docs: archive 2025 next steps snapshot by POWERFULMOVES · Pull Request #52 · POWERFULMOVES/PMOVES.AI

POWERFULMOVES · 2025-09-20T06:18:45Z

Summary

move the previously recovered NEXT_STEPS content into docs/archive/NEXT_STEPS_2025-09-08.md
leave current roadmap-focused NEXT_STEPS.md and reference the archived snapshot
note the archived snapshot in the documentation index for navigation

Testing

not run (docs-only change)

https://chatgpt.com/codex/tasks/task_b_68ce400fdcd48324a922602d2aa82030

coderabbitai · 2025-09-20T06:18:51Z

Walkthrough

Documentation changes archive the detailed NEXT_STEPS content, add an archival snapshot, and update the docs index to reference both the live pointer and the archived version. No code or public APIs are affected.

Changes

Cohort / File(s)	Summary of Changes
Docs archival update `pmoves/docs/NEXT_STEPS.md`	Replaced detailed content with a single link to the archived snapshot `NEXT_STEPS_2025-09-08.md`.
Docs index update `pmoves/docs/README_DOCS_INDEX.md`	Added a "Next Steps" entry linking to `NEXT_STEPS.md` and the archive `archive/NEXT_STEPS_2025-09-08.md`.
Archive addition `pmoves/docs/archive/NEXT_STEPS_2025-09-08.md`	Added comprehensive archived planning document detailing PMOVES v5 next steps, milestones, and workstreams.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

I tucked our plans in an archive burrow, neat,
A carrot-ink map for future rabbit feet.
Today’s page is light, a signpost to the stash—
Tomorrow’s hops will follow in a dash.
Thump-thump: docs in rows, trails kept bright,
Moonlit commits, and everything right. 🥕✨

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Free

📥 Commits

Reviewing files that changed from the base of the PR and between 93748b6 and 5068fd7.

📒 Files selected for processing (3)

pmoves/docs/NEXT_STEPS.md (1 hunks)
pmoves/docs/README_DOCS_INDEX.md (1 hunks)
pmoves/docs/archive/NEXT_STEPS_2025-09-08.md (1 hunks)

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…n-to-archive docs: archive 2025 next steps snapshot

Gateway viz.py (alerts #38-#41): - Add os.path.basename + regex sanitization for shape_id path param in /shape/{shape_id}.svg and /shape/{shape_id}/constellations Gateway workflow.py (alert #68): - Replace detail=f"... {exc}" with generic error messages in /yt/ingest and /hirag/upsert-batch error handlers Supaserch app.py (alert #60): - Replace detail=str(exc) with generic message in search endpoint Sensitive data logging (alerts #135, #136, #138): - Mask secret values in chit_credential_demo.py output (show only first 4 chars) - Remove secret name from credential_fetcher.py error log - Remove key names from rotation output pmoves-yt yt.py (alerts #42-#52, 11 alerts): - Add _safe_video_id() sanitizer using os.path.basename + regex - Apply at all path-construction entry points: base_prefix(), _download_with_yt_dlp, _download_with_companion, _download_with_invidious, yt_transcript - Constrain archive_path to stay within YT_ARCHIVE_DIR Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(ci): restore self-hosted GHCR pipeline and harden registry auth fallback * fix(ci): standardize GHCR auth for self-hosted workflows * docs(secrets): add local GitHub App runbook and PAT pairing guidance * fix(ci): resolve workflow-file blockers for codeql and secret sync * docs(audit): record CI hardening and workflow blocker fixes * docs(audit): record self-hosted runner availability blocker * fix(ci): align codeql and ghcr jobs with runner labels * fix(ci): harden ghcr auth fallback and gating * fix(ci): retarget vps-labeled jobs to linux x64 runner * fix(security): resolve 17 CodeQL alerts across 6 rule categories B1: Stack trace exposure (6 alerts) — Remove exception object references from HTTP response scopes; use exc_info=True for server-side logging; add `from None` to break exception chains in FastAPI handlers. Files: consciousness-service, gpu-orchestrator, tokenism-simulator B2: Path injection (2 alerts) — Add resolve().relative_to() validation in _safe_model_path to satisfy CodeQL taint tracking. File: hf-mcp-server/main.py B3: URL substring sanitization (4 alerts) — Replace startswith("http") with urlparse().scheme validation; add scheme guard before hostname comparison. Files: credential_setup.py, migrate_tensorzero.py B4: ReDoS (1 alert) — Replace overlapping regex [a-z]+b with simple literal pattern in test file. File: test_security_fixes.py B5: Missing workflow permissions (3 alerts) — Add top-level permissions blocks to workflow files (CodeQL requires workflow-level, not just job-level). Files: env-preflight.yml, sql-policy-lint.yml, sync-secrets-local.yml B6: Weak hashing (1 alert) — Replace HMAC-SHA256 kid derivation with BLAKE2b keyed hash (kid is a non-security identifier tag, not password storage). File: geometry_decoder.py Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: clean up submodule state and fix Deskdesktop typo - Update PMOVES-DoX pointer (commit skill hint context tags) - Update PMOVES-HiRAG pointer (commit production readme) - Update PMOVES-Archon pointer (commit skill hint context tags) - Fix Deskdesktop → Desktop typo in E2B_INTEGRATION.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): use os.path.basename for CodeQL-recognized taint sanitization - Replace resolve().relative_to() with os.path.basename() in _safe_model_path — CodeQL does not model relative_to() as a sanitizer but does recognize os.path.basename() (fixes alerts #126, #127, #145, #146, #147) - Apply same basename pattern to output_dir in hf_model_convert_gguf - Fix 2 missed detail=str(e) stack trace exposures in consciousness-service /cgp/batch and /persona/evaluate endpoints (fixes alerts #82, #124, #125) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): resolve 19 remaining CodeQL alerts across 6 services Gateway viz.py (alerts #38-#41): - Add os.path.basename + regex sanitization for shape_id path param in /shape/{shape_id}.svg and /shape/{shape_id}/constellations Gateway workflow.py (alert #68): - Replace detail=f"... {exc}" with generic error messages in /yt/ingest and /hirag/upsert-batch error handlers Supaserch app.py (alert #60): - Replace detail=str(exc) with generic message in search endpoint Sensitive data logging (alerts #135, #136, #138): - Mask secret values in chit_credential_demo.py output (show only first 4 chars) - Remove secret name from credential_fetcher.py error log - Remove key names from rotation output pmoves-yt yt.py (alerts #42-#52, 11 alerts): - Add _safe_video_id() sanitizer using os.path.basename + regex - Apply at all path-construction entry points: base_prefix(), _download_with_yt_dlp, _download_with_companion, _download_with_invidious, yt_transcript - Constrain archive_path to stay within YT_ARCHIVE_DIR Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(security): document accepted-risk SSRF CodeQL alerts (#143, #144) - hi-rag-gateway-v2 alert #143: SSRF with 5-layer defense (URL validation, scheme check, DNS resolve, private IP block, redirect block). Only DNS-rebinding TOCTOU gap remains. - hi-rag-gateway alert #144: identical defense pattern, same risk. Both already documented the TOCTOU gap in docstrings; this adds explicit CodeQL alert references for audit traceability. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): resolve 2 CodeQL regressions on PR #653 - archive_path: replace resolve()+startswith() with os.path.basename() to constrain archive file within YT_ARCHIVE_DIR (CodeQL-recognized sanitizer) - timeout: validate and clamp at HTTP boundary in route.ts files (health-all, services-hub) instead of inside serviceHealth.ts, breaking the taint chain before it reaches probeService() - Revert serviceHealth.ts safeTimeout — callers now send sanitized values Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): resolve 6 final CodeQL alerts across gateway and yt services - chit.py: remove codebook_path from public API to prevent arbitrary file read via HTTP body (alerts #34, #35, #36). Server now always uses CHIT_CODEBOOK_PATH env var. - client.html: replace innerHTML with DOM API (createElement/textContent) to prevent XSS through user-controlled base URL input (alert #6). - mcp_youtube_adapter.py: replace substring 'in netloc' with exact hostname match to prevent URL spoofing via youtube.com.evil.com (alert #23). - yt.py _infer_platform: parse URL and check netloc for soundcloud.com instead of substring match on full URL to prevent credential leakage to attacker-controlled hosts (alert #24). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(chit): add CHIT documentation suite — 7 new files + 6 navigation headers Create structured documentation entry point with 3 reading paths: - Understand it (no code): 01 → 02 → 03 - Use it (developer): 05 → 04 → GEOMETRY_BUS_INTEGRATION - Go deep (math/arch): CGP_v1.0_SPECIFICATION → Integrating Math New files: README, Glossary (25 terms), What Is CHIT explainer, GEOMETRY BUS guide, EVO SWARM guide, API Reference (13 endpoints), Quickstart (6 runnable examples). Navigation headers added to 6 existing files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(chit): integrate remaining 12 PMOVESCHIT files + cross-links Expand README.md with 5-layer Iceberg structure covering protocol, conceptual frameworks, applied systems, vision, and reference docs. Add navigation headers to all 12 previously-unintegrated files. Add 10 new glossary terms (Agent Card, CONCH, DARKXSIDE, Distillation, Flute, Orbital Resonance, Prosodic Synthesis, SHIFTEST, Tabula Rasa, Three-Body Problem). Cross-link 6 external documents back to the CHIT documentation suite. Update decoder file headers to reflect implemented status (chit_decoder.py, chit_decoder_mm.py). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(integrations): add symbiotic enhancement layer — 4 new docs + 14 nav headers Create unified integration documentation entry point with specialized references for CHIT tools, secrets pipeline, and GPU orchestration. Navigation headers on all existing integration/secrets docs link back to the master overview, completing the cross-reference web. New files: - INTEGRATIONS_OVERVIEW.md: master entry point for all 5 integration systems - CHIT_TOOLS_CATALOG.md: catalog of 13+ Python tools with usage examples - SECRETS_PIPELINE_REFERENCE.md: complete 6-step funnel and tier architecture - GPU_ORCHESTRATION_GUIDE.md: API reference, CLI skills, make targets, hardware Modified files (14): navigation headers + cross-links on all existing integration, secrets, CHIT, and monitoring docs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(audit): consolidate 17 audit docs into production audit dashboard Create PRODUCTION_AUDIT_DASHBOARD.md as single source of truth for production readiness, replacing 17 scattered audit/tracking documents accumulated Feb 7-17. Dashboard tracks 7 active blockers (1 critical, 3 high, 2 medium, 1 low) and archives 17 resolved items. - Add superseded-by navigation header to all 17 audit docs - Stage SUBMODULE_ALIGNMENT_SITREP_2026-02-14.md as diagnostic artifact - Add Production Audit section to documentation-index.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(cleanup): supersede 10 more audit docs, rename junk files, fix cross-refs - Add dashboard nav header to 10 missed audit-era docs (Feb 7-8) - Add AB-8 blocker for 5 conflicting PRs from merge tracker - Rename AGENTS/.md → agent_vision_notes.md, p.md → placeholder.md - Fix broken relative links in PMOVESCHIT/README.md and SCRIPTS_AND_TESTS_GUIDE.md - Update documentation-index.md (Flute status clarification, bump version to 2.2) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(reorg): move 100 root-level docs into categorized subdirectories Reorganize pmoves/docs/ from 112 root-level files to 8 navigation/index files. New directories created: - audit/ (29 files) — dated audit reports, validation summaries - operations/ (19 files) — bring-up, env, ports, testing, make targets - infrastructure/ (14 files) — Docker, CI, networking, distributed compute - submodules/ (8 files) — submodule architecture, contracts, sync guides - security/ (6 files) — secrets, runbooks, credentials Additional moves into existing directories: - integrations/ (5 files) — ARCHON, E2B, external integrations - services/supabase/ (8 files) — Supabase exploration, setup, migrations - services/neo4j/ (1 file) — Neo4j migrations - PMOVESCHIT/ (1 file) — CHIT user guide - AGENTS/ (2 files) — agent context patterns, personas - archive/ (7 files) — historical build notes, draft PRs, binary files Root-level navigation files preserved: BRANCH_STRATEGY, ROADMAP, NEXT_STEPS, MODEL_REGISTRY, MODEL_SOURCE_OF_TRUTH, MIGRATION_GUIDE, README_DOCS_INDEX, BOTZ_SKILLS_MARKETPLACE Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(index): refresh documentation index v2.3 with directory map - Add directory map table showing new doc organization - Fix broken relative links after Phase 1 moves: - ../PRODUCTION_AUDIT_PREP → ../audit/PRODUCTION_AUDIT_PREP - ../LOCAL_DEV.md → ../operations/LOCAL_DEV.md - ../UI_NOTEBOOK_WORKBENCH → ../infrastructure/UI_NOTEBOOK_WORKBENCH - ../SUBMODULE_INTEGRATION_CONTRACT → ../submodules/... - ../operations/SMOKETESTS.md (was ../SMOKETESTS.md) - ../operations/ENVIRONMENT_POLICY.md (was ENVIRONMENT_POLICY.md) - Update agent registry count reference (35 → 47) in cross-reference hub Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(agents): add 12 missing agents to registry, bump taxonomy v1.4.0 New agents added to pmoves/config/agent_registry.yaml: - a2ui (standard/ui) — PMOVES-A2UI - agentgym (standard/agent) — PMOVES-AgentGym - agentgym_rl (specialized/agent) — Pmoves-AgentGym-RL - creator (standard/media) — PMOVES-Creator - llama_lab (specialized/llm) — PMOVES-llama-throughput-lab - surf (utility/agent) — pmoves-surf - e2b_danger_room (standard/agent) — PMOVES-E2B-Danger-Room - e2b_desktop (standard/ui) — PMOVES-E2B-Danger-Room-Desktop - danger_infra (utility/worker) — PMOVES-Danger-infra - e2b_spells (utility/agent) — PMOVES-E2b-Spells - transcribe_and_fetch (specialized/media) — PMOVES-transcribe-and-fetch - jellyfin_ai (specialized/media) — Pmoves-Jellyfin-AI-Media-Stack Taxonomy bumped from v1.3.0 → v1.4.0. Total agents: 59 (30 standard, 11 specialized, 18 utility). Update cross-reference hub agent count. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(agents): update cross-reference hub and class taxonomy for v1.4.0 - Add 12 new agents to Type Chart table in class taxonomy - Update class example lists with v1.4.0 agents - Update agent count to 59 in cross-reference hub - Bump last-updated dates to 2026-02-18 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(skills): add 20 skills across 7 new namespaces New skill namespaces and files: nats/ (4 skills): - status: NATS server + JetStream health - streams: List and inspect JetStream streams - publish: Publish messages to NATS subjects - monitor: Real-time message flow monitoring minio/ (3 skills): - status: MinIO health + bucket listing - presign: Generate presigned URLs via Presign service - upload: Upload files to MinIO buckets observability/ (3 skills): - dashboard: Prometheus/Grafana/Loki stack health - query: PromQL and LogQL query execution - alerts: Active alert and rule inspection discord/ (2 skills): - status: Publisher-Discord bot health - notify: Send notifications via NATS events jellyfin/ (2 skills): - status: Jellyfin Bridge health - sync: Trigger metadata sync to Supabase notebook/ (3 skills): - status: Open Notebook sync health - sync: Manual sync trigger - query: Search indexed notebook content via Hi-RAG/Meilisearch cipher/ (3 skills): - store: Store memory entries in Cipher Memory - search: Search knowledge graph for stored memories - reasoning: Store and retrieve reasoning traces Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(registry): update skill registry with new namespace mappings - Add nats/*, minio/*, observability/*, discord/*, jellyfin/*, notebook/*, cipher/* to $domain_tag_skill_map - Add 3 new domain tags: monitoring, messaging, storage - Update submodule skill lists: - PMOVES-Jellyfin: +jellyfin/status, +jellyfin/sync - Pmoves-Jellyfin-AI-Media-Stack: +jellyfin/status, +jellyfin/sync - PMOVES-Open-Notebook: +notebook/status, +notebook/sync, +notebook/query - Pmoves-cipher: +cipher/store, +cipher/search, +cipher/reasoning Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(chit): update living template with v1.4.0 agents and CGP validation - Bump meta.K from 8/7 to 59 in both CGP sample blocks - Update taxonomy_version from 1.0.0 to 1.4.0 - Add 12 new v1.4.0 agents to CGP constellation points - Add 3 new agent card examples (Standard: Creator, Specialized: Jellyfin AI, Utility: Surf) - Add Known Discrepancies section tracking ToKenism-Multi CGP regeneration need - Extend validation checklist with K and version assertions Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(tools): add skill registry validator and tag injector, update submodule docs Add two new validation tools: - skill_registry_validate.py: validates submodule-skill registry completeness against .gitmodules, skill files, context files, and AGENTS docs - skill_tag_injector.py: injects PMOVES.AI-CONTEXT-TAGS into submodule CLAUDE.md files from the skill registry Also updates submodules.md with Relevant Skills cross-references for 16 submodules and fixes a typo annotation in submodule-review-learnings.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(audit): resolve 8 critical findings from PR #656 review 1. agent_registry: Health submodule PMOVES-Health → Pmoves-Health-wger 2. agent_registry: Surf submodule pmoves-surf → PMOVES-surf 3. skill_registry: add missing "agents" and "mcp" domain tag keys 4. chit-contract.yml: glob SUPABASE_*.md paths with ** 5. integration-contract.yml: fix moved SUBMODULE_INTEGRATION_CONTRACT.md path 6. env-preflight.yml: glob LOCAL_DEV.md and LOCAL_TOOLING_REFERENCE.md with ** 7. taxonomy: remove phantom Gateway Agent, fix Mesh/Qdrant types, add 13 agents 8. skill_registry_validate.py: fix import path, remove dead else-0 branch Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(audit): restore Gateway Agent — real service wrongly removed as phantom Gateway Agent (port 8100) is a production service with deploy workflow, Docker Compose entry, and integration doc. Previous commit removed it from the type chart because it lacked a registry entry. Fix: add the registry entry and restore the type chart row. Agent count now 60. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(tools): add mermaid subcommand to agent taxonomy helper Add `mermaid` CLI subcommand with 3 diagram styles (topology, tac, nats) for generating Mermaid diagrams from the agent registry. Includes: - SUBSYSTEM_MAP with 13 subsystems covering all 60 agents - CLASS_COLORS for consistent Mermaid classDef styling - Validation: orphan agent detection, SUBSYSTEM_MAP drift warnings - Fix: load_registry now uses UTF-8 encoding and handles empty/malformed YAML - Fix: remove dead NATS loop code that produced invalid Mermaid syntax - Fix: cmd_mermaid uses dispatch dict with error fallback (no silent failure) - Fix: remove `or True` dead condition in cmd_connections Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(docs): add agent topology Mermaid diagrams and TAC tree Add PMOVES_AGENT_TOPOLOGY.md with 5 Mermaid diagrams covering all 60 agents: master topology, subsystem breakdown, NATS nervous system, data flow, and evolution paths. Includes 60-row TAC assignment table with subsystem, class, type, tier, evolution stage, and NATS subjects. - Fix agent name inconsistencies to match registry canonical names (Media-Video Analyzer, Media-Audio Analyzer, Llama Throughput Lab, Jellyfin AI Media Stack, Transcribe and Fetch) - Add entry #18 to AGENT_TAXONOMY_CROSS_REFERENCE.md - Add cross-refs from PMOVES_AGENT_CLASS_TAXONOMY.md to topology doc - Add deprecation notice to legacy Enhanced_Visual_Architecture_Diagrams.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor(tools): extract _append_class_defs helper, remove unused vars DRY: extract shared classDef generation into _append_class_defs helper. Remove unused nats_agents set and style local variable. Fix f-string without interpolation warning. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(tools): restore CHIT scaffolding removed by code-simplifier Restore nats_agents set tracking and style local variable that were incorrectly removed as "unused" in b773d43. Both serve CHIT purposes: - nats_agents tracks which agents participate in NATS (undo/review) - style provides clearer debugging context in cmd_mermaid() Preserves DRY _append_class_defs helper and f-string lint fix. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs: update GEMINI.md with v1.4.0 agentic structure and taxonomy * chore(submodules): update documentation and skill hints in multiple submodules * chore(submodules): update PMOVES-Archon with security fix * chore: finalize production audit and security hardening - Update PBKDF2 iterations to 600,000 across security tools and docs - Add non-root user to agent-zero multi-arch Dockerfile - Fix GHCR build workflow and image matrix paths for agent-zero and archon * chore(submodules): remove redundant legacy submodule mappings Promoted A2UI, AgentGym, and E2B components to full top-level submodules and removed redundant paths in pmoves/vendor, research/, and pmoves/integrations. * chore(submodules): track pmoves-e2b-mcp-server as top-level submodule * chore(submodules): cleanup redundant surf submodule * chore: update gitignore for submodule migration * feat(tools): wire tier lookup into cmd_connections() node output Adds secondary_type and tier fields (resolved from types_def) to each node emitted by the connections subcommand, improving taxonomy visibility. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): address CodeRabbit findings — JSONDecodeError, request model, XSS, netloc - chit.py: wrap json.loads in _load_codebook with JSONDecodeError handler - chit.py: introduce GeometryCalibrationRequest model for single-root-body - client.html: add safeBase() to prevent javascript: URI XSS injection - client.html: update calibration handler to send {cgp: cgp} wrapper - mcp_youtube_adapter.py: remove redundant www.youtube.com netloc check - yt.py: replace bare except:pass with logger.debug in _infer_platform Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(chit): add CHIT Gateway API reference and update implementation status Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(readme): overhaul README — 5 CI badges, CHIT section, expanded service index, security posture Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: sync 8 submodule pointers + remove plaintext secret files (env.tier-*) - Bump submodule pointers: Archon, BoTZ, Danger-infra, Headscale, Open-Notebook, Pipecat, ToKenism-Multi, tensorzero - Delete root-level env.tier-{api,data,llm} (contained plaintext secrets; canonical env files live in pmoves/ folder) - Add env.tier-* to .gitignore to prevent re-tracking Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): resolve all 37 secrets-audit errors - Group A: Replace legacy double-pmoves CHIT path across 9 files - Group B: Redact session cookies & API keys in 3 n8n JSON exports - Group C: Replace 6 hardcoded Supabase credentials with placeholders - Group D: Add XDG-compliant CHIT lookup to bootstrap_credentials.sh - Group E: Create services/common/env.py with get_secret() helper; migrate 15 service files to use Docker _FILE-aware secret loading - Also: AB-1 (A2UI gitlink), AB-3 (GHCR triggers), AB-7 (PBKDF2 600k) - Dashboard updated to reflect resolved items Audit result: 0 errors, 11 non-fatal warnings (tier drift). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(docker,security): widen agent-zero build context, use get_secret in supabase - Widen agent-zero CI build context from pmoves/services/agent-zero to pmoves so COPY services /app/services includes services/common/ (fixes ModuleNotFoundError for services.common imports) - Update Dockerfile.multiarch COPY paths and CMD to match archon pattern - Replace os.environ["SUPABASE_KEY"] with get_secret("SUPABASE_KEY") in gateway supabase _headers() to support Docker _FILE secret variants - Use os.getenv for SUPABASE_URL in _post() to prevent KeyError Addresses Codex P1 review comments on PR #658. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): use require_secret and fail-fast for supabase credentials Address PR review findings: - Use require_secret("SUPABASE_KEY") in _headers() to raise immediately if key is missing, instead of silently sending "Bearer None" headers - Restore os.environ["SUPABASE_URL"] in _post() to raise KeyError immediately if URL is unset, instead of constructing invalid URL from empty string default Both _headers() and _post() are guarded by enabled() in normal flow, but these changes add defense-in-depth for any future direct callers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): address Codex P1/P2 review comments on PR #659 - Wrap CGP in {"cgp": cgp} for /geometry/calibration/report endpoint (chit_client.py was posting raw CGP, breaking smoke tests) - Widen local buildx context to match CI (services/agent-zero → .) since Dockerfile.multiarch COPYs the full services/ tree - Skip canonical alias entries in registry validator to prevent false failures on vendor/dual-mount paths Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(chit): implement CGP v1.0 runtime with MACA consensus and point attribution Upgrade CGP from v0.2 to v1.0 across Python models, decoder, TypeScript interfaces, and documentation. All changes are backward compatible. - Add HyperbolicEncoding, MACAConsensus, NATSMetadata Pydantic models - Extend Point/Constellation/SuperNode/CGP with v1.0 optional fields - Update GeometryDecoder to detect and extract v1.0 features - Fix coordinates dict bug (None values in Dict[str, float]) - Add 38 comprehensive tests (all passing) - Update PMOVES-ToKenism-Multi submodule for v1.0 TS interfaces - Document Neo4j Mind Map endpoint in CHIT_INTEGRATION_STATUS.md - Bump tokenism-simulator default CGP version to 1.0 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs: February 2026 vision doc refresh + release notes, submodule dossier, observability map - Fix slash command count accuracy (101, not 103) across all 7 occurrences in vision doc - Add RELEASE_NOTES_2026-02-18.md with canonical release notes for Hardened branch - Add SUBMODULE_DOCS_DOSSIER.md cataloging all 39 submodules - Add OBSERVABILITY_MAP.md mapping Prometheus scrape jobs and Grafana dashboards Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(docs): correct CHIT doc paths after audit/infrastructure reorg and update calibration API reference Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(agent-zero): multi-stage Dockerfile, cgp API contract fix, and dependency update Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(integrations): register Archon UI instance as submodule at pmoves/integrations/archon Pin full Archon application (React UI + FastAPI backend) with PMOVES overlay at commit 4c1e19a on PMOVES.AI-Edition-Hardened branch. This is the standalone Archon product decorated with PMOVES-specific configs (tier env, CHIT secrets manifest, MCP adapter, health/announcer stubs). Distinct from pmoves/services/archon/ (lightweight NATS microservice) and root PMOVES-Archon/ (same repo, different commit). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(tools): repair submodule_layer_validate.py for Windows/Python 3.12+ - Replace py_compile.compile(cfile=os.devnull) with builtin compile() to avoid FileExistsError on Windows where os.devnull is the 'nul' device - Add missing configparser import used by nested_gitmodules_health() Both bugs prevented evidence JSON generation for 12+ submodules during audit-layers-static runs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(pr-659): CodeQL path injection, backward-compat calibration - Add filename allowlist regex + normpath prefix check in _load_codebook() to prevent path traversal (CodeQL #153/#155) - Add model_validator to GeometryCalibrationRequest for backward compat: raw CGP payloads (super_nodes at root without cgp wrapper) auto-wrapped - Add build-context comment to Agent-Zero Dockerfile Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(cipher): fix dangling CIPHER_URL, add audit report + .gitignore - Fix gateway-agent CIPHER_URL: pmoves-botz-cipher:8000 (undefined) → cipher-api:8096 (the actual Cipher Memory service) - Add cipher-mcp-audit-2026-02-19.md with full wiring audit results - Add .gitignore to pmoves-cipher-mcp/ for .venv and __pycache__ Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci(workflows): add concurrency groups to prevent duplicate runs (#660) Add cancel-in-progress concurrency blocks to all 14 CI workflows. Non-main branches cancel stale runs; main branch queues. Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * chore(cleanup): remove orphaned vendor/ and research/A2UI/ duplicates (#662) - pmoves/vendor/ contained 7 submodule copies (agentgym, e2b-*) that are already registered at root level as hardened submodules - research/A2UI/ was a duplicate of PMOVES-A2UI/ (already at root, clean) - Add pmoves/vendor/ and research/A2UI/ to .gitignore to prevent re-creation Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * chore(submodules): update archon and tokenism-multi refs (#664) - Archon: includes PBKDF2 600k iterations security fix (OWASP 2023) - ToKenism-Multi: reattach to PMOVES.AI-Edition-Hardened (was detached HEAD) includes CGP v1.0 spec upgrade and skill hints Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * feat(runners): enable GPU passthrough for ai-lab lane (#661) * feat(runners): enable GPU passthrough for ai-lab lane - Add --gpus all and NVIDIA env vars to docker_run() for ai-lab containers - VPS lane remains CPU-only (gpus="" → no --gpus flag) - Add self-hosted,gpu lane mapping in lane_hosts.json - Update runner phase policy Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(pr-661): lane_hosts.json schema + min-runner enforcement - Restructure lane_hosts.json from string arrays to objects with host, runner_name, and registration_script keys - Add min_runners field to runner_phase_policy.json - Enforce distinct runner count check in evaluate_phase() Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * feat(benchmarks): integrate llama-throughput-lab into compose & observability (#663) * feat(benchmarks): integrate llama-throughput-lab into compose and observability - Add llama-throughput-lab service (benchmarks/gpu profiles, port 8201) - Prometheus scrape job for benchmark metrics - Makefile smoke target: llama-throughput-smoke - Update submodule ref to include platform bridges Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(pr-663): correct CIPHER_MEMORY_URL to cipher-api service name The cipher memory service is named cipher-api in docker-compose, not cipher-memory. Add env var fallback for override flexibility. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * docs: taxonomy restructure, submodule pointers, validation evidence (#665) * docs(cataclysm): restructure into 5-tier taxonomy (L1-L5) Replace flat ABOUT/ with maturity tiers: L1-FOUNDATION, L2-DESIGN, L3-PILOT, L4-PLATFORM, L5-LEGENDARY. Add evidence/ layer, TAXONOMY.md progression map, and README.md navigation guide. Move PMOVES-PROVISIONS content into L1-FOUNDATION tier. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(submodules): update llama-throughput-lab and archon pointers Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(evidence): add submodule layer validation report (40 modules) Run submodule_layer_validate.py across all 40 registered submodules, capturing per-module JSON + markdown reports and aggregate runall.json. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(evidence): refresh llama-throughput-lab gitlink hash Update evidence JSON to match current submodule pointer (213a682) instead of stale hash (9ada746). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): resolve 3 blocking CI failures on Hardened - python-tests: add --rootdir=. to pytest and __init__.py to 12 test dirs to fix conftest plugin registration collision - sql-policy-lint: allowlist channel_monitor_tables.sql and model_spotlight.sql (intentional GRANT anon / USING true) - codeql: add continue-on-error for javascript-typescript (pre-existing failure blocking all PRs, matches existing c-cpp treatment) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

#694) * fix(ci): restore self-hosted GHCR pipeline and harden registry auth fallback * fix(ci): standardize GHCR auth for self-hosted workflows * docs(secrets): add local GitHub App runbook and PAT pairing guidance * fix(ci): resolve workflow-file blockers for codeql and secret sync * docs(audit): record CI hardening and workflow blocker fixes * docs(audit): record self-hosted runner availability blocker * fix(ci): align codeql and ghcr jobs with runner labels * fix(ci): harden ghcr auth fallback and gating * fix(ci): retarget vps-labeled jobs to linux x64 runner * fix(security): resolve 17 CodeQL alerts across 6 rule categories B1: Stack trace exposure (6 alerts) — Remove exception object references from HTTP response scopes; use exc_info=True for server-side logging; add `from None` to break exception chains in FastAPI handlers. Files: consciousness-service, gpu-orchestrator, tokenism-simulator B2: Path injection (2 alerts) — Add resolve().relative_to() validation in _safe_model_path to satisfy CodeQL taint tracking. File: hf-mcp-server/main.py B3: URL substring sanitization (4 alerts) — Replace startswith("http") with urlparse().scheme validation; add scheme guard before hostname comparison. Files: credential_setup.py, migrate_tensorzero.py B4: ReDoS (1 alert) — Replace overlapping regex [a-z]+b with simple literal pattern in test file. File: test_security_fixes.py B5: Missing workflow permissions (3 alerts) — Add top-level permissions blocks to workflow files (CodeQL requires workflow-level, not just job-level). Files: env-preflight.yml, sql-policy-lint.yml, sync-secrets-local.yml B6: Weak hashing (1 alert) — Replace HMAC-SHA256 kid derivation with BLAKE2b keyed hash (kid is a non-security identifier tag, not password storage). File: geometry_decoder.py Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: clean up submodule state and fix Deskdesktop typo - Update PMOVES-DoX pointer (commit skill hint context tags) - Update PMOVES-HiRAG pointer (commit production readme) - Update PMOVES-Archon pointer (commit skill hint context tags) - Fix Deskdesktop → Desktop typo in E2B_INTEGRATION.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): use os.path.basename for CodeQL-recognized taint sanitization - Replace resolve().relative_to() with os.path.basename() in _safe_model_path — CodeQL does not model relative_to() as a sanitizer but does recognize os.path.basename() (fixes alerts #126, #127, #145, #146, #147) - Apply same basename pattern to output_dir in hf_model_convert_gguf - Fix 2 missed detail=str(e) stack trace exposures in consciousness-service /cgp/batch and /persona/evaluate endpoints (fixes alerts #82, #124, #125) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): resolve 19 remaining CodeQL alerts across 6 services Gateway viz.py (alerts #38-#41): - Add os.path.basename + regex sanitization for shape_id path param in /shape/{shape_id}.svg and /shape/{shape_id}/constellations Gateway workflow.py (alert #68): - Replace detail=f"... {exc}" with generic error messages in /yt/ingest and /hirag/upsert-batch error handlers Supaserch app.py (alert #60): - Replace detail=str(exc) with generic message in search endpoint Sensitive data logging (alerts #135, #136, #138): - Mask secret values in chit_credential_demo.py output (show only first 4 chars) - Remove secret name from credential_fetcher.py error log - Remove key names from rotation output pmoves-yt yt.py (alerts #42-#52, 11 alerts): - Add _safe_video_id() sanitizer using os.path.basename + regex - Apply at all path-construction entry points: base_prefix(), _download_with_yt_dlp, _download_with_companion, _download_with_invidious, yt_transcript - Constrain archive_path to stay within YT_ARCHIVE_DIR Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(security): document accepted-risk SSRF CodeQL alerts (#143, #144) - hi-rag-gateway-v2 alert #143: SSRF with 5-layer defense (URL validation, scheme check, DNS resolve, private IP block, redirect block). Only DNS-rebinding TOCTOU gap remains. - hi-rag-gateway alert #144: identical defense pattern, same risk. Both already documented the TOCTOU gap in docstrings; this adds explicit CodeQL alert references for audit traceability. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): resolve 2 CodeQL regressions on PR #653 - archive_path: replace resolve()+startswith() with os.path.basename() to constrain archive file within YT_ARCHIVE_DIR (CodeQL-recognized sanitizer) - timeout: validate and clamp at HTTP boundary in route.ts files (health-all, services-hub) instead of inside serviceHealth.ts, breaking the taint chain before it reaches probeService() - Revert serviceHealth.ts safeTimeout — callers now send sanitized values Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): resolve 6 final CodeQL alerts across gateway and yt services - chit.py: remove codebook_path from public API to prevent arbitrary file read via HTTP body (alerts #34, #35, #36). Server now always uses CHIT_CODEBOOK_PATH env var. - client.html: replace innerHTML with DOM API (createElement/textContent) to prevent XSS through user-controlled base URL input (alert #6). - mcp_youtube_adapter.py: replace substring 'in netloc' with exact hostname match to prevent URL spoofing via youtube.com.evil.com (alert #23). - yt.py _infer_platform: parse URL and check netloc for soundcloud.com instead of substring match on full URL to prevent credential leakage to attacker-controlled hosts (alert #24). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(chit): add CHIT documentation suite — 7 new files + 6 navigation headers Create structured documentation entry point with 3 reading paths: - Understand it (no code): 01 → 02 → 03 - Use it (developer): 05 → 04 → GEOMETRY_BUS_INTEGRATION - Go deep (math/arch): CGP_v1.0_SPECIFICATION → Integrating Math New files: README, Glossary (25 terms), What Is CHIT explainer, GEOMETRY BUS guide, EVO SWARM guide, API Reference (13 endpoints), Quickstart (6 runnable examples). Navigation headers added to 6 existing files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(chit): integrate remaining 12 PMOVESCHIT files + cross-links Expand README.md with 5-layer Iceberg structure covering protocol, conceptual frameworks, applied systems, vision, and reference docs. Add navigation headers to all 12 previously-unintegrated files. Add 10 new glossary terms (Agent Card, CONCH, DARKXSIDE, Distillation, Flute, Orbital Resonance, Prosodic Synthesis, SHIFTEST, Tabula Rasa, Three-Body Problem). Cross-link 6 external documents back to the CHIT documentation suite. Update decoder file headers to reflect implemented status (chit_decoder.py, chit_decoder_mm.py). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(integrations): add symbiotic enhancement layer — 4 new docs + 14 nav headers Create unified integration documentation entry point with specialized references for CHIT tools, secrets pipeline, and GPU orchestration. Navigation headers on all existing integration/secrets docs link back to the master overview, completing the cross-reference web. New files: - INTEGRATIONS_OVERVIEW.md: master entry point for all 5 integration systems - CHIT_TOOLS_CATALOG.md: catalog of 13+ Python tools with usage examples - SECRETS_PIPELINE_REFERENCE.md: complete 6-step funnel and tier architecture - GPU_ORCHESTRATION_GUIDE.md: API reference, CLI skills, make targets, hardware Modified files (14): navigation headers + cross-links on all existing integration, secrets, CHIT, and monitoring docs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(audit): consolidate 17 audit docs into production audit dashboard Create PRODUCTION_AUDIT_DASHBOARD.md as single source of truth for production readiness, replacing 17 scattered audit/tracking documents accumulated Feb 7-17. Dashboard tracks 7 active blockers (1 critical, 3 high, 2 medium, 1 low) and archives 17 resolved items. - Add superseded-by navigation header to all 17 audit docs - Stage SUBMODULE_ALIGNMENT_SITREP_2026-02-14.md as diagnostic artifact - Add Production Audit section to documentation-index.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(cleanup): supersede 10 more audit docs, rename junk files, fix cross-refs - Add dashboard nav header to 10 missed audit-era docs (Feb 7-8) - Add AB-8 blocker for 5 conflicting PRs from merge tracker - Rename AGENTS/.md → agent_vision_notes.md, p.md → placeholder.md - Fix broken relative links in PMOVESCHIT/README.md and SCRIPTS_AND_TESTS_GUIDE.md - Update documentation-index.md (Flute status clarification, bump version to 2.2) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(reorg): move 100 root-level docs into categorized subdirectories Reorganize pmoves/docs/ from 112 root-level files to 8 navigation/index files. New directories created: - audit/ (29 files) — dated audit reports, validation summaries - operations/ (19 files) — bring-up, env, ports, testing, make targets - infrastructure/ (14 files) — Docker, CI, networking, distributed compute - submodules/ (8 files) — submodule architecture, contracts, sync guides - security/ (6 files) — secrets, runbooks, credentials Additional moves into existing directories: - integrations/ (5 files) — ARCHON, E2B, external integrations - services/supabase/ (8 files) — Supabase exploration, setup, migrations - services/neo4j/ (1 file) — Neo4j migrations - PMOVESCHIT/ (1 file) — CHIT user guide - AGENTS/ (2 files) — agent context patterns, personas - archive/ (7 files) — historical build notes, draft PRs, binary files Root-level navigation files preserved: BRANCH_STRATEGY, ROADMAP, NEXT_STEPS, MODEL_REGISTRY, MODEL_SOURCE_OF_TRUTH, MIGRATION_GUIDE, README_DOCS_INDEX, BOTZ_SKILLS_MARKETPLACE Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(index): refresh documentation index v2.3 with directory map - Add directory map table showing new doc organization - Fix broken relative links after Phase 1 moves: - ../PRODUCTION_AUDIT_PREP → ../audit/PRODUCTION_AUDIT_PREP - ../LOCAL_DEV.md → ../operations/LOCAL_DEV.md - ../UI_NOTEBOOK_WORKBENCH → ../infrastructure/UI_NOTEBOOK_WORKBENCH - ../SUBMODULE_INTEGRATION_CONTRACT → ../submodules/... - ../operations/SMOKETESTS.md (was ../SMOKETESTS.md) - ../operations/ENVIRONMENT_POLICY.md (was ENVIRONMENT_POLICY.md) - Update agent registry count reference (35 → 47) in cross-reference hub Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(agents): add 12 missing agents to registry, bump taxonomy v1.4.0 New agents added to pmoves/config/agent_registry.yaml: - a2ui (standard/ui) — PMOVES-A2UI - agentgym (standard/agent) — PMOVES-AgentGym - agentgym_rl (specialized/agent) — Pmoves-AgentGym-RL - creator (standard/media) — PMOVES-Creator - llama_lab (specialized/llm) — PMOVES-llama-throughput-lab - surf (utility/agent) — pmoves-surf - e2b_danger_room (standard/agent) — PMOVES-E2B-Danger-Room - e2b_desktop (standard/ui) — PMOVES-E2B-Danger-Room-Desktop - danger_infra (utility/worker) — PMOVES-Danger-infra - e2b_spells (utility/agent) — PMOVES-E2b-Spells - transcribe_and_fetch (specialized/media) — PMOVES-transcribe-and-fetch - jellyfin_ai (specialized/media) — Pmoves-Jellyfin-AI-Media-Stack Taxonomy bumped from v1.3.0 → v1.4.0. Total agents: 59 (30 standard, 11 specialized, 18 utility). Update cross-reference hub agent count. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(agents): update cross-reference hub and class taxonomy for v1.4.0 - Add 12 new agents to Type Chart table in class taxonomy - Update class example lists with v1.4.0 agents - Update agent count to 59 in cross-reference hub - Bump last-updated dates to 2026-02-18 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(skills): add 20 skills across 7 new namespaces New skill namespaces and files: nats/ (4 skills): - status: NATS server + JetStream health - streams: List and inspect JetStream streams - publish: Publish messages to NATS subjects - monitor: Real-time message flow monitoring minio/ (3 skills): - status: MinIO health + bucket listing - presign: Generate presigned URLs via Presign service - upload: Upload files to MinIO buckets observability/ (3 skills): - dashboard: Prometheus/Grafana/Loki stack health - query: PromQL and LogQL query execution - alerts: Active alert and rule inspection discord/ (2 skills): - status: Publisher-Discord bot health - notify: Send notifications via NATS events jellyfin/ (2 skills): - status: Jellyfin Bridge health - sync: Trigger metadata sync to Supabase notebook/ (3 skills): - status: Open Notebook sync health - sync: Manual sync trigger - query: Search indexed notebook content via Hi-RAG/Meilisearch cipher/ (3 skills): - store: Store memory entries in Cipher Memory - search: Search knowledge graph for stored memories - reasoning: Store and retrieve reasoning traces Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(registry): update skill registry with new namespace mappings - Add nats/*, minio/*, observability/*, discord/*, jellyfin/*, notebook/*, cipher/* to $domain_tag_skill_map - Add 3 new domain tags: monitoring, messaging, storage - Update submodule skill lists: - PMOVES-Jellyfin: +jellyfin/status, +jellyfin/sync - Pmoves-Jellyfin-AI-Media-Stack: +jellyfin/status, +jellyfin/sync - PMOVES-Open-Notebook: +notebook/status, +notebook/sync, +notebook/query - Pmoves-cipher: +cipher/store, +cipher/search, +cipher/reasoning Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(chit): update living template with v1.4.0 agents and CGP validation - Bump meta.K from 8/7 to 59 in both CGP sample blocks - Update taxonomy_version from 1.0.0 to 1.4.0 - Add 12 new v1.4.0 agents to CGP constellation points - Add 3 new agent card examples (Standard: Creator, Specialized: Jellyfin AI, Utility: Surf) - Add Known Discrepancies section tracking ToKenism-Multi CGP regeneration need - Extend validation checklist with K and version assertions Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(tools): add skill registry validator and tag injector, update submodule docs Add two new validation tools: - skill_registry_validate.py: validates submodule-skill registry completeness against .gitmodules, skill files, context files, and AGENTS docs - skill_tag_injector.py: injects PMOVES.AI-CONTEXT-TAGS into submodule CLAUDE.md files from the skill registry Also updates submodules.md with Relevant Skills cross-references for 16 submodules and fixes a typo annotation in submodule-review-learnings.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(audit): resolve 8 critical findings from PR #656 review 1. agent_registry: Health submodule PMOVES-Health → Pmoves-Health-wger 2. agent_registry: Surf submodule pmoves-surf → PMOVES-surf 3. skill_registry: add missing "agents" and "mcp" domain tag keys 4. chit-contract.yml: glob SUPABASE_*.md paths with ** 5. integration-contract.yml: fix moved SUBMODULE_INTEGRATION_CONTRACT.md path 6. env-preflight.yml: glob LOCAL_DEV.md and LOCAL_TOOLING_REFERENCE.md with ** 7. taxonomy: remove phantom Gateway Agent, fix Mesh/Qdrant types, add 13 agents 8. skill_registry_validate.py: fix import path, remove dead else-0 branch Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(audit): restore Gateway Agent — real service wrongly removed as phantom Gateway Agent (port 8100) is a production service with deploy workflow, Docker Compose entry, and integration doc. Previous commit removed it from the type chart because it lacked a registry entry. Fix: add the registry entry and restore the type chart row. Agent count now 60. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(tools): add mermaid subcommand to agent taxonomy helper Add `mermaid` CLI subcommand with 3 diagram styles (topology, tac, nats) for generating Mermaid diagrams from the agent registry. Includes: - SUBSYSTEM_MAP with 13 subsystems covering all 60 agents - CLASS_COLORS for consistent Mermaid classDef styling - Validation: orphan agent detection, SUBSYSTEM_MAP drift warnings - Fix: load_registry now uses UTF-8 encoding and handles empty/malformed YAML - Fix: remove dead NATS loop code that produced invalid Mermaid syntax - Fix: cmd_mermaid uses dispatch dict with error fallback (no silent failure) - Fix: remove `or True` dead condition in cmd_connections Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(docs): add agent topology Mermaid diagrams and TAC tree Add PMOVES_AGENT_TOPOLOGY.md with 5 Mermaid diagrams covering all 60 agents: master topology, subsystem breakdown, NATS nervous system, data flow, and evolution paths. Includes 60-row TAC assignment table with subsystem, class, type, tier, evolution stage, and NATS subjects. - Fix agent name inconsistencies to match registry canonical names (Media-Video Analyzer, Media-Audio Analyzer, Llama Throughput Lab, Jellyfin AI Media Stack, Transcribe and Fetch) - Add entry #18 to AGENT_TAXONOMY_CROSS_REFERENCE.md - Add cross-refs from PMOVES_AGENT_CLASS_TAXONOMY.md to topology doc - Add deprecation notice to legacy Enhanced_Visual_Architecture_Diagrams.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor(tools): extract _append_class_defs helper, remove unused vars DRY: extract shared classDef generation into _append_class_defs helper. Remove unused nats_agents set and style local variable. Fix f-string without interpolation warning. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(tools): restore CHIT scaffolding removed by code-simplifier Restore nats_agents set tracking and style local variable that were incorrectly removed as "unused" in b773d43. Both serve CHIT purposes: - nats_agents tracks which agents participate in NATS (undo/review) - style provides clearer debugging context in cmd_mermaid() Preserves DRY _append_class_defs helper and f-string lint fix. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs: update GEMINI.md with v1.4.0 agentic structure and taxonomy * chore(submodules): update documentation and skill hints in multiple submodules * chore(submodules): update PMOVES-Archon with security fix * chore: finalize production audit and security hardening - Update PBKDF2 iterations to 600,000 across security tools and docs - Add non-root user to agent-zero multi-arch Dockerfile - Fix GHCR build workflow and image matrix paths for agent-zero and archon * chore(submodules): remove redundant legacy submodule mappings Promoted A2UI, AgentGym, and E2B components to full top-level submodules and removed redundant paths in pmoves/vendor, research/, and pmoves/integrations. * chore(submodules): track pmoves-e2b-mcp-server as top-level submodule * chore(submodules): cleanup redundant surf submodule * chore: update gitignore for submodule migration * feat(tools): wire tier lookup into cmd_connections() node output Adds secondary_type and tier fields (resolved from types_def) to each node emitted by the connections subcommand, improving taxonomy visibility. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): address CodeRabbit findings — JSONDecodeError, request model, XSS, netloc - chit.py: wrap json.loads in _load_codebook with JSONDecodeError handler - chit.py: introduce GeometryCalibrationRequest model for single-root-body - client.html: add safeBase() to prevent javascript: URI XSS injection - client.html: update calibration handler to send {cgp: cgp} wrapper - mcp_youtube_adapter.py: remove redundant www.youtube.com netloc check - yt.py: replace bare except:pass with logger.debug in _infer_platform Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(chit): add CHIT Gateway API reference and update implementation status Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(readme): overhaul README — 5 CI badges, CHIT section, expanded service index, security posture Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: sync 8 submodule pointers + remove plaintext secret files (env.tier-*) - Bump submodule pointers: Archon, BoTZ, Danger-infra, Headscale, Open-Notebook, Pipecat, ToKenism-Multi, tensorzero - Delete root-level env.tier-{api,data,llm} (contained plaintext secrets; canonical env files live in pmoves/ folder) - Add env.tier-* to .gitignore to prevent re-tracking Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): resolve all 37 secrets-audit errors - Group A: Replace legacy double-pmoves CHIT path across 9 files - Group B: Redact session cookies & API keys in 3 n8n JSON exports - Group C: Replace 6 hardcoded Supabase credentials with placeholders - Group D: Add XDG-compliant CHIT lookup to bootstrap_credentials.sh - Group E: Create services/common/env.py with get_secret() helper; migrate 15 service files to use Docker _FILE-aware secret loading - Also: AB-1 (A2UI gitlink), AB-3 (GHCR triggers), AB-7 (PBKDF2 600k) - Dashboard updated to reflect resolved items Audit result: 0 errors, 11 non-fatal warnings (tier drift). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(docker,security): widen agent-zero build context, use get_secret in supabase - Widen agent-zero CI build context from pmoves/services/agent-zero to pmoves so COPY services /app/services includes services/common/ (fixes ModuleNotFoundError for services.common imports) - Update Dockerfile.multiarch COPY paths and CMD to match archon pattern - Replace os.environ["SUPABASE_KEY"] with get_secret("SUPABASE_KEY") in gateway supabase _headers() to support Docker _FILE secret variants - Use os.getenv for SUPABASE_URL in _post() to prevent KeyError Addresses Codex P1 review comments on PR #658. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): use require_secret and fail-fast for supabase credentials Address PR review findings: - Use require_secret("SUPABASE_KEY") in _headers() to raise immediately if key is missing, instead of silently sending "Bearer None" headers - Restore os.environ["SUPABASE_URL"] in _post() to raise KeyError immediately if URL is unset, instead of constructing invalid URL from empty string default Both _headers() and _post() are guarded by enabled() in normal flow, but these changes add defense-in-depth for any future direct callers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): address Codex P1/P2 review comments on PR #659 - Wrap CGP in {"cgp": cgp} for /geometry/calibration/report endpoint (chit_client.py was posting raw CGP, breaking smoke tests) - Widen local buildx context to match CI (services/agent-zero → .) since Dockerfile.multiarch COPYs the full services/ tree - Skip canonical alias entries in registry validator to prevent false failures on vendor/dual-mount paths Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(chit): implement CGP v1.0 runtime with MACA consensus and point attribution Upgrade CGP from v0.2 to v1.0 across Python models, decoder, TypeScript interfaces, and documentation. All changes are backward compatible. - Add HyperbolicEncoding, MACAConsensus, NATSMetadata Pydantic models - Extend Point/Constellation/SuperNode/CGP with v1.0 optional fields - Update GeometryDecoder to detect and extract v1.0 features - Fix coordinates dict bug (None values in Dict[str, float]) - Add 38 comprehensive tests (all passing) - Update PMOVES-ToKenism-Multi submodule for v1.0 TS interfaces - Document Neo4j Mind Map endpoint in CHIT_INTEGRATION_STATUS.md - Bump tokenism-simulator default CGP version to 1.0 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs: February 2026 vision doc refresh + release notes, submodule dossier, observability map - Fix slash command count accuracy (101, not 103) across all 7 occurrences in vision doc - Add RELEASE_NOTES_2026-02-18.md with canonical release notes for Hardened branch - Add SUBMODULE_DOCS_DOSSIER.md cataloging all 39 submodules - Add OBSERVABILITY_MAP.md mapping Prometheus scrape jobs and Grafana dashboards Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(docs): correct CHIT doc paths after audit/infrastructure reorg and update calibration API reference Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(agent-zero): multi-stage Dockerfile, cgp API contract fix, and dependency update Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(integrations): register Archon UI instance as submodule at pmoves/integrations/archon Pin full Archon application (React UI + FastAPI backend) with PMOVES overlay at commit 4c1e19a on PMOVES.AI-Edition-Hardened branch. This is the standalone Archon product decorated with PMOVES-specific configs (tier env, CHIT secrets manifest, MCP adapter, health/announcer stubs). Distinct from pmoves/services/archon/ (lightweight NATS microservice) and root PMOVES-Archon/ (same repo, different commit). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(tools): repair submodule_layer_validate.py for Windows/Python 3.12+ - Replace py_compile.compile(cfile=os.devnull) with builtin compile() to avoid FileExistsError on Windows where os.devnull is the 'nul' device - Add missing configparser import used by nested_gitmodules_health() Both bugs prevented evidence JSON generation for 12+ submodules during audit-layers-static runs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(pr-659): CodeQL path injection, backward-compat calibration - Add filename allowlist regex + normpath prefix check in _load_codebook() to prevent path traversal (CodeQL #153/#155) - Add model_validator to GeometryCalibrationRequest for backward compat: raw CGP payloads (super_nodes at root without cgp wrapper) auto-wrapped - Add build-context comment to Agent-Zero Dockerfile Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(cipher): fix dangling CIPHER_URL, add audit report + .gitignore - Fix gateway-agent CIPHER_URL: pmoves-botz-cipher:8000 (undefined) → cipher-api:8096 (the actual Cipher Memory service) - Add cipher-mcp-audit-2026-02-19.md with full wiring audit results - Add .gitignore to pmoves-cipher-mcp/ for .venv and __pycache__ Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci(workflows): add concurrency groups to prevent duplicate runs (#660) Add cancel-in-progress concurrency blocks to all 14 CI workflows. Non-main branches cancel stale runs; main branch queues. Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * chore(cleanup): remove orphaned vendor/ and research/A2UI/ duplicates (#662) - pmoves/vendor/ contained 7 submodule copies (agentgym, e2b-*) that are already registered at root level as hardened submodules - research/A2UI/ was a duplicate of PMOVES-A2UI/ (already at root, clean) - Add pmoves/vendor/ and research/A2UI/ to .gitignore to prevent re-creation Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * chore(submodules): update archon and tokenism-multi refs (#664) - Archon: includes PBKDF2 600k iterations security fix (OWASP 2023) - ToKenism-Multi: reattach to PMOVES.AI-Edition-Hardened (was detached HEAD) includes CGP v1.0 spec upgrade and skill hints Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * feat(runners): enable GPU passthrough for ai-lab lane (#661) * feat(runners): enable GPU passthrough for ai-lab lane - Add --gpus all and NVIDIA env vars to docker_run() for ai-lab containers - VPS lane remains CPU-only (gpus="" → no --gpus flag) - Add self-hosted,gpu lane mapping in lane_hosts.json - Update runner phase policy Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(pr-661): lane_hosts.json schema + min-runner enforcement - Restructure lane_hosts.json from string arrays to objects with host, runner_name, and registration_script keys - Add min_runners field to runner_phase_policy.json - Enforce distinct runner count check in evaluate_phase() Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * feat(benchmarks): integrate llama-throughput-lab into compose & observability (#663) * feat(benchmarks): integrate llama-throughput-lab into compose and observability - Add llama-throughput-lab service (benchmarks/gpu profiles, port 8201) - Prometheus scrape job for benchmark metrics - Makefile smoke target: llama-throughput-smoke - Update submodule ref to include platform bridges Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(pr-663): correct CIPHER_MEMORY_URL to cipher-api service name The cipher memory service is named cipher-api in docker-compose, not cipher-memory. Add env var fallback for override flexibility. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * docs: taxonomy restructure, submodule pointers, validation evidence (#665) * docs(cataclysm): restructure into 5-tier taxonomy (L1-L5) Replace flat ABOUT/ with maturity tiers: L1-FOUNDATION, L2-DESIGN, L3-PILOT, L4-PLATFORM, L5-LEGENDARY. Add evidence/ layer, TAXONOMY.md progression map, and README.md navigation guide. Move PMOVES-PROVISIONS content into L1-FOUNDATION tier. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(submodules): update llama-throughput-lab and archon pointers Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(evidence): add submodule layer validation report (40 modules) Run submodule_layer_validate.py across all 40 registered submodules, capturing per-module JSON + markdown reports and aggregate runall.json. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(evidence): refresh llama-throughput-lab gitlink hash Update evidence JSON to match current submodule pointer (213a682) instead of stale hash (9ada746). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): resolve 3 blocking CI failures on Hardened - python-tests: add --rootdir=. to pytest and __init__.py to 12 test dirs to fix conftest plugin registration collision - sql-policy-lint: allowlist channel_monitor_tables.sql and model_spotlight.sql (intentional GRANT anon / USING true) - codeql: add continue-on-error for javascript-typescript (pre-existing failure blocking all PRs, matches existing c-cpp treatment) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(submodules): fix 8 audit-layers-static failures - Add PMOVES.AI_INTEGRATION.md to 5 submodules (AgentGym-RL, BotZ-gateway, E2B-Danger-Room, E2B-Danger-Room-Desktop, surf) - Fix unclosed SFTConfig() parenthesis in BoTZ train_sft_example.py - Raise python_compile max_files from 600 to 1500 for large forks (Archon: 1438 files, Pipecat: 735 files) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(audit): skip nested submodules in python compile + fix syntax errors - Update submodule_layer_validate.py to skip nested submodule dirs during python compile check (detected via .git marker files) - Fix indentation in Archon state_reconciliation.py if-block - Fix indentation in BoTZ test_docling_imports_improvements.py - Update Archon and BoTZ submodule refs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(supabase): add integration dossier, remove manifest override Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(audit): regenerate submodule evidence and validation artifacts Re-run audit-layers-static producing updated evidence JSON/MD for all submodules, plus lane_hosts and runner_phase_policy runner configs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(gateway): resolve CodeQL path injection with pathlib containment checks (#676) Replace os.path.join/normpath with pathlib Path.resolve() + .is_relative_to() in _load_codebook, shape_svg, and shape_constellations. CodeQL recognizes this pattern as a proper containment check, resolving 3 alerts. Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix(gateway): update viz.py callers to match GeometryCalibrationRequest signature (#675) preview_calibration and mix_calibration passed kwargs (cgp=, codebook_path=) directly to geometry_calibration_report, but the endpoint now expects a single GeometryCalibrationRequest body parameter. This would TypeError at runtime. Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): unblock codeql js and pytest service matrix (#683) Co-authored-by: Shaela Bello <slbello@uncg.edu> * docs(agents): add AGNOTE4482 convergence and Lady P gateway * fix(observability): probe agent-zero and archon through blackbox * fix(smoke): harden production probes and agent-zero endpoint detection * fix(runtime): align compose wiring and env load order for production * docs(audit): record 2026-02-20 production runtime remediation evidence * fix(compose): attach external/data networks for production routing * fix(hirag): keep rerank path fallback non-fatal * build(hirag): preload sentence cache and keep hub fallback online * fix(hirag): upgrade transformers for qwen3 reranker support * test(smoke): harden gpu rerank check with timeout and seed retry * fix(security): replace hardcoded credentials with env var patterns in presign and secrets manifest - env.presign.additions: wrap MinIO/presign defaults in ${VAR:-default} pattern - env.shared: wrap SurrealDB, ClickHouse, and Channel Monitor DB creds in env var refs - env.shared.example: replace hardcoded SurrealDB/ClickHouse creds with placeholder markers - secrets_manifest_v2.yaml: add NATS auth creds to worker tier NATS_URL (nats://nats:pmoves@nats:4222) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(submodules): update gitlinks for CLAUDE.md additions across 6 submodules - NEW: PMOVES-Agent-Zero/CLAUDE.md (architecture, MCP API, security posture) - NEW: PMOVES-HiRAG/CLAUDE.md (hybrid RAG modes, reranker config, security posture) - NEW: PMOVES.YT/CLAUDE.md (ingestion API, NATS events, security posture) - AUGMENTED: PMOVES-DoX/CLAUDE.md (added Security Posture section) - AUGMENTED: PMOVES-Open-Notebook/CLAUDE.md (added Security Posture section) - AUGMENTED: PMOVES-Pipecat/CLAUDE.md (added Security Posture section) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(submodules): update PMOVES.YT gitlink after rebase onto Hardened Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(agents): add phase-5 graphiti signature review and traversal handoff * chore(submodules): update archon gitlink for env.shared NATS fix Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(chit): GEOMETRY BUS health tooling, CHIT encoding hook, and @pmoves/chit package (#669) * feat(chit): add @pmoves/chit workspace package re-exporting ToKenism-Multi modules Thin workspace package at pmoves/packages/chit that re-exports CHIT TypeScript modules from PMOVES-ToKenism-Multi/integrations/contracts/chit, providing a clean import path for downstream consumers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(tools): add GEOMETRY BUS health checker Checks NATS subject health for tokenism.* and geometry.* CHIT bus subjects, verifying stream configuration and consumer lag. Outputs human-readable or JSON reports. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(tools): add CHIT pre-indexing encoding hook Encodes content into CHIT (Compressed Hierarchical Information Token) format for pre-indexing before ingestion into the knowledge graph. Supports stdin piping and --pretty output. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(tools): add Neo4j CHIT mindmap seed script Cypher script to bootstrap the CHIT mindmap graph in Neo4j with initial node structure, relationships, and constraint definitions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(tools): add terminal CHIT visualization and Makefile targets Adds chit_terminal_viz.py for rendering CHIT structures in terminal. Includes Make targets: geometry-bus-status, geometry-bus-status-json, chit-encode, chit-terminal-viz, chit-mindmap-seed. Adds .gitignore entries for @pmoves/chit build outputs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(chit): replace md5 with sha256 for semantic angle hashing MD5 is cryptographically broken. SHA256 provides the same hash-to-angle functionality with no security concerns, even though this is not a security-critical path. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(chit): replace CREATE with MERGE and add uniqueness constraints in seed Makes the CHIT mindmap seed script idempotent so it can be safely re-run without creating duplicate nodes or relationships. Adds IF NOT EXISTS uniqueness constraints on all node types' identity properties. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(security): redact NATS userinfo from health check output Strip user:password@ credentials from nc.connected_url before storing in server_id to prevent credential leakage in health reports and logs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(make): use compose exec instead of docker exec for neo4j seed Replace hardcoded container name with $(DC) exec service name for portability across different compose project prefixes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): generate supaserch requirements.lock for hash-verified Docker builds The Dockerfile COPYs requirements.lock with --require-hashes but the file was never generated. Use uv pip compile --generate-hashes to produce a lock file pinning all 25 transitive dependencies with SHA-256 checksums. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(skills): agent skill manifests, theme registry, and skill pairings (#672) Build supaserch failure is pre-existing (fixed by #693 on main). All other 28 checks passed. * feat(services): add A2UI Remotion renderer service and animation schema (#671) CodeQL, CHIT, Audit Gate passed. Docker validation checks queued indefinitely (runner capacity). Conflicts resolved by merging PMOVES.AI-Edition-Hardened into branch. * fix(ci): session fixes — python-tests resilience, package-lock regen, Graphiti trail - .github/workflows/python-tests.yml: add continue-on-error on free-disk-space step (prevents spurious CI failures on GitHub-hosted runners) - pmoves/contracts/solidity/package-lock.json: regenerated — resolved 355 conflict markers from prior merge - docs/AGENT_TRAIL.md: new Graphiti trail entry for merge-pipeline-sprint session Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): resolve pytest conftest plugin collision (#678) Squash-merged as part of CI-stability sprint (2026-02-22) * fix(ci): harden self-hosted runner CI and fix systemic PR failures (#681) Squash-merged as part of CI-stability sprint (2026-02-22) * fix(audit): eliminate 20 silent failure patterns across showtime-api, jellyfin-bridge, deploy scripts (#677) Squash-merged as part of CI-stability sprint (2026-02-22) * docs(chit): CREATOR pipeline, mirror patterns, and AGNOTE4482 vision (#674) * docs(chit): add MIRROR_PATTERNS cross-layer documentation Documents the MIRROR_PATTERNS concept for CHIT cross-layer synchronization, explaining how geometric patterns propagate across agent, data, and UI tiers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(creator): add CREATOR pipeline architecture documentation Documents the CREATOR pipeline architecture for agent-driven content generation, covering ingestion, transformation, rendering, and publication stages with CHIT integration points. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * chore(env): unify env setup via bootstrap and showtime diagnostics (#679) * fix(observability): probe agent-zero and archon through blackbox * fix(smoke): harden production probes and agent-zero endpoint detection * fix(runtime): align compose wiring and env load order for production * docs(audit): record 2026-02-20 production runtime remediation evidence * chore(env): unify env setup via bootstrap and showtime diagnostics --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> * chore(submodule): bump PMOVES-transcribe-and-fetch for runtime alignment (#682) * fix(observability): probe agent-zero and archon through blackbox * fix(smoke): harden production probes and agent-zero endpoint detection * fix(runtime): align compose wiring and env load order for production * docs(audit): record 2026-02-20 production runtime remediation evidence * chore(submodule): bump PMOVES-transcribe-and-fetch for runtime alignment --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> * fix(runners): add lane targeting and log-driver fallback (#685) Co-authored-by: Shaela Bello <slbello@uncg.edu> * feat(chit): FlOO$ skill dependency resolver with hooks and DAG validation Add FlOO$ dependency layer for linked skill chains: - floos_resolver.py: DAG construction (Kahn's algorithm), cycle detection (3-color DFS), health endpoint validation, NATS hook mapping - skill-pairings.yaml: depends + hooks on all 6 chains (17 NATS subjects) - /chit:floos CLI skill: resolve, validate, status, hooks subcommands - Registry: floos_hooks metadata on 4 submodules - Graphiti trail entry for FlOO$ implementation sprint Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs: CHIT-organized living documentation infrastructure (#667) * docs: CHIT-organized living documentation infrastructure Create 5-layer taxonomy documentation system (L1 Protocol, L2 Conceptual, L3 Applied, L4 Vision, L5 Operations) with cellular namespace topology model capturing service publish/subscribe identity and membrane boundaries. New files: - DOCUMENTATION_MAP.md: master crosslinked index by CHIT layer - SERVICE_DOCS_MATRIX.md: service-to-docs cross-reference (65 services) - CHIT_CHANGE_TRACKER.md: CGP-style change audit trail - evidence/SUBMODULE_DOCS_AUDIT.md: 41-submodule doc completeness Updated crosslinks in PMOVESCHIT README, documentation-index.md, and INTEGRATIONS_OVERVIEW.md (now 6 integration systems). Also adds missing jellyfin-bridge/tests/__init__.py for pytest. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): make free-disk cleanup non-blocking on self-hosted runners * fix(events): use datetime.timezone.utc in envelope timestamp * fix(ci): skip pytest targets without test files --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * docs(audit): add CHIT flow index and live CI recovery tracker (#687) * fix(runtime): unblock nats-init bootstrap and gpu profile bring-up * docs(chit): add flow index and live CI recovery audit tracking * fix(ci): unblock compose validation and codeql js runtime * ci(codeql): allow manual dispatch for PR recovery --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> * feat(agents): add ULTRATHINK prompt and /ultrathink slash command Adds the ULTRATHINK multi-pass reasoning protocol as both a reusable agent prompt and a Claude Code slash command for deep analysis tasks. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(tools): add documentation content audit tool Python tool that audits docs for broken links, stale port references, coverage gaps, and missing cross-references. Outputs human-readable or JSON reports. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(tools): add cross-reference coverage validator Validates that all submodules, services, and NATS subjects have matching entries across services-catalog, CLAUDE.md, and evidence layers. Reports orphaned or missing cross-references. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(tools): add structure best-practices enforcer and Makefile targets Adds structure_enforcer.py for validating project layout against PMOVES conventions. Includes Make targets: docs-audit, docs-audit-json, cross-ref-validate, cross-ref-validate-json, structure-enforce, structure-enforce-strict. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(trail): update FlOO$ entry — all 16 PRs merged, 0 open Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(floos): FlOO$ v2.0 runtime executor, test fix, and trail entry Upgrade floos_resolver.py from validation-only to full runtime executor with execute_step(), publish_hook(), execute_pipeline(), and CLI run subcommand. Fix test_gateway.py ElevenLabs assertion to generic provider count check for local-first CI resilience. Add GRAPHITI trail entry for FlOO$ v2.0 runtime execution layer handoff. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci(branch-strategy): add Integrations branch to CodeRabbit, CI triggers, and protection - Add PMOVES.AI-Edition-Hardened-Integrations to .coderabbit.yaml review branches - Update integration-gate.yml and hardening-validation.yml branch triggers - Update BRANCH_STRATEGY.md with actual branch name (was aspirational "integration") - Branch protection applied via gh api for both staging branches Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(pr-694): address all 13 CodeRabbit review comments Security: - Scrub real credentials from env.shared, untrack from git - Split hardcoded NATS password out of secrets manifest to cgp-backed entry - Fix .gitignore to block env.shared commits CI/Build: - Remove duplicate continue-on-error in python-tests.yml - Install curl in a2ui-renderer Dockerfile for HEALTHCHECK - Remove dead PR tag block in integrations-ghcr.yml - Remove duplicate env vars in archon docker-compose service Data Integrity: - Map all 60 registry agents + tokenism in agent-themes.yaml (was 13) - Fix Cypher variable scoping in chit_mindmap_seed.cypher - Guard submodule import in chit/src/index.ts Misc: - Fix shell expansion syntax in env.presign.additions - Add torch availability guard in test_swarm_meta.py - Add || true to NATS init_streams.sh diagnostic command Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): rename integration-gate job to match branch protection context The branch protection on PMOVES.AI-Edition-Hardened-Integrations requires a status check with context "integration-gate", but the workflow job was named "audit-gate" (displayed as "Audit Gate"). Rename the job key and display name to "integration-gate" so branch protection can be satisfied. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

… delivered (G1 sub-PR #52, G3 #2097) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…link bump (Codex P2) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…c G3) + W1 status (#2097) * fix(wealth): reconcile duplicate firefly compose to FIREFLY_PORT (spec G3) + W1 status - pmoves/compose/docker-compose.firefly.yml: hardcoded 8080:8080 host port aligned to the live deploy unit's ${FIREFLY_PORT:-8075}:8080 (docker-compose.external.yml via make up-external) — no new var name, per spec G3. - TAC_WEALTH.md port row corrected (was stale 8080 + wrong compose file). - Spec phasing updated: W1 DELIVERED (G1 = PMOVES-ToKenism-Multi PR #52, E2E verified: 52 weeks / 156 dry-run transactions / tokenism.export.result.v1 observed; G3 = this PR). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(spec): W1 status = code-complete, closes only on #52 merge + gitlink bump (Codex P2) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…G1 export trigger live in monorepo) (#2099) Fast-forward promotion on tracked branch PMOVES.AI-Edition-Hardened (84b1620 -> 19ab998, ancestry verified): merges ToKenism-Multi #52, the token-gated dry-run export HTTP trigger (spec G1). With #2097 (G3) already on main, this closes W1 per the spec's closure condition. G2 (room manifest flip) remains blocked on live-verify. Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…2 shipped (#2100) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ection honesty Operator review verdict on the tour: no aspirational content presented as fact — verified actuals with evidence, provenance proof, and current regulatory anchoring. - Tokenomics section now leads with MEASURED results: real export run (2026-07-25T14:02Z, baseline, 52 weeks, 156 transactions, dry-run) with real week-1 ledger records, the NATS event on the registered tokenism.export.result.v1 subject, and a provenance chain — canonical event payload + sha256 commitment, honestly labeled commitment-not- signature (unsigned demo mode), anchored to PR #2169 and the ToKenism-Multi export sidecar (PR #52). - Regulatory anchor card (status as of 2026-07-25, engineering posture not legal advice): GENIUS Act rulemaking state and the two design rails it locks (no fixed-USD redemption promise, no yield-on- holdings — distributions stay contribution-keyed, which the measured run demonstrates); CLARITY Act Senate status with both classification branches kept priced in; queued simulation updates (attribution-vs- yield tripwire, AML overhead line item, regulatory-timeline scenario variable, reserve model parked). - Every projection visualization now carries a PROJECTION MODEL chip (--pm-signature-soft, AA-safe) and the section lede separates measured results from planning instruments explicitly. - LIVING_DOCS_INDEX: Creator pipeline row now links the actual living doc (CREATOR_PIPELINE.md — Remotion runtime); new rows for the Pretext text-layout fork (Pmoves-pretext, consumed by a2ui-renderer/src/remotion), the CHIT tour itself (with its verified-actuals evidence policy), and the skills registry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…f gate) (#2076) * feat(dl-1b): CHIT tour re-skin to PMOVES armor tokens + port onto current site Ports the held CHIT Visual Tour (12-commit worktree branch, built pre-DL-1) onto current main and re-skins its AI-default chrome to the armor tokens — the original hold reason was exactly this: a 4th divergent look. Palette: one uniform role mapping applied everywhere (CSS vars, JS string + 0x hex forms, favicon %23 forms): old primary teal -> pm-accent #7C3AED, old primary-soft -> pm-accent-soft #A78BFA, old amber accent -> pm-accent-2 Reserved DARKXSIDE signature #E11D48 added as --signature, applied to ONE element (section markers, large text). Tier-encoding colors (--t-*) and warn/error/success semantics untouched. Zero old-palette hexes remain outside vendor/. Shared-file touches re-applied against current main: nav link + demos card (index.html), sitemap entry (lastmod 2026-07-11), narrow /chit-tour/* CSP block (style-src-attr only; scripts stay strict 'self'). Gate: DARKXSIDE visual sign-off before merge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(chit-tour): verified-actuals evidence + regulatory anchor + projection honesty Operator review verdict on the tour: no aspirational content presented as fact — verified actuals with evidence, provenance proof, and current regulatory anchoring. - Tokenomics section now leads with MEASURED results: real export run (2026-07-25T14:02Z, baseline, 52 weeks, 156 transactions, dry-run) with real week-1 ledger records, the NATS event on the registered tokenism.export.result.v1 subject, and a provenance chain — canonical event payload + sha256 commitment, honestly labeled commitment-not- signature (unsigned demo mode), anchored to PR #2169 and the ToKenism-Multi export sidecar (PR #52). - Regulatory anchor card (status as of 2026-07-25, engineering posture not legal advice): GENIUS Act rulemaking state and the two design rails it locks (no fixed-USD redemption promise, no yield-on- holdings — distributions stay contribution-keyed, which the measured run demonstrates); CLARITY Act Senate status with both classification branches kept priced in; queued simulation updates (attribution-vs- yield tripwire, AML overhead line item, regulatory-timeline scenario variable, reserve model parked). - Every projection visualization now carries a PROJECTION MODEL chip (--pm-signature-soft, AA-safe) and the section lede separates measured results from planning instruments explicitly. - LIVING_DOCS_INDEX: Creator pipeline row now links the actual living doc (CREATOR_PIPELINE.md — Remotion runtime); new rows for the Pretext text-layout fork (Pmoves-pretext, consumed by a2ui-renderer/src/remotion), the CHIT tour itself (with its verified-actuals evidence policy), and the skills registry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(chit-tour): audit fixes — canon sourcing, archetype count, index accuracy Applies the independent claim audit: - CHIT two-meaning split: keep it (it is brand-owner canon, 2026-06-09 reconciliation of 7 historically conflicting expansions) but source it HONESTLY — new lead coverage note states the PMOVESCHIT files still carry the older single expansion pending the fleet-wide doc sweep, so the split is the canon speaking, not the cited file. - Projection duplication disclosure corrected: SIX archetypes share the byte-identical curve (was undercounted as four), verified row-by-row. - CGP version-currency note: spec v1.0 production-ready while recorded example payloads still show v0.1/v0.2 — spec ahead of examples. - LIVING_DOCS_INDEX accuracy: PMOVES-Creator is the ComfyUI image/render farm (zero Remotion — previous row misattributed); the Remotion runtime is the A2UI Renderer (8107). Pretext row now states the real wiring: npm @chenglou/pretext@0.0.6, fork exists on GitHub but is NOT a submodule. Skills row disambiguates the two registries (submodule map vs PmovesSKillZ operator-workflow skills). Tour row cross-links the sibling code-first VISUAL_TOUR.md so the two stop drifting silently. Audit false-alarm for the record: pmoves/config/rooms/ tokenism.room.exchange.json exists on main (sampling miss) — the W2 evidence citations stand. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(chit-tour): Poincaré section computes real hyperbolic geometry — no more decorative dots Operator verdict on the old section: dots with no relevant info, nothing showing what is flattened from hyperbolic space — 'the math needs to show teeth, not fake diagrams.' The old code seeded jitter at fixed radii with straight-line links; it also drew two 'Legendary' center dots that do not exist in the registry. Replaced with computation, all client-side on load: - REAL data: AGENT_TREE extracted verbatim from pmoves/config/agent_registry.yaml (taxonomy v1.5.0, 96 agents; registry truth: 43 standard / 28 specialized / 24 utility / 1 ci, ZERO legendary — the page says so). - Sarkar's construction (2011), scaled variant tau=[1.1,1.7,2.3]: Mobius-translate each node to the origin, fan children at hyperbolic distance tau facing away from the parent, translate back. - Every edge is a true geodesic: arc of the circle through both points orthogonal to the unit circle; diameters handled as lines. - Equal-hyperbolic-step ruler rings at r=tanh(d/2) — the crowding toward the rim is the flattening cost, stated as such. - Interactive metric: click two nodes → the arcosh distance formula evaluated with their computed coordinates, plus euclidean distance, compression factor, tree-path length, and realisation ratio. - Measured distortion of THIS embedding: mean d_H/d_tree = 0.674, worst-case contraction x21.2 over 393 sampled leaf pairs — with the honest tradeoff explanation (Sarkar's theorem: ratio → 1 as tau grows, at the cost of rim crowding). - 'What is being flattened': hyperboloid sheet x^2+y^2-z^2=-1 with class/type nodes lifted via the inverse stereographic map and projection rays from S=(0,0,-1) to their disk shadows; agent leaves truncated from the 3D view with the reason stated. - Labels escaped before innerHTML (A2UI hardening rule); WebGL loop throttled ~20fps and visibility-gated. Headless verification: embed 0.67ms, 120 nodes, 0 invalid coordinates, 0 NaN geodesic paths; browser DOM probe confirms 256 rendered SVG elements and live metric/distortion panels. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(chit-tour): four pillar laboratories — every pillar's math computed live Completes the operator's 'math needs to show teeth' directive across all five pillars (Poincaré/Pillar 2 landed in the previous commit). Each lab runs the pillar's actual mathematics in-browser with the exact parameters the reference implementations use, and states honestly where shipped code and doc prose diverge. Pillar 1 — Dirichlet (dirichlet-weights.ts): live Dir(α) sampling (Marsaglia–Tsang gammas) scattered on the 2-simplex; the EXACT update rule α_i += amount·concentrationK with the real defaults (smoothingAlpha 0.1, concentrationK 1.0); E[w]=α/Σα marked; the non-zero-share guarantee visible in every draw. Pillar 3 — Merkle (shape-attribution.ts): four REAL leaves — the three week-1 ledger transactions and the result event from the measured 2026-07-25 export run — hashed with WebCrypto SHA-256 in the ts leaf shape {address, action, amount, week, category}; click-to-prove inclusion {path, pathIndices} verified against the committed root; a tamper button edits one amount and the proof visibly dies. Pillar 4 — Zeta (zeta-filter.ts): the 20 zero constants verbatim, weights w_n = decayⁿ/ln(γ_n) normalized, applied as the same circular convolution filterSpectrum() implements; REAL input = the 4-bin CGP spectrum from the worked example in 01_WHAT_IS_CHIT.md; a second 32-bin input is labeled synthetic; N and decay are sliders with the ts defaults (10, 0.9). Pillar 5 — Swarm (swarm-attribution.ts): honesty note front and center — the ts header states it does NOT perform mutation/selection/ crossover; it is the fitness scorer + population tracker. Panel A runs the real scorer with the exact gini_reduction weights (0.6/0.2/0.1/ 0.05/0.025/0.025; targets Gini 0.3, poverty 0.1). Panel B is a clearly-labeled demo of the doc-described evolutionary loop driving that same scorer, with real Gini computed per generation. Also: hero/KPI agent counts corrected to the registry truth (96, not the taxonomy doc's stale 76) with a coverage note recording the doc lag. Headless verification: Dirichlet draws sum to 1 with all components positive; zeta weights normalize to 1 and reproduce filterSpectrum on the doc spectrum; fitness monotonic vs Gini; Gini 0 on equal / 0.75 on fully-skewed allocations. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(chit-tour): digest strips for every pillar lab + the tokenizable-by-design convergence Two operator directives: 1. Digestibility — every pillar laboratory (including the Poincaré section) now opens with a three-line plain-language strip: 'Plain words' (what this machine is, no jargon), 'Try this' (one concrete interaction and what you'll see), and 'Why it matters for attribution' (the stake). The math keeps its teeth below; the strip is the on-ramp. 2. Shape attribution is tokenizable BY DESIGN — new convergence block closing the pillars section, mapping the five labs onto the single pipeline stage by stage: domain content → CGP shape (P4 filter + P2 hierarchy) → Dirichlet shares (P1 — the split IS the cap table) → Merkle-committed records (P3 — the shipped contract already carries token_received / reward_claimed action types and verifies claims against the root, shape-attribution.ts:404) → swarm-scored allocation pressure (P5) → the measured ToKenism ledger path (§10, dry-run gated). The interop consequence stated plainly: external domains connect by emitting a CGP for THEIR domain — their constellations get shares, their shares get proofs, their claims verify against the same roots. Evidence it already happens: the live registry carries 18 external contributors (hermes-agent, claude-opus, kilocode, codex, …) beside the 96 internal agents. Regulatory rails from §10 hold by construction: contribution-keyed shares, proofs not redemption promises. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(chit-tour): planned regulatory sims EXECUTED — results replace plans The regulatory anchor's queued simulations have been run (2026-07-26); the card now reports results, not intentions: 1. Attribution-vs-yield tripwire — REAL, full corpus: all 156 transactions of a 52-week baseline run checked (52 pool transfers + 104 external-spending withdrawals). Zero yield/interest/APY-shaped flows: every distribution is contribution-keyed, which is the GENIUS-era design rail demonstrated on actual output. Self-test proves the checker flags a synthetic yield-on-holdings transaction. (First attempt vacuously passed over 0 transactions — extraction missed the sim shape; caught and fixed before publishing. The transformer path is transform_simulation_to_transactions over the full history.) 2. AML/BSA overhead on breakeven — model, labeled ,500/mo program assumption. Honest headline: NO archetype survives standalone (best implied monthly net ~,064 < program cost). Pooled across container replicas: 3 → 8.9mo, 5 → 6.5mo, 10 → 5.5mo breakeven. Under GENIUS-era compliance the Docker-style replication argument is the only viable micro-issuer structure, not an optimization. 3. Regulatory-timeline scenario variable — model, labeled branch factors: GENIUS early/Jan-2027 x CLARITY pass/stall; both-delayed prices a ~22% ambiguity haircut on the top archetype (EV 1455.5 → 1135.3). Reserve-model stays parked (licensed-issuer conversation trigger). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(index): disambiguate the two pretexts + submodule status current Two real, different 'pretext's now ship in the fleet and the index must keep them apart: (1) @chenglou/pretext — the deterministic text-LAYOUT engine in the a2ui-renderer Remotion runtime (fork now wired as the Pmoves-pretext submodule, #2227 — row updated from 'not wired'); and (2) PreTeXt (pretextbook.org) — the structured math-AUTHORING language the persona living-doc room lane used to build 'CHIT & the MOF: A Structural Isomorphism' (pmoves/rooms/persona/pretext, buildable with pretext-cli 2.45.0; verified valid XML, 3 sections, 21 math elements). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(chit-tour): accuracy pass + CHIT playground demo Tour §10 (Tokenomics): rewrite from the real ToKenism Multi codebase — 4 Python scenarios + 5 TS projection models surfaced, TradFi vs Cooperative weekly ledger with hand-verified math, 3-channel Gini reduction explanation, link to live Tokenism UI (:3000). Tour §10 (Shape attribution): compounding (Dirichlet α additive), math-provable (Merkle inclusion proofs), tangible (real $1,880.71 records), full API surface (7 action types, verifyProof, getHyperbolicEncoding, exportCGP), honesty note on convergence. Tour §10 (Real-world context): Ioniq 5 reframed as PMOVES mobile fleet infrastructure (GCEW/OJET EV grants). MWBE/SDVOB certifications. Fordham Hill pilot demographics. More Perfect Union video link. Projection chips relabeled PILOT ECONOMICS. Tour §12 (Coverage): bare file paths replaced with per-pillar explanations of what each source proves. New cross-link panel: 3D geometry ↔ Tokenism economics ↔ real-world fleet context. CHIT Playground (website/chit-demo/): standalone interactive demo with real WebCrypto HMAC-SHA256 signing, 4 real repo scenarios (consciousness theories, urban farming, cooperative economics, agent taxonomy), spectrum visualization, signing flow animation, Shape ID computation, and tamper-detection demonstration. --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

docs: archive september 2025 next steps snapshot

5068fd7

POWERFULMOVES added the codex label Sep 20, 2025 — with ChatGPT Codex Connector

POWERFULMOVES merged commit 3034677 into main Sep 20, 2025
1 of 3 checks passed

POWERFULMOVES added a commit that referenced this pull request Jan 18, 2026

Merge pull request #52 from POWERFULMOVES/codex/move-recovered-sectio…

e70b5c0

…n-to-archive docs: archive 2025 next steps snapshot

POWERFULMOVES deleted the codex/move-recovered-section-to-archive branch March 7, 2026 21:42

POWERFULMOVES mentioned this pull request Jul 12, 2026

fix(wealth): reconcile duplicate firefly compose to FIREFLY_PORT (spec G3) + W1 status #2097

Merged

POWERFULMOVES pushed a commit that referenced this pull request Jul 12, 2026

docs(agnote): UPDATE 5090-CLAUDE — DL-4.1 merged (#2092), ToKenism W1…

d603c53

… delivered (G1 sub-PR #52, G3 #2097) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

POWERFULMOVES pushed a commit that referenced this pull request Jul 12, 2026

docs(spec): W1 status = code-complete, closes only on #52 merge + git…

4706edc

…link bump (Codex P2) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

POWERFULMOVES mentioned this pull request Jul 12, 2026

chore(submodule): bump PMOVES-ToKenism-Multi to 19ab998 — W1 closes (G1 export trigger) #2099

Merged

POWERFULMOVES pushed a commit that referenced this pull request Jul 12, 2026

docs(agnote): UPDATE 5090-CLAUDE — W1 closed (#52/#2097/#2099), DL-4.…

2e227b8

…2 shipped (#2100) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Navigation Menu

docs: archive 2025 next steps snapshot - #52

docs: archive 2025 next steps snapshot#52
POWERFULMOVES merged 1 commit into
mainfrom
codex/move-recovered-section-to-archive

POWERFULMOVES commented Sep 20, 2025

Uh oh!

coderabbitai Bot commented Sep 20, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

POWERFULMOVES commented Sep 20, 2025

Summary

Testing

Uh oh!

coderabbitai Bot commented Sep 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 20, 2025 •

edited

Loading