docs(agents): comprehensive AGENTS directory review and cross-reference fixes - #742
Merged
Merged
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review infoConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (10)
📝 WalkthroughWalkthroughConfiguration and documentation updates standardize per-agent NATS and CHIT toggle settings across utility agents in the registry, add GPU port routing for Hi-RAG v2, and introduce comprehensive documentation for agent system topology, resilience patterns, gap analysis, and persona seeds. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 12
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
pmoves/docs/AGENTS/IMPLEMENTATION_GAP_ANALYSIS.md (1)
117-118:⚠️ Potential issue | 🟠 MajorReconcile conflicting SKILL.md implementation status.
Line 117 says standardized SKILL.md pivots are missing, but Line 310 states the template/marketplace is operational. Keep one source of truth here.
Proposed direction (example)
-**Gap:** Current tool structure uses `instruments/` directory without standardized SKILL.md pivot files. +**Status: ⚠️ Partially implemented.** SKILL.md template exists, but migration from `instruments/` to standardized skill pivots is incomplete across services.As per coding guidelines, "Keep status claims aligned with evidence in runbooks and smokes."
Also applies to: 306-311
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/AGENTS/IMPLEMENTATION_GAP_ANALYSIS.md` around lines 117 - 118, There are conflicting status claims about SKILL.md pivots: one sentence says standardized SKILL.md pivots are missing for the instruments/ directory while another says the template/marketplace is operational; pick the correct current truth (either “standardized SKILL.md pivots are present and marketplace operational” or “pivots missing and marketplace not ready”), then update both occurrences that reference SKILL.md/instruments/ and the template/marketplace statements so they match: edit the phrase mentioning “instruments/ directory” and the sentence that refers to the “template/marketplace” (and any nearby summary like “standardized SKILL.md pivots” or “operational”) to the chosen single status, and add a short evidence note pointing to the runbook or smoke test that substantiates the claim (e.g., reference the runbook or smoke name), ensuring SKILL.md and template/marketplace wording are consistent across the document.pmoves/docs/AGENTS/PERSONAS.md (1)
478-492:⚠️ Potential issue | 🟠 MajorAdd persona NATS subjects to canonical
.claude/context/nats-subjects.md.The persona subjects introduced at lines 481–490 in PERSONAS.md (
persona.created.v1,persona.updated.v1,persona.activated.v1,persona.attributed.v1) are not documented in the canonical NATS subjects catalog. Per coding guidelines, NATS event topology must be maintained in.claude/context/nats-subjects.md.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/AGENTS/PERSONAS.md` around lines 478 - 492, The PERSONAS.md file introduces four new NATS subjects (persona.created.v1, persona.updated.v1, persona.activated.v1, persona.attributed.v1) but they are missing from the canonical NATS subjects document; update the canonical NATS subjects catalog to include entries for these four subjects with their payload shapes (e.g., persona_id, slug, category; changes; agent_id; persona_ids[], weights[], cgp_packet_id) so the central topology is authoritative and matches the symbols defined in PERSONAS.md.
🧹 Nitpick comments (4)
pmoves/tools/model_readiness_check.py (3)
119-123: Hardcoded model preferences may require maintenance.The expected model preferences (
claude-sonnet-4-5,claude-opus-4-5,claude-haiku-4-5) are hardcoded. Consider extracting these to a constant or making them configurable via CLI/env if the model names evolve frequently.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/tools/model_readiness_check.py` around lines 119 - 123, Extract the hardcoded set assigned to expected into a single source of truth (e.g., a top-level constant like PERSONA_MODEL_PREFERENCES or a configurable CLI/env variable) and update the check in model_readiness_check.py to reference that symbol instead of the inline set; update any relevant docstring or help text to explain how to change the list and keep the call to self._check("Persona model preferences valid", ...) and the missing calculation (missing = expected - models) unchanged so behavior stays the same while model names become maintainable/configurable.
30-37: Consider validating URL schemes for security.Ruff S310 flags that
urllib.request.urlopenaccepts arbitrary URL schemes includingfile://. While this is a local development/CI tool with low risk, consider adding scheme validation if this tool might run in less trusted environments.🔒 Optional: Add URL scheme validation
def http_get(url: str, timeout: int = 10) -> dict | None: """GET request returning parsed JSON or None on failure.""" try: + if not url.startswith(("http://", "https://")): + return None req = urllib.request.Request(url, headers={"Accept": "application/json"}) with urllib.request.urlopen(req, timeout=timeout) as resp: return json.loads(resp.read().decode())🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/tools/model_readiness_check.py` around lines 30 - 37, The http_get function accepts arbitrary URL schemes (e.g., file://) which is unsafe; before building the Request or calling urllib.request.urlopen, parse the url with urllib.parse.urlparse and validate that parsed.scheme is either "http" or "https" (if not, return None or raise a controlled error), then proceed as before; update http_get to perform this scheme check (using urllib.parse.urlparse) to reject non-http(s) schemes safely.
137-144: Critical models list is hardcoded.Similar to model preferences, the critical Ollama models list (
qwen3,nomic-embed-text) is hardcoded. This is acceptable for a readiness check but may need updates as the model registry evolves.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/tools/model_readiness_check.py` around lines 137 - 144, The critical models list is hardcoded as critical = ["qwen3", "nomic-embed-text"]; change this to a configurable source so the list can be updated without changing code — e.g., read from an existing model preferences/config (or a new constant like CRITICAL_MODELS) and use that variable in the loop that checks pulled; update references in model_readiness_check.py where critical is used (the loop that calls self._warn and self._check, and the pulled variable) so the check uses the configurable list instead of the literal array.pmoves/docs/AGENTS/IMPLEMENTATION_GAP_ANALYSIS.md (1)
176-197: Move implemented items out of “Critical Gaps” section.This subsection now contains mostly completed status plus portability follow-ups. Consider splitting into “Resolved” and “Remaining” to reduce triage noise.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/AGENTS/IMPLEMENTATION_GAP_ANALYSIS.md` around lines 176 - 197, The "Damage Control / Security Hooks" subsection currently mixes implemented and remaining items; split it into two subsections "Resolved" and "Remaining" so completed work is not listed as a critical gap. Under "Resolved" move the bullets for security/patterns.yaml deployment, deterministic hooks (.env* blocking with template ask pattern), Known Roads Docker redirection (.claude/CLAUDE.md), adversarial instruction detection (pre-execution GAN defense), and the template path behavior (`check_path()` returns `(blocked, reason, is_template)`). Under "Remaining" keep "Portability" (hooks don't apply in submodule worktrees / Known Limitation in AGENT_RESILIENCE_PATTERNS.md) and the not-implemented items (probabilistic LLM safety / Haiku model integration and prompt scan hooks like `security/hooks/prompt_scan.py`). Ensure headings use consistent status markers (✅/❌) and update the subsection title originally labeled "Damage Control / Security Hooks."
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docs/AGENT_TRAIL.md`:
- Around line 13-40: The TAC entry uses a generic graphiti:{agent} block instead
of the required machine-parseable graphiti:tac format; update the block to the
graphiti:tac template and include the required TAC metadata keys (lane, branch,
status, owner, reviewer) so tooling can parse it, and ensure the same template
is used for other related docs referenced (symbols: graphiti:tac,
pmoves/docs/TAC/TAC_MODEL_INFRA_PERSONA_PROD_READINESS.md,
pmoves/docs/AGENTS/AI_GRAPHITI_PROTOCOL.md,
pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md); keep the content intact but move the
TAC-specific fields into the graphiti:tac header following the project's TAC
block template and validate with the Graphiti protocol parser.
In `@pmoves/config/agent_registry.yaml`:
- Around line 213-214: The Mermaid topology diagram entry for Hi-RAG v2 needs
updating to show both CPU and GPU ports; replace the existing node that only
lists :8086 with a node that includes both ports, e.g. hirag_v2["Hi-RAG
v2<br/>:8086, :8087"], so the diagram matches the agent_registry.yaml entries
(port: 8086 and gpu_port: 8087); locate the Hi-RAG v2 node in
PMOVES_AGENT_TOPOLOGY.md and update the label accordingly.
In `@pmoves/docs/AGENTS/PERSONAS.md`:
- Around line 3-6: The document's "Status" line claims "Architecture Definition
+ 8 Production Seeds Deployed" while the Phase-1 checklist remains unchecked;
update the roadmap/checklist so both are consistent by either marking Phase-1
items as completed or changing the Status to reflect "Phase-1 incomplete", and
mirror the same change in the other occurrence referenced near the Phase-1 block
(the duplicate section around the Phase-1 checklist lines). Locate the header
symbols "Version", "Last Updated", "Status", "Seed SQL" and the Phase-1
checklist block (and its duplicate) and make the status and checkboxes match
exactly (e.g., check the Phase-1 box(s) if seeds truly deployed or downgrade the
Status line to "Pending Phase-1").
- Around line 245-298: The fenced blocks showing persona configs (the block
beginning with "-- From 17_persona_seed.sql" and persona examples like name:
'Developer', name: 'Researcher', etc.) are incorrectly fenced as sql; change
those fences to ```yaml to match pseudo-config content, and change the unlabeled
inheritance example block that begins with "Coordinator (parent)" to ```text (or
another appropriate language) so rendering/linting and copy-paste are correct;
apply the same fence language fixes to the other persona/example blocks (the
unlabeled inheritance example and any similar blocks later in the file).
In `@pmoves/docs/AGENTS/README.md`:
- Around line 139-150: The section header "Known Gaps (P0-P1)" is inconsistent
with rows that include P2 items; update the section title or relocate the P2
rows so priorities match: either rename the header to "Known Gaps (P0-P2)" or
move the P2 table rows (the entries referencing `bpm_encoder.py` and
`OBSERVABILITY_MAP.md`) into a separate "P2" subsection. Ensure the title text
"Known Gaps (P0-P1)" in the README is changed to the chosen corrected header and
that the table rows remain accurate under the new heading.
- Around line 4-5: The README header "Files: 69+ documents across 7 tiers" is
inconsistent with the tier breakdown; recount the actual documents referenced by
the tier lists and update the "Files:" line to the accurate total (or a correct
minimum like "70+" if appropriate), and ensure the "Registry:" agent count in
`pmoves/config/agent_registry.yaml` (taxonomy v1.4.0) matches that total where
applicable; modify the "Files:" header in AGENTS/README.md to reflect the
reconciled number and run a quick scan of the other affected files (notably docs
20-103) to correct any other mismatched status claims so the header aligns with
the evidence in the runbooks and smokes.
In `@pmoves/docs/TAC/TAC_MODEL_INFRA_PERSONA_PROD_READINESS.md`:
- Around line 59-61: Update the documentation entry that references the
migration filename
`pmoves/supabase/migrations/20260301_persona_model_resolution.sql` so it matches
the actual timestamped migration file that was added (or alternatively add the
missing migration file with that exact name); ensure the doc still mentions
creation of the view `pmoves_core.persona_model_resolution` and that the
migration filename in the docs and the migrations directory are identical.
In `@pmoves/supabase/initdb/12_model_registry_seed.sql`:
- Around line 667-717: The seed uses invalid Anthropic model_id values; update
the VALUES for the three INSERTs that set model_id ('claude-sonnet-4-5',
'claude-opus-4-5', 'claude-haiku-4-5') for provider v_anthropic_id to currently
supported Anthropic model IDs (e.g. replace with 'claude-3-5-sonnet-latest' or
'claude-sonnet-4-20250514' for Sonnet, 'claude-opus-4-1' or
'claude-opus-4-20250514' for Opus, and 'claude-3-5-haiku-latest' or
'claude-3-5-haiku-20241022' for Haiku), ensuring the model_id values inserted
into pmoves_core.models match Anthropic's API and your key's accessible models.
In `@pmoves/supabase/initdb/17_persona_seed.sql`:
- Around line 162-166: The DO UPDATE clause only refreshes a subset of columns
so seeded rows stay stale; update the DO UPDATE in this INSERT ... ON CONFLICT
block to include all mutable persona fields (e.g. thread_id =
EXCLUDED.thread_id, model = EXCLUDED.model, token_limit = EXCLUDED.token_limit,
filters = EXCLUDED.filters, nats_subject = EXCLUDED.nats_subject, plus the
existing description, system_prompt_template, tools_access, behavior_weights and
updated_at = NOW()) so any changes in seeds converge on re-run, and apply the
same expanded DO UPDATE change to the other upsert blocks identified (the
similar INSERT ... ON CONFLICT statements at the other mentioned locations).
- Around line 31-33: Update the comment that currently says "uuid-ossp already
enabled by 00_pmoves_schema.sql" to reference pgcrypto instead, because the SQL
uses gen_random_uuid(); locate the comment near the persona seed block where
gen_random_uuid() is used (look for gen_random_uuid() calls and the existing
comment line) and change it to "-- pgcrypto already enabled by
00_pmoves_schema.sql".
In `@pmoves/supabase/migrations/20260301002000_persona_model_resolution.sql`:
- Around line 35-39: The JOIN between personas (p) and models (m) is ambiguous
because m.model_id can be duplicated across providers; change the join to be
deterministic by matching both the model identifier and the provider (e.g.,
replace "ON m.model_id = p.model_preference" with a composite join such as "ON
m.model_id = p.model_preference AND m.provider_id = p.provider_preference" or
the equivalent provider key used on persona rows), and make the same change for
the other identical join at lines 70-73 so persona resolution always selects the
single model row scoped to the intended provider.
- Around line 51-52: The GRANT line gives broad read access to provider
internals by granting SELECT on pmoves_core.persona_model_resolution to
postgrest_anon and postgrest_auth_user; remove those public grants and restrict
access to the service role only (i.e., replace the current GRANT SELECT ON
pmoves_core.persona_model_resolution TO postgrest_anon, postgrest_auth_user with
a GRANT to the service role user used by your PostgREST/Supabase service), and
apply the same change to the other similar grant referenced at the second
occurrence (line ~79) so both persona_model_resolution views are only readable
by the service role.
---
Outside diff comments:
In `@pmoves/docs/AGENTS/IMPLEMENTATION_GAP_ANALYSIS.md`:
- Around line 117-118: There are conflicting status claims about SKILL.md
pivots: one sentence says standardized SKILL.md pivots are missing for the
instruments/ directory while another says the template/marketplace is
operational; pick the correct current truth (either “standardized SKILL.md
pivots are present and marketplace operational” or “pivots missing and
marketplace not ready”), then update both occurrences that reference
SKILL.md/instruments/ and the template/marketplace statements so they match:
edit the phrase mentioning “instruments/ directory” and the sentence that refers
to the “template/marketplace” (and any nearby summary like “standardized
SKILL.md pivots” or “operational”) to the chosen single status, and add a short
evidence note pointing to the runbook or smoke test that substantiates the claim
(e.g., reference the runbook or smoke name), ensuring SKILL.md and
template/marketplace wording are consistent across the document.
In `@pmoves/docs/AGENTS/PERSONAS.md`:
- Around line 478-492: The PERSONAS.md file introduces four new NATS subjects
(persona.created.v1, persona.updated.v1, persona.activated.v1,
persona.attributed.v1) but they are missing from the canonical NATS subjects
document; update the canonical NATS subjects catalog to include entries for
these four subjects with their payload shapes (e.g., persona_id, slug, category;
changes; agent_id; persona_ids[], weights[], cgp_packet_id) so the central
topology is authoritative and matches the symbols defined in PERSONAS.md.
---
Nitpick comments:
In `@pmoves/docs/AGENTS/IMPLEMENTATION_GAP_ANALYSIS.md`:
- Around line 176-197: The "Damage Control / Security Hooks" subsection
currently mixes implemented and remaining items; split it into two subsections
"Resolved" and "Remaining" so completed work is not listed as a critical gap.
Under "Resolved" move the bullets for security/patterns.yaml deployment,
deterministic hooks (.env* blocking with template ask pattern), Known Roads
Docker redirection (.claude/CLAUDE.md), adversarial instruction detection
(pre-execution GAN defense), and the template path behavior (`check_path()`
returns `(blocked, reason, is_template)`). Under "Remaining" keep "Portability"
(hooks don't apply in submodule worktrees / Known Limitation in
AGENT_RESILIENCE_PATTERNS.md) and the not-implemented items (probabilistic LLM
safety / Haiku model integration and prompt scan hooks like
`security/hooks/prompt_scan.py`). Ensure headings use consistent status markers
(✅/❌) and update the subsection title originally labeled "Damage Control /
Security Hooks."
In `@pmoves/tools/model_readiness_check.py`:
- Around line 119-123: Extract the hardcoded set assigned to expected into a
single source of truth (e.g., a top-level constant like
PERSONA_MODEL_PREFERENCES or a configurable CLI/env variable) and update the
check in model_readiness_check.py to reference that symbol instead of the inline
set; update any relevant docstring or help text to explain how to change the
list and keep the call to self._check("Persona model preferences valid", ...)
and the missing calculation (missing = expected - models) unchanged so behavior
stays the same while model names become maintainable/configurable.
- Around line 30-37: The http_get function accepts arbitrary URL schemes (e.g.,
file://) which is unsafe; before building the Request or calling
urllib.request.urlopen, parse the url with urllib.parse.urlparse and validate
that parsed.scheme is either "http" or "https" (if not, return None or raise a
controlled error), then proceed as before; update http_get to perform this
scheme check (using urllib.parse.urlparse) to reject non-http(s) schemes safely.
- Around line 137-144: The critical models list is hardcoded as critical =
["qwen3", "nomic-embed-text"]; change this to a configurable source so the list
can be updated without changing code — e.g., read from an existing model
preferences/config (or a new constant like CRITICAL_MODELS) and use that
variable in the loop that checks pulled; update references in
model_readiness_check.py where critical is used (the loop that calls self._warn
and self._check, and the pulled variable) so the check uses the configurable
list instead of the literal array.
ℹ️ Review info
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (20)
docs/AGENT_TRAIL.mdpmoves/Makefilepmoves/config/agent_registry.yamlpmoves/config/gpu-models.yamlpmoves/docs/AGENTS/AGENT_CONTEXT_PATTERNS.mdpmoves/docs/AGENTS/AGNOTE4482.mdpmoves/docs/AGENTS/AGNOTE4482PHI.t1.mdpmoves/docs/AGENTS/AI_GRAPHITI_PROTOCOL.mdpmoves/docs/AGENTS/CODEX_CIPHER_MEMORY_IMPLEMENTATION_MAP.mdpmoves/docs/AGENTS/CODEX_OPERATOR_HOME.mdpmoves/docs/AGENTS/CODEX_RUNTIME_PROTOCOL.mdpmoves/docs/AGENTS/IMPLEMENTATION_GAP_ANALYSIS.mdpmoves/docs/AGENTS/PERSONAS.mdpmoves/docs/AGENTS/README.mdpmoves/docs/AGENTS/SUBMODULE_CODEX_HOMES/README.mdpmoves/docs/TAC/TAC_MODEL_INFRA_PERSONA_PROD_READINESS.mdpmoves/supabase/initdb/12_model_registry_seed.sqlpmoves/supabase/initdb/17_persona_seed.sqlpmoves/supabase/migrations/20260301002000_persona_model_resolution.sqlpmoves/tools/model_readiness_check.py
Comment on lines
+31
to
+33
| -- uuid-ossp already enabled by 00_pmoves_schema.sql | ||
|
|
||
| -- ============================================================================= |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# First, examine the specific file and the lines in question
echo "=== File: 17_persona_seed.sql (lines 1-70) ==="
cat -n pmoves/supabase/initdb/17_persona_seed.sql | head -70
echo -e "\n=== Check 00_pmoves_schema.sql for extensions ==="
cat pmoves/supabase/initdb/00_pmoves_schema.sql | grep -i "CREATE EXTENSION" || echo "No CREATE EXTENSION found"
echo -e "\n=== Search for UUID functions in initdb scripts ==="
rg -n "gen_random_uuid|uuid_generate_v4" pmoves/supabase/initdbRepository: POWERFULMOVES/PMOVES.AI
Length of output: 5893
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Search for ON CONFLICT in 17_persona_seed.sql ==="
rg -n "ON CONFLICT" pmoves/supabase/initdb/17_persona_seed.sql
echo -e "\n=== Check personas table schema for constraints ==="
rg -B5 -A10 "CREATE TABLE.*personas" pmoves/supabase/initdb/ | head -50
echo -e "\n=== Search for unique constraints on (name, version) ==="
rg -n "unique|constraint" pmoves/supabase/initdb/ | grep -i "personas\|name.*version" || echo "No direct constraint found in search"Repository: POWERFULMOVES/PMOVES.AI
Length of output: 620
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Find migration file for personas table ==="
find pmoves -name "*persona*" -type f | grep -E "migrations|initdb"
echo -e "\n=== Search for personas table definition ==="
rg -n "CREATE TABLE.*personas" pmoves/
echo -e "\n=== Search for unique constraint on name, version ==="
rg -B2 -A8 "personas" pmoves/supabase/initdb/00_pmoves_schema.sql | grep -A10 "CREATE TABLE"Repository: POWERFULMOVES/PMOVES.AI
Length of output: 727
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Read personas table definition from migration ==="
cat pmoves/supabase/migrations/20250115_persona_agent_creation.sqlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 10966
Update comment on line 31 to reference pgcrypto instead of uuid-ossp.
Line 31 comment says "uuid-ossp already enabled", but the code uses gen_random_uuid(), which is provided by pgcrypto (not uuid-ossp). Both extensions are already enabled in 00_pmoves_schema.sql, so update the comment to accurately reflect the UUID generator in use: change to -- pgcrypto already enabled by 00_pmoves_schema.sql.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/supabase/initdb/17_persona_seed.sql` around lines 31 - 33, Update the
comment that currently says "uuid-ossp already enabled by 00_pmoves_schema.sql"
to reference pgcrypto instead, because the SQL uses gen_random_uuid(); locate
the comment near the persona seed block where gen_random_uuid() is used (look
for gen_random_uuid() calls and the existing comment line) and change it to "--
pgcrypto already enabled by 00_pmoves_schema.sql".
Comment on lines
+35
to
+39
| FROM pmoves_core.personas p | ||
| LEFT JOIN pmoves_core.models m | ||
| ON m.model_id = p.model_preference | ||
| LEFT JOIN pmoves_core.model_providers mp | ||
| ON mp.id = m.provider_id; |
Contributor
There was a problem hiding this comment.
Use a deterministic join key for persona resolution.
Joining personas.model_preference to models.model_id can return multiple model rows for one persona when model IDs exist under multiple providers. That makes runtime resolution ambiguous.
Also applies to: 70-73
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/supabase/migrations/20260301002000_persona_model_resolution.sql`
around lines 35 - 39, The JOIN between personas (p) and models (m) is ambiguous
because m.model_id can be duplicated across providers; change the join to be
deterministic by matching both the model identifier and the provider (e.g.,
replace "ON m.model_id = p.model_preference" with a composite join such as "ON
m.model_id = p.model_preference AND m.provider_id = p.provider_preference" or
the equivalent provider key used on persona rows), and make the same change for
the other identical join at lines 70-73 so persona resolution always selects the
single model row scoped to the intended provider.
Comment on lines
+51
to
+52
| GRANT SELECT ON pmoves_core.persona_model_resolution TO postgrest_anon, postgrest_auth_user; | ||
|
|
Contributor
There was a problem hiding this comment.
Restrict grants on resolution views that expose provider internals.
Both views include provider endpoint/config fields and are granted to postgrest_anon. That broadens exposure and conflicts with the nearby “service role read access” intent.
Suggested hardening direction
-GRANT SELECT ON pmoves_core.persona_model_resolution TO postgrest_anon, postgrest_auth_user;
+GRANT SELECT ON pmoves_core.persona_model_resolution TO service_role;
-GRANT SELECT ON pmoves_core.active_persona_summary TO postgrest_anon, postgrest_auth_user;
+GRANT SELECT ON pmoves_core.active_persona_summary TO service_role;Also applies to: 79-79
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/supabase/migrations/20260301002000_persona_model_resolution.sql`
around lines 51 - 52, The GRANT line gives broad read access to provider
internals by granting SELECT on pmoves_core.persona_model_resolution to
postgrest_anon and postgrest_auth_user; remove those public grants and restrict
access to the service role only (i.e., replace the current GRANT SELECT ON
pmoves_core.persona_model_resolution TO postgrest_anon, postgrest_auth_user with
a GRANT to the service role user used by your PostgREST/Supabase service), and
apply the same change to the other similar grant referenced at the second
occurrence (line ~79) so both persona_model_resolution views are only readable
by the service role.
POWERFULMOVES
changed the base branch from
main
to
feat/model-registry-persona-readiness
March 2, 2026 04:38
POWERFULMOVES
pushed a commit
that referenced
this pull request
Mar 2, 2026
POWERFULMOVES
force-pushed
the
docs/agents-review-2026-03-01
branch
from
March 2, 2026 04:44
6bfc35d to
5e191c2
Compare
POWERFULMOVES
changed the base branch from
feat/model-registry-persona-readiness
to
main
March 2, 2026 05:48
POWERFULMOVES
force-pushed
the
docs/agents-review-2026-03-01
branch
from
March 2, 2026 05:49
43e5cc7 to
a0ed3a1
Compare
- Mark Phase 1 roadmap items as complete (model registry, persona seeds, GPU models YAML, service-model mappings) - Update CHIT integration status from None to Partial - Add A2A MCP foundation status - Update security hooks as implemented - Refresh date to 2026-03-01 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- AGENT_CONTEXT_PATTERNS: add hook portability warning for Windows - CODEX_CIPHER_MEMORY: add cipher categories table for quick reference - CODEX_OPERATOR_HOME: add known gaps link to gap analysis - CODEX_RUNTIME_PROTOCOL: add Codex-Claude collision handling section Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add a start-here index document that catalogs all 69 files in the AGENTS directory with descriptions and category groupings. Provides newcomers a navigation map for the agent documentation corpus. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add 4 worked examples (Developer, Creator, Researcher, Analyst) showing model_preference, chit_attribution, and tool_allowlist - Document persona inheritance chain (seed SQL → Supabase row → agent_registry.yaml → runtime resolution view) - Add CHIT attribution configuration section - Add quick reference summary table for all 8 standard personas - Cross-reference 17_persona_seed.sql from PR #741 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add chit_toggles (encode, sign, bus_emit) to 9 infrastructure agents: nats-init, supabase-db, minio, qdrant, meilisearch, neo4j, prometheus, grafana, loki (all disabled — infra agents don't produce CHIT events) - Add gpu_port: 8087 to hi-rag-gateway for v1/v2 port split - Achieves 60/60 CHIT toggle coverage across all registered agents Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Document naming conventions for codex home files - Add orphan tracking guidance for unmapped submodules - Expand directory structure examples Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
4 tasks
POWERFULMOVES
added a commit
that referenced
this pull request
Mar 2, 2026
* fix(security): auth-gate agent-zero A2A discovery endpoint * fix(security): HMAC CHIT proofs + A2A discovery auth audit + dotnet preflight (#736) * fix(security): use HMAC for CHIT proofs * docs(security): add A2A discovery auth sweep findings * chore(env): require dotnet sdk in bootstrap preflight --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> * chore(deps): bump multer (#735) Bumps the npm_and_yarn group with 1 update in the /CATACLYSM_STUDIOS_INC/L4-PLATFORM/provisions/docker-stacks/jellyfin-ai/api-gateway directory: [multer](https://github.com/expressjs/multer). Updates `multer` from 2.0.2 to 2.1.0 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v2.0.2...v2.1.0) --- updated-dependencies: - dependency-name: multer dependency-version: 2.1.0 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(chit): correct FlOO$ PYTHONPATH for pr-monitor pipeline * feat(chit): CHIT-signed Graphiti trail + skill pairing awareness (#739) * fix(security): use HMAC for CHIT proofs * docs(security): add A2A discovery auth sweep findings * fix(security): update submodule pointers to 2026-03-01 review fix branches Update gitlink pointers for 5 submodules to their security fix branches: - BoTZ: auth-gate /.well-known/agent.json (PR #70) - ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46) - Agent-Zero: path containment + supervisord users (PR #8) - transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44) - DoX: secrets externalized + honest 501 (PR #114) Also update review status doc with fix verification. All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(env): require dotnet sdk in bootstrap preflight * feat(chit): add CHIT-signed Graphiti trail tooling Add provenance signing for agent trail entries using CHIT HMAC: - sign_trail.py: CLI tool to create and sign trail entries - PostToolUse hook for automatic signing on trail file writes - /chit:sign-trail skill command for interactive use - Preflight check for dotnet SDK (required by CHIT crypto) - CLAUDE.md documentation for trail signing workflow - Settings.json hook registration Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix(runtime): service networking, healthchecks, SQL, Makefile hardening (#740) * fix(security): use HMAC for CHIT proofs * docs(security): add A2A discovery auth sweep findings * fix(security): update submodule pointers to 2026-03-01 review fix branches Update gitlink pointers for 5 submodules to their security fix branches: - BoTZ: auth-gate /.well-known/agent.json (PR #70) - ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46) - Agent-Zero: path containment + supervisord users (PR #8) - transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44) - DoX: secrets externalized + honest 501 (PR #114) Also update review status doc with fix verification. All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(env): require dotnet sdk in bootstrap preflight * fix(compose): networking, healthchecks, and env hardening - Fix external compose service networking and port bindings - Add missing healthcheck configurations to n8n compose - Update env.shared.example with new required variables - Harden docker-compose.yml service definitions Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(services): auth, healthchecks, and dependency updates - Agent Zero: Dockerfile non-root hardening, MCP server auth fixes - service_registry: improve service discovery and health reporting - evo-controller: add healthcheck endpoint and startup guards - flute-gateway: fix import path - render-webhook: update deps, add input validation - retrieval-eval: add health and metrics endpoints Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(sql): RLS policies, model registry seeds, and supabase config - Tighten RLS policies for public_init and geometry tables - Update model registry seed data with current model versions - Add studio board RLS migration for service_role access - Add supabase .gitignore and config.toml for local dev Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(tooling): Makefile targets, smoke tests, and operational scripts - Makefile: add sign-trail, volume-reset, and infra targets - smoke.ps1: expand service coverage and timeout handling - with-env.sh: support multi-tier env loading - bringup_with_ui.sh: improve startup sequencing - chit_security.py: fix HMAC signing edge cases - retro_flightcheck.py: add new validation checks - capture_evidence.sh: new script for PR evidence collection - AI_GRAPHITI_PROTOCOL.md: document agent trail protocol - pr-monitor.md: update skill command definition Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(submodules): update BoTZ-gateway and Cipher pointers Update submodule pointers to latest reviewed commits from 2026-03-01 security sweep. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(security): 2026-03-01 submodule security reviews and agent notes - 5 submodule security reviews (Agent Zero, BoTZ, DoX, ToKenism, transcribe-and-fetch) - Security queue tracker and sitrep JSON - AGNOTE4482 FlOO$ and Flute agent notes - CHIT review-sweep skill command and post-review hook Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * chore: add gitignore for runtime data and DAO docs (#743) * fix(security): use HMAC for CHIT proofs * docs(security): add A2A discovery auth sweep findings * fix(security): update submodule pointers to 2026-03-01 review fix branches Update gitlink pointers for 5 submodules to their security fix branches: - BoTZ: auth-gate /.well-known/agent.json (PR #70) - ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46) - Agent-Zero: path containment + supervisord users (PR #8) - transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44) - DoX: secrets externalized + honest 501 (PR #114) Also update review status doc with fix verification. All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(env): require dotnet sdk in bootstrap preflight * chore: add gitignore for runtime data, DAO docs, and env backups Add entries to prevent accidental commits of: - pmoves/jellyfin-ai/ (runtime config/data from Jellyfin AI stack) - pmoves/pmoves/PR_EVIDENCE/ (smoke test evidence artifacts) - pmoves/docs/logs/pr_monitor_* (runtime PR monitor logs) - CATACLYSM_STUDIOS_INC/PMOVES DAO/ (managed separately) - pmoves/env.jellyfin-ai, pmoves/env.supa.runtime.bak.* (env backups) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * feat(models): model registry reconciliation + persona seeds + readiness check (#741) * fix(security): use HMAC for CHIT proofs * docs(security): add A2A discovery auth sweep findings * fix(security): update submodule pointers to 2026-03-01 review fix branches Update gitlink pointers for 5 submodules to their security fix branches: - BoTZ: auth-gate /.well-known/agent.json (PR #70) - ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46) - Agent-Zero: path containment + supervisord users (PR #8) - transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44) - DoX: secrets externalized + honest 501 (PR #114) Also update review status doc with fix verification. All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(env): require dotnet sdk in bootstrap preflight * docs(agents): overlay TAC model/persona readiness into graphiti protocol * docs(agents): correct TAC status wording for local staged artifacts * feat(models): reconcile model registry with Anthropic, TTS, and expanded service mappings Add Anthropic provider (claude-sonnet-4-5, claude-opus-4-5, claude-haiku-4-5) as persona backbone. Add TTS provider with 6 engines from Ultimate TTS Studio. Add 5 missing Ollama models from gpu-models.yaml (qwen3:32b, qwen3:1.7b, llama3.2:3b, codellama:7b, deepseek-coder:6.7b). Fix VRAM values to match gpu-models.yaml truth (qwen3:8b: 8000→6144, nomic-embed-text: 1000→512). Expand service-model mappings from 4 to 15+ services including hirag, archon, coding, orchestrator, vl_sentinel, tts, extract_worker, and more. Covers TAC branches B + C. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(personas): integrate 8 standard persona seeds into initdb pipeline Copy persona seeds from pmoves/db/v5_14_seed_standard_personas.sql into the active Supabase initdb pipeline as 17_persona_seed.sql. Personas reference claude-sonnet-4-5 (Developer/Creator/Analyst/Tester), claude-opus-4-5 (Researcher/Coordinator/Security), and claude-haiku-4-5 (Archivist). Sequenced after model registry (12) to ensure model_preference references are valid. Preserves ON CONFLICT (name, version) idempotency. Covers TAC branch A. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(gpu): sync gpu-models.yaml with SQL model registry Add 10 models missing from gpu-models.yaml that exist in SQL and consume local GPU VRAM: qwen2.5:32b, qwen2.5:14b, qwen2-vl:7b, qwen3-reranker:4b, nemotron-mini, llama3.1, qwen3-embedding:4b/8b, embeddinggemma:300m. GPU Orchestrator needs these entries for VRAM scheduling on RTX 5090. Covers TAC branch D. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(db): add persona-model resolution view for runtime agent identity lookup Create persona_model_resolution view joining persona → model → provider for runtime resolution of which API endpoint to call for each persona. Also adds active_persona_summary convenience view. Grants SELECT to PostgREST anon/auth roles. Covers TAC branch F. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(ops): add model-readiness check and Make target Create model_readiness_check.py that validates: - Supabase model_providers populated with ≥8 active providers - Supabase personas table populated with ≥8 rows - Ollama has expected local models pulled - TensorZero gateway operational - persona_model_resolution view returns valid data Add 'make model-readiness' target and wire into verify-all chain. Covers TAC branch E. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(db): harden model/persona seed determinism and view security * fix(ops): enforce readiness gate and close TAC doc drift * fix(sql): harden studio_board RLS policy for service_role only * fix(db): reconcile model provider upserts and enforce studio policy replacement - update model_providers upserts to refresh mutable fields (type/api_base/api_key_env_var/description/active/metadata)\n- always replace studio_board_service_role_all policy in migration for upgrade parity\n- clarify persona resolution grant comment to match PostgREST role grants\n- add readiness-check type hints/constants and align TAC verify steps * fix(security): tighten studio_board revokes and TensorZero reachability checks * fix(readiness): enforce registry thresholds and harden studio_board revokes --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * docs(agents): comprehensive AGENTS directory review and cross-reference fixes (#742) * docs(agents): update gap analysis with Phase 1 completions - Mark Phase 1 roadmap items as complete (model registry, persona seeds, GPU models YAML, service-model mappings) - Update CHIT integration status from None to Partial - Add A2A MCP foundation status - Update security hooks as implemented - Refresh date to 2026-03-01 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(agents): add cross-references between operator docs - AGENT_CONTEXT_PATTERNS: add hook portability warning for Windows - CODEX_CIPHER_MEMORY: add cipher categories table for quick reference - CODEX_OPERATOR_HOME: add known gaps link to gap analysis - CODEX_RUNTIME_PROTOCOL: add Codex-Claude collision handling section Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(agents): create README.md index for 69-file directory Add a start-here index document that catalogs all 69 files in the AGENTS directory with descriptions and category groupings. Provides newcomers a navigation map for the agent documentation corpus. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(agents): add concrete persona seed examples to PERSONAS.md - Add 4 worked examples (Developer, Creator, Researcher, Analyst) showing model_preference, chit_attribution, and tool_allowlist - Document persona inheritance chain (seed SQL → Supabase row → agent_registry.yaml → runtime resolution view) - Add CHIT attribution configuration section - Add quick reference summary table for all 8 standard personas - Cross-reference 17_persona_seed.sql from PR #741 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(registry): complete CHIT toggle coverage and Hi-RAG port split - Add chit_toggles (encode, sign, bus_emit) to 9 infrastructure agents: nats-init, supabase-db, minio, qdrant, meilisearch, neo4j, prometheus, grafana, loki (all disabled — infra agents don't produce CHIT events) - Add gpu_port: 8087 to hi-rag-gateway for v1/v2 port split - Achieves 60/60 CHIT toggle coverage across all registered agents Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(agents): update SUBMODULE_CODEX_HOMES naming convention docs - Document naming conventions for codex home files - Add orphan tracking guidance for unmapped submodules - Expand directory structure examples Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(agents): align persona status, topology ports, and gap metadata --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * chore: sync Hardened → main after #741-#745 merge batch (#746) * chore(submodules): bump transcribe-and-fetch + cipher for A2A parity (#745) * chore(submodules): bump transcribe-and-fetch and cipher for a2a auth parity * chore(submodules): bump transcribe-and-fetch and cipher to merge-ready A2A heads --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> * fix(a2a): secure discovery/task APIs and align with upstream agent-card path (#744) * fix(security): use HMAC for CHIT proofs * docs(security): add A2A discovery auth sweep findings * fix(security): update submodule pointers to 2026-03-01 review fix branches Update gitlink pointers for 5 submodules to their security fix branches: - BoTZ: auth-gate /.well-known/agent.json (PR #70) - ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46) - Agent-Zero: path containment + supervisord users (PR #8) - transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44) - DoX: secrets externalized + honest 501 (PR #114) Also update review status doc with fix verification. All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(env): require dotnet sdk in bootstrap preflight * fix(security): auth-gate agent-zero A2A discovery endpoint * fix(security): HMAC CHIT proofs + A2A discovery auth audit + dotnet preflight (#736) * fix(security): use HMAC for CHIT proofs * docs(security): add A2A discovery auth sweep findings * chore(env): require dotnet sdk in bootstrap preflight --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> * chore(deps): bump multer (#735) Bumps the npm_and_yarn group with 1 update in the /CATACLYSM_STUDIOS_INC/L4-PLATFORM/provisions/docker-stacks/jellyfin-ai/api-gateway directory: [multer](https://github.com/expressjs/multer). Updates `multer` from 2.0.2 to 2.1.0 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v2.0.2...v2.1.0) --- updated-dependencies: - dependency-name: multer dependency-version: 2.1.0 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(chit): correct FlOO$ PYTHONPATH for pr-monitor pipeline * feat(chit): CHIT-signed Graphiti trail + skill pairing awareness (#739) * fix(security): use HMAC for CHIT proofs * docs(security): add A2A discovery auth sweep findings * fix(security): update submodule pointers to 2026-03-01 review fix branches Update gitlink pointers for 5 submodules to their security fix branches: - BoTZ: auth-gate /.well-known/agent.json (PR #70) - ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46) - Agent-Zero: path containment + supervisord users (PR #8) - transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44) - DoX: secrets externalized + honest 501 (PR #114) Also update review status doc with fix verification. All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(env): require dotnet sdk in bootstrap preflight * feat(chit): add CHIT-signed Graphiti trail tooling Add provenance signing for agent trail entries using CHIT HMAC: - sign_trail.py: CLI tool to create and sign trail entries - PostToolUse hook for automatic signing on trail file writes - /chit:sign-trail skill command for interactive use - Preflight check for dotnet SDK (required by CHIT crypto) - CLAUDE.md documentation for trail signing workflow - Settings.json hook registration Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix(runtime): service networking, healthchecks, SQL, Makefile hardening (#740) * fix(security): use HMAC for CHIT proofs * docs(security): add A2A discovery auth sweep findings * fix(security): update submodule pointers to 2026-03-01 review fix branches Update gitlink pointers for 5 submodules to their security fix branches: - BoTZ: auth-gate /.well-known/agent.json (PR #70) - ToKenism-Multi: all P1/P2 cred defaults fixed (PR #46) - Agent-Zero: path containment + supervisord users (PR #8) - transcribe-and-fetch: openai v2 alignment + doc scrub (PR #44) - DoX: secrets externalized + honest 501 (PR #114) Also update review status doc with fix verification. All 7 P1 and 20 P2 findings resolved. 4 dependabot PRs merged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(env): require dotnet sdk in bootstrap preflight * fix(compose): networking, healthchecks, and env hardening - Fix external compose service networking and port bindings - Add missing healthcheck configurations to n8n compose - Update env.shared.example with new required variables - Harden docker-compose.yml service definitions Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(services): auth, healthchecks, and dependency updates - Agent Zero: Dockerfile non-root hardening, MCP server auth fixes - service_registry: improve service discovery and health reporting - evo-controller: add healthcheck endpoint and startup guards - flute-gateway: fix import path - render-webhook: update deps, add input validation - retrieval-eval: add health and metrics endpoints Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(sql): RLS policies, model registry seeds, and supabase config - Tighten RLS policies for public_init and geometry tables - Update model registry seed data with current model versions - Add studio board RLS migration for service_role access - Add supabase .gitignore and config.toml for local dev Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(tooling): Makefile targets, smoke tests, and operational scripts - Makefile: add sign-trail, volume-reset, and infra targets - smoke.ps1: expand service coverage and timeout handling - with-env.sh: support multi-tier env loading - bringup_with_ui.sh: improve startup sequencing - chit_security.py: fix HMAC signing edge cases - retro_flightcheck.py: add new validation checks - capture_evidence.sh: new script for PR evidence collection - AI_GRAPHITI_PROTOCOL.md: document agent trail protocol - pr-monitor.md: update skill command definition Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(submodules): update BoTZ-gateway and Cipher pointers Update submodule pointers to latest reviewed commits from 2026-03-01 security sweep. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(security): 2026-03-01 submodule security reviews and agent notes - 5 submodule security reviews (Agent Zero, BoTZ, DoX, ToKenism, transcribe-and-fetch) - Security queue tracker and sitrep JSON - AGNOTE4482 FlOO$ and Flute agent notes - CHIT review-sweep skill command and post-review hook Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * docs(agents): overlay TAC model/persona readiness into graphiti protocol * docs(agents): correct TAC status wording for local staged artifacts * feat(models): reconcile model registry with Anthropic, TTS, and expanded service mappings Add Anthropic provider (claude-sonnet-4-5, claude-opus-4-5, claude-haiku-4-5) as persona backbone. Add TTS provider with 6 engines from Ultimate TTS Studio. Add 5 missing Ollama models from gpu-models.yaml (qwen3:32b, qwen3:1.7b, llama3.2:3b, codellama:7b, deepseek-coder:6.7b). Fix VRAM values to match gpu-models.yaml truth (qwen3:8b: 8000→6144, nomic-embed-text: 1000→512). Expand service-model mappings from 4 to 15+ services including hirag, archon, coding, orchestrator, vl_sentinel, tts, extract_worker, and more. Covers TAC branches B + C. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(personas): integrate 8 standard persona seeds into initdb pipeline Copy persona seeds from pmoves/db/v5_14_seed_standard_personas.sql into the active Supabase initdb pipeline as 17_persona_seed.sql. Personas reference claude-sonnet-4-5 (Developer/Creator/Analyst/Tester), claude-opus-4-5 (Researcher/Coordinator/Security), and claude-haiku-4-5 (Archivist). Sequenced after model registry (12) to ensure model_preference references are valid. Preserves ON CONFLICT (name, version) idempotency. Covers TAC branch A. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(gpu): sync gpu-models.yaml with SQL model registry Add 10 models missing from gpu-models.yaml that exist in SQL and consume local GPU VRAM: qwen2.5:32b, qwen2.5:14b, qwen2-vl:7b, qwen3-reranker:4b, nemotron-mini, llama3.1, qwen3-embedding:4b/8b, embeddinggemma:300m. GPU Orchestrator needs these entries for VRAM scheduling on RTX 5090. Covers TAC branch D. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(db): add persona-model resolution view for runtime agent identity lookup Create persona_model_resolution view joining persona → model → provider for runtime resolution of which API endpoint to call for each persona. Also adds active_persona_summary convenience view. Grants SELECT to PostgREST anon/auth roles. Covers TAC branch F. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(ops): add model-readiness check and Make target Create model_readiness_check.py that validates: - Supabase model_providers populated with ≥8 active providers - Supabase personas table populated with ≥8 rows - Ollama has expected local models pulled - TensorZero gateway operational - persona_model_resolution view returns valid data Add 'make model-readiness' target and wire into verify-all chain. Covers TAC branch E. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(db): harden model/persona seed determinism and view security * fix(ops): enforce readiness gate and close TAC doc drift * fix(a2a): harden discovery/task auth and add agent-card endpoint * fix(sql): harden studio_board RLS policy for service_role only * fix(chat-relay): lazy-load supabase client to avoid path shadow in tests * fix(ci): avoid hard failures in compose validation and yt docs tests * fix(pmoves-yt): make boto3 optional at import time for test collection * fix(pmoves-yt): stub tenacity when unavailable in CI test env * chore(submodule): bump PMOVES-Agent-Zero for canonical agent-card parity * chore(pr-scope): drop transcribe-and-fetch and cipher gitlink bumps from #744 * fix(a2a): address review blockers — RLS predicate, fail-closed key gate, discovery auth B-1: studio_board RLS policy now restricts to service_role instead of using(true) B-2: model-registry SUPABASE_SERVICE_KEY uses :? (fail-closed) instead of :- (empty) B-3: discover_agents endpoint uses _require_discovery_auth instead of _require_task_auth Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
4 tasks
This was referenced Mar 15, 2026
11 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
6 Atomic Commits
Dependency
Merge after PR #741 (model registry + persona seeds) — this PR cross-references
17_persona_seed.sqland persona-model resolution views introduced there.Test plan
grep -c "not implemented" pmoves/docs/AGENTS/IMPLEMENTATION_GAP_ANALYSIS.mdreturns ≤4 (legitimate A2A gaps only)agent_registry.yamlis valid YAML:python -c "import yaml; yaml.safe_load(open('pmoves/config/agent_registry.yaml'))"🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes
Chores
Documentation