feat(deployment): Tier-based environment structure and container registry updates - #501
POWERFULMOVES wants to merge 5 commits into
Conversation
…(v3) (#479) * fix(hardened): Restore RLS policies and env security fixes v3 This commit restores critical security fixes that were lost in the 6-tier refactor (commit 8c22298) of feat/submodule-restructure. **Security Issues Fixed:** 1. **RLS Policies Deleted**: The 6-tier refactor deleted hardened RLS files: - pmoves/supabase/initdb/06_media_analysis.sql (restored) - pmoves/supabase/initdb/09_geometry_rls.sql (restored) - These tables had NO tenant isolation in base branch 2. **Hardcoded Credentials**: Base branch introduced actual credentials: - Replaced with empty values + REQUIRED comments - Added shell-style defaults for development compatibility **Changes:** - **RLS Hardening**: TO authenticated, removed 'pmoves' fallback - **Media Analysis**: detections, segments, emotions tables - **Geometry Bus**: anchors, constellations, shape_points, shape_index - **Env Files**: NEO4J_AUTH=neo4j/none, POSTGRES_PASSWORD with fallback **Security Impact:** - CRITICAL: Media and geometry tables were accessible without auth - MEDIUM: Hardcoded credentials in git (now removed) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(hardened): Add missing geometry bus schema Restored pmoves/supabase/initdb/07_geometry_bus.sql with CREATE TABLE statements for anchors, constellations, shape_points, shape_index. This file contains the core CHIT Geometry Bus schema and was missed in the initial v3 commit. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Codex Agent <codex-agent@example.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
VPS runner has config issues on Ubuntu 24.04. CHIT contract check is CPU-only (ripgrep + file checks), so ubuntu-latest is sufficient. Will re-enable VPS runner after config is fixed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Changes: - Update container image references from cataclysm-studios-inc to powerfulmoves - Add tier-based environment file loading structure - Add modular makefiles for tier-based service management Container Registry Updates: - pmoves/Makefile: Update Jellyfin image reference - pmoves/docker-compose.gpu-image.yml: Update Hi-RAG GPU image reference - pmoves/env.shared.example: Update Agent Zero, Archon, Archon UI, PMOVES.YT image references Tier-Based Environment Structure: - pmoves/docker-compose.external.yml: Add YAML anchors for tier env files - x-env-tier-data: Data services env file - x-env-tier-worker: Worker services env file - x-env-tier-media: Media services env file New Modular Makefiles: - pmoves/makefiles/tier-agents.mk: Agent service orchestration - pmoves/makefiles/tier-bus.mk: NATS message bus configuration - pmoves/makefiles/tier-data.mk: Data service management (Supabase, Qdrant, etc.) - pmoves/makefiles/tier-integrations.mk: Third-party integrations - pmoves/makefiles/tier-llm.mk: LLM provider configuration - pmoves/makefiles/tier-media.mk: Media processing services - pmoves/makefiles/tier-obs.mk: Observability stack (Prometheus, Grafana, Loki) - pmoves/makefiles/tier-supabase.mk: Supabase-specific commands - pmoves/makefiles/tier-ui.mk: UI service management - pmoves/makefiles/tier-workers.mk: Background worker services - pmoves/makefiles/utils.mk: Shared utilities and helpers 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. Note
|
| Cohort / File(s) | Summary |
|---|---|
Container Image Registry Updates pmoves/Makefile, pmoves/docker-compose.gpu-image.yml, pmoves/env.shared.example |
Registry prefix changed from ghcr.io/cataclysm-studios-inc to ghcr.io/powerfulmoves for images: pmoves-jellyfin, pmoves-agent-zero, pmoves-archon, pmoves-archon-ui, pmoves-yt, hi-rag-gateway-v2-gpu. Version tags remain unchanged. |
Environment Tiering & Credential Sanitization pmoves/env.tier-agent, pmoves/env.tier-api, pmoves/env.tier-data, pmoves/env.tier-llm, pmoves/env.tier-media, pmoves/env.tier-worker |
Updated service endpoints (Supabase URLs, GitHub Runner Controller vars), replaced hardcoded credentials with production placeholders (POSTGRES_PASSWORD, SUPABASE_JWT_SECRET, MEILI_MASTER_KEY, MINIO keys), added new provider API keys (MOONSHOT_API_KEY, VENICE_API_KEY, Z_AI_API_KEY), removed legacy credential blocks (Invidious secrets). |
Docker Compose YAML Anchoring pmoves/docker-compose.external.yml |
Introduced tier-based YAML anchors (env-tier-data, env-tier-worker, env-tier-media) for environment file loading; replaced per-service env_file arrays with anchor-based inheritance via merge keys (<<: \*env-tier-). |
GitHub Actions & CI Configuration .github/workflows/chit-contract.yml, .coderabbit.yaml |
Workflow runner changed from self-hosted [vps] to ubuntu-latest; CodeRabbit config updated with new branch, documentation coverage targets (min: 80, patch: 80), and review settings (num_commits: 10, summary: true, line_comments: true). |
Makefile Tier Service Orchestration pmoves/makefiles/tier-agents.mk, pmoves/makefiles/tier-bus.mk, pmoves/makefiles/tier-data.mk, pmoves/makefiles/tier-integrations.mk, pmoves/makefiles/tier-llm.mk, pmoves/makefiles/tier-media.mk, pmoves/makefiles/tier-obs.mk, pmoves/makefiles/tier-supabase.mk, pmoves/makefiles/tier-ui.mk, pmoves/makefiles/tier-workers.mk |
Added 10 new Makefile modules defining phony targets for service lifecycle (up/down/wait/status) across data, agent, worker, media, observability, integrations, LLM, and UI tiers. Includes health checks via curl, smoke tests, docker-compose orchestration, and environment-driven configuration. |
Utility Makefile & Orchestration pmoves/makefiles/utils.mk |
Comprehensive orchestration and utility targets (verify-all, inventory, backup, brand-defaults, test suites, model profiling, Tailscale integration, consciousness tooling, notebook integration, GPU/creator pipeline smoke tests, Discord integration). |
Database Schema: Media Analysis pmoves/supabase/initdb/06_media_analysis.sql, pmoves/supabase/supabase/sql/006_media_analysis.sql |
Added three new tables (detections, segments, emotions) with namespace-scoped columns, indexes on (namespace, video_id, timestamp/label), and row-level security (RLS) policies enforcing tenant isolation via app.current\_tenant. Authenticated-user-only access via RLS. |
Database Schema: Geometry Bus & RLS pmoves/supabase/initdb/07_geometry_bus.sql, pmoves/supabase/initdb/09_geometry_rls.sql, pmoves/supabase/sql/007_geometry_bus.sql |
Introduced anchors, constellations, shape_points, and shape_index tables with UUID PKs, FK relationships, and GIN indexes on jsonb metadata. RLS policies created for read-only pmoves_ui role with tenant isolation via namespace-based current\_setting checks. |
Supabase Migration Foundation pmoves/supabase/sql/001_init.sql |
Added minimal init migration with three placeholder tables (agent_memory, extractions, studio_board) using bigserial PKs and IF NOT EXISTS guards. |
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~60 minutes
The review spans 15+ files across heterogeneous categories (environment configuration with credential handling, 10+ new Makefiles with orchestration logic, multi-table SQL schema with RLS policies, and CI configuration). While individual Makefile targets follow repetitive patterns and many env changes are straightforward value updates, the breadth of changes, new database schema with tenant-isolation policies, credential sanitization requirements, and service orchestration logic demands careful cross-domain verification.
Possibly related PRs
- refactor(env): Phase 2 - Migrate API tier to env-tier-api anchor #350: Performs equivalent refactor of Docker Compose env_file usage by introducing and using tiered YAML env-file anchors with anchor-based inheritance for services, directly parallel to the docker-compose.external.yml changes in this PR.
- fix(hardened): Restore RLS policies and remove hardcoded credentials (v3) #479: Modifies the same media_analysis.sql schema file and sanitizes hardcoded credentials across env tier files, with overlapping credential placeholder updates and RLS policy adjustments.
- fix(infra): TensorZero ClickHouse and GPU Orchestrator startup fixes #451: Updates the same env.tier-agent configuration (Supabase endpoint rewrites and GitHub Runner Controller integration) and Docker Compose tier-based env_file anchoring, indicating shared infrastructure changes.
Suggested reviewers
- hunnibear
🐰 From the rabbit warren, a verse on this grand refactoring:
Registry keys now shine with PowerfulMoves' name,
Tiers orchestrate the dance, each service plays its game,
Anchors bind the secrets, geometry takes flight,
Schemas bloom with tenant walls, RLS guards the night. 🌙
🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Description check | The description is largely incomplete. It lacks Testing section (required), Required Checks section (required), and Follow-up Tasks/Reviewer Notes sections. | Add Testing section with commands/output, mark Required Checks, and include any Reviewer Notes for thorough context. |
✅ Passed checks (2 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title accurately summarizes the main changes: tier-based environment structure and container registry migration to powerfulmoves. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands and usage tips.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1f58e6af68
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| IF NOT EXISTS ( | ||
| SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename='anchors' AND policyname='read_anchors_tenant' | ||
| ) THEN | ||
| EXECUTE 'CREATE POLICY read_anchors_tenant ON public.anchors FOR SELECT TO authenticated USING (namespace = current_setting(''app.current_tenant'', true))'; |
There was a problem hiding this comment.
When a fresh Supabase initdb run executes this script, the CREATE POLICY ... USING (namespace = ...) statements will fail because the Geometry Bus tables created in pmoves/supabase/initdb/07_geometry_bus.sql (lines 4–49) do not define a namespace column. That causes initdb to error out before schema setup completes, so new environments won’t come up. Either add a namespace column to those tables or change the RLS predicates to a column that actually exists.
Useful? React with 👍 / 👎.
…views - Remove `language: "python"` (invalid - field expects locale codes) - Add `PMOVES.AI-Edition-Hardened-v3-clean` to reviews.branches - CodeRabbit auto-detects programming languages 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 14
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
pmoves/env.tier-worker (1)
23-37: Avoid clobbering shared secrets and align Open Notebook token.
Blank values will override earlier env files. Consider commenting them out by default and add a note to keepOPEN_NOTEBOOK_API_TOKENaligned with the UI password.Based on learnings, keep OPEN_NOTEBOOK_API_TOKEN aligned with OPEN_NOTEBOOK_PASSWORD.🔧 Safer placeholders + alignment note
-# REQUIRED: Set unique access key for production deployments -MINIO_ACCESS_KEY= -# REQUIRED: Generate with `openssl rand -base64 32` for production deployments -MINIO_SECRET_KEY= +## REQUIRED: Set unique access key for production deployments +# MINIO_ACCESS_KEY= +## REQUIRED: Generate with `openssl rand -base64 32` for production deployments +# MINIO_SECRET_KEY= @@ -SUPABASE_SERVICE_ROLE_KEY=your_supabase_service_role_key_here +# SUPABASE_SERVICE_ROLE_KEY=your_supabase_service_role_key_here @@ -OPEN_NOTEBOOK_API_TOKEN= +## Keep in sync with OPEN_NOTEBOOK_PASSWORD +# OPEN_NOTEBOOK_API_TOKEN=
🤖 Fix all issues with AI agents
In @.coderabbit.yaml:
- Around line 20-35: The config uses invalid top-level keys "documentation" and
"review"; move the docstring coverage settings into
pre_merge_checks.docstrings.threshold (set to 80 from coverage.minimum/patch)
and relocate the review settings under a top-level "reviews" block, e.g., copy
review.num_commits -> reviews.num_commits, review.summary -> reviews.summary,
and enable the line-by-line flag as reviews.line_by_line (true) so the schema
matches schema.v2.json and those settings are honored.
In `@pmoves/docker-compose.gpu-image.yml`:
- Around line 2-4: The docker-compose entry for service hi-rag-gateway-v2-gpu
references an incorrect GHCR organization in the image value (image:
${HIRAG_V2_GPU_IMAGE:-ghcr.io/powerfulmoves/hi-rag-gateway-v2-gpu:cu128-py310-stable});
verify which org actually hosts the image (powerfulmoves vs
cataclysm-studios-inc) and update the default image tag or the docs to the
correct registry string so pulls succeed; change the fallback value in the
HIRAG_V2_GPU_IMAGE default to
ghcr.io/cataclysm-studios-inc/hi-rag-gateway-v2-gpu:cu128-py310-stable if that
is the correct host (or update docs to match the powerfulmoves org) and add a
brief comment clarifying the authoritative source.
In `@pmoves/env.tier-agent`:
- Around line 19-21: Replace the non-existent hostname in the environment
variables by updating SUPABASE_URL and SUPA_REST_URL to use the documented
internal Supabase host; specifically change the values assigned to SUPABASE_URL
and SUPA_REST_URL from http://supabase_kong_PMOVES.AI:8000 and
http://supabase_kong_PMOVES.AI:8000/rest/v1 to use
http://api.supabase.internal:8000 and http://api.supabase.internal:8000/rest/v1
respectively so containers on the pmoves-net can resolve the Supabase service.
In `@pmoves/env.tier-data`:
- Around line 14-16: The env file uses shell-style expansion which Docker
Compose does not perform, so change the POSTGRES_PASSWORD entry in env.tier-data
to a literal value (e.g., POSTGRES_PASSWORD=pmoves_dev) for dev, or leave
POSTGRES_PASSWORD blank in env.tier-data and move the defaulting logic into your
docker-compose.yml environment section using the
${POSTGRES_PASSWORD:-pmoves_dev} expansion; update the POSTGRES_PASSWORD key
accordingly to ensure Compose reads the intended value.
In `@pmoves/env.tier-media`:
- Around line 9-21: The file defines empty environment variables
(MINIO_ACCESS_KEY, MINIO_SECRET_KEY, SUPABASE_SERVICE_ROLE_KEY, etc.) that will
override valid values when loaded after env.shared; update the file to avoid
accidental clobbering by either commenting out those empty assignments (e.g.
replace MINIO_ACCESS_KEY= with # MINIO_ACCESS_KEY=) or moving them into an
example/template file (e.g. env.tier-media.example) and leave this file with
only non-sensitive defaults (MINIO_ENDPOINT, MINIO_SECURE, MINIO_BUCKET,
MINIO_OUTPUT_BUCKET, SUPA_REST_URL) so runtime secrets aren’t overwritten.
Ensure references to MINIO_ACCESS_KEY, MINIO_SECRET_KEY, and
SUPABASE_SERVICE_ROLE_KEY are adjusted accordingly in deployment docs or load
order.
In `@pmoves/makefiles/tier-agents.mk`:
- Around line 20-25: The wait-agents makefile target always succeeds because
each timeout line uses "|| true"; remove the "|| true" fallbacks (or add a
fail-on-error check) so that if any timeout command fails the make target fails
and the "✅ Agents ready" echo is not run; update the wait-agents recipe (the
timeout ... bash -c 'until curl -sf http://localhost:8080/healthz; do sleep 2;
done' lines) to propagate non-zero exits (or wrap the sequence with "set -e" /
check each command's exit status) so failures are reported correctly.
- Around line 77-87: The curl invocation in the archon-rest-policy-smoke target
uses an unquoted $$hdr variable which causes word-splitting when hdr="-H
Authorization: Bearer $$auth"; fix by ensuring the header is passed as a single
argument to curl — either build hdr as just the header value and call curl -H
"$$hdr" or keep hdr as the full flag+value but quote it in the curl call
("$$hdr"); update the curl line that currently uses $$hdr so the Authorization
header is properly quoted and not split into multiple args.
In `@pmoves/makefiles/tier-data.mk`:
- Around line 20-26: The wait-data makefile target currently swallows failures
with "|| true", causing "✅ Data tier ready" to print even when services fail;
update the wait-data target (replace the four timeout curl lines) to use the
same warning/exit pattern as wait-tensorzero: run each timeout curl command
without "|| true", capture failures, print a clear warning listing which
services failed (or a single consolidated warning) and exit non-zero if any
health checks fail, similar to how wait-tensorzero handles timeouts; ensure
references to the localhost endpoints (ports 6333, 7474, 7700, 9000) remain and
keep the initial "⏳ Waiting for data tier..." and final success message only
when all checks pass.
In `@pmoves/makefiles/tier-integrations.mk`:
- Around line 68-72: The comfyui-smoke Makefile recipe treats HTTP 404 as a
successful reachability check; update the condition in the comfyui-smoke recipe
to only consider 200 or 302 as success (remove the `[ "$$code" = "404" ]`
branch), ensure the port is still taken from COMFYUI_HOST_PORT (via the local
port variable) and update the success/failure echo logic so a 404 prints the
"not ready" message with the actual HTTP code; keep the curl invocation and port
resolution unchanged and only change the conditional expression and resulting
echo text in the comfyui-smoke target.
In `@pmoves/makefiles/tier-workers.mk`:
- Around line 20-24: The wait-workers recipe (target wait-workers) currently
appends "|| true" to both timeout/curl checks which silences failures and still
prints "✅ Workers ready"; remove the "|| true" and instead check each timeout's
exit status: run the timeout + curl for each health endpoint
(http://localhost:8083/healthz and http://localhost:8084/healthz), and if a
check fails print a clear warning (e.g., echo "⚠️ Worker on :8083 failed health
check" or similar) and propagate a non-zero exit status (or set a flag and exit
1 at the end) so failures are not reported as success; update only the
wait-workers target to implement this conditional warning/exit logic.
In `@pmoves/makefiles/utils.mk`:
- Line 281: The default TAILSCALE_KEY_FILE in utils.mk hardcodes the old org
name; change the default to a non-breaking, configurable value (e.g. point to
../powerfulmoves instead of ../CATACLYSM_STUDIOS_INC, or set it empty) and add a
clear comment that users should override TAILSCALE_KEY_FILE if their directory
layout differs; update the TAILSCALE_KEY_FILE assignment (variable name:
TAILSCALE_KEY_FILE) to use a safer default like $(abspath
$(CURDIR)/../powerfulmoves/PMOVES-PROVISIONS/tailscale/tailscale_authkey.txt) or
leave it unset so consumers must provide it, and ensure any documentation or
README mentions how to override this Make variable.
- Around line 85-92: The Makefile backup target prints a message about mirroring
the MinIO bucket but never runs the command; update the backup recipe in the
backup target (in pmoves/makefiles/utils.mk) to actually invoke the MinIO client
mirror, e.g. run an mc mirror from the configured alias/bucket to $(BACKUP_DIR)
(use the existing variables like $(MINIO_BUCKET) and the expected alias name)
and ensure the command is non-failing if best-effort is intended (e.g. prefix
with -@ or handle exit code) and include a clear echo before/after similar to
the Postgres/Qdrant steps so the MinIO mirror completes and its result is
captured in $(BACKUP_DIR).
In `@pmoves/supabase/sql/001_init.sql`:
- Around line 1-3: The new tables agent_memory, extractions, and studio_board
lack Row Level Security; enable RLS for each table (ALTER TABLE ... ENABLE ROW
LEVEL SECURITY) and add restrictive policies that explicitly allow only intended
principals: e.g., create policy names like "allow_authenticated_select",
"allow_owner_insert_update_delete" that use auth.uid() or a specific
owner/tenant column (add an owner_id/created_by column to agent_memory,
extractions, studio_board if not present) and require owner_id = auth.uid() or
matching tenant_id for reads/writes; alternatively, if these are placeholders,
add a TODO comment in the migration marking them for RLS hardening and ensure a
follow-up ticket to add the ENABLE RLS statements and concrete policies before
production.
In `@pmoves/supabase/sql/006_media_analysis.sql`:
- Around line 55-71: The RLS policies currently grant full CRUD to anon and use
USING (true) / WITH CHECK (true) for tables detections, segments, and emotions,
which disables tenant isolation; instead remove or comment out the GRANTs to
anon and replace the policies detections_anon_all, segments_anon_all,
emotions_anon_all so they target authenticated and enforce namespace =
current_setting('app.current_tenant', true) in both USING and WITH CHECK
expressions (mirror the hardened pattern from initdb/06_media_analysis.sql); if
this SQL is only for local dev, add a clear WARNING comment at the top
indicating it is unsafe for production and should not be applied in prod
environments.
♻️ Duplicate comments (3)
pmoves/supabase/initdb/07_geometry_bus.sql (1)
4-49: Missingnamespacecolumn required by RLS policies.The geometry tables lack a
namespacecolumn, but09_geometry_rls.sqldefines policies usingnamespace = current_setting('app.current_tenant', true). This will cause initdb to fail when creating RLS policies.Add a
namespacecolumn to each table for tenant isolation:🔒 Add namespace column to geometry tables
CREATE TABLE IF NOT EXISTS public.anchors ( id uuid PRIMARY KEY DEFAULT gen_random_uuid(), + namespace text NOT NULL DEFAULT 'pmoves', kind text NOT NULL CHECK (kind IN ('text','audio','video','image','latent','multi')), ... ); CREATE TABLE IF NOT EXISTS public.constellations ( id uuid PRIMARY KEY DEFAULT gen_random_uuid(), + namespace text NOT NULL DEFAULT 'pmoves', anchor_id uuid NOT NULL REFERENCES public.anchors(id) ON DELETE CASCADE, ... ); CREATE TABLE IF NOT EXISTS public.shape_points ( id uuid PRIMARY KEY DEFAULT gen_random_uuid(), + namespace text NOT NULL DEFAULT 'pmoves', constellation_id uuid NOT NULL REFERENCES public.constellations(id) ON DELETE CASCADE, ... ); CREATE TABLE IF NOT EXISTS public.shape_index ( shape_id uuid NOT NULL, + namespace text NOT NULL DEFAULT 'pmoves', modality text NOT NULL, ... );pmoves/supabase/initdb/09_geometry_rls.sql (1)
26-48: RLS policy structure is correct, but depends on missingnamespacecolumn.The tenant-isolation pattern using
current_setting('app.current_tenant', true)is properly implemented with existence checks before policy creation. However, these policies reference anamespacecolumn that doesn't exist in the geometry tables defined in07_geometry_bus.sql.This will cause runtime errors:
column "namespace" does not exist.pmoves/supabase/sql/007_geometry_bus.sql (1)
1-60: Schema duplicatesinitdb/07_geometry_bus.sql- same namespace column gap applies.This migration mirrors the initdb version for consistency, which is good practice. However, the same critical issue applies: RLS policies in
09_geometry_rls.sqlexpect anamespacecolumn that isn't defined here.Ensure both files are updated together when adding the namespace column.
🧹 Nitpick comments (18)
pmoves/env.tier-llm (1)
96-110: Consider consolidating with existing optional providers section and adding documentation URLs.A few consistency observations:
Duplicate section header: "Additional Provider Keys (Optional)" duplicates the existing section at line 26 ("OPTIONAL: Additional Provider Keys"). Consider adding these keys to that existing section instead.
Missing documentation URLs: Other providers include URLs (e.g.,
# OpenRouter - https://openrouter.ai/keys). Adding URLs for Moonshot, Venice, and Z.AI would maintain consistency.Redundant comments: The "Optional: Add your X API key" pattern is unnecessary since the section header already indicates these are optional.
Naming consistency:
Z_AI_API_KEYuses an underscore separator, while the similarXAI_API_KEY(line 46) doesn't. ConsiderZAI_API_KEYfor consistency.Suggested consolidation (move to existing section around line 64)
# ElevenLabs (TTS) ELEVENLABS_API_KEY= + +# Moonshot AI (Kimi) - https://platform.moonshot.cn/ +MOONSHOT_API_KEY= + +# Venice AI - https://venice.ai/ +VENICE_API_KEY= + +# Z.AI (GLM) - https://www.zhipuai.cn/ +ZAI_API_KEY= # ============================================ # TensorZero Gateway Configuration.github/workflows/chit-contract.yml (1)
38-53: Add a pack manifest linter step in CI.
A lightweight validation step here would enforce pack manifest shape early in the workflow.As per coding guidelines, add a CI-oriented pack manifest linter for validation.➕ Example CI linter step
- uses: actions/checkout@v6 with: fetch-depth: 0 sparse-checkout: | pmoves docs .github/workflows sparse-checkout-cone-mode: false + + - name: Lint pack manifests + run: | + set -euo pipefail + python - <<'PY' + import json, glob, sys + paths = glob.glob("**/pack.manifest.json", recursive=True) + if not paths: + print("No pack manifests found.") + sys.exit(0) + required = {"name", "version", "files"} + for p in paths: + data = json.load(open(p, "r", encoding="utf-8")) + missing = required - set(data) + if missing: + print(f"{p}: missing keys {sorted(missing)}") + sys.exit(1) + print("Pack manifest lint OK.") + PYpmoves/env.tier-api (1)
45-51: Clarify redundancy betweenNEO4J_PASSWORDandNEO4J_AUTH.Both variables appear to serve related purposes—
NEO4J_AUTHuses formatneo4j/passwordwhich embeds the password. This may cause confusion about which to set. Consider documenting whether both are required or ifNEO4J_AUTHsupersedesNEO4J_PASSWORD.📝 Suggested documentation improvement
# Neo4j Connection (for Hi-RAG Knowledge Graph) NEO4J_URI=bolt://neo4j:7687 NEO4J_USER=neo4j # REQUIRED: Generate with `openssl rand -base64 24` for production deployments NEO4J_PASSWORD= -# REQUIRED: Generate with `openssl rand -base64 24` for production deployments (format: neo4j/password) +# REQUIRED: Set to neo4j/<NEO4J_PASSWORD value> for Docker auth (used by container startup) NEO4J_AUTH=pmoves/docker-compose.external.yml (1)
82-95: Consider adding profile scoping for local development.Based on repository conventions, Compose profiles (
data,workers) help scope what runs locally. Consider adding profiles to enable selective service startup.♻️ Example profile addition
open-notebook-surrealdb-ext: image: ${OPEN_NOTEBOOK_SURREAL_IMAGE:-surrealdb/surrealdb:v2} container_name: cataclysm-open-notebook-surrealdb <<: *env-tier-data + profiles: + - data + - workers command: start --log info --user ${SURREAL_USER} --pass ${SURREAL_PASS} rocksdb:/mydata/mydatabase.dbBased on learnings, using Compose profiles helps scope what runs locally.
pmoves/env.tier-data (1)
20-22: Document security implications of disabled Neo4j auth.
neo4j/nonedisables authentication entirely. While acceptable for local dev, consider adding a warning comment about never using this in production.📝 Suggested documentation
# Neo4j (Knowledge Graph) # Format: neo4j/<password> # REQUIRED: Generate password with `openssl rand -base64 24` for production deployments -# For development, use "neo4j/none" to disable auth (healthcheck compatibility) +# For development, use "neo4j/none" to disable auth (healthcheck compatibility) +# ⚠️ WARNING: neo4j/none disables ALL authentication - NEVER use in production! NEO4J_AUTH=neo4j/nonepmoves/makefiles/tier-supabase.mk (2)
13-14: Fragile directory navigation withcd ...The
cd ..assumes this Makefile is always included from a specific location (pmoves/). If included from elsewhere, the supabase CLI will run in the wrong directory.♻️ Use explicit path variable
+SUPABASE_DIR ?= $(dir $(lastword $(MAKEFILE_LIST)))/.. + up-supabase: ## Start Supabase (Postgres + Kong + Studio) `@echo` "🗄️ Starting Supabase..." `@if` [ "$(SUPABASE_RUNTIME)" = "cli" ]; then \ - cd .. && supabase start --network-id pmoves-net; \ + cd $(SUPABASE_DIR) && supabase start --network-id pmoves-net; \ else \
15-17: Consider adding healthcheck for compose mode.CLI mode has built-in wait logic, but compose mode immediately returns after
up -d. Services may not be ready when the target completes.♻️ Add compose mode readiness check
`@if` [ "$(SUPABASE_RUNTIME)" = "cli" ]; then \ cd .. && supabase start --network-id pmoves-net; \ else \ $(DC) up -d postgres postgrest gotrue realtime storage studio; \ + `@echo` "Waiting for Postgres..."; \ + timeout 30 bash -c 'until $(DC) exec -T postgres pg_isready -U postgres 2>/dev/null; do sleep 1; done' || echo "⚠️ Postgres may still be starting"; \ fipmoves/makefiles/tier-bus.mk (1)
21-22: Hardcoded container name is fragile.
pmoves-nats-1assumes a specific Compose project name. If the project name changes or differs across environments, this will fail silently (30s timeout then warning).♻️ Use docker-compose exec for portability
wait-bus: ## Wait for NATS to be ready - `@timeout` 30 bash -c 'until docker exec pmoves-nats-1 nc -z localhost 4222 2>/dev/null; do sleep 1; done' || echo "⚠️ NATS may still be starting" + `@timeout` 30 bash -c 'until $(DC) exec -T nats nc -z localhost 4222 2>/dev/null; do sleep 1; done' || echo "⚠️ NATS may still be starting"This uses the service name
natswhich is portable across project names.pmoves/makefiles/tier-integrations.mk (1)
10-17: up-integrations only starts n8n; consider including other services.The
up-integrationstarget only callsup-n8n, but the tier header (line 3) lists n8n, ComfyUI, Ultimate TTS Studio, and VibeVoice. Similarly,down-integrationsonly stops n8n. If TTS, VibeVoice, and ComfyUI should be optional, consider documenting this or adding anup-integrations-alltarget.pmoves/makefiles/tier-ui.mk (2)
37-38: ui-dev-logs fails silently when log file is missing.The
[ -f ... ] && tailpattern produces no output and exits with code 1 if the log file doesn't exist. Consider informing the user.Suggested fix
ui-dev-logs: ## Tail console dev server logs - `@cd` ui && [ -f .pmoves_ui_dev.log ] && tail -f .pmoves_ui_dev.log + `@cd` ui && if [ -f .pmoves_ui_dev.log ]; then tail -f .pmoves_ui_dev.log; else echo "No dev server log found. Is the server running?"; fi
28-32: Consider adding cleanup for orphaned PID files.If the dev server crashes, the PID file may reference a stale process. The
ui-dev-stoptarget might attempt to kill an unrelated process with the same PID. Consider validating the PID belongs to a node process before killing.pmoves/makefiles/tier-llm.mk (1)
19-22: Consider usingdowninstead ofstopfor consistency.Other tier files use
downto stop services (e.g.,down-data,down-obs), butdown-tensorzerousesstop. Whilestoppreserves containers, this inconsistency may confuse users. If preserving state is intentional, consider documenting it in the comment.pmoves/makefiles/tier-data.mk (1)
34-39: neo4j-reset: Consider longer abort window and explicit confirmation.A 2-second window (line 35) may be too short for users to react to a dangerous data-wiping operation. Also, if
docker volume rmfails (line 38), the subsequentup -d neo4jproceeds anyway, potentially leaving the system in an inconsistent state.Suggested improvement
neo4j-reset: ## DANGEROUS: wipe Neo4j volume and recreate - `@echo` "⚠️ This will delete the neo4j-data volume. Press Ctrl+C to abort." && sleep 2 + `@echo` "⚠️ This will DELETE the neo4j-data volume. Press Ctrl+C within 5 seconds to abort." && sleep 5 @$(DC) stop neo4j || true @$(DC) rm -f neo4j || true - `@docker` volume rm $(PROJECT)_neo4j-data || true - @$(DC) up -d neo4j + `@docker` volume rm $(PROJECT)_neo4j-data || (echo "⚠️ Volume removal failed" && exit 1) + @$(DC) up -d neo4j && echo "✔ Neo4j recreated"pmoves/makefiles/tier-obs.mk (2)
11-22: Inconsistent use ofdocker composevs$(DC)variable.Lines 13 and 22 use
docker composedirectly while other tier files and lines 57, 64 use$(DC). This inconsistency could cause issues if$(DC)is configured differently (e.g., with additional options or a different compose file).Suggested fix for consistency
up-obs: ## Start observability stack FIRST (Prometheus, Grafana, Loki, Promtail, cAdvisor) `@echo` "📊 Starting observability stack (monitoring FIRST)..." - @$(LOAD_ENV_SHARED) docker compose -p $(PROJECT) -f docker-compose.yml --profile monitoring up -d + @$(DC) --profile monitoring up -d @$(MAKE) --no-print-directory wait-obs `@echo` "✅ Observability ready - capturing all logs from here on" `@echo` " Grafana: http://localhost:3002 (admin/admin)" @@ -20,7 +20,7 @@ down-obs: ## Stop observability stack `@echo` "📊 Stopping observability..." - @$(LOAD_ENV_SHARED) docker compose -p $(PROJECT) -f docker-compose.yml --profile monitoring down + @$(DC) --profile monitoring down
72-75: monitoring-smoke has a race condition with 2-second sleep.The 2-second sleep after
up-monitoringmay not be sufficient for Prometheus to start scraping targets. Consider either increasing the delay or polling for samples in a loop.Suggested improvement
monitoring-smoke: up-monitoring ## Confirm blackbox exporter is scraping endpoints `@echo` "Probing key endpoints via Prometheus blackbox..." - `@sleep` 2 - `@curl` -fsS "http://localhost:$${PROMETHEUS_HOST_PORT:-9090}/api/v1/query?query=probe_success" | jq '.data.result | length' | grep -E '^[1-9]' >/dev/null && echo "✔ blackbox is reporting targets" || (echo "✖ no blackbox samples yet (wait ~15s and retry 'make -C pmoves monitoring-status')" && exit 1) + `@for` i in 1 2 3 4 5; do \ + sleep 3; \ + count=$$(curl -fsS "http://localhost:$${PROMETHEUS_HOST_PORT:-9090}/api/v1/query?query=probe_success" 2>/dev/null | jq -r '.data.result | length' 2>/dev/null || echo 0); \ + [ "$$count" -gt 0 ] && echo "✔ blackbox is reporting $$count targets" && exit 0; \ + echo "→ Waiting for blackbox samples (attempt $$i/5)..."; \ + done; \ + echo "✖ no blackbox samples after 15s (retry 'make -C pmoves monitoring-status')" && exit 1pmoves/makefiles/tier-media.mk (2)
30-31: Inconsistent docker-compose invocation.This target uses
docker composedirectly instead of the$(DC)variable used elsewhere in this file. This could cause issues if the project uses a custom compose alias or additional flags.Suggested fix
up-invidious: ## Start Invidious instance for YouTube fallback - `@bash` -lc '. ./scripts/with-env.sh; INVIDIOUS_BIND="${INVIDIOUS_BIND:-127.0.0.1:3005}" docker compose -p $(PROJECT) --profile invidious up -d invidious invidious-db invidious-companion' + `@bash` -lc '. ./scripts/with-env.sh; INVIDIOUS_BIND="$${INVIDIOUS_BIND:-127.0.0.1:3005}" $(DC) --profile invidious up -d invidious invidious-db invidious-companion'
40-57: Consider environment variable fallbacks for smoke test URLs.The smoke tests hardcode
localhost:8077,localhost:8093, andlocalhost:8097. While acceptable for local testing, theyt-docs-*targets below demonstrate a better pattern using${PMOVES_YT_BASE_URL:-http://localhost:8091}fallbacks, which enables testing against remote or non-default deployments.Example for yt-smoke
yt-smoke: ## Smoke test YouTube service - `@echo` "[YT] Health check" && \ - curl -sf http://localhost:8077/healthz >/dev/null && echo "✔ YT health OK" || (echo "✖ YT health failed" && exit 1) + @$(LOAD_ENV_SHARED); \ + base=$${PMOVES_YT_BASE_URL:-http://localhost:8077}; \ + echo "[YT] Health check ($$base)" && \ + curl -sf "$$base/healthz" >/dev/null && echo "✔ YT health OK" || (echo "✖ YT health failed" && exit 1)pmoves/makefiles/utils.mk (1)
62-65: Validation logic may produce confusing output.The validation checks for services on
pmoves-netbut thegrep -vexcludessupabase|archon|agent-zero. If these services are found onpmoves-net, they'll be excluded from the warning, but the comment says "Backend services should NOT be on pmoves-net (except UIs)". The logic and comment don't align — Archon and Agent Zero are agent services, not UIs.Clarify the exclusion list
validate-tier: ## Validate tier network compliance (backend services should NOT be on pmoves-net) `@echo` "🔍 Validating tier network compliance..." - `@echo` "Backend services should NOT be on pmoves-net (except UIs)" - `@docker` ps --format "table {{.Names}}\t{{.Networks}}" 2>/dev/null | grep pmoves-net | grep -v "supabase\|archon\|agent-zero" || echo "✅ No unexpected services on pmoves-net" + `@echo` "Backend services should NOT be on pmoves-net (except agents and UIs)" + `@docker` ps --format "table {{.Names}}\t{{.Networks}}" 2>/dev/null | grep pmoves-net | grep -vE "(supabase|archon|agent-zero|ui)" || echo "✅ No unexpected services on pmoves-net"
| # Documentation comment requirements | ||
| documentation: | ||
| # Require docstrings for Python functions/classes | ||
| coverage: | ||
| minimum: 80 | ||
| patch: 80 | ||
|
|
||
| # Review depth settings | ||
| review: | ||
| # Number of commits to review in a PR | ||
| num_commits: 10 | ||
|
|
||
| # Include summary of PR | ||
| summary: true | ||
|
|
||
| # Enable line-by-line reviews |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Find and read the .coderabbit.yaml file
find . -name ".coderabbit.yaml" -o -name "coderabbit.yaml" | head -20Repository: POWERFULMOVES/PMOVES.AI
Length of output: 85
🏁 Script executed:
# Also search for schema-related files
find . -type f \( -name "*schema*" -o -name "*config*" \) | grep -E "\.(json|yaml|yml)$" | head -20Repository: POWERFULMOVES/PMOVES.AI
Length of output: 244
🏁 Script executed:
# Look for documentation files that might describe the schema
find . -type f \( -name "*.md" -o -name "*.rst" \) | xargs grep -l "coderabbit\|CodeRabbit\|schema" 2>/dev/null | head -10Repository: POWERFULMOVES/PMOVES.AI
Length of output: 445
🏁 Script executed:
# Read the .coderabbit.yaml file with line numbers
cat -n ./.coderabbit.yamlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 1106
🌐 Web query:
CodeRabbit .coderabbit.yaml schema configuration documentation
💡 Result:
Here are the official CodeRabbit docs for the .coderabbit.yaml schema and configuration:
- Configuration reference (full schema-driven field list & descriptions). [1]
- Guide: configuring CodeRabbit via a .coderabbit.yaml file with examples and template. [2]
- Notes on configuration inheritance and hierarchy (how repository/central/UI settings merge). [3]
Key points: place .coderabbit.yaml in the repository root; the docs include example files and the machine-readable JSON schema (referenced in examples as yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json). [2][1]
Sources:
- CodeRabbit — Configuration reference. [1]
- CodeRabbit — Configure using a YAML file (examples & template). [2]
- CodeRabbit — Configuration inheritance (hierarchy & merging). [3]
🌐 Web query:
CodeRabbit schema json https://coderabbit.ai/integrations/schema.v2.json documentation review top-level keys
💡 Result:
Top-level keys in the CodeRabbit schema (schema.v2.json) and brief descriptions:
- language — locale for reviews (ISO codes, default "en-US"). [1]
- tone_instructions — custom tone for reviews/chat (string). [1]
- early_access — enable early-access features (boolean). [1]
- enable_free_tier — enable free-tier features (boolean). [1]
- inheritance — whether to inherit parent settings (boolean). [1]
- reviews — object with many review-related settings (profile, summaries, labeling, auto-review, path filters, commit/review status, etc.). [1]
- finishing_touches — options for generated docstrings and unit tests. [1]
- pre_merge_checks — pre-merge check configuration (docstring coverage, title/description checks, linked-issue assessment, custom checks). [1]
Source: CodeRabbit schema JSON. [1] https://coderabbit.ai/integrations/schema.v2.json
🌐 Web query:
CodeRabbit configuration pre_merge_checks docstrings threshold
💡 Result:
Short answer: CodeRabbit’s pre_merge_checks include a Docstring Coverage check with a configurable "threshold" (percentage). The default threshold is 80% and you can set it in .coderabbit.yaml under reviews.pre_merge_checks.docstrings.threshold (example: threshold: 85). You can also set the check’s mode (off | warning | error). [1][2]
Sources:
- CodeRabbit Pre‑Merge Checks (Docstring Coverage, default 80% and YAML example). [1]
- Configuration reference / .coderabbit.yaml schema (pre_merge_checks.docstrings). [2]
documentation and review are invalid top-level keys in CodeRabbit schema.
Per the official CodeRabbit schema (schema.v2.json), valid top-level keys are reviews, pre_merge_checks, language, tone_instructions, early_access, enable_free_tier, inheritance, and finishing_touches. The documentation and review blocks at lines 20–36 will be ignored.
Move documentation coverage to pre_merge_checks.docstrings.threshold and keep review settings nested within the reviews block:
🔧 Schema-aligned adjustment
reviews:
review_status: true
branches:
- "PMOVES.AI-Edition-Hardened"
- "PMOVES.AI-Edition-Hardened-v3-clean"
- "feat/hardened-*"
- "fix/hardened-*"
excluded_branches:
- "main"
- "origin/main"
+ num_commits: 10
+ summary: true
+ line_comments: true
-# Documentation comment requirements
-documentation:
- # Require docstrings for Python functions/classes
- coverage:
- minimum: 80
- patch: 80
-
-# Review depth settings
-review:
- # Number of commits to review in a PR
- num_commits: 10
-
- # Include summary of PR
- summary: true
-
- # Enable line-by-line reviews
- line_comments: true
+
+pre_merge_checks:
+ docstrings:
+ threshold: 80🤖 Prompt for AI Agents
In @.coderabbit.yaml around lines 20 - 35, The config uses invalid top-level
keys "documentation" and "review"; move the docstring coverage settings into
pre_merge_checks.docstrings.threshold (set to 80 from coverage.minimum/patch)
and relocate the review settings under a top-level "reviews" block, e.g., copy
review.num_commits -> reviews.num_commits, review.summary -> reviews.summary,
and enable the line-by-line flag as reviews.line_by_line (true) so the schema
matches schema.v2.json and those settings are honored.
| hi-rag-gateway-v2-gpu: | ||
| image: ${HIRAG_V2_GPU_IMAGE:-ghcr.io/cataclysm-studios-inc/hi-rag-gateway-v2-gpu:cu128-py310-stable} | ||
| image: ${HIRAG_V2_GPU_IMAGE:-ghcr.io/powerfulmoves/hi-rag-gateway-v2-gpu:cu128-py310-stable} | ||
| runtime: nvidia |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Search for references to this image in the codebase
rg "hi-rag-gateway-v2-gpu" --type yml --type yaml -A 2 -B 2Repository: POWERFULMOVES/PMOVES.AI
Length of output: 94
🏁 Script executed:
# Look for any CI/CD, build, or deployment files that might reference image publishing
fd -e "yml" -e "yaml" -e "json" -e "dockerfile" -e "Dockerfile" | head -20Repository: POWERFULMOVES/PMOVES.AI
Length of output: 929
🏁 Script executed:
# Check the docker-compose file structure and any environment variable documentation
cat pmoves/docker-compose.gpu-image.ymlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 2208
🏁 Script executed:
# Search for any documentation or scripts related to GPU image building/publishing
fd -e "md" -e "sh" -e "py" | xargs rg -l "HIRAG.*GPU|cu128|py310" 2>/dev/null | head -10Repository: POWERFULMOVES/PMOVES.AI
Length of output: 348
🏁 Script executed:
# Check the hi-rag-gateway-v2 documentation
cat pmoves/docs/services/hi-rag-gateway-v2/README.md | head -100Repository: POWERFULMOVES/PMOVES.AI
Length of output: 6272
🏁 Script executed:
# Search for GitHub Actions or CI/CD workflows
fd -e "yml" -e "yaml" | xargs rg -l "ghcr.io|gpu|image" | grep -i "workflow\|action\|ci\|\.github"Repository: POWERFULMOVES/PMOVES.AI
Length of output: 49
🏁 Script executed:
# Look for any GitHub Actions workflows
fd ".github" -type dRepository: POWERFULMOVES/PMOVES.AI
Length of output: 237
🏁 Script executed:
# Search for Dockerfile related to hi-rag-gateway-v2-gpu
fd -i "dockerfile*" | xargs grep -l "hi-rag-gateway\|cu128\|py310" 2>/dev/nullRepository: POWERFULMOVES/PMOVES.AI
Length of output: 295
🏁 Script executed:
# Search for any image build or publish scripts
rg "ghcr.io/powerfulmoves/hi-rag-gateway-v2-gpu" --type-list all -lRepository: POWERFULMOVES/PMOVES.AI
Length of output: 456
🏁 Script executed:
# Check the Dockerfile.gpu to see what organization it references
cat pmoves/services/hi-rag-gateway-v2/Dockerfile.gpuRepository: POWERFULMOVES/PMOVES.AI
Length of output: 2244
🏁 Script executed:
# Search for references to both organizations in the codebase
rg "cataclysm-studios-inc|powerfulmoves" --type yaml -B 2 -A 2Repository: POWERFULMOVES/PMOVES.AI
Length of output: 6580
🏁 Script executed:
# Look for any CI/CD workflows or build scripts that push images
fd -type f -name "*.yml" -o -name "*.yaml" | xargs grep -l "push\|build\|registry\|ghcr" 2>/dev/null | head -10Repository: POWERFULMOVES/PMOVES.AI
Length of output: 237
🏁 Script executed:
# Check if there are any recent commits or documentation about the image registry
rg "HIRAG_V2_GPU_IMAGE" -B 2 -A 2Repository: POWERFULMOVES/PMOVES.AI
Length of output: 1412
Clarify the correct GHCR organization for the GPU image.
The docker-compose file specifies ghcr.io/powerfulmoves/hi-rag-gateway-v2-gpu:cu128-py310-stable, but the service documentation recommends ghcr.io/cataclysm-studios-inc/hi-rag-gateway-v2-gpu:cu128-py310-stable. Verify which organization hosts the actual image and update either the compose file or documentation to ensure the tag is correct, or the container will fail to pull at startup.
🤖 Prompt for AI Agents
In `@pmoves/docker-compose.gpu-image.yml` around lines 2 - 4, The docker-compose
entry for service hi-rag-gateway-v2-gpu references an incorrect GHCR
organization in the image value (image:
${HIRAG_V2_GPU_IMAGE:-ghcr.io/powerfulmoves/hi-rag-gateway-v2-gpu:cu128-py310-stable});
verify which org actually hosts the image (powerfulmoves vs
cataclysm-studios-inc) and update the default image tag or the docs to the
correct registry string so pulls succeed; change the fallback value in the
HIRAG_V2_GPU_IMAGE default to
ghcr.io/cataclysm-studios-inc/hi-rag-gateway-v2-gpu:cu128-py310-stable if that
is the correct host (or update docs to match the powerfulmoves org) and add a
brief comment clarifying the authoritative source.
| SUPABASE_URL=http://supabase_kong_PMOVES.AI:8000 | ||
| SUPABASE_SERVICE_ROLE_KEY= # REQUIRED: From Supabase CLI | ||
| SUPA_REST_URL=http://postgrest:3000/rest/v1 | ||
| SUPA_REST_URL=http://supabase_kong_PMOVES.AI:8000/rest/v1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Search for docker-compose files and check for container name patterns
find . -type f \( -name "docker-compose*" -o -name "*.compose.yml" -o -name "*.compose.yaml" \) | head -20Repository: POWERFULMOVES/PMOVES.AI
Length of output: 639
🏁 Script executed:
# Search for supabase_kong container references in compose files
rg -n "supabase_kong" -A 2 -B 2 --type yamlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 2111
🏁 Script executed:
# Also check for any references to the specific container name with dots
rg -n "supabase_kong_PMOVES\.AI" --type yamlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 666
🏁 Script executed:
# Search for service definitions in docker-compose files - look for supabase services
rg -n "services:" -A 300 pmoves/docker-compose.yml | grep -A 50 "supabase"Repository: POWERFULMOVES/PMOVES.AI
Length of output: 3983
🏁 Script executed:
# Look for the supabase_kong service definition more specifically
rg -n "supabase_kong" -B 5 -A 5 pmoves/docker-compose.yml | head -50Repository: POWERFULMOVES/PMOVES.AI
Length of output: 1740
🏁 Script executed:
# Check if there's a network definition that might explain the naming
rg -n "networks:" -A 20 pmoves/docker-compose.ymlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 42643
🏁 Script executed:
# Search for any service definition named supabase_kong
rg -n "supabase_kong:" pmoves/docker-compose.ymlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 49
🏁 Script executed:
# Look for container_name or hostname definitions that might set this name
rg -n "container_name|hostname" pmoves/docker-compose.yml | grep -i supabaseRepository: POWERFULMOVES/PMOVES.AI
Length of output: 49
🏁 Script executed:
# Search across all compose files for supabase_kong service definition
find pmoves -name "docker-compose*.yml" -exec rg -l "supabase_kong:" {} \;Repository: POWERFULMOVES/PMOVES.AI
Length of output: 49
🏁 Script executed:
# Search for supabase_kong in all files and directories
find pmoves -type f \( -name "*.yml" -o -name "*.yaml" -o -name "*.env*" \) -exec rg -l "supabase_kong" {} \;Repository: POWERFULMOVES/PMOVES.AI
Length of output: 128
🏁 Script executed:
# Check if there's a separate supabase compose or configuration directory
ls -la pmoves/ | grep -i supabaseRepository: POWERFULMOVES/PMOVES.AI
Length of output: 127
🏁 Script executed:
# Search for any references that might explain this configuration
rg -n "supabase_kong_PMOVES\.AI" --type yaml --type txtRepository: POWERFULMOVES/PMOVES.AI
Length of output: 666
🏁 Script executed:
# Check contents of supabase directory
ls -la pmoves/supabase/Repository: POWERFULMOVES/PMOVES.AI
Length of output: 351
🏁 Script executed:
# Look for any service definition or configuration in supabase directory
find pmoves/supabase -type f \( -name "*.yml" -o -name "*.yaml" -o -name "*.json" -o -name "docker-compose*" \) | head -20Repository: POWERFULMOVES/PMOVES.AI
Length of output: 49
🏁 Script executed:
# Check if there's documentation or README about the supabase setup
find pmoves/supabase -name "README*" -o -name "*.md" | xargs cat 2>/dev/nullRepository: POWERFULMOVES/PMOVES.AI
Length of output: 49
🏁 Script executed:
# Check if postgrest service uses container_name or aliases that might explain the supabase_kong name
rg -n "postgrest" -B 5 -A 20 pmoves/docker-compose.yml | grep -A 20 "^postgrest:"Repository: POWERFULMOVES/PMOVES.AI
Length of output: 49
🏁 Script executed:
# Look for any network alias definitions that might create this hostname
rg -n "aliases:" -A 5 pmoves/docker-compose.ymlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 217
🏁 Script executed:
# Check the env file referenced in the review to see if there's more context
cat -n pmoves/env.tier-agent | head -30Repository: POWERFULMOVES/PMOVES.AI
Length of output: 1705
🏁 Script executed:
# Check if there's any documentation about supabase setup or external service
find pmoves -name "*.md" -o -name "README*" | xargs grep -l "supabase_kong\|Kong\|gateway" 2>/dev/null | head -5Repository: POWERFULMOVES/PMOVES.AI
Length of output: 384
🏁 Script executed:
# Look for any instructions about external Supabase setup
find . -maxdepth 2 -name "*.md" | xargs grep -l "Supabase\|supabase" 2>/dev/nullRepository: POWERFULMOVES/PMOVES.AI
Length of output: 518
🏁 Script executed:
# Verify the complete context of postgrest service definition
rg -n "postgrest:" -A 30 pmoves/docker-compose.yml | head -50Repository: POWERFULMOVES/PMOVES.AI
Length of output: 1776
🏁 Script executed:
# Search for any Kong service or gateway configuration
rg -n "kong" -i pmoves/docker-compose.ymlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 421
🏁 Script executed:
# Check if there's documentation about external Supabase or Kong setup
cat ./README.md | grep -A 10 -B 2 -i "supabase\|kong" | head -40Repository: POWERFULMOVES/PMOVES.AI
Length of output: 5412
🏁 Script executed:
# Look for any env file that might have the actual service definition
find pmoves -name "env*" -type f | xargs grep -l "supabase_kong" 2>/dev/nullRepository: POWERFULMOVES/PMOVES.AI
Length of output: 118
🏁 Script executed:
# Check the Supabase service documentation
cat pmoves/docs/services/supabase/README.md 2>/dev/null | head -100Repository: POWERFULMOVES/PMOVES.AI
Length of output: 49
🏁 Script executed:
# Check the env example file to see if there's guidance
cat pmoves/env.tier-agent.example | head -30Repository: POWERFULMOVES/PMOVES.AI
Length of output: 1577
🏁 Script executed:
# Check if there's documentation about Supabase CLI setup
grep -r "supabase start\|supabase_kong\|Kong gateway" pmoves/docs/ 2>/dev/null | head -20Repository: POWERFULMOVES/PMOVES.AI
Length of output: 2018
🏁 Script executed:
# Look at the main README for Supabase setup instructions
cat pmoves/README.md 2>/dev/null | grep -A 20 -B 5 -i "supabase\|kong" | head -60Repository: POWERFULMOVES/PMOVES.AI
Length of output: 49
🏁 Script executed:
# Check the LOCAL_TOOLING_REFERENCE mentioned in main README
cat pmoves/docs/LOCAL_TOOLING_REFERENCE.md 2>/dev/null | grep -A 10 -B 2 -i "supabase\|kong\|port 8000" | head -50Repository: POWERFULMOVES/PMOVES.AI
Length of output: 9863
🏁 Script executed:
# Verify the correct Supabase internal hostname from documentation
cat pmoves/docs/LOCAL_TOOLING_REFERENCE.md | grep -A 5 -B 5 "api.supabase.internal"Repository: POWERFULMOVES/PMOVES.AI
Length of output: 2585
🏁 Script executed:
# Check if there are any recent changes or PRs related to supabase_kong
git log --oneline -20 -- pmoves/env.tier-agent pmoves/docker-compose.yml 2>/dev/null | head -10Repository: POWERFULMOVES/PMOVES.AI
Length of output: 149
🏁 Script executed:
# Verify what the actual Supabase CLI provides
grep -r "api.supabase\|supabase.internal" pmoves/docs/ pmoves/*.md 2>/dev/nullRepository: POWERFULMOVES/PMOVES.AI
Length of output: 2033
Correct the Supabase URL hostname to match the documented standard.
The hostname supabase_kong_PMOVES.AI does not exist in the docker-compose configuration. According to the documentation (LOCAL_TOOLING_REFERENCE.md, Dec 2025), services targeting the Supabase stack should use http://api.supabase.internal:8000 instead. Update lines 19 and 21 to:
SUPABASE_URL=http://api.supabase.internal:8000
SUPA_REST_URL=http://api.supabase.internal:8000/rest/v1
This matches the established pattern for compose-based Supabase networking and will resolve DNS correctly inside Docker containers on the pmoves-net network.
🤖 Prompt for AI Agents
In `@pmoves/env.tier-agent` around lines 19 - 21, Replace the non-existent
hostname in the environment variables by updating SUPABASE_URL and SUPA_REST_URL
to use the documented internal Supabase host; specifically change the values
assigned to SUPABASE_URL and SUPA_REST_URL from
http://supabase_kong_PMOVES.AI:8000 and
http://supabase_kong_PMOVES.AI:8000/rest/v1 to use
http://api.supabase.internal:8000 and http://api.supabase.internal:8000/rest/v1
respectively so containers on the pmoves-net can resolve the Supabase service.
| # REQUIRED: Generate with `openssl rand -base64 24` for production deployments | ||
| # For development, a safe default is provided | ||
| POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-pmoves_dev} |
There was a problem hiding this comment.
Shell variable expansion won't work in Docker Compose env_file.
Docker Compose's env_file directive reads files as literal key=value pairs without shell expansion. The syntax ${POSTGRES_PASSWORD:-pmoves_dev} will be passed as a literal string, not expanded to pmoves_dev.
🐛 Proposed fix
For dev defaults, either:
Option 1: Use literal default value (recommended for dev env file):
-POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-pmoves_dev}
+POSTGRES_PASSWORD=pmoves_devOption 2: Leave empty and set defaults in docker-compose.yml environment section:
environment:
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-pmoves_dev}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # REQUIRED: Generate with `openssl rand -base64 24` for production deployments | |
| # For development, a safe default is provided | |
| POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-pmoves_dev} | |
| # REQUIRED: Generate with `openssl rand -base64 24` for production deployments | |
| # For development, a safe default is provided | |
| POSTGRES_PASSWORD=pmoves_dev |
🤖 Prompt for AI Agents
In `@pmoves/env.tier-data` around lines 14 - 16, The env file uses shell-style
expansion which Docker Compose does not perform, so change the POSTGRES_PASSWORD
entry in env.tier-data to a literal value (e.g., POSTGRES_PASSWORD=pmoves_dev)
for dev, or leave POSTGRES_PASSWORD blank in env.tier-data and move the
defaulting logic into your docker-compose.yml environment section using the
${POSTGRES_PASSWORD:-pmoves_dev} expansion; update the POSTGRES_PASSWORD key
accordingly to ensure Compose reads the intended value.
| MINIO_ENDPOINT=minio:9000 | ||
| MINIO_ACCESS_KEY=minioadmin | ||
| MINIO_SECRET_KEY=minioadmin | ||
| # REQUIRED: Set unique access key for production deployments | ||
| MINIO_ACCESS_KEY= | ||
| # REQUIRED: Generate with `openssl rand -base64 32` for production deployments | ||
| MINIO_SECRET_KEY= | ||
| MINIO_SECURE=false | ||
| MINIO_BUCKET=assets | ||
| MINIO_OUTPUT_BUCKET=outputs | ||
|
|
||
| # ----- Supabase (Metadata) ----- | ||
| SUPA_REST_URL=http://host.docker.internal:65421/rest/v1 | ||
| SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.fake_key_replace_with_real | ||
| SUPABASE_SERVICE_ROLE_KEY=your_supabase_service_role_key_here | ||
|
|
There was a problem hiding this comment.
Empty placeholders can override layered env values.
If this file is loaded after env.shared, the blank assignments will clobber valid credentials. Consider commenting them out by default or moving them to an example file to avoid accidental overrides.
🔧 Safer placeholder pattern
-# REQUIRED: Set unique access key for production deployments
-MINIO_ACCESS_KEY=
-# REQUIRED: Generate with `openssl rand -base64 32` for production deployments
-MINIO_SECRET_KEY=
+## REQUIRED: Set unique access key for production deployments
+# MINIO_ACCESS_KEY=
+## REQUIRED: Generate with `openssl rand -base64 32` for production deployments
+# MINIO_SECRET_KEY=
@@
-SUPABASE_SERVICE_ROLE_KEY=your_supabase_service_role_key_here
+# SUPABASE_SERVICE_ROLE_KEY=your_supabase_service_role_key_here🤖 Prompt for AI Agents
In `@pmoves/env.tier-media` around lines 9 - 21, The file defines empty
environment variables (MINIO_ACCESS_KEY, MINIO_SECRET_KEY,
SUPABASE_SERVICE_ROLE_KEY, etc.) that will override valid values when loaded
after env.shared; update the file to avoid accidental clobbering by either
commenting out those empty assignments (e.g. replace MINIO_ACCESS_KEY= with #
MINIO_ACCESS_KEY=) or moving them into an example/template file (e.g.
env.tier-media.example) and leave this file with only non-sensitive defaults
(MINIO_ENDPOINT, MINIO_SECURE, MINIO_BUCKET, MINIO_OUTPUT_BUCKET, SUPA_REST_URL)
so runtime secrets aren’t overwritten. Ensure references to MINIO_ACCESS_KEY,
MINIO_SECRET_KEY, and SUPABASE_SERVICE_ROLE_KEY are adjusted accordingly in
deployment docs or load order.
| wait-workers: ## Wait for workers to be ready | ||
| @echo "⏳ Waiting for workers..." | ||
| @timeout 60 bash -c 'until curl -sf http://localhost:8083/healthz; do sleep 2; done' || true | ||
| @timeout 60 bash -c 'until curl -sf http://localhost:8084/healthz; do sleep 2; done' || true | ||
| @echo "✅ Workers ready" |
There was a problem hiding this comment.
wait-workers silently ignores failures and reports success.
The || true on lines 22-23 suppresses errors, so "Workers ready" is printed even if both health checks fail. This could mask startup failures.
Suggested fix: Report warnings on timeout
wait-workers: ## Wait for workers to be ready
`@echo` "⏳ Waiting for workers..."
- `@timeout` 60 bash -c 'until curl -sf http://localhost:8083/healthz; do sleep 2; done' || true
- `@timeout` 60 bash -c 'until curl -sf http://localhost:8084/healthz; do sleep 2; done' || true
- `@echo` "✅ Workers ready"
+ `@timeout` 60 bash -c 'until curl -sf http://localhost:8083/healthz; do sleep 2; done' || echo "⚠️ Worker on :8083 may still be starting"
+ `@timeout` 60 bash -c 'until curl -sf http://localhost:8084/healthz; do sleep 2; done' || echo "⚠️ Worker on :8084 may still be starting"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| wait-workers: ## Wait for workers to be ready | |
| @echo "⏳ Waiting for workers..." | |
| @timeout 60 bash -c 'until curl -sf http://localhost:8083/healthz; do sleep 2; done' || true | |
| @timeout 60 bash -c 'until curl -sf http://localhost:8084/healthz; do sleep 2; done' || true | |
| @echo "✅ Workers ready" | |
| wait-workers: ## Wait for workers to be ready | |
| `@echo` "⏳ Waiting for workers..." | |
| `@timeout` 60 bash -c 'until curl -sf http://localhost:8083/healthz; do sleep 2; done' || echo "⚠️ Worker on :8083 may still be starting" | |
| `@timeout` 60 bash -c 'until curl -sf http://localhost:8084/healthz; do sleep 2; done' || echo "⚠️ Worker on :8084 may still be starting" |
🤖 Prompt for AI Agents
In `@pmoves/makefiles/tier-workers.mk` around lines 20 - 24, The wait-workers
recipe (target wait-workers) currently appends "|| true" to both timeout/curl
checks which silences failures and still prints "✅ Workers ready"; remove the
"|| true" and instead check each timeout's exit status: run the timeout + curl
for each health endpoint (http://localhost:8083/healthz and
http://localhost:8084/healthz), and if a check fails print a clear warning
(e.g., echo "⚠️ Worker on :8083 failed health check" or similar) and propagate a
non-zero exit status (or set a flag and exit 1 at the end) so failures are not
reported as success; update only the wait-workers target to implement this
conditional warning/exit logic.
| backup: ## Dump Postgres, snapshot Qdrant, mirror MinIO bucket, Meili dump (best-effort) | ||
| @mkdir -p "$(BACKUP_DIR)" | ||
| @echo "→ Backing up Postgres…" | ||
| -@$(DC) exec -T postgres pg_dump -U $$POSTGRES_USER -d $$POSTGRES_DB > "$(BACKUP_DIR)/postgres.sql" | ||
| @echo "→ Snapshotting Qdrant…" | ||
| -@curl -fsS "http://localhost:6333/collections/$$QDRANT_COLLECTION/snapshots" -X POST -H 'content-type: application/json' -d '{}' > "$(BACKUP_DIR)/qdrant_snapshot.json" | ||
| @echo "→ Mirroring MinIO bucket '$(MINIO_BUCKET)' (requires mc alias 'local')…" | ||
| @echo "✔ Backup written to: $(BACKUP_DIR)" |
There was a problem hiding this comment.
MinIO backup step is incomplete.
The target prints a message about mirroring the MinIO bucket but doesn't actually execute the mc mirror command. This appears to be a placeholder.
Suggested fix to complete the MinIO backup
backup: ## Dump Postgres, snapshot Qdrant, mirror MinIO bucket, Meili dump (best-effort)
`@mkdir` -p "$(BACKUP_DIR)"
`@echo` "→ Backing up Postgres…"
-@$(DC) exec -T postgres pg_dump -U $$POSTGRES_USER -d $$POSTGRES_DB > "$(BACKUP_DIR)/postgres.sql"
`@echo` "→ Snapshotting Qdrant…"
-@curl -fsS "http://localhost:6333/collections/$$QDRANT_COLLECTION/snapshots" -X POST -H 'content-type: application/json' -d '{}' > "$(BACKUP_DIR)/qdrant_snapshot.json"
`@echo` "→ Mirroring MinIO bucket '$(MINIO_BUCKET)' (requires mc alias 'local')…"
+ -@mc mirror local/$(MINIO_BUCKET) "$(BACKUP_DIR)/minio/" 2>/dev/null || echo " (skipped: mc not configured)"
`@echo` "✔ Backup written to: $(BACKUP_DIR)"Would you like me to open an issue to track completing the backup implementation?
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| backup: ## Dump Postgres, snapshot Qdrant, mirror MinIO bucket, Meili dump (best-effort) | |
| @mkdir -p "$(BACKUP_DIR)" | |
| @echo "→ Backing up Postgres…" | |
| -@$(DC) exec -T postgres pg_dump -U $$POSTGRES_USER -d $$POSTGRES_DB > "$(BACKUP_DIR)/postgres.sql" | |
| @echo "→ Snapshotting Qdrant…" | |
| -@curl -fsS "http://localhost:6333/collections/$$QDRANT_COLLECTION/snapshots" -X POST -H 'content-type: application/json' -d '{}' > "$(BACKUP_DIR)/qdrant_snapshot.json" | |
| @echo "→ Mirroring MinIO bucket '$(MINIO_BUCKET)' (requires mc alias 'local')…" | |
| @echo "✔ Backup written to: $(BACKUP_DIR)" | |
| backup: ## Dump Postgres, snapshot Qdrant, mirror MinIO bucket, Meili dump (best-effort) | |
| `@mkdir` -p "$(BACKUP_DIR)" | |
| `@echo` "→ Backing up Postgres…" | |
| -@$(DC) exec -T postgres pg_dump -U $$POSTGRES_USER -d $$POSTGRES_DB > "$(BACKUP_DIR)/postgres.sql" | |
| `@echo` "→ Snapshotting Qdrant…" | |
| -@curl -fsS "http://localhost:6333/collections/$$QDRANT_COLLECTION/snapshots" -X POST -H 'content-type: application/json' -d '{}' > "$(BACKUP_DIR)/qdrant_snapshot.json" | |
| `@echo` "→ Mirroring MinIO bucket '$(MINIO_BUCKET)' (requires mc alias 'local')…" | |
| -@mc mirror local/$(MINIO_BUCKET) "$(BACKUP_DIR)/minio/" 2>/dev/null || echo " (skipped: mc not configured)" | |
| `@echo` "✔ Backup written to: $(BACKUP_DIR)" |
🤖 Prompt for AI Agents
In `@pmoves/makefiles/utils.mk` around lines 85 - 92, The Makefile backup target
prints a message about mirroring the MinIO bucket but never runs the command;
update the backup recipe in the backup target (in pmoves/makefiles/utils.mk) to
actually invoke the MinIO client mirror, e.g. run an mc mirror from the
configured alias/bucket to $(BACKUP_DIR) (use the existing variables like
$(MINIO_BUCKET) and the expected alias name) and ensure the command is
non-failing if best-effort is intended (e.g. prefix with -@ or handle exit code)
and include a clear echo before/after similar to the Postgres/Qdrant steps so
the MinIO mirror completes and its result is captured in $(BACKUP_DIR).
| # ============================================================================= | ||
|
|
||
| .PHONY: tailscale-save-key tailscale-join tailscale-rejoin tailscale-status tailscale-logout | ||
| TAILSCALE_KEY_FILE?=$(abspath $(CURDIR)/../CATACLYSM_STUDIOS_INC/PMOVES-PROVISIONS/tailscale/tailscale_authkey.txt) |
There was a problem hiding this comment.
Hardcoded path references old organization name.
The TAILSCALE_KEY_FILE default path references CATACLYSM_STUDIOS_INC, which conflicts with the registry migration to powerfulmoves in this PR. This path also assumes a specific directory structure that may not exist for all users.
Consider making the path configurable or updating the org reference
-TAILSCALE_KEY_FILE?=$(abspath $(CURDIR)/../CATACLYSM_STUDIOS_INC/PMOVES-PROVISIONS/tailscale/tailscale_authkey.txt)
+TAILSCALE_KEY_FILE?=$(abspath $(CURDIR)/../PMOVES-PROVISIONS/tailscale/tailscale_authkey.txt)Or document that users should override this variable if they have a different directory structure.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| TAILSCALE_KEY_FILE?=$(abspath $(CURDIR)/../CATACLYSM_STUDIOS_INC/PMOVES-PROVISIONS/tailscale/tailscale_authkey.txt) | |
| TAILSCALE_KEY_FILE?=$(abspath $(CURDIR)/../PMOVES-PROVISIONS/tailscale/tailscale_authkey.txt) |
🤖 Prompt for AI Agents
In `@pmoves/makefiles/utils.mk` at line 281, The default TAILSCALE_KEY_FILE in
utils.mk hardcodes the old org name; change the default to a non-breaking,
configurable value (e.g. point to ../powerfulmoves instead of
../CATACLYSM_STUDIOS_INC, or set it empty) and add a clear comment that users
should override TAILSCALE_KEY_FILE if their directory layout differs; update the
TAILSCALE_KEY_FILE assignment (variable name: TAILSCALE_KEY_FILE) to use a safer
default like $(abspath
$(CURDIR)/../powerfulmoves/PMOVES-PROVISIONS/tailscale/tailscale_authkey.txt) or
leave it unset so consumers must provide it, and ensure any documentation or
README mentions how to override this Make variable.
| create table if not exists agent_memory(id bigserial primary key); | ||
| create table if not exists extractions(id bigserial primary key); | ||
| create table if not exists studio_board(id bigserial primary key); |
There was a problem hiding this comment.
Missing RLS on new tables.
These stub tables lack Row Level Security. Per the RLS hardening checklist, all tables should have RLS enabled with appropriate policies before production use.
If these are placeholder schemas, consider adding RLS now or flagging them for follow-up:
🔒 Suggested RLS enablement
create table if not exists agent_memory(id bigserial primary key);
create table if not exists extractions(id bigserial primary key);
create table if not exists studio_board(id bigserial primary key);
+
+-- Enable RLS (policies to be added when schema is finalized)
+ALTER TABLE agent_memory ENABLE ROW LEVEL SECURITY;
+ALTER TABLE extractions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE studio_board ENABLE ROW LEVEL SECURITY;As per coding guidelines, Supabase RLS hardening is required for files matching **/{migrations,supabase}/**/*.sql.
🤖 Prompt for AI Agents
In `@pmoves/supabase/sql/001_init.sql` around lines 1 - 3, The new tables
agent_memory, extractions, and studio_board lack Row Level Security; enable RLS
for each table (ALTER TABLE ... ENABLE ROW LEVEL SECURITY) and add restrictive
policies that explicitly allow only intended principals: e.g., create policy
names like "allow_authenticated_select", "allow_owner_insert_update_delete" that
use auth.uid() or a specific owner/tenant column (add an owner_id/created_by
column to agent_memory, extractions, studio_board if not present) and require
owner_id = auth.uid() or matching tenant_id for reads/writes; alternatively, if
these are placeholders, add a TODO comment in the migration marking them for RLS
hardening and ensure a follow-up ticket to add the ENABLE RLS statements and
concrete policies before production.
| GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.detections TO anon; | ||
| GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.segments TO anon; | ||
| GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.emotions TO anon; | ||
|
|
||
| ALTER TABLE public.detections ENABLE ROW LEVEL SECURITY; | ||
| ALTER TABLE public.segments ENABLE ROW LEVEL SECURITY; | ||
| ALTER TABLE public.emotions ENABLE ROW LEVEL SECURITY; | ||
|
|
||
| DO $$ BEGIN | ||
| CREATE POLICY detections_anon_all ON public.detections FOR ALL TO anon USING (true) WITH CHECK (true); | ||
| EXCEPTION WHEN duplicate_object THEN NULL; END $$; | ||
| DO $$ BEGIN | ||
| CREATE POLICY segments_anon_all ON public.segments FOR ALL TO anon USING (true) WITH CHECK (true); | ||
| EXCEPTION WHEN duplicate_object THEN NULL; END $$; | ||
| DO $$ BEGIN | ||
| CREATE POLICY emotions_anon_all ON public.emotions FOR ALL TO anon USING (true) WITH CHECK (true); | ||
| EXCEPTION WHEN duplicate_object THEN NULL; END $$; |
There was a problem hiding this comment.
Critical: Wide-open RLS policies bypass tenant isolation.
Granting full CRUD to anon with USING (true) WITH CHECK (true) policies negates RLS protection entirely—any unauthenticated user can read and write all rows across all tenants.
Compare with the hardened version in initdb/06_media_analysis.sql which correctly:
- Comments out anon grants
- Uses
TO authenticatedwithnamespace = current_setting('app.current_tenant', true)
If this file is for dev/testing only, consider adding a prominent warning or removing it. For production, use the hardened initdb version.
🔒 Hardened policy pattern
-GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.detections TO anon;
-GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.segments TO anon;
-GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.emotions TO anon;
+-- HARDENED: Remove anonymous grants - access via authenticated JWT only
DO $$ BEGIN
- CREATE POLICY detections_anon_all ON public.detections FOR ALL TO anon USING (true) WITH CHECK (true);
+ CREATE POLICY detections_tenant_isolation ON public.detections FOR ALL
+ TO authenticated
+ USING (namespace = current_setting('app.current_tenant', true))
+ WITH CHECK (namespace = current_setting('app.current_tenant', true));
EXCEPTION WHEN duplicate_object THEN NULL; END $$;As per coding guidelines, Supabase RLS hardening is required.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.detections TO anon; | |
| GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.segments TO anon; | |
| GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.emotions TO anon; | |
| ALTER TABLE public.detections ENABLE ROW LEVEL SECURITY; | |
| ALTER TABLE public.segments ENABLE ROW LEVEL SECURITY; | |
| ALTER TABLE public.emotions ENABLE ROW LEVEL SECURITY; | |
| DO $$ BEGIN | |
| CREATE POLICY detections_anon_all ON public.detections FOR ALL TO anon USING (true) WITH CHECK (true); | |
| EXCEPTION WHEN duplicate_object THEN NULL; END $$; | |
| DO $$ BEGIN | |
| CREATE POLICY segments_anon_all ON public.segments FOR ALL TO anon USING (true) WITH CHECK (true); | |
| EXCEPTION WHEN duplicate_object THEN NULL; END $$; | |
| DO $$ BEGIN | |
| CREATE POLICY emotions_anon_all ON public.emotions FOR ALL TO anon USING (true) WITH CHECK (true); | |
| EXCEPTION WHEN duplicate_object THEN NULL; END $$; | |
| -- HARDENED: Remove anonymous grants - access via authenticated JWT only | |
| ALTER TABLE public.detections ENABLE ROW LEVEL SECURITY; | |
| ALTER TABLE public.segments ENABLE ROW LEVEL SECURITY; | |
| ALTER TABLE public.emotions ENABLE ROW LEVEL SECURITY; | |
| DO $$ BEGIN | |
| CREATE POLICY detections_tenant_isolation ON public.detections FOR ALL | |
| TO authenticated | |
| USING (namespace = current_setting('app.current_tenant', true)) | |
| WITH CHECK (namespace = current_setting('app.current_tenant', true)); | |
| EXCEPTION WHEN duplicate_object THEN NULL; END $$; | |
| DO $$ BEGIN | |
| CREATE POLICY segments_tenant_isolation ON public.segments FOR ALL | |
| TO authenticated | |
| USING (namespace = current_setting('app.current_tenant', true)) | |
| WITH CHECK (namespace = current_setting('app.current_tenant', true)); | |
| EXCEPTION WHEN duplicate_object THEN NULL; END $$; | |
| DO $$ BEGIN | |
| CREATE POLICY emotions_tenant_isolation ON public.emotions FOR ALL | |
| TO authenticated | |
| USING (namespace = current_setting('app.current_tenant', true)) | |
| WITH CHECK (namespace = current_setting('app.current_tenant', true)); | |
| EXCEPTION WHEN duplicate_object THEN NULL; END $$; |
🤖 Prompt for AI Agents
In `@pmoves/supabase/sql/006_media_analysis.sql` around lines 55 - 71, The RLS
policies currently grant full CRUD to anon and use USING (true) / WITH CHECK
(true) for tables detections, segments, and emotions, which disables tenant
isolation; instead remove or comment out the GRANTs to anon and replace the
policies detections_anon_all, segments_anon_all, emotions_anon_all so they
target authenticated and enforce namespace =
current_setting('app.current_tenant', true) in both USING and WITH CHECK
expressions (mirror the hardened pattern from initdb/06_media_analysis.sql); if
this SQL is only for local dev, add a clear WARNING comment at the top
indicating it is unsafe for production and should not be applied in prod
environments.
- Include env.shared in all tier YAML anchors (data, api, worker, media, agent, llm, ui) - Remove inline postgres/postgrest services (use Supabase CLI instead) - Update anchor names from id* to descriptive env-tier-* names - Align docker-compose.external.yml with same tier-based pattern This resolves the 2 critical issues identified in PR review: 1. YAML anchor format missing env.shared base configuration 2. PostgreSQL/PostgREST service placement conflicting with Supabase CLI Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…ion) Resolved 24 merge conflicts with strategy: - Security-first: Preferred v3-clean security hardening - 6-tier architecture: Kept v3-clean's tier-based env structure over main's 8-tier - Submodule alignment: All submodules point to PMOVES.AI-Edition-Hardened - Container registry: Preserved powerfulmoves registry migration from PR #501 Conflict resolutions: - .gitmodules: Kept Hardened branch directives for 40+ submodules - docker-compose.yml: Kept 6-tier architecture, Supabase CLI pattern - Makefile: Kept v3-clean tier-specific targets - service_registry.py: Kept 6-tier (DATA, API, LLM, WORKER, MEDIA, AGENT) - Submodules: All 9 submodule conflicts resolved with v3-clean pointers - 10 lower-priority files: Accepted v3-clean versions New files staged: - pmoves/vendor/e2b* submodules (root-level structure from v3-clean) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…nablement This is a focused PR extracted from PR #501, containing only the essential container registry migration and CodeRabbit configuration fixes. **Container Registry Migration:** - Update image references from ghcr.io/cataclysm-studios-inc to ghcr.io/powerfulmoves - Affected images: Agent Zero, Archon, Archon UI, PMOVES.YT, Hi-RAG GPU - Files updated: pmoves/env.shared.example, pmoves/docker-compose.gpu-image.yml **CodeRabbit Configuration:** - Remove invalid `language: "python"` field (field expects locale codes) - Add PMOVES.AI-Edition-Hardened-v3-clean to reviews.branches - Add documentation coverage requirements (80% minimum) - CodeRabbit now auto-detects programming languages **Excluded from this PR:** - 8-tier modular makefiles (tier-*.mk files) - conflicts with 6-tier architecture - Extensive Makefile refactoring (1500+ lines of changes) - Inline PostgreSQL/PostgREST service definitions - These can be addressed in separate focused PRs **Note:** RLS policy restoration files (06_media_analysis.sql, 07_geometry_bus.sql, 09_geometry_rls.sql) were already merged to v3-clean via PR #500 (model registry). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
Tier makefiles (8-tier architecture) conflict with 6-tier security decision. Container registry migration extracted to PR #508 (now merged). The 8-tier model was rejected for security reasons - see plan document for details. |
1 participant
Summary
Updates deployment configuration with tier-based environment file loading structure and container registry migration to `powerfulmoves`.
Changes
Container Registry Migration
Updated all container image references from `ghcr.io/cataclysm-studios-inc` to `ghcr.io/powerfulmoves`:
Tier-Based Environment Structure
Added YAML anchors for modular environment file loading in `pmoves/docker-compose.external.yml`:
New Modular Makefiles
Added `pmoves/makefiles/` directory with tier-specific makefiles:
🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes
New Features
Infrastructure & Deployment
Security
✏️ Tip: You can customize this high-level summary in your review settings.