolves through the datacenter egress."
That is backwards. Per the 2026-07-28 discovery in mk/egress.mk:7-10:
"YouTube datacenter IPs get FLAGGED by YouTube's bot detection.
Residential IPs work. ... the DEFAULT for YT download traffic should be
host-direct (residential)."
Two files stated opposite truths and the wrong one had a make target attached:
`make up-yt-egress` still routes through the datacenter — the IP class now known
to be bot-gated — while its own header advertised that as the fix. Running it
today makes ingestion worse, not better.
Kept rather than deleted: datacenter egress is still a legitimate fallback for
nodes with no residential path, and the Tailscale plumbing here is correct. Only
the claim about which IP class YouTube flags was wrong. The header now leads with
the correction, marks the overlay FALLBACK-ONLY, points at `make yt-direct` /
`make yt-egress-check`, and retains the original text labelled as history.
Verified: YAML parses, all 5 services intact (tailscale-yt-egress, pmoves-yt,
bgutil-pot-provider, invidious-companion, invidious); validate-composes clean;
validate-dockerfile-paths OK.
Found while establishing why the Keith D / Coin Bureau corpus was never ingested.
Two live blockers, this being the second: a host-side Tailscale exit node is
currently ACTIVE on the 4090, so container egress resolves to datacenter and gets
bot-gated. The first is ffmpeg-whisper running CPU-only at 0.24x realtime, which
would make 81 minutes of audio take ~5.6 hours instead of ~30 minutes.
Known Road: compose:pr:2456
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
91b5afe to
5812360
Compare
… handoff
These two 4090-claude entries have sat UNCOMMITTED in a local working tree since
2026-08-04 and were never on main. Consequence: no other agent and no commit
history has ever seen them, while at least one of their claims was being treated
as a real handoff.
Committed here against main (not the local branch, which was 12 commits behind on
this file) so nothing that landed since is clobbered.
What the entries record, all independently re-verified this session:
- ffmpeg-whisper runs CPU-only on a CUDA base image: the cmake never passed the
CUDA flag, libggml-cuda.so is absent, and af_whisper's use_gpu defaults to 1 —
so the GPU was requested every run and silently downgraded, ffmpeg exiting 0
throughout. Measured 0.24x realtime. Now fixed in PR #2446.
- No VAD model shipped; vad_model has no default, so segmentation fell back to
fixed windows sized by `queue` (3s default) — which also caps segment length
even once VAD is enabled. Also #2446.
- yt-dlp failures were an egress problem, not cookies: datacenter IPs are
bot-gated, residential works. The compose overlay documented the inverse and
is corrected in PR #2456.
- The mint/tokenomics review findings, which held up.
ONE CLAIM RETRACTED. The entry asserted "B850 running the Keith D/Coin Bureau
cluster (5 videos, 81 min)" as corpus input for the $CRED instrument-class
decision. Verified false on three counts:
- no transcripts, SRT/VTT, download-archive entries or MinIO objects exist for
either channel; pmoves/data/media/ is empty
- no brief anywhere enumerates which 5 videos
- the existing 2,028-video crawl (DARKXSIDE_PLAYLIST_ANALYSIS_2026-07-28.md)
lists Keith D and Coin Bureau as two SEPARATE channels, 36 and 23 videos —
"5 videos, 81 min" corresponds to nothing measured
Retracted in place rather than deleted. This is an audit trail; silently removing
a false claim leaves no evidence it was ever made or corrected, which is the same
failure mode that let the Longbow "no code was ever written" assertion stand.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Docker Hardening ValidationHardening Validation ReportValidated: Fri Aug 7 15:43:19 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: p7-room-orchestrator [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret [INFO] Validating: p7_control_token ====================================== |
… handoff (#2457) These two 4090-claude entries have sat UNCOMMITTED in a local working tree since 2026-08-04 and were never on main. Consequence: no other agent and no commit history has ever seen them, while at least one of their claims was being treated as a real handoff. Committed here against main (not the local branch, which was 12 commits behind on this file) so nothing that landed since is clobbered. What the entries record, all independently re-verified this session: - ffmpeg-whisper runs CPU-only on a CUDA base image: the cmake never passed the CUDA flag, libggml-cuda.so is absent, and af_whisper's use_gpu defaults to 1 — so the GPU was requested every run and silently downgraded, ffmpeg exiting 0 throughout. Measured 0.24x realtime. Now fixed in PR #2446. - No VAD model shipped; vad_model has no default, so segmentation fell back to fixed windows sized by `queue` (3s default) — which also caps segment length even once VAD is enabled. Also #2446. - yt-dlp failures were an egress problem, not cookies: datacenter IPs are bot-gated, residential works. The compose overlay documented the inverse and is corrected in PR #2456. - The mint/tokenomics review findings, which held up. ONE CLAIM RETRACTED. The entry asserted "B850 running the Keith D/Coin Bureau cluster (5 videos, 81 min)" as corpus input for the $CRED instrument-class decision. Verified false on three counts: - no transcripts, SRT/VTT, download-archive entries or MinIO objects exist for either channel; pmoves/data/media/ is empty - no brief anywhere enumerates which 5 videos - the existing 2,028-video crawl (DARKXSIDE_PLAYLIST_ANALYSIS_2026-07-28.md) lists Keith D and Coin Bureau as two SEPARATE channels, 36 and 23 videos — "5 videos, 81 min" corresponds to nothing measured Retracted in place rather than deleted. This is an audit trail; silently removing a false claim leaves no evidence it was ever made or corrected, which is the same failure mode that let the Longbow "no code was ever written" assertion stand. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 participant
Two documents assert things that are demonstrably false, and both are load-bearing. Same defect class: confidently-wrong text that nobody re-checked.
1. Longbow deprecation rests on a false premise
PMOVES_LONGBOW_DEPRECATED.mdstates onmain:Both clauses are false:
294ea52f7feat(submodule): add PMOVES--longbow (Arrow-Flight vector cache)23af4df50feat(longbow): Phase D — compose stanza + profile data wiring(ports 3100/3101/9190, healthcheck, limits, networks, volume)Both on
origin/fix/cipher-search-memoryid-followup— 345 commits behind main, no open PR. Never merged, so no removal commit exists either; that's precisely why searchingmainalone finds nothing.The cited justification was
TAC_CIPHER.md:402("LongBow is documentation-only — never integrated"), dated 2026-07-13 — one day before that work landed. True when written, stale when cited on 2026-07-30.This corrects the facts, not the decision. Not adopting Longbow may well be right — Cipher (Qdrant dense + BM25 sparse + RRF) and Hi-RAG v2 (dense + Meilisearch lexical + graph boost) genuinely deliver the hybrid retrieval it promised. The decision now stands on superseded-by grounds, and the unmerged work is findable rather than denied.
Also documents a naming collision the original conflated — "Longbow" is both an Arrow-Flight vector cache (real, benchmarked, unmerged, positioned as an L1 cache in front of Qdrant, not a replacement) and an unrelated contextual-bandit model router (never built, correctly abandoned). The router was rightly dropped; the vector cache was deprecated by proxy.
stage-4.longbow-or-deprecated(pmoves-launch-readiness.tac.yaml:253). The gate stays satisfied, but it was passed on an untrue premise — that may warrant re-examination rather than a silent patch.2. The yt-egress overlay documents the inverse of reality
docker-compose.yt-egress.yml:7-12says it routes YouTube traffic through the KVM4-1 datacenter exit node to bypass "YouTube's residential-IP anti-bot 403s".mk/egress.mk:7-10(2026-07-28 discovery) says the opposite, and is correct:Practical consequence:
make up-yt-egressstill routes through the datacenter — the IP class now known to be bot-gated — while its header presents that as the fix. Running it today makes ingestion worse. That is a trap with a make target attached.(This half lands in a follow-up commit on this branch — the compose path is
readOnlyand needs a Known Road, which this PR number provides.)Why these two together
Both are the same failure mode, and it recurred elsewhere this session: a fictional Agent Zero MCP API documented with copy-pasteable
curl/nats subcommands that 404, and a Prometheus probe pointing at an Archon port/path that never existed (#2448).The living-docs registry (#2449) catches stale. Nothing catches confidently wrong. Enrollment measures age; it cannot measure truth. That gap is the systemic finding — worth addressing directly rather than fixing instances one at a time.
Related: #2448 (Archon probe), #2449 (registry enrollment + supersede banners).
🤖 Generated with Claude Code