fix(makefile): Correct path in check-tier-envs target - #482
Merged
POWERFULMOVES merged 17 commits intoJan 10, 2026
Merged
POWERFULMOVES merged 17 commits into
POWERFULMOVES merged 17 commits into
Conversation
The check-tier-envs target was using pmoves/env.tier-* paths but the Makefile is already in pmoves/ directory. Changed to use relative paths env.tier-* for correct file detection. Fixes issue where make -C pmoves check-tier-envs would fail to find tier env files that actually exist. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
The Makefile had duplicate target definitions that caused warnings: - up-workers at lines 147 and 730 - up-tensorzero at lines 161 and 762 - up-agents at lines 154 and 1102 - down-tensorzero at lines 242 and 765 Renamed later definitions to preserve both use cases: - up-workers (line 730) → up-workers-core - up-tensorzero (line 762) → up-tensorzero-full - up-agents (line 1102) → up-agents-stack - down-tensorzero (line 765) → down-tensorzero-full The friendly short names (with health checks) are now the only definition, while the explicit variants (with full service lists) are available via the -suffixed versions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Layer 2-4 validation fixes for hardened branch: **Network & Configuration Fixes:** - channel-monitor: Add pmoves_data network for postgres connectivity - GRAPH_BOOST: Fix type error (string "true" → float "0.15") **Restored Missing Modules:** - services/common/telemetry.py: PublisherMetrics and PublishTelemetry - services/common/hrm_sidecar.py: HRM sidecar runtime support - libs/providers/embedding.py: Text embedding provider - libs/langextract/*: Language extraction providers and orchestrator **Hi-RAG Gateway v2 Fixes:** - app.py: Fix lifespan function global declarations (moved all globals to top of function - cannot re-declare after yield in generators) - web/: Create StaticFiles mount directory with placeholder index.html **Monitoring:** - grafana/datasources/datasource.yml: Add Prometheus datasource All 29 services now running healthy on hardened branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The pmoves-ui service was using undefined network names from the old architecture. Updated to match the 5-tier network model: - app_tier → pmoves_app - api_tier → pmoves_api - supabase_net (external, already correct) The pmoves-ui service now starts successfully on port 4482. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
**Changes:** - Add env.tier-ui to pmoves-ui service env_file list - Load UI-specific environment variables for Supabase connection **Backend Connectivity:** - SUPABASE_ANON_KEY: Real credentials (not demo keys) - SUPABASE_SERVICE_ROLE_KEY: Service role for server operations - PRESIGN_SHARED_SECRET: Required for upload presign API - NEXT_PUBLIC_SUPABASE_URL: Client-side Supabase URL - NEXT_PUBLIC_SUPABASE_ANON_KEY: Client-side auth key **Note:** env.tier-ui is gitignored (contains credentials) and must be manually configured with real Supabase credentials from .env.local 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…ents - Add make targets: bootstrap-tier-envs, populate-tier-envs - Fix ALL tier anchors to include env.shared for credential inheritance - x-env-tier-worker (id003): NOW includes env.shared - x-env-tier-media (id004): NOW includes env.shared - x-env-tier-agent (id005): NOW includes env.shared - x-env-tier-ui (id007): NOW includes env.shared - Remove NEO4J_URL/USER/PASSWORD from env.shared (client-only vars) - Add INVIDIOUS_COMPANION_* keys to .env for invidious services This ensures services like invidious-companion (media tier) can access shared credentials and prevents Neo4j config errors from client vars. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…ase CLI **Problem:** Services referenced postgres/postgrest from docker-compose.yml which was removed, but URLs and dependencies weren't updated. **Changes:** 1. Removed postgres, postgrest, postgrest-health services from compose - These now run via Supabase CLI instead 2. Updated all service URLs from postgrest:3000/3010 to Supabase CLI: - SUPABASE_URL: http://host.docker.internal:65421 - SUPA_REST_URL: http://host.docker.internal:65421/rest/v1 3. Fixed broken depends_on references: - channel-monitor: removed postgres dependency - tokenism-simulator: changed from [nats, postgrest] to [nats] **Services updated:** - pmoves-yt, hi-rag-gateway, archon, pmoves-ui - jellyfin-bridge, flute-gateway, tokenism-simulator - evo-controller, render-webhook 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
**PR Review Fixes:** - Changed all Supabase URLs from port 65421 → 54321 (correct Kong port) - Fixed gateway-agent to use host.docker.internal:54321 instead of removed supabase_kong_PMOVES.AI:8000 container reference - Removed obsolete postgrest:host-gateway entry from render-webhook **Context:** Supabase CLI maps Kong to host port 54321 (internal 8000). Services must use host.docker.internal:54321 to access Supabase API. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Restores 54 slash commands, security hooks, and TAC documentation that were removed during 6-tier architecture implementation. - Slash commands across 16 categories (agents, botz, db, deploy, github, health, k8s, pipecat, search, test, tts, workitems, worktree, yt) - Security hooks (pre-tool.sh blocks dangerous ops, post-tool.sh NATS) - TAC documentation (TAC_INTEGRATION_STATUS.md) - Phase 1 & 2 security hardening docs - Testing and service documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Restores the remaining TAC commands that were deleted in commit 4490fcd: - agent-sdk/handoff.md - chit/* (4 commands): bus, decode, encode, visualize - gpu/* (3 commands): models, optimize, status - hyperdim/* (3 commands): animate, export, render - langextract/* (4 commands): extract, process, provider, status - model/* (2 commands): load, unload - n8n/* (4 commands): execute, nodes, suggest, workflows - tensorzero/models.md - tts/test-all.md Source: pr24-tac-integration worktree at commit a7e3bbe 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit fixes several bugs identified during code review:
**Neo4j Service (Critical Fix):**
- Remove env.shared from Neo4j service (use only env.tier-data)
- Neo4j 5.22 rejects NEO4J_URL from env.shared as invalid config setting
- This resolves "Unrecognized setting: URL" startup error
**Port Configuration Fixes:**
- Split NEO4J_PORT into NEO4J_HTTP_PORT (7474) and NEO4J_BOLT_PORT (7687)
Previously both ports used same variable, causing conflicts when customized
- Split NATS_PORT into NATS_PORT (4222) and NATS_MONITORING_PORT (9223)
Previously monitoring port would break if NATS_PORT was customized
**Internal Service Communication:**
- Fix TensorZero URLs: Change port 3030→3000 for container-to-container calls
Port 3030 is host port; containers must use internal port 3000
Services affected: botz-gateway, tokenism-simulator, gateway-agent
- Add NEO4J_URL variable to hi-rag-gateway-v2 for Neo4j connectivity
**Environment Variable Consistency:**
- extract-worker: Change hardcoded SUPA_REST_URL to use ${VAR:-default} pattern
- pdf-ingest: Change hardcoded NATS_URL to use ${VAR:-default} pattern
- comfy-watcher: Change hardcoded MINIO_ENDPOINT to use ${VAR:-default} pattern
These changes align with the tier architecture documented in .claude/context/tier-architecture.md
and enable proper dual-mode operation for distributed PMOVES.AI deployments.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222},
which looks for the variable in the host environment, not from env_file entries.
Since env.shared and env.tier-worker already define NATS_URL with credentials
(nats://nats:pmoves@nats:4222), removing the explicit override allows the
container to use the authenticated URL from the tier env files.
Fixes Authorization Violation errors in comfy-watcher NATS connection.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The docker-compose.yml referenced `supabase_net` but Supabase CLI creates
`supabase_network_PMOVES.AI`. This mismatch prevented services from reaching
Supabase via container-to-container networking.
Changed network reference from:
supabase_net: { name: supabase_net }
To:
supabase_net: { name: supabase_network_PMOVES.AI }
Services like pmoves-ui can now reach Supabase Kong directly via the shared
network instead of relying on host.docker.internal workaround.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222},
which looks for the variable in the host environment, not from env_file entries.
Since env.tier-agent defines NATS_URL with credentials (nats://nats:pmoves@nats:4222),
removing the explicit override allows the container to use the authenticated URL
from the tier env file.
Also removed NATS_URL from env.shared (now tier-specific) to avoid conflicts
between shared and tier-level configurations.
Fixes "Authorization Violation" errors in agent-zero NATS connection.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Restored scripts that were present on main branch but missing from hardened branch. These are utility scripts for: - Environment setup (env_setup.sh, env_check.sh) - Python venv creation (create_venv.sh variants) - Integration authentication (integration-auth-setup.sh) - n8n workflow management (n8n-flows-watcher.sh, n8n-import-flows.sh) - Open Notebook helpers (notebook_ingest_utils.py, etc.) - Neo4j bootstrap (neo4j_bootstrap.sh) - Credential management (credentials/*) - Proxmox bootstrap (proxmox/pmoves-bootstrap.sh) - Windows PowerShell equivalents (*.ps1 files) All scripts have been reviewed for alignment with hardened branch requirements. Container names and ports updated in separate commits. Restored from: origin/main 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Updated container names and ports in restored scripts to match hardened branch architecture: Container name changes (cataclysm-* → hardened): - integration-auth-setup.sh: cataclysm-firefly → firefly - integration-auth-setup.sh: cataclysm-wger → pmoves-wger - integration-auth-setup.sh: cataclysm-jellyfin → jellyfin - wger_brand_defaults.sh: cataclysm-wger → pmoves-wger Port changes (Supabase migration 65421 → 54321): - pmoves.ps1: host.docker.internal:65421 → 54321 - test_m2_loop.py: 127.0.0.1:65421 → 54321 Also restored branding scripts from git history: - tailscale_brand_init.sh: Tailnet VPN initialization - tailscale_brand_up.sh: Tailnet connection script These fixes ensure the restored scripts work correctly with the hardened branch's network and service architecture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…tory Restored integration configuration files for external services: wger (Health/Fitness): - nginx.conf: Reverse proxy configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow firefly (Wealth/Finance): - nginx-buffers.conf: Buffer size configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow jellyfin (Media Server): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow open-notebook (Knowledge Base): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow Also restored nginx config mounts in docker-compose.external.yml for wger and firefly services. Restored from: commit 3b4a548^, 4490fcd^ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES
merged commit Jan 10, 2026
9668fc2
into
PMOVES.AI-Edition-Hardened
6 of 8 checks passed
POWERFULMOVES
added a commit
that referenced
this pull request
Jan 11, 2026
* fix(makefile): Correct path in check-tier-envs target The check-tier-envs target was using pmoves/env.tier-* paths but the Makefile is already in pmoves/ directory. Changed to use relative paths env.tier-* for correct file detection. Fixes issue where make -C pmoves check-tier-envs would fail to find tier env files that actually exist. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(makefile): Rename duplicate targets to avoid warnings The Makefile had duplicate target definitions that caused warnings: - up-workers at lines 147 and 730 - up-tensorzero at lines 161 and 762 - up-agents at lines 154 and 1102 - down-tensorzero at lines 242 and 765 Renamed later definitions to preserve both use cases: - up-workers (line 730) → up-workers-core - up-tensorzero (line 762) → up-tensorzero-full - up-agents (line 1102) → up-agents-stack - down-tensorzero (line 765) → down-tensorzero-full The friendly short names (with health checks) are now the only definition, while the explicit variants (with full service lists) are available via the -suffixed versions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Restore missing modules and fix service configuration Layer 2-4 validation fixes for hardened branch: **Network & Configuration Fixes:** - channel-monitor: Add pmoves_data network for postgres connectivity - GRAPH_BOOST: Fix type error (string "true" → float "0.15") **Restored Missing Modules:** - services/common/telemetry.py: PublisherMetrics and PublishTelemetry - services/common/hrm_sidecar.py: HRM sidecar runtime support - libs/providers/embedding.py: Text embedding provider - libs/langextract/*: Language extraction providers and orchestrator **Hi-RAG Gateway v2 Fixes:** - app.py: Fix lifespan function global declarations (moved all globals to top of function - cannot re-declare after yield in generators) - web/: Create StaticFiles mount directory with placeholder index.html **Monitoring:** - grafana/datasources/datasource.yml: Add Prometheus datasource All 29 services now running healthy on hardened branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix pmoves-ui network names for 5-tier architecture The pmoves-ui service was using undefined network names from the old architecture. Updated to match the 5-tier network model: - app_tier → pmoves_app - api_tier → pmoves_api - supabase_net (external, already correct) The pmoves-ui service now starts successfully on port 4482. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ui): Configure pmoves-ui for production backend connectivity **Changes:** - Add env.tier-ui to pmoves-ui service env_file list - Load UI-specific environment variables for Supabase connection **Backend Connectivity:** - SUPABASE_ANON_KEY: Real credentials (not demo keys) - SUPABASE_SERVICE_ROLE_KEY: Service role for server operations - PRESIGN_SHARED_SECRET: Required for upload presign API - NEXT_PUBLIC_SUPABASE_URL: Client-side Supabase URL - NEXT_PUBLIC_SUPABASE_ANON_KEY: Client-side auth key **Note:** env.tier-ui is gitignored (contains credentials) and must be manually configured with real Supabase credentials from .env.local 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Align tier env bootstrap with Hardened branch requirements - Add make targets: bootstrap-tier-envs, populate-tier-envs - Fix ALL tier anchors to include env.shared for credential inheritance - x-env-tier-worker (id003): NOW includes env.shared - x-env-tier-media (id004): NOW includes env.shared - x-env-tier-agent (id005): NOW includes env.shared - x-env-tier-ui (id007): NOW includes env.shared - Remove NEO4J_URL/USER/PASSWORD from env.shared (client-only vars) - Add INVIDIOUS_COMPANION_* keys to .env for invidious services This ensures services like invidious-companion (media tier) can access shared credentials and prevents Neo4j config errors from client vars. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Migrate services from docker-compose postgres to Supabase CLI **Problem:** Services referenced postgres/postgrest from docker-compose.yml which was removed, but URLs and dependencies weren't updated. **Changes:** 1. Removed postgres, postgrest, postgrest-health services from compose - These now run via Supabase CLI instead 2. Updated all service URLs from postgrest:3000/3010 to Supabase CLI: - SUPABASE_URL: http://host.docker.internal:65421 - SUPA_REST_URL: http://host.docker.internal:65421/rest/v1 3. Fixed broken depends_on references: - channel-monitor: removed postgres dependency - tokenism-simulator: changed from [nats, postgrest] to [nats] **Services updated:** - pmoves-yt, hi-rag-gateway, archon, pmoves-ui - jellyfin-bridge, flute-gateway, tokenism-simulator - evo-controller, render-webhook 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(supabase): Correct port number and gateway-agent URL **PR Review Fixes:** - Changed all Supabase URLs from port 65421 → 54321 (correct Kong port) - Fixed gateway-agent to use host.docker.internal:54321 instead of removed supabase_kong_PMOVES.AI:8000 container reference - Removed obsolete postgrest:host-gateway entry from render-webhook **Context:** Supabase CLI maps Kong to host port 54321 (internal 8000). Services must use host.docker.internal:54321 to access Supabase API. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore TAC integration framework deleted in commit 4490fcd Restores 54 slash commands, security hooks, and TAC documentation that were removed during 6-tier architecture implementation. - Slash commands across 16 categories (agents, botz, db, deploy, github, health, k8s, pipecat, search, test, tts, workitems, worktree, yt) - Security hooks (pre-tool.sh blocks dangerous ops, post-tool.sh NATS) - TAC documentation (TAC_INTEGRATION_STATUS.md) - Phase 1 & 2 security hardening docs - Testing and service documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore remaining 22 TAC commands Restores the remaining TAC commands that were deleted in commit 4490fcd: - agent-sdk/handoff.md - chit/* (4 commands): bus, decode, encode, visualize - gpu/* (3 commands): models, optimize, status - hyperdim/* (3 commands): animate, export, render - langextract/* (4 commands): extract, process, provider, status - model/* (2 commands): load, unload - n8n/* (4 commands): execute, nodes, suggest, workflows - tensorzero/models.md - tts/test-all.md Source: pr24-tac-integration worktree at commit a7e3bbe 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix service configuration issues for dual-mode data tier This commit fixes several bugs identified during code review: **Neo4j Service (Critical Fix):** - Remove env.shared from Neo4j service (use only env.tier-data) - Neo4j 5.22 rejects NEO4J_URL from env.shared as invalid config setting - This resolves "Unrecognized setting: URL" startup error **Port Configuration Fixes:** - Split NEO4J_PORT into NEO4J_HTTP_PORT (7474) and NEO4J_BOLT_PORT (7687) Previously both ports used same variable, causing conflicts when customized - Split NATS_PORT into NATS_PORT (4222) and NATS_MONITORING_PORT (9223) Previously monitoring port would break if NATS_PORT was customized **Internal Service Communication:** - Fix TensorZero URLs: Change port 3030→3000 for container-to-container calls Port 3030 is host port; containers must use internal port 3000 Services affected: botz-gateway, tokenism-simulator, gateway-agent - Add NEO4J_URL variable to hi-rag-gateway-v2 for Neo4j connectivity **Environment Variable Consistency:** - extract-worker: Change hardcoded SUPA_REST_URL to use ${VAR:-default} pattern - pdf-ingest: Change hardcoded NATS_URL to use ${VAR:-default} pattern - comfy-watcher: Change hardcoded MINIO_ENDPOINT to use ${VAR:-default} pattern These changes align with the tier architecture documented in .claude/context/tier-architecture.md and enable proper dual-mode operation for distributed PMOVES.AI deployments. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(comfy-watcher): Remove NATS_URL override to use tier credentials The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.shared and env.tier-worker already define NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env files. Fixes Authorization Violation errors in comfy-watcher NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(network): Correct Supabase network name for container connectivity The docker-compose.yml referenced `supabase_net` but Supabase CLI creates `supabase_network_PMOVES.AI`. This mismatch prevented services from reaching Supabase via container-to-container networking. Changed network reference from: supabase_net: { name: supabase_net } To: supabase_net: { name: supabase_network_PMOVES.AI } Services like pmoves-ui can now reach Supabase Kong directly via the shared network instead of relying on host.docker.internal workaround. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(nats): Remove NATS_URL override from agent-zero service The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.tier-agent defines NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env file. Also removed NATS_URL from env.shared (now tier-specific) to avoid conflicts between shared and tier-level configurations. Fixes "Authorization Violation" errors in agent-zero NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(scripts): Restore 50 utility scripts from main branch Restored scripts that were present on main branch but missing from hardened branch. These are utility scripts for: - Environment setup (env_setup.sh, env_check.sh) - Python venv creation (create_venv.sh variants) - Integration authentication (integration-auth-setup.sh) - n8n workflow management (n8n-flows-watcher.sh, n8n-import-flows.sh) - Open Notebook helpers (notebook_ingest_utils.py, etc.) - Neo4j bootstrap (neo4j_bootstrap.sh) - Credential management (credentials/*) - Proxmox bootstrap (proxmox/pmoves-bootstrap.sh) - Windows PowerShell equivalents (*.ps1 files) All scripts have been reviewed for alignment with hardened branch requirements. Container names and ports updated in separate commits. Restored from: origin/main 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(scripts): Align restored scripts with hardened branch requirements Updated container names and ports in restored scripts to match hardened branch architecture: Container name changes (cataclysm-* → hardened): - integration-auth-setup.sh: cataclysm-firefly → firefly - integration-auth-setup.sh: cataclysm-wger → pmoves-wger - integration-auth-setup.sh: cataclysm-jellyfin → jellyfin - wger_brand_defaults.sh: cataclysm-wger → pmoves-wger Port changes (Supabase migration 65421 → 54321): - pmoves.ps1: host.docker.internal:65421 → 54321 - test_m2_loop.py: 127.0.0.1:65421 → 54321 Also restored branding scripts from git history: - tailscale_brand_init.sh: Tailnet VPN initialization - tailscale_brand_up.sh: Tailnet connection script These fixes ensure the restored scripts work correctly with the hardened branch's network and service architecture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(integrations): Restore pr-kits integration configs from git history Restored integration configuration files for external services: wger (Health/Fitness): - nginx.conf: Reverse proxy configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow firefly (Wealth/Finance): - nginx-buffers.conf: Buffer size configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow jellyfin (Media Server): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow open-notebook (Knowledge Base): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow Also restored nginx config mounts in docker-compose.external.yml for wger and firefly services. Restored from: commit 3b4a548^, 4490fcd^ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES
added a commit
that referenced
this pull request
Jan 16, 2026
* fix(makefile): Correct path in check-tier-envs target The check-tier-envs target was using pmoves/env.tier-* paths but the Makefile is already in pmoves/ directory. Changed to use relative paths env.tier-* for correct file detection. Fixes issue where make -C pmoves check-tier-envs would fail to find tier env files that actually exist. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(makefile): Rename duplicate targets to avoid warnings The Makefile had duplicate target definitions that caused warnings: - up-workers at lines 147 and 730 - up-tensorzero at lines 161 and 762 - up-agents at lines 154 and 1102 - down-tensorzero at lines 242 and 765 Renamed later definitions to preserve both use cases: - up-workers (line 730) → up-workers-core - up-tensorzero (line 762) → up-tensorzero-full - up-agents (line 1102) → up-agents-stack - down-tensorzero (line 765) → down-tensorzero-full The friendly short names (with health checks) are now the only definition, while the explicit variants (with full service lists) are available via the -suffixed versions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Restore missing modules and fix service configuration Layer 2-4 validation fixes for hardened branch: **Network & Configuration Fixes:** - channel-monitor: Add pmoves_data network for postgres connectivity - GRAPH_BOOST: Fix type error (string "true" → float "0.15") **Restored Missing Modules:** - services/common/telemetry.py: PublisherMetrics and PublishTelemetry - services/common/hrm_sidecar.py: HRM sidecar runtime support - libs/providers/embedding.py: Text embedding provider - libs/langextract/*: Language extraction providers and orchestrator **Hi-RAG Gateway v2 Fixes:** - app.py: Fix lifespan function global declarations (moved all globals to top of function - cannot re-declare after yield in generators) - web/: Create StaticFiles mount directory with placeholder index.html **Monitoring:** - grafana/datasources/datasource.yml: Add Prometheus datasource All 29 services now running healthy on hardened branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix pmoves-ui network names for 5-tier architecture The pmoves-ui service was using undefined network names from the old architecture. Updated to match the 5-tier network model: - app_tier → pmoves_app - api_tier → pmoves_api - supabase_net (external, already correct) The pmoves-ui service now starts successfully on port 4482. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ui): Configure pmoves-ui for production backend connectivity **Changes:** - Add env.tier-ui to pmoves-ui service env_file list - Load UI-specific environment variables for Supabase connection **Backend Connectivity:** - SUPABASE_ANON_KEY: Real credentials (not demo keys) - SUPABASE_SERVICE_ROLE_KEY: Service role for server operations - PRESIGN_SHARED_SECRET: Required for upload presign API - NEXT_PUBLIC_SUPABASE_URL: Client-side Supabase URL - NEXT_PUBLIC_SUPABASE_ANON_KEY: Client-side auth key **Note:** env.tier-ui is gitignored (contains credentials) and must be manually configured with real Supabase credentials from .env.local 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Align tier env bootstrap with Hardened branch requirements - Add make targets: bootstrap-tier-envs, populate-tier-envs - Fix ALL tier anchors to include env.shared for credential inheritance - x-env-tier-worker (id003): NOW includes env.shared - x-env-tier-media (id004): NOW includes env.shared - x-env-tier-agent (id005): NOW includes env.shared - x-env-tier-ui (id007): NOW includes env.shared - Remove NEO4J_URL/USER/PASSWORD from env.shared (client-only vars) - Add INVIDIOUS_COMPANION_* keys to .env for invidious services This ensures services like invidious-companion (media tier) can access shared credentials and prevents Neo4j config errors from client vars. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Migrate services from docker-compose postgres to Supabase CLI **Problem:** Services referenced postgres/postgrest from docker-compose.yml which was removed, but URLs and dependencies weren't updated. **Changes:** 1. Removed postgres, postgrest, postgrest-health services from compose - These now run via Supabase CLI instead 2. Updated all service URLs from postgrest:3000/3010 to Supabase CLI: - SUPABASE_URL: http://host.docker.internal:65421 - SUPA_REST_URL: http://host.docker.internal:65421/rest/v1 3. Fixed broken depends_on references: - channel-monitor: removed postgres dependency - tokenism-simulator: changed from [nats, postgrest] to [nats] **Services updated:** - pmoves-yt, hi-rag-gateway, archon, pmoves-ui - jellyfin-bridge, flute-gateway, tokenism-simulator - evo-controller, render-webhook 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(supabase): Correct port number and gateway-agent URL **PR Review Fixes:** - Changed all Supabase URLs from port 65421 → 54321 (correct Kong port) - Fixed gateway-agent to use host.docker.internal:54321 instead of removed supabase_kong_PMOVES.AI:8000 container reference - Removed obsolete postgrest:host-gateway entry from render-webhook **Context:** Supabase CLI maps Kong to host port 54321 (internal 8000). Services must use host.docker.internal:54321 to access Supabase API. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore TAC integration framework deleted in commit 4490fcd Restores 54 slash commands, security hooks, and TAC documentation that were removed during 6-tier architecture implementation. - Slash commands across 16 categories (agents, botz, db, deploy, github, health, k8s, pipecat, search, test, tts, workitems, worktree, yt) - Security hooks (pre-tool.sh blocks dangerous ops, post-tool.sh NATS) - TAC documentation (TAC_INTEGRATION_STATUS.md) - Phase 1 & 2 security hardening docs - Testing and service documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore remaining 22 TAC commands Restores the remaining TAC commands that were deleted in commit 4490fcd: - agent-sdk/handoff.md - chit/* (4 commands): bus, decode, encode, visualize - gpu/* (3 commands): models, optimize, status - hyperdim/* (3 commands): animate, export, render - langextract/* (4 commands): extract, process, provider, status - model/* (2 commands): load, unload - n8n/* (4 commands): execute, nodes, suggest, workflows - tensorzero/models.md - tts/test-all.md Source: pr24-tac-integration worktree at commit a7e3bbe 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix service configuration issues for dual-mode data tier This commit fixes several bugs identified during code review: **Neo4j Service (Critical Fix):** - Remove env.shared from Neo4j service (use only env.tier-data) - Neo4j 5.22 rejects NEO4J_URL from env.shared as invalid config setting - This resolves "Unrecognized setting: URL" startup error **Port Configuration Fixes:** - Split NEO4J_PORT into NEO4J_HTTP_PORT (7474) and NEO4J_BOLT_PORT (7687) Previously both ports used same variable, causing conflicts when customized - Split NATS_PORT into NATS_PORT (4222) and NATS_MONITORING_PORT (9223) Previously monitoring port would break if NATS_PORT was customized **Internal Service Communication:** - Fix TensorZero URLs: Change port 3030→3000 for container-to-container calls Port 3030 is host port; containers must use internal port 3000 Services affected: botz-gateway, tokenism-simulator, gateway-agent - Add NEO4J_URL variable to hi-rag-gateway-v2 for Neo4j connectivity **Environment Variable Consistency:** - extract-worker: Change hardcoded SUPA_REST_URL to use ${VAR:-default} pattern - pdf-ingest: Change hardcoded NATS_URL to use ${VAR:-default} pattern - comfy-watcher: Change hardcoded MINIO_ENDPOINT to use ${VAR:-default} pattern These changes align with the tier architecture documented in .claude/context/tier-architecture.md and enable proper dual-mode operation for distributed PMOVES.AI deployments. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(comfy-watcher): Remove NATS_URL override to use tier credentials The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.shared and env.tier-worker already define NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env files. Fixes Authorization Violation errors in comfy-watcher NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(network): Correct Supabase network name for container connectivity The docker-compose.yml referenced `supabase_net` but Supabase CLI creates `supabase_network_PMOVES.AI`. This mismatch prevented services from reaching Supabase via container-to-container networking. Changed network reference from: supabase_net: { name: supabase_net } To: supabase_net: { name: supabase_network_PMOVES.AI } Services like pmoves-ui can now reach Supabase Kong directly via the shared network instead of relying on host.docker.internal workaround. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(nats): Remove NATS_URL override from agent-zero service The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.tier-agent defines NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env file. Also removed NATS_URL from env.shared (now tier-specific) to avoid conflicts between shared and tier-level configurations. Fixes "Authorization Violation" errors in agent-zero NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(scripts): Restore 50 utility scripts from main branch Restored scripts that were present on main branch but missing from hardened branch. These are utility scripts for: - Environment setup (env_setup.sh, env_check.sh) - Python venv creation (create_venv.sh variants) - Integration authentication (integration-auth-setup.sh) - n8n workflow management (n8n-flows-watcher.sh, n8n-import-flows.sh) - Open Notebook helpers (notebook_ingest_utils.py, etc.) - Neo4j bootstrap (neo4j_bootstrap.sh) - Credential management (credentials/*) - Proxmox bootstrap (proxmox/pmoves-bootstrap.sh) - Windows PowerShell equivalents (*.ps1 files) All scripts have been reviewed for alignment with hardened branch requirements. Container names and ports updated in separate commits. Restored from: origin/main 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(scripts): Align restored scripts with hardened branch requirements Updated container names and ports in restored scripts to match hardened branch architecture: Container name changes (cataclysm-* → hardened): - integration-auth-setup.sh: cataclysm-firefly → firefly - integration-auth-setup.sh: cataclysm-wger → pmoves-wger - integration-auth-setup.sh: cataclysm-jellyfin → jellyfin - wger_brand_defaults.sh: cataclysm-wger → pmoves-wger Port changes (Supabase migration 65421 → 54321): - pmoves.ps1: host.docker.internal:65421 → 54321 - test_m2_loop.py: 127.0.0.1:65421 → 54321 Also restored branding scripts from git history: - tailscale_brand_init.sh: Tailnet VPN initialization - tailscale_brand_up.sh: Tailnet connection script These fixes ensure the restored scripts work correctly with the hardened branch's network and service architecture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(integrations): Restore pr-kits integration configs from git history Restored integration configuration files for external services: wger (Health/Fitness): - nginx.conf: Reverse proxy configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow firefly (Wealth/Finance): - nginx-buffers.conf: Buffer size configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow jellyfin (Media Server): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow open-notebook (Knowledge Base): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow Also restored nginx config mounts in docker-compose.external.yml for wger and firefly services. Restored from: commit 3b4a548^, 4490fcd^ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES
added a commit
that referenced
this pull request
Jan 16, 2026
* fix(makefile): Correct path in check-tier-envs target (#482) * fix(makefile): Correct path in check-tier-envs target The check-tier-envs target was using pmoves/env.tier-* paths but the Makefile is already in pmoves/ directory. Changed to use relative paths env.tier-* for correct file detection. Fixes issue where make -C pmoves check-tier-envs would fail to find tier env files that actually exist. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(makefile): Rename duplicate targets to avoid warnings The Makefile had duplicate target definitions that caused warnings: - up-workers at lines 147 and 730 - up-tensorzero at lines 161 and 762 - up-agents at lines 154 and 1102 - down-tensorzero at lines 242 and 765 Renamed later definitions to preserve both use cases: - up-workers (line 730) → up-workers-core - up-tensorzero (line 762) → up-tensorzero-full - up-agents (line 1102) → up-agents-stack - down-tensorzero (line 765) → down-tensorzero-full The friendly short names (with health checks) are now the only definition, while the explicit variants (with full service lists) are available via the -suffixed versions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Restore missing modules and fix service configuration Layer 2-4 validation fixes for hardened branch: **Network & Configuration Fixes:** - channel-monitor: Add pmoves_data network for postgres connectivity - GRAPH_BOOST: Fix type error (string "true" → float "0.15") **Restored Missing Modules:** - services/common/telemetry.py: PublisherMetrics and PublishTelemetry - services/common/hrm_sidecar.py: HRM sidecar runtime support - libs/providers/embedding.py: Text embedding provider - libs/langextract/*: Language extraction providers and orchestrator **Hi-RAG Gateway v2 Fixes:** - app.py: Fix lifespan function global declarations (moved all globals to top of function - cannot re-declare after yield in generators) - web/: Create StaticFiles mount directory with placeholder index.html **Monitoring:** - grafana/datasources/datasource.yml: Add Prometheus datasource All 29 services now running healthy on hardened branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix pmoves-ui network names for 5-tier architecture The pmoves-ui service was using undefined network names from the old architecture. Updated to match the 5-tier network model: - app_tier → pmoves_app - api_tier → pmoves_api - supabase_net (external, already correct) The pmoves-ui service now starts successfully on port 4482. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ui): Configure pmoves-ui for production backend connectivity **Changes:** - Add env.tier-ui to pmoves-ui service env_file list - Load UI-specific environment variables for Supabase connection **Backend Connectivity:** - SUPABASE_ANON_KEY: Real credentials (not demo keys) - SUPABASE_SERVICE_ROLE_KEY: Service role for server operations - PRESIGN_SHARED_SECRET: Required for upload presign API - NEXT_PUBLIC_SUPABASE_URL: Client-side Supabase URL - NEXT_PUBLIC_SUPABASE_ANON_KEY: Client-side auth key **Note:** env.tier-ui is gitignored (contains credentials) and must be manually configured with real Supabase credentials from .env.local 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Align tier env bootstrap with Hardened branch requirements - Add make targets: bootstrap-tier-envs, populate-tier-envs - Fix ALL tier anchors to include env.shared for credential inheritance - x-env-tier-worker (id003): NOW includes env.shared - x-env-tier-media (id004): NOW includes env.shared - x-env-tier-agent (id005): NOW includes env.shared - x-env-tier-ui (id007): NOW includes env.shared - Remove NEO4J_URL/USER/PASSWORD from env.shared (client-only vars) - Add INVIDIOUS_COMPANION_* keys to .env for invidious services This ensures services like invidious-companion (media tier) can access shared credentials and prevents Neo4j config errors from client vars. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Migrate services from docker-compose postgres to Supabase CLI **Problem:** Services referenced postgres/postgrest from docker-compose.yml which was removed, but URLs and dependencies weren't updated. **Changes:** 1. Removed postgres, postgrest, postgrest-health services from compose - These now run via Supabase CLI instead 2. Updated all service URLs from postgrest:3000/3010 to Supabase CLI: - SUPABASE_URL: http://host.docker.internal:65421 - SUPA_REST_URL: http://host.docker.internal:65421/rest/v1 3. Fixed broken depends_on references: - channel-monitor: removed postgres dependency - tokenism-simulator: changed from [nats, postgrest] to [nats] **Services updated:** - pmoves-yt, hi-rag-gateway, archon, pmoves-ui - jellyfin-bridge, flute-gateway, tokenism-simulator - evo-controller, render-webhook 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(supabase): Correct port number and gateway-agent URL **PR Review Fixes:** - Changed all Supabase URLs from port 65421 → 54321 (correct Kong port) - Fixed gateway-agent to use host.docker.internal:54321 instead of removed supabase_kong_PMOVES.AI:8000 container reference - Removed obsolete postgrest:host-gateway entry from render-webhook **Context:** Supabase CLI maps Kong to host port 54321 (internal 8000). Services must use host.docker.internal:54321 to access Supabase API. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore TAC integration framework deleted in commit 4490fcd Restores 54 slash commands, security hooks, and TAC documentation that were removed during 6-tier architecture implementation. - Slash commands across 16 categories (agents, botz, db, deploy, github, health, k8s, pipecat, search, test, tts, workitems, worktree, yt) - Security hooks (pre-tool.sh blocks dangerous ops, post-tool.sh NATS) - TAC documentation (TAC_INTEGRATION_STATUS.md) - Phase 1 & 2 security hardening docs - Testing and service documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore remaining 22 TAC commands Restores the remaining TAC commands that were deleted in commit 4490fcd: - agent-sdk/handoff.md - chit/* (4 commands): bus, decode, encode, visualize - gpu/* (3 commands): models, optimize, status - hyperdim/* (3 commands): animate, export, render - langextract/* (4 commands): extract, process, provider, status - model/* (2 commands): load, unload - n8n/* (4 commands): execute, nodes, suggest, workflows - tensorzero/models.md - tts/test-all.md Source: pr24-tac-integration worktree at commit a7e3bbe 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix service configuration issues for dual-mode data tier This commit fixes several bugs identified during code review: **Neo4j Service (Critical Fix):** - Remove env.shared from Neo4j service (use only env.tier-data) - Neo4j 5.22 rejects NEO4J_URL from env.shared as invalid config setting - This resolves "Unrecognized setting: URL" startup error **Port Configuration Fixes:** - Split NEO4J_PORT into NEO4J_HTTP_PORT (7474) and NEO4J_BOLT_PORT (7687) Previously both ports used same variable, causing conflicts when customized - Split NATS_PORT into NATS_PORT (4222) and NATS_MONITORING_PORT (9223) Previously monitoring port would break if NATS_PORT was customized **Internal Service Communication:** - Fix TensorZero URLs: Change port 3030→3000 for container-to-container calls Port 3030 is host port; containers must use internal port 3000 Services affected: botz-gateway, tokenism-simulator, gateway-agent - Add NEO4J_URL variable to hi-rag-gateway-v2 for Neo4j connectivity **Environment Variable Consistency:** - extract-worker: Change hardcoded SUPA_REST_URL to use ${VAR:-default} pattern - pdf-ingest: Change hardcoded NATS_URL to use ${VAR:-default} pattern - comfy-watcher: Change hardcoded MINIO_ENDPOINT to use ${VAR:-default} pattern These changes align with the tier architecture documented in .claude/context/tier-architecture.md and enable proper dual-mode operation for distributed PMOVES.AI deployments. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(comfy-watcher): Remove NATS_URL override to use tier credentials The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.shared and env.tier-worker already define NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env files. Fixes Authorization Violation errors in comfy-watcher NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(network): Correct Supabase network name for container connectivity The docker-compose.yml referenced `supabase_net` but Supabase CLI creates `supabase_network_PMOVES.AI`. This mismatch prevented services from reaching Supabase via container-to-container networking. Changed network reference from: supabase_net: { name: supabase_net } To: supabase_net: { name: supabase_network_PMOVES.AI } Services like pmoves-ui can now reach Supabase Kong directly via the shared network instead of relying on host.docker.internal workaround. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(nats): Remove NATS_URL override from agent-zero service The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.tier-agent defines NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env file. Also removed NATS_URL from env.shared (now tier-specific) to avoid conflicts between shared and tier-level configurations. Fixes "Authorization Violation" errors in agent-zero NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(scripts): Restore 50 utility scripts from main branch Restored scripts that were present on main branch but missing from hardened branch. These are utility scripts for: - Environment setup (env_setup.sh, env_check.sh) - Python venv creation (create_venv.sh variants) - Integration authentication (integration-auth-setup.sh) - n8n workflow management (n8n-flows-watcher.sh, n8n-import-flows.sh) - Open Notebook helpers (notebook_ingest_utils.py, etc.) - Neo4j bootstrap (neo4j_bootstrap.sh) - Credential management (credentials/*) - Proxmox bootstrap (proxmox/pmoves-bootstrap.sh) - Windows PowerShell equivalents (*.ps1 files) All scripts have been reviewed for alignment with hardened branch requirements. Container names and ports updated in separate commits. Restored from: origin/main 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(scripts): Align restored scripts with hardened branch requirements Updated container names and ports in restored scripts to match hardened branch architecture: Container name changes (cataclysm-* → hardened): - integration-auth-setup.sh: cataclysm-firefly → firefly - integration-auth-setup.sh: cataclysm-wger → pmoves-wger - integration-auth-setup.sh: cataclysm-jellyfin → jellyfin - wger_brand_defaults.sh: cataclysm-wger → pmoves-wger Port changes (Supabase migration 65421 → 54321): - pmoves.ps1: host.docker.internal:65421 → 54321 - test_m2_loop.py: 127.0.0.1:65421 → 54321 Also restored branding scripts from git history: - tailscale_brand_init.sh: Tailnet VPN initialization - tailscale_brand_up.sh: Tailnet connection script These fixes ensure the restored scripts work correctly with the hardened branch's network and service architecture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(integrations): Restore pr-kits integration configs from git history Restored integration configuration files for external services: wger (Health/Fitness): - nginx.conf: Reverse proxy configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow firefly (Wealth/Finance): - nginx-buffers.conf: Buffer size configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow jellyfin (Media Server): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow open-notebook (Knowledge Base): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow Also restored nginx config mounts in docker-compose.external.yml for wger and firefly services. Restored from: commit 3b4a548^, 4490fcd^ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * feat(model-registry): Add Supabase-backed dynamic model configuration Implements a database-driven model registry that replaces hardcoded TensorZero TOML configuration with dynamic model routing and discovery. Database Schema: - 5 tables: model_providers, models, model_aliases, service_model_mappings, model_deployments - 3 views: v_active_models, v_service_models, v_active_deployments - 7 indexes for query performance - RLS policies for public read, authenticated write Model Registry Service: - FastAPI service on port 8110 - Modern lifespan context manager (replaces deprecated @app.on_event) - TensorZero TOML generation endpoint - GPU orchestrator integration via NATS mesh.gpu.* subjects - Migration script from existing TensorZero config Seed Data: - 8 providers (Ollama local/edge, Z.ai, OpenAI, Venice, Groq, OpenRouter, Together) - 18 models (chat, embedding, reranker, vision-language) - Service mappings for agent_zero, langextract, deepresearch Documentation: - Service README with API endpoints and quick start - Architecture documentation with schema reference - Service startup guide with dependency ordering 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(model-registry): Dockerfile permission and host binding fixes - Fix file ownership: Use COPY --chown instead of separate chown - Fix host binding: Use 0.0.0.0 instead of 127.0.0.1 for Docker 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(model-registry): Dockerfile permission and host binding fixes - Fix file ownership: Use COPY --chown instead of separate chown - Fix host binding: Use 0.0.0.0 instead of 127.0.0.1 for Docker 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(model-registry): Fix Supabase connectivity for Docker environment - Update main.py default SUPABASE_URL to use host.docker.internal:54321 - Use MODEL_REGISTRY_SUPABASE_URL variable to avoid .env conflicts - Follows pattern used by other services (hirag-gateway, tensorzero) Fixes connection error: "Name or service not known" 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(submodules): Restore AgentGym submodules - Add AgentGym submodule (PMOVES.AI-Edition-Hardened branch) - Restore AgentGym-RL submodule (PMOVES.AI-Edition-Hardened branch) - Both submodules are custom forks for PMOVES.AI integration Context: Each submodule fork works standalone AND with PMOVES.AI services when docked. Nested submodules exist within these forks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(submodules): Update submodule references after feature work - PMOVES-Archon: uv.lock dependency updates (5d65667) - PMOVES-A2UI: Add E2B Danger Room integration (a589d59) - pmoves/integrations/archon: Hi-RAG v2 semantic expansion (08a3210) - .gitmodules: Sync from PMOVES.AI-Edition-Hardened-v3-clean 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(submodules): Add missing submodule gitlinks to index Adds 12 submodule references that were in .gitmodules but not in the git index. These are custom forks for PMOVES.AI integration. Submodules added: - PMOVES-Creator, PMOVES-Deep-Serch, PMOVES-DoX, PMOVES-HiRAG - PMOVES-Jellyfin, PMOVES-Open-Notebook, PMOVES-Remote-View - PMOVES-Tailscale, PMOVES-Wealth, PMOVES.YT - Pmoves-Health-wger, Pmoves-Jellyfin-AI-Media-Stack Also adds submodule workflow documentation for reference. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(submodules): Remove ignore=all directives Removing 'ignore = all' from submodule configurations to enable proper tracking of submodule commits. This allows submodule changes to be committed and pushed as part of the merge to PMOVES.AI-Edition-Hardened-v3-clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES
added a commit
that referenced
this pull request
Jan 18, 2026
* fix(makefile): Correct path in check-tier-envs target The check-tier-envs target was using pmoves/env.tier-* paths but the Makefile is already in pmoves/ directory. Changed to use relative paths env.tier-* for correct file detection. Fixes issue where make -C pmoves check-tier-envs would fail to find tier env files that actually exist. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(makefile): Rename duplicate targets to avoid warnings The Makefile had duplicate target definitions that caused warnings: - up-workers at lines 147 and 730 - up-tensorzero at lines 161 and 762 - up-agents at lines 154 and 1102 - down-tensorzero at lines 242 and 765 Renamed later definitions to preserve both use cases: - up-workers (line 730) → up-workers-core - up-tensorzero (line 762) → up-tensorzero-full - up-agents (line 1102) → up-agents-stack - down-tensorzero (line 765) → down-tensorzero-full The friendly short names (with health checks) are now the only definition, while the explicit variants (with full service lists) are available via the -suffixed versions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Restore missing modules and fix service configuration Layer 2-4 validation fixes for hardened branch: **Network & Configuration Fixes:** - channel-monitor: Add pmoves_data network for postgres connectivity - GRAPH_BOOST: Fix type error (string "true" → float "0.15") **Restored Missing Modules:** - services/common/telemetry.py: PublisherMetrics and PublishTelemetry - services/common/hrm_sidecar.py: HRM sidecar runtime support - libs/providers/embedding.py: Text embedding provider - libs/langextract/*: Language extraction providers and orchestrator **Hi-RAG Gateway v2 Fixes:** - app.py: Fix lifespan function global declarations (moved all globals to top of function - cannot re-declare after yield in generators) - web/: Create StaticFiles mount directory with placeholder index.html **Monitoring:** - grafana/datasources/datasource.yml: Add Prometheus datasource All 29 services now running healthy on hardened branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix pmoves-ui network names for 5-tier architecture The pmoves-ui service was using undefined network names from the old architecture. Updated to match the 5-tier network model: - app_tier → pmoves_app - api_tier → pmoves_api - supabase_net (external, already correct) The pmoves-ui service now starts successfully on port 4482. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ui): Configure pmoves-ui for production backend connectivity **Changes:** - Add env.tier-ui to pmoves-ui service env_file list - Load UI-specific environment variables for Supabase connection **Backend Connectivity:** - SUPABASE_ANON_KEY: Real credentials (not demo keys) - SUPABASE_SERVICE_ROLE_KEY: Service role for server operations - PRESIGN_SHARED_SECRET: Required for upload presign API - NEXT_PUBLIC_SUPABASE_URL: Client-side Supabase URL - NEXT_PUBLIC_SUPABASE_ANON_KEY: Client-side auth key **Note:** env.tier-ui is gitignored (contains credentials) and must be manually configured with real Supabase credentials from .env.local 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Align tier env bootstrap with Hardened branch requirements - Add make targets: bootstrap-tier-envs, populate-tier-envs - Fix ALL tier anchors to include env.shared for credential inheritance - x-env-tier-worker (id003): NOW includes env.shared - x-env-tier-media (id004): NOW includes env.shared - x-env-tier-agent (id005): NOW includes env.shared - x-env-tier-ui (id007): NOW includes env.shared - Remove NEO4J_URL/USER/PASSWORD from env.shared (client-only vars) - Add INVIDIOUS_COMPANION_* keys to .env for invidious services This ensures services like invidious-companion (media tier) can access shared credentials and prevents Neo4j config errors from client vars. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Migrate services from docker-compose postgres to Supabase CLI **Problem:** Services referenced postgres/postgrest from docker-compose.yml which was removed, but URLs and dependencies weren't updated. **Changes:** 1. Removed postgres, postgrest, postgrest-health services from compose - These now run via Supabase CLI instead 2. Updated all service URLs from postgrest:3000/3010 to Supabase CLI: - SUPABASE_URL: http://host.docker.internal:65421 - SUPA_REST_URL: http://host.docker.internal:65421/rest/v1 3. Fixed broken depends_on references: - channel-monitor: removed postgres dependency - tokenism-simulator: changed from [nats, postgrest] to [nats] **Services updated:** - pmoves-yt, hi-rag-gateway, archon, pmoves-ui - jellyfin-bridge, flute-gateway, tokenism-simulator - evo-controller, render-webhook 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(supabase): Correct port number and gateway-agent URL **PR Review Fixes:** - Changed all Supabase URLs from port 65421 → 54321 (correct Kong port) - Fixed gateway-agent to use host.docker.internal:54321 instead of removed supabase_kong_PMOVES.AI:8000 container reference - Removed obsolete postgrest:host-gateway entry from render-webhook **Context:** Supabase CLI maps Kong to host port 54321 (internal 8000). Services must use host.docker.internal:54321 to access Supabase API. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore TAC integration framework deleted in commit 4490fcd Restores 54 slash commands, security hooks, and TAC documentation that were removed during 6-tier architecture implementation. - Slash commands across 16 categories (agents, botz, db, deploy, github, health, k8s, pipecat, search, test, tts, workitems, worktree, yt) - Security hooks (pre-tool.sh blocks dangerous ops, post-tool.sh NATS) - TAC documentation (TAC_INTEGRATION_STATUS.md) - Phase 1 & 2 security hardening docs - Testing and service documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore remaining 22 TAC commands Restores the remaining TAC commands that were deleted in commit 4490fcd: - agent-sdk/handoff.md - chit/* (4 commands): bus, decode, encode, visualize - gpu/* (3 commands): models, optimize, status - hyperdim/* (3 commands): animate, export, render - langextract/* (4 commands): extract, process, provider, status - model/* (2 commands): load, unload - n8n/* (4 commands): execute, nodes, suggest, workflows - tensorzero/models.md - tts/test-all.md Source: pr24-tac-integration worktree at commit a7e3bbe 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix service configuration issues for dual-mode data tier This commit fixes several bugs identified during code review: **Neo4j Service (Critical Fix):** - Remove env.shared from Neo4j service (use only env.tier-data) - Neo4j 5.22 rejects NEO4J_URL from env.shared as invalid config setting - This resolves "Unrecognized setting: URL" startup error **Port Configuration Fixes:** - Split NEO4J_PORT into NEO4J_HTTP_PORT (7474) and NEO4J_BOLT_PORT (7687) Previously both ports used same variable, causing conflicts when customized - Split NATS_PORT into NATS_PORT (4222) and NATS_MONITORING_PORT (9223) Previously monitoring port would break if NATS_PORT was customized **Internal Service Communication:** - Fix TensorZero URLs: Change port 3030→3000 for container-to-container calls Port 3030 is host port; containers must use internal port 3000 Services affected: botz-gateway, tokenism-simulator, gateway-agent - Add NEO4J_URL variable to hi-rag-gateway-v2 for Neo4j connectivity **Environment Variable Consistency:** - extract-worker: Change hardcoded SUPA_REST_URL to use ${VAR:-default} pattern - pdf-ingest: Change hardcoded NATS_URL to use ${VAR:-default} pattern - comfy-watcher: Change hardcoded MINIO_ENDPOINT to use ${VAR:-default} pattern These changes align with the tier architecture documented in .claude/context/tier-architecture.md and enable proper dual-mode operation for distributed PMOVES.AI deployments. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(comfy-watcher): Remove NATS_URL override to use tier credentials The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.shared and env.tier-worker already define NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env files. Fixes Authorization Violation errors in comfy-watcher NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(network): Correct Supabase network name for container connectivity The docker-compose.yml referenced `supabase_net` but Supabase CLI creates `supabase_network_PMOVES.AI`. This mismatch prevented services from reaching Supabase via container-to-container networking. Changed network reference from: supabase_net: { name: supabase_net } To: supabase_net: { name: supabase_network_PMOVES.AI } Services like pmoves-ui can now reach Supabase Kong directly via the shared network instead of relying on host.docker.internal workaround. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(nats): Remove NATS_URL override from agent-zero service The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.tier-agent defines NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env file. Also removed NATS_URL from env.shared (now tier-specific) to avoid conflicts between shared and tier-level configurations. Fixes "Authorization Violation" errors in agent-zero NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(scripts): Restore 50 utility scripts from main branch Restored scripts that were present on main branch but missing from hardened branch. These are utility scripts for: - Environment setup (env_setup.sh, env_check.sh) - Python venv creation (create_venv.sh variants) - Integration authentication (integration-auth-setup.sh) - n8n workflow management (n8n-flows-watcher.sh, n8n-import-flows.sh) - Open Notebook helpers (notebook_ingest_utils.py, etc.) - Neo4j bootstrap (neo4j_bootstrap.sh) - Credential management (credentials/*) - Proxmox bootstrap (proxmox/pmoves-bootstrap.sh) - Windows PowerShell equivalents (*.ps1 files) All scripts have been reviewed for alignment with hardened branch requirements. Container names and ports updated in separate commits. Restored from: origin/main 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(scripts): Align restored scripts with hardened branch requirements Updated container names and ports in restored scripts to match hardened branch architecture: Container name changes (cataclysm-* → hardened): - integration-auth-setup.sh: cataclysm-firefly → firefly - integration-auth-setup.sh: cataclysm-wger → pmoves-wger - integration-auth-setup.sh: cataclysm-jellyfin → jellyfin - wger_brand_defaults.sh: cataclysm-wger → pmoves-wger Port changes (Supabase migration 65421 → 54321): - pmoves.ps1: host.docker.internal:65421 → 54321 - test_m2_loop.py: 127.0.0.1:65421 → 54321 Also restored branding scripts from git history: - tailscale_brand_init.sh: Tailnet VPN initialization - tailscale_brand_up.sh: Tailnet connection script These fixes ensure the restored scripts work correctly with the hardened branch's network and service architecture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(integrations): Restore pr-kits integration configs from git history Restored integration configuration files for external services: wger (Health/Fitness): - nginx.conf: Reverse proxy configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow firefly (Wealth/Finance): - nginx-buffers.conf: Buffer size configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow jellyfin (Media Server): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow open-notebook (Knowledge Base): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow Also restored nginx config mounts in docker-compose.external.yml for wger and firefly services. Restored from: commit 3b4a548^, 4490fcd^ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES
added a commit
that referenced
this pull request
Jan 18, 2026
* fix(makefile): Correct path in check-tier-envs target (#482) * fix(makefile): Correct path in check-tier-envs target The check-tier-envs target was using pmoves/env.tier-* paths but the Makefile is already in pmoves/ directory. Changed to use relative paths env.tier-* for correct file detection. Fixes issue where make -C pmoves check-tier-envs would fail to find tier env files that actually exist. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(makefile): Rename duplicate targets to avoid warnings The Makefile had duplicate target definitions that caused warnings: - up-workers at lines 147 and 730 - up-tensorzero at lines 161 and 762 - up-agents at lines 154 and 1102 - down-tensorzero at lines 242 and 765 Renamed later definitions to preserve both use cases: - up-workers (line 730) → up-workers-core - up-tensorzero (line 762) → up-tensorzero-full - up-agents (line 1102) → up-agents-stack - down-tensorzero (line 765) → down-tensorzero-full The friendly short names (with health checks) are now the only definition, while the explicit variants (with full service lists) are available via the -suffixed versions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Restore missing modules and fix service configuration Layer 2-4 validation fixes for hardened branch: **Network & Configuration Fixes:** - channel-monitor: Add pmoves_data network for postgres connectivity - GRAPH_BOOST: Fix type error (string "true" → float "0.15") **Restored Missing Modules:** - services/common/telemetry.py: PublisherMetrics and PublishTelemetry - services/common/hrm_sidecar.py: HRM sidecar runtime support - libs/providers/embedding.py: Text embedding provider - libs/langextract/*: Language extraction providers and orchestrator **Hi-RAG Gateway v2 Fixes:** - app.py: Fix lifespan function global declarations (moved all globals to top of function - cannot re-declare after yield in generators) - web/: Create StaticFiles mount directory with placeholder index.html **Monitoring:** - grafana/datasources/datasource.yml: Add Prometheus datasource All 29 services now running healthy on hardened branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix pmoves-ui network names for 5-tier architecture The pmoves-ui service was using undefined network names from the old architecture. Updated to match the 5-tier network model: - app_tier → pmoves_app - api_tier → pmoves_api - supabase_net (external, already correct) The pmoves-ui service now starts successfully on port 4482. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ui): Configure pmoves-ui for production backend connectivity **Changes:** - Add env.tier-ui to pmoves-ui service env_file list - Load UI-specific environment variables for Supabase connection **Backend Connectivity:** - SUPABASE_ANON_KEY: Real credentials (not demo keys) - SUPABASE_SERVICE_ROLE_KEY: Service role for server operations - PRESIGN_SHARED_SECRET: Required for upload presign API - NEXT_PUBLIC_SUPABASE_URL: Client-side Supabase URL - NEXT_PUBLIC_SUPABASE_ANON_KEY: Client-side auth key **Note:** env.tier-ui is gitignored (contains credentials) and must be manually configured with real Supabase credentials from .env.local 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Align tier env bootstrap with Hardened branch requirements - Add make targets: bootstrap-tier-envs, populate-tier-envs - Fix ALL tier anchors to include env.shared for credential inheritance - x-env-tier-worker (id003): NOW includes env.shared - x-env-tier-media (id004): NOW includes env.shared - x-env-tier-agent (id005): NOW includes env.shared - x-env-tier-ui (id007): NOW includes env.shared - Remove NEO4J_URL/USER/PASSWORD from env.shared (client-only vars) - Add INVIDIOUS_COMPANION_* keys to .env for invidious services This ensures services like invidious-companion (media tier) can access shared credentials and prevents Neo4j config errors from client vars. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Migrate services from docker-compose postgres to Supabase CLI **Problem:** Services referenced postgres/postgrest from docker-compose.yml which was removed, but URLs and dependencies weren't updated. **Changes:** 1. Removed postgres, postgrest, postgrest-health services from compose - These now run via Supabase CLI instead 2. Updated all service URLs from postgrest:3000/3010 to Supabase CLI: - SUPABASE_URL: http://host.docker.internal:65421 - SUPA_REST_URL: http://host.docker.internal:65421/rest/v1 3. Fixed broken depends_on references: - channel-monitor: removed postgres dependency - tokenism-simulator: changed from [nats, postgrest] to [nats] **Services updated:** - pmoves-yt, hi-rag-gateway, archon, pmoves-ui - jellyfin-bridge, flute-gateway, tokenism-simulator - evo-controller, render-webhook 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(supabase): Correct port number and gateway-agent URL **PR Review Fixes:** - Changed all Supabase URLs from port 65421 → 54321 (correct Kong port) - Fixed gateway-agent to use host.docker.internal:54321 instead of removed supabase_kong_PMOVES.AI:8000 container reference - Removed obsolete postgrest:host-gateway entry from render-webhook **Context:** Supabase CLI maps Kong to host port 54321 (internal 8000). Services must use host.docker.internal:54321 to access Supabase API. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore TAC integration framework deleted in commit 4490fcd Restores 54 slash commands, security hooks, and TAC documentation that were removed during 6-tier architecture implementation. - Slash commands across 16 categories (agents, botz, db, deploy, github, health, k8s, pipecat, search, test, tts, workitems, worktree, yt) - Security hooks (pre-tool.sh blocks dangerous ops, post-tool.sh NATS) - TAC documentation (TAC_INTEGRATION_STATUS.md) - Phase 1 & 2 security hardening docs - Testing and service documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore remaining 22 TAC commands Restores the remaining TAC commands that were deleted in commit 4490fcd: - agent-sdk/handoff.md - chit/* (4 commands): bus, decode, encode, visualize - gpu/* (3 commands): models, optimize, status - hyperdim/* (3 commands): animate, export, render - langextract/* (4 commands): extract, process, provider, status - model/* (2 commands): load, unload - n8n/* (4 commands): execute, nodes, suggest, workflows - tensorzero/models.md - tts/test-all.md Source: pr24-tac-integration worktree at commit a7e3bbe 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix service configuration issues for dual-mode data tier This commit fixes several bugs identified during code review: **Neo4j Service (Critical Fix):** - Remove env.shared from Neo4j service (use only env.tier-data) - Neo4j 5.22 rejects NEO4J_URL from env.shared as invalid config setting - This resolves "Unrecognized setting: URL" startup error **Port Configuration Fixes:** - Split NEO4J_PORT into NEO4J_HTTP_PORT (7474) and NEO4J_BOLT_PORT (7687) Previously both ports used same variable, causing conflicts when customized - Split NATS_PORT into NATS_PORT (4222) and NATS_MONITORING_PORT (9223) Previously monitoring port would break if NATS_PORT was customized **Internal Service Communication:** - Fix TensorZero URLs: Change port 3030→3000 for container-to-container calls Port 3030 is host port; containers must use internal port 3000 Services affected: botz-gateway, tokenism-simulator, gateway-agent - Add NEO4J_URL variable to hi-rag-gateway-v2 for Neo4j connectivity **Environment Variable Consistency:** - extract-worker: Change hardcoded SUPA_REST_URL to use ${VAR:-default} pattern - pdf-ingest: Change hardcoded NATS_URL to use ${VAR:-default} pattern - comfy-watcher: Change hardcoded MINIO_ENDPOINT to use ${VAR:-default} pattern These changes align with the tier architecture documented in .claude/context/tier-architecture.md and enable proper dual-mode operation for distributed PMOVES.AI deployments. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(comfy-watcher): Remove NATS_URL override to use tier credentials The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.shared and env.tier-worker already define NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env files. Fixes Authorization Violation errors in comfy-watcher NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(network): Correct Supabase network name for container connectivity The docker-compose.yml referenced `supabase_net` but Supabase CLI creates `supabase_network_PMOVES.AI`. This mismatch prevented services from reaching Supabase via container-to-container networking. Changed network reference from: supabase_net: { name: supabase_net } To: supabase_net: { name: supabase_network_PMOVES.AI } Services like pmoves-ui can now reach Supabase Kong directly via the shared network instead of relying on host.docker.internal workaround. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(nats): Remove NATS_URL override from agent-zero service The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.tier-agent defines NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env file. Also removed NATS_URL from env.shared (now tier-specific) to avoid conflicts between shared and tier-level configurations. Fixes "Authorization Violation" errors in agent-zero NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(scripts): Restore 50 utility scripts from main branch Restored scripts that were present on main branch but missing from hardened branch. These are utility scripts for: - Environment setup (env_setup.sh, env_check.sh) - Python venv creation (create_venv.sh variants) - Integration authentication (integration-auth-setup.sh) - n8n workflow management (n8n-flows-watcher.sh, n8n-import-flows.sh) - Open Notebook helpers (notebook_ingest_utils.py, etc.) - Neo4j bootstrap (neo4j_bootstrap.sh) - Credential management (credentials/*) - Proxmox bootstrap (proxmox/pmoves-bootstrap.sh) - Windows PowerShell equivalents (*.ps1 files) All scripts have been reviewed for alignment with hardened branch requirements. Container names and ports updated in separate commits. Restored from: origin/main 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(scripts): Align restored scripts with hardened branch requirements Updated container names and ports in restored scripts to match hardened branch architecture: Container name changes (cataclysm-* → hardened): - integration-auth-setup.sh: cataclysm-firefly → firefly - integration-auth-setup.sh: cataclysm-wger → pmoves-wger - integration-auth-setup.sh: cataclysm-jellyfin → jellyfin - wger_brand_defaults.sh: cataclysm-wger → pmoves-wger Port changes (Supabase migration 65421 → 54321): - pmoves.ps1: host.docker.internal:65421 → 54321 - test_m2_loop.py: 127.0.0.1:65421 → 54321 Also restored branding scripts from git history: - tailscale_brand_init.sh: Tailnet VPN initialization - tailscale_brand_up.sh: Tailnet connection script These fixes ensure the restored scripts work correctly with the hardened branch's network and service architecture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(integrations): Restore pr-kits integration configs from git history Restored integration configuration files for external services: wger (Health/Fitness): - nginx.conf: Reverse proxy configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow firefly (Wealth/Finance): - nginx-buffers.conf: Buffer size configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow jellyfin (Media Server): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow open-notebook (Knowledge Base): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow Also restored nginx config mounts in docker-compose.external.yml for wger and firefly services. Restored from: commit 3b4a548^, 4490fcd^ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * feat(model-registry): Add Supabase-backed dynamic model configuration Implements a database-driven model registry that replaces hardcoded TensorZero TOML configuration with dynamic model routing and discovery. Database Schema: - 5 tables: model_providers, models, model_aliases, service_model_mappings, model_deployments - 3 views: v_active_models, v_service_models, v_active_deployments - 7 indexes for query performance - RLS policies for public read, authenticated write Model Registry Service: - FastAPI service on port 8110 - Modern lifespan context manager (replaces deprecated @app.on_event) - TensorZero TOML generation endpoint - GPU orchestrator integration via NATS mesh.gpu.* subjects - Migration script from existing TensorZero config Seed Data: - 8 providers (Ollama local/edge, Z.ai, OpenAI, Venice, Groq, OpenRouter, Together) - 18 models (chat, embedding, reranker, vision-language) - Service mappings for agent_zero, langextract, deepresearch Documentation: - Service README with API endpoints and quick start - Architecture documentation with schema reference - Service startup guide with dependency ordering 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(model-registry): Dockerfile permission and host binding fixes - Fix file ownership: Use COPY --chown instead of separate chown - Fix host binding: Use 0.0.0.0 instead of 127.0.0.1 for Docker 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(model-registry): Dockerfile permission and host binding fixes - Fix file ownership: Use COPY --chown instead of separate chown - Fix host binding: Use 0.0.0.0 instead of 127.0.0.1 for Docker 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(model-registry): Fix Supabase connectivity for Docker environment - Update main.py default SUPABASE_URL to use host.docker.internal:54321 - Use MODEL_REGISTRY_SUPABASE_URL variable to avoid .env conflicts - Follows pattern used by other services (hirag-gateway, tensorzero) Fixes connection error: "Name or service not known" 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(submodules): Restore AgentGym submodules - Add AgentGym submodule (PMOVES.AI-Edition-Hardened branch) - Restore AgentGym-RL submodule (PMOVES.AI-Edition-Hardened branch) - Both submodules are custom forks for PMOVES.AI integration Context: Each submodule fork works standalone AND with PMOVES.AI services when docked. Nested submodules exist within these forks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(submodules): Update submodule references after feature work - PMOVES-Archon: uv.lock dependency updates (5d65667) - PMOVES-A2UI: Add E2B Danger Room integration (a589d59) - pmoves/integrations/archon: Hi-RAG v2 semantic expansion (08a3210) - .gitmodules: Sync from PMOVES.AI-Edition-Hardened-v3-clean 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(submodules): Add missing submodule gitlinks to index Adds 12 submodule references that were in .gitmodules but not in the git index. These are custom forks for PMOVES.AI integration. Submodules added: - PMOVES-Creator, PMOVES-Deep-Serch, PMOVES-DoX, PMOVES-HiRAG - PMOVES-Jellyfin, PMOVES-Open-Notebook, PMOVES-Remote-View - PMOVES-Tailscale, PMOVES-Wealth, PMOVES.YT - Pmoves-Health-wger, Pmoves-Jellyfin-AI-Media-Stack Also adds submodule workflow documentation for reference. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(submodules): Remove ignore=all directives Removing 'ignore = all' from submodule configurations to enable proper tracking of submodule commits. This allows submodule changes to be committed and pushed as part of the merge to PMOVES.AI-Edition-Hardened-v3-clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES
added a commit
that referenced
this pull request
Jan 19, 2026
* fix(makefile): Correct path in check-tier-envs target The check-tier-envs target was using pmoves/env.tier-* paths but the Makefile is already in pmoves/ directory. Changed to use relative paths env.tier-* for correct file detection. Fixes issue where make -C pmoves check-tier-envs would fail to find tier env files that actually exist. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(makefile): Rename duplicate targets to avoid warnings The Makefile had duplicate target definitions that caused warnings: - up-workers at lines 147 and 730 - up-tensorzero at lines 161 and 762 - up-agents at lines 154 and 1102 - down-tensorzero at lines 242 and 765 Renamed later definitions to preserve both use cases: - up-workers (line 730) → up-workers-core - up-tensorzero (line 762) → up-tensorzero-full - up-agents (line 1102) → up-agents-stack - down-tensorzero (line 765) → down-tensorzero-full The friendly short names (with health checks) are now the only definition, while the explicit variants (with full service lists) are available via the -suffixed versions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Restore missing modules and fix service configuration Layer 2-4 validation fixes for hardened branch: **Network & Configuration Fixes:** - channel-monitor: Add pmoves_data network for postgres connectivity - GRAPH_BOOST: Fix type error (string "true" → float "0.15") **Restored Missing Modules:** - services/common/telemetry.py: PublisherMetrics and PublishTelemetry - services/common/hrm_sidecar.py: HRM sidecar runtime support - libs/providers/embedding.py: Text embedding provider - libs/langextract/*: Language extraction providers and orchestrator **Hi-RAG Gateway v2 Fixes:** - app.py: Fix lifespan function global declarations (moved all globals to top of function - cannot re-declare after yield in generators) - web/: Create StaticFiles mount directory with placeholder index.html **Monitoring:** - grafana/datasources/datasource.yml: Add Prometheus datasource All 29 services now running healthy on hardened branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix pmoves-ui network names for 5-tier architecture The pmoves-ui service was using undefined network names from the old architecture. Updated to match the 5-tier network model: - app_tier → pmoves_app - api_tier → pmoves_api - supabase_net (external, already correct) The pmoves-ui service now starts successfully on port 4482. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ui): Configure pmoves-ui for production backend connectivity **Changes:** - Add env.tier-ui to pmoves-ui service env_file list - Load UI-specific environment variables for Supabase connection **Backend Connectivity:** - SUPABASE_ANON_KEY: Real credentials (not demo keys) - SUPABASE_SERVICE_ROLE_KEY: Service role for server operations - PRESIGN_SHARED_SECRET: Required for upload presign API - NEXT_PUBLIC_SUPABASE_URL: Client-side Supabase URL - NEXT_PUBLIC_SUPABASE_ANON_KEY: Client-side auth key **Note:** env.tier-ui is gitignored (contains credentials) and must be manually configured with real Supabase credentials from .env.local 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Align tier env bootstrap with Hardened branch requirements - Add make targets: bootstrap-tier-envs, populate-tier-envs - Fix ALL tier anchors to include env.shared for credential inheritance - x-env-tier-worker (id003): NOW includes env.shared - x-env-tier-media (id004): NOW includes env.shared - x-env-tier-agent (id005): NOW includes env.shared - x-env-tier-ui (id007): NOW includes env.shared - Remove NEO4J_URL/USER/PASSWORD from env.shared (client-only vars) - Add INVIDIOUS_COMPANION_* keys to .env for invidious services This ensures services like invidious-companion (media tier) can access shared credentials and prevents Neo4j config errors from client vars. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Migrate services from docker-compose postgres to Supabase CLI **Problem:** Services referenced postgres/postgrest from docker-compose.yml which was removed, but URLs and dependencies weren't updated. **Changes:** 1. Removed postgres, postgrest, postgrest-health services from compose - These now run via Supabase CLI instead 2. Updated all service URLs from postgrest:3000/3010 to Supabase CLI: - SUPABASE_URL: http://host.docker.internal:65421 - SUPA_REST_URL: http://host.docker.internal:65421/rest/v1 3. Fixed broken depends_on references: - channel-monitor: removed postgres dependency - tokenism-simulator: changed from [nats, postgrest] to [nats] **Services updated:** - pmoves-yt, hi-rag-gateway, archon, pmoves-ui - jellyfin-bridge, flute-gateway, tokenism-simulator - evo-controller, render-webhook 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(supabase): Correct port number and gateway-agent URL **PR Review Fixes:** - Changed all Supabase URLs from port 65421 → 54321 (correct Kong port) - Fixed gateway-agent to use host.docker.internal:54321 instead of removed supabase_kong_PMOVES.AI:8000 container reference - Removed obsolete postgrest:host-gateway entry from render-webhook **Context:** Supabase CLI maps Kong to host port 54321 (internal 8000). Services must use host.docker.internal:54321 to access Supabase API. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore TAC integration framework deleted in commit 4490fcd Restores 54 slash commands, security hooks, and TAC documentation that were removed during 6-tier architecture implementation. - Slash commands across 16 categories (agents, botz, db, deploy, github, health, k8s, pipecat, search, test, tts, workitems, worktree, yt) - Security hooks (pre-tool.sh blocks dangerous ops, post-tool.sh NATS) - TAC documentation (TAC_INTEGRATION_STATUS.md) - Phase 1 & 2 security hardening docs - Testing and service documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore remaining 22 TAC commands Restores the remaining TAC commands that were deleted in commit 4490fcd: - agent-sdk/handoff.md - chit/* (4 commands): bus, decode, encode, visualize - gpu/* (3 commands): models, optimize, status - hyperdim/* (3 commands): animate, export, render - langextract/* (4 commands): extract, process, provider, status - model/* (2 commands): load, unload - n8n/* (4 commands): execute, nodes, suggest, workflows - tensorzero/models.md - tts/test-all.md Source: pr24-tac-integration worktree at commit a7e3bbe 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix service configuration issues for dual-mode data tier This commit fixes several bugs identified during code review: **Neo4j Service (Critical Fix):** - Remove env.shared from Neo4j service (use only env.tier-data) - Neo4j 5.22 rejects NEO4J_URL from env.shared as invalid config setting - This resolves "Unrecognized setting: URL" startup error **Port Configuration Fixes:** - Split NEO4J_PORT into NEO4J_HTTP_PORT (7474) and NEO4J_BOLT_PORT (7687) Previously both ports used same variable, causing conflicts when customized - Split NATS_PORT into NATS_PORT (4222) and NATS_MONITORING_PORT (9223) Previously monitoring port would break if NATS_PORT was customized **Internal Service Communication:** - Fix TensorZero URLs: Change port 3030→3000 for container-to-container calls Port 3030 is host port; containers must use internal port 3000 Services affected: botz-gateway, tokenism-simulator, gateway-agent - Add NEO4J_URL variable to hi-rag-gateway-v2 for Neo4j connectivity **Environment Variable Consistency:** - extract-worker: Change hardcoded SUPA_REST_URL to use ${VAR:-default} pattern - pdf-ingest: Change hardcoded NATS_URL to use ${VAR:-default} pattern - comfy-watcher: Change hardcoded MINIO_ENDPOINT to use ${VAR:-default} pattern These changes align with the tier architecture documented in .claude/context/tier-architecture.md and enable proper dual-mode operation for distributed PMOVES.AI deployments. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(comfy-watcher): Remove NATS_URL override to use tier credentials The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.shared and env.tier-worker already define NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env files. Fixes Authorization Violation errors in comfy-watcher NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(network): Correct Supabase network name for container connectivity The docker-compose.yml referenced `supabase_net` but Supabase CLI creates `supabase_network_PMOVES.AI`. This mismatch prevented services from reaching Supabase via container-to-container networking. Changed network reference from: supabase_net: { name: supabase_net } To: supabase_net: { name: supabase_network_PMOVES.AI } Services like pmoves-ui can now reach Supabase Kong directly via the shared network instead of relying on host.docker.internal workaround. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(nats): Remove NATS_URL override from agent-zero service The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.tier-agent defines NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env file. Also removed NATS_URL from env.shared (now tier-specific) to avoid conflicts between shared and tier-level configurations. Fixes "Authorization Violation" errors in agent-zero NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(scripts): Restore 50 utility scripts from main branch Restored scripts that were present on main branch but missing from hardened branch. These are utility scripts for: - Environment setup (env_setup.sh, env_check.sh) - Python venv creation (create_venv.sh variants) - Integration authentication (integration-auth-setup.sh) - n8n workflow management (n8n-flows-watcher.sh, n8n-import-flows.sh) - Open Notebook helpers (notebook_ingest_utils.py, etc.) - Neo4j bootstrap (neo4j_bootstrap.sh) - Credential management (credentials/*) - Proxmox bootstrap (proxmox/pmoves-bootstrap.sh) - Windows PowerShell equivalents (*.ps1 files) All scripts have been reviewed for alignment with hardened branch requirements. Container names and ports updated in separate commits. Restored from: origin/main 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(scripts): Align restored scripts with hardened branch requirements Updated container names and ports in restored scripts to match hardened branch architecture: Container name changes (cataclysm-* → hardened): - integration-auth-setup.sh: cataclysm-firefly → firefly - integration-auth-setup.sh: cataclysm-wger → pmoves-wger - integration-auth-setup.sh: cataclysm-jellyfin → jellyfin - wger_brand_defaults.sh: cataclysm-wger → pmoves-wger Port changes (Supabase migration 65421 → 54321): - pmoves.ps1: host.docker.internal:65421 → 54321 - test_m2_loop.py: 127.0.0.1:65421 → 54321 Also restored branding scripts from git history: - tailscale_brand_init.sh: Tailnet VPN initialization - tailscale_brand_up.sh: Tailnet connection script These fixes ensure the restored scripts work correctly with the hardened branch's network and service architecture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(integrations): Restore pr-kits integration configs from git history Restored integration configuration files for external services: wger (Health/Fitness): - nginx.conf: Reverse proxy configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow firefly (Wealth/Finance): - nginx-buffers.conf: Buffer size configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow jellyfin (Media Server): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow open-notebook (Knowledge Base): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow Also restored nginx config mounts in docker-compose.external.yml for wger and firefly services. Restored from: commit 3b4a548^, 4490fcd^ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES
added a commit
that referenced
this pull request
Jan 21, 2026
* fix(makefile): Correct path in check-tier-envs target The check-tier-envs target was using pmoves/env.tier-* paths but the Makefile is already in pmoves/ directory. Changed to use relative paths env.tier-* for correct file detection. Fixes issue where make -C pmoves check-tier-envs would fail to find tier env files that actually exist. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(makefile): Rename duplicate targets to avoid warnings The Makefile had duplicate target definitions that caused warnings: - up-workers at lines 147 and 730 - up-tensorzero at lines 161 and 762 - up-agents at lines 154 and 1102 - down-tensorzero at lines 242 and 765 Renamed later definitions to preserve both use cases: - up-workers (line 730) → up-workers-core - up-tensorzero (line 762) → up-tensorzero-full - up-agents (line 1102) → up-agents-stack - down-tensorzero (line 765) → down-tensorzero-full The friendly short names (with health checks) are now the only definition, while the explicit variants (with full service lists) are available via the -suffixed versions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Restore missing modules and fix service configuration Layer 2-4 validation fixes for hardened branch: **Network & Configuration Fixes:** - channel-monitor: Add pmoves_data network for postgres connectivity - GRAPH_BOOST: Fix type error (string "true" → float "0.15") **Restored Missing Modules:** - services/common/telemetry.py: PublisherMetrics and PublishTelemetry - services/common/hrm_sidecar.py: HRM sidecar runtime support - libs/providers/embedding.py: Text embedding provider - libs/langextract/*: Language extraction providers and orchestrator **Hi-RAG Gateway v2 Fixes:** - app.py: Fix lifespan function global declarations (moved all globals to top of function - cannot re-declare after yield in generators) - web/: Create StaticFiles mount directory with placeholder index.html **Monitoring:** - grafana/datasources/datasource.yml: Add Prometheus datasource All 29 services now running healthy on hardened branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix pmoves-ui network names for 5-tier architecture The pmoves-ui service was using undefined network names from the old architecture. Updated to match the 5-tier network model: - app_tier → pmoves_app - api_tier → pmoves_api - supabase_net (external, already correct) The pmoves-ui service now starts successfully on port 4482. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ui): Configure pmoves-ui for production backend connectivity **Changes:** - Add env.tier-ui to pmoves-ui service env_file list - Load UI-specific environment variables for Supabase connection **Backend Connectivity:** - SUPABASE_ANON_KEY: Real credentials (not demo keys) - SUPABASE_SERVICE_ROLE_KEY: Service role for server operations - PRESIGN_SHARED_SECRET: Required for upload presign API - NEXT_PUBLIC_SUPABASE_URL: Client-side Supabase URL - NEXT_PUBLIC_SUPABASE_ANON_KEY: Client-side auth key **Note:** env.tier-ui is gitignored (contains credentials) and must be manually configured with real Supabase credentials from .env.local 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Align tier env bootstrap with Hardened branch requirements - Add make targets: bootstrap-tier-envs, populate-tier-envs - Fix ALL tier anchors to include env.shared for credential inheritance - x-env-tier-worker (id003): NOW includes env.shared - x-env-tier-media (id004): NOW includes env.shared - x-env-tier-agent (id005): NOW includes env.shared - x-env-tier-ui (id007): NOW includes env.shared - Remove NEO4J_URL/USER/PASSWORD from env.shared (client-only vars) - Add INVIDIOUS_COMPANION_* keys to .env for invidious services This ensures services like invidious-companion (media tier) can access shared credentials and prevents Neo4j config errors from client vars. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Migrate services from docker-compose postgres to Supabase CLI **Problem:** Services referenced postgres/postgrest from docker-compose.yml which was removed, but URLs and dependencies weren't updated. **Changes:** 1. Removed postgres, postgrest, postgrest-health services from compose - These now run via Supabase CLI instead 2. Updated all service URLs from postgrest:3000/3010 to Supabase CLI: - SUPABASE_URL: http://host.docker.internal:65421 - SUPA_REST_URL: http://host.docker.internal:65421/rest/v1 3. Fixed broken depends_on references: - channel-monitor: removed postgres dependency - tokenism-simulator: changed from [nats, postgrest] to [nats] **Services updated:** - pmoves-yt, hi-rag-gateway, archon, pmoves-ui - jellyfin-bridge, flute-gateway, tokenism-simulator - evo-controller, render-webhook 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(supabase): Correct port number and gateway-agent URL **PR Review Fixes:** - Changed all Supabase URLs from port 65421 → 54321 (correct Kong port) - Fixed gateway-agent to use host.docker.internal:54321 instead of removed supabase_kong_PMOVES.AI:8000 container reference - Removed obsolete postgrest:host-gateway entry from render-webhook **Context:** Supabase CLI maps Kong to host port 54321 (internal 8000). Services must use host.docker.internal:54321 to access Supabase API. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore TAC integration framework deleted in commit 4490fcd Restores 54 slash commands, security hooks, and TAC documentation that were removed during 6-tier architecture implementation. - Slash commands across 16 categories (agents, botz, db, deploy, github, health, k8s, pipecat, search, test, tts, workitems, worktree, yt) - Security hooks (pre-tool.sh blocks dangerous ops, post-tool.sh NATS) - TAC documentation (TAC_INTEGRATION_STATUS.md) - Phase 1 & 2 security hardening docs - Testing and service documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore remaining 22 TAC commands Restores the remaining TAC commands that were deleted in commit 4490fcd: - agent-sdk/handoff.md - chit/* (4 commands): bus, decode, encode, visualize - gpu/* (3 commands): models, optimize, status - hyperdim/* (3 commands): animate, export, render - langextract/* (4 commands): extract, process, provider, status - model/* (2 commands): load, unload - n8n/* (4 commands): execute, nodes, suggest, workflows - tensorzero/models.md - tts/test-all.md Source: pr24-tac-integration worktree at commit a7e3bbe 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix service configuration issues for dual-mode data tier This commit fixes several bugs identified during code review: **Neo4j Service (Critical Fix):** - Remove env.shared from Neo4j service (use only env.tier-data) - Neo4j 5.22 rejects NEO4J_URL from env.shared as invalid config setting - This resolves "Unrecognized setting: URL" startup error **Port Configuration Fixes:** - Split NEO4J_PORT into NEO4J_HTTP_PORT (7474) and NEO4J_BOLT_PORT (7687) Previously both ports used same variable, causing conflicts when customized - Split NATS_PORT into NATS_PORT (4222) and NATS_MONITORING_PORT (9223) Previously monitoring port would break if NATS_PORT was customized **Internal Service Communication:** - Fix TensorZero URLs: Change port 3030→3000 for container-to-container calls Port 3030 is host port; containers must use internal port 3000 Services affected: botz-gateway, tokenism-simulator, gateway-agent - Add NEO4J_URL variable to hi-rag-gateway-v2 for Neo4j connectivity **Environment Variable Consistency:** - extract-worker: Change hardcoded SUPA_REST_URL to use ${VAR:-default} pattern - pdf-ingest: Change hardcoded NATS_URL to use ${VAR:-default} pattern - comfy-watcher: Change hardcoded MINIO_ENDPOINT to use ${VAR:-default} pattern These changes align with the tier architecture documented in .claude/context/tier-architecture.md and enable proper dual-mode operation for distributed PMOVES.AI deployments. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(comfy-watcher): Remove NATS_URL override to use tier credentials The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.shared and env.tier-worker already define NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env files. Fixes Authorization Violation errors in comfy-watcher NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(network): Correct Supabase network name for container connectivity The docker-compose.yml referenced `supabase_net` but Supabase CLI creates `supabase_network_PMOVES.AI`. This mismatch prevented services from reaching Supabase via container-to-container networking. Changed network reference from: supabase_net: { name: supabase_net } To: supabase_net: { name: supabase_network_PMOVES.AI } Services like pmoves-ui can now reach Supabase Kong directly via the shared network instead of relying on host.docker.internal workaround. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(nats): Remove NATS_URL override from agent-zero service The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.tier-agent defines NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env file. Also removed NATS_URL from env.shared (now tier-specific) to avoid conflicts between shared and tier-level configurations. Fixes "Authorization Violation" errors in agent-zero NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(scripts): Restore 50 utility scripts from main branch Restored scripts that were present on main branch but missing from hardened branch. These are utility scripts for: - Environment setup (env_setup.sh, env_check.sh) - Python venv creation (create_venv.sh variants) - Integration authentication (integration-auth-setup.sh) - n8n workflow management (n8n-flows-watcher.sh, n8n-import-flows.sh) - Open Notebook helpers (notebook_ingest_utils.py, etc.) - Neo4j bootstrap (neo4j_bootstrap.sh) - Credential management (credentials/*) - Proxmox bootstrap (proxmox/pmoves-bootstrap.sh) - Windows PowerShell equivalents (*.ps1 files) All scripts have been reviewed for alignment with hardened branch requirements. Container names and ports updated in separate commits. Restored from: origin/main 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(scripts): Align restored scripts with hardened branch requirements Updated container names and ports in restored scripts to match hardened branch architecture: Container name changes (cataclysm-* → hardened): - integration-auth-setup.sh: cataclysm-firefly → firefly - integration-auth-setup.sh: cataclysm-wger → pmoves-wger - integration-auth-setup.sh: cataclysm-jellyfin → jellyfin - wger_brand_defaults.sh: cataclysm-wger → pmoves-wger Port changes (Supabase migration 65421 → 54321): - pmoves.ps1: host.docker.internal:65421 → 54321 - test_m2_loop.py: 127.0.0.1:65421 → 54321 Also restored branding scripts from git history: - tailscale_brand_init.sh: Tailnet VPN initialization - tailscale_brand_up.sh: Tailnet connection script These fixes ensure the restored scripts work correctly with the hardened branch's network and service architecture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(integrations): Restore pr-kits integration configs from git history Restored integration configuration files for external services: wger (Health/Fitness): - nginx.conf: Reverse proxy configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow firefly (Wealth/Finance): - nginx-buffers.conf: Buffer size configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow jellyfin (Media Server): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow open-notebook (Knowledge Base): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow Also restored nginx config mounts in docker-compose.external.yml for wger and firefly services. Restored from: commit 3b4a548^, 4490fcd^ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
POWERFULMOVES
added a commit
that referenced
this pull request
Jan 21, 2026
…ment * fix(makefile): Correct path in check-tier-envs target (#482) * fix(makefile): Correct path in check-tier-envs target The check-tier-envs target was using pmoves/env.tier-* paths but the Makefile is already in pmoves/ directory. Changed to use relative paths env.tier-* for correct file detection. Fixes issue where make -C pmoves check-tier-envs would fail to find tier env files that actually exist. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(makefile): Rename duplicate targets to avoid warnings The Makefile had duplicate target definitions that caused warnings: - up-workers at lines 147 and 730 - up-tensorzero at lines 161 and 762 - up-agents at lines 154 and 1102 - down-tensorzero at lines 242 and 765 Renamed later definitions to preserve both use cases: - up-workers (line 730) → up-workers-core - up-tensorzero (line 762) → up-tensorzero-full - up-agents (line 1102) → up-agents-stack - down-tensorzero (line 765) → down-tensorzero-full The friendly short names (with health checks) are now the only definition, while the explicit variants (with full service lists) are available via the -suffixed versions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Restore missing modules and fix service configuration Layer 2-4 validation fixes for hardened branch: **Network & Configuration Fixes:** - channel-monitor: Add pmoves_data network for postgres connectivity - GRAPH_BOOST: Fix type error (string "true" → float "0.15") **Restored Missing Modules:** - services/common/telemetry.py: PublisherMetrics and PublishTelemetry - services/common/hrm_sidecar.py: HRM sidecar runtime support - libs/providers/embedding.py: Text embedding provider - libs/langextract/*: Language extraction providers and orchestrator **Hi-RAG Gateway v2 Fixes:** - app.py: Fix lifespan function global declarations (moved all globals to top of function - cannot re-declare after yield in generators) - web/: Create StaticFiles mount directory with placeholder index.html **Monitoring:** - grafana/datasources/datasource.yml: Add Prometheus datasource All 29 services now running healthy on hardened branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix pmoves-ui network names for 5-tier architecture The pmoves-ui service was using undefined network names from the old architecture. Updated to match the 5-tier network model: - app_tier → pmoves_app - api_tier → pmoves_api - supabase_net (external, already correct) The pmoves-ui service now starts successfully on port 4482. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ui): Configure pmoves-ui for production backend connectivity **Changes:** - Add env.tier-ui to pmoves-ui service env_file list - Load UI-specific environment variables for Supabase connection **Backend Connectivity:** - SUPABASE_ANON_KEY: Real credentials (not demo keys) - SUPABASE_SERVICE_ROLE_KEY: Service role for server operations - PRESIGN_SHARED_SECRET: Required for upload presign API - NEXT_PUBLIC_SUPABASE_URL: Client-side Supabase URL - NEXT_PUBLIC_SUPABASE_ANON_KEY: Client-side auth key **Note:** env.tier-ui is gitignored (contains credentials) and must be manually configured with real Supabase credentials from .env.local 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Align tier env bootstrap with Hardened branch requirements - Add make targets: bootstrap-tier-envs, populate-tier-envs - Fix ALL tier anchors to include env.shared for credential inheritance - x-env-tier-worker (id003): NOW includes env.shared - x-env-tier-media (id004): NOW includes env.shared - x-env-tier-agent (id005): NOW includes env.shared - x-env-tier-ui (id007): NOW includes env.shared - Remove NEO4J_URL/USER/PASSWORD from env.shared (client-only vars) - Add INVIDIOUS_COMPANION_* keys to .env for invidious services This ensures services like invidious-companion (media tier) can access shared credentials and prevents Neo4j config errors from client vars. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Migrate services from docker-compose postgres to Supabase CLI **Problem:** Services referenced postgres/postgrest from docker-compose.yml which was removed, but URLs and dependencies weren't updated. **Changes:** 1. Removed postgres, postgrest, postgrest-health services from compose - These now run via Supabase CLI instead 2. Updated all service URLs from postgrest:3000/3010 to Supabase CLI: - SUPABASE_URL: http://host.docker.internal:65421 - SUPA_REST_URL: http://host.docker.internal:65421/rest/v1 3. Fixed broken depends_on references: - channel-monitor: removed postgres dependency - tokenism-simulator: changed from [nats, postgrest] to [nats] **Services updated:** - pmoves-yt, hi-rag-gateway, archon, pmoves-ui - jellyfin-bridge, flute-gateway, tokenism-simulator - evo-controller, render-webhook 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(supabase): Correct port number and gateway-agent URL **PR Review Fixes:** - Changed all Supabase URLs from port 65421 → 54321 (correct Kong port) - Fixed gateway-agent to use host.docker.internal:54321 instead of removed supabase_kong_PMOVES.AI:8000 container reference - Removed obsolete postgrest:host-gateway entry from render-webhook **Context:** Supabase CLI maps Kong to host port 54321 (internal 8000). Services must use host.docker.internal:54321 to access Supabase API. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore TAC integration framework deleted in commit 4490fcd Restores 54 slash commands, security hooks, and TAC documentation that were removed during 6-tier architecture implementation. - Slash commands across 16 categories (agents, botz, db, deploy, github, health, k8s, pipecat, search, test, tts, workitems, worktree, yt) - Security hooks (pre-tool.sh blocks dangerous ops, post-tool.sh NATS) - TAC documentation (TAC_INTEGRATION_STATUS.md) - Phase 1 & 2 security hardening docs - Testing and service documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): Restore remaining 22 TAC commands Restores the remaining TAC commands that were deleted in commit 4490fcd: - agent-sdk/handoff.md - chit/* (4 commands): bus, decode, encode, visualize - gpu/* (3 commands): models, optimize, status - hyperdim/* (3 commands): animate, export, render - langextract/* (4 commands): extract, process, provider, status - model/* (2 commands): load, unload - n8n/* (4 commands): execute, nodes, suggest, workflows - tensorzero/models.md - tts/test-all.md Source: pr24-tac-integration worktree at commit a7e3bbe 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Fix service configuration issues for dual-mode data tier This commit fixes several bugs identified during code review: **Neo4j Service (Critical Fix):** - Remove env.shared from Neo4j service (use only env.tier-data) - Neo4j 5.22 rejects NEO4J_URL from env.shared as invalid config setting - This resolves "Unrecognized setting: URL" startup error **Port Configuration Fixes:** - Split NEO4J_PORT into NEO4J_HTTP_PORT (7474) and NEO4J_BOLT_PORT (7687) Previously both ports used same variable, causing conflicts when customized - Split NATS_PORT into NATS_PORT (4222) and NATS_MONITORING_PORT (9223) Previously monitoring port would break if NATS_PORT was customized **Internal Service Communication:** - Fix TensorZero URLs: Change port 3030→3000 for container-to-container calls Port 3030 is host port; containers must use internal port 3000 Services affected: botz-gateway, tokenism-simulator, gateway-agent - Add NEO4J_URL variable to hi-rag-gateway-v2 for Neo4j connectivity **Environment Variable Consistency:** - extract-worker: Change hardcoded SUPA_REST_URL to use ${VAR:-default} pattern - pdf-ingest: Change hardcoded NATS_URL to use ${VAR:-default} pattern - comfy-watcher: Change hardcoded MINIO_ENDPOINT to use ${VAR:-default} pattern These changes align with the tier architecture documented in .claude/context/tier-architecture.md and enable proper dual-mode operation for distributed PMOVES.AI deployments. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(comfy-watcher): Remove NATS_URL override to use tier credentials The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.shared and env.tier-worker already define NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env files. Fixes Authorization Violation errors in comfy-watcher NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(network): Correct Supabase network name for container connectivity The docker-compose.yml referenced `supabase_net` but Supabase CLI creates `supabase_network_PMOVES.AI`. This mismatch prevented services from reaching Supabase via container-to-container networking. Changed network reference from: supabase_net: { name: supabase_net } To: supabase_net: { name: supabase_network_PMOVES.AI } Services like pmoves-ui can now reach Supabase Kong directly via the shared network instead of relying on host.docker.internal workaround. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(nats): Remove NATS_URL override from agent-zero service The environment section was overriding NATS_URL with ${NATS_URL:-nats://nats:4222}, which looks for the variable in the host environment, not from env_file entries. Since env.tier-agent defines NATS_URL with credentials (nats://nats:pmoves@nats:4222), removing the explicit override allows the container to use the authenticated URL from the tier env file. Also removed NATS_URL from env.shared (now tier-specific) to avoid conflicts between shared and tier-level configurations. Fixes "Authorization Violation" errors in agent-zero NATS connection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(scripts): Restore 50 utility scripts from main branch Restored scripts that were present on main branch but missing from hardened branch. These are utility scripts for: - Environment setup (env_setup.sh, env_check.sh) - Python venv creation (create_venv.sh variants) - Integration authentication (integration-auth-setup.sh) - n8n workflow management (n8n-flows-watcher.sh, n8n-import-flows.sh) - Open Notebook helpers (notebook_ingest_utils.py, etc.) - Neo4j bootstrap (neo4j_bootstrap.sh) - Credential management (credentials/*) - Proxmox bootstrap (proxmox/pmoves-bootstrap.sh) - Windows PowerShell equivalents (*.ps1 files) All scripts have been reviewed for alignment with hardened branch requirements. Container names and ports updated in separate commits. Restored from: origin/main 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(scripts): Align restored scripts with hardened branch requirements Updated container names and ports in restored scripts to match hardened branch architecture: Container name changes (cataclysm-* → hardened): - integration-auth-setup.sh: cataclysm-firefly → firefly - integration-auth-setup.sh: cataclysm-wger → pmoves-wger - integration-auth-setup.sh: cataclysm-jellyfin → jellyfin - wger_brand_defaults.sh: cataclysm-wger → pmoves-wger Port changes (Supabase migration 65421 → 54321): - pmoves.ps1: host.docker.internal:65421 → 54321 - test_m2_loop.py: 127.0.0.1:65421 → 54321 Also restored branding scripts from git history: - tailscale_brand_init.sh: Tailnet VPN initialization - tailscale_brand_up.sh: Tailnet connection script These fixes ensure the restored scripts work correctly with the hardened branch's network and service architecture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(integrations): Restore pr-kits integration configs from git history Restored integration configuration files for external services: wger (Health/Fitness): - nginx.conf: Reverse proxy configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow firefly (Wealth/Finance): - nginx-buffers.conf: Buffer size configuration - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow jellyfin (Media Server): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow open-notebook (Knowledge Base): - docker-compose.pmoves-net.yml: Standalone deployment - README_PRSUMMARY.md: Integration documentation - .github/workflows/docker-publish.yml: CI/CD workflow Also restored nginx config mounts in docker-compose.external.yml for wger and firefly services. Restored from: commit 3b4a548^, 4490fcd^ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * feat(model-registry): Add Supabase-backed dynamic model configuration Implements a database-driven model registry that replaces hardcoded TensorZero TOML configuration with dynamic model routing and discovery. Database Schema: - 5 tables: model_providers, models, model_aliases, service_model_mappings, model_deployments - 3 views: v_active_models, v_service_models, v_active_deployments - 7 indexes for query performance - RLS policies for public read, authenticated write Model Registry Service: - FastAPI service on port 8110 - Modern lifespan context manager (replaces deprecated @app.on_event) - TensorZero TOML generation endpoint - GPU orchestrator integration via NATS mesh.gpu.* subjects - Migration script from existing TensorZero config Seed Data: - 8 providers (Ollama local/edge, Z.ai, OpenAI, Venice, Groq, OpenRouter, Together) - 18 models (chat, embedding, reranker, vision-language) - Service mappings for agent_zero, langextract, deepresearch Documentation: - Service README with API endpoints and quick start - Architecture documentation with schema reference - Service startup guide with dependency ordering 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(model-registry): Dockerfile permission and host binding fixes - Fix file ownership: Use COPY --chown instead of separate chown - Fix host binding: Use 0.0.0.0 instead of 127.0.0.1 for Docker 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(model-registry): Fix Supabase connectivity for Docker environment - Update main.py default SUPABASE_URL to use host.docker.internal:54321 - Use MODEL_REGISTRY_SUPABASE_URL variable to avoid .env conflicts - Follows pattern used by other services (hirag-gateway, tensorzero) Fixes connection error: "Name or service not known" 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(submodules): Restore AgentGym submodules - Add AgentGym submodule (PMOVES.AI-Edition-Hardened branch) - Restore AgentGym-RL submodule (PMOVES.AI-Edition-Hardened branch) - Both submodules are custom forks for PMOVES.AI integration Context: Each submodule fork works standalone AND with PMOVES.AI services when docked. Nested submodules exist within these forks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(submodules): Update submodule references after feature work - PMOVES-Archon: uv.lock dependency updates (5d65667) - PMOVES-A2UI: Add E2B Danger Room integration (a589d59) - pmoves/integrations/archon: Hi-RAG v2 semantic expansion (08a3210) - .gitmodules: Sync from PMOVES.AI-Edition-Hardened-v3-clean 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore(submodules): Remove ignore=all directives Removing 'ignore = all' from submodule configurations to enable proper tracking of submodule commits. This allows submodule changes to be committed and pushed as part of the merge to PMOVES.AI-Edition-Hardened-v3-clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(submodules): Add missing submodule entries and new feature files Updates .gitmodules to add missing submodule entries that are tracked in HEAD: - PMOVES-BotZ-gateway (PMOVES.AI-Edition-Hardened branch) - PMOVES-Danger-infra - PMOVES-MAI-UI - Pmoves-AgentGym-RL - e2b (PMOVES.AI-Edition-Hardened branch) - pmoves-e2b-mcp-server - pmoves-surf - PMOVES-E2B-Danger-Room-Deskdesktop - PMOVES-E2b-Spells (PMOVES.AI-Edition-Hardened branch) - PMOVES-A2UI (PMOVES.AI-Edition-Hardened branch) Also adds new feature files: - PR review documentation in .claude/learnings/ - Agent integration best practices guide - PMOVES BoTZ plan documentation - PMOVES-transcribe-and-fetch (new service) - Agent Zero instruments (custom, yt_download) - Knowledge and memory directories for Agent Zero - Database migrations (v5_12, v5_13, v5_14) - Persona agent creation migration - Grafana dashboards provisioning - Utility tools (pr_monitor, review_checklist, etc.) - Python uv.lock Submodule pointer updates: - PMOVES-DoX: Updated A2UI and PsyFeR references - PMOVES-ToKenism-Multi: Updated PMOVES-DoX integration references 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR includes two fixes for the PMOVES.AI-Edition-Hardened branch:
1. Makefile Path Fix
Fixes path bug in check-tier-envs validation target.
Issue: The target used absolute paths but the Makefile is already in pmoves directory.
Fix: Changed to relative paths for correct file detection.
2. TAC Integration Framework Restoration
Restores the TAC (Terminal Agent Console) integration framework that was deleted in commit
4490fcdeduring 6-tier architecture implementation.What Was Restored:
Testing
✅ Makefile path fix verified
✅ Pre-tool hook blocks dangerous operations (tested:
rm -rf /)✅ All command files restored from commit
45770f17✅ Hooks are executable