fix(infra): resolve flute-gateway and bgutil-pot-provider healthcheck failures - #915
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Docker Hardening ValidationHardening Validation ReportValidated: Sat Mar 14 01:49:18 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe changes update Docker healthchecks to use PID existence checks instead of process scanning, extend timeouts and grace periods, and fix JWT payload decoding to correctly handle URL-safe Base64 encoding in UI utilities. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
pmoves/docs/AGENTS/CODEX_CLAUDE_PARITY_GAPS.md (1)
54-61: Documentation accurately reflects current parity gaps.The missing tokens are correctly identified. Per the coding guidelines for this file, consider adding these tokens to close the gaps:
chit:review-sweepchit:sign-traildocs:reconciletac:reviewThe corresponding parity map (
CODEX_CLAUDE_PARITY_MAP.md) should also be updated to maintain consistency.Would you like me to help draft the parity map entries for these missing tokens, or open an issue to track this work?
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/AGENTS/CODEX_CLAUDE_PARITY_GAPS.md` around lines 54 - 61, The docs list in CODEX_CLAUDE_PARITY_GAPS.md omits four tokens that should be added to close parity gaps; add the four tokens (`chit:review-sweep`, `chit:sign-trail`, `docs:reconcile`, `tac:review`) into the "Missing Tokens by Prefix" section and then update the corresponding parity map file CODEX_CLAUDE_PARITY_MAP.md to include matching entries for those exact token keys so documentation and the parity map remain consistent.pmoves/configs/tac_trees/agent-zero-customization.tac.yaml (1)
241-249: Grep pattern may produce false positives.The pattern
agent-zero:|healthcheck:will match any service that has ahealthcheck:block, not specifically the agent-zero service's healthcheck. This could lead to falsepassresults.Consider a more specific pattern that ensures both terms appear in proximity:
♻️ Suggested pattern refinement
- id: agent-zero.security.docker.healthcheck task: "Verify health check in compose" action: type: grep target: "pmoves/docker-compose.yml" - pattern: "agent-zero:|healthcheck:" + pattern: "agent-zero:(?:[\\s\\S]*?)healthcheck:" expect: "Docker compose includes healthcheck for agent-zero" context: "Required for orchestration and service discovery" agent_hint: codexAlternatively, consider using two separate checks or a manual review action for this verification.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/configs/tac_trees/agent-zero-customization.tac.yaml` around lines 241 - 249, The current check id agent-zero.security.docker.healthcheck uses the pattern "agent-zero:|healthcheck:" which can match a healthcheck in any service; update the check so it only passes when the agent-zero service has a healthcheck by making the grep target more specific or ensuring proximity — e.g., match "agent-zero:" followed within a few lines by "healthcheck:" or split into two checks (one that finds "agent-zero:" and a second that confirms a subsequent "healthcheck:" block) so false positives are eliminated; adjust the pattern or replace the single grep action with two actions that reference id agent-zero.security.docker.healthcheck (or new ids) accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@PMOVES-a0-plugins`:
- Line 1: Update the submodule pointer for PMOVES-a0-plugins to reference a real
commit on the PMOVES.AI-Edition-Hardened branch: replace the non-existent commit
8dfc1f63aee1881c5fc0b891c013ccb4b18b0f57 with the actual HEAD commit
00d6a87843f190c48b22e3b0c282c0a6a2a823a2 (or another valid commit from branch
PMOVES.AI-Edition-Hardened), commit the submodule update, and push the change so
submodule initialization succeeds.
In `@pmoves/ui/app/api/health/boot-jwt/route.ts`:
- Around line 9-11: The JWT payload decoding correctly converts base64url to
base64 in route.ts but the same conversion is missing in decodeJwtExp (function
decodeJwtExp) in pmoves/ui/lib/supabaseClient.ts and in the ownerIdFromToken
extraction in pmoves/ui/app/dashboard/ingest/page.tsx; update both to perform
.replace(/-/g, '+').replace(/_/g, '/') on the JWT parts[1] before calling
Buffer.from(..., 'base64') so the payload is decoded per RFC 7519 and parsed
reliably into JSON.
---
Nitpick comments:
In `@pmoves/configs/tac_trees/agent-zero-customization.tac.yaml`:
- Around line 241-249: The current check id
agent-zero.security.docker.healthcheck uses the pattern
"agent-zero:|healthcheck:" which can match a healthcheck in any service; update
the check so it only passes when the agent-zero service has a healthcheck by
making the grep target more specific or ensuring proximity — e.g., match
"agent-zero:" followed within a few lines by "healthcheck:" or split into two
checks (one that finds "agent-zero:" and a second that confirms a subsequent
"healthcheck:" block) so false positives are eliminated; adjust the pattern or
replace the single grep action with two actions that reference id
agent-zero.security.docker.healthcheck (or new ids) accordingly.
In `@pmoves/docs/AGENTS/CODEX_CLAUDE_PARITY_GAPS.md`:
- Around line 54-61: The docs list in CODEX_CLAUDE_PARITY_GAPS.md omits four
tokens that should be added to close parity gaps; add the four tokens
(`chit:review-sweep`, `chit:sign-trail`, `docs:reconcile`, `tac:review`) into
the "Missing Tokens by Prefix" section and then update the corresponding parity
map file CODEX_CLAUDE_PARITY_MAP.md to include matching entries for those exact
token keys so documentation and the parity map remain consistent.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 8dd60b24-6eda-496c-a607-0ba8269952ab
📒 Files selected for processing (9)
.gitmodulesPMOVES-Agent-ZeroPMOVES-a0-pluginspmoves/configs/tac_trees/agent-zero-customization.tac.yamlpmoves/docker-compose.ymlpmoves/docs/AGENTS/CODEX_CLAUDE_PARITY_GAPS.mdpmoves/ui/app/api/health/boot-jwt/route.tspmoves/ui/playwright.config.tspmoves/ui/scripts/with-env.mjs
- Increase flute-gateway healthcheck timeout to 15s, start_period to 60s - Replace pgrep healthcheck with kill -0 1 for bgutil-pot-provider - Fix JWT base64url decoding in boot-jwt route, supabaseClient, ingest page Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
b7a2904 to
2b4196e
Compare
Docker Hardening ValidationHardening Validation ReportValidated: Sat Mar 14 21:02:11 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
1 participant
Summary
pgrepwithkill -0 1(pgrep not available in the minimal container image)Testing
Restarted both services and verified health status:
bgutil-pot-provider: Now healthy (kill -0 1 works where pgrep failed)flute-gateway: Now healthy (60s start_period allows TTS provider initialization)docker compose ps flute-gateway bgutil-pot-provider # Both show (healthy)Fixes #882
Summary by CodeRabbit