fix(neo4j): internal-only Neo4j fronted by a Tailscale forwarder on a dedicated graph front; LOAD CSV blocklist; fleet test by POWERFULMOVES · Pull Request #3201 · POWERFULMOVES/PMOVES.AI

POWERFULMOVES · 2026-09-27T08:00:14Z

Lane: ops/knuckles-neo4j-from-fork (Neo4j Phase 1b follow-up). Branch ops/knuckles-neo4j-external. No live change.

Why

Phase 1b step 7 (2026-09-27): the compose neo4j came up healthy, but Docker published nothing. pmoves_app, pmoves_bus and pmoves_data are all internal: true, and Docker does not publish ports for a container attached only to internal networks. The render and dry-run gates could not see this: they read REQUESTED bindings.

Design: operator OPTION A (after the networking-doc and upstream reconciliation)

Neo4j stays internal-only (no egress, no host port), fronted by a Tailscale forwarder. This is DOCKER_NETWORK_HARDENING.md Rule 5: "There is no 'publish without egress.' Front it with a gateway." (preferred)

Rejected alternatives:

Neo4j on pmoves_external. It violates Rule 1 (data services never on pmoves_external). network-planes-and-package-sharing-2026-09-03.md calls it "a security regression".
Masquerade-off bridges. They do not block egress; they only remove SNAT.

The first attempt (neo4j joins pmoves_external, commit 21526bb) is reverted (e8ded62), as is the blocklist commit that had edited that block (a39991a). History is kept honest.

Commits

Commit	What
`f646643`	Fleet test: a published service must be on a non-internal network
`ae2c46f`	P2-A + P3: external networks' internal flag comes from their Makefile create sites
`a39991a`, `e8ded62`	Reverts: the pmoves_external change and the blocklist that had edited it
`14ed3b6`	Neo4j is internal-only by design; invariants pinned
`e45c8fc`	The LOAD CSV blocklist, re-applied on its own (defense in depth)
`9b64c67`	The forwarder, on a dedicated `pmoves_graph_front`
`5889d40`	Review fixes: `--no-deps` + graph_front preflight (P2); dedicated scoped key + `TS_AUTH_ONCE`; state-volume rename; registry rows; continuation-line parser
`ea6461e`	Nits: the preflight also refuses a stopped Neo4j (`.State.Running`); accurate inspect-failure message; 4-state behavioural test

The forwarder: `docker-compose.neo4j-tailnet.yml` (an overlay, NOT in STACK_FILES)

Pattern: it reuses the repo's sidecar pattern (docker-compose.yt-egress.yml) and TAILSCALE_FLEET_POSTURE.md.

Service neo4j-tailnet:

tailscale/tailscale:stable pinned by digest (sha256:c507f3a2…, tailscale 1.102.5). The precedent uses the moving :latest, which validate-composes-images flags.
TS_USERSPACE=true, and TS_STATE_DIR on the named volume graphfront-tailnet-state (see review fixes for why the name avoids "neo4j").
TS_AUTHKEY comes from a dedicated NEO4J_TAILNET_AUTHKEY (:? guarded), with TS_AUTH_ONCE=true.
The auth key from the secrets funnel, failing closed at compose parse (the same :? guard as yt-egress).
TS_EXTRA_ARGS=--advertise-tags=tag:neo4j.
TS_ACCEPT_DNS=false, so neo4j resolves via Docker DNS.
cap_drop: [ALL] + no-new-privileges. Measured: userspace tailscaled starts with no capabilities (throwaway, no key, --network none). yt-egress's NET_ADMIN was for its proxy listeners, which this does not use.
No host ports, and no network_mode: Neo4j does not share its netns.

Forwarding: config/tailscale/neo4j-tailnet-serve.json via TS_SERVE_CONFIG sends only TCP 7687 to neo4j:7687. The 7474 browser UI is not forwarded, because fleet AGInTs need bolt only.

Networks (least privilege, per the steward's ruling):

pmoves_graph_front (NEW, internal: true, 172.30.9.0/24, gateway .1): joined only by neo4j and the forwarder. A compromised forwarder reaches Neo4j and nothing else on the data tier; the forwarder is deliberately NOT on pmoves_data.
- The subnet is permanent per Rule 2. .1–.8 are allocated (repo and live); .9 was free.
pmoves_external is the one egress network, for the Tailscale control plane and DERP. This is the documented dual-attach pattern (agent-zero, archon, hi-rag-gateway-v2, flute-gateway). Rule 1 keeps DATA services off pmoves_external; the forwarder is a gateway, not a data store.

Neo4j: it joins pmoves_graph_front (internal) and gains nothing else. It stays on app/bus/data, all internal, with no alias needed (compose registers the service name on every network).

Make targets (mk/neo4j-tailnet.mk; no recipe nests make):

up-neo4j-tailnet: preflight is $(DC) -f <overlay> config -q, which trips the overlay's own key guard without printing it.
neo4j-tailnet-status.
down-neo4j-tailnet: compose stop, then a non-forced docker container rm.

Open questions: evidence

Does TS_DEST_IP work in userspace? NO. Containerboot on the pinned image says "invalid configuration: TS_DEST_IP is not supported with TS_USERSPACE". It would need kernel mode (/dev/net/tun + NET_ADMIN), which departs from the repo's userspace precedent.
Does serve TCP accept a non-localhost target?
- The CLI path refuses it: "only localhost or 127.0.0.1 proxies are currently supported" (ipn/serve.go ExpandProxyTargetValue, in our PMOVES-Tailscale fork).
- A ServeConfig applied via TS_SERVE_CONFIG is dialled by tailscaled with b.dialer.SystemDial(ctx, "tcp", backDst) (ipn/ipnlocal/serve.go), with no localhost check. So TCPForward: "neo4j:7687" resolves via Docker DNS.
- Source-reasoned from the fork (2026-04), not runtime-tested (that needs a logged-in node). It MUST be proven at the live step.

Rendered evidence (read-only; the shared checkout's env over this tree's compose; env values never printed)

Field	Rendered value
`neo4j` networks	`pmoves_app, pmoves_bus, pmoves_data, pmoves_graph_front`
`neo4j-tailnet` networks	`pmoves_external, pmoves_graph_front`
image	`tailscale/tailscale:stable@sha256:c507f3a2…`
ports	NONE
`network_mode`	none
`cap_drop`	ALL
`security_opt`	`no-new-privileges:true`
`TS_USERSPACE`	true
`TS_SERVE_CONFIG`	`/config/serve.json` (mounted ro)
`TS_EXTRA_ARGS`	`--advertise-tags=tag:neo4j`
`TS_ACCEPT_DNS`	false
auth key	resolves as set on this node (value not shown)
`pmoves_graph_front`	internal=True, `172.30.9.0/24`
internal flags	app/bus/data/graph_front True; external False

The LOAD CSV blocklist: defense in depth (`e45c8fc`)

NEO4J_internal_dbms_cypher__ip__blocklist=0.0.0.0/0,::/0 on neo4j. Even internal-only, it stops Cypher LOAD CSV from reaching the host gateway, the LAN or other containers.

Evidence (pinned 5.26.30 Community image; throwaway containers only; the live container untouched):

Strict validation recognises the key ("Configuration file validation successful"); a bogus key is rejected ("Configuration contains errors").
Without it, on a private --internal bridge, LOAD CSV FROM 'http://127.0.0.1:1/x' gives "Couldn't load the external resource". That is a connection error.
With it, http and https IP literals AND a resolvable hostname give "access to … is blocked via the configuration property internal.dbms.cypher_ip_blocklist". That is a policy refusal.
Re-proved with the service's full rendered env (24 keys; values passed via the docker CLI env).
Caveats:
- internal.* is unsupported by Neo4j; the digest pin keeps it stable.
- Upstream notes the source documents coverage of LOAD CSV and apoc.load.json. Other apoc.load.* procedures and HTTP redirects are unverified.
- --network none is unusable for offline Neo4j tests: Neo4j 5.26 exits immediately (code 3, "shutdown initiated by request", no error) without a network. Use a private --internal bridge.

Fleet test: `tests/test_published_ports_need_a_non_internal_network.py`

Every published service in the default STACK_FILES must join at least one non-internal network.

Measured: 35 violators at main. On Knuckles, 15/15 RUNNING violators had requested bindings and zero effective ones, while cipher-api, minio and presign published.
The known violators are listed in KNOWN_VIOLATORS as strict xfail. Neo4j is listed by design (see below).
P2-A: pmoves_external and pmoves_db_egress are external: true, so their internal flag comes from the Makefile create sites. EXTERNAL_NON_INTERNAL asserts that every docker network create site for them omits --internal (Makefile:725/5815 for db_egress; 5144/5191/5813 for external), with a positive control.
P3: network keys resolve to name:. Scope: STACK_FILES only; !reset/!override are not modelled.
Option-A invariants:
- neo4j joins exactly app/bus/data/graph_front, all internal;
- neo4j has no network_mode;
- pmoves_graph_front is internal, and its only STACK member is neo4j (the forwarder joins from its overlay).

Forwarder test (tests/test_neo4j_tailnet_forwarder.py), 7 structural assertions: digest pin; userspace and no TS_DEST_IP; the serve mount; bolt-only forward; the tag; graph_front + external only, with no netns, ports or caps; not in STACK_FILES; no recipe nests make.

Dropped deliberately (the steward's ruling): two assertions that the auth-key line uses the funnel-sourced :? guard. Their text named the auth-key variable, which the zero-access gate refuses. They are not rephrased to avoid the name. Coverage stays adequate: the compose line's :? makes compose itself refuse to start without the key.

Counts (targeted): forwarder 7 + fleet + bind passthrough + neo4j safety + no-bare-compose = 146 passed, 35 xfailed, 0 failed.

Gates:

Gate	Result
`compose-networks-check`	in sync (109)
`compose-split-check`	rc=0
`validate-composes`	clean

Review fixes (`5889d40`)

P2: the forwarder never recreates Neo4j. Before this fix, up-neo4j-tailnet would have recreated the live pmoves-neo4j implicitly: through depends_on: neo4j, compose sees neo4j's config changed by this PR, since it joins pmoves_graph_front.

The target now runs up -d --no-deps neo4j-tailnet.
Before that, a names-only docker inspect preflight refuses (exit 1) unless the running pmoves-neo4j is already attached to pmoves_graph_front. It prints network names only, never addresses.
depends_on stays, for full-stack ordering.
Tests:
- a structural check: --no-deps is present and the preflight precedes the up;
- a behavioural check: real make runs against build_stub_env stubs. Before the recreate the target refuses and no compose up runs; after it, every up carries --no-deps.

P3:

Registry rows: DOCKER_NETWORK_HARDENING.md gains pmoves_db_egress (172.30.8.0/24, not internal) and pmoves_graph_front (172.30.9.0/24, internal). The "Six networks" line was already stale; it now reads nine.
Comment fix: the overlay comment now says neo4j resolves on pmoves_graph_front, not pmoves_data.
State volume: renamed to graphfront-tailnet-state. Any name containing neo4j would still match volume-reset's (^pmoves_.*neo4j|neo4j$), and that includes the suggested pmoves_tailnet-neo4j-state. A match means make volume-reset SERVICE=neo4j would wipe the forwarder's tailnet identity. A test asserts that the name cannot match.
Create-site parser: it now joins backslash-continued lines. Failing-before: the old single-line regex missed an --internal placed on a continuation line. There is a new test for this.
Key scoping: the forwarder uses the dedicated NEO4J_TAILNET_AUTHKEY (a one-off, pre-authorised key scoped to tag:neo4j) plus TS_AUTH_ONCE=true. Registering it in the secrets manifest is an operator step: the manifest path is zero-access to agents (even a protection check naming the path was refused), so I did not attempt the edit by another route.

Tests (targeted only), at 5889d40: test_neo4j_tailnet_forwarder, test_published_ports_need_a_non_internal_network, test_neo4j_bind_passthrough, test_neo4j_container_safety and test_no_bare_compose_calls give 151 passed, 35 xfailed. The commit message says 157; that figure is wrong, and 151 is the measured count. Gates: compose-networks-check OK (109 services), validate-composes clean, compose-split-check rc 0.

Nits (ea6461e):

The preflight reads .State.Running together with the network names, in the same single inspect call (still no addresses). It refuses when pmoves-neo4j is stopped: --no-deps will not start it, and a forwarder in front of a stopped Neo4j fronts nothing.
An inspect failure now reads "could not inspect pmoves-neo4j (missing, or daemon/permission error)".
The behavioural test covers four stub states, each asserting the refusal reason and that no compose up ran: before the recreate; after it (the only one that runs up, and with --no-deps); recreated but stopped; inspect failing with rc 1.
Same targeted set at ea6461e: 153 passed, 35 xfailed; compose-networks-check OK (109 services); validate-composes clean; compose-split-check rc 0.

Operator decision (left as is): the overlay keeps ${NEO4J_TAILNET_AUTHKEY:?}. With TS_AUTH_ONCE=true the key is only used at first login, but the :? means the variable must stay set for compose to render the overlay at all; relaxing it once the state volume holds an identity is the operator's call. The main stack is unaffected, because the overlay is not in STACK_FILES.

Findings (not fixed here)

APOC (corrected). Upstream verified from the neo4j Docker entrypoint (docker-image-src/5/coredb/docker-entrypoint.sh:468-473) that NEO4JLABS_PLUGINS is still honoured in 5.x as a fallback (: ${NEO4J_PLUGINS:=${NEO4JLABS_PLUGINS}}, with a deprecation warning), and core apoc installs from the local labs/ jar with no download. So APOC is most likely LOADED, and dbms.security.procedures.unrestricted=apoc.* is LIVE. This corrects my earlier "may never load" reading, which looked only at the empty plugins/ of the bare image. Suggestion, not in this PR: rename to NEO4J_PLUGINS.
Neo4j's ports: / NEO4J_BIND are INERT under option A. On internal-only networks nothing publishes. They are kept only because feat(neo4j): NEO4J_BIND pass-through (option B) + Neo4j on app/bus/data for every AGInT (compose half pending road) #3196's pass-through reads them. Dropping them (and with them feat(neo4j): NEO4J_BIND pass-through (option B) + Neo4j on app/bus/data for every AGInT (compose half pending road) #3196's pass-through) is a follow-up decision for the operator, not this PR.
yt-egress sidecar. It sits only on pmoves_app, which is internal: true, so it may never reach the Tailscale control plane. Unmeasured.
Guard findings (for the damage-control owner), three:
- (a) A compose container removal is misread as a filesystem removal. A compose container removal with the force flag, in a down target mirroring down-yt-egress, was misread by the Bash guard as a filesystem recursive/force removal and refused. The same pattern later matched this PR description's own prose describing it: the finding reproduced itself. The approved down target uses compose stop plus a non-forced docker container rm.
- (b) Zero-access name matching is inconsistent. The overlay compose file and mk/neo4j-tailnet.mk, both containing the auth-key variable NAME, were written WITHOUT refusal. A test-file heredoc with the same NAME was refused by the zero-access pattern for that variable, probably Write-tool content vs Bash command-text scanning. The two assertions were then dropped (the steward's ruling), not rephrased.
- (c) A grep pattern tripped the gate by itself. A verification grep whose own PATTERN named the variable was refused, even though the file it checked no longer contained the name. The self-check moved to the Read tool.
- Not investigated further.
Runbook-gate lessons from 1b:
- step 4: sha256 tree identity, not du;
- step 6: a precondition that the service has at least one non-internal network, or is gateway-fronted;
- step 7: an effective-publish gate (docker port / NetworkSettings.Ports);
- step 2: "Old password and new password cannot be the same" means equal, i.e. a no-op.

OPERATOR STEPS (not done by this PR)

Auth key: mint a one-off, pre-authorised Tailscale auth key scoped to tag:neo4j. This needs a tagOwners entry for tag:neo4j in the tailnet policy. Deliver it as NEO4J_TAILNET_AUTHKEY through the secrets funnel (make -C pmoves secrets-funnel), and register NEO4J_TAILNET_AUTHKEY in the secrets manifest. Agents cannot do that last part because the manifest is zero-access to them. With TS_AUTH_ONCE=true, the key is used only for the first login; after that, the state volume carries the node identity.
Tailnet grant: allow the fleet tag to reach Neo4j, e.g. src <fleet AGInT tag> → dst tag:neo4j, ip: tcp:7687 (in pmoves/configs/tailscale-acl-policy.json, or wherever the operator manages the policy).
NEO4J_BIND: keep it at a loopback value on this node (e.g. 127.0.0.1 via the .env.local Known Road). No host publish is needed under option A, and a loopback value stays safe if a non-internal network is ever added.
Gated Neo4j recreate, BEFORE the forwarder. This is operator-approved and runs on the shared checkout after fix(neo4j): internal-only Neo4j fronted by a Tailscale forwarder on a dedicated graph front; LOAD CSV blocklist; fleet test #3201 merges. It follows the Phase 1b runbook in fix(neo4j): Phase 1 stabilise: never start a second or volumeless Neo4j; one name source (compose pin pending road) #3193, step for step:
- 4a. Pre-counts. Run the Phase 1b step-1 node and relationship count queries, authenticated as in Phase 1b step 8, and record them.
- 4b. Clean stop, verified. Run docker stop -t 60 pmoves-neo4j, then the fix(neo4j): Phase 1 stabilise: never start a second or volumeless Neo4j; one name source (compose pin pending road) #3193 Rollback A.1 log check (INFO Stopped. after the last INFO Started.). If the stop was not clean: STOP.
- 4c. Backup: the Phase 1b mechanism. Copy the stopped volume, mounted :ro, into a dated volume whose name does not start with pmoves_ (so volume-reset SERVICE=neo4j cannot match it). The -pre3201 suffix keeps the 1b backup intact.
```
docker volume create knuckles-neo4j-backup-YYYYMMDD-pre3201
docker run --rm -v pmoves_neo4j-data:/from:ro -v knuckles-neo4j-backup-YYYYMMDD-pre3201:/to busybox:1.36 sh -c 'cp -a /from/. /to/'
```
  Then verify sha256 tree identity, with both sides mounted read-only. It prints two digests per side: the file-content digest and the path-list digest. Each pair must be identical, or STOP.
```
docker run --rm -v pmoves_neo4j-data:/from:ro -v knuckles-neo4j-backup-YYYYMMDD-pre3201:/to:ro busybox:1.36 sh -c 'for d in /from /to; do cd $d; echo "$d files=$(find . -type f -exec sha256sum {} + | sort -k2 | sha256sum | cut -c1-16) tree=$(find . | sort | sha256sum | cut -c1-16)"; done'
```
- 4d. Dry run, the LITERAL compose command. Use the Phase 1b step 6 command verbatim: the same -p pmoves --project-directory "$PWD", and the same --env-file and -f lists, re-derived on the day with the print-dc one-liner from Phase 1b step 6. The subcommand is:
```
--dry-run up -d neo4j
```
  It must show ONLY Network pmoves_graph_front Creating/Created and Container pmoves-neo4j Recreate/Recreated/Starting/Started. Anything else is a STOP: another container, a volume creation, or orphan removal. Do not use make -n up-data-tier as the dry run: its nested $(MAKE) … wait-data line executes even under -n.
- 4e. LIVE: make -C pmoves up-data-tier DATA_SERVICES=neo4j.
- 4f. Checks.
  - The container is healthy and the image digest is unchanged.
  - Auth is ON: run the Phase 1b step 8 wrong-password control, which must fail for the auth reason, and confirm the compose password is accepted.
  - The post-counts equal the 4a counts.
  - A names-only docker inspect lists pmoves_graph_front.
  - cipher-api still resolves neo4j.
Forwarder bring-up:
- make -C pmoves up-neo4j-tailnet. Its preflight refuses until step 4 has attached pmoves-neo4j to pmoves_graph_front, and it runs with --no-deps, so it never touches Neo4j;
- verify neo4j-tailnet-status;
- from a fleet node, bolt to the forwarder's MagicDNS name on 7687. It must authenticate, while a non-granted source is refused. This also proves the Q2 source reasoning.

Rollback (steps 4 and 5)

Step 5 failed, or needs undoing: run make -C pmoves down-neo4j-tailnet. This stops the forwarder and removes it without force. Neo4j is untouched, and nothing else needs doing: the internal, now-empty pmoves_graph_front can remain.

Step 4 failed, or needs undoing. Re-up Neo4j from the pre-PR compose, through the same gated path:

R1. If the forwarder was started, run make -C pmoves down-neo4j-tailnet first.
R2. Materialise the pre-PR file. docker-compose.yml is the only file in the step-6 list that this PR changes, so write its pre-merge copy to scratch:
```
git -C <shared checkout> show <3201-merge-sha>^1:pmoves/docker-compose.yml > <scratch>/docker-compose.pre3201.yml
```
R3. Gated dry run. Use the same literal command as 4d, with -f <scratch>/docker-compose.pre3201.yml in place of -f docker-compose.yml. Keep --project-directory "$PWD" so relative paths resolve exactly as before. It must show ONLY Container pmoves-neo4j Recreate/Recreated/Starting/Started; anything else is a STOP. Compose does not delete a network a service merely left, so pmoves_graph_front stays: internal, and empty.
R4. LIVE. Run the same command without --dry-run. This is the one literal compose up in the runbook: no make target renders a substituted compose file.
R5. Checks. The same as 4f, except the network list must not include pmoves_graph_front.

Data damaged. That means post-counts differ from 4a, or debug.log shows store, recovery or corruption ERRORs. Nothing starts on pmoves_neo4j-data until the restore has finished. Restore from knuckles-neo4j-backup-YYYYMMDD-pre3201 using #3193 Rollback B:

announce no compose activity to the other sessions;
take the compose container down;
run the single gated restore command, which refuses while any container, running or stopped, references the volume, and exits 3 when that query itself fails;
the counts must match.

Only then run R3 and R4.

🤖 Generated with Claude Code

Docker publishes NOTHING for a container attached only to `internal: true` networks, with no error. Phase 1b of the Neo4j migration hit exactly that: the compose neo4j came up healthy on pmoves_app/bus/data, all internal, and its tailnet bind silently did not exist. The render and dry-run gates could not see it; they read the REQUESTED bindings. This test parses the Makefile's default STACK_FILES (the YAML directly, no docker or env files), merges services by name, and asserts that every published service joins at least one non-internal network. Measured fleet-wide on origin/main f9d8a82: 35 violators. Empirically, on Knuckles, 15 of 15 RUNNING violators had requested bindings and ZERO effective ones, while cipher-api, minio and presign (each also on a non-internal network) published. The 34 other than neo4j are listed in KNOWN_VIOLATORS as xfail(strict=True): recorded, not silently passed, and a fix makes the case XPASS-fail until the name is removed. A staleness test keeps the list honest. neo4j is deliberately NOT listed. This test FAILS on it at main (1 failed, 58 passed, 34 xfailed) until the compose change in this PR (it joins pmoves_external, like cipher-api) lands under its grant. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-09-27T08:00:23Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

coderabbit

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: POWERFULMOVES/PMOVES.AI/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 47973923-d931-4943-92ac-75a21d8d03fd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

kilo-code-bot · 2026-09-27T08:01:23Z

Code Review Summary

The review did not run because the selected model is no longer available.

Choose another model in Kilo Code review settings: https://app.kilo.ai/code-reviews

Previous Review Summaries (8 snapshots)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review

The review did not run because the selected model is no longer available.

Choose another model in Kilo Code review settings: https://app.kilo.ai/code-reviews

Previous review

The review did not run because the selected model is no longer available.

Choose another model in Kilo Code review settings: https://app.kilo.ai/code-reviews

Previous review

The review did not run because the selected model is no longer available.

Choose another model in Kilo Code review settings: https://app.kilo.ai/code-reviews

Previous review

The review did not run because the selected model is no longer available.

Choose another model in Kilo Code review settings: https://app.kilo.ai/code-reviews

Previous review

The review did not run because the selected model is no longer available.

Choose another model in Kilo Code review settings: https://app.kilo.ai/code-reviews

Previous review

The review did not run because the selected model is no longer available.

Choose another model in Kilo Code review settings: https://app.kilo.ai/code-reviews

Previous review

The review did not run because the selected model is no longer available.

Choose another model in Kilo Code review settings: https://app.kilo.ai/code-reviews

Previous review

The review did not run because the selected model is no longer available.

Choose another model in Kilo Code review settings: https://app.kilo.ai/code-reviews

github-actions · 2026-09-27T08:02:39Z

Fleet review: kilocode (kilo/z-ai/glm-5.3)

_{reviewer: tier 2/3 kilo-primary - model kilo/z-ai/glm-5.3 - fell back after tier 1 spark-local: not-configured}

CORRECTNESS

Diff contradicts its own title: the neo4j→pmoves_external compose hunk is absent — this diff ships only the test. At this state neo4j is in PUBLISHED but not KNOWN_VIOLATORS, so test_a_published_service_is_on_a_non_internal_network[neo4j] fails; body concedes CI is red "intended", but merging before the awaited compose PR leaves main red, and the merge-order coupling is unenforced. Either include the compose change or retitle/split the PR.
_stack() runs at import time (pmoves/tests/test_published_ports_need_a_non_internal_network.py:79): a Makefile reformat or missing stack file becomes a collection-time assert/IO error for the whole file, not a clean failure. Regex hardcodes the exact format (STACK_FILES ?=\ + tab-indented -f + \ continuations) — breaks on spaces/CRLF/reformat (loud, but brittle).
cur["ports"] += sv.get("ports") or []: long-syntax dict ports append dict keys ("target","published") into the list — detection still works by accident (truthy), but failure messages will print garbage; same for a string scalar ports.
Static-only view: NETWORKS.get(n, False) treats undeclared networks as non-internal; extends:/include:/profiles and env-interpolated ports ("${X}:80") are invisible — possible false pass/fail vs runtime; acceptable given the stated "no docker, no env files" design, but undocumented edge.
supaserch in KNOWN_VIOLATORS (and body) looks like a typo — the staleness test fails loudly if the name doesn't publish, so self-catching.
Merge semantics (ports append, networks union, network_mode last-wins) match compose multi-file merge; xfail(strict=True) + staleness test correctly pin the 34-name list (no silent pass, XPASS-fail on fix, stale-detect on removal).
No shell code, no YAML edits, no anchors touched; single test file — no scope creep.

SECURITY / TOPOLOGY

LEAK: docstring "Measured on Knuckles 2026-09-27" (line 16) bakes an internal fleet hostname into a public-repo test file; the same host name and "tailnet" wording repeat in the title/body (public PR metadata). No IPs (tailnet/LAN/bridge gateway), no host-port mappings, no secrets/tokens/credentials in the diff; pmoves_* network names and service names are already public repo content. Otherwise clean.

VERDICT: REQUEST_CHANGES — the advertised compose fix is missing from the diff (test is red on neo4j until a separate, unenforced companion PR lands), and an internal machine name is hardcoded into public test prose.

reviewer chain

tier	reviewer	model	outcome	detail
1	`spark-local`	-	not-configured	SPARK_REVIEW_URL is not set
2	`kilo-primary`	`kilo/z-ai/glm-5.3`	ok	review produced
3	`kilo-alternate`	-	not-reached

_ lane: fleet-review chain (self-hosted kvm4) - spark-local (when online) -> kilo-primary -> kilo-alternate _

…lish (#3201) Under KNOWN_ROAD compose:pr:3201, a file grant written by the operator. Phase 1b step 7: the compose neo4j came up healthy but published NOTHING. pmoves_app, pmoves_bus and pmoves_data are all internal:true, and Docker does not publish ports for a container attached only to internal networks. cipher-api publishes because it is ALSO on pmoves_external. - docker-compose.yml (source): services.neo4j adds pmoves_external, with NO alias. Measured: every Neo4j consumer already shares app/bus/data with it, and cipher-api carries no alias there either. - The networks injector was run directly, not `make compose-networks`. It added pmoves_external to neo4j's PMOVES_NETWORKS. - docker-compose.core.yml was regenerated by `make compose-split`. Checks: - compose-networks-check: in sync (109 services); - test_published_ports_need_a_non_internal_network: the neo4j case now PASSES; the 34 known violators still xfail; - with bind passthrough + safety + no-bare-compose: 134 passed, 34 xfailed. Rendered (read-only; the operator's real NEO4J_BIND carried unprinted): - networks: app/bus/data with the neo4j alias, plus pmoves_external (null); - external is internal=false; - ports 7474 and 7687 on the TAILNET address; - container_name pmoves-neo4j; image at the 5.26.30 digest; - volume pmoves_neo4j-data. No recreate here. That is a separate operator-approved step with its own dry run and effective-publish gate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-09-27T08:04:45Z

Docker Hardening Validation

Hardening Validation Report

Validated: Sun Sep 27 08:04:43 UTC 2026

Services Checked

PMOVES.AI compose hardening ratchet

[INFO] Checking: /home/runner/work/PMOVES.AI/PMOVES.AI/pmoves/docker-compose.hardened.yml
[INFO] Merged onto (base-first):
/home/runner/work/PMOVES.AI/PMOVES.AI/pmoves/docker-compose.yml
/home/runner/work/PMOVES.AI/PMOVES.AI/pmoves/docker-compose.comfyui.yml
/home/runner/work/PMOVES.AI/PMOVES.AI/pmoves/docker-compose.ultimate-tts-studio.yml
/home/runner/work/PMOVES.AI/PMOVES.AI/pmoves/docker-compose.archon.submodule.yml
/home/runner/work/PMOVES.AI/PMOVES.AI/pmoves/docker-compose.apps.yml
/home/runner/work/PMOVES.AI/PMOVES.AI/pmoves/docker-compose.activepieces.yml

[INFO] Validating: agent-zero
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: archon
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: channel-monitor
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: comfy-watcher
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: deepresearch
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: extract-worker
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: ffmpeg-whisper
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: grayjay-plugin-host
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: hi-rag-gateway-gpu
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: hi-rag-gateway-v2
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: hi-rag-gateway-v2-gpu
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: invidious-companion-proxy
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: jellyfin-bridge
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: langextract
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: media-audio
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: media-video
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: mesh-agent
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: nats-echo-req
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: nats-echo-res
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: notebook-sync
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: p7-room-orchestrator
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: pdf-ingest
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: pmoves-yt
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: presign
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: publisher-discord
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: render-webhook
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: retrieval-eval
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

[INFO] Validating: supaserch
[PASS] user: user: 65532:65532
[PASS] read_only: read_only: true
[PASS] cap_drop: cap_drop: [ALL]
[PASS] no_new_privileges: security_opt: no-new-privileges:true
[PASS] resource_limits: deploy.resources.limits: ['cpus', 'memory']

===================================
Summary: 28 services x 5 properties = 140 evaluated; 140 passed + 0 findings = 140
Findings: 0 (0 baselined, 0 new)

github-actions · 2026-09-27T08:06:16Z

Fleet review: kilocode (kilo/z-ai/glm-5.3)

_{reviewer: tier 2/3 kilo-primary - model kilo/z-ai/glm-5.3 - fell back after tier 1 spark-local: not-configured}

CORRECTNESS

Core mechanism is right: pmoves_external: (null) under service networks is valid compose and attaching to a non-internal network is what makes publishing take effect; hunks in docker-compose.yml and its split artifact docker-compose.core.yml are identical. Since core is generated, confirm the split regen byte-reproduces these edits (claimed in body, not provable from diff).
Empty-var fail-open now activated: ports: ${NEO4J_BIND:-0.0.0.0}:... was inert on main (internal-only nets never published); this PR makes it live. If NEO4J_BIND is unset/empty on any runner/host doing a real up, ports publish on 0.0.0.0 (all interfaces). Consider a fail-safe guard in a gate or a safer default.
Network-surface side effect: aliases or not, compose DNS resolves neo4j to every other service on pmoves_external — the body only measured consumers via app/bus/data. Auth is ON per body, but the added adjacency should be a conscious call.
Test parser is brittle: ^STACK_FILES \?= \ regex is tab-anchored, ?=-only; any Makefile reformat trips the assert at import/collection, failing the whole module (loud by design, but noisy CI).
_all_internal hardcodes the compose "default" network as non-internal and short-circuits if "default" is explicitly listed — if default is ever defined internal: true, silent false negative. Also last-file-wins on network defs across stack files only approximates compose merge; port append overstates it too. Neither affects this rule today.
CI edges: module-top import yaml + import-time _stack() → PyYAML (and pytest) must be in the test runner's deps; ImportError/collection error, not per-test failure.
xfail(strict=True) + staleness test is the right pattern (XPASS catches fixed violators; renames shrink the list). Body's claim "this PR's CI will show the one neo4j failure" is wrong — the fix ships in the same PR, so CI here should be green.

SECURITY / TOPOLOGY

Leak: hostname "Knuckles" hardcoded in the new test's docstring (test_published_ports_need_a_non_internal_network.py:10–12: "Measured on Knuckles 2026-09-27 against running containers…"), plus live operational state ("15 of 15 running"). Public repo — scrub to a neutral phrase ("measured on a fleet host").
Borderline: compose comments say NEO4J_BIND is "(the tailnet address)" — names the VPN overlay and the bind design; no literal IP/host. Suggest softening to "the private bind address".
The 0.0.0.0 fallback (above) doubles as an exposure issue.
Otherwise clean: no IPs, no bridge gateway addrs, no credentials/tokens/secrets; ports 7474/7687 already in-file and standard; the 34 KNOWN_VIOLATORS names are derived from the repo's own public compose files. No instruction smuggling in the diff; nothing asked the reviewer to execute.

VERDICT: REQUEST_CHANGES — the "Knuckles" hostname/operational detail must be scrubbed from the public test docstring, and the now-live 0.0.0.0 default for NEO4J_BIND needs a fail-safe.

reviewer chain

tier	reviewer	model	outcome	detail
1	`spark-local`	-	not-configured	SPARK_REVIEW_URL is not set
2	`kilo-primary`	`kilo/z-ai/glm-5.3`	ok	review produced
3	`kilo-alternate`	-	not-reached

_ lane: fleet-review chain (self-hosted kvm4) - spark-local (when online) -> kilo-primary -> kilo-alternate _

POWERFULMOVES

Independent review (Control Body, B850 steward), head reviewed `21526bb`: request changes (0 P1, 2 P2)

The compose change is clean. Both files show zero top-level diffs, and exactly one service (neo4j) differs. It gains pmoves_external plus the matching PMOVES_NETWORKS entry. Ports, image digest and volumes are byte-identical to main, and the regenerated core.yml mirrors the source. The new test gives 59 passed, 34 xfailed; it is pure YAML parsing with no subprocess or docker.

P2-A, contract correctness: the test takes external networks' `internal` flag on trust

An external: true network's internal flag lives wherever docker network create ran, not in the YAML. So the assertion that pmoves_external is non-internal is vacuously true.

53 passing services pass ONLY via pmoves_external, including neo4j and cipher-api. supabase-db passes only via pmoves_db_egress.
Today every sanctioned create site is non-internal, so today's verdicts are right. A future --internal at any create site would still turn the guard green on exactly the failure it exists to catch.
Fix: assert structurally that the Makefile's create lines for these external networks carry no --internal, or keep an explicit table of external-network flags checked against those sites.

P2-B, defense in depth: joining pmoves_external gives Neo4j outbound egress

app, bus and data are internal: true, so Neo4j had no route out. pmoves_external is a normal NAT'd bridge, so any client holding the password could make Neo4j fetch arbitrary URLs through LOAD CSV (or APOC load procedures, if present). That includes the host gateway and host-published ports: an SSRF and exfiltration channel. cipher-api already has this egress.

Operator decision: keep pmoves_external for publishing, and restrict Neo4j's outbound URL loading in this PR. The setting must be verified for Neo4j 5.26 Community, and the PR must show LOAD CSV from a URL being refused.

In-network reach added: in STACK_FILES, only pmoves-ollama and supabase-gotrue newly share a network with neo4j. In other compose files, if deployed: chit-tour, persona-room and traefik. Anything attached to pmoves_external by hand also gains reach.

P3

The comment "No alias here" is misleading: compose gives every container its service name and container_name as DNS names on every network it joins.
Network keys are not resolved to their name:. For example comfyui's api_tier maps to the internal pmoves_api, which is masked today.
Only STACK_FILES is scanned. Overlays using !reset or !override tags don't safe_load. Say both in the docstring.

Operator decision: keep pmoves_external, and restrict Neo4j's outbound URL loading in this PR. On a non-internal network, a Cypher `LOAD CSV FROM 'http(s)://…'` could otherwise make Neo4j fetch from anywhere it can route to. - NEO4J_internal_dbms_cypher__ip__blocklist=0.0.0.0/0,::/0 on the neo4j service (docker-compose.yml; core overlay regenerated by compose-split). - Verified on the pinned 5.26.30 Community image, with throwaway containers only; the live container was not touched: - strict validation RECOGNISES the key, while a bogus key is rejected; - on a private --internal bridge WITHOUT it, LOAD CSV of http://127.0.0.1:1/x fails with a connection error ("Couldn't load the external resource"); - WITH it, http and https IP literals AND a resolvable hostname fail by POLICY: "access to … is blocked via the configuration property internal.dbms.cypher_ip_blocklist"; - re-proved with the service's full rendered environment (24 keys), whose values were passed via the docker CLI's env, never argv or a file. - `internal.*` means unsupported by Neo4j; the digest pin keeps it stable. (--network none could not be used: Neo4j 5.26 exits immediately with code 3.) Also P3: the pmoves_external comment is corrected. Compose registers the service name `neo4j` (and container_name) on every network the service joins, so no explicit alias is needed there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-09-27T08:21:41Z

Docker Hardening Validation

Hardening Validation Report

Validated: Sun Sep 27 08:21:39 UTC 2026