hardened: layered local bring-up + archon/env + monitoring alignment

.github/workflows/codeql.yml

@@ -40,9 +40,6 @@ jobs:
     name: Analyze (${{ matrix.language }})
     # PMOVES.AI: Prefer self-hosted runners; fall back to GitHub-hosted if unavailable
     runs-on: ubuntu-latest
-    # Allow C/CPP to fail gracefully - this repo is primarily Python/TypeScript
-    # C/CPP files only exist in submodules (external dependencies)
-    continue-on-error: ${{ matrix.language == 'c-cpp' }}
     permissions:
       # required for all workflows
       security-events: write
@@ -60,8 +57,6 @@ jobs:
         include:
         - language: actions
           build-mode: none
-        - language: c-cpp
-          build-mode: autobuild
         - language: javascript-typescript
           build-mode: none
         - language: python

.github/workflows/hardening-validation.yml

@@ -91,7 +91,7 @@ jobs:
           - pmoves/services/archon/Dockerfile
           - pmoves/services/agent-zero/Dockerfile
           - pmoves/services/flute-gateway/Dockerfile
-          - pmoves/services/hirag-gateway/Dockerfile
+          - pmoves/services/hi-rag-gateway/Dockerfile
           - pmoves/services/extract-worker/Dockerfile
           - pmoves/services/tokenism-simulator/Dockerfile
           - pmoves/services/botz-gateway/Dockerfile
@@ -204,6 +204,22 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
+      - name: Materialize compose env files from templates
+        run: |
+          set -euo pipefail
+
+          if [ ! -f "pmoves/env.shared" ] && [ -f "pmoves/env.shared.example" ]; then
+            cp pmoves/env.shared.example pmoves/env.shared
+          fi
+
+          for tier in data supabase api llm worker media agent ui; do
+            env_file="pmoves/env.tier-${tier}"
+            example_file="${env_file}.example"
+            if [ ! -f "${env_file}" ] && [ -f "${example_file}" ]; then
+              cp "${example_file}" "${env_file}"
+            fi
+          done
+
       - name: Validate compose syntax
         run: |
           echo "Validating docker-compose files..."
@@ -212,9 +228,9 @@ jobs:
           docker compose -f pmoves/docker-compose.yml config --quiet
           echo "✓ pmoves/docker-compose.yml is valid"
 
-          # Validate hardened compose file
-          docker compose -f pmoves/docker-compose.hardened.yml config --quiet
-          echo "✓ pmoves/docker-compose.hardened.yml is valid"
+          # Validate hardened compose syntax only (override file is intentionally partial)
+          docker compose -f pmoves/docker-compose.hardened.yml config --quiet --no-consistency
+          echo "✓ pmoves/docker-compose.hardened.yml syntax is valid"
 
           # Validate monitoring compose file
           if [ -f "pmoves/monitoring/docker-compose.monitoring.yml" ]; then

.gitignore

@@ -11,6 +11,8 @@
 !.env.template
 !.env.tier-*
 secrets/
+!pmoves/integrations/**/secrets/
+!pmoves/integrations/**/secrets/labels.yaml
 *.pem
 *.key
 !*.key.example

.gitmodules

@@ -54,6 +54,11 @@
 	url = https://github.com/POWERFULMOVES/PMOVES-A2UI.git
 	branch = PMOVES.AI-Edition-Hardened
 
+[submodule "research/A2UI"]
+	path = research/A2UI
+	url = https://github.com/POWERFULMOVES/PMOVES-A2UI.git
+	branch = PMOVES.AI-Edition-Hardened
+
 [submodule "PMOVES-Deep-Serch"]
 	path = PMOVES-Deep-Serch
 	url = https://github.com/POWERFULMOVES/PMOVES-Deep-Serch.git
@@ -93,6 +98,11 @@
 	url = https://github.com/POWERFULMOVES/PMOVES-surf.git
 	branch = PMOVES.AI-Edition-Hardened
 
+[submodule "pmoves-surf"]
+	path = pmoves-surf
+	url = https://github.com/POWERFULMOVES/PMOVES-surf.git
+	branch = PMOVES.AI-Edition-Hardened
+
 # =============================================================================
 # E2B Danger Room - Sandboxed Code Execution
 # =============================================================================
@@ -124,38 +134,42 @@
 	url = https://github.com/POWERFULMOVES/PMOVES-E2b-Spells.git
 	branch = PMOVES.AI-Edition-Hardened
 
-# DEPRECATED: Vendor e2b entries below - replaced by forked submodules above
-# Uncomment only if working with pre-migration branches (before 2026-02-07)
-# All code confirmed preserved in forked repositories - no local commits lost
-# [submodule "pmoves/vendor/e2b"]
-# 	path = pmoves/pmoves/vendor/e2b
-# 	url = https://github.com/POWERFULMOVES/PMOVES-E2B-Danger-Room.git
-# 	branch = PMOVES.AI-Edition-Hardened
-#
-# [submodule "pmoves/vendor/e2b-desktop"]
-# 	path = pmoves/vendor/e2b-desktop
-# 	url = https://github.com/POWERFULMOVES/PMOVES-E2B-Danger-Room-Desktop.git
-# 	branch = PMOVES.AI-Edition-Hardened
-#
-# [submodule "pmoves/vendor/e2b-infra"]
-# 	path = pmoves/vendor/e2b-infra
-# 	url = https://github.com/POWERFULMOVES/PMOVES-Danger-infra.git
-# 	branch = PMOVES.AI-Edition-Hardened
-#
-# [submodule "pmoves/vendor/e2b-mcp-server"]
-# 	path = pmoves/vendor/e2b-mcp-server
-# 	url = https://github.com/POWERFULMOVES/pmoves-e2b-mcp-server.git
-# 	branch = PMOVES.AI-Edition-Hardened
-#
-# [submodule "pmoves/vendor/e2b-spells"]
-# 	path = pmoves/vendor/e2b-spells
-# 	url = https://github.com/POWERFULMOVES/PMOVES-E2b-Spells.git
-# 	branch = PMOVES.AI-Edition-Hardened
-#
-# [submodule "pmoves/vendor/e2b-surf"]
-# 	path = pmoves/vendor/e2b-surf
-# 	url = https://github.com/POWERFULMOVES/pmoves-surf.git
-# 	branch = PMOVES.AI-Edition-Hardened
+# Compatibility mappings for historical gitlinks that still exist in index.
+# Keep these active until the legacy vendor/research paths are fully removed.
+[submodule "pmoves/vendor/agentgym"]
+	path = pmoves/vendor/agentgym
+	url = https://github.com/POWERFULMOVES/PMOVES-AgentGym.git
+	branch = PMOVES.AI-Edition-Hardened
+
+[submodule "pmoves/vendor/agentgym-rl"]
+	path = pmoves/vendor/agentgym-rl
+	url = https://github.com/POWERFULMOVES/Pmoves-AgentGym-RL.git
+	branch = PMOVES.AI-Edition-Hardened
+
+[submodule "pmoves/vendor/e2b-desktop"]
+	path = pmoves/vendor/e2b-desktop
+	url = https://github.com/POWERFULMOVES/PMOVES-E2B-Danger-Room-Desktop.git
+	branch = PMOVES.AI-Edition-Hardened
+
+[submodule "pmoves/vendor/e2b-infra"]
+	path = pmoves/vendor/e2b-infra
+	url = https://github.com/POWERFULMOVES/PMOVES-Danger-infra.git
+	branch = PMOVES.AI-Edition-Hardened
+
+[submodule "pmoves/vendor/e2b-mcp-server"]
+	path = pmoves/vendor/e2b-mcp-server
+	url = https://github.com/POWERFULMOVES/pmoves-e2b-mcp-server.git
+	branch = PMOVES.AI-Edition-Hardened
+
+[submodule "pmoves/vendor/e2b-spells"]
+	path = pmoves/vendor/e2b-spells
+	url = https://github.com/POWERFULMOVES/PMOVES-E2b-Spells.git
+	branch = PMOVES.AI-Edition-Hardened
+
+[submodule "pmoves/vendor/e2b-surf"]
+	path = pmoves/vendor/e2b-surf
+	url = https://github.com/POWERFULMOVES/PMOVES-surf.git
+	branch = PMOVES.AI-Edition-Hardened
 
 # =============================================================================
 # Voice & Speech Services
@@ -209,11 +223,6 @@
 	url = https://github.com/POWERFULMOVES/PMOVES-Open-Notebook.git
 	branch = PMOVES.AI-Edition-Hardened
 
-[submodule "Pmoves-open-notebook"]
-	path = Pmoves-open-notebook
-	url = https://github.com/POWERFULMOVES/Pmoves-open-notebook.git
-	branch = PMOVES.AI-Edition-Hardened
-
 # =============================================================================
 # Document Processing
 # =============================================================================

pmoves/.env.example

@@ -128,7 +128,7 @@ NEXT_PUBLIC_SUPABASE_PASSWORD_AUTH_ENABLED=true
 NEXT_PUBLIC_SUPABASE_OAUTH_ENABLED=true
 
 # NATS (events / mesh)
-NATS_URL=nats://nats:4222
+NATS_URL=nats://nats:pmoves@nats:4222
 
 # PMOVES.YT (YouTube ingestion & summarization)
 YT_BUCKET=cataclysm-youtube