fix(security): resolve 25 CodeQL alerts (Tiers 1+2) - #715
Merged
Conversation
9th graphiti-signed trail entry documenting: - All 13 CodeRabbit review fixes applied - integration-gate CI context fix - Squash merge to Integrations + promotion to Hardened - 27 conflict resolution in promotion PR Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fix unauthenticated NATS defaults in Pipecat (5 integration files) and Flute-Gateway (main.py + README.md): nats://nats:4222 → nats://nats:pmoves@nats:4222. Fill all TBD placeholders in Pmoves-hyperdimensions integration template. Add pmoves/docs/PMOVES_SERVICE_TOPOLOGY.md (7-tier architecture map, 4 data flow narratives, full submodule directory). Add pmoves/docs/integrations/INTEGRATION_CHECKLIST.md (9-section onboarding checklist for new submodules). Update INTEGRATIONS.md with cross-references and recently-reviewed submodules section covering BoTZ, DoX, Pipecat, Flute-Gateway, Open-Notebook, and Hyperdimensions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Update BoTZ submodule: gateway auth upgraded from MCP_SERVER_TOKEN to Supabase JWT (unified PMOVES auth). Adds X-CHIT-Attestation Safe Passage header and first agent.graphiti.signed.v1 NATS emission implementation. Append graphiti trail entry documenting NATS auth hardening, unified gateway auth, and agent trail work across this session. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(flute): remove plaintext nats fallback and redact service URL * fix(ci): harden ghcr matrix loading and bootstrap secret flow * docs(parity): align botz auth, topology ports, and graphiti context indexes --------- Co-authored-by: Shaela Bello <slbello@uncg.edu>
…h gate (#704) * feat(preflight): add deterministic submodule branch policy gate * docs(release): add submodule production checklist and deterministic gate flow --------- Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Shaela Bello <slbello@uncg.edu>
Co-authored-by: Shaela Bello <slbello@uncg.edu>
- Fix 4 unhealthy Supabase containers: URL-encode passwords containing '/' in postgres connection strings (POSTGRES_PASSWORD_URLENCODED fallback) - Fix Invidious: auto-generate 16-char hex companion key via secrets hydration - Fix ComfyUI watcher: MinIO credential fallback chain MINIO_ACCESS_KEY→MINIO_ROOT_USER - Fix Kong: entrypoint wrapper for auto-migration bootstrap - Evolve DOCKED_MODE boolean into TopologyMode enum (docked/hybrid/standalone) with backward-compatible auto-detection from EXTERNAL_* + SUPABASE_RUNTIME - Add dynamic port resolution bridging port_allocator + topology context - Add cross-tier auth alignment validator (JWT, NATS, MinIO, URL-safety, placeholders) - Wire credential_urlencoder into secrets-funnel pipeline - Add auth-alignment + ports-resolve Make targets, integrate into preflight gate - Add topology block to mesh agent v2 NATS announcements - 29:29 DOCKED_MODE/TOPOLOGY_MODE parity across all compose services Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
_find_container_env_value() was returning placeholder strings like INVIDIOUS_COMPANION_KEY_HERE from running containers, preventing the secrets.token_hex(8) fallback from generating a real key. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
MINIO_ACCESS_KEY fallback changed from MINIO_ROOT_USER to MINIO_USER and MINIO_SECRET_KEY fallback from MINIO_ROOT_PASSWORD to MINIO_PASSWORD to match the canonical variable names in env.tier-data. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(darkxside): COCREATOR registration + A2UI Remotion + portal + auth Phase 1: DARKXSIDE registered as 8th contributor (✦ glyph, #E11D48, witness voice) Phase 2: A2UI Renderer port 8105, Remotion renderMedia wired, 3 demo specs Phase 3: Hyperdimensions WebRTC portal with prosodic-geometry bridge Phase 4: Creator pipeline — MinIO upload + NATS events after render Phase 5: JWT auth middleware (fail-closed) + CHIT Safe Passage headers Phase 6: KRISS KROSS ACK with CHIT attestation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(governance): Claude ACK for KRISS KROSS rail split handoff - Added rail-split handoff trail entry to AGENT_TRAIL.md - Signed ACK::CLAUDE-OPUS::PHI-4482-T1::KRISS-KROSS-RAIL-SPLIT in AGNOTE4482PHI - Logged claim/review/release for PR #708 creation and PR #707 close-review Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(governance): propose Stash-Safe Rail Split Protocol amendment Formalizes the git stash-pop conflict hazard discovered during KRISS KROSS rail split handoff. Adds proposed amendment to KRISS_KROSS_ACK.md and corresponding graphiti trail entry in AGENT_TRAIL.md. Key invariant: stash base commit must equal branch HEAD at pop time. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(a2ui): align renderer contracts, remotion entrypoint, and skill port * docs(agents): add KRISS KROSS accord to runtime rail for signature parity * docs(agents): add Codex rail-split ACK to integrations lane --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Refresh .claude/CLAUDE.md with Cipher Memory service documentation and CHIT-aware services list. Update NEXT_STEPS with completed items and ROADMAP priorities. Fix Flute communication layer doc reference. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ports Expand CHIT integration status with updated service scores and NATS auth enforcement results. Add new entries to secrets manifest for recently documented services. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Harden 8 service Dockerfiles with security best practices. Add session-context-worker Dockerfile. Update requirements for notebook-sync, pdf-ingest, and jellyfin-bridge. Enhance smoke test script, auth alignment checker, flightcheck, and merge_shared_to_tiers tooling. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Update gitlinks for DoX, tensorzero (includes CLAUDE.md expansion), and transcribe-and-fetch to latest upstream commits. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Refactor audio processor with improved error handling and stream processing. Update API gateway routing. Expand jellyfin-ai compose configuration and environment example with new service parameters. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ated version keys
- Add cap_drop/read_only/no-new-privileges to nats-init sidecar
- Remove duplicate PORT env vars in session-context-worker and github-runner-ctl
- Remove duplicate comment in agent-zero service block
- Fix model-registry healthcheck: wget -> curl -f (wget not installed in image)
- Fix comfy-watcher: flatten nested ${VAR:-${NESTED:-default}} substitution
- Remove deprecated version: '3.9' from arm64 and gpu overrides
- Add nats-init to HARDENED_SERVICES in test suite
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Python fallback URL used postgres:5432 (wrong hostname) with non-standard credentials. Align with docker-compose defaults: supabase-db:5432, postgres:postgres user/pass. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Hardening tracker v4.0: - Add per-service scorecard (hardened, RW, unhealthy, no-healthcheck) - Document nats-init hardening, compose cleanup, 3 service fixes - Update completion metrics: 44/66 services hardened Service inventory v2.0: - Full 66-service catalog with ports, profiles, healthcheck status - Classify services by hardening tier and network membership Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
HiRAG env.shared already uses plain KEY=VALUE format — no export prefix found. Mark #15 as FIXED (stale entry). Add P2#16 for A2UI env.tier-ui.sh which also uses export syntax. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…dened-Integrations # Conflicts: # docs/AGENT_TRAIL.md # pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md # pmoves/docs/AGENTS/KRISS_KROSS_ACCORD.md # pmoves/docs/AGENTS/KRISS_KROSS_ACK.md # pmoves/docs/PMOVES.AI PLANS/ROADMAP.md # pmoves/mk/preflight.mk # pmoves/tools/auth_alignment_check.py
…ath injection - chit.py: Replace bare open() with pathlib resolve + is_relative_to containment check, also fixes file handle leak (CodeQL path-injection) - client.html: Add hex regex validation + encodeURIComponent for shapeId in URL construction (CodeQL DOM XSS via a.href) - serviceHealth.ts: Clamp timeout to [1s, 60s] and move clearTimeout to finally block (CodeQL resource exhaustion) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…-RAG gateways Replace requests.get(url) with urllib3 connection pool that connects directly to the DNS-resolved IP address. This closes the DNS-rebinding TOCTOU gap where an attacker-controlled DNS could return a safe IP during validation but a private IP (e.g., 169.254.169.254) during the actual HTTP request. Changes in both gateway.py (v1) and app.py (v2): - _fetch_remote_image now returns urllib3.HTTPResponse (was requests.Response) - Callers updated: r.content -> r.data, exception types adjusted - Host header set for correct HTTP routing, server_hostname for TLS SNI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Full mask for decoded secret values: show only key names, never partial values (was leaking first 4 chars which can reveal provider prefixes) - Add suppression annotation on diagnostic scan output (intentional tool behavior for credential audit) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…h operations Add inline suppression comments to 18 file-operation sinks across 4 files where CodeQL's static taint analysis cannot model the sanitizers: - yt.py (11): _safe_video_id (basename + _SAFE_VID_RE regex allowlist) - viz.py (4): _SAFE_SHAPE_RE + is_relative_to guard, codebook_path via _load_codebook sanitizer chain - chit.py (1): _load_codebook (basename + _SAFE_FILENAME regex + is_relative_to) - hf-mcp-server/main.py (2): _safe_model_path (basename + _SAFE_MODEL_RE) Each annotation documents the specific sanitizer that protects the sink. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... 📒 Files selected for processing (15)
✏️ Tip: You can disable in-progress messages and the fortune message in your review settings. Tip You can make CodeRabbit's review stricter and more nitpicky using the `assertive` profile, if that's what you prefer.Change the ✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9b0a2ad43c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| resp = requests.get(url, timeout=timeout, allow_redirects=False) | ||
| resp.raise_for_status() | ||
| if 300 <= resp.status_code < 400: | ||
| resolved_ip = addrs[0][4][0] |
There was a problem hiding this comment.
The SSRF-safe fetch path now hard-pins resolved_ip = addrs[0][4][0], so image retrieval fails whenever the first DNS result is unreachable even if another validated public address would work (common with dual-stack AAAA/A records or round-robin DNS). This is a behavioral regression from the previous requests.get flow and can break /geometry/decode/image for valid URLs; iterate through the resolved candidates (or use connection logic that falls back) instead of using only the first entry.
Useful? React with 👍 / 👎.
Comment on lines
+226
to
+227
| const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'a2ui-')); | ||
| const outputFile = path.join(tmpDir, `render.${format}`); |
There was a problem hiding this comment.
/render and /render/chart create temp dirs via fs.mkdtempSync(...) but only delete them on success; if renderMedia, MinIO upload, or a later step throws, the handler returns 500 without removing the directory. Failed retries will accumulate large files in /tmp and can exhaust disk over time, so cleanup should run in a finally block (or equivalent) in both handlers.
Useful? React with 👍 / 👎.
…andling, calibration report Fixes from PR review agents: - Both gateways: close urllib3 ConnectionPool after request (prevents FD leak) - Both gateways: validate r.data is non-empty before Image.open (urllib3 can return None despite bytes annotation) - hi-rag-gateway-v2: add per-URL try/except matching v1 pattern (502 for fetch failures instead of generic 500) - chit.py geometry_calibration_report: migrate bare open() to pathlib write_text with OSError handling (consistent with ingest_cgp fix, safe in read_only containers) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Both geometry_decode_image and geometry_decode_audio had an early return that made the swarm/GAN sidecar branch unreachable. Restructure control flow to match the geometry_search endpoint pattern: check mode first, branch into swarm vs default return. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ShapeStore imports from pmoves.chit.CGP_SPEC_VERSION which fails in Docker containers without the namespace package. Add the proven Agent Zero pattern (mkdir + __init__.py + COPY chit) to both v1 and v2 Dockerfiles. Also widen v1 build context from ./services to . so the chit/ directory is accessible. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Wire the AgentGym RL Coordinator to receive HuggingFace model download notifications so the training pipeline can react to newly available models. Add record_event() to SupabaseStorage as a best-effort event log for downstream analytics. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace per-event connect/publish/close cycle with a persistent NATS connection managed via FastAPI lifespan. Fix NATS_URL default to include auth credentials (nats://nats:pmoves@nats:4222) matching all other PMOVES services. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…check - storage.record_event: logger.debug → logger.warning with exc_info - hf_model_handler: log missing fields, include payload in error context - hf-mcp: time.time() replaces monotonic loop.time() for real timestamps - hf-mcp: /healthz reports NATS status (degraded when disconnected) - hf-mcp: remove credential leak from NATS URL log, log shutdown errors - hf-mcp: add exc_info to publish failure log - hi-rag-v2: add except HTTPException:raise to audio decode (matches image) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- hi-rag-gateway: SSRF-safe fetch now tries all resolved IPs instead of hard-pinning addrs[0], fixing dual-stack AAAA/A and round-robin DNS - a2ui-renderer: hoist tmpDir declaration so catch blocks can clean up orphaned temp directories on renderMedia/upload failures Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…dened-Integrations # Conflicts: # pmoves/services/a2ui-renderer/src/index.ts
Contributor
Docker Hardening ValidationHardening Validation ReportValidated: Thu 26 Feb 2026 05:42:00 PM UTCServices CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
POWERFULMOVES
added a commit
that referenced
this pull request
Feb 27, 2026
* feat: harden topology+CHIT production gate workflow (#712) * feat(preflight): add topology and CHIT sync gate * feat(preflight): expand topology gate to all running containers * feat(preflight): enforce manifest-driven topology policy gate * feat(preflight): scope CHIT gate to policy-defined services * feat(runtime): enforce CHIT production overlays on core services * docs(ops): add topology+CHIT strict gate workflow runbook * chore(chit): sync secrets manifest v1 with v2 source * fix(make): run CHIT manifest targets with project venv * fix(topology-gate): make archon-ui absence non-fatal, align policy networks - archon-ui missing is now a warning (headless deployments via `make up-agents` exclude it intentionally) - archon-ui policy network changed from pmoves_external to pmoves_api to match compose wiring Resolves review comments on PR #712. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * chore: sync 14 submodules to latest PMOVES.AI-Edition-Hardened Updated gitlinks for: A2UI, AgentGym, Archon, BoTZ, Creator, Danger-infra, DoX, Headscale, MAI-UI, n8n, surf, tensorzero, cipher, e2b-mcp-server. Resolves branch/detached-HEAD misalignment after PR #714/#715 merge into main. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: point PMOVES-surf gitlink to PMOVES.AI-Edition-Hardened branch PMOVES-surf was the only submodule (1/40) still pointing to main (135748a) instead of the hardened branch (a27fbb2). The hardened branch includes 3 additional integration dossier commits. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs: add PMOVES.AI integration dossiers to 5 submodules Create PMOVES.AI_INTEGRATION.md for submodules that were missing the required integration dossier, fixing submodule-layer-validate and submodule-docs-audit audit gate failures: - PMOVES-AgentGym (worker: RL training environments) - Pmoves-cipher (agent: dual-layer memory, port 8096) - pmoves-e2b-mcp-server (worker: sandboxed code execution) - PMOVES-Headscale (agent: VPN control plane) - PMOVES-n8n (orchestration: 11 workflow definitions) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: update audit evidence and secrets manifest after post-sync validation Regenerated evidence files from submodule-layer-validate-all-strict (40/40 pass), secrets-funnel sync (99 entries), and tooling audit. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: flatten CHIT_PASSPHRASE compose substitution and document passphrase setup The topology-chit-gate-strict audit gate warned about empty/placeholder CHIT_PASSPHRASE on hi-rag-gateway, hi-rag-gateway-v2, and agent-zero. Root cause: Docker Compose environment: section interpolation uses shell env / --env-file / .env — NOT env_file: loaded values. The nested ${CHIT_PROD_PASSPHRASE:-${JWT_SECRET:-}} never resolved because neither variable was available at compose parse time. Changes: - Flatten all 7 CHIT_PASSPHRASE lines in docker-compose.yml to ${CHIT_PROD_PASSPHRASE:-changeme} (changeme is in the gate's PLACEHOLDER_VALUES set, catching forgotten deployments) - Update env.shared.example with generation command - Document passphrase setup in TOPOLOGY_CHIT_GATE_WORKFLOW.md and ENVIRONMENT_SETUP.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: resolve hi-rag v1 port conflict, add evo-controller Dockerfile, fix build contexts Three compose fixes surfaced during topology gate validation: 1. hi-rag-gateway v1 shared HIRAG_V2_HOST_PORT with v2, causing port collision when set to 8086. Give v1 its own HIRAG_V1_HOST_PORT variable (default 8089). 2. evo-controller had no Dockerfile — create one following the flute-gateway pattern (python:3.11-slim, non-root user, healthcheck). Includes services/common/ for shared env module import. 3. Both evo-controller and flute-gateway used wrong build context (./services/<name> instead of .). Fix to match hi-rag-gateway pattern: context=. with dockerfile=services/<name>/Dockerfile. Also adds both in-tree services to images.yaml for CI builds. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: add FFmpeg/WebRTC build deps to flute-gateway Dockerfile PyAV (av) and aiortc require system build dependencies (gcc, python3-dev, FFmpeg dev headers, libopus, libvpx) to compile from source. Added them to the install layer and a cleanup step that purges build-only deps after pip install to keep the final image slim. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: address PR #716 review comments — multi-stage build, fail-fast secrets, portable paths - Convert flute-gateway Dockerfile to multi-stage build: builder stage compiles PyAV/aiortc wheels, runtime stage installs only shared libs (libavformat61, libavcodec61, etc.) — eliminates --auto-remove risk of purging runtime .so files (Critical fix from CodeRabbit) - Replace CHIT_PASSPHRASE fallback ${:-changeme} with ${:?message} across all 7 compose occurrences so services fail-fast when CHIT_PROD_PASSPHRASE is not set in env.shared - Fix hardcoded Windows paths in 41 evidence JSON files and their generation scripts (submodule_layer_validate.py, runall.py) to use project-relative paths instead of absolute C:\Users\... paths - Add cross-platform (PowerShell) passphrase generation instructions to ENVIRONMENT_SETUP.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: set CHIT_PROD_PASSPHRASE in CI compose validation step The ${:?} fail-fast guard requires CHIT_PROD_PASSPHRASE to be set. CI copies env.shared.example (which has an empty value) so compose config would fail. Add env var and --env-file to the validation step. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs: make env.shared passphrase setup idempotent Replace append-only `printf >>` / `Add-Content` with grep+sed (bash) and Get-Content + -replace (PowerShell) patterns so re-running the snippet updates existing entries instead of duplicating them. Addresses PR #716 CodeRabbit nitpick comment #6. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: add gh auth token fallback to GHCR bootstrap in push-gh-secrets The GHCR bootstrap token resolution now falls back to `gh auth token` when neither GHCR_TOKEN nor GH_PAT_PUBLISH are set, matching the existing username fallback pattern that already uses `gh api user`. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
POWERFULMOVES
added a commit
that referenced
this pull request
Feb 28, 2026
* feat: harden topology+CHIT production gate workflow (#712) * feat(preflight): add topology and CHIT sync gate * feat(preflight): expand topology gate to all running containers * feat(preflight): enforce manifest-driven topology policy gate * feat(preflight): scope CHIT gate to policy-defined services * feat(runtime): enforce CHIT production overlays on core services * docs(ops): add topology+CHIT strict gate workflow runbook * chore(chit): sync secrets manifest v1 with v2 source * fix(make): run CHIT manifest targets with project venv * fix(topology-gate): make archon-ui absence non-fatal, align policy networks - archon-ui missing is now a warning (headless deployments via `make up-agents` exclude it intentionally) - archon-ui policy network changed from pmoves_external to pmoves_api to match compose wiring Resolves review comments on PR #712. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * chore: sync 14 submodules to latest PMOVES.AI-Edition-Hardened Updated gitlinks for: A2UI, AgentGym, Archon, BoTZ, Creator, Danger-infra, DoX, Headscale, MAI-UI, n8n, surf, tensorzero, cipher, e2b-mcp-server. Resolves branch/detached-HEAD misalignment after PR #714/#715 merge into main. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: point PMOVES-surf gitlink to PMOVES.AI-Edition-Hardened branch PMOVES-surf was the only submodule (1/40) still pointing to main (135748a) instead of the hardened branch (a27fbb2). The hardened branch includes 3 additional integration dossier commits. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs: add PMOVES.AI integration dossiers to 5 submodules Create PMOVES.AI_INTEGRATION.md for submodules that were missing the required integration dossier, fixing submodule-layer-validate and submodule-docs-audit audit gate failures: - PMOVES-AgentGym (worker: RL training environments) - Pmoves-cipher (agent: dual-layer memory, port 8096) - pmoves-e2b-mcp-server (worker: sandboxed code execution) - PMOVES-Headscale (agent: VPN control plane) - PMOVES-n8n (orchestration: 11 workflow definitions) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: update audit evidence and secrets manifest after post-sync validation Regenerated evidence files from submodule-layer-validate-all-strict (40/40 pass), secrets-funnel sync (99 entries), and tooling audit. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: flatten CHIT_PASSPHRASE compose substitution and document passphrase setup The topology-chit-gate-strict audit gate warned about empty/placeholder CHIT_PASSPHRASE on hi-rag-gateway, hi-rag-gateway-v2, and agent-zero. Root cause: Docker Compose environment: section interpolation uses shell env / --env-file / .env — NOT env_file: loaded values. The nested ${CHIT_PROD_PASSPHRASE:-${JWT_SECRET:-}} never resolved because neither variable was available at compose parse time. Changes: - Flatten all 7 CHIT_PASSPHRASE lines in docker-compose.yml to ${CHIT_PROD_PASSPHRASE:-changeme} (changeme is in the gate's PLACEHOLDER_VALUES set, catching forgotten deployments) - Update env.shared.example with generation command - Document passphrase setup in TOPOLOGY_CHIT_GATE_WORKFLOW.md and ENVIRONMENT_SETUP.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: resolve hi-rag v1 port conflict, add evo-controller Dockerfile, fix build contexts Three compose fixes surfaced during topology gate validation: 1. hi-rag-gateway v1 shared HIRAG_V2_HOST_PORT with v2, causing port collision when set to 8086. Give v1 its own HIRAG_V1_HOST_PORT variable (default 8089). 2. evo-controller had no Dockerfile — create one following the flute-gateway pattern (python:3.11-slim, non-root user, healthcheck). Includes services/common/ for shared env module import. 3. Both evo-controller and flute-gateway used wrong build context (./services/<name> instead of .). Fix to match hi-rag-gateway pattern: context=. with dockerfile=services/<name>/Dockerfile. Also adds both in-tree services to images.yaml for CI builds. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: add FFmpeg/WebRTC build deps to flute-gateway Dockerfile PyAV (av) and aiortc require system build dependencies (gcc, python3-dev, FFmpeg dev headers, libopus, libvpx) to compile from source. Added them to the install layer and a cleanup step that purges build-only deps after pip install to keep the final image slim. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: address PR #716 review comments — multi-stage build, fail-fast secrets, portable paths - Convert flute-gateway Dockerfile to multi-stage build: builder stage compiles PyAV/aiortc wheels, runtime stage installs only shared libs (libavformat61, libavcodec61, etc.) — eliminates --auto-remove risk of purging runtime .so files (Critical fix from CodeRabbit) - Replace CHIT_PASSPHRASE fallback ${:-changeme} with ${:?message} across all 7 compose occurrences so services fail-fast when CHIT_PROD_PASSPHRASE is not set in env.shared - Fix hardcoded Windows paths in 41 evidence JSON files and their generation scripts (submodule_layer_validate.py, runall.py) to use project-relative paths instead of absolute C:\Users\... paths - Add cross-platform (PowerShell) passphrase generation instructions to ENVIRONMENT_SETUP.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: set CHIT_PROD_PASSPHRASE in CI compose validation step The ${:?} fail-fast guard requires CHIT_PROD_PASSPHRASE to be set. CI copies env.shared.example (which has an empty value) so compose config would fail. Add env var and --env-file to the validation step. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs: make env.shared passphrase setup idempotent Replace append-only `printf >>` / `Add-Content` with grep+sed (bash) and Get-Content + -replace (PowerShell) patterns so re-running the snippet updates existing entries instead of duplicating them. Addresses PR #716 CodeRabbit nitpick comment #6. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: add gh auth token fallback to GHCR bootstrap in push-gh-secrets The GHCR bootstrap token resolution now falls back to `gh auth token` when neither GHCR_TOKEN nor GH_PAT_PUBLISH are set, matching the existing username fallback pattern that already uses `gh api user`. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: migrate GHCR auth to GitHub App tokens with PAT+workflow fallback All 4 GHCR-pushing workflows now generate short-lived installation tokens via actions/create-github-app-token using the PMOVES.AI GitHub App (GH_APP_ID + GH_APP_SEC secrets). Each workflow falls back to PAT-based auth then workflow token if the App token is unavailable. integrations-ghcr.yml uses explicit three-tier login steps with a hard-fail guard; the simpler workflows use inline ternary expressions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): remove secrets context from step-level if conditions GitHub Actions does not allow secrets.* in step if: expressions. Remove the guard and rely on continue-on-error: true — if secrets are missing the action fails gracefully, outputs stay empty, and the fallback chain (PAT → workflow token) activates. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(mcp): resolve cipher MCP stdout pollution corrupting stdio transport On Windows, `uv run` activates the venv by sourcing Activate.Ps1 which echoes to stdout, corrupting the MCP JSON-RPC stream. Switch to invoking the venv python directly to bypass activation entirely. Also fix a secondary stdout leak in the NATS announcer (print→stderr), reduce client timeout from 30s→5s, and add health-check + graceful fallback to all cipher slash commands so Docker-offline sessions degrade to local auto-memory instead of hanging. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(mcp): remove unnecessary cwd and PYTHONPATH from cipher MCP config The venv python resolves its own site-packages via .pth files from the editable install — PYTHONPATH is redundant. cwd is also unnecessary since the venv interpreter does not depend on working directory for package resolution. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(mcp): switch cipher MCP from stdio Python bridge to container SSE The local Python subprocess (pmoves-cipher-mcp) caused recurring Activate.ps1 stdout pollution on Windows, corrupting the MCP stdio transport. The cipher-api container already supports SSE natively via @modelcontextprotocol/sdk — enable it and point Claude Code directly at the container's /sse endpoint, eliminating the local bridge entirely. - Enable --mcp-transport-type sse on cipher-api container command - Replace stdio/python MCP config with SSE direct to localhost:8096/sse - No local process, no venv, no Activate.ps1, no stdout corruption Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: address PR #719 review comments - Replace sed -i with portable awk+mv for macOS compatibility - Use cryptographic RNG for PowerShell passphrase generation (URL-safe base64) - Update CHIT docs to match actual compose :? (required) syntax - Add _repo_relative_or_posix() helper to handle paths outside repo root - Normalize absolute Windows path in validation evidence JSON - Add traceback.print_exc() for better announcer error diagnostics Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
POWERFULMOVES
pushed a commit
that referenced
this pull request
Feb 28, 2026
…02-28 Update all three audit tracking documents with live API-verified data: - Dashboard: 43 CodeQL alerts (35 error, 8 warning), 7 Dependabot (5H, 2L), 1 open PR (#717). Added Recent Merge Activity for 7 PRs (#712-719). CodeQL Groups A-E marked FIXED (PR #715), Group H added for new alerts. - Hardening tracker: Dependabot High marked REGRESSION (5 new alerts), CodeQL footnoted for expanded scope. Added Recent Activity section. - Merge tracker: PRs #577-581 all CLOSED, Archon #6 CLOSED, DoX #92 MERGED. Updated Quick Status with live counts. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves 25 CodeQL alerts across Tiers 1 (critical SSRF) and 2 (high path-injection, XSS, resource exhaustion, clear-text logging). All affected files are in the main repo (not submodules).
Alert breakdown by fix type:
Commits
fix(security): real fixes for XSS, resource exhaustion, and chit.py path injectionfix(security): eliminate SSRF TOCTOU via urllib3 direct-connectfix(security): mask credentials in chit_credential_demo.pychore(security): add CodeQL suppression annotationsFiles Changed (9)
gateway/api/chit.pyopen(f"data/{shape_id}.json")) + 1 annotationgateway/web/client.htmlencodeURIComponentfor shapeId in URLsui/lib/serviceHealth.ts[1s, 60s]+finallyforclearTimeouthi-rag-gateway/gateway.pyhi-rag-gateway-v2/app.pychit_credential_demo.py****) instead of partial (sk-1****) + 1 suppressionpmoves-yt/yt.py_safe_video_id()sanitizergateway/api/viz.py_SAFE_SHAPE_RE+is_relative_to()hf-mcp-server/main.py_safe_model_path()Test plan
_fetch_remote_imagein both gateways still returns image data correctly (urllib3.datavs requests.content)chit_credential_demo.py --helpruns without crashgrep -c "CodeQL path-injection" pmoves/services/pmoves-yt/yt.pyreturns 11grep -c "CodeQL" pmoves/services/gateway/gateway/api/viz.pyreturns 4🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Bug Fixes
Security