chore: sync Hardened → main after #741-#745 merge batch

[POWERFULMOVES]

Summary

• Syncs PMOVES.AI-Edition-Hardened → main after merging PRs feat(models): model registry reconciliation + persona seeds + readiness check #741–chore(submodules): bump transcribe-and-fetch + cipher for A2A parity #745
• Resolves 10 conflicting files (2 submodules, 2 A2A files, 3 SQL files, 1 tool, 1 doc, 1 migration)
• Security fixes from Hardened preserved: B-3 discovery auth (server.py), B-1 RLS auth.role() (01_public_init.sql)
• Feature additions from main included: model registry expansion, persona seeds, readiness check, TAC docs

Conflict Resolution Strategy

File	Kept From	Reason
PMOVES-transcribe-and-fetch	main	More recent submodule pointer
Pmoves-cipher	main	More recent submodule pointer
server.py (A2A)	Hardened	B-3 discovery auth fix
test_server.py (A2A)	Hardened	Aligned with server.py
01_public_init.sql	Hardened	B-1 RLS auth.role() fix
12_model_registry_seed.sql	main	Expanded model registry (#741)
studio_board_rls migration	main	Stricter RLS migration
persona_model_resolution migration	main	Latest persona view
model_readiness_check.py	main	Expanded from #741
TAC_MODEL_INFRA...md	main	Phase 1 completion updates

Test plan

• Verify no conflict markers remain in merged files
• Confirm A2A server.py has B-3 auth guard on discovery endpoint
• Confirm 01_public_init.sql has auth.role() = 'service_role' RLS
• After merge: API-merge main → Hardened for convergence

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added configurable public/private modes for agent discovery and task APIs via environment variables.
  • Introduced standard agent discovery endpoint with legacy path support and enhanced authentication error handling.

• Documentation

  • Updated A2A integration documentation reflecting new endpoint paths and security requirements.

• Chores

  • Improved resilience for optional dependencies.
  • Strengthened database security policies and deployment credential configuration.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f620734 and 08f984c.

📒 Files selected for processing (10)

• PMOVES-Agent-Zero
• pmoves/docker-compose.yml
• pmoves/docs/integrations/INTEGRATIONS.md
• pmoves/docs/reviews/2026-03-02/a2a-upstream-parity-review.md
• pmoves/services/agent-zero/python/features/a2a/server.py
• pmoves/services/agent-zero/python/features/a2a/test_server.py
• pmoves/services/agent-zero/python/features/a2a/types.py
• pmoves/services/chat-relay/main.py
• pmoves/services/pmoves-yt/yt.py
• pmoves/supabase/initdb/01_public_init.sql

---

📝 Walkthrough

Walkthrough

This PR introduces A2A discovery authentication gating with environment-driven public/private modes, adds fallback credential resolution in Docker configuration, improves dependency handling in chat-relay and YouTube services, updates A2A documentation and database RLS policies, and updates a submodule pointer.

Changes

Cohort / File(s)	Summary
A2A Discovery & Authentication pmoves/services/agent-zero/python/features/a2a/server.py, pmoves/services/agent-zero/python/features/a2a/test_server.py, pmoves/services/agent-zero/python/features/a2a/types.py	Introduced WELL_KNOWN_AGENT_CARD_PATH and LEGACY_AGENT_CARD_PATH constants. Added environment-driven public/private mode toggles (A2A_DISCOVERY_PUBLIC, A2A_TASKS_PUBLIC) with centralized auth helpers (_require_a2a_auth, _require_discovery_auth, _require_task_auth). Updated all A2A endpoints to accept and validate Authorization headers. Extended JWT error handling with WWW-Authenticate headers. Tests updated to include auth headers and verify 401 responses; added legacy path compatibility test.
A2A Documentation pmoves/docs/integrations/INTEGRATIONS.md, pmoves/docs/reviews/2026-03-02/a2a-upstream-parity-review.md	Updated integration docs to reflect canonical A2A discovery endpoint as /.well-known/agent-card.json with legacy /.well-known/agent.json alias; added dev-only public override section. Added new A2A Upstream Parity Review documenting findings and action items applied.
Service Dependency Handling pmoves/services/chat-relay/main.py, pmoves/services/pmoves-yt/yt.py	Implemented lazy imports and resilient dependency handling. Chat-relay now uses forward-reference string type for SupabaseClient and defers import to connect(). YouTube service wraps yt_dlp, boto3, and tenacity imports in try/except blocks with fallback stubs; raises HTTPException(503) at runtime if dependencies unavailable.
Infrastructure Configuration pmoves/docker-compose.yml	Modified model-registry SUPABASE_SERVICE_KEY to fall back to SUPABASE_SERVICE_ROLE_KEY with error if neither is set, replacing strict required-only pattern.
Database Policy & Submodule pmoves/supabase/initdb/01_public_init.sql, PMOVES-Agent-Zero (submodule)	Constrained studio_board RLS service_role policy to explicitly check auth.role() = 'service_role'. Updated submodule pointer to latest commit.

Sequence Diagram

sequenceDiagram
    participant Client
    participant Server as A2A Server
    participant EnvConfig as Environment Config
    participant Auth as JWT Validator

    Client->>Server: GET /.well-known/agent-card.json
    Server->>EnvConfig: Check A2A_DISCOVERY_PUBLIC
    
    alt Public Mode Enabled
        EnvConfig-->>Server: true
        Server-->>Client: Return Agent Card (200)
    else Public Mode Disabled
        EnvConfig-->>Server: false
        Server->>Server: Check Authorization header
        
        alt Header Present
            Server->>Auth: Validate JWT
            alt Token Valid
                Auth-->>Server: Valid
                Server-->>Client: Return Agent Card (200)
            else Token Invalid
                Auth-->>Server: Invalid
                Server-->>Client: 401 (WWW-Authenticate header)
            end
        else Header Missing
            Server-->>Client: 401 (WWW-Authenticate header)
        end
    end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• docs(agents): comprehensive AGENTS directory review and cross-reference fixes #742: Directly implements the A2A discovery endpoints, auth gating, and agent-card path changes that are core to this PR's authentication refactor.
• feat(service-discovery): add NATS-based service discovery infrastructure and personas-first architecture #493: Modifies the same model-registry service environment variable handling in docker-compose.yml for credential fallback resolution.
• feat(models): model registry reconciliation + persona seeds + readiness check #741: Updates the studio_board RLS policy to enforce auth.role() = 'service_role' constraint, aligning with database security patterns in this PR.

Poem

🐰 A2A paths now stand behind the gate,
With auth checks to regulate the state,
Public modes dance when flags do gleam,
Dependencies lazy in the service dream! ✨

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch sync/hardened-to-main

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}