fix(audit): resolve production blockers B3/B4/B5

[POWERFULMOVES]

Summary

• B3 — Standardize CGP schema to chit.cgp.v0.2 across 10 service files (constant + backward-compat accept for legacy geometry.cgp.v1)
• B4 — Add nats-init sidecar for auto-creating JetStream streams (GEOMETRY_CGP, TOKENISM_ATTRIBUTION, BOTZ_COORDINATION) on startup
• B5 — Fix duplicate linux/arm64 platform entries in 5 GHCR workflow matrix lines
• B1+B2 — Documented as phantom blockers (already resolved / never broken)

Test plan

• grep -r '"cgp\.v1"' pmoves/services/ returns 0 matches
• grep -r '"chit\.cgp\.v0\.2"' pmoves/services/ matches all CGP producers
• grep 'linux/arm64,linux/arm64' .github/workflows/integrations-ghcr.yml returns 0
• docker compose up -d nats nats-init → nats stream ls shows 3 streams
• Gateway /geometry/event accepts both geometry.cgp.v1 and chit.cgp.v0.2 envelope types
• Existing tests pass with updated assertions

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 251 files, which is 101 over the limit of 150.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch PMOVES.AI-Edition-Hardened

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

In general, to fix uncontrolled path usage, you must (1) treat any path component from the client as untrusted, (2) normalize it (using Path(...).resolve() or os.path.normpath), and (3) enforce that the resulting absolute path stays within a known safe root using a containment check like resolved_path.relative_to(root) (or startswith checks on normalized strings). You should never rely solely on substring checks like ".." not in value or raw concatenation.

In this function, the main defense is already present via resolved.relative_to(cache_dir.resolve()), but CodeQL flags the direct use of cache_dir / output_dir with tainted data. The safest, minimal-impact improvement is:

• Normalize output_dir as a Path first.
• Use that normalized component when joining with cache_dir.
• Keep the relative_to check to ensure resolved stays under cache_dir.
• Optionally, keep the existing regex and ".." checks as an early filter.

Concretely, within hf_model_convert_gguf in pmoves/services/hf-mcp-server/main.py, we will:

• Replace the current if output_dir: block (lines 633–641) to:
  • Validate output_dir against the regex and ".." as now.
  • Construct output_subpath = Path(output_dir) and ensure it is not absolute.
  • Compute resolved = (cache_dir / output_subpath).resolve().
  • Call resolved.relative_to(cache_dir.resolve()) to enforce containment.
• Leave the else branch (defaulting to cache_dir / "gguf") unchanged.

This preserves external behavior (clients still pass similar strings, and successful cases still resolve under cache_dir), while making the normalization and containment explicit and slightly stricter (reject absolute output_dir immediately), which should satisfy CodeQL.

General fix approach: Ensure that all filesystem paths derived from user input are both (a) strictly validated/sanitized and (b) checked to be contained within a trusted root directory after normalization/resolve(). For this case, we should guarantee that cache_dir is always under MODELS_BASE, and that any subpaths derived from output_dir remain under that same trusted root.

Best concrete fix here:

1. Strengthen _safe_model_path to verify that the resulting cache_dir is inside MODELS_BASE using resolve() + relative_to(). This ensures a compromised or unexpected MODELS_BASE value cannot be combined with a crafted model_id to escape the intended area.
2. In hf_model_convert_gguf, update the containment check for resolved to use MODELS_BASE.resolve() as the base instead of cache_dir.resolve(). This way, even if an attacker could influence cache_dir somehow, resolved must still remain within the global model cache root.
3. Keep existing validation for output_dir (regex and ".." check) to preserve current behavior.

Concretely:

• In _safe_model_path, after computing cache_dir = MODELS_BASE / sanitized, call resolved = cache_dir.resolve() and enforce resolved.relative_to(MODELS_BASE.resolve()) within a try/except, raising HTTPException(400, "Invalid model ID") if it fails.
• In hf_model_convert_gguf, change the relative_to call from resolved.relative_to(cache_dir.resolve()) to resolved.relative_to(MODELS_BASE.resolve()).

No new imports are needed; Path.resolve and relative_to are already in use.

---

At a high level, the fix should (1) keep the URL validation but (2) ensure that the actual HTTP connection goes to the same, pre-validated IPs/domains, blocking private/internal addresses and preventing DNS rebinding between validation and the requests call. The recommended pattern is to resolve the hostname once, validate all returned IPs against RFC1918/loopback/etc., and then use a custom HTTP adapter so that requests connects to that verified address rather than re-resolving DNS, while still sending the original Host header.

The best way to fix this with minimal functional change is to enhance _fetch_remote_image to:

• Build a small requests.Session() per call.
• Use a custom requests.adapters.HTTPAdapter subclass (defined in the same file) that overrides get_connection / init_poolmanager to connect to a specific, validated IP address while preserving the logical URL and Host header.
• After resolving and validating IPs with socket.getaddrinfo, pick one IP (for now, the first) and use the adapter to force the TCP connection to that IP and port.
• Ensure we explicitly set the Host header to the original hostname to keep HTTP semantics.
• Keep the existing redirect ban and error handling.

This change is entirely within pmoves/services/hi-rag-gateway-v2/app.py. We will:

• Add an import for HTTPAdapter and PoolManager from requests.adapters / urllib3.poolmanager.
• Define a small _FixedAddressAdapter class above _fetch_remote_image.
• Modify _fetch_remote_image to construct a Session, mount the adapter for the appropriate scheme, and perform the GET request through that session to prevent re-resolution. No change to the API of _fetch_remote_image or to the behavior of callers is required.

In general, to fix full SSRF vulnerabilities you should avoid sending requests to arbitrary user-provided URLs. Instead, configure a strict allowlist of permitted hosts (or full base URLs) and have user input only select among these, or thoroughly validate both the hostname and the resolved IPs, including all redirects, with a mechanism that prevents DNS rebinding and accidental access to internal networks.

For this codebase, the best fix with minimal functional change is to (a) require that image hosts be selected from a configured allowlist when that allowlist is non-empty, and (b) when no allowlist is provided, perform stronger, consistent IP-based checks for every network hop, including redirects, using a custom requests adapter that pins connections to previously validated IP addresses. This aligns with the recommendation in the background: resolve DNS once, validate the IP(s), and then enforce that requests uses the validated IP address, while still presenting the original hostname in the TLS SNI and HTTP Host header.

Concretely, all necessary edits are in pmoves/services/hi-rag-gateway/gateway.py:

1. Add a small helper _ip_is_private_or_internal(ip_raw: str) -> bool to centralize and re-use IP safety checks instead of duplicating the logic in _host_is_private_or_internal and _fetch_remote_image.
2. Add a HostIPAdapter class that subclasses requests.adapters.HTTPAdapter and overrides get_connection (or uses a custom init_poolmanager) so that it connects to a specific validated IP address for a given host, while preserving the original host in SNI/headers.
3. Modify _fetch_remote_image:
   • Replace the inline IP classification loop with the new _ip_is_private_or_internal helper.
   • After resolving addresses and validating them, select one IP (for simplicity, the first non-private IP) and build a temporary requests.Session that mounts the HostIPAdapter for the URL’s scheme.
   • Use this session to perform the GET request so that any internal requests resolution and potential redirections stay constrained to the validated IP/host pair, and apply the same IP checks to any redirected locations before following them (we’ll still forbid redirects at the HTTP layer as now, so behavior remains the same to callers).
4. Keep the external behavior of _fetch_remote_image the same from the caller’s perspective: it still raises an HTTPException for invalid URLs, blocked hosts/IPs, or non-2xx (including redirects) responses and returns a requests.Response for successful image fetches.

We will only touch the shown regions and add a small amount of new code (helper + adapter + session usage) around _fetch_remote_image. No external (non-standard-library) dependencies beyond requests are introduced.

---