Skip to content

feat(ffmpeg-whisper): add provider selection and gpu auto-detect - #44

Merged
POWERFULMOVES merged 1 commit into
mainfrom
codex/extend-ffmpeg-whisper-for-gpu-support
Sep 20, 2025
Merged

POWERFULMOVES merged 1 commit into
mainfrom
codex/extend-ffmpeg-whisper-for-gpu-support

Conversation

@POWERFULMOVES

@POWERFULMOVES POWERFULMOVES commented Sep 20, 2025

Copy link
Copy Markdown
Owner

Summary

  • add multi-provider transcription pipeline with GPU detection, faster-whisper default, and optional Qwen2 Audio support
  • allow /yt/transcript and /yt/ingest to forward the selected transcription provider and document the new options
  • extend ffmpeg-whisper unit tests to cover provider forwarding and error handling

Testing

  • pytest pmoves/tests/test_ffmpeg_whisper.py

https://chatgpt.com/codex/tasks/task_b_68ce2ec34a9c8324ab794101b7d74e80

Summary by CodeRabbit

  • New Features

    • Choose the transcription provider via a request parameter (default: faster-whisper; options: whisper, qwen2-audio). Provider flows from ingest to transcript.
    • Transcription responses now include provider, device, and model details.
  • Improvements

    • Auto-detects CUDA GPUs and selects optimal compute type; falls back to CPU INT8 when needed.
    • Configurable audio processing timeout.
  • Documentation

    • Expanded guidance on provider selection, defaults, GPU/diarization recommendations, and configuration options.
  • Tests

    • Added coverage for provider overrides and invalid provider errors.
  • Chores

    • Added dependencies to support new providers.

@coderabbitai

coderabbitai Bot commented Sep 20, 2025

Copy link
Copy Markdown
Contributor

Walkthrough

Multi-provider transcription support is added across docs, service code, and tests. The ffmpeg-whisper server now routes to faster-whisper, whisper, or qwen2-audio, with device/compute-type detection, configurable timeouts, and new dependencies. pmoves-yt propagates an optional provider field. Tests cover provider override, invalid provider handling, and payload propagation.

Changes

Cohort / File(s) Summary
Docs: transcript provider semantics
pmoves/docs/PMOVES.yt/PMOVES_YT.md
Documents provider parameter for transcript/ingest, default/provider options (faster-whisper, whisper, qwen2-audio), CUDA auto-detect, CPU fallback, and expanded configuration notes.
Dependencies for new backends
pmoves/services/ffmpeg-whisper/requirements.txt
Adds faster-whisper==1.0.2, transformers==4.44.2, sentencepiece==0.2.0 for new provider support.
ffmpeg-whisper: multi-provider refactor
pmoves/services/ffmpeg-whisper/server.py
Introduces provider routing, device/compute-type detection, configurable timeout, new model loaders/runners for faster-whisper and qwen2-audio, revised ffmpeg extraction, iterable segment handling, health annotations, and error guards for unsupported providers. Updates app metadata and response fields.
YouTube ingest/transcript provider propagation
pmoves/services/pmoves-yt/yt.py
Extends payloads to include optional provider; restructures yt_ingest to build and pass a transcript payload with provider when present.
Tests for provider flow and validation
pmoves/tests/test_ffmpeg_whisper.py
Adds tests for provider override and invalid provider (400). Updates fallback test to assert provider propagation in forwarded payload and response.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor U as Client
  participant YT as pmoves-yt
  participant FW as ffmpeg-whisper
  participant FWf as Provider Runner

  U->>YT: POST /yt/transcript {language, whisper_model?, provider?}
  YT->>FW: POST /transcribe {language, model, provider?}
  FW->>FW: Validate provider ∈ {faster-whisper, whisper, qwen2-audio}
  alt Invalid provider
    FW-->>U: 400 {"error":"unsupported provider"}
  else Valid provider
    FW->>FW: Select device (cuda/cpu) + compute_type
    FW->>FWf: Load model (cached) for provider
    FWf-->>FW: Model ready
    FW->>FWf: Transcribe(audio)
    FWf-->>FW: {segments, text, meta}
    FW-->>U: 200 {provider, model, device, segments}
  end
Loading
sequenceDiagram
  autonumber
  actor U as Client
  participant YT as pmoves-yt (ingest)
  participant YT2 as pmoves-yt (transcript)
  participant FW as ffmpeg-whisper

  U->>YT: POST /yt/ingest {video_id, namespace, ..., provider?}
  YT->>YT2: Build tr_payload (include provider if present)
  YT2->>FW: POST /transcribe tr_payload
  FW-->>YT2: Transcript result
  YT2-->>YT: Pass-through result
  YT-->>U: Response
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Poem

I twitched my ears at choices three,
Whisper winds, Qwen’s sea, and faster-whisper’s spree.
GPUs hum, CPUs sigh—still, captions bloom for me.
I nibble logs, hop through tests, provider set with glee.
Transcript trails of carrot tales—ship it, bun-degree! 🥕🐇


📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Free

📥 Commits

Reviewing files that changed from the base of the PR and between 2689925 and 5160f8f.

📒 Files selected for processing (5)
  • pmoves/docs/PMOVES.yt/PMOVES_YT.md (2 hunks)
  • pmoves/services/ffmpeg-whisper/requirements.txt (1 hunks)
  • pmoves/services/ffmpeg-whisper/server.py (9 hunks)
  • pmoves/services/pmoves-yt/yt.py (2 hunks)
  • pmoves/tests/test_ffmpeg_whisper.py (2 hunks)

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

Comment @coderabbitai help to get the list of available commands and usage tips.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Codex Review: Here are some suggestions.

Reply with @codex fix comments to fix any unresolved comments.

About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".

Comment on lines +394 to 402
provider = (body.get("provider") or DEFAULT_PROVIDER).lower()
if provider not in SUPPORTED_PROVIDERS:
raise HTTPException(400, f"provider must be one of {', '.join(SUPPORTED_PROVIDERS)}")

language = body.get("language")
model_name = body.get("whisper_model") or os.environ.get("WHISPER_MODEL", "large-v3")
diarize = body.get("diarize", True)
model_name = body.get("whisper_model") or DEFAULT_WHISPER_MODEL
diarize = bool(body.get("diarize", True))
out_audio_key = body.get("out_audio_key")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P1] Use Qwen2 default model when provider is qwen2-audio

Selecting provider="qwen2-audio" without explicitly passing whisper_model currently uses DEFAULT_WHISPER_MODEL (large-v3) because model_name is computed before the provider switch. _transcribe_with_provider sees a non-empty model name and forwards the invalid Whisper identifier to _run_qwen2_audio, which makes transformers.AutoProcessor.from_pretrained("large-v3") raise and the endpoint returns HTTP 500. The environment variable QWEN2_AUDIO_MODEL is never applied unless the caller overrides the model manually. Defaulting model_name based on the chosen provider (Qwen vs Whisper) would avoid the failure and honour the documented behaviour that Qwen2 Audio is supported out of the box.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@codex fix comments

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

  • Ensured the /transcribe endpoint defaults to QWEN2_AUDIO_MODEL whenever provider="qwen2-audio" is selected without an explicit whisper_model, preventing invalid Whisper model IDs from being forwarded. pmoves/services/ffmpeg-whisper/server.pyL398-L403

Testing

  • ⚠️ pytest pmoves/tests/test_ffmpeg_whisper.py (fails: ModuleNotFoundError: No module named 'fastapi')

View task →

@POWERFULMOVES
POWERFULMOVES merged commit c475f33 into main Sep 20, 2025
1 of 3 checks passed
POWERFULMOVES added a commit that referenced this pull request Jan 18, 2026
…-for-gpu-support

feat(ffmpeg-whisper): add provider selection and gpu auto-detect
POWERFULMOVES pushed a commit that referenced this pull request Mar 1, 2026
…nches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Mar 1, 2026
* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* feat(chit): add CHIT-signed Graphiti trail tooling

Add provenance signing for agent trail entries using CHIT HMAC:
- sign_trail.py: CLI tool to create and sign trail entries
- PostToolUse hook for automatic signing on trail file writes
- /chit:sign-trail skill command for interactive use
- Preflight check for dotnet SDK (required by CHIT crypto)
- CLAUDE.md documentation for trail signing workflow
- Settings.json hook registration

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Mar 1, 2026
…ng (#740)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* fix(compose): networking, healthchecks, and env hardening

- Fix external compose service networking and port bindings
- Add missing healthcheck configurations to n8n compose
- Update env.shared.example with new required variables
- Harden docker-compose.yml service definitions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(services): auth, healthchecks, and dependency updates

- Agent Zero: Dockerfile non-root hardening, MCP server auth fixes
- service_registry: improve service discovery and health reporting
- evo-controller: add healthcheck endpoint and startup guards
- flute-gateway: fix import path
- render-webhook: update deps, add input validation
- retrieval-eval: add health and metrics endpoints

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(sql): RLS policies, model registry seeds, and supabase config

- Tighten RLS policies for public_init and geometry tables
- Update model registry seed data with current model versions
- Add studio board RLS migration for service_role access
- Add supabase .gitignore and config.toml for local dev

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(tooling): Makefile targets, smoke tests, and operational scripts

- Makefile: add sign-trail, volume-reset, and infra targets
- smoke.ps1: expand service coverage and timeout handling
- with-env.sh: support multi-tier env loading
- bringup_with_ui.sh: improve startup sequencing
- chit_security.py: fix HMAC signing edge cases
- retro_flightcheck.py: add new validation checks
- capture_evidence.sh: new script for PR evidence collection
- AI_GRAPHITI_PROTOCOL.md: document agent trail protocol
- pr-monitor.md: update skill command definition

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(submodules): update BoTZ-gateway and Cipher pointers

Update submodule pointers to latest reviewed commits from
2026-03-01 security sweep.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(security): 2026-03-01 submodule security reviews and agent notes

- 5 submodule security reviews (Agent Zero, BoTZ, DoX, ToKenism, transcribe-and-fetch)
- Security queue tracker and sitrep JSON
- AGNOTE4482 FlOO$ and Flute agent notes
- CHIT review-sweep skill command and post-review hook

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Mar 2, 2026
* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* chore: add gitignore for runtime data, DAO docs, and env backups

Add entries to prevent accidental commits of:
- pmoves/jellyfin-ai/ (runtime config/data from Jellyfin AI stack)
- pmoves/pmoves/PR_EVIDENCE/ (smoke test evidence artifacts)
- pmoves/docs/logs/pr_monitor_* (runtime PR monitor logs)
- CATACLYSM_STUDIOS_INC/PMOVES DAO/ (managed separately)
- pmoves/env.jellyfin-ai, pmoves/env.supa.runtime.bak.* (env backups)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Mar 2, 2026
…ss check (#741)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* docs(agents): overlay TAC model/persona readiness into graphiti protocol

* docs(agents): correct TAC status wording for local staged artifacts

* feat(models): reconcile model registry with Anthropic, TTS, and expanded service mappings

Add Anthropic provider (claude-sonnet-4-5, claude-opus-4-5, claude-haiku-4-5)
as persona backbone. Add TTS provider with 6 engines from Ultimate TTS Studio.
Add 5 missing Ollama models from gpu-models.yaml (qwen3:32b, qwen3:1.7b,
llama3.2:3b, codellama:7b, deepseek-coder:6.7b). Fix VRAM values to match
gpu-models.yaml truth (qwen3:8b: 8000→6144, nomic-embed-text: 1000→512).
Expand service-model mappings from 4 to 15+ services including hirag, archon,
coding, orchestrator, vl_sentinel, tts, extract_worker, and more.

Covers TAC branches B + C.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(personas): integrate 8 standard persona seeds into initdb pipeline

Copy persona seeds from pmoves/db/v5_14_seed_standard_personas.sql into the
active Supabase initdb pipeline as 17_persona_seed.sql. Personas reference
claude-sonnet-4-5 (Developer/Creator/Analyst/Tester), claude-opus-4-5
(Researcher/Coordinator/Security), and claude-haiku-4-5 (Archivist).

Sequenced after model registry (12) to ensure model_preference references
are valid. Preserves ON CONFLICT (name, version) idempotency.

Covers TAC branch A.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(gpu): sync gpu-models.yaml with SQL model registry

Add 10 models missing from gpu-models.yaml that exist in SQL and consume
local GPU VRAM: qwen2.5:32b, qwen2.5:14b, qwen2-vl:7b, qwen3-reranker:4b,
nemotron-mini, llama3.1, qwen3-embedding:4b/8b, embeddinggemma:300m.
GPU Orchestrator needs these entries for VRAM scheduling on RTX 5090.

Covers TAC branch D.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(db): add persona-model resolution view for runtime agent identity lookup

Create persona_model_resolution view joining persona → model → provider
for runtime resolution of which API endpoint to call for each persona.
Also adds active_persona_summary convenience view. Grants SELECT to
PostgREST anon/auth roles.

Covers TAC branch F.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(ops): add model-readiness check and Make target

Create model_readiness_check.py that validates:
- Supabase model_providers populated with ≥8 active providers
- Supabase personas table populated with ≥8 rows
- Ollama has expected local models pulled
- TensorZero gateway operational
- persona_model_resolution view returns valid data

Add 'make model-readiness' target and wire into verify-all chain.

Covers TAC branch E.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(db): harden model/persona seed determinism and view security

* fix(ops): enforce readiness gate and close TAC doc drift

* fix(sql): harden studio_board RLS policy for service_role only

* fix(db): reconcile model provider upserts and enforce studio policy replacement

- update model_providers upserts to refresh mutable fields (type/api_base/api_key_env_var/description/active/metadata)\n- always replace studio_board_service_role_all policy in migration for upgrade parity\n- clarify persona resolution grant comment to match PostgREST role grants\n- add readiness-check type hints/constants and align TAC verify steps

* fix(security): tighten studio_board revokes and TensorZero reachability checks

* fix(readiness): enforce registry thresholds and harden studio_board revokes

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
POWERFULMOVES added a commit that referenced this pull request Mar 2, 2026
…rd path (#744)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* fix(security): auth-gate agent-zero A2A discovery endpoint

* fix(security): HMAC CHIT proofs + A2A discovery auth audit + dotnet preflight (#736)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* chore(env): require dotnet sdk in bootstrap preflight

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>

* chore(deps): bump multer (#735)

Bumps the npm_and_yarn group with 1 update in the /CATACLYSM_STUDIOS_INC/L4-PLATFORM/provisions/docker-stacks/jellyfin-ai/api-gateway directory: [multer](https://github.com/expressjs/multer).


Updates `multer` from 2.0.2 to 2.1.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.0.2...v2.1.0)

---
updated-dependencies:
- dependency-name: multer
  dependency-version: 2.1.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(chit): correct FlOO$ PYTHONPATH for pr-monitor pipeline

* feat(chit): CHIT-signed Graphiti trail + skill pairing awareness (#739)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* feat(chit): add CHIT-signed Graphiti trail tooling

Add provenance signing for agent trail entries using CHIT HMAC:
- sign_trail.py: CLI tool to create and sign trail entries
- PostToolUse hook for automatic signing on trail file writes
- /chit:sign-trail skill command for interactive use
- Preflight check for dotnet SDK (required by CHIT crypto)
- CLAUDE.md documentation for trail signing workflow
- Settings.json hook registration

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* fix(runtime): service networking, healthchecks, SQL, Makefile hardening (#740)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* fix(compose): networking, healthchecks, and env hardening

- Fix external compose service networking and port bindings
- Add missing healthcheck configurations to n8n compose
- Update env.shared.example with new required variables
- Harden docker-compose.yml service definitions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(services): auth, healthchecks, and dependency updates

- Agent Zero: Dockerfile non-root hardening, MCP server auth fixes
- service_registry: improve service discovery and health reporting
- evo-controller: add healthcheck endpoint and startup guards
- flute-gateway: fix import path
- render-webhook: update deps, add input validation
- retrieval-eval: add health and metrics endpoints

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(sql): RLS policies, model registry seeds, and supabase config

- Tighten RLS policies for public_init and geometry tables
- Update model registry seed data with current model versions
- Add studio board RLS migration for service_role access
- Add supabase .gitignore and config.toml for local dev

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(tooling): Makefile targets, smoke tests, and operational scripts

- Makefile: add sign-trail, volume-reset, and infra targets
- smoke.ps1: expand service coverage and timeout handling
- with-env.sh: support multi-tier env loading
- bringup_with_ui.sh: improve startup sequencing
- chit_security.py: fix HMAC signing edge cases
- retro_flightcheck.py: add new validation checks
- capture_evidence.sh: new script for PR evidence collection
- AI_GRAPHITI_PROTOCOL.md: document agent trail protocol
- pr-monitor.md: update skill command definition

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(submodules): update BoTZ-gateway and Cipher pointers

Update submodule pointers to latest reviewed commits from
2026-03-01 security sweep.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(security): 2026-03-01 submodule security reviews and agent notes

- 5 submodule security reviews (Agent Zero, BoTZ, DoX, ToKenism, transcribe-and-fetch)
- Security queue tracker and sitrep JSON
- AGNOTE4482 FlOO$ and Flute agent notes
- CHIT review-sweep skill command and post-review hook

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* docs(agents): overlay TAC model/persona readiness into graphiti protocol

* docs(agents): correct TAC status wording for local staged artifacts

* feat(models): reconcile model registry with Anthropic, TTS, and expanded service mappings

Add Anthropic provider (claude-sonnet-4-5, claude-opus-4-5, claude-haiku-4-5)
as persona backbone. Add TTS provider with 6 engines from Ultimate TTS Studio.
Add 5 missing Ollama models from gpu-models.yaml (qwen3:32b, qwen3:1.7b,
llama3.2:3b, codellama:7b, deepseek-coder:6.7b). Fix VRAM values to match
gpu-models.yaml truth (qwen3:8b: 8000→6144, nomic-embed-text: 1000→512).
Expand service-model mappings from 4 to 15+ services including hirag, archon,
coding, orchestrator, vl_sentinel, tts, extract_worker, and more.

Covers TAC branches B + C.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(personas): integrate 8 standard persona seeds into initdb pipeline

Copy persona seeds from pmoves/db/v5_14_seed_standard_personas.sql into the
active Supabase initdb pipeline as 17_persona_seed.sql. Personas reference
claude-sonnet-4-5 (Developer/Creator/Analyst/Tester), claude-opus-4-5
(Researcher/Coordinator/Security), and claude-haiku-4-5 (Archivist).

Sequenced after model registry (12) to ensure model_preference references
are valid. Preserves ON CONFLICT (name, version) idempotency.

Covers TAC branch A.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(gpu): sync gpu-models.yaml with SQL model registry

Add 10 models missing from gpu-models.yaml that exist in SQL and consume
local GPU VRAM: qwen2.5:32b, qwen2.5:14b, qwen2-vl:7b, qwen3-reranker:4b,
nemotron-mini, llama3.1, qwen3-embedding:4b/8b, embeddinggemma:300m.
GPU Orchestrator needs these entries for VRAM scheduling on RTX 5090.

Covers TAC branch D.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(db): add persona-model resolution view for runtime agent identity lookup

Create persona_model_resolution view joining persona → model → provider
for runtime resolution of which API endpoint to call for each persona.
Also adds active_persona_summary convenience view. Grants SELECT to
PostgREST anon/auth roles.

Covers TAC branch F.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(ops): add model-readiness check and Make target

Create model_readiness_check.py that validates:
- Supabase model_providers populated with ≥8 active providers
- Supabase personas table populated with ≥8 rows
- Ollama has expected local models pulled
- TensorZero gateway operational
- persona_model_resolution view returns valid data

Add 'make model-readiness' target and wire into verify-all chain.

Covers TAC branch E.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(db): harden model/persona seed determinism and view security

* fix(ops): enforce readiness gate and close TAC doc drift

* fix(a2a): harden discovery/task auth and add agent-card endpoint

* fix(sql): harden studio_board RLS policy for service_role only

* fix(chat-relay): lazy-load supabase client to avoid path shadow in tests

* fix(ci): avoid hard failures in compose validation and yt docs tests

* fix(pmoves-yt): make boto3 optional at import time for test collection

* fix(pmoves-yt): stub tenacity when unavailable in CI test env

* chore(submodule): bump PMOVES-Agent-Zero for canonical agent-card parity

* chore(pr-scope): drop transcribe-and-fetch and cipher gitlink bumps from #744

* fix(a2a): address review blockers — RLS predicate, fail-closed key gate, discovery auth

B-1: studio_board RLS policy now restricts to service_role instead of using(true)
B-2: model-registry SUPABASE_SERVICE_KEY uses :? (fail-closed) instead of :- (empty)
B-3: discover_agents endpoint uses _require_discovery_auth instead of _require_task_auth

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
POWERFULMOVES added a commit that referenced this pull request Mar 2, 2026
* chore(submodules): bump transcribe-and-fetch + cipher for A2A parity (#745)

* chore(submodules): bump transcribe-and-fetch and cipher for a2a auth parity

* chore(submodules): bump transcribe-and-fetch and cipher to merge-ready A2A heads

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>

* fix(a2a): secure discovery/task APIs and align with upstream agent-card path (#744)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* fix(security): auth-gate agent-zero A2A discovery endpoint

* fix(security): HMAC CHIT proofs + A2A discovery auth audit + dotnet preflight (#736)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* chore(env): require dotnet sdk in bootstrap preflight

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>

* chore(deps): bump multer (#735)

Bumps the npm_and_yarn group with 1 update in the /CATACLYSM_STUDIOS_INC/L4-PLATFORM/provisions/docker-stacks/jellyfin-ai/api-gateway directory: [multer](https://github.com/expressjs/multer).


Updates `multer` from 2.0.2 to 2.1.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.0.2...v2.1.0)

---
updated-dependencies:
- dependency-name: multer
  dependency-version: 2.1.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(chit): correct FlOO$ PYTHONPATH for pr-monitor pipeline

* feat(chit): CHIT-signed Graphiti trail + skill pairing awareness (#739)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* feat(chit): add CHIT-signed Graphiti trail tooling

Add provenance signing for agent trail entries using CHIT HMAC:
- sign_trail.py: CLI tool to create and sign trail entries
- PostToolUse hook for automatic signing on trail file writes
- /chit:sign-trail skill command for interactive use
- Preflight check for dotnet SDK (required by CHIT crypto)
- CLAUDE.md documentation for trail signing workflow
- Settings.json hook registration

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* fix(runtime): service networking, healthchecks, SQL, Makefile hardening (#740)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* fix(compose): networking, healthchecks, and env hardening

- Fix external compose service networking and port bindings
- Add missing healthcheck configurations to n8n compose
- Update env.shared.example with new required variables
- Harden docker-compose.yml service definitions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(services): auth, healthchecks, and dependency updates

- Agent Zero: Dockerfile non-root hardening, MCP server auth fixes
- service_registry: improve service discovery and health reporting
- evo-controller: add healthcheck endpoint and startup guards
- flute-gateway: fix import path
- render-webhook: update deps, add input validation
- retrieval-eval: add health and metrics endpoints

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(sql): RLS policies, model registry seeds, and supabase config

- Tighten RLS policies for public_init and geometry tables
- Update model registry seed data with current model versions
- Add studio board RLS migration for service_role access
- Add supabase .gitignore and config.toml for local dev

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(tooling): Makefile targets, smoke tests, and operational scripts

- Makefile: add sign-trail, volume-reset, and infra targets
- smoke.ps1: expand service coverage and timeout handling
- with-env.sh: support multi-tier env loading
- bringup_with_ui.sh: improve startup sequencing
- chit_security.py: fix HMAC signing edge cases
- retro_flightcheck.py: add new validation checks
- capture_evidence.sh: new script for PR evidence collection
- AI_GRAPHITI_PROTOCOL.md: document agent trail protocol
- pr-monitor.md: update skill command definition

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(submodules): update BoTZ-gateway and Cipher pointers

Update submodule pointers to latest reviewed commits from
2026-03-01 security sweep.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(security): 2026-03-01 submodule security reviews and agent notes

- 5 submodule security reviews (Agent Zero, BoTZ, DoX, ToKenism, transcribe-and-fetch)
- Security queue tracker and sitrep JSON
- AGNOTE4482 FlOO$ and Flute agent notes
- CHIT review-sweep skill command and post-review hook

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* docs(agents): overlay TAC model/persona readiness into graphiti protocol

* docs(agents): correct TAC status wording for local staged artifacts

* feat(models): reconcile model registry with Anthropic, TTS, and expanded service mappings

Add Anthropic provider (claude-sonnet-4-5, claude-opus-4-5, claude-haiku-4-5)
as persona backbone. Add TTS provider with 6 engines from Ultimate TTS Studio.
Add 5 missing Ollama models from gpu-models.yaml (qwen3:32b, qwen3:1.7b,
llama3.2:3b, codellama:7b, deepseek-coder:6.7b). Fix VRAM values to match
gpu-models.yaml truth (qwen3:8b: 8000→6144, nomic-embed-text: 1000→512).
Expand service-model mappings from 4 to 15+ services including hirag, archon,
coding, orchestrator, vl_sentinel, tts, extract_worker, and more.

Covers TAC branches B + C.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(personas): integrate 8 standard persona seeds into initdb pipeline

Copy persona seeds from pmoves/db/v5_14_seed_standard_personas.sql into the
active Supabase initdb pipeline as 17_persona_seed.sql. Personas reference
claude-sonnet-4-5 (Developer/Creator/Analyst/Tester), claude-opus-4-5
(Researcher/Coordinator/Security), and claude-haiku-4-5 (Archivist).

Sequenced after model registry (12) to ensure model_preference references
are valid. Preserves ON CONFLICT (name, version) idempotency.

Covers TAC branch A.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(gpu): sync gpu-models.yaml with SQL model registry

Add 10 models missing from gpu-models.yaml that exist in SQL and consume
local GPU VRAM: qwen2.5:32b, qwen2.5:14b, qwen2-vl:7b, qwen3-reranker:4b,
nemotron-mini, llama3.1, qwen3-embedding:4b/8b, embeddinggemma:300m.
GPU Orchestrator needs these entries for VRAM scheduling on RTX 5090.

Covers TAC branch D.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(db): add persona-model resolution view for runtime agent identity lookup

Create persona_model_resolution view joining persona → model → provider
for runtime resolution of which API endpoint to call for each persona.
Also adds active_persona_summary convenience view. Grants SELECT to
PostgREST anon/auth roles.

Covers TAC branch F.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(ops): add model-readiness check and Make target

Create model_readiness_check.py that validates:
- Supabase model_providers populated with ≥8 active providers
- Supabase personas table populated with ≥8 rows
- Ollama has expected local models pulled
- TensorZero gateway operational
- persona_model_resolution view returns valid data

Add 'make model-readiness' target and wire into verify-all chain.

Covers TAC branch E.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(db): harden model/persona seed determinism and view security

* fix(ops): enforce readiness gate and close TAC doc drift

* fix(a2a): harden discovery/task auth and add agent-card endpoint

* fix(sql): harden studio_board RLS policy for service_role only

* fix(chat-relay): lazy-load supabase client to avoid path shadow in tests

* fix(ci): avoid hard failures in compose validation and yt docs tests

* fix(pmoves-yt): make boto3 optional at import time for test collection

* fix(pmoves-yt): stub tenacity when unavailable in CI test env

* chore(submodule): bump PMOVES-Agent-Zero for canonical agent-card parity

* chore(pr-scope): drop transcribe-and-fetch and cipher gitlink bumps from #744

* fix(a2a): address review blockers — RLS predicate, fail-closed key gate, discovery auth

B-1: studio_board RLS policy now restricts to service_role instead of using(true)
B-2: model-registry SUPABASE_SERVICE_KEY uses :? (fail-closed) instead of :- (empty)
B-3: discover_agents endpoint uses _require_discovery_auth instead of _require_task_auth

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
POWERFULMOVES added a commit that referenced this pull request Mar 2, 2026
* fix(security): auth-gate agent-zero A2A discovery endpoint

* fix(security): HMAC CHIT proofs + A2A discovery auth audit + dotnet preflight (#736)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* chore(env): require dotnet sdk in bootstrap preflight

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>

* chore(deps): bump multer (#735)

Bumps the npm_and_yarn group with 1 update in the /CATACLYSM_STUDIOS_INC/L4-PLATFORM/provisions/docker-stacks/jellyfin-ai/api-gateway directory: [multer](https://github.com/expressjs/multer).


Updates `multer` from 2.0.2 to 2.1.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.0.2...v2.1.0)

---
updated-dependencies:
- dependency-name: multer
  dependency-version: 2.1.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(chit): correct FlOO$ PYTHONPATH for pr-monitor pipeline

* feat(chit): CHIT-signed Graphiti trail + skill pairing awareness (#739)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* feat(chit): add CHIT-signed Graphiti trail tooling

Add provenance signing for agent trail entries using CHIT HMAC:
- sign_trail.py: CLI tool to create and sign trail entries
- PostToolUse hook for automatic signing on trail file writes
- /chit:sign-trail skill command for interactive use
- Preflight check for dotnet SDK (required by CHIT crypto)
- CLAUDE.md documentation for trail signing workflow
- Settings.json hook registration

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* fix(runtime): service networking, healthchecks, SQL, Makefile hardening (#740)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* fix(compose): networking, healthchecks, and env hardening

- Fix external compose service networking and port bindings
- Add missing healthcheck configurations to n8n compose
- Update env.shared.example with new required variables
- Harden docker-compose.yml service definitions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(services): auth, healthchecks, and dependency updates

- Agent Zero: Dockerfile non-root hardening, MCP server auth fixes
- service_registry: improve service discovery and health reporting
- evo-controller: add healthcheck endpoint and startup guards
- flute-gateway: fix import path
- render-webhook: update deps, add input validation
- retrieval-eval: add health and metrics endpoints

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(sql): RLS policies, model registry seeds, and supabase config

- Tighten RLS policies for public_init and geometry tables
- Update model registry seed data with current model versions
- Add studio board RLS migration for service_role access
- Add supabase .gitignore and config.toml for local dev

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(tooling): Makefile targets, smoke tests, and operational scripts

- Makefile: add sign-trail, volume-reset, and infra targets
- smoke.ps1: expand service coverage and timeout handling
- with-env.sh: support multi-tier env loading
- bringup_with_ui.sh: improve startup sequencing
- chit_security.py: fix HMAC signing edge cases
- retro_flightcheck.py: add new validation checks
- capture_evidence.sh: new script for PR evidence collection
- AI_GRAPHITI_PROTOCOL.md: document agent trail protocol
- pr-monitor.md: update skill command definition

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(submodules): update BoTZ-gateway and Cipher pointers

Update submodule pointers to latest reviewed commits from
2026-03-01 security sweep.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(security): 2026-03-01 submodule security reviews and agent notes

- 5 submodule security reviews (Agent Zero, BoTZ, DoX, ToKenism, transcribe-and-fetch)
- Security queue tracker and sitrep JSON
- AGNOTE4482 FlOO$ and Flute agent notes
- CHIT review-sweep skill command and post-review hook

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* chore: add gitignore for runtime data and DAO docs (#743)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* chore: add gitignore for runtime data, DAO docs, and env backups

Add entries to prevent accidental commits of:
- pmoves/jellyfin-ai/ (runtime config/data from Jellyfin AI stack)
- pmoves/pmoves/PR_EVIDENCE/ (smoke test evidence artifacts)
- pmoves/docs/logs/pr_monitor_* (runtime PR monitor logs)
- CATACLYSM_STUDIOS_INC/PMOVES DAO/ (managed separately)
- pmoves/env.jellyfin-ai, pmoves/env.supa.runtime.bak.* (env backups)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* feat(models): model registry reconciliation + persona seeds + readiness check (#741)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* docs(agents): overlay TAC model/persona readiness into graphiti protocol

* docs(agents): correct TAC status wording for local staged artifacts

* feat(models): reconcile model registry with Anthropic, TTS, and expanded service mappings

Add Anthropic provider (claude-sonnet-4-5, claude-opus-4-5, claude-haiku-4-5)
as persona backbone. Add TTS provider with 6 engines from Ultimate TTS Studio.
Add 5 missing Ollama models from gpu-models.yaml (qwen3:32b, qwen3:1.7b,
llama3.2:3b, codellama:7b, deepseek-coder:6.7b). Fix VRAM values to match
gpu-models.yaml truth (qwen3:8b: 8000→6144, nomic-embed-text: 1000→512).
Expand service-model mappings from 4 to 15+ services including hirag, archon,
coding, orchestrator, vl_sentinel, tts, extract_worker, and more.

Covers TAC branches B + C.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(personas): integrate 8 standard persona seeds into initdb pipeline

Copy persona seeds from pmoves/db/v5_14_seed_standard_personas.sql into the
active Supabase initdb pipeline as 17_persona_seed.sql. Personas reference
claude-sonnet-4-5 (Developer/Creator/Analyst/Tester), claude-opus-4-5
(Researcher/Coordinator/Security), and claude-haiku-4-5 (Archivist).

Sequenced after model registry (12) to ensure model_preference references
are valid. Preserves ON CONFLICT (name, version) idempotency.

Covers TAC branch A.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(gpu): sync gpu-models.yaml with SQL model registry

Add 10 models missing from gpu-models.yaml that exist in SQL and consume
local GPU VRAM: qwen2.5:32b, qwen2.5:14b, qwen2-vl:7b, qwen3-reranker:4b,
nemotron-mini, llama3.1, qwen3-embedding:4b/8b, embeddinggemma:300m.
GPU Orchestrator needs these entries for VRAM scheduling on RTX 5090.

Covers TAC branch D.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(db): add persona-model resolution view for runtime agent identity lookup

Create persona_model_resolution view joining persona → model → provider
for runtime resolution of which API endpoint to call for each persona.
Also adds active_persona_summary convenience view. Grants SELECT to
PostgREST anon/auth roles.

Covers TAC branch F.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(ops): add model-readiness check and Make target

Create model_readiness_check.py that validates:
- Supabase model_providers populated with ≥8 active providers
- Supabase personas table populated with ≥8 rows
- Ollama has expected local models pulled
- TensorZero gateway operational
- persona_model_resolution view returns valid data

Add 'make model-readiness' target and wire into verify-all chain.

Covers TAC branch E.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(db): harden model/persona seed determinism and view security

* fix(ops): enforce readiness gate and close TAC doc drift

* fix(sql): harden studio_board RLS policy for service_role only

* fix(db): reconcile model provider upserts and enforce studio policy replacement

- update model_providers upserts to refresh mutable fields (type/api_base/api_key_env_var/description/active/metadata)\n- always replace studio_board_service_role_all policy in migration for upgrade parity\n- clarify persona resolution grant comment to match PostgREST role grants\n- add readiness-check type hints/constants and align TAC verify steps

* fix(security): tighten studio_board revokes and TensorZero reachability checks

* fix(readiness): enforce registry thresholds and harden studio_board revokes

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* docs(agents): comprehensive AGENTS directory review and cross-reference fixes (#742)

* docs(agents): update gap analysis with Phase 1 completions

- Mark Phase 1 roadmap items as complete (model registry, persona seeds,
  GPU models YAML, service-model mappings)
- Update CHIT integration status from None to Partial
- Add A2A MCP foundation status
- Update security hooks as implemented
- Refresh date to 2026-03-01

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(agents): add cross-references between operator docs

- AGENT_CONTEXT_PATTERNS: add hook portability warning for Windows
- CODEX_CIPHER_MEMORY: add cipher categories table for quick reference
- CODEX_OPERATOR_HOME: add known gaps link to gap analysis
- CODEX_RUNTIME_PROTOCOL: add Codex-Claude collision handling section

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(agents): create README.md index for 69-file directory

Add a start-here index document that catalogs all 69 files in the
AGENTS directory with descriptions and category groupings. Provides
newcomers a navigation map for the agent documentation corpus.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(agents): add concrete persona seed examples to PERSONAS.md

- Add 4 worked examples (Developer, Creator, Researcher, Analyst)
  showing model_preference, chit_attribution, and tool_allowlist
- Document persona inheritance chain (seed SQL → Supabase row →
  agent_registry.yaml → runtime resolution view)
- Add CHIT attribution configuration section
- Add quick reference summary table for all 8 standard personas
- Cross-reference 17_persona_seed.sql from PR #741

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(registry): complete CHIT toggle coverage and Hi-RAG port split

- Add chit_toggles (encode, sign, bus_emit) to 9 infrastructure agents:
  nats-init, supabase-db, minio, qdrant, meilisearch, neo4j, prometheus,
  grafana, loki (all disabled — infra agents don't produce CHIT events)
- Add gpu_port: 8087 to hi-rag-gateway for v1/v2 port split
- Achieves 60/60 CHIT toggle coverage across all registered agents

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(agents): update SUBMODULE_CODEX_HOMES naming convention docs

- Document naming conventions for codex home files
- Add orphan tracking guidance for unmapped submodules
- Expand directory structure examples

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(agents): align persona status, topology ports, and gap metadata

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* chore: sync Hardened → main after #741-#745 merge batch (#746)

* chore(submodules): bump transcribe-and-fetch + cipher for A2A parity (#745)

* chore(submodules): bump transcribe-and-fetch and cipher for a2a auth parity

* chore(submodules): bump transcribe-and-fetch and cipher to merge-ready A2A heads

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>

* fix(a2a): secure discovery/task APIs and align with upstream agent-card path (#744)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* fix(security): auth-gate agent-zero A2A discovery endpoint

* fix(security): HMAC CHIT proofs + A2A discovery auth audit + dotnet preflight (#736)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* chore(env): require dotnet sdk in bootstrap preflight

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>

* chore(deps): bump multer (#735)

Bumps the npm_and_yarn group with 1 update in the /CATACLYSM_STUDIOS_INC/L4-PLATFORM/provisions/docker-stacks/jellyfin-ai/api-gateway directory: [multer](https://github.com/expressjs/multer).


Updates `multer` from 2.0.2 to 2.1.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.0.2...v2.1.0)

---
updated-dependencies:
- dependency-name: multer
  dependency-version: 2.1.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(chit): correct FlOO$ PYTHONPATH for pr-monitor pipeline

* feat(chit): CHIT-signed Graphiti trail + skill pairing awareness (#739)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* feat(chit): add CHIT-signed Graphiti trail tooling

Add provenance signing for agent trail entries using CHIT HMAC:
- sign_trail.py: CLI tool to create and sign trail entries
- PostToolUse hook for automatic signing on trail file writes
- /chit:sign-trail skill command for interactive use
- Preflight check for dotnet SDK (required by CHIT crypto)
- CLAUDE.md documentation for trail signing workflow
- Settings.json hook registration

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* fix(runtime): service networking, healthchecks, SQL, Makefile hardening (#740)

* fix(security): use HMAC for CHIT proofs

* docs(security): add A2A discovery auth sweep findings

* fix(security): update submodule pointers to 2026-03-01 review fix branches

Update gitlink pointers for 5 submodules to their security fix branches:
- BoTZ: auth-gate /.well-known/agent.json (PR #70)
- ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46)
- Agent-Zero: path containment + supervisord users (PR #8)
- transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44)
- DoX: secrets externalized + honest 501 (PR #114)

Also update review status doc with fix verification.

All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(env): require dotnet sdk in bootstrap preflight

* fix(compose): networking, healthchecks, and env hardening

- Fix external compose service networking and port bindings
- Add missing healthcheck configurations to n8n compose
- Update env.shared.example with new required variables
- Harden docker-compose.yml service definitions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(services): auth, healthchecks, and dependency updates

- Agent Zero: Dockerfile non-root hardening, MCP server auth fixes
- service_registry: improve service discovery and health reporting
- evo-controller: add healthcheck endpoint and startup guards
- flute-gateway: fix import path
- render-webhook: update deps, add input validation
- retrieval-eval: add health and metrics endpoints

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(sql): RLS policies, model registry seeds, and supabase config

- Tighten RLS policies for public_init and geometry tables
- Update model registry seed data with current model versions
- Add studio board RLS migration for service_role access
- Add supabase .gitignore and config.toml for local dev

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(tooling): Makefile targets, smoke tests, and operational scripts

- Makefile: add sign-trail, volume-reset, and infra targets
- smoke.ps1: expand service coverage and timeout handling
- with-env.sh: support multi-tier env loading
- bringup_with_ui.sh: improve startup sequencing
- chit_security.py: fix HMAC signing edge cases
- retro_flightcheck.py: add new validation checks
- capture_evidence.sh: new script for PR evidence collection
- AI_GRAPHITI_PROTOCOL.md: document agent trail protocol
- pr-monitor.md: update skill command definition

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(submodules): update BoTZ-gateway and Cipher pointers

Update submodule pointers to latest reviewed commits from
2026-03-01 security sweep.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(security): 2026-03-01 submodule security reviews and agent notes

- 5 submodule security reviews (Agent Zero, BoTZ, DoX, ToKenism, transcribe-and-fetch)
- Security queue tracker and sitrep JSON
- AGNOTE4482 FlOO$ and Flute agent notes
- CHIT review-sweep skill command and post-review hook

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* docs(agents): overlay TAC model/persona readiness into graphiti protocol

* docs(agents): correct TAC status wording for local staged artifacts

* feat(models): reconcile model registry with Anthropic, TTS, and expanded service mappings

Add Anthropic provider (claude-sonnet-4-5, claude-opus-4-5, claude-haiku-4-5)
as persona backbone. Add TTS provider with 6 engines from Ultimate TTS Studio.
Add 5 missing Ollama models from gpu-models.yaml (qwen3:32b, qwen3:1.7b,
llama3.2:3b, codellama:7b, deepseek-coder:6.7b). Fix VRAM values to match
gpu-models.yaml truth (qwen3:8b: 8000→6144, nomic-embed-text: 1000→512).
Expand service-model mappings from 4 to 15+ services including hirag, archon,
coding, orchestrator, vl_sentinel, tts, extract_worker, and more.

Covers TAC branches B + C.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(personas): integrate 8 standard persona seeds into initdb pipeline

Copy persona seeds from pmoves/db/v5_14_seed_standard_personas.sql into the
active Supabase initdb pipeline as 17_persona_seed.sql. Personas reference
claude-sonnet-4-5 (Developer/Creator/Analyst/Tester), claude-opus-4-5
(Researcher/Coordinator/Security), and claude-haiku-4-5 (Archivist).

Sequenced after model registry (12) to ensure model_preference references
are valid. Preserves ON CONFLICT (name, version) idempotency.

Covers TAC branch A.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(gpu): sync gpu-models.yaml with SQL model registry

Add 10 models missing from gpu-models.yaml that exist in SQL and consume
local GPU VRAM: qwen2.5:32b, qwen2.5:14b, qwen2-vl:7b, qwen3-reranker:4b,
nemotron-mini, llama3.1, qwen3-embedding:4b/8b, embeddinggemma:300m.
GPU Orchestrator needs these entries for VRAM scheduling on RTX 5090.

Covers TAC branch D.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(db): add persona-model resolution view for runtime agent identity lookup

Create persona_model_resolution view joining persona → model → provider
for runtime resolution of which API endpoint to call for each persona.
Also adds active_persona_summary convenience view. Grants SELECT to
PostgREST anon/auth roles.

Covers TAC branch F.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(ops): add model-readiness check and Make target

Create model_readiness_check.py that validates:
- Supabase model_providers populated with ≥8 active providers
- Supabase personas table populated with ≥8 rows
- Ollama has expected local models pulled
- TensorZero gateway operational
- persona_model_resolution view returns valid data

Add 'make model-readiness' target and wire into verify-all chain.

Covers TAC branch E.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(db): harden model/persona seed determinism and view security

* fix(ops): enforce readiness gate and close TAC doc drift

* fix(a2a): harden discovery/task auth and add agent-card endpoint

* fix(sql): harden studio_board RLS policy for service_role only

* fix(chat-relay): lazy-load supabase client to avoid path shadow in tests

* fix(ci): avoid hard failures in compose validation and yt docs tests

* fix(pmoves-yt): make boto3 optional at import time for test collection

* fix(pmoves-yt): stub tenacity when unavailable in CI test env

* chore(submodule): bump PMOVES-Agent-Zero for canonical agent-card parity

* chore(pr-scope): drop transcribe-and-fetch and cipher gitlink bumps from #744

* fix(a2a): address review blockers — RLS predicate, fail-closed key gate, discovery auth

B-1: studio_board RLS policy now restricts to service_role instead of using(true)
B-2: model-registry SUPABASE_SERVICE_KEY uses :? (fail-closed) instead of :- (empty)
B-3: discover_agents endpoint uses _require_discovery_auth instead of _require_task_auth

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@POWERFULMOVES
POWERFULMOVES deleted the codex/extend-ffmpeg-whisper-for-gpu-support branch March 7, 2026 21:41
POWERFULMOVES pushed a commit that referenced this pull request Mar 26, 2026
Update PMOVES-ToKenism-Multi to commit 4a48144 (fix/docked-env-paths):
- Fix all PR #44 review comments
- Add accessibility test steps to CI workflow
- Add coverage configuration to Jest
- Support both .ts and .js hardhat config in CI
- Remove unrecognized doc_target_coverage from coderabbit config
- Correct env_file paths and remove weak postgres default
- Add docked mode configuration for PMOVES.AI integration
- Remove invalid nested submodule entries
- Remove invalid absolute path submodules (runtime integrations via networking)
- Use useradd instead of adduser for Alpine compatibility

These fixes enable proper docked mode operation for PMOVES.AI integration
and resolve CI/CD issues for cross-platform compatibility.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
POWERFULMOVES pushed a commit that referenced this pull request Apr 16, 2026
…se 9Q)

Routes all YouTube-facing services through the KVM4-1 Tailscale exit node
(pmoves-kvm4-1, IP 31.97.42.207, Hostinger datacenter) to bypass YouTube's
residential-IP anti-bot 403s. PMOVES.YT is a critical upstream for
ffmpeg-whisper, extract-worker, langextract, notebook-sync, channel-monitor,
publisher-discord, Hi-RAG v2, and the conch-consciousness-analysis skill
pipeline; silent 403s in the ingestion layer propagate as quiet downstream
failures.

## Root cause

YouTube's anti-bot sweeps blacklist residential IP ranges periodically.
Once the home IP is blocked, every request from it gets 403'd regardless
of yt-dlp client (web/android/ios), PO token freshness, or cookie
validity. The 3-tier fallback chain (yt-dlp → Invidious Companion →
Invidious API) all egresses from the same residential IP, so Tier 2/3
also 403.

Additionally, background investigation found that YT_ENABLE_PO_TOKEN has
been silently FALSE by default despite all supporting infrastructure
working. bgutil-pot-provider and invidious-companion have been generating
PO tokens for weeks (verified via `docker logs pmoves-invidious-companion-1`
showing `Successfully generated PO token`) but yt-dlp wasn't using them.

## Solution

### docker-compose.yt-egress.yml (new overlay)

Tailscale userspace sidecar (tailscale/tailscale:latest) with
`TS_EXTRA_ARGS=--exit-node=pmoves-kvm4-1 --exit-node-allow-lan-access`.
Exposes two proxy listeners inside pmoves_app network:
  - SOCKS5 on :1055
  - HTTP CONNECT on :1080 (used by yt-dlp/urllib via HTTP_PROXY env)

Four service overrides set HTTP_PROXY/HTTPS_PROXY pointing at the sidecar
and NO_PROXY carving out internal Docker DNS targets (minio, nats,
supabase-kong, etc.) so service-to-service traffic stays on pmoves_app:
  - pmoves-yt
  - bgutil-pot-provider
  - invidious-companion
  - invidious

Userspace tailscale requires NET_ADMIN for the proxy listeners (not for
TUN device). Sidecar authenticates via existing TAILSCALE_AUTHKEY in
env.shared — no new credentials required. State persists in a named
volume so re-activation skips re-auth.

### mk/egress.mk (new Make targets)

Five targets for lifecycle + verification:
  - up-yt-egress       — activate sidecar, recreate 4 YT services with proxy
  - down-yt-egress     — stop sidecar, revert services to residential egress
  - yt-egress-preflight — verify KVM4-1 is reachable + advertising as exit
  - yt-egress-status   — show sidecar peers + service container states
  - yt-egress-verify   — compare host IP vs PMOVES.YT container egress IP
                         + test-ingest dQw4w9WgXcQ (short known-good video)

### env.shared.example

Adds YT_ENABLE_PO_TOKEN=true with inline comment explaining the silent
misconfiguration. With the sidecar routing traffic through a datacenter
IP, yt-dlp's PO tokens (from bgutil or companion) will actually work
with YouTube instead of being ignored or flagged.

### .claude/hooks/damage-control/patterns.yaml

Adds `docker-compose.yt-egress` and `mk/egress.mk` to chitSafePaths
(the allow-list that permits Edit/Write on otherwise read-only compose +
mk paths). Same pattern as prior additions for docker-compose.open-notebook,
docker-compose.external, etc.

### Docs corrections (TOPOLOGY.md)

KVM2 was mislabeled as "Exit Node" in topology docs, but the actual
production egress exit node is KVM4-1 (setup by 4090-CLAUDE on
2026-04-12, see pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md:475). KVM2's
actual role is reverse proxy (nginx SSL) + RustDesk relay. Updated the
node table entry and added a clarifying note to the KVM2 section.
`deploy/provision/kvm2-exit-node.sh` is an older draft script that was
never activated; flagged in docs to prevent operator confusion.

### YT_EGRESS_RUNBOOK.md (new operator doc)

Documents:
  - When to activate (symptoms that indicate residential-IP block)
  - Preflight: confirming KVM4-1 exit-node advertisement
  - Activation / deactivation / status / verify workflows
  - Troubleshooting: stuck sidecar join, expired auth key, YT still 403s
  - Forward reference to Phase 9Q.2 (cookie refresh workflow — proper
    OAuth2 + Playwright harvester replacing the manual cookies.txt)

## What this does NOT fix

- Cookies: still uses the manual `darkxside.youtube.cookies.txt`
  workaround. Phase 9Q.2 (deferred, tracked as task #44) replaces this
  with Google OAuth2 refresh token + weekly Playwright harvest +
  Fernet-encrypted storage in MinIO + NATS event on refresh.
- Explicit yt-dlp `proxy` option in the PMOVES.YT submodule. Not needed
  because yt-dlp auto-respects HTTP_PROXY via Python urllib. Defense-
  in-depth enhancement can ship later if desired.
- External downloader (aria2c) fallback for resilience against yt-dlp's
  own 403 recovery limits. Future Phase 9Q.3 candidate.

## Test plan (operator runs after merge)

  # 1. Preflight
  make -C pmoves yt-egress-preflight
  # Expect: "KVM4-1 reachable on tailnet."

  # 2. Activate
  make -C pmoves up-yt-egress
  # Expect: sidecar healthy, 4 services recreated, verify runs automatically

  # 3. Confirm IP change
  make -C pmoves yt-egress-verify
  # Expect:
  #   Host IP:      <residential IP>
  #   PMOVES.YT IP: 31.97.42.207 (or Hostinger range)
  #   Test ingest:  {"ok": true, ...}

  # 4. Real-world test — Cole Medin 2hr Archon video (Phase 9C blocker)
  curl -X POST http://localhost:8077/yt/ingest \
    -H 'Content-Type: application/json' \
    -d '{"url": "https://www.youtube.com/watch?v=srx9iwnjK2M"}'
  # Expect: {"ok": true, ...} (was 403 before)

  # 5. Rollback test
  make -C pmoves down-yt-egress
  make -C pmoves yt-egress-verify
  # Expect: PMOVES.YT IP reverts to residential

## Task list impact

After this merges:
  - Close #36 (Phase 9J YT 403 client-switch) as SUPERSEDED
  - Unblock #29 (Phase 9C Cole Medin channel ingestion)
  - Unblock #30 (Phase 9D Archon video-driven TAC review)
  - #44 (Phase 9Q.2 cookie refresh workflow) continues as planned follow-up

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
POWERFULMOVES pushed a commit that referenced this pull request Apr 16, 2026
…se 9Q)

Routes all YouTube-facing services through the KVM4-1 Tailscale exit node
(pmoves-kvm4-1, IP 31.97.42.207, Hostinger datacenter) to bypass YouTube's
residential-IP anti-bot 403s. PMOVES.YT is a critical upstream for
ffmpeg-whisper, extract-worker, langextract, notebook-sync, channel-monitor,
publisher-discord, Hi-RAG v2, and the conch-consciousness-analysis skill
pipeline; silent 403s in the ingestion layer propagate as quiet downstream
failures.

YouTube's anti-bot sweeps blacklist residential IP ranges periodically.
Once the home IP is blocked, every request from it gets 403'd regardless
of yt-dlp client (web/android/ios), PO token freshness, or cookie
validity. The 3-tier fallback chain (yt-dlp → Invidious Companion →
Invidious API) all egresses from the same residential IP, so Tier 2/3
also 403.

Additionally, background investigation found that YT_ENABLE_PO_TOKEN has
been silently FALSE by default despite all supporting infrastructure
working. bgutil-pot-provider and invidious-companion have been generating
PO tokens for weeks (verified via `docker logs pmoves-invidious-companion-1`
showing `Successfully generated PO token`) but yt-dlp wasn't using them.

Tailscale userspace sidecar (tailscale/tailscale:latest) with
`TS_EXTRA_ARGS=--exit-node=pmoves-kvm4-1 --exit-node-allow-lan-access`.
Exposes two proxy listeners inside pmoves_app network:
  - SOCKS5 on :1055
  - HTTP CONNECT on :1080 (used by yt-dlp/urllib via HTTP_PROXY env)

Four service overrides set HTTP_PROXY/HTTPS_PROXY pointing at the sidecar
and NO_PROXY carving out internal Docker DNS targets (minio, nats,
supabase-kong, etc.) so service-to-service traffic stays on pmoves_app:
  - pmoves-yt
  - bgutil-pot-provider
  - invidious-companion
  - invidious

Userspace tailscale requires NET_ADMIN for the proxy listeners (not for
TUN device). Sidecar authenticates via existing TAILSCALE_AUTHKEY in
env.shared — no new credentials required. State persists in a named
volume so re-activation skips re-auth.

Five targets for lifecycle + verification:
  - up-yt-egress       — activate sidecar, recreate 4 YT services with proxy
  - down-yt-egress     — stop sidecar, revert services to residential egress
  - yt-egress-preflight — verify KVM4-1 is reachable + advertising as exit
  - yt-egress-status   — show sidecar peers + service container states
  - yt-egress-verify   — compare host IP vs PMOVES.YT container egress IP
                         + test-ingest dQw4w9WgXcQ (short known-good video)

Adds YT_ENABLE_PO_TOKEN=true with inline comment explaining the silent
misconfiguration. With the sidecar routing traffic through a datacenter
IP, yt-dlp's PO tokens (from bgutil or companion) will actually work
with YouTube instead of being ignored or flagged.

Adds `docker-compose.yt-egress` and `mk/egress.mk` to chitSafePaths
(the allow-list that permits Edit/Write on otherwise read-only compose +
mk paths). Same pattern as prior additions for docker-compose.open-notebook,
docker-compose.external, etc.

KVM2 was mislabeled as "Exit Node" in topology docs, but the actual
production egress exit node is KVM4-1 (setup by 4090-CLAUDE on
2026-04-12, see pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md:475). KVM2's
actual role is reverse proxy (nginx SSL) + RustDesk relay. Updated the
node table entry and added a clarifying note to the KVM2 section.
`deploy/provision/kvm2-exit-node.sh` is an older draft script that was
never activated; flagged in docs to prevent operator confusion.

Documents:
  - When to activate (symptoms that indicate residential-IP block)
  - Preflight: confirming KVM4-1 exit-node advertisement
  - Activation / deactivation / status / verify workflows
  - Troubleshooting: stuck sidecar join, expired auth key, YT still 403s
  - Forward reference to Phase 9Q.2 (cookie refresh workflow — proper
    OAuth2 + Playwright harvester replacing the manual cookies.txt)

- Cookies: still uses the manual `darkxside.youtube.cookies.txt`
  workaround. Phase 9Q.2 (deferred, tracked as task #44) replaces this
  with Google OAuth2 refresh token + weekly Playwright harvest +
  Fernet-encrypted storage in MinIO + NATS event on refresh.
- Explicit yt-dlp `proxy` option in the PMOVES.YT submodule. Not needed
  because yt-dlp auto-respects HTTP_PROXY via Python urllib. Defense-
  in-depth enhancement can ship later if desired.
- External downloader (aria2c) fallback for resilience against yt-dlp's
  own 403 recovery limits. Future Phase 9Q.3 candidate.

  # 1. Preflight
  make -C pmoves yt-egress-preflight
  # Expect: "KVM4-1 reachable on tailnet."

  # 2. Activate
  make -C pmoves up-yt-egress
  # Expect: sidecar healthy, 4 services recreated, verify runs automatically

  # 3. Confirm IP change
  make -C pmoves yt-egress-verify
  # Expect:
  #   Host IP:      <residential IP>
  #   PMOVES.YT IP: 31.97.42.207 (or Hostinger range)
  #   Test ingest:  {"ok": true, ...}

  # 4. Real-world test — Cole Medin 2hr Archon video (Phase 9C blocker)
  curl -X POST http://localhost:8077/yt/ingest \
    -H 'Content-Type: application/json' \
    -d '{"url": "https://www.youtube.com/watch?v=srx9iwnjK2M"}'
  # Expect: {"ok": true, ...} (was 403 before)

  # 5. Rollback test
  make -C pmoves down-yt-egress
  make -C pmoves yt-egress-verify
  # Expect: PMOVES.YT IP reverts to residential

After this merges:
  - Close #36 (Phase 9J YT 403 client-switch) as SUPERSEDED
  - Unblock #29 (Phase 9C Cole Medin channel ingestion)
  - Unblock #30 (Phase 9D Archon video-driven TAC review)
  - #44 (Phase 9Q.2 cookie refresh workflow) continues as planned follow-up

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant