chore: sync submodules (Agent-Zero, BoTZ, ToKenism-Multi) - #409
Closed
POWERFULMOVES wants to merge 3 commits into
Closed
POWERFULMOVES wants to merge 3 commits into
POWERFULMOVES wants to merge 3 commits into
Conversation
PMOVES-Agent-Zero (5cbda82): - Add TensorZero gateway provider configuration - Chat and embedding providers at http://tensorzero-gateway:3000/v1 PMOVES-BoTZ (b39e3b4): - Add agent SDK integration for Claude Agent SDK - Add MCP bridge for external service communication - Add glancer feature for quick data inspection - Fix circular imports in AgentGym RL trainer - Add gateway docker-compose and N8N MCP integration PMOVES-ToKenism-Multi (9981589): - Update contract schemas (audio, entities, persona) - Update UI components (charts, simulation results) - Add skeleton UI component - Update integration submodules (DoX, Firefly-iii) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
…mentation
This commit implements the security-based tier architecture for PMOVES.AI,
isolating secrets by service category and implementing network segmentation.
## Changes
### 6-Tier Environment Architecture
- env.tier-data: Infrastructure credentials (postgres, qdrant, neo4j, meilisearch, minio, nats)
- env.tier-api: Data access APIs (postgrest, presign, hi-rag-gateway)
- env.tier-llm: ALL external LLM API keys (security fence)
- env.tier-worker: Background workers
- env.tier-media: Media processing (pmoves-yt, ffmpeg-whisper, media-video, media-audio)
- env.tier-agent: Agent orchestration (agent-zero, archon, supaserch, deepresearch)
### 5-Tier Network Architecture
- pmoves_data (172.30.4.0/24): Data stores - postgres, qdrant, neo4j, meilisearch, minio
- pmoves_api (172.30.1.0/24): Public-facing services - postgrest, tensorzero-ui, api gateways
- pmoves_app (172.30.2.0/24): Application services - hi-rag, agents, workers
- pmoves_bus (172.30.3.0/24): Message bus - NATS, JetStream
- pmoves_monitoring (172.30.5.0/24): Observability - prometheus, grafana, loki
### Docker Compose Updates
- Add YAML anchors for tier-based env file loading
- Add 5-tier network definitions with subnet allocation
- Update deepresearch service as reference implementation
- Remove compose-time ${VAR} expansion for secrets (use env_file instead)
### Helper Scripts
- tools/fix_tier_manifest.py: Add tier targets to CHIT manifest
- tools/dedupe_tier_env.py: Remove duplicate entries from tier env files
- tools/merge_shared_to_tiers.py: Merge env.shared values into tier files
### CHIT Manifest Updates
- Add tier env file targets to all 66 secret entries
- Enables runtime secret decoding to tier-specific files
## Security Posture
- Move from shell env vars to CHIT secrets encoding
- Enforce network segmentation between tiers
- Only tier-llm has external LLM API keys (security fence)
- Secrets loaded at container runtime, not compose-time
## Note
Tier env files are gitignored and populated at runtime via CHIT.
The committed env.tier-* files are example templates only.
Related: PR #412 (CHIT), PR #413 (Security Hardening), PR #415 (Infrastructure)
…twork segmentation This commit implements the comprehensive tier architecture for improved security and organization of PMOVES.AI infrastructure. ## Changes ### 6-Tier Environment Architecture (Security-Based) - tier-data: Infrastructure credentials (postgres, qdrant, neo4j, meilisearch, minio, nats) - tier-api: Data access APIs (postgrest, presign, hi-rag-gateway) - tier-llm: ALL external LLM API keys (tensorzero-gateway, tensorzero-ui, ollama) - tier-worker: Background workers (extract-worker, langextract, pdf-ingest, notebook-sync) - tier-media: Media processing (pmoves-yt, ffmpeg-whisper, media-video, media-audio) - tier-agent: Agent orchestration (agent-zero, archon, supaserch, deepresearch) ### 5-Tier Docker Network Architecture - pmoves_api (172.30.1.0/24): Public-facing services - pmoves_app (172.30.2.0/24): Application services - pmoves_bus (172.30.3.0/24): NATS message bus - pmoves_data (172.30.4.0/24): Data stores - pmoves_monitoring (172.30.5.0/24): Observability ### Security Improvements - Compose-time secret expansion removed (now runtime from tier env files) - YAML anchors for reusable tier env configurations - Network segmentation for inter-tier communication control - tier-llm is the ONLY tier with external LLM API keys ### Services Updated (45 core services) All core services now use `<<: *env-tier-*` anchors and assigned to correct network tiers. External/integration services (Invidious, Grayjay, Cloudflare) retain existing env_file pattern. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Owner
Author
|
Superseded by PR #433 (comprehensive submodule sync included) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cherry-picks submodule updates from main to hardened branch.
Changes
Context
Part of targeted PR series to sync all main branch features to
PMOVES.AI-Edition-Hardened.Related
/home/pmoves/.claude/plans/ethereal-prancing-naur.mdd8d46bb5🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.5 noreply@anthropic.com