diff --git a/.github/workflows/integrations-ghcr.matrix.json b/.github/workflows/integrations-ghcr.matrix.json index 197467bfed..d0bcc5e1a5 100644 --- a/.github/workflows/integrations-ghcr.matrix.json +++ b/.github/workflows/integrations-ghcr.matrix.json @@ -118,5 +118,53 @@ "platforms": "linux/amd64,linux/arm64", "generate_sbom": true, "trivy_ignorefile": "" + }, + { + "name": "a2ui-nats-bridge", + "git_url": "https://github.com/POWERFULMOVES/PMOVES.AI.git", + "ref": "main", + "context": "pmoves/services/a2ui-nats-bridge", + "dockerfile": "pmoves/services/a2ui-nats-bridge/Dockerfile", + "image_name": "pmoves-a2ui-nats-bridge", + "build_args": "", + "platforms": "linux/amd64,linux/arm64", + "generate_sbom": false, + "trivy_ignorefile": "" + }, + { + "name": "session-context-worker", + "git_url": "https://github.com/POWERFULMOVES/PMOVES.AI.git", + "ref": "main", + "context": "pmoves", + "dockerfile": "pmoves/services/session-context-worker/Dockerfile", + "image_name": "pmoves-session-context-worker", + "build_args": "", + "platforms": "linux/amd64,linux/arm64", + "generate_sbom": false, + "trivy_ignorefile": "" + }, + { + "name": "llama-throughput-lab", + "git_url": "https://github.com/POWERFULMOVES/PMOVES-llama-throughput-lab.git", + "ref": "main", + "context": ".", + "dockerfile": "Dockerfile", + "image_name": "pmoves-llama-throughput-lab", + "build_args": "", + "platforms": "linux/amd64", + "generate_sbom": false, + "trivy_ignorefile": "" + }, + { + "name": "tokenism-ui", + "git_url": "https://github.com/POWERFULMOVES/PMOVES.AI.git", + "ref": "main", + "context": "PMOVES-ToKenism-Multi/pmoves-nextjs", + "dockerfile": "PMOVES-ToKenism-Multi/pmoves-nextjs/Dockerfile", + "image_name": "pmoves-tokenism-ui", + "build_args": "", + "platforms": "linux/amd64,linux/arm64", + "generate_sbom": false, + "trivy_ignorefile": "" } ] diff --git a/PMOVES-ToKenism-Multi b/PMOVES-ToKenism-Multi index f093bf1cc4..0471493b94 160000 --- a/PMOVES-ToKenism-Multi +++ b/PMOVES-ToKenism-Multi @@ -1 +1 @@ -Subproject commit f093bf1cc467e46c896af3ce949a07c583cda7b7 +Subproject commit 0471493b946edca8e69f2754487a6fad01dc6cb4 diff --git a/pmoves/Makefile b/pmoves/Makefile index 121290a05a..e5a198c1c4 100644 --- a/pmoves/Makefile +++ b/pmoves/Makefile @@ -2181,7 +2181,7 @@ GHCR_PREPUBLISH_SCRIPT ?= tools/ghcr_local_prepublish.py GHCR_MATRIX_FILE ?= ../.github/workflows/integrations-ghcr.matrix.json GHCR_PREPUBLISH_TAG_SUFFIX ?= local-smoke GHCR_PREPUBLISH_PLATFORM ?= linux/amd64 -GHCR_LOCAL_INTEGRATIONS ?= agent-zero archon firefly-iii jellyfin pmoves-yt deepresearch supaserch +GHCR_LOCAL_INTEGRATIONS ?= agent-zero archon firefly-iii jellyfin pmoves-yt deepresearch supaserch a2ui-nats-bridge session-context-worker tokenism-ui .PHONY: buildx-setup docker-login buildx-setup: ## Ensure docker buildx builder exists and is bootstrapped @@ -2275,6 +2275,40 @@ ghcr-dispatch-supaserch: ci-runners-check-strict ## Dispatch GHCR workflow for S gh workflow run "$(GHCR_WORKFLOW)" --repo "$(GH_REPO)" --ref "$(GHCR_DISPATCH_REF)" $$args @echo "✔ Dispatched $(GHCR_WORKFLOW) for supaserch on ref $(GHCR_DISPATCH_REF)" +.PHONY: ghcr-build-one +ghcr-build-one: buildx-setup ## Build a single GHCR image locally: make ghcr-build-one IMAGE=agent-zero + @if [ -z "$(IMAGE)" ]; then echo "Usage: make ghcr-build-one IMAGE="; exit 1; fi + @$(PYTHON) $(GHCR_PREPUBLISH_SCRIPT) \ + --matrix-file "$(GHCR_MATRIX_FILE)" \ + --repo-root .. \ + --integration "$(IMAGE)" \ + --skip-trivy \ + --platform "$(GHCR_PREPUBLISH_PLATFORM)" \ + --builder "$(BUILDX_BUILDER)" \ + --tag-suffix "$(GHCR_PREPUBLISH_TAG_SUFFIX)" + +.PHONY: ghcr-prepublish-one +ghcr-prepublish-one: buildx-setup ## Build + Trivy gate a single image: make ghcr-prepublish-one IMAGE=agent-zero + @if [ -z "$(IMAGE)" ]; then echo "Usage: make ghcr-prepublish-one IMAGE="; exit 1; fi + @$(PYTHON) $(GHCR_PREPUBLISH_SCRIPT) \ + --matrix-file "$(GHCR_MATRIX_FILE)" \ + --repo-root .. \ + --integration "$(IMAGE)" \ + --platform "$(GHCR_PREPUBLISH_PLATFORM)" \ + --builder "$(BUILDX_BUILDER)" \ + --tag-suffix "$(GHCR_PREPUBLISH_TAG_SUFFIX)" + +.PHONY: ghcr-dispatch-one +ghcr-dispatch-one: ci-runners-check-strict ## Dispatch GHCR workflow for a single image: make ghcr-dispatch-one IMAGE=agent-zero + @if [ -z "$(IMAGE)" ]; then echo "Usage: make ghcr-dispatch-one IMAGE="; exit 1; fi + @args="-f integration=$(IMAGE) -f push_to_dockerhub=false"; \ + if [ -n "$(GHCR_NAMESPACE)" ]; then args="$$args -f ghcr_namespace=$(GHCR_NAMESPACE)"; fi; \ + gh workflow run "$(GHCR_WORKFLOW)" --repo "$(GH_REPO)" --ref "$(GHCR_DISPATCH_REF)" $$args + +.PHONY: ghcr-list +ghcr-list: ## List all images in the integrations-ghcr matrix + @$(PYTHON) -c "import json,pathlib;[print(e['name']) for e in json.loads(pathlib.Path('$(GHCR_MATRIX_FILE)').read_text())]" + .PHONY: deepresearch-smoke deepresearch-smoke: ## Publish a sample DeepResearch request and wait for a result (requires worker running) @ENV_FILE="$(CURDIR)/env.shared" bash -lc '. ./scripts/with-env.sh "$$ENV_FILE" && PYTHONPATH="$(CURDIR)/.." python3 tools/deepresearch_smoke.py --nats nats://localhost:4222 --timeout $${DEEPRESEARCH_SMOKE_TIMEOUT:-60}' diff --git a/pmoves/docs/NEXT_STEPS.md b/pmoves/docs/NEXT_STEPS.md index 4af8a4ee38..f74815d4f2 100644 --- a/pmoves/docs/NEXT_STEPS.md +++ b/pmoves/docs/NEXT_STEPS.md @@ -1,7 +1,34 @@ # PMOVES v5 • NEXT_STEPS Note: Consolidated plan index at pmoves/docs/PMOVES.AI PLANS/README_DOCS_INDEX.md. -_Last updated: 2026-03-06_ +_Last updated: 2026-03-07_ + +### Latest changes (Mar 7, 2026) +- Merge wave completed on `main`: 8 PRs merged in 3 batches + - Batch 1: `#814` (UI build fix), `#815` (smoke Supabase discovery), `#816` (healthcheck stability), `#817` (CI runner alignment), `#819` (DoX submodule bump) + - Batch 2: `#818` (model fabric + coding-plan wiring — rebased after 8 CodeRabbit comments) + - Batch 3: `#820` (distributed topology docs/examples), `#821` (chrome extension + 9 security fixes) +- Chrome extension security hardening (`#821`): + - auth credentials moved from `chrome.storage.sync` to `session` (memory-only) + - XSS eliminated in options page (innerHTML → createElement) + - mock server hardened (method allowlist, pathname parsing) + - `synthesizeAudio` timeout added (AbortController) + - processing status auto-cleanup (5min TTL) + - config race condition fixed (configReady promise) + - storage write serialization (promise queue) + - CSP added to manifest.json +- Distributed deployment documentation landed (`#820`): + - topology visualization with ASCII architecture diagrams + - example configs for local-network, Tailscale, and VPS deployments + - env.shared.example expanded with distributed config vars +- GHCR matrix gap analysis completed: + - 4 compose-referenced images lack CI build definitions: `a2ui-nats-bridge`, `llama-throughput-lab`, `session-context-worker`, `tokenism-ui` + - `ultimate-tts-studio` is in GHCR (manually pushed) but has no automated CI build + - `integrations-ghcr.matrix.json` covers 10 of 24 `images.yaml` entries +- Live backlog snapshot: + - Open PRs: `0` + - Dependabot alerts: `1` (`1 medium`) + - Code scanning alerts: `0` ### Latest changes (Mar 6, 2026) - Merge queue closeout completed on `main`: diff --git a/pmoves/docs/PMOVES.AI PLANS/ROADMAP.md b/pmoves/docs/PMOVES.AI PLANS/ROADMAP.md index 29711a374d..e83b229015 100644 --- a/pmoves/docs/PMOVES.AI PLANS/ROADMAP.md +++ b/pmoves/docs/PMOVES.AI PLANS/ROADMAP.md @@ -1,11 +1,15 @@ # PMOVES v5 • ROADMAP -Last updated: 2026-03-06 +Last updated: 2026-03-07 ## Vision A production-ready, self-hostable orchestration mesh for creative + agent workloads across GPU boxes and Jetsons: **hybrid Hi‑RAG**, **Supabase Studio**, **n8n orchestration**, **Jellyfin publishing**, and **graph-aware retrieval**. -## Audit Snapshot (2026-03-06) +## Audit Snapshot (2026-03-07) +- March 7 merge wave completed on `main`: `#814`, `#815`, `#816`, `#817`, `#818`, `#819`, `#820`, `#821` (8 PRs, 3 batches). +- Chrome extension security hardening landed in `#821`: 9 CodeRabbit review items addressed (auth storage isolation, XSS remediation, mock server hardening, timeout guards, state management fixes, CSP). +- Distributed topology documentation + examples landed in `#820`. +- GHCR matrix gap analysis: 4 compose-referenced images (`a2ui-nats-bridge`, `llama-throughput-lab`, `session-context-worker`, `tokenism-ui`) have no CI build definition — tracked as ops follow-up. - March 6 merge wave completed on `main`: `#797`, `#798`, `#799`, `#800`, `#802`, plus Dependabot workflow updates `#803`-`#807`. - Superseded lane cleanup completed: `#801` closed (scope incorporated into `#802`). - Production runtime re-validation passed after merge wave: diff --git a/pmoves/docs/PRODUCTION_AUDIT_DASHBOARD.md b/pmoves/docs/PRODUCTION_AUDIT_DASHBOARD.md index 4bf0a2f4c1..3a7ab04c10 100644 --- a/pmoves/docs/PRODUCTION_AUDIT_DASHBOARD.md +++ b/pmoves/docs/PRODUCTION_AUDIT_DASHBOARD.md @@ -3,7 +3,7 @@ > **Single source of truth** for PMOVES.AI production readiness. > Supersedes all individual audit documents accumulated Feb 7 -- Feb 18, 2026. -**Last Updated:** 2026-03-06 (merge queue closeout + production re-validation) +**Last Updated:** 2026-03-07 (8-PR merge wave + GHCR matrix gap analysis) **Branch:** `PMOVES.AI-Edition-Hardened` (production release lane) **Commit:** `96adc266` **Consolidated From:** 27 audit documents @@ -28,6 +28,54 @@ --- +## Latest Changes (Mar 7, 2026) + +- Merge wave completed on `main`: 8 PRs merged in 3 batches (#814-#821) + - Batch 1 (06:00 UTC): #814 UI build fix, #815 smoke Supabase discovery, #816 healthcheck stability, #817 CI runner alignment, #819 DoX submodule bump + - Batch 2 (07:01 UTC): #818 model fabric + coding-plan wiring (rebased after 8 CodeRabbit comments) + - Batch 3 (17:11 UTC): #820 distributed topology docs, #821 chrome extension (9 security fixes) +- Chrome extension security review completed (9/11 actionable CodeRabbit items addressed): + - `chrome.storage.sync` → `session` for auth credentials + - innerHTML XSS eliminated in options shapes display + - Mock server method allowlist + pathname routing + - `synthesizeAudio` timeout (AbortController) + - Processing status TTL cleanup + - Config load race condition (configReady promise) + - Storage read-modify-write serialization + - Content Security Policy added to manifest.json +- GHCR matrix gap analysis completed (see section below) +- Live metrics: Open PRs `0`, Dependabot `1` (medium), Code Scanning `0` + +--- + +### GHCR Matrix Gap Analysis (Mar 7, 2026) + +**Build pipelines:** +- `integrations-ghcr.yml` — 10 images (matrix-driven, multi-arch, Trivy + Cosign) +- `self-hosted-builds.yml` — 11 CPU + 2 GPU images (push-triggered, amd64) +- `build-images.yml` — 24 images from `images.yaml` (manual dispatch) + +**GHCR registry:** 23 packages published. + +**Compose → GHCR coverage gaps (4 truly missing):** + +| Service | Compose Image Reference | In GHCR? | In CI? | +|---------|------------------------|----------|--------| +| `a2ui-nats-bridge` | `ghcr.io/.../pmoves-a2ui-nats-bridge:pmoves-latest` | ❌ | ❌ | +| `llama-throughput-lab` | `ghcr.io/.../pmoves-llama-throughput-lab:latest` | ❌ | ❌ | +| `session-context-worker` | `ghcr.io/.../pmoves-session-context-worker:latest` | ❌ | ❌ | +| `tokenism-ui` | `ghcr.io/.../pmoves-tokenism-ui:pmoves-latest` | ❌ | ❌ | +| `ultimate-tts-studio` | `ghcr.io/.../pmoves-ultimate-tts-studio:pmoves-latest` | ✅ (manual) | ❌ | + +**Cross-reference gaps:** +- `integrations-ghcr.matrix.json` covers 10/24 `images.yaml` entries +- `self-hosted-builds.yml` builds 13 services not in `integrations-ghcr.matrix.json` +- 2 submodules in `images.yaml` still track `main` instead of `PMOVES.AI-Edition-Hardened` (`pmoves-botz`, `pmoves-tailscale`) + +**Recommendation:** Add build definitions for the 4 missing images, or convert their compose references to local `build:` directives if they're dev-only. + +--- + ## Latest Changes (Mar 6, 2026) - Merge queue closeout completed on `main`: @@ -85,7 +133,7 @@ | Metric | Value | |--------|-------| -| Quantitative snapshot timestamp | 2026-03-04 (live GitHub + local smoke/model-readiness snapshot) | +| Quantitative snapshot timestamp | 2026-03-07 (live GitHub + local smoke/model-readiness snapshot) | | Total tracked items | 24 | | Resolved | 23 (+1 since last update) | | Active blockers | 1 (self-hosted queue starvation) | @@ -93,8 +141,8 @@ | High | 1 | | Medium | 0 | | Low | 0 | -| CodeQL alerts (open) | **0 open** (live GitHub API on 2026-03-04) | -| Dependabot alerts | **1 open** (`1 medium`; live GitHub API on 2026-03-04) | +| CodeQL alerts (open) | **0 open** (live GitHub API on 2026-03-07) | +| Dependabot alerts | **1 open** (`1 medium`; live GitHub API on 2026-03-07) | | Open PRs | **0** | | CI queue | Hosted gates healthy; self-hosted queue starvation persists on CodeQL/GHCR lanes | diff --git a/pmoves/images.yaml b/pmoves/images.yaml index 08496dcb54..8d9b640e28 100644 --- a/pmoves/images.yaml +++ b/pmoves/images.yaml @@ -80,7 +80,7 @@ images: - name: pmoves-botz repo: PMOVES-BoTZ - ref: heads/main + ref: heads/PMOVES.AI-Edition-Hardened context: . dockerfile: Dockerfile image: ghcr.io/powerfulmoves/pmoves-botz @@ -101,7 +101,7 @@ images: - name: pmoves-tailscale repo: PMOVES-Tailscale - ref: heads/main + ref: heads/PMOVES.AI-Edition-Hardened context: . dockerfile: Dockerfile image: ghcr.io/powerfulmoves/pmoves-tailscale @@ -156,6 +156,29 @@ images: dockerfile: services/gpu-orchestrator/Dockerfile image: ghcr.io/powerfulmoves/pmoves-gpu-orchestrator + - name: pmoves-a2ui-nats-bridge + context: pmoves + dockerfile: services/a2ui-nats-bridge/Dockerfile + image: ghcr.io/powerfulmoves/pmoves-a2ui-nats-bridge + + - name: pmoves-session-context-worker + context: pmoves + dockerfile: services/session-context-worker/Dockerfile + image: ghcr.io/powerfulmoves/pmoves-session-context-worker + + - name: pmoves-tokenism-ui + repo: PMOVES-ToKenism-Multi + ref: heads/PMOVES.AI-Edition-Hardened + context: pmoves-nextjs + dockerfile: pmoves-nextjs/Dockerfile + image: ghcr.io/powerfulmoves/pmoves-tokenism-ui + + # GPU-heavy services (manual dispatch only — not in integrations-ghcr matrix) + - name: pmoves-ultimate-tts-studio + context: pmoves + dockerfile: docker/ultimate-tts-studio/Dockerfile + image: ghcr.io/powerfulmoves/pmoves-ultimate-tts-studio + # Submodule-backed services - name: pmoves-transcribe-backend repo: PMOVES-transcribe-and-fetch @@ -163,3 +186,10 @@ images: context: . dockerfile: backend/Dockerfile image: ghcr.io/powerfulmoves/pmoves-transcribe-backend + + - name: pmoves-llama-throughput-lab + repo: PMOVES-llama-throughput-lab + ref: heads/main + context: . + dockerfile: Dockerfile + image: ghcr.io/powerfulmoves/pmoves-llama-throughput-lab