fix(a2a): secure discovery/task APIs and align with upstream agent-card path

.claude/CLAUDE.md

@@ -602,3 +602,74 @@ When developing features for PMOVES.AI:
 7. **Respect context tiers** - Load only appropriate context level for your task
 
 PMOVES.AI is a sophisticated production system. Your role is to build features that integrate with this ecosystem, not replace it.
+
+## Skill Pairing Awareness
+
+When orchestrating multi-step work, consult `pmoves/configs/skill-pairings.yaml` to identify the correct pipeline and agent chain for the task at hand.
+
+**How to use:**
+1. Match the current task to one of the 7 defined pairings below
+2. Check `depends` for each chain step — verify services are healthy before proceeding
+3. Assign work to the agent specified in each step (or delegate via Agent Zero MCP)
+4. Publish completion hooks to NATS as each step finishes
+
+**Quick Reference — Skill Pairings:**
+
+| Pairing | Steps | Agents | NATS Subject |
+|---------|-------|--------|-------------|
+| `model-benchmark-viz` | model-trainer → benchmark → chart → render | agent-zero → archon → creator | `skills.pipeline.model-benchmark-viz.v1` |
+| `ingest-chit-index` | extract → chit-encode → hirag-index | extract-worker → tokenism → hirag | `skills.pipeline.ingest-chit-index.v1` |
+| `research-summarize-render` | deepresearch → chart → render | deepresearch → archon → creator | `skills.pipeline.research-render.v1` |
+| `chit-3d-viz` | chit-encode → threejs-render | tokenism → hyperdimensions | `skills.pipeline.chit-3d-viz.v1` |
+| `voice-synthesis` | text-generate → prosodic → tts | agent-zero → flute → ultimate-tts | `skills.pipeline.voice-synthesis.v1` |
+| `agent-card-gen` | theme → comfyui → card | archon → creator → archon | `skills.pipeline.agent-card-gen.v1` |
+| `pr-monitor-graphiti-chit` | pr-monitor → encode → trail-sync | codex → tokenism → archon | `skills.pipeline.pr-monitor-graphiti-chit.v1` |
+
+**Commands:**
+- `/chit:floos status` — Show all pairing statuses
+- `/chit:floos validate <pairing>` — Validate dependencies for a pairing
+- `make -C pmoves floos-status` — CLI equivalent
+
+Skill pairing consultation is **advisory** — use it to inform agent assignment, not as a hard gate.
+
+## CHIT-Signed Graphiti Trail
+
+After significant work, sign a Graphiti trail entry with CHIT HMAC for provenance and attribution.
+
+**Flow:** Write trail entry → Sign with `sign_cgp()` → Emit `agent.graphiti.signed.v1` to NATS
+
+**When to sign:**
+- Multi-file changes (3+ files modified)
+- Task or subtask completion
+- Agent handoff (passing work to another contributor)
+- PR review completion
+- Session end with meaningful changes
+
+**Trail entry format:**
+```
+◆ Claude Opus | #7C3AED | Phase H | <timestamp>
+Summary: <one-line summary of work>
+Resonance: security-audit, architecture, ...
+```
+
+**How to sign:**
+```bash
+# Via Make target (preferred)
+make -C pmoves sign-trail SUMMARY="Completed security hardening" AGENT=claude-opus PHASE="Phase H"
+
+# Via skill command
+/chit:sign-trail "Completed security hardening"
+
+# Via Python directly
+python pmoves/tools/sign_trail.py --agent-id claude-opus --summary "Completed security hardening"
+```
+
+**Automatic signing:** A PostToolUse hook on Edit/Write auto-signs when the file path contains `AGENT_TRAIL` or `graphiti`. No manual action needed for trail file writes.
+
+**Signing is optional locally** — if `CHIT_PASSPHRASE` is not set, payloads are emitted unsigned with a stderr warning. This is expected in development. Never hardcode passphrases.
+
+**Infrastructure:**
+- Signing tool: `pmoves/tools/sign_trail.py` (imports `sign_cgp()` from `chit_security.py`)
+- Agent registry: `pmoves/config/agent_signatures.yaml` (glyph, color, voice per agent)
+- Schema: `pmoves/contracts/schemas/agent-graphiti/signature.v1.schema.json`
+- Log artifact: `pmoves/docs/logs/graphiti_signed_latest.json` (runtime, gitignored)

.claude/commands/chit/review-sweep.md

@@ -0,0 +1,105 @@
+# CHIT Review Sweep
+
+Post-review handshake that feeds Claude's PR review findings into the CHIT/FlOO$ pipeline. Run this after completing review work to sync learnings into the Graphiti trail.
+
+## Arguments
+
+- `$ARGUMENTS` - Optional: `--dry-run` to preview without writing, `--no-nats` to skip NATS publish, `--trail` to also write a Graphiti trail entry
+
+## Instructions
+
+This command implements the KRISS KROSS Accord scout role: Claude reviews, encodes findings as CGP, and hands off to Codex's `pr-monitor-graphiti-chit` pairing.
+
+### Step 1: Collect PR state
+
+Run `make -C pmoves pr-monitor` to produce:
+- `pmoves/docs/logs/pr_monitor_latest.json`
+- `pmoves/docs/logs/pr_monitor_learnings_latest.md`
+
+If the command fails (missing script or Make target), report the error and stop — do not improvise a replacement.
+
+### Step 2: Encode as CGP
+
+Run `make -C pmoves pr-monitor-chit-packet` to produce:
+- `pmoves/docs/logs/pr_monitor_learnings_latest.cgp.json`
+
+Read the CGP packet and summarize: schema version, contributor count, encoded learnings count.
+
+### Step 3: Trail entry (if `--trail` flag)
+
+If `--trail` is specified, prepend a Graphiti trail entry to `docs/AGENT_TRAIL.md` using Claude's signature:
+
+```markdown
+<!-- graphiti:claude-opus phase:review-sweep ts:{current ISO-8601} -->
+
+## ◆ Claude Opus — review-sweep: PR Review Learnings Sync
+
+<table><tr><td style="background:#7C3AED;width:24px"></td><td>
+
+**Resonance:** security-audit, cross-repo-orchestration
+**Voice:** analytical
+
+### Done
+- {list items reviewed/merged/fixed}
+
+### Left Behind
+- {items remaining for next agent}
+
+### For Next Agent
+- CGP packet at `pmoves/docs/logs/pr_monitor_learnings_latest.cgp.json`
+- Run `/chit:floos validate pr-monitor-graphiti-chit` to verify pipeline
+
+</td></tr></table>
+
+<!-- /graphiti -->
+```
+
+### Step 4: NATS publish (unless `--no-nats` or `--dry-run`)
+
+Attempt to publish `ops.pr.review.completed.v1` to NATS with payload:
+```json
+{
+  "agent_id": "claude-opus",
+  "glyph": "◆",
+  "color": "#7C3AED",
+  "timestamp": "{ISO-8601}",
+  "artifact": "pmoves/docs/logs/pr_monitor_learnings_latest.cgp.json",
+  "summary": "{brief description of what was reviewed}"
+}
+```
+
+Use `nats pub` if available, otherwise skip gracefully with a note that NATS is not connected.
+
+### Step 5: Summary output
+
+Display:
+- PRs reviewed/merged in this session
+- Learnings encoded (actionable vs nitpick vs out-of-diff)
+- CGP packet location
+- Trail entry status (written / skipped)
+- NATS publish status (sent / skipped / unavailable)
+
+If `--dry-run`, show what would be written/published without executing.
+
+## Examples
+
+```bash
+# Standard post-review sweep
+/chit:review-sweep
+
+# Include trail entry
+/chit:review-sweep --trail
+
+# Preview without side effects
+/chit:review-sweep --dry-run
+
+# Skip NATS (offline mode)
+/chit:review-sweep --trail --no-nats
+```
+
+## Related
+
+- `/pr-monitor` — Collect PR state and learnings
+- `/chit:floos validate pr-monitor-graphiti-chit` — Validate the full pipeline
+- `/chit:encode` — Manual CGP encoding
+- `/github:pr-review` — Review a specific PR

.claude/commands/chit/sign-trail.md

@@ -0,0 +1,45 @@
+# CHIT Sign Trail
+
+Sign a Graphiti trail entry with CHIT HMAC for agent attribution and provenance.
+
+## Arguments
+
+- `$ARGUMENTS` - Summary of the work being signed (text string)
+
+## Instructions
+
+1. Parse `$ARGUMENTS` as the summary text.  If empty, use "Trail entry signed" as default.
+2. Try signing via Make target (preferred — uses env-bootstrap):
+   ```bash
+   make -C pmoves sign-trail SUMMARY="<summary>" AGENT="${AGENT:-claude-opus}" PHASE="${PHASE:-Phase H}"
+   ```
+3. If Make is unavailable, fall back to direct Python invocation:
+   ```bash
+   python pmoves/tools/sign_trail.py --agent-id "${AGENT:-claude-opus}" --summary "<summary>" --phase "${PHASE:-Phase H}"
+   ```
+4. Report to the user:
+   - Signed payload summary (agent, glyph, phase, timestamp)
+   - HMAC kid (first 16 hex chars of SHA-256 of passphrase) — or "unsigned" if `CHIT_PASSPHRASE` not set
+   - Whether `graphiti_signed_latest.json` was written
+   - NATS publish status (if `nats` CLI available)
+
+## Example
+
+```bash
+# Sign a trail entry for completed security audit
+/chit:sign-trail "Completed Phase C security audit for Agent Zero"
+
+# Sign with custom agent and phase
+AGENT=codex PHASE="Phase G" /chit:sign-trail "Merged 12 PRs"
+
+# Pipe JSON payload
+echo '{"agent_id":"gemini","summary":"Research complete"}' | python pmoves/tools/sign_trail.py --stdin
+```
+
+## Related
+
+- `/chit:encode` - Encode data as CGP v2 packet
+- `/chit:floos` - FlOO$ linked skill pipelines
+- `/chit:bus` - Publish to GEOMETRY BUS
+- `pmoves/config/agent_signatures.yaml` - Agent glyph/color registry
+- `pmoves/contracts/schemas/agent-graphiti/signature.v1.schema.json` - Payload schema

.claude/commands/pr-monitor.md

@@ -1,43 +1,66 @@
----
-description: Monitor CI/CD status of v3-clean → Hardened migration PRs
----
+# PR Monitor
 
-# PR Monitor for v3-clean Migration
+Monitor PR merge readiness including actionable, nitpick, and out-of-diff review learnings.
 
-## What It Does
+## Arguments
 
-Monitors the CI/CD status, mergeability, and review status of all targeted PRs created for the v3-clean → Hardened migration.
+- `$ARGUMENTS` - Optional: `--strict` for gate mode, `--chit` for CGP packet, `--floos` for full FlOO$ parity
 
-## Usage
+## Instructions
 
-```bash
-# Run PR monitoring
-.claude/scripts/pr-monitor.sh
-```
+Parse `$ARGUMENTS` and run the appropriate Make target from the `pmoves/` directory.
+
+### Default (no args)
+
+Collect current PR state and review learnings.
+
+1. Run `make -C pmoves pr-monitor`
+2. Display generated artifacts:
+   - `pmoves/docs/logs/pr_monitor_latest.json` — raw PR state snapshot
+   - `pmoves/docs/logs/pr_monitor_learnings_latest.md` — human-readable learnings
+3. Summarize: open PRs count, actionable comments, nitpicks, out-of-diff items
+
+### `--chit`
+
+Generate a CHIT-encoded CGP packet from PR learnings for Graphiti trail handoff.
+
+1. Run `make -C pmoves pr-monitor` (if not already fresh)
+2. Run `make -C pmoves pr-monitor-chit-packet`
+3. Display: `pmoves/docs/logs/pr_monitor_learnings_latest.cgp.json`
+
+### `--strict`
 
-## Output
+Gate mode — exit 0 required before merge approval.
 
-The script displays:
-- **Summary table**: PR #, title, mergeable status, CI checks, review status
-- **Detailed status**: URL, mergeable state, check results for each PR
-- **Next steps**: Commands for approving and merging PRs
+1. Run `make -C pmoves pr-monitor-strict`
+2. If exit code is non-zero, list blocking items
+3. If exit code is 0, confirm merge readiness
 
-## PRs Monitored
+### `--floos`
 
-| PR | Service | Files |
-|----|---------|-------|
-| #528 | Hi-RAG v2 | 2 |
-| #529 | Flute Gateway | 1 |
-| #530 | Presign | 1 |
-| #531 | Publisher Discord | 1 |
-| #532 | Session Context Worker | 1 |
-| #533 | Agent Zero | 1 |
-| #534 | Gateway Agent | 2 |
+Full FlOO$ parity check — validates the `pr-monitor-graphiti-chit` skill pairing pipeline.
+
+1. Run `make -C pmoves chit-flow-pr-monitor-strict`
+2. Report: DAG validity, dependency satisfaction, CHIT encoding status, Graphiti sync
+
+## Examples
+
+```bash
+# Quick PR status check
+/pr-monitor
+
+# Generate CHIT packet for handoff
+/pr-monitor --chit
+
+# Pre-merge gate check
+/pr-monitor --strict
+
+# Full FlOO$ pipeline validation
+/pr-monitor --floos
+```
 
-## Status Icons
+## Related
 
-- ✅ = PASS / MERGEABLE / APPROVED
-- ❌ = FAIL / CONFLICTING / CHANGES REQUESTED
-- ⏳ = PENDING
-- 👀 = REVIEW REQUIRED
-- 🔄 = CHANGES REQUESTED
+- `/chit:floos validate pr-monitor-graphiti-chit` — Validate the FlOO$ pipeline DAG
+- `/chit:encode` — Encode data as CGP v2 packet
+- `/github:pr-review` — Review a specific PR