docs(hardened): DAO recontext and production audit docs convergence - #707
Merged
POWERFULMOVES merged 6 commits intoFeb 25, 2026
Merged
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Owner
Author
|
KRISS KROSS rail split completed by Codex. What changed in this update:
Runtime follow-up should move in a dedicated Integrations-targeted PR for Claude close-review. |
5 tasks
Phase 1: DARKXSIDE registered as 8th contributor (✦ glyph, #E11D48, witness voice) Phase 2: A2UI Renderer port 8105, Remotion renderMedia wired, 3 demo specs Phase 3: Hyperdimensions WebRTC portal with prosodic-geometry bridge Phase 4: Creator pipeline — MinIO upload + NATS events after render Phase 5: JWT auth middleware (fail-closed) + CHIT Safe Passage headers Phase 6: KRISS KROSS ACK with CHIT attestation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
POWERFULMOVES
force-pushed
the
docs/kriss-kross-dao-phase
branch
from
February 24, 2026 14:20
b3ffd1a to
cc44d57
Compare
Owner
Author
Claude Close-Review — PR #707 (Docs/Signature Lane)Scope VerificationAfter CODEX's rail split at
Zero runtime files. No Conflict ResolutionResolved 4 merge conflicts across 3 rebase commits:
KRISS KROSS Accord AcknowledgementI acknowledge:
Cross-References
🤖 Close-review by Claude Opus 4.6 |
POWERFULMOVES
added a commit
that referenced
this pull request
Feb 25, 2026
* feat(darkxside): COCREATOR registration + A2UI Remotion + portal + auth Phase 1: DARKXSIDE registered as 8th contributor (✦ glyph, #E11D48, witness voice) Phase 2: A2UI Renderer port 8105, Remotion renderMedia wired, 3 demo specs Phase 3: Hyperdimensions WebRTC portal with prosodic-geometry bridge Phase 4: Creator pipeline — MinIO upload + NATS events after render Phase 5: JWT auth middleware (fail-closed) + CHIT Safe Passage headers Phase 6: KRISS KROSS ACK with CHIT attestation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(governance): Claude ACK for KRISS KROSS rail split handoff - Added rail-split handoff trail entry to AGENT_TRAIL.md - Signed ACK::CLAUDE-OPUS::PHI-4482-T1::KRISS-KROSS-RAIL-SPLIT in AGNOTE4482PHI - Logged claim/review/release for PR #708 creation and PR #707 close-review Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(governance): propose Stash-Safe Rail Split Protocol amendment Formalizes the git stash-pop conflict hazard discovered during KRISS KROSS rail split handoff. Adds proposed amendment to KRISS_KROSS_ACK.md and corresponding graphiti trail entry in AGENT_TRAIL.md. Key invariant: stash base commit must equal branch HEAD at pop time. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(a2ui): align renderer contracts, remotion entrypoint, and skill port * docs(agents): add KRISS KROSS accord to runtime rail for signature parity * docs(agents): add Codex rail-split ACK to integrations lane --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
POWERFULMOVES
commented
Feb 25, 2026
POWERFULMOVES
left a comment
POWERFULMOVES
left a comment
Owner
Author
There was a problem hiding this comment.
Review: PASS — Ready for Merge
Reviewer: Claude Code (automated review)
Summary
All 12 files are documentation, YAML config, and JSON schema — zero runtime code changes confirmed.
Findings
- Schema (
signature.v1.schema.json): Additive-only —"darkxside"example +"witness"enum. Backward compatible. - Config (
agent_signatures.yaml): Newdarkxsideentry follows existing patterns (glyph, color, voice, resonance). Clean. - KRISS KROSS rewrite: Replaces Codex-specific 4-step handshake with general multi-agent collision protocol. Adds Rail Strategy, JOHNNY BLAZE fallback, dual signature requirements. Old CODEX WEAVE checklist removed — acceptable for governance evolution.
- DAO Recontext Plan: Well-structured scenario envelope (3 bands), clear rules against benchmark backfill, ingestion pipeline documented.
- Dashboard: Adds drift checks + release gates RG-1..RG-4. Honest about quantitative snapshot staleness (2026-02-20).
- No sensitive data: Searched for credentials, tokens, PII — none found.
Minor Notes (non-blocking)
- Pre-existing broken link:
README_DOCS_INDEX.md→../AGENTS/LOCAL_CERTIFICATION_LOCKDOWN.md(not introduced here) - Old handshake field names (
overlay_id,lane_owner) fully replaced without deprecation note - Dashboard commit ref
80d06daaretained with updated date — clarified by new snapshot timestamp row
Overlap with PR #706
3 shared files (NEXT_STEPS.md, ROADMAP.md, PRODUCTION_AUDIT_DASHBOARD.md). PR #706 targets main with broader dashboard rewrites (+52/-33) plus 2 unique checklist files. Will need rebase after Hardened→main sync. Not blocking.
Verdict
Docs-only, well-structured, follows project conventions. CodeQL pending is irrelevant for pure docs. Safe to merge with --admin.
POWERFULMOVES
pushed a commit
that referenced
this pull request
Feb 25, 2026
… KRISS KROSS) Resolves merge conflicts between #706 (lock-step release closeout on main) and #707 (DAO recontext + hardened convergence on Hardened). Conflict resolution strategy: - ROADMAP.md: keep both lock-step history + DAO recontext + Sprint Overlay - PRODUCTION_AUDIT_DASHBOARD.md: combine metadata, keep both validation commands (AB-6 + RG-1..RG-4), preserve both changelog entries Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
3 tasks
POWERFULMOVES
added a commit
that referenced
this pull request
Feb 25, 2026
chore: sync Hardened docs into main (#707)
POWERFULMOVES
added a commit
that referenced
this pull request
Feb 26, 2026
…713) * docs(trail): add entry for PR #694 review remediation + branch promotion 9th graphiti-signed trail entry documenting: - All 13 CodeRabbit review fixes applied - integration-gate CI context fix - Squash merge to Integrations + promotion to Hardened - 27 conflict resolution in promotion PR Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(ci): add GHCR bootstrap and local-first supaserch gates * docs(ops): codify Dock.Tier Git.Flare parity lane and handoff trail * fix(ci): honor GHCR integration selector for workflow dispatch * fix(ci): skip non-selected GHCR matrix lanes on dispatch * fix(ci): resolve GHCR matrix from config for true targeted dispatch * chore(ops): make GHCR bootstrap lane org-aware by default * fix(ci): resolve GHCR matrix by names to avoid output masking * docs(ci): record GHCR matrix resolver source-of-truth flow * fix(ci): use python3 fallback for integration config step * fix(ci): prefer GHCR PAT auth before workflow token * docs(ci): note PAT-first GHCR auth for 403 mitigation * feat(ci): add GHCR namespace override for targeted dispatch * docs(ops): document GHCR namespace override for org routing * fix(auth): NATS credential hardening + service topology docs Fix unauthenticated NATS defaults in Pipecat (5 integration files) and Flute-Gateway (main.py + README.md): nats://nats:4222 → nats://nats:pmoves@nats:4222. Fill all TBD placeholders in Pmoves-hyperdimensions integration template. Add pmoves/docs/PMOVES_SERVICE_TOPOLOGY.md (7-tier architecture map, 4 data flow narratives, full submodule directory). Add pmoves/docs/integrations/INTEGRATION_CHECKLIST.md (9-section onboarding checklist for new submodules). Update INTEGRATIONS.md with cross-references and recently-reviewed submodules section covering BoTZ, DoX, Pipecat, Flute-Gateway, Open-Notebook, and Hyperdimensions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(auth): BoTZ gateway unified JWT + CHIT attestation + agent trails Update BoTZ submodule: gateway auth upgraded from MCP_SERVER_TOKEN to Supabase JWT (unified PMOVES auth). Adds X-CHIT-Attestation Safe Passage header and first agent.graphiti.signed.v1 NATS emission implementation. Append graphiti trail entry documenting NATS auth hardening, unified gateway auth, and agent trail work across this session. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(parity): resolve PR699 review threads and CI hardening gaps (#703) * fix(flute): remove plaintext nats fallback and redact service URL * fix(ci): harden ghcr matrix loading and bootstrap secret flow * docs(parity): align botz auth, topology ports, and graphiti context indexes --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> * feat(release): deterministic submodule production checklist and branch gate (#704) * feat(preflight): add deterministic submodule branch policy gate * docs(release): add submodule production checklist and deterministic gate flow --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> * fix(jellyfin): align prod topology and yt metadata path (#700) Co-authored-by: Shaela Bello <slbello@uncg.edu> * feat(jellyfin): add prod stack verify and parity audit targets (#701) Co-authored-by: Shaela Bello <slbello@uncg.edu> * docs(creator): update roadmap, handoff trail, and audit runbook (#702) Co-authored-by: Shaela Bello <slbello@uncg.edu> * feat(topology): topology-aware service recovery + auth alignment - Fix 4 unhealthy Supabase containers: URL-encode passwords containing '/' in postgres connection strings (POSTGRES_PASSWORD_URLENCODED fallback) - Fix Invidious: auto-generate 16-char hex companion key via secrets hydration - Fix ComfyUI watcher: MinIO credential fallback chain MINIO_ACCESS_KEY→MINIO_ROOT_USER - Fix Kong: entrypoint wrapper for auto-migration bootstrap - Evolve DOCKED_MODE boolean into TopologyMode enum (docked/hybrid/standalone) with backward-compatible auto-detection from EXTERNAL_* + SUPABASE_RUNTIME - Add dynamic port resolution bridging port_allocator + topology context - Add cross-tier auth alignment validator (JWT, NATS, MinIO, URL-safety, placeholders) - Wire credential_urlencoder into secrets-funnel pipeline - Add auth-alignment + ports-resolve Make targets, integrate into preflight gate - Add topology block to mesh agent v2 NATS announcements - 29:29 DOCKED_MODE/TOPOLOGY_MODE parity across all compose services Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(hydrate): filter placeholder values from container env inspection _find_container_env_value() was returning placeholder strings like INVIDIOUS_COMPANION_KEY_HERE from running containers, preventing the secrets.token_hex(8) fallback from generating a real key. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): isolate hyphenated service pytest conftests in python-tests * fix(ci): scope python-tests workflow to service test suites * fix(pytest): use explicit pmoves.tests fixture bridge import * fix(compose): align comfy-watcher MinIO credential variables MINIO_ACCESS_KEY fallback changed from MINIO_ROOT_USER to MINIO_USER and MINIO_SECRET_KEY fallback from MINIO_ROOT_PASSWORD to MINIO_PASSWORD to match the canonical variable names in env.tier-data. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(darkxside): A2UI Remotion renderer + WebRTC portal + auth (#708) * feat(darkxside): COCREATOR registration + A2UI Remotion + portal + auth Phase 1: DARKXSIDE registered as 8th contributor (✦ glyph, #E11D48, witness voice) Phase 2: A2UI Renderer port 8105, Remotion renderMedia wired, 3 demo specs Phase 3: Hyperdimensions WebRTC portal with prosodic-geometry bridge Phase 4: Creator pipeline — MinIO upload + NATS events after render Phase 5: JWT auth middleware (fail-closed) + CHIT Safe Passage headers Phase 6: KRISS KROSS ACK with CHIT attestation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(governance): Claude ACK for KRISS KROSS rail split handoff - Added rail-split handoff trail entry to AGENT_TRAIL.md - Signed ACK::CLAUDE-OPUS::PHI-4482-T1::KRISS-KROSS-RAIL-SPLIT in AGNOTE4482PHI - Logged claim/review/release for PR #708 creation and PR #707 close-review Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(governance): propose Stash-Safe Rail Split Protocol amendment Formalizes the git stash-pop conflict hazard discovered during KRISS KROSS rail split handoff. Adds proposed amendment to KRISS_KROSS_ACK.md and corresponding graphiti trail entry in AGENT_TRAIL.md. Key invariant: stash base commit must equal branch HEAD at pop time. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(a2ui): align renderer contracts, remotion entrypoint, and skill port * docs(agents): add KRISS KROSS accord to runtime rail for signature parity * docs(agents): add Codex rail-split ACK to integrations lane --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * chore(env): enforce uv-first pmoves venv bootstrap * feat(preflight): add topology and CHIT sync gate * feat(preflight): expand topology gate to all running containers * feat(preflight): enforce manifest-driven topology policy gate * feat(preflight): scope CHIT gate to policy-defined services * feat(runtime): enforce CHIT production overlays on core services * docs(ops): add topology+CHIT strict gate workflow runbook * fix(make): run CHIT manifest targets with project venv * security(nats): enforce authenticated NATS URLs across all services Replace all 48 occurrences of unauthenticated nats://nats:4222 with nats://nats:pmoves@nats:4222 in service code, compose files, Dockerfiles, shell scripts, terraform, and UI components. Preserves test_nats_authentication.py negative assertion unchanged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * security(nats): update NATS auth in documentation and agent prompts Replace unauthenticated nats://nats:4222 with nats://nats:pmoves@nats:4222 in 35 documentation files: agent system prompts, architecture docs, production audit reports, infrastructure guides, service READMEs, integration checklists, and planning documents. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(catalog): add CHIT services, port 3000 conflict note, health endpoints Add 4 missing services to catalog: Tokenism Simulator (8103), Evo Controller (8113), A2UI NATS Bridge (9224), and Session Context Worker (8100). Document port 3000 conflict between Grafana and Next.js dev server. Add health endpoint quick reference section. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(agents): update protocols, accord, trail, and integration audits Update agent documentation: expand AGENT_TRAIL with session entries, enhance KRISS_KROSS_ACCORD with NATS auth enforcement notes, update AGNOTE4482PHI with CHIT integration status, and refresh Codex parity gaps and submodule integration audit references. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(context): update main CLAUDE.md, planning, and architecture docs Refresh .claude/CLAUDE.md with Cipher Memory service documentation and CHIT-aware services list. Update NEXT_STEPS with completed items and ROADMAP priorities. Fix Flute communication layer doc reference. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(audit): update CHIT status, secrets manifest, and validation reports Expand CHIT integration status with updated service scores and NATS auth enforcement results. Add new entries to secrets manifest for recently documented services. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(docker): Dockerfile hardening, requirements updates, and tooling Harden 8 service Dockerfiles with security best practices. Add session-context-worker Dockerfile. Update requirements for notebook-sync, pdf-ingest, and jellyfin-bridge. Enhance smoke test script, auth alignment checker, flightcheck, and merge_shared_to_tiers tooling. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(submodules): update upstream submodule pointers Update gitlinks for DoX, tensorzero (includes CLAUDE.md expansion), and transcribe-and-fetch to latest upstream commits. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(jellyfin-ai): audio processor and API gateway updates Refactor audio processor with improved error handling and stream processing. Update API gateway routing. Expand jellyfin-ai compose configuration and environment example with new service parameters. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(compose): harden nats-init, fix unhealthy services, remove deprecated version keys - Add cap_drop/read_only/no-new-privileges to nats-init sidecar - Remove duplicate PORT env vars in session-context-worker and github-runner-ctl - Remove duplicate comment in agent-zero service block - Fix model-registry healthcheck: wget -> curl -f (wget not installed in image) - Fix comfy-watcher: flatten nested ${VAR:-${NESTED:-default}} substitution - Remove deprecated version: '3.9' from arm64 and gpu overrides - Add nats-init to HARDENED_SERVICES in test suite Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(channel-monitor): correct fallback database hostname and credentials The Python fallback URL used postgres:5432 (wrong hostname) with non-standard credentials. Align with docker-compose defaults: supabase-db:5432, postgres:postgres user/pass. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(hardening): update tracker to v4.0 and service inventory to v2.0 Hardening tracker v4.0: - Add per-service scorecard (hardened, RW, unhealthy, no-healthcheck) - Document nats-init hardening, compose cleanup, 3 service fixes - Update completion metrics: 44/66 services hardened Service inventory v2.0: - Full 66-service catalog with ports, profiles, healthcheck status - Classify services by hardening tier and network membership Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(security): close stale HiRAG P2#15, add A2UI P2#16 HiRAG env.shared already uses plain KEY=VALUE format — no export prefix found. Mark #15 as FIXED (stale entry). Add P2#16 for A2UI env.tier-ui.sh which also uses export syntax. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
POWERFULMOVES
pushed a commit
that referenced
this pull request
Mar 26, 2026
* chore, cleanup leftovers of tanstack refactoring * refactor: Complete Phase 5 - Remove manual cache invalidations - Removed all manual cache invalidations from knowledge queries - Updated task queries to rely on backend consistency - Fixed optimistic update utilities to handle edge cases - Cleaned up unused imports and test utilities - Fixed minor TypeScript issues in UI components Backend now ensures data consistency through proper transaction handling, eliminating the need for frontend cache coordination. * docs: Enhance TODO comment for knowledge optimistic update issue - Added comprehensive explanation of the query key mismatch issue - Documented current behavior and impact on user experience - Listed potential solutions with tradeoffs - Created detailed PRP story in PRPs/local/ for future implementation - References specific line numbers and implementation details This documents a known limitation where optimistic updates to knowledge items are invisible because mutations update the wrong query cache.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
Testing
Follow-up