feat(darkxside): A2UI Remotion renderer + WebRTC portal + auth - #708
POWERFULMOVES merged 7 commits into
Conversation
Phase 1: DARKXSIDE registered as 8th contributor (✦ glyph, #E11D48, witness voice) Phase 2: A2UI Renderer port 8105, Remotion renderMedia wired, 3 demo specs Phase 3: Hyperdimensions WebRTC portal with prosodic-geometry bridge Phase 4: Creator pipeline — MinIO upload + NATS events after render Phase 5: JWT auth middleware (fail-closed) + CHIT Safe Passage headers Phase 6: KRISS KROSS ACK with CHIT attestation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Formalizes the git stash-pop conflict hazard discovered during KRISS KROSS rail split handoff. Adds proposed amendment to KRISS_KROSS_ACK.md and corresponding graphiti trail entry in AGENT_TRAIL.md. Key invariant: stash base commit must equal branch HEAD at pop time. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
■ Codex — PR #708 Contract + Runtime Hardening
|
Docker Hardening ValidationHardening Validation ReportValidated: Tue 24 Feb 2026 11:23:30 PM UTCServices CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
9851986
into
PMOVES.AI-Edition-Hardened-Integrations
Docker Hardening ValidationHardening Validation ReportValidated: Wed 25 Feb 2026 06:55:49 AM UTCServices CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
…713) * docs(trail): add entry for PR #694 review remediation + branch promotion 9th graphiti-signed trail entry documenting: - All 13 CodeRabbit review fixes applied - integration-gate CI context fix - Squash merge to Integrations + promotion to Hardened - 27 conflict resolution in promotion PR Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(ci): add GHCR bootstrap and local-first supaserch gates * docs(ops): codify Dock.Tier Git.Flare parity lane and handoff trail * fix(ci): honor GHCR integration selector for workflow dispatch * fix(ci): skip non-selected GHCR matrix lanes on dispatch * fix(ci): resolve GHCR matrix from config for true targeted dispatch * chore(ops): make GHCR bootstrap lane org-aware by default * fix(ci): resolve GHCR matrix by names to avoid output masking * docs(ci): record GHCR matrix resolver source-of-truth flow * fix(ci): use python3 fallback for integration config step * fix(ci): prefer GHCR PAT auth before workflow token * docs(ci): note PAT-first GHCR auth for 403 mitigation * feat(ci): add GHCR namespace override for targeted dispatch * docs(ops): document GHCR namespace override for org routing * fix(auth): NATS credential hardening + service topology docs Fix unauthenticated NATS defaults in Pipecat (5 integration files) and Flute-Gateway (main.py + README.md): nats://nats:4222 → nats://nats:pmoves@nats:4222. Fill all TBD placeholders in Pmoves-hyperdimensions integration template. Add pmoves/docs/PMOVES_SERVICE_TOPOLOGY.md (7-tier architecture map, 4 data flow narratives, full submodule directory). Add pmoves/docs/integrations/INTEGRATION_CHECKLIST.md (9-section onboarding checklist for new submodules). Update INTEGRATIONS.md with cross-references and recently-reviewed submodules section covering BoTZ, DoX, Pipecat, Flute-Gateway, Open-Notebook, and Hyperdimensions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(auth): BoTZ gateway unified JWT + CHIT attestation + agent trails Update BoTZ submodule: gateway auth upgraded from MCP_SERVER_TOKEN to Supabase JWT (unified PMOVES auth). Adds X-CHIT-Attestation Safe Passage header and first agent.graphiti.signed.v1 NATS emission implementation. Append graphiti trail entry documenting NATS auth hardening, unified gateway auth, and agent trail work across this session. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(parity): resolve PR699 review threads and CI hardening gaps (#703) * fix(flute): remove plaintext nats fallback and redact service URL * fix(ci): harden ghcr matrix loading and bootstrap secret flow * docs(parity): align botz auth, topology ports, and graphiti context indexes --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> * feat(release): deterministic submodule production checklist and branch gate (#704) * feat(preflight): add deterministic submodule branch policy gate * docs(release): add submodule production checklist and deterministic gate flow --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> * fix(jellyfin): align prod topology and yt metadata path (#700) Co-authored-by: Shaela Bello <slbello@uncg.edu> * feat(jellyfin): add prod stack verify and parity audit targets (#701) Co-authored-by: Shaela Bello <slbello@uncg.edu> * docs(creator): update roadmap, handoff trail, and audit runbook (#702) Co-authored-by: Shaela Bello <slbello@uncg.edu> * feat(topology): topology-aware service recovery + auth alignment - Fix 4 unhealthy Supabase containers: URL-encode passwords containing '/' in postgres connection strings (POSTGRES_PASSWORD_URLENCODED fallback) - Fix Invidious: auto-generate 16-char hex companion key via secrets hydration - Fix ComfyUI watcher: MinIO credential fallback chain MINIO_ACCESS_KEY→MINIO_ROOT_USER - Fix Kong: entrypoint wrapper for auto-migration bootstrap - Evolve DOCKED_MODE boolean into TopologyMode enum (docked/hybrid/standalone) with backward-compatible auto-detection from EXTERNAL_* + SUPABASE_RUNTIME - Add dynamic port resolution bridging port_allocator + topology context - Add cross-tier auth alignment validator (JWT, NATS, MinIO, URL-safety, placeholders) - Wire credential_urlencoder into secrets-funnel pipeline - Add auth-alignment + ports-resolve Make targets, integrate into preflight gate - Add topology block to mesh agent v2 NATS announcements - 29:29 DOCKED_MODE/TOPOLOGY_MODE parity across all compose services Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(hydrate): filter placeholder values from container env inspection _find_container_env_value() was returning placeholder strings like INVIDIOUS_COMPANION_KEY_HERE from running containers, preventing the secrets.token_hex(8) fallback from generating a real key. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): isolate hyphenated service pytest conftests in python-tests * fix(ci): scope python-tests workflow to service test suites * fix(pytest): use explicit pmoves.tests fixture bridge import * fix(compose): align comfy-watcher MinIO credential variables MINIO_ACCESS_KEY fallback changed from MINIO_ROOT_USER to MINIO_USER and MINIO_SECRET_KEY fallback from MINIO_ROOT_PASSWORD to MINIO_PASSWORD to match the canonical variable names in env.tier-data. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(darkxside): A2UI Remotion renderer + WebRTC portal + auth (#708) * feat(darkxside): COCREATOR registration + A2UI Remotion + portal + auth Phase 1: DARKXSIDE registered as 8th contributor (✦ glyph, #E11D48, witness voice) Phase 2: A2UI Renderer port 8105, Remotion renderMedia wired, 3 demo specs Phase 3: Hyperdimensions WebRTC portal with prosodic-geometry bridge Phase 4: Creator pipeline — MinIO upload + NATS events after render Phase 5: JWT auth middleware (fail-closed) + CHIT Safe Passage headers Phase 6: KRISS KROSS ACK with CHIT attestation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(governance): Claude ACK for KRISS KROSS rail split handoff - Added rail-split handoff trail entry to AGENT_TRAIL.md - Signed ACK::CLAUDE-OPUS::PHI-4482-T1::KRISS-KROSS-RAIL-SPLIT in AGNOTE4482PHI - Logged claim/review/release for PR #708 creation and PR #707 close-review Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(governance): propose Stash-Safe Rail Split Protocol amendment Formalizes the git stash-pop conflict hazard discovered during KRISS KROSS rail split handoff. Adds proposed amendment to KRISS_KROSS_ACK.md and corresponding graphiti trail entry in AGENT_TRAIL.md. Key invariant: stash base commit must equal branch HEAD at pop time. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(a2ui): align renderer contracts, remotion entrypoint, and skill port * docs(agents): add KRISS KROSS accord to runtime rail for signature parity * docs(agents): add Codex rail-split ACK to integrations lane --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * chore(env): enforce uv-first pmoves venv bootstrap * feat(preflight): add topology and CHIT sync gate * feat(preflight): expand topology gate to all running containers * feat(preflight): enforce manifest-driven topology policy gate * feat(preflight): scope CHIT gate to policy-defined services * feat(runtime): enforce CHIT production overlays on core services * docs(ops): add topology+CHIT strict gate workflow runbook * fix(make): run CHIT manifest targets with project venv * security(nats): enforce authenticated NATS URLs across all services Replace all 48 occurrences of unauthenticated nats://nats:4222 with nats://nats:pmoves@nats:4222 in service code, compose files, Dockerfiles, shell scripts, terraform, and UI components. Preserves test_nats_authentication.py negative assertion unchanged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * security(nats): update NATS auth in documentation and agent prompts Replace unauthenticated nats://nats:4222 with nats://nats:pmoves@nats:4222 in 35 documentation files: agent system prompts, architecture docs, production audit reports, infrastructure guides, service READMEs, integration checklists, and planning documents. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(catalog): add CHIT services, port 3000 conflict note, health endpoints Add 4 missing services to catalog: Tokenism Simulator (8103), Evo Controller (8113), A2UI NATS Bridge (9224), and Session Context Worker (8100). Document port 3000 conflict between Grafana and Next.js dev server. Add health endpoint quick reference section. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(agents): update protocols, accord, trail, and integration audits Update agent documentation: expand AGENT_TRAIL with session entries, enhance KRISS_KROSS_ACCORD with NATS auth enforcement notes, update AGNOTE4482PHI with CHIT integration status, and refresh Codex parity gaps and submodule integration audit references. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(context): update main CLAUDE.md, planning, and architecture docs Refresh .claude/CLAUDE.md with Cipher Memory service documentation and CHIT-aware services list. Update NEXT_STEPS with completed items and ROADMAP priorities. Fix Flute communication layer doc reference. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(audit): update CHIT status, secrets manifest, and validation reports Expand CHIT integration status with updated service scores and NATS auth enforcement results. Add new entries to secrets manifest for recently documented services. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(docker): Dockerfile hardening, requirements updates, and tooling Harden 8 service Dockerfiles with security best practices. Add session-context-worker Dockerfile. Update requirements for notebook-sync, pdf-ingest, and jellyfin-bridge. Enhance smoke test script, auth alignment checker, flightcheck, and merge_shared_to_tiers tooling. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(submodules): update upstream submodule pointers Update gitlinks for DoX, tensorzero (includes CLAUDE.md expansion), and transcribe-and-fetch to latest upstream commits. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(jellyfin-ai): audio processor and API gateway updates Refactor audio processor with improved error handling and stream processing. Update API gateway routing. Expand jellyfin-ai compose configuration and environment example with new service parameters. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(compose): harden nats-init, fix unhealthy services, remove deprecated version keys - Add cap_drop/read_only/no-new-privileges to nats-init sidecar - Remove duplicate PORT env vars in session-context-worker and github-runner-ctl - Remove duplicate comment in agent-zero service block - Fix model-registry healthcheck: wget -> curl -f (wget not installed in image) - Fix comfy-watcher: flatten nested ${VAR:-${NESTED:-default}} substitution - Remove deprecated version: '3.9' from arm64 and gpu overrides - Add nats-init to HARDENED_SERVICES in test suite Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(channel-monitor): correct fallback database hostname and credentials The Python fallback URL used postgres:5432 (wrong hostname) with non-standard credentials. Align with docker-compose defaults: supabase-db:5432, postgres:postgres user/pass. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(hardening): update tracker to v4.0 and service inventory to v2.0 Hardening tracker v4.0: - Add per-service scorecard (hardened, RW, unhealthy, no-healthcheck) - Document nats-init hardening, compose cleanup, 3 service fixes - Update completion metrics: 44/66 services hardened Service inventory v2.0: - Full 66-service catalog with ports, profiles, healthcheck status - Classify services by hardening tier and network membership Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(security): close stale HiRAG P2#15, add A2UI P2#16 HiRAG env.shared already uses plain KEY=VALUE format — no export prefix found. Mark #15 as FIXED (stale entry). Add P2#16 for A2UI env.tier-ui.sh which also uses export syntax. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…708) * docs: Update AI documentation for accurate codebase reflection - Replace obsolete POLLING_ARCHITECTURE.md with DATA_FETCHING_ARCHITECTURE.md - Rewrite API_NAMING_CONVENTIONS.md with file references instead of code examples - Condense ARCHITECTURE.md from 482 to 195 lines for clarity - Update ETAG_IMPLEMENTATION.md to reflect actual implementation - Update QUERY_PATTERNS.md to reflect completed Phase 5 (nanoid optimistic updates) - Add PRPs/stories/ to .gitignore All documentation now references actual files in codebase rather than embedding potentially stale code examples. * docs: Update CLAUDE.md and AGENTS.md with current patterns - Update CLAUDE.md to reference documentation files instead of embedding code - Replace Service Layer and Error Handling code examples with file references - Add proper distinction between DATA_FETCHING_ARCHITECTURE and QUERY_PATTERNS docs - Include ETag implementation reference - Update environment variables section with .env.example reference * docs: apply PR review improvements to AI documentation - Fix punctuation, hyphenation, and grammar issues across all docs - Add language tags to directory tree code blocks for proper markdown linting - Clarify TanStack Query integration (not replacing polling, but integrating it) - Add Cache-Control header documentation and browser vs non-browser fetch behavior - Reference actual implementation files for polling intervals instead of hardcoding values - Improve type-safety phrasing and remove line numbers from file references - Clarify Phase 1 removed manual frontend ETag cache (backend ETags remain)
2 participants
Summary
src/remotion/A2UIComposition.tsx+DarkxsidePortal.tsx, 3 demo compositionsPmoves-hyperdimensionssubmodule bump (eca5305) bringing portal architecture for real-time agent visualizationDARKXSIDE_SIGNATURE.md(CHIT CGP attestation + ASCII sigil) +KRISS_KROSS_ACK.md(accord witness attestation)agent_signatures.yamlwith DARKXSIDE entity +signature.v1.schema.jsonupdatesnats://nats:pmoves@nats:4222(authenticated)KRISS KROSS Rail Strategy
This PR follows the KRISS KROSS Accord rail split:
feat/darkxside-a2ui-runtime→Integrations— runtime payload (A2UI, portal, auth)docs/kriss-kross-dao-phase→Hardened— docs/signature scope onlyRail split performed by CODEX at commit
b3ffd1aaper AGNOTE4482PHI.t1 governance.Runtime Evidence
{{port}}allocation)verify_token()raises on missing secret)nats://nats:pmoves@nats:4222cap_drop: ALL,read_only: true, non-root USERdemos/Files Changed (57 files, +932/-1852)
New runtime:
pmoves/services/a2ui-renderer/src/remotion/A2UIComposition.tsxpmoves/services/a2ui-renderer/src/remotion/DarkxsidePortal.tsxpmoves/services/a2ui-renderer/src/remotion/index.tspmoves/services/a2ui-renderer/demos/*.json(3 files)pmoves/services/a2ui-renderer/src/index.ts(expanded)Governance:
pmoves/docs/AGENTS/DARKXSIDE_SIGNATURE.mdpmoves/docs/AGENTS/KRISS_KROSS_ACK.mdpmoves/config/agent_signatures.yamldocs/AGENT_TRAIL.mdCleanup (removed):
pmoves/tools/jellyfin_creator_parity_audit.pypmoves/tools/jellyfin_verify.pypmoves/tools/yt_jellyfin_smoke.pypmoves/tools/submodule_branch_policy_check.pypmoves/scripts/codex_parity_check.pyTest plan
docker build pmoves/services/a2ui-renderergrep -r 'password\|secret' --include='*.ts' pmoves/services/a2ui-renderer/)Pmoves-hyperdimensionsresolves toeca5305🤖 Generated with Claude Code