fix(security): secrets-audit zero-errors + hardening batch

.claude/commands/botz/secrets.md

@@ -18,11 +18,11 @@ Run this command when:
 
 ### Encode Options
 - `--env-file, -e <path>` - Source env file (default: `pmoves/env.shared`)
-- `--out, -o <path>` - Output CGP path (default: `pmoves/pmoves/data/chit/env.cgp.json`)
+- `--out, -o <path>` - Output CGP path (default: `pmoves/data/chit/env.cgp.json`)
 - `--no-cleartext` - Store secrets as base64 only (no plaintext)
 
 ### Decode Options
-- `--cgp, -c <path>` - Input CGP file (default: `pmoves/pmoves/data/chit/env.cgp.json`)
+- `--cgp, -c <path>` - Input CGP file (default: `pmoves/data/chit/env.cgp.json`)
 - `--out, -o <path>` - Output decoded env file (default: `pmoves/pmoves/data/chit/env.decoded`)
 
 ## Implementation

.claude/commands/cipher/reasoning.md

@@ -0,0 +1,38 @@
+# Cipher Reasoning
+
+Store and retrieve reasoning traces and patterns in Cipher Memory.
+
+## Instructions
+
+Manage reasoning traces in Cipher Memory. Two modes:
+
+### Store a reasoning trace
+
+```bash
+# Store reasoning via Cipher Memory API
+curl -s -X POST http://localhost:8096/api/memory \
+  -H "Content-Type: application/json" \
+  -d '{
+    "content": "$REASONING_CONTENT",
+    "category": "reasoning_trace",
+    "metadata": {
+      "task": "$TASK_DESCRIPTION",
+      "outcome": "$OUTCOME",
+      "confidence": 0.85
+    },
+    "source": "claude-code",
+    "timestamp": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"
+  }'
+```
+
+### Retrieve reasoning patterns
+
+```bash
+# Search for reasoning patterns
+curl -s "http://localhost:8096/api/memory/search?q=$PATTERN_QUERY&category=reasoning_trace&limit=5"
+```
+
+**Notes:**
+- Also available via MCP tools: `pmoves_cipher_store_reasoning`, `pmoves_cipher_reasoning_patterns`
+- Reasoning traces help agents learn from past decisions
+- Patterns are indexed for similarity search

.claude/commands/cipher/search.md

@@ -0,0 +1,29 @@
+# Cipher Search
+
+Search Cipher Memory for stored knowledge and reasoning traces.
+
+## Instructions
+
+Search the Cipher Memory knowledge graph. The user should provide a search query.
+
+```bash
+# Search Cipher Memory (port 8096)
+curl -s "http://localhost:8096/api/memory/search?q=$QUERY&limit=10" | python -c "
+import sys, json
+d = json.load(sys.stdin)
+results = d if isinstance(d, list) else d.get('results', [])
+for i, r in enumerate(results):
+    print(f'{i+1}. [{r.get(\"category\",\"?\")}] {r.get(\"content\",\"?\")[:120]}...')
+    print(f'   source={r.get(\"source\",\"?\")} ts={r.get(\"timestamp\",\"?\")}')
+"
+```
+
+```bash
+# Check Cipher Memory health
+curl -s http://localhost:8096/health
+```
+
+**Notes:**
+- Also available via MCP tool: `pmoves_cipher_search`
+- Supports semantic search over Neo4j graph
+- Results include category, source, and timestamp metadata

.claude/commands/cipher/store.md

@@ -0,0 +1,31 @@
+# Cipher Store
+
+Store a memory entry in Cipher Memory (Neo4j-backed knowledge graph).
+
+## Instructions
+
+Store a memory entry in Cipher Memory. The user should provide:
+1. **Content** — the knowledge/memory to store
+2. **Category** — optional category (e.g., `agent_plan`, `agent_checkpoint`, `agent_completion`)
+
+```bash
+# Store memory via Cipher Memory API (port 8096)
+curl -s -X POST http://localhost:8096/api/memory \
+  -H "Content-Type: application/json" \
+  -d '{
+    "content": "$CONTENT",
+    "category": "$CATEGORY",
+    "source": "claude-code",
+    "timestamp": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"
+  }'
+```
+
+```bash
+# Verify storage
+curl -s "http://localhost:8096/api/memory/search?q=$SEARCH_TERM&limit=1"
+```
+
+**Notes:**
+- Cipher Memory also available via MCP tools: `pmoves_cipher_store`
+- Categories: `agent_plan`, `agent_checkpoint`, `agent_completion`, `pattern`, `learning`
+- Content is indexed in Neo4j for graph traversal queries

.claude/commands/discord/notify.md

@@ -0,0 +1,27 @@
+# Discord Notify
+
+Send a notification through the Publisher-Discord service.
+
+## Instructions
+
+Trigger a Discord notification. This works by publishing a NATS event that Publisher-Discord is subscribed to.
+
+The user should provide:
+1. **Message** — the notification content
+2. **Channel** — target Discord channel (if configurable)
+
+```bash
+# Publish a notification event via NATS
+# Publisher-Discord listens on: ingest.file.added.v1, ingest.transcript.ready.v1, ingest.summary.ready.v1, ingest.chapters.ready.v1
+nats pub "ingest.summary.ready.v1" "{\"title\": \"$TITLE\", \"summary\": \"$MESSAGE\", \"source\": \"manual\"}"
+```
+
+```bash
+# Verify Publisher-Discord received the event
+docker logs publisher-discord --tail 5 2>&1
+```
+
+**Notes:**
+- Publisher-Discord subscribes to specific NATS subjects
+- Messages are formatted as Discord embeds
+- Rate limiting may apply

.claude/commands/discord/status.md

@@ -0,0 +1,25 @@
+# Discord Status
+
+Check the status of the Publisher-Discord notification bot.
+
+## Instructions
+
+Check health of:
+1. **Publisher-Discord** (port 8094) - Discord notification service
+2. **NATS subscriptions** - Verify event listeners are active
+
+```bash
+# Publisher-Discord health
+curl -s http://localhost:8094/healthz && echo "Publisher-Discord: healthy" || echo "Publisher-Discord: unhealthy"
+```
+
+```bash
+# Container status
+docker ps --filter "name=publisher-discord" --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
+```
+
+Report:
+- Service health (healthy/unhealthy)
+- NATS subscription status (listening for ingest events)
+- Recent notification activity
+- Any errors in logs

.claude/commands/jellyfin/status.md

@@ -0,0 +1,25 @@
+# Jellyfin Status
+
+Check the status of Jellyfin Bridge and related media services.
+
+## Instructions
+
+Check health of:
+1. **Jellyfin Bridge** (port 8093) - Metadata webhook and helper
+2. **Jellyfin server** - Media server accessibility
+
+```bash
+# Jellyfin Bridge health
+curl -s http://localhost:8093/healthz && echo "Jellyfin Bridge: healthy" || echo "Jellyfin Bridge: unhealthy"
+```
+
+```bash
+# Container status
+docker ps --filter "name=jellyfin" --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
+```
+
+Report:
+- Jellyfin Bridge health (healthy/unhealthy)
+- Supabase sync status
+- Recent webhook activity
+- Any errors in logs

.claude/commands/jellyfin/sync.md

@@ -0,0 +1,29 @@
+# Jellyfin Sync
+
+Trigger a sync between Jellyfin and Supabase metadata.
+
+## Instructions
+
+Initiate a metadata sync from Jellyfin to Supabase via the Jellyfin Bridge service.
+
+```bash
+# Check Jellyfin Bridge health first
+curl -s http://localhost:8093/healthz
+```
+
+```bash
+# Trigger sync (if endpoint available)
+curl -s -X POST http://localhost:8093/sync \
+  -H "Content-Type: application/json" \
+  -d '{"force": false}'
+```
+
+```bash
+# Check recent sync logs
+docker logs jellyfin-bridge --tail 20 2>&1
+```
+
+Report:
+- Sync status (started/completed/failed)
+- Number of items synced
+- Any sync errors

.claude/commands/minio/presign.md

@@ -0,0 +1,27 @@
+# MinIO Presign
+
+Generate presigned URLs for MinIO objects via the Presign service.
+
+## Instructions
+
+Generate a short-lived presigned URL for an object in MinIO. The user should provide:
+1. **Bucket** — `assets` or `outputs`
+2. **Key** — the object path within the bucket
+
+```bash
+# Generate presigned URL via Presign service (port 8088)
+curl -s -X POST http://localhost:8088/presign \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer $PRESIGN_SHARED_SECRET" \
+  -d '{"bucket": "$BUCKET", "key": "$KEY", "expires_in": 3600}'
+```
+
+```bash
+# Check Presign service health
+curl -s http://localhost:8088/healthz
+```
+
+**Notes:**
+- Presigned URLs expire after the specified duration (default: 1 hour)
+- Only `assets` and `outputs` buckets are allowed
+- Requires `PRESIGN_SHARED_SECRET` environment variable

.claude/commands/minio/status.md

@@ -0,0 +1,31 @@
+# MinIO Status
+
+Check the status of MinIO S3-compatible object storage.
+
+## Instructions
+
+Check health of:
+1. **MinIO Server** (port 9000) - Object storage API
+2. **MinIO Console** (port 9001) - Web management UI
+3. **Buckets** - Verify `assets` and `outputs` exist
+
+```bash
+# MinIO health check
+curl -s http://localhost:9000/minio/health/live && echo "MinIO: healthy" || echo "MinIO: unhealthy"
+```
+
+```bash
+# List buckets (requires mc client or curl with auth)
+docker exec -it minio mc ls local/ 2>/dev/null || echo "Use MinIO Console at http://localhost:9001"
+```
+
+```bash
+# Container status
+docker ps --filter "name=minio" --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
+```
+
+Report:
+- MinIO health (live/dead)
+- Bucket listing (assets, outputs)
+- Storage usage if available
+- Console accessibility

.claude/commands/minio/upload.md

@@ -0,0 +1,33 @@
+# MinIO Upload
+
+Upload a file to MinIO object storage.
+
+## Instructions
+
+Upload a file to a specified bucket. The user should provide:
+1. **File path** — local file to upload
+2. **Bucket** — target bucket (`assets` or `outputs`)
+3. **Key** — destination object key
+
+```bash
+# Upload via mc CLI (if available in container)
+docker exec -it minio mc cp "/tmp/$FILENAME" "local/$BUCKET/$KEY"
+```
+
+```bash
+# Upload via curl with presigned PUT URL
+# First generate a presigned PUT URL, then upload
+curl -s -X PUT "$PRESIGNED_URL" \
+  -H "Content-Type: application/octet-stream" \
+  --data-binary @"$FILE_PATH"
+```
+
+```bash
+# Verify upload
+docker exec -it minio mc ls "local/$BUCKET/$KEY"
+```
+
+**Notes:**
+- For large files, consider using multipart upload
+- The Presign service (port 8088) can generate PUT URLs
+- Verify bucket exists before uploading

.claude/commands/nats/monitor.md

@@ -0,0 +1,40 @@
+# NATS Monitor
+
+Monitor NATS message flow in real-time for debugging and observability.
+
+## Instructions
+
+Monitor NATS subjects for real-time message flow. The user should provide:
+1. **Subject pattern** — NATS subject to monitor (supports wildcards: `>`, `*`)
+
+```bash
+# Monitor all messages (use with caution — high volume)
+nats sub ">" --count 10
+```
+
+```bash
+# Monitor specific subject pattern
+nats sub "$SUBJECT_PATTERN" --count 20
+```
+
+```bash
+# Monitor research events
+nats sub "research.>" --count 10
+```
+
+```bash
+# Monitor ingestion pipeline
+nats sub "ingest.>" --count 10
+```
+
+Common patterns:
+- `research.>` — all research events
+- `ingest.>` — all ingestion events
+- `geometry.>` — all geometry bus events
+- `botz.>` — all BoTZ work distribution
+- `mesh.>` — mesh node announcements
+
+**Notes:**
+- Requires `nats` CLI tool
+- Use `--count N` to limit output
+- Use `>` for all sub-subjects, `*` for single-level wildcard

.claude/commands/nats/publish.md

@@ -0,0 +1,31 @@
+# NATS Publish
+
+Publish a message to a NATS subject for testing or triggering workflows.
+
+## Instructions
+
+Publish a message to the specified NATS subject. The user should provide:
+1. **Subject** — the NATS subject to publish to (e.g., `research.deepresearch.request.v1`)
+2. **Payload** — JSON message body
+
+Common subjects (see `.claude/context/nats-subjects.md`):
+- `research.deepresearch.request.v1` — trigger deep research
+- `supaserch.request.v1` — trigger holographic search
+- `ingest.file.added.v1` — simulate file ingestion event
+
+```bash
+# Publish message using nats CLI (if available)
+nats pub "$SUBJECT" '$PAYLOAD'
+```
+
+```bash
+# Alternative: publish via curl to NATS HTTP monitoring
+# Note: NATS monitoring API is read-only; for publishing, use nats CLI or a service endpoint
+echo "Publishing to: $SUBJECT"
+echo "Payload: $PAYLOAD"
+```
+
+**Safety notes:**
+- Always confirm the subject and payload with the user before publishing
+- Production subjects trigger real workflows — use with care
+- For testing, prefer subjects with `.test.` in the name