feat(chit-evoswarm): Restore CHIT, Evoswarm, Flute, Geometry Bus, and Consciousness docs - #476
Closed
POWERFULMOVES wants to merge 144 commits into
Closed
POWERFULMOVES wants to merge 144 commits into
POWERFULMOVES wants to merge 144 commits into
Conversation
Add comprehensive integration document outlining how to incorporate IndyDevDan's Tactical Agentic Coding framework with PMOVES.AI. Includes 12 leverage points, git worktrees, Claude hooks, ARCHON integration, and concrete 4-phase implementation architecture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Convert CRLF to LF for consistent line endings across environments. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Update integration plan to clarify that TAC integration is about Claude Code CLI developer tooling that LEVERAGES existing PMOVES infrastructure, not replacing it. Key changes: - Add CRITICAL DISTINCTION section explaining CLI vs runtime agents - Document existing production services (Agent Zero, Hi-RAG, SupaSerch, etc.) - Refocus phases on .claude/ context, custom commands, and hooks - Update implementation priorities to leverage, not duplicate - Provide examples of slash commands that call existing services - Remove unnecessary Docker Compose modifications This ensures Claude Code CLI becomes PMOVES-aware without duplicating the sophisticated multi-agent orchestration already in production. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add comprehensive .claude/ directory structure following IndyDevDan TAC patterns to make Claude Code CLI PMOVES-aware. This enables developers to leverage existing production infrastructure (Agent Zero, Hi-RAG v2, SupaSerch, NATS, etc.) directly from their coding workflow. Directory structure: - CLAUDE.md: Always-on context with architecture overview and service catalog - commands/: Custom slash commands for service interaction - /search:hirag - Query Hi-RAG v2 hybrid RAG - /health:check-all - Verify all service health - /agents:status - Check Agent Zero orchestrator - /deploy:smoke-test - Run integration tests - /deploy:services - Docker compose status - context/: Detailed reference documentation - services-catalog.md - Complete service listing with APIs - nats-subjects.md - NATS event subject catalog - mcp-api.md - Agent Zero MCP API reference - chit-geometry-bus.md - Structured data exchange format - evoswarm.md - Evolutionary optimization system This transforms Claude Code CLI from a general-purpose coding assistant into a PMOVES-native development tool that understands and integrates with the existing multi-agent orchestration stack. Also include comprehensive PMOVES.AI Services and Integrations documentation for reference. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Refined .claude/commands/ based on TAC continuous improvement loop: Fixes: - Add 'cd pmoves' prefix to all make/compose commands - Update verify-all description with actual capabilities - Document compose file location (pmoves/docker-compose.yml) New command: - /deploy:up - Comprehensive service bring-up with profiles This demonstrates TAC methodology: test commands, discover gaps, refine iteratively based on actual system behavior. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Complete TAC integration enhancements following iterative refinement: TensorZero Integration (Primary Model Provider): - Add comprehensive TensorZero documentation (.claude/context/tensorzero.md) - Prominent placement in CLAUDE.md as primary observability/model provider - Document TensorZero Gateway (port 3030), ClickHouse (8123), UI (4000) - Include usage examples for LLM calls, embeddings, metrics queries - Configuration, troubleshooting, and best practices Claude Code CLI Hooks: - pre-tool.sh: Security validation, blocks dangerous operations - post-tool.sh: Publishes to NATS (claude.code.tool.executed.v1) - Fallback to local logging if NATS unavailable - Comprehensive hooks README with installation and usage Git Worktrees for Parallel Development: - Complete guide for parallel Claude Code CLI instances - PMOVES-specific patterns (monorepo, submodules, docker ports) - Real-world examples and troubleshooting - Enables simultaneous work on multiple features Common Development Tasks: - Add TensorZero examples to CLAUDE.md - LLM calls, embeddings, metrics queries via TensorZero This demonstrates TAC continuous improvement: implement, test, discover gaps, refine, document, and iterate. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Fix DeepResearch Dockerfile to work with context: ./services - Change COPY paths from absolute (services/...) to relative (deepresearch/...) - Remove unused COPY contracts (not needed by deepresearch) - Quote JSON value in .env.local to prevent shell parsing error - AGENT_ZERO_DECODING now properly quoted with single quotes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
## PBnJ (Pinokio-Based N-tier) Deployment System ### Deployment Scripts (deploy/scripts/) - deploy-k8s.sh: Kubernetes orchestration for ai-lab, kvm4, local targets - deploy-compose.sh: Docker Compose wrapper for local development - Both scripts executable with comprehensive error handling ### Kubernetes Manifests (deploy/k8s/) Base manifests: - namespace.yaml: PMOVES namespace with labels - pmoves-core-deployment.yaml: Core service with security hardening - pmoves-core-service.yaml: ClusterIP service - ingress.yaml: Nginx ingress controller config - kustomization.yaml: Resource aggregation Overlays: - ai-lab/: 5 replicas, pmoves.lab.local, v1.0.0-lab-hardened - kvm4/: 2 replicas, pmoves.kvm4.yourdomain.tld, v1.0.0-kvm4-hardened - local/: dev-local tag, pmoves.localtest.me ### Pinokio Application (pbnj/pinokio/api/pmoves-pbnj/) One-click graphical interface for: - AI Lab K8s cluster management (start/stop/status) - KVM4 gateway deployment controls - Local Docker Compose stack management (up/down/logs) - 10 JSON workflow files + pinokio.js manifest ### Documentation - deploy/README.md: Comprehensive deployment guide - pbnj/README.md: Pinokio integration and usage ## Critical Security Fixes ### Kubernetes Security Hardening deploy/k8s/base/pmoves-core-deployment.yaml: - Pod-level securityContext: runAsNonRoot, runAsUser 1000, fsGroup 1000 - Container securityContext: readOnlyRootFilesystem, no privilege escalation - Capability drop ALL - tmpfs volumes for /tmp and /var/cache ### Dependency Management .github/dependabot.yml: - Automated updates for pip, docker, github-actions - Weekly schedule with max 10 PRs per ecosystem - Conventional commit messages ### Credential Sanitization pmoves/env.shared.example: - Removed exposed Google OAuth credentials (GOCSPX-*) - Replaced real email addresses with example.com placeholders - Removed real domain references (cataclysmstudios.com) ## Documentation Updates Open-Source Model Recommendations: - Added comprehensive TensorZero Gateway section (~180 lines) - Model routing architecture and configurations - ClickHouse observability patterns - Hardware deployment matrix - Integration examples (TOML, Python) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Document the complete PBnJ (Pinokio-Based N-tier) deployment system design and implementation details. ## Contents (1,353 lines) ### Deployment Architecture - Multi-environment strategy: AI Lab K8s, KVM4 gateway, local dev - Service orchestration via deploy-k8s.sh and deploy-compose.sh - Kustomize-based Kubernetes manifest management ### Implementation Artifacts **Deployment Scripts:** - deploy-k8s.sh: K8s orchestration with target-specific config - Supports: ai-lab, kvm4, local targets - Environment variable overrides for context/namespace - Built-in validation and error handling - deploy-compose.sh: Docker Compose wrapper - Detects docker-compose vs docker compose - Project and compose file customization **Kubernetes Manifests:** - Base manifests: namespace, deployment, service, ingress - Overlays: ai-lab (5 replicas), kvm4 (2 replicas), local (dev) - Kustomize patches for environment-specific configuration **Pinokio Integration:** - pinokio.js manifest with menu structure - JSON workflows for each deployment target: - lab-up/down, kvm4-up/down, local-up/down/logs, status ### Security Considerations - SecurityContext configuration patterns - NetworkPolicy examples - Secret management strategies - TLS termination with cert-manager ### Cloud School IAM Integration - WorkOS identity provider patterns - Role-based access control design - Audit logging architecture ## Related Implementations - /deploy/ directory structure - /pbnj/ Pinokio application - Kubernetes manifests in deploy/k8s/ This document served as the blueprint for the complete PBnJ deployment system implemented in commit 1f09825. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Comprehensive security hardening documentation for production PMOVES.AI deployments. ## PMOVES.AI-Edition-Hardened-Full.md (999 lines) ### Security Architecture Documentation **Container Security:** - Distroless and minimal base images (gcr.io/distroless/python3) - Multi-stage Docker builds with BuildKit secret mounts - Non-root user execution (UID 65532) - Read-only root filesystems with tmpfs mounts - Capability dropping (drop: ALL) - seccomp and AppArmor profiles **GitHub Actions CI/CD Security:** - Harden-Runner EDR with network egress blocking - Trivy vulnerability scanning (HIGH/CRITICAL gates) - Cosign keyless image signing - SBOM generation with Syft - Dependabot configuration (pip, docker, github-actions) - JIT ephemeral runners documentation **Kubernetes Security:** - Pod and container SecurityContext patterns - NetworkPolicies for zero-trust networking - Pod Security Standards (restricted profile) - Resource limits and quotas - TLS termination with cert-manager - RBAC least-privilege access **Infrastructure Security:** - Cloudflare Tunnels for zero-trust remote access - Tailscale mesh VPN for admin access - RustDesk self-hosted remote desktop - Secret management with Docker secrets - 90-day secret rotation policy **Network Security:** - Internal network isolation - TLS/mTLS for service-to-service communication - Ingress controller hardening - DDoS protection patterns ## PMOVES.AI-Edition-Hardened-Summary.md (103 lines) Executive summary of security hardening approach: - Quick reference for key security controls - Decision matrix for deployment scenarios - Compliance mapping (SOC 2, ISO 27001) - Security posture scorecard ## Implementation Status This documentation describes the target hardened state. Current implementation gaps identified in security audit: - 3/42 services (7%) with non-root users - 0/42 services with distroless images - Missing K8s SecurityContext in most deployments - No Harden-Runner EDR in workflows - No active Cloudflare Tunnels or Tailscale VPN See docs/Security-Hardening-Roadmap.md for phased implementation plan to achieve full hardened posture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Phased implementation plan to achieve production-grade security posture for PMOVES.AI multi-agent orchestration platform. ## Security-Hardening-Roadmap.md (1,728 lines, 45KB) ### Executive Summary **Current Security Posture:** - Container Security: 7% hardened (3/42 services) - Base Images: 2% minimal (1/42 distroless/alpine) - Kubernetes: 0% SecurityContext coverage - CI/CD: No Harden-Runner EDR, basic scanning - Network: No NetworkPolicies, no TLS/mTLS - Secrets: No rotation mechanism **Risk Assessment:** - HIGH: Privilege escalation (39 root containers) - HIGH: Supply chain attacks (no EDR, missing gates) - HIGH: Data exfiltration (no NetworkPolicies) - MEDIUM: Container escape (writable filesystems) - MEDIUM: Secret compromise (no rotation) ### Phase 1: Immediate Actions (Week 1-2) - HIGH Priority **Task 1.1: Non-Root Users for All Services** - Files: 42 Dockerfiles, docker-compose.yml - Effort: 40-60 hours - Implementation: Add UID 65532 to all containers - Testing: Verify `id` output, run smoke tests **Task 1.2: Read-Only Filesystems + tmpfs** - Files: docker-compose.yml, service overrides - Effort: 50-70 hours - Implementation: read_only: true + tmpfs mounts - Testing: Attempt writes to root, verify functionality **Task 1.3: Kubernetes SecurityContext** - Files: deploy/k8s/base/*.yaml, overlays - Effort: 30-40 hours - Implementation: Pod + container securityContext - Testing: kube-bench, manual privilege tests **Task 1.4: Kubernetes NetworkPolicies** - Files: network-policy-*.yaml (4 new files) - Effort: 40-50 hours - Implementation: Default deny + tier-based allow - Testing: Verify isolation with curl tests **Task 1.5: TLS Termination** - Files: ingress.yaml, cert-manager config - Effort: 20-30 hours - Implementation: cert-manager + Let's Encrypt - Testing: SSL Labs A+ rating **Phase 1 Target: 80% security score** ### Phase 2: Short-Term Hardening (Week 3-6) - MEDIUM Priority **Task 2.1: Harden-Runner EDR** - Files: 7 GitHub workflow files - Effort: 15-20 hours - Implementation: step-security/harden-runner@v2 - Testing: StepSecurity dashboard monitoring **Task 2.2: BuildKit Secret Mounts** - Files: 42 Dockerfiles, workflows - Effort: 25-35 hours - Implementation: --mount=type=secret patterns - Testing: Dive/Trivy secret scanning **Task 2.3: Branch Protection + Signed Commits** - Files: GitHub settings, .github/CODEOWNERS - Effort: 10-15 hours - Implementation: 2 approvals, code owner reviews - Testing: Attempt unsigned commit (should fail) **Task 2.4: Secret Rotation Automation** - Files: rotate-secrets.sh, workflows - Effort: 30-40 hours - Implementation: 90-day rotation schedule - Testing: Dry-run rotation, verify zero downtime **Phase 2 Target: 90% security score** ### Phase 3: Long-Term Hardening (Month 2-3) - MEDIUM/LOW Priority **Task 3.1: Distroless Image Migration** - Files: 42 Dockerfiles (phased) - Effort: 80-100 hours - Strategy: Easy → Medium → Hard services - Target: 70% distroless (30/42 services) **Task 3.2: Cloudflare Tunnels** - Files: docker-compose.cloudflared.yml, config - Effort: 20-30 hours - Implementation: Zero-trust remote access - Testing: Verify no direct port exposure **Task 3.3: Tailscale Mesh VPN** - Files: docker-compose.tailscale.yml, ACLs - Effort: 25-35 hours - Implementation: Sidecar pattern + ACLs - Testing: SSH via Tailscale only **Task 3.4: Security Observability** - Files: falco rules, Grafana dashboards, alerts - Effort: 40-50 hours - Implementation: Falco + Prometheus + Grafana - Testing: Trigger test attacks, verify detection **Phase 3 Target: 95% security score** ### Metrics & Success Criteria **Automated Tracking:** - scripts/security-metrics.sh for weekly reports - GitHub Actions workflow for metric dashboards - Prometheus/Grafana security dashboards **Success Metrics:** - Non-root: 100% (42/42) - Read-only FS: 100% (42/42) - K8s SecurityContext: 100% - NetworkPolicies: 5+ tier-based policies - TLS: 100% ingress + A+ SSL Labs - Distroless: 70% (30/42) - CVE reduction: 50-80% ### Rollback Plans Each phase includes independent rollback: - docker-compose.root-fallback.yml - docker-compose.writable.yml - deploy/k8s/rollback/ patches - Secret backup directories (30-day retention) ### Critical Files for Implementation 1. pmoves/docker-compose.hardened.yml (extend to all services) 2. deploy/k8s/base/pmoves-core-deployment.yaml (SecurityContext) 3. pmoves/services/*/Dockerfile (42 files - non-root + distroless) 4. deploy/k8s/base/network-policy-*.yaml (4 new files) 5. .github/workflows/build-images.yml (Harden-Runner) ### Estimated Total Effort **380-520 person-hours (2.5-3.5 person-months)** Recommended: 2 engineers dedicated for 8-12 weeks ## Implementation Status This roadmap addresses gaps identified in the comprehensive security audit. Critical fixes already completed: - ✅ Exposed credentials removed from env.shared.example - ✅ K8s SecurityContext added to pmoves-core deployment - ✅ Dependabot enabled (.github/dependabot.yml) Next: Execute Phase 1 tasks to achieve 80% security posture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Reference documentation for WorkOS-based identity and access management strategy integrated with PBnJ deployment system. ## Cloud School IAM and Onboarding Strategy.pdf Enterprise IAM architecture for PMOVES.AI platform: ### Identity Provider Integration - WorkOS SSO for unified authentication - B2B (organizations) and B2C (individual users) - SAML, OAuth 2.0, OpenID Connect support - Directory sync (SCIM) ### Role-Based Access Control (RBAC) - Developer role: Local dev environments only - DevOps role: All deployment targets (ai-lab, kvm4, local) - Admin role: Full control + monitoring access ### PBnJ Integration Points - Pinokio user authentication → WorkOS SSO - Identity-aware deployment authorization - Audit logging for all PBnJ actions - Session management and MFA enforcement ### Onboarding Workflow - New user registration via WorkOS portal - Automatic role assignment based on organization - Claude Code CLI credential provisioning - Deployment target access matrix ### Compliance & Audit - SOC 2 Type II audit trail requirements - GDPR user data handling - Access review schedules (quarterly) - Privileged access management (PAM) ## Integration with PMOVES.AI This IAM strategy integrates with: - PBnJ deployment system (/pbnj/) - Kubernetes RBAC policies (deploy/k8s/) - Tailscale ACLs for VPN access - Cloudflare Access for zero-trust ## Implementation Status Documented but not yet implemented. Integration planned for: - Phase 2 of Security Hardening Roadmap - Post-PBnJ deployment rollout - Coordinated with Tailscale VPN activation Reference: docs/Security-Hardening-Roadmap.md (Phase 3) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Remove old PMOVES.AI-Edition-Hardened.md in favor of the new comprehensive documentation structure: - PMOVES.AI-Edition-Hardened-Full.md (999 lines) - PMOVES.AI-Edition-Hardened-Summary.md (103 lines) - Security-Hardening-Roadmap.md (1,728 lines) The original document has been superseded by this more detailed and actionable three-document set that provides: 1. Full security architecture documentation 2. Executive summary for quick reference 3. Phased implementation roadmap with specific tasks 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Fix kustomize resource paths (../../base → ../base) in all overlays - Add .envrc.example with all K8s and Compose env vars - Update deploy/README.md with detailed prerequisites - Add ingress hostname comments for clarity Validation Results: ✅ All 3 overlays (ai-lab, kvm4, local) build successfully ✅ All deployment scripts pass syntax validation ✅ All 8 PBnJ workflow JSON files valid Fixes: - Kustomize paths were incorrect (looking for deploy/base instead of deploy/k8s/base) - Missing environment variable documentation - Prerequisites section lacked verification commands 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Bumps the pip group with 1 update in the /pmoves/services/archon directory: [mcp](https://github.com/modelcontextprotocol/python-sdk). Updates `mcp` from 1.12.2 to 1.23.0 - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.12.2...v1.23.0) --- updated-dependencies: - dependency-name: mcp dependency-version: 1.23.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…updates (#274) Bumps the npm_and_yarn group with 1 update in the /CATACLYSM_STUDIOS_INC/PMOVES-PROVISIONS/docker-stacks/jellyfin-ai/api-gateway directory: [jws](https://github.com/brianloveswords/node-jws). Bumps the npm_and_yarn group with 2 updates in the /pmoves/ui directory: [next](https://github.com/vercel/next.js) and [mdast-util-to-hast](https://github.com/syntax-tree/mdast-util-to-hast). Updates `jws` from 3.2.2 to 3.2.3 - [Release notes](https://github.com/brianloveswords/node-jws/releases) - [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md) - [Commits](auth0/node-jws@v3.2.2...v3.2.3) Updates `next` from 16.0.0 to 16.0.7 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v16.0.0...v16.0.7) Updates `mdast-util-to-hast` from 13.2.0 to 13.2.1 - [Release notes](https://github.com/syntax-tree/mdast-util-to-hast/releases) - [Commits](syntax-tree/mdast-util-to-hast@13.2.0...13.2.1) --- updated-dependencies: - dependency-name: jws dependency-version: 3.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.0.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mdast-util-to-hast dependency-version: 13.2.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: POWERFULMOVES <142271328+POWERFULMOVES@users.noreply.github.com>
Brings in all features from main branch to PMOVES.AI-Edition-Hardened: Centralized PMOVES UI: - Service catalog with 55 services across 11 tiers - Real-time health monitoring with SystemStatsBar - Tier-based navigation and filtering - Neo-brutalism design with Cataclysm Studios branding - Hub view with system overview and quick stats New Submodules: - PMOVES-n8n: n8n workflow automation - PMOVES-crush: PMOVES-Crush deployment tooling - PMOVES-Pipecat: Voice communication framework - PMOVES-Ultimate-TTS-Studio: Multi-engine TTS - PMOVES-Pinokio-Ultimate-TTS-Studio: Pinokio integration - PMOVES-tensorzero: TensorZero gateway - Pmoves-hyperdimensions: Hyperdimensional computing - pmoves/vendor/agentgym-rl: RL training framework - pmoves/vendor/e2b: E2B Danger Room Documentation Updates: - CLAUDE.md: Updated with new service catalog and workflows - CI/CD: Enhanced with self-hosted runners - Testing: Comprehensive test strategy and coverage requirements Preserves hardened branch security commits: - 17 security hardening commits remain intact - PBnJ deployment infrastructure - Cloud School IAM strategy 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
**A2UI NATS Bridge Service:** - Bridges Google A2UI (Agent-to-User Interface) events to PMOVES geometry bus - REST API at /api/v1/a2ui for A2UI JSON events - WebSocket at /ws/a2ui for A2UI agents (JSONL format) - WebSocket at /ws/client for PMOVES UI subscribers - Publishes to a2ui.render.v1 subject on NATS - Subscribes to geometry.> for bidirectional communication - Prometheus metrics: a2ui_events_published, a2ui_active_websockets **A2UI Format Support (v0.9):** - createSurface / beginRendering: Initialize UI surface - updateComponents / surfaceUpdate: Add/update UI components - updateDataModel / dataModelUpdate: Update data bindings - userAction: Forward user interactions to agents **NATS WebSocket Enablement:** - Added WebSocket support to NATS service - Flags: -ws -ws_port 4223 - Exposed on host port 9223 (9223:4223) This enables: 1. A2UI agents to generate declarative UIs for PMOVES 2. Real-time UI updates via NATS geometry bus 3. Browser-based WebSocket connections to NATS 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…ty) (#400) The websockets library's extra_headers parameter is not supported by uvloop's create_connection(), which is used by uvicorn. Removed the extra_headers parameter and rely on the apikey URL parameter for Supabase realtime authentication. Also: - Add pmoves/vendor/python/ to .gitignore (unpacked packages) - Remove 275+ unpacked package files from git tracking Vendor submodules were already configured with POWERFULMOVES forks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
) * fix(security): NATS authentication and event queuing Critical security and reliability fixes: - Add NATS authentication support (user/pass via env vars) - Add event queuing when NATS is disconnected (buffer up to 1000 events) - Flush buffered events automatically on reconnection - Update docker-compose.yml with NATS auth configuration - Add NATS_USER/NATS_PASS environment variables 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(deploy): publisher-discord now loads env.shared for DISCORD_WEBHOOK_URL The publisher-discord service was using <<: *env-tier-agent which only loads env.tier-agent and .env.local, but DISCORD_WEBHOOK_URL is stored in env.shared. Updated the service to use explicit env_file configuration that includes env.shared, similar to gateway-agent pattern. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix(pr398): backend service fixes from PR #396 review 1. **agent_zero/controller.py** - Better unsubscribe logging - Extract `subject` attribute for better debugging - Replace silent `pass` with warning log 2. **comfy-watcher/watcher.py** - Remove redundant local import - `timedelta` already imported at module level These fixes address CodeRabbit review comments from PR #396. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(pr398): add _parse_int_env helper and improve error handling 1. **comfy-watcher/watcher.py** - Comprehensive error handling - Add `_parse_int_env()` helper with validation - Add corrupted state file backup with timestamp - Replace bare `except:` with specific exception types - Add logging module for proper error tracking - Add comprehensive docstrings 2. **hi-rag-gateway-v2/app.py** - Safer environment parsing - Add `_parse_int_env()` helper with validation - Replace unsafe `int(os.environ.get())` calls: - NEO4J_DICT_REFRESH_SEC, NEO4J_DICT_LIMIT - ENTITY_CACHE_TTL, ENTITY_CACHE_MAX - GEOMETRY_CACHE_WARM_LIMIT, HTTP_PORT, PGPORT 3. **session-context-worker/main.py** - Error handling improvements - Add `_parse_int_env()` helper for HEALTH_PORT - Add `_nats_loop_done()` callback for crash detection - Import missing `Msg` type from nats.aio.msg 4. **jellyfin-bridge/main.py** - Task cleanup - Store and cancel autolink task on shutdown - Remove unused imports (contextlib, suppress) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(codereview): address critical review comments from PR #398 - session-context-worker: Move if __name__ guard AFTER app definition (was causing NameError at runtime) - tokenism-simulator: Fix lock ordering to prevent deadlock (must use _results_lock, _status_lock consistently) - hi-rag-gateway-v2: Use logger.warning() for general config parsing (not rerank-specific _RERANK_CONFIG_WARNINGS list) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * style(session-context-worker): remove redundant inline string literals Remove non-docstring triple-quoted strings inside lifespan function body (lines 95, 103) that were creating confusion. Keep actual function docstring. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(session-context-worker): add payload schema validation - Load schemas from services/common/events.py at startup - Validate incoming claude.code.session.context.v1 payloads - Validate outgoing kb.upsert.request.v1 payloads - Prevents schema drift between publishers and consumers - Follows coding guideline: "Validate payloads against schemas before publishing events using services/common/events.py" 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
…365) * feat(cli): rebrand Crush CLI to PMOVES CLI Update user-facing branding from "Crush CLI" to "PMOVES CLI" while maintaining backward compatibility with existing Crush infrastructure. Changes: - Update crush_app help text: "Crush CLI integration" → "PMOVES CLI integration" - Update crush_configurator.py docstring to emphasize PMOVES deployment - Update command help texts for setup/status/preview commands - Update user-facing documentation in .claude/commands/crush/ Rationale: The "Crush" name originated as an internal codename but the production CLI should reflect the PMOVES brand for consistency with the broader PMOVES.AI ecosystem. The underlying "crush" command name and file paths are preserved for backward compatibility. Modified Files: - pmoves/tools/mini_cli.py - pmoves/tools/crush_configurator.py - .claude/commands/crush/setup.md - .claude/commands/crush/status.md 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * feat(cli): add PMOVES Agent SDK commands to mini CLI Implement agent-sdk sub-commands for creating and managing PMOVES Agent instances with full ecosystem access via interactive CLI wizard. Features Implemented: - `pmoves agent-sdk create` - Interactive wizard for agent creation - 5 agent roles: researcher, code-reviewer, media-processor, knowledge-manager, general - Role-based tool and subagent configuration - Automatic NATS, TensorZero, and Hi-RAG connection - Unique agent ID generation with timestamps - Beautiful formatted output with configuration summary - `pmoves agent-sdk run` - Execute tasks with existing agents - Task execution with streaming output - Model override support - Session resumption capability - `pmoves agent-sdk list` - List agent instances - Status filtering - Configurable limit (placeholder for SessionManager integration) - `pmoves agent-sdk status` - Check agent status - NATS heartbeat monitoring - Active agent information (placeholder for SessionManager) Technical Details: - Integrated with PMOVES-BoTZ Agent SDK - Async/await pattern for agent lifecycle management - Interactive role selection with graceful Ctrl+C handling - Comprehensive error handling for missing dependencies - Auto-discovery of PMOVES-BoTZ submodule Usage Examples: ```bash # Interactive agent creation pmoves agent-sdk create # Pre-select role pmoves agent-sdk create --role researcher # Execute task pmoves agent-sdk run pmoves-researcher-1735123456 "Analyze architecture" # List agents pmoves agent-sdk list --status active --limit 50 ``` Related Documentation: - .claude/commands/agent-sdk/create.md - .claude/commands/agent-sdk/run.md - .claude/commands/agent-sdk/resume.md 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * docs(agent-sdk): update CLI documentation for run and resume commands Update user-facing documentation for agent-sdk CLI commands to reflect the new PMOVES CLI integration pattern. Changes: - `.claude/commands/agent-sdk/run.md` - Updated from skill-based to CLI command documentation - Added usage examples with `pmoves agent-sdk run` - Documented arguments and options - Added troubleshooting section - `.claude/commands/agent-sdk/resume.md` - Updated from skill-based to CLI command documentation - Added session management workflow - Documented session states and storage backends - Added troubleshooting section Documentation Pattern: All agent-sdk command documentation now follows a consistent pattern: - Usage section with use cases - Implementation section with CLI examples - Arguments and options tables - What It Does checklist - Related commands section - Notes and troubleshooting This aligns with the create.md documentation updated in the previous implementation phase. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix(agent-sdk): address all PR #365 review comments Fix all 14 issues from comprehensive PR review across error handling, documentation, and code quality improvements. Critical Fixes (4): - Make NATS connection mandatory with ConnectionError on failure - Add two-layer error handling to task execution - Replace generic Exception catches with specific error types - Exit with code 1 on all failure paths Documentation (5): - Correct NATS event subjects (remove non-existent events) - Add prerequisites sections to all agent-sdk docs - Fix example code placeholders with runnable examples - Update model IDs (remove date suffixes) - Document storage backends and timeouts Improvements (5): - Add Google-style docstrings to key functions (≥80% coverage) - Enhance Crush configurator docstrings - Improve list/status placeholders with NATS monitoring guidance - Fix context manager usage pattern - Add comprehensive timeout documentation All syntax checks pass. Docstring coverage ≥80%. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
PMOVES-Agent-Zero (5cbda82): - Add TensorZero gateway provider configuration - Chat and embedding providers at http://tensorzero-gateway:3000/v1 PMOVES-BoTZ (b39e3b4): - Add agent SDK integration for Claude Agent SDK - Add MCP bridge for external service communication - Add glancer feature for quick data inspection - Fix circular imports in AgentGym RL trainer - Add gateway docker-compose and N8N MCP integration PMOVES-ToKenism-Multi (9981589): - Update contract schemas (audio, entities, persona) - Update UI components (charts, simulation results) - Add skeleton UI component - Update integration submodules (DoX, Firefly-iii) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Merge PR #393 - Geometric framework upgrade - Merged main's github-runner-ctl service configuration - Removed duplicate @DataClass decorator in controller.py - Fixed env.tier-agent environment variables 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…rs (#321) Comprehensive GEOMETRY BUS integration across PMOVES.AI services with CHIT shape attribution support. - CGP publishing to `tokenism.cgp.ready.v1` in DeepResearch and SupaSerch - CHIT voice attribution events in Flute Gateway - CHIT event subscriptions in Publisher Discord - Prometheus metrics and /metrics endpoint for DeepResearch - Proper error handling separation (build vs publish errors) - TensorZero mode with Ollama model support 🤖 Generated with [Claude Code](https://claude.com/claude-code)
…ization (#343) * feat(geometry-bus): add submodules and CHIT mathematical documentation Registers previously half-initialized submodules and adds new ones: - PMOVES-Pinokio-Ultimate-TTS-Studio: TTS Pinokio package - PMOVES-tensorzero: Full TensorZero codebase - Pmoves-hyperdimensions: Three.js parametric surface visualizer Adds PMOVESCHIT mathematical foundation documentation: - Hyperbolic geometry (Poincaré Disk Model) - Riemann zeta dynamics for spectral filtering - Holographic principle for dimensional encoding - Human_side prosodic sidecar for voice agents This establishes the mathematical framework for CGP v2 (CHIT Geometry Packets) used in cross-modal GEOMETRY BUS communication. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(geometry-bus): add CHIT and hyperdimensions TAC commands Adds 7 new TAC commands for GEOMETRY BUS interaction: CHIT Commands: - /chit:encode - Encode data as CGP v2 packet - /chit:decode - Decode and validate CGP v2 packets - /chit:visualize - Render packet geometry via hyperdimensions - /chit:bus - Publish/subscribe to GEOMETRY BUS Hyperdimensions Commands: - /hyperdim:render - Render parametric surfaces (Poincaré, zeta, etc.) - /hyperdim:animate - Create animated visualizations - /hyperdim:export - Export to GLTF, STL, PNG formats Updates geometry-nats-subjects.md with: - CHIT packet lifecycle events (encoded/decoded) - Visualization request/ready events - EvoSwarm population and solution events - tokenism.transform.v1 for transformations - TAC command integration table 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs: align PMOVESCHIT, Flute, and persona documentation with implementation Phase 1: Document Consolidation - Add deprecation notices to duplicate Flute Architecture docs Phase 2: PMOVESCHIT Core Updates - Create IMPLEMENTATION_STATUS.md tracking TypeScript/Python modules - Add implementation cross-references to PMOVESCHIT.md - Add status banners to decoder specification docs Phase 3: Flute Voice Documentation - Create FLUTE_PROSODIC_ARCHITECTURE.md (boundary types, TTFS optimization) - Create voice-personas.md (Supabase schema, provider configs) Phase 4: CATACLYSM & Personas - Create PERSONAS.md with math-enhanced 325+ persona framework - Add implementation links to CATACLYSM_STUDIOS_INC.md Phase 5: Cross-Reference Index - Create documentation-index.md navigation matrix 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Cherry-picked from: f6385c9 feat(infra): Restore seed scripts from main branch Changes: - Added seed_jellyfin_media.py Note: seed_studio_board.sh already exists in target, kept existing version
Cherry-picked from: 4e09c1f fix(tests): Address test failures and improve docstring coverage Changes: - Fixed env.tier-worker placeholder values - Fixed volume naming in fresh deployment tests - Added docstrings to 6 tool files Note: Kept existing docker-compose.yml from target
- Replaced chit/__init__.py with PR version (has save_cgp, write_to_tier_envs, etc.) - Replaced chit/codec.py with PR version - Replaced mini_cli.py with PR version (has 'env' command) - Fixed placeholder value in env.tier-media
- POSTGRES_PASSWORD (matching across tier-data and tier-api) - SUPABASE_JWT_SECRET Note: 11 remaining test failures are: - 7x YAML stub issues (test setup, not production issue) - 4x Legacy .env.generated references (requires docker-compose.yml changes)
Combines changes from PRs #454-#461: - 6-tier environment architecture with CHIT v2 - Seed scripts restoration - Test improvements and docstring coverage - CHIT v2 encoding/decoding functions - All other changes already present in hardened Test Results: - 45 passed, 11 skipped, 7 warnings - 11 failures are test setup issues (YAML stub) and legacy .env.generated references 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Changed &env-tier-data to &id001 to match existing service references - Changed &env-tier-api to &id002 - Changed &env-tier-worker to &id003 - Changed &env-tier-media to &id004 - Changed &env-tier-agent to &id005 - Changed &env-tier-llm to &id006 - Changed &env-tier-ui to &id007 - Updated all <<: *env-tier-* references to use *id00* format This fixes docker-compose config validation errors.
This commit restores 19,668 files that were accidentally deleted in commit 4490fcd. ## Files Restored ### .claude/ (110 files) - CLAUDE.md - Claude Code configuration - README.md - Documentation index - commands/ - 70+ command documentation files - context/ - Architecture context files - hooks/ - Pre/post tool execution hooks - scripts/ - Utility scripts - learnings/ - Project learning documents ### Other Files - .github/workflows/ - CI/CD workflows - .vscode/mcp.json - MCP server configuration All files restored from PMOVES.AI-Edition-Hardened branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> # Conflicts: # .claude/CLAUDE.md # .claude/README.md # .claude/commands/agent-sdk/create.md # .claude/commands/agent-sdk/resume.md # .claude/commands/agent-sdk/run.md # .claude/commands/crush/setup.md # .claude/commands/crush/status.md # .claude/context/documentation-index.md # .claude/context/nats-subjects.md # .claude/context/python-patterns.md # .claude/context/submodules.md # .claude/context/tensorzero.md # .claude/hooks/post-tool.sh # .claude/learnings/pr366-self-hosted-runner-2025-12.md # .dockerignore # .github/CODEOWNERS # .github/dependabot.yml # .github/workflows/build-images.yml # .github/workflows/chit-contract.yml # .github/workflows/env-preflight.yml # .github/workflows/integrations-ghcr.yml # .github/workflows/python-tests.yml # .github/workflows/self-hosted-builds-hardened.yml # .github/workflows/self-hosted-builds.yml # .github/workflows/sql-policy-lint.yml # .github/workflows/webhook-smoke.yml # .github/workflows/yt-dlp-bump.yml # AGENTS.md # CATACLYSM_STUDIOS_INC/ABOUT/Cataclysm Studios Platform Vision & Brand Identity.md # CATACLYSM_STUDIOS_INC/PMOVES-PROVISIONS/docker-stacks/jellyfin-ai/api-gateway/package-lock.json # CATACLYSM_STUDIOS_INC/PMOVES-PROVISIONS/docker-stacks/jellyfin-ai/api-gateway/package.json # Open-Source Model Recommendations for PMOVES by Service & Deployment Context.md # PMOVES-DoX # README.md # deploy/README.md # docs/PMOVES Multimodal Communication Layer (“Flute”) – Architecture & Roadmap.md # docs/PMOVES-claude code integrate.md # docs/PMOVES.AI Services and Integrations.md # docs/PMOVES.AI-Edition-Hardened-Full.md # docs/PMOVES.AI-Edition-Hardened-Summary.md # docs/PMOVES_Git_Organization.md # docs/PMOVES_Repository_Index.md # docs/PMOVES_TensorZero_Implementation.md # docs/SECRETS.md # docs/SECRETS_ENTRY_SCRIPT.md # docs/SECRETS_ONBOARDING.md # docs/TensorZero_Implementation_Review.md # docs/testing/TESTING.md # docs/tz.md # pmoves/.dockerignore # pmoves/.env.example # pmoves/compose/docker-compose.firefly.yml # pmoves/compose/docker-compose.wger.yml # pmoves/compose/n8n/Dockerfile # pmoves/config/channel_monitor.json # pmoves/contracts/solidity/package-lock.json # pmoves/contracts/topics.json # pmoves/docker-compose.agents.images.yml # pmoves/docker-compose.agents.integrations.yml # pmoves/docker-compose.archon-ui.submodule.yml # pmoves/docker-compose.archon.submodule.yml # pmoves/docker-compose.external.yml # pmoves/docker-compose.gpu-image.yml # pmoves/docker-compose.hardened.yml # pmoves/docker-compose.n8n.yml # pmoves/docker-compose.open-notebook.yml # pmoves/docker-compose.vps.override.yml # pmoves/docker/ultimate-tts-studio/Dockerfile # pmoves/docs/CI_IMAGES.md # pmoves/docs/EXTERNAL_INTEGRATIONS_BRINGUP.md # pmoves/docs/LOCAL_DEV.md # pmoves/docs/LOCAL_TOOLING_REFERENCE.md # pmoves/docs/NEXT_STEPS.md # pmoves/docs/PMOVES.AI PLANS/CREATOR_PIPELINE.md # pmoves/docs/PMOVES.AI PLANS/Enhanced Media Stack with Advanced AudioVideo Analysis/requirements.txt # pmoves/docs/PMOVES.AI PLANS/HI-RAG_UPGRADE.md # pmoves/docs/PMOVES.AI PLANS/HI_RAG_RERANKER.md # pmoves/docs/PMOVES.AI PLANS/JELLYFIN_YOUTUBE_INTEGRATION.md # pmoves/docs/PMOVES.AI PLANS/LOCAL_DEV.md # pmoves/docs/PMOVES.AI PLANS/M2_AUTOMATION_COMPLETED.md # pmoves/docs/PMOVES.AI PLANS/N8N_CHECKLIST.md # pmoves/docs/PMOVES.AI PLANS/N8N_SETUP.md # pmoves/docs/PMOVES.AI PLANS/NEXT_STEPS.md # pmoves/docs/PMOVES.AI PLANS/PMOVES.yt/GRAYJAY_JELLYFIN_BRIDGE.md # pmoves/docs/PMOVES.AI PLANS/README_DOCS_INDEX.md # pmoves/docs/PMOVES.AI PLANS/REALTIME_LISTENER.md # pmoves/docs/PMOVES.AI PLANS/ROADMAP.md # pmoves/docs/PMOVES.AI PLANS/SESSION_IMPLEMENTATION_PLAN.md # pmoves/docs/PMOVES.AI PLANS/SMOKETESTS.md # pmoves/docs/PMOVES.AI PLANS/SUPABASE_DISCORD_AUTOMATION.md # pmoves/docs/PMOVES.AI PLANS/requirements.txt # pmoves/docs/PMOVESCHIT/CATACLYSM_STUDIOS_INC.md # pmoves/docs/PMOVESCHIT/Constellation-Harvest-Regularization/requirements.txt # pmoves/docs/PMOVESCHIT/GEOMETRY_BUS_INTEGRATION.md # pmoves/docs/PMOVESCHIT/IMPLEMENTATION_STATUS.md # pmoves/docs/PMOVESCHIT/PMOVES-CONCHexecution_guide.md # pmoves/docs/PMOVESCHIT/PMOVESCHIT.md # pmoves/docs/PMOVESCHIT/PMOVESCHIT_DECODER_MULTIv0.1.md # pmoves/docs/PMOVESCHIT/PMOVESCHIT_DECODERv0.1.md # pmoves/docs/SESSION_IMPLEMENTATION_PLAN.md # pmoves/docs/SMOKETESTS.md # pmoves/docs/context/PMOVES Multimodal Communication Layer (“Flute”) – Architecture & Roadmap.md # pmoves/docs/context/k_furthest_neighbors_(kfn).py # pmoves/docs/context/py_and_collabs/agentic_self_learning_smollm3_colab.py # pmoves/docs/context/py_and_collabs/doc2structure.py # pmoves/docs/context/py_and_collabs/k_furthest_neighbors_(kfn).py # pmoves/docs/context/py_and_collabs/memory_decoder_colab.py # pmoves/docs/context/py_and_collabs/the_human_construct_neural_network.py # pmoves/docs/context/py_and_collabs/topology_capsules_v1_0.py # pmoves/docs/context/topology_capsules_v1_0.py # pmoves/docs/pmoves-model-management-starter/README.md # pmoves/docs/services/agent-zero/README.md # pmoves/docs/services/archon/HEADLESS_RUNBOOK.md # pmoves/docs/services/archon/README.md # pmoves/docs/services/extract-worker/README.md # pmoves/docs/services/hi-rag-gateway-v2/README.md # pmoves/docs/services/jellyfin/README.md # pmoves/docs/services/open-notebook/README.md # pmoves/docs/services/open-notebook/TENSORZERO_OBSERVABILITY_NOTES.md # pmoves/docs/services/wger/README.md # pmoves/docs/venice-tensorzero-integration/README.md # pmoves/env.shared.example # pmoves/env.tier-api # pmoves/env.tier-data # pmoves/env.tier-llm # pmoves/env.tier-media # pmoves/integrations/archon # pmoves/monitoring/prometheus/alert.rules.yml # pmoves/n8n/flows/approval_poller.json # pmoves/n8n/flows/debug_cron.json # pmoves/n8n/flows/echo_publisher.json # pmoves/n8n/flows/finance_firefly_sync.json # pmoves/n8n/flows/finance_monthly_to_cgp.json # pmoves/n8n/flows/finance_monthly_to_cgp.webhook.json # pmoves/n8n/flows/firefly_sync_to_supabase.json # pmoves/n8n/flows/health_weekly_to_cgp.json # pmoves/n8n/flows/health_weekly_to_cgp.webhook.json # pmoves/n8n/flows/health_wger_sync.json # pmoves/n8n/flows/qwen_to_cgp.webhook.json # pmoves/n8n/flows/vibevoice_to_cgp.webhook.json # pmoves/n8n/flows/wan_to_cgp.webhook.json # pmoves/n8n/flows/wger_sync_to_supabase.json # pmoves/n8n/flows/yt_docs_sync_diff.json # pmoves/scripts/bootstrap_env.py # pmoves/services/__init__.py # pmoves/services/a2ui-nats-bridge/bridge.py # pmoves/services/agent-zero/Dockerfile # pmoves/services/agent-zero/Dockerfile.multiarch # pmoves/services/agent-zero/main.py # pmoves/services/agent-zero/mcp_server.py # pmoves/services/agent-zero/requirements.txt # pmoves/services/agent_zero/controller.py # pmoves/services/agentgym-rl-coordinator/app.py # pmoves/services/agentgym-rl-coordinator/coordinator/trajectory.py # pmoves/services/analysis-echo/Dockerfile # pmoves/services/analysis-echo/requirements.txt # pmoves/services/archon/Dockerfile # pmoves/services/archon/README.md # pmoves/services/archon/main.py # pmoves/services/archon/requirements.txt # pmoves/services/channel-monitor/Dockerfile # pmoves/services/channel-monitor/channel_monitor/main.py # pmoves/services/channel-monitor/channel_monitor/monitor.py # pmoves/services/channel-monitor/requirements.txt # pmoves/services/comfy-watcher/Dockerfile # pmoves/services/comfy-watcher/requirements.txt # pmoves/services/comfy-watcher/watcher.py # pmoves/services/common/__init__.py # pmoves/services/common/cgp_mappers.py # pmoves/services/common/events.py # pmoves/services/consciousness-service/cgp_mapper.py # pmoves/services/consciousness-service/persona_gate.py # pmoves/services/deepresearch/Dockerfile # pmoves/services/deepresearch/__init__.py # pmoves/services/deepresearch/parser.py # pmoves/services/deepresearch/requirements.txt # pmoves/services/deepresearch/tests/__init__.py # pmoves/services/deepresearch/tests/test_parsing.py # pmoves/services/deepresearch/tests/test_worker.py # pmoves/services/deepresearch/worker.py # pmoves/services/evo-controller/app.py # pmoves/services/evo-controller/requirements.txt # pmoves/services/extract-worker/Dockerfile # pmoves/services/extract-worker/requirements.lock # pmoves/services/extract-worker/requirements.txt # pmoves/services/extract-worker/worker.py # pmoves/services/ffmpeg-whisper/Dockerfile # pmoves/services/ffmpeg-whisper/requirements.txt # pmoves/services/ffmpeg-whisper/server.py # pmoves/services/flute-gateway/main.py # pmoves/services/flute-gateway/providers/cloning.py # pmoves/services/gateway/Dockerfile # pmoves/services/gateway/gateway/main.py # pmoves/services/gateway/requirements.txt # pmoves/services/gateway/tests/test_geometry_endpoints.py # pmoves/services/gateway/tests/test_mindmap_endpoint.py # pmoves/services/gateway/tests/test_workflow_utils.py # pmoves/services/graph-linker/Dockerfile # pmoves/services/graph-linker/requirements.txt # pmoves/services/grayjay-plugin-host/Dockerfile # pmoves/services/grayjay-plugin-host/requirements.txt # pmoves/services/hi-rag-gateway/Dockerfile # pmoves/services/hi-rag-gateway/gateway.py # pmoves/services/hi-rag-gateway/requirements.txt # pmoves/services/invidious-companion-proxy/Dockerfile # pmoves/services/jellyfin-bridge/Dockerfile # pmoves/services/jellyfin-bridge/main.py # pmoves/services/jellyfin-bridge/requirements.txt # pmoves/services/langextract/Dockerfile # pmoves/services/langextract/api.py # pmoves/services/langextract/requirements.txt # pmoves/services/mcp_youtube_adapter.py # pmoves/services/media-audio/requirements.txt # pmoves/services/media-video/Dockerfile # pmoves/services/media-video/requirements.txt # pmoves/services/mesh-agent/Dockerfile # pmoves/services/n8n/workflows/pmoves_comfy_gen.json # pmoves/services/n8n/workflows/pmoves_content_approval.json # pmoves/services/n8n/workflows/pmoves_echo_ingest.json # pmoves/services/nats-echo/Dockerfile # pmoves/services/notebook-sync/Dockerfile # pmoves/services/notebook-sync/requirements.txt # pmoves/services/notebook-sync/sync.py # pmoves/services/pdf-ingest/Dockerfile # pmoves/services/pdf-ingest/app.py # pmoves/services/pdf-ingest/requirements.txt # pmoves/services/pmoves-yt/Dockerfile # pmoves/services/pmoves-yt/README.md # pmoves/services/pmoves-yt/requirements.lock # pmoves/services/pmoves-yt/requirements.txt # pmoves/services/pmoves-yt/tests/test_docs_catalog.py # pmoves/services/pmoves-yt/tests/test_rate_limit.py # pmoves/services/pmoves-yt/yt.py # pmoves/services/presign/Dockerfile # pmoves/services/presign/api.py # pmoves/services/presign/requirements.txt # pmoves/services/publisher-discord/Dockerfile # pmoves/services/publisher-discord/main.py # pmoves/services/publisher-discord/requirements.txt # pmoves/services/publisher-discord/tests/test_formatting.py # pmoves/services/publisher/Dockerfile # pmoves/services/publisher/publisher.py # pmoves/services/publisher/requirements.txt # pmoves/services/publisher/tests/test_publisher.py # pmoves/services/render-webhook/Dockerfile # pmoves/services/render-webhook/requirements.txt # pmoves/services/render-webhook/webhook.py # pmoves/services/retrieval-eval/Dockerfile # pmoves/services/retrieval-eval/eval_utils.py # pmoves/services/retrieval-eval/requirements.txt # pmoves/services/session-context-worker/requirements.lock # pmoves/services/session-context-worker/test_transform.py # pmoves/services/supaserch/Dockerfile # pmoves/services/supaserch/app.py # pmoves/services/supaserch/requirements.txt # pmoves/services/vibevoice-realtime/Dockerfile # pmoves/tensorzero/clickhouse/users.xml # pmoves/tensorzero/config/tensorzero.toml.example # pmoves/tests/conftest.py # pmoves/tests/test_hirag_gateway.py # pmoves/tests/test_mini_cli.py # pmoves/tests/test_multiagent_workflow.py # pmoves/tests/test_pmoves_yt.py # pmoves/tools/flightcheck/retro_flightcheck.py # pmoves/tools/push-gh-secrets.sh
Change 'language: "python"' to 'language: "en"' to fix CodeRabbit parsing warning. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
## Changes
### 1. Remove hardcoded credentials from env.tier-data (CRITICAL)
- POSTGRES_PASSWORD: Replace hardcoded value with ${POSTGRES_PASSWORD:-changeme}
- NEO4J_AUTH: Replace hardcoded value with ${NEO4J_PASSWORD:-changeme}
- Users must now set these via environment variables
### 2. Fix overly permissive RLS policies (CRITICAL)
- Replace USING (true) with namespace-based tenant isolation
- Tables affected: anchors, constellations, shape_points, shape_index, detections, segments, emotions
- Policies now use: current_setting('app.current_tenant', true)
- Fallback to 'pmoves' namespace for default tenant
### 3. Secure ClickHouse healthcheck URLs (CRITICAL)
- Remove hardcoded credentials from healthcheck URLs
- Use ${CLICKHOUSE_USER} and ${CLICKHOUSE_PASSWORD} environment variables
- Also fixed TENSORZERO_CLICKHOUSE_URL with same approach
## Security Impact
These changes address CRITICAL vulnerabilities found in code review:
- Hardcoded production credentials removed from version control
- Database row-level security now implements proper tenant isolation
- Process list no longer exposes ClickHouse credentials
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Remove 'documentation' and 'review' sections that are not recognized by CodeRabbit. These keys were causing parsing warnings. The 'reviews' section with review_status and branches is kept intact. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…ructure This ensures the security fixes from PMOVES.AI-Edition-Hardened are present when merging PR #473. Fixes: 1. env.tier-data - Remove hardcoded credentials - POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme} - NEO4J_AUTH: neo4j/${NEO4J_PASSWORD:-changeme} 2. pmoves/supabase/initdb/06_media_analysis.sql - Restore with tenant isolation - Replaced USING (true) with namespace-based tenant isolation - Policies check app.current_tenant setting 3. pmoves/supabase/initdb/09_geometry_rls.sql - Restore with tenant isolation - Replaced USING (true) with namespace-based tenant isolation - Read policies check app.current_tenant setting 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
read_shape_points_tenant -> read_shape_index_tenant
…d' into PMOVES.AI-Edition-Hardened # Conflicts: # features/gateway/docker-compose.yml
… Consciousness docs from main branch This commit restores critical documentation and implementation files that were missing from the PMOVES.AI-Edition-Hardened branch. ## Evoswarm Implementation (9 files) - CRITICAL - .claude/context/evoswarm.md - Evoswarm context documentation - pmoves/docs/context/py_and_collabs/evoswarm_evolutionary_test_time_optimization_for_llm_agents.py - pmoves/docs/context/py_and_collabs/EvoSwarm_Evolutionary_Test_Time_Optimization_for_LLM_Agents.ipynb - pmoves/docs/architecture/evoswarm-agentgym-rl-integration.md - pmoves/docs/architecture/evoswarm-agentgym-rl-quickstart.md - pmoves/docs/notes/chit_evoswarm_gan_plan.md - pmoves/contracts/schemas/geometry/swarm.meta.v1.schema.json - pmoves/supabase/migrations/2025-10-18_geometry_swarm.sql (FIXED: tenant-isolated RLS) - pmoves/db/v5_13_geometry_swarm.sql ## CHIT Documentation (5 files) - pmoves/docs/PMOVESCHIT/Human_side.md - pmoves/docs/PMOVESCHIT/Integrating Math into PMOVES.AI.md - pmoves/docs/PMOVESCHIT/Mathematical_UI_Design_Specification.md - pmoves/docs/PMOVESCHIT/Mathematical_UI_Implementation_Plan.md - pmoves/docs/PMOVESCHIT/PMOVES-CONCHexecution_guideb.md ## Constellation-Harvest-Regularization (3 files) - pmoves/docs/PMOVESCHIT/Constellation-Harvest-Regularization/README.md - pmoves/docs/PMOVESCHIT/Constellation-Harvest-Regularization/app.py (18KB) - pmoves/docs/PMOVESCHIT/Constellation-Harvest-Regularization/Understanding Range-Partition-Entropy (RPE).docx ## Flute Architecture (2 files) - .claude/context/flute-gateway.md - pmoves/monitoring/grafana/dashboards/flute-gateway.json ## Geometry Bus (5 files) - pmoves/services/common/geometry_params.py - pmoves/services/gateway/scripts/mini_geometry_decode.py - pmoves/services/gateway/scripts/chit_client.py - pmoves/services/gateway/scripts/chit_sign.py - pmoves/supabase/migrations/2025-09-08_geometry_bus.sql - pmoves/supabase/migrations/2025-10-18_geometry_swarm_compat.sql - pmoves/supabase/migrations/2025-10-20_geometry_cgp_views.sql ## Consciousness/Persona (4 files) - pmoves/docs/PERSONAS.md - pmoves/datasets/personas/ (directory with persona files) - pmoves/services/gateway/gateway/api/consciousness.py - pmoves/services/gateway/tests/test_consciousness_demo.py ## Security Fixes Applied - Fixed RLS policies in 2025-10-18_geometry_swarm.sql to use tenant isolation - Excluded insecure 2025-09-08_geometry_bus_rls.sql (hardened version exists) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Contributor
|
Important Review skippedToo many files! 89 files out of 239 files are above the max files limit of 150. You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
To fix the problem, explicitly declare least-privilege permissions for the workflow or the specific job. Since this workflow only needs to check out code and run tests, the minimal safe setting is contents: read. This constrains the GITHUB_TOKEN to read-only access to repository contents, avoiding default, potentially broader write permissions.
The best way to fix it without changing existing behavior is to add a permissions block at the workflow (top) level, just after the on: section and before jobs:. This will apply to all jobs in the workflow (currently just tests) and is enough for actions/checkout@v4 to work. No other permissions appear necessary because the workflow doesn’t interact with issues, pull requests, packages, or environments using the token.
Concretely:
- Edit
.github/workflows/python-tests.yml. - Insert:
permissions:
contents: readafter the on: block (after line 25 in the provided snippet), leaving the rest of the workflow unchanged.
- No new imports, actions, or methods are needed.
Suggested changeset
1
.github/workflows/python-tests.yml
| @@ -23,6 +23,9 @@ | ||
| - '.github/workflows/python-tests.yml' | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| tests: | ||
| runs-on: ubuntu-latest |
Copilot is powered by AI and may make mistakes. Always verify output.
This commit addresses critical issues preventing service bringup on the
hardened branch before submodule restructure.
**CHIT Secrets Management (secrets_manifest_v2.yaml):**
- Add 14 missing keys to manifest v2 for llm tier:
- OTEL_EXPORTER_OTLP_TRACES_ENDPOINT
- TENSORZERO_GATEWAY_URL, TENSORZERO_CLICKHOUSE_*
- TENSORZERO_PG_* (database config)
- VENICE_API_KEY, Z_AI_API_KEY, MOONSHOT_API_KEY
- CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN
- OLLAMA_URL (client compatibility)
- Manifest now has 33 llm tier entries (was 19)
**Make Targets (Makefile):**
- Add `chit-apply-manifest` target for applying v2 manifest to tier env files
- Uses pmoves.chit.apply_manifest_v2() from CHIT module
**Docker Compose Fixes:**
- Add pmoves_data network to tensorzero-gateway (ClickHouse connectivity)
- Fix INVIDIOUS env interpolation: change ${VAR:?required} to ${VAR:-default}
- invidious service: INVIDIOUS_HMAC_KEY, INVIDIOUS_COMPANION_KEY
- invidious-companion service: SERVER_SECRET_KEY
- Services now load keys from env.tier-media without manual exports
**Documentation (from main branch):**
- Copy 5 critical documentation files to hardened branch:
- tier-architecture.md: 6-tier env + 5-tier network model
- services-catalog.md: Complete service listing with dynamic ports
- nats-subjects.md: Comprehensive NATS subject catalog
- geometry-nats-subjects.md: GEOMETRY BUS subjects
- docs/PORT_REGISTRY.md: Port allocation registry
**Fixes Issues:**
- TensorZero Gateway can now reach ClickHouse via pmoves_data network
- INVIDIOUS services start without manual variable exports
- CHIT manifest v2 workflow is complete and functional
- All tier env files auto-populate via `make chit-apply-manifest`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Owner
Author
New Commit: CHIT v2 Secrets Management and Docker FixesJust pushed commit CHIT Secrets Management
Docker Compose Fixes
Documentation from main
Status: Ready for review and merge. All fixes aligned with hardened branch requirements. |
- Add <<: *env-tier-* anchors to qdrant, postgrest-health, bgutil-pot-provider
- Fix hardcoded ports to use ${SERVICE_PORT:-default} pattern:
- botz-gateway: ${BOTZ_GATEWAY_PORT:-8054}
- evo-controller: ${EVO_CONTROLLER_PORT:-8113}
- ultimate-tts-studio: ${ULTIMATE_TTS_PORT:-7861}
- flute-gateway: ${FLUTE_GATEWAY_PORT:-8055}, ${FLUTE_WS_PORT:-8056}
- github-runner-ctl: ${GITHUB_RUNNER_CTL_PORT:-8104}
- Add port registry variables to env.tier-agent and env.tier-media
- Move PGRST_DB_URI to env.tier-api (fixes compose-time var expansion)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add sync_common_credentials() to enforce credential consistency across tiers - Add multi-tier targeting for Jellyfin secrets (agent + media tiers) - Add worker tier static configuration entries (type: static) - Update apply_manifest_v2() to call sync_common_credentials() - Update env.tier-*.example files with correct structure and port variables 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Critical security and reliability fixes: 1. sync_common_credentials() - Add error handling & prevent credential override - Added force=False parameter to only ADD missing credentials - Never REPLACES existing values unless force=True - Added comprehensive error handling (PermissionError, OSError, UnicodeDecodeError) - Returns Dict[str, List[str]] with detailed changes made - Added logging for all operations - Updated docstring to list all 10 credentials (was only 6) - Added security warning about development defaults 2. decode_secret_map() - Fix bare except clause - Changed 'except Exception' to 'except (ValueError, TypeError)' - Added warning log on decode failure - Preserves raw value as fallback 3. apply_manifest_v2() - Add YAML error handling - Added try/except for FileNotFoundError, YAMLError, OSError - Validates manifest structure before processing - Proper error messages with context 4. RLS policies - Require authentication - Changed USING (true) to USING (auth.uid() IS NOT NULL) - Added comment about future tenant/namespace scoping 5. secrets_manifest_v2.yaml - Remove duplicate keys - Removed duplicate tier_layout, github_sync, docker_secrets 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The env.tier-* files should be gitignored and not tracked in git. They contain runtime credentials that differ per environment. Users should copy env.tier-*.example files to create their local configs. This commit removes the tracked env.tier files from git while keeping the sanitized local copies for development use. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Scout report: LOW RISK - No conflicts expected Changes: CI/CD build fixes, Comfy-watcher fixes, notebook-sync style fixes # Conflicts: # .claude/commands/chit/bus.md # .claude/commands/hyperdim/animate.md # .gitmodules # pmoves/docker-compose.yml # pmoves/docs/PMOVESCHIT/CATACLYSM_STUDIOS_INC.md # pmoves/docs/PMOVESCHIT/PMOVESCHIT.md # pmoves/docs/PMOVESCHIT/Pmoves-Aragon-adabara-md # pmoves/env.tier-agent # pmoves/services/notebook-sync/sync.py # pmoves/services/publisher-discord/main.py # pmoves/services/supaserch/app.py # pmoves/tensorzero/config/tensorzero.toml
Scout report: MEDIUM RISK - Known conflicts expected - Hi-RAG WebSocket extra_headers removal (uvloop fix) - NATS auth config changes - Archon submodule update # Conflicts: # pmoves/tools/mini_cli.py
Scout report: HIGH RISK - Major YAML restructuring expected - Preserve YAML anchor structure (<<: *env-tier-*) - Standardize port variable names - Supabase URL consistency # Conflicts: # pmoves/docker-compose.yml
- fix(publisher-discord): Use urlparse for proper hostname validation instead of substring check (py/incomplete-url-substring-sanitization) - docs(geometry_decoder): Add comment explaining SHA256 is for key ID generation, not password hashing (py/weak-sensitive-data-hashing - false positive) - fix(github): Add permissions: contents: read to validate jobs (actions/missing-workflow-permissions) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Owner
Author
|
Replaced by PR #478 from clean branch PMOVES.AI-Edition-Hardened-v2. The previous branch had lost critical production services (flute-gateway, consciousness-service) during merge conflict resolution. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Restores 30 critical files (11,665 lines) from main branch to PMOVES.AI-Edition-Hardened that were missing during the submodule restructure.
Files Restored
Security Fixes
2025-10-18_geometry_swarm.sqlwith tenant isolation2025-09-08_geometry_bus_rls.sql(hardened version exists)Database Tables
Test Plan
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.5 noreply@anthropic.com