fix(compose+hirag): probes the images can run + keep cu121 torch off ARM by POWERFULMOVES · Pull Request #2680 · POWERFULMOVES/PMOVES.AI

POWERFULMOVES · 2026-08-22T16:33:47Z

Summary

Surfaced by the post-merge rolling recreate on SPARK (GB10/ARM64) while applying 4090's wave (#2662–#2674):

a2ui-renderer + tokenism-ui healthchecks: wget → curl. The images ship curl only, so both services answered HTTP 200 while permanently "unhealthy" (14+ failing streak) — false-negative probes. Matches the existing tensorzero-ui curl-fallback pattern. Splits regenerated from the monolith.
hi-rag-gateway v1 Dockerfile: guard the optional CUDA torch install to x86_64. The unpinned pip install --index-url .../cu121 torch has no modern aarch64 wheels; on ARM it silently resolved torch 2.0.1, clobbering the locked 2.9.x. transformers 4.57.3 then crashes at import (torch.compiler missing). This is the documented unpinned-install defect class (chore(infra): operator-infra-gates - fix pre-existing village-gate 3-policy violations #2285 family) going from latent to live on rebuild.

The x86 unpinned-clobber question (cu121 pins vs lock coherence) stays with the hi-rag v1 retirement-or-repin lane — this PR only stops the ARM footgun.

Affected services

a2ui-renderer (healthcheck only)
tokenism-ui (healthcheck only)
hi-rag-gateway v1 (Dockerfile, ARM hosts only)

Testing

Live-validated on SPARK (GB10) from this branch:

up -d --force-recreate a2ui-renderer tokenism-ui → both healthy (were permanently unhealthy pre-fix, services returned 200 throughout)
build hi-rag-gateway with no build args on aarch64 → image contains torch 2.9.1+cpu, gateway healthy (pre-fix rebuild crash-looped on torch 2.0.1)
make compose-split regenerated core/ui splits; diff is exactly the two probe lines
Post-wave node state: 81 up, 0 restarting; unhealthy reduced to the known routed lanes (pmoves-ui truthful-503, media CUDA)

Full wave-validation record (regression repairs included): pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md — SPARK-KIMI::POSTMERGE-WAVE-2662-2674::2026-08-22.

💘 Generated with Crush

Two false-unhealthy healthchecks and one silent torch downgrade, all surfaced by the post-merge rolling recreate on SPARK (GB10/ARM64): - a2ui-renderer and tokenism-ui healthchecks used wget, but the images ship curl only. Both services answered 200 while stuck "unhealthy" (14+ failing streak). Switch to curl, matching the tensorzero-ui probe pattern. Splits regenerated from the monolith. - hi-rag-gateway v1's optional CUDA stanza pip-installs unpinned torch from download.pytorch.org/whl/cu121. That index has no modern aarch64 wheels, so on ARM the install silently resolved torch 2.0.1, clobbering the locked 2.9.x; transformers 4.57.3 then crashes at import on torch.compiler. Guard the stanza to x86_64 hosts. The x86 unpinned-clobber question remains with the hi-rag v1 repin/retire lane. Rebuild on GB10 without build args now yields torch 2.9.1+cpu and a healthy gateway. Validated on-node: both UIs healthy via curl probes; gateway healthy with locked torch after arch-guarded build. 💘 Generated with Crush

coderabbitai · 2026-08-22T16:33:55Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: faeeddc9-e6b5-48d3-9ebb-b908ed622707

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-22T16:34:16Z

Docker Hardening Validation

Hardening Validation Report

Validated: Sat Aug 22 16:34:15 UTC 2026

Services Checked

PMOVES.AI Docker Hardening Validation

[INFO] Checking: pmoves/docker-compose.hardened.yml

[INFO] Validating: hi-rag-gateway-v2
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: extract-worker
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: langextract
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: presign
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: render-webhook
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: retrieval-eval
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pdf-ingest
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: jellyfin-bridge
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: invidious-companion-proxy
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: ffmpeg-whisper
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-video
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-audio
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-v2-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: deepresearch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supaserch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: publisher-discord
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: mesh-agent
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-req
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-res
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: comfy-watcher
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: grayjay-plugin-host
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: agent-zero
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: p7-room-orchestrator
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: archon
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: channel-monitor
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pmoves-yt
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: notebook-sync
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supabase_service_role_key
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

[INFO] Validating: supabase_jwt_secret
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

[INFO] Validating: p7_control_token
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

======================================
Summary: 112 passed, 43 warnings, 0 errors

github-actions · 2026-08-22T16:34:38Z

🔏 CHIT-aware change — control-body routing

This PR touches a CHIT-aware service (ports 8086/8087/8103/8106/8113/9224 surface). Before a Control-Body ACK:

the diff (or PR body) should reference a CHIT signature trail — chit.signed.v1, a CHIT: trailer, or a make -C pmoves sign-trail entry;
the chit-pr-audit-agent (.claude/agents/chit-pr-audit-agent.md) is the gate that grants/refuses ACK eligibility;
signing quickstart: pmoves/docs/AGENTS/CHIT_SIGNING_TUTORIAL.md.

Advisory routing only — the blocking contract check is CHIT Contract.

github-actions · 2026-08-22T18:08:32Z

Docker Hardening Validation

Hardening Validation Report

Validated: Sat Aug 22 18:08:30 UTC 2026