docs(tac): TAC trees for Agent Zero, autoresearch, ClawZ, a0-plugins, Cipher + alignment analysis - #940
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📝 WalkthroughWalkthroughAdds three new agents to the registry (autoresearch, clawz, a0_plugins), updates CHIT/topology metadata and a timestamp, changes the Cipher API host:port across configs and service defaults, and adds numerous TACs, topology diagrams, animations, and operational documentation assets. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Docker Hardening ValidationHardening Validation ReportValidated: Sun Mar 15 07:27:59 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 18
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (4)
pmoves/services/gateway-agent/README.md (1)
229-245:⚠️ Potential issue | 🟠 MajorComplete the Cipher port migration across this README.
Lines 229 and 245 use
http://cipher-api:8096, but other sections in this same file still reference Cipher on3025(for example, troubleshooting), which creates conflicting operator guidance.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/services/gateway-agent/README.md` around lines 229 - 245, Update all references to Cipher in this README so they use the same port (3025) instead of the old 8096; specifically replace instances of "http://cipher-api:8096" (e.g., the CIPHER_URL env line in the env block and the -e CIPHER_URL=... in the "Manual Deployment" docker run example) with "http://cipher-api:3025", and scan the troubleshooting and any other examples to ensure no remaining references to 8096 remain so all CIPHER_URL examples are consistent.pmoves/docker-compose.vps.override.yml (1)
77-95:⚠️ Potential issue | 🔴 CriticalFix network isolation preventing
gateway-agentfrom reachingcipher-api.The override at lines 93–95 replaces
gateway-agent's networks with[pmoves-net, pmoves_api]. However,cipher-api(base config, line 2112) remains on[pmoves_app, pmoves_data, pmoves_bus]. These network sets do not intersect, so DNS resolution ofcipher-api:8096(line 77) will fail at runtime.The base configuration correctly shares
pmoves_appandpmoves_busbetween both services. The override must preserve at least one of these shared networks.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docker-compose.vps.override.yml` around lines 77 - 95, The override removes the shared Docker networks causing gateway-agent to be isolated from cipher-api; update the gateway-agent service networks in the override (the networks list under the gateway-agent entry) to include at least one of the networks that cipher-api is on (e.g., pmoves_app or pmoves_bus) so that gateway-agent can resolve cipher-api:8096, preserving the existing shared network(s) instead of replacing them with only pmoves-net and pmoves_api.pmoves/docs/TAC/TAC_BOTZ.md (1)
72-83:⚠️ Potential issue | 🟠 MajorCorrect the stale and inaccurate references in the auth security claim.
The P1 FIXED status is correct—the code does implement fail-closed behavior—but the documentation contains factual errors:
- Line numbers: The check is at lines 51–54, not 63–67
- Exception type: Uses
web.HTTPInternalServerError, notHTTPException(500)- Environment variable: Uses
SUPABASE_JWT_SECRET, notJWT_SECRET- Stale pattern description: The documented fail-open pattern (
if not JWT_SECRET: return True) does not match what was actually in the code; update the description to match the actual fix (raises exception on missing secret)Update lines 72, 82, 113, and 129 to reflect:
auth.py:51-54(not 63-67)web.HTTPInternalServerError(notHTTPException(500))SUPABASE_JWT_SECRET(notJWT_SECRET)- Replace the stale pattern description with the actual implementation: raises exception when secret is unset
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/TAC/TAC_BOTZ.md` around lines 72 - 83, Update the auth security claim to correct references: change the file reference to auth.py:51-54, replace the exception mention with web.HTTPInternalServerError, replace JWT_SECRET with SUPABASE_JWT_SECRET, and rewrite the stale fail-open pattern description to state the current behavior precisely (the code raises web.HTTPInternalServerError when SUPABASE_JWT_SECRET is unset) so the P1 FIXED entry and related lines reflect these exact symbols and behavior.pmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.md (1)
211-226:⚠️ Potential issue | 🟡 MinorMaturity matrix shows stale BoTZ auth status.
Line 216 still shows
Auth | P1 fail-openfor BoTZ, but Line 232 confirms this is now fixed. Update the matrix to reflect the corrected status.As per coding guidelines for
pmoves/docs/**: "Keep status claims aligned with evidence in runbooks and smokes."Proposed fix
-| **BoTZ** | Partial | Yes | P1 fail-open | Active | Yes | Partial | Stage 1 | +| **BoTZ** | Partial | Yes | Partial (fixed) | Active | Yes | Partial | Stage 1 |🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.md` around lines 211 - 226, The maturity matrix row for the submodule "BoTZ" has a stale Auth status ("P1 fail-open"); update the table cell under the "Auth" column for the "BoTZ" row to reflect the corrected status shown elsewhere in the doc (replace "P1 fail-open" with the fixed status), and scan the same table for any other inconsistency between the BoTZ runbook/smoke evidence and the matrix to ensure they match; locate the "BoTZ" row and the "Auth" column in the existing markdown table and change the cell value accordingly.
🧹 Nitpick comments (5)
pmoves/docs/operations/N8N_WORKFLOW_INVENTORY.md (1)
185-196: Consider documenting platform compatibility for operator commands.The operator commands use Makefile targets without indicating platform compatibility. Since the coding guidelines require checking for command drift across Windows/WSL/Linux instructions, consider adding a note about platform support or prerequisites.
📝 Suggested platform compatibility note
Add a platform note above the command section:
## Operator Commands +**Platform compatibility:** Requires `make` and Docker. On Windows, use WSL2 or Git Bash. + ```bash # Full bootstrap (API key + import + activate + sync) make -C pmoves n8n-bootstrapAs per coding guidelines, flag command drift across Windows/WSL/Linux instructions.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/operations/N8N_WORKFLOW_INVENTORY.md` around lines 185 - 196, Add a brief platform compatibility/prerequisites note above the Makefile commands explaining which OS/terminal environments are supported (e.g., Linux/macOS, WSL, Windows-native) and any prerequisites (GNU make, Docker, WSL enabled) and mention known drift or recommended alternatives for Windows users; reference the Make targets listed (n8n-bootstrap, up-n8n, n8n-api-bootstrap, n8n-import-flows, n8n-activate-flows, n8n-sync-supabase-registry, n8n-export-repo-flows) so readers know which commands the note applies to.pmoves/docs/operations/diagrams/network-routes.mmd (1)
35-39: Clarify NATS note scope to internal actors.The note at Line 35 currently spans
UsertoKVM2, which can read as user-facing NATS access. Tightening it to internal participants would avoid topology ambiguity.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/operations/diagrams/network-routes.mmd` around lines 35 - 39, The NATS note currently reads "Note over User,KVM2: NATS pub/sub (port 4222)" which implies user-facing access; change the note to cover only internal actors (for example "Note over KVM41,KVM42: NATS pub/sub (port 4222)") and/or update the text to say "internal NATS pub/sub (port 4222)" so the diagram clearly labels NATS as internal between KVM41 and KVM42 rather than User.pmoves/docs/TAC/TAC_A0_PLUGINS.md (1)
92-96: Add language specifier to fenced code block.The code block showing plugin structure would benefit from a language identifier for better readability.
Proposed fix
-``` +```text plugins/<plugin_name>/ ├── index.yaml # title, description, github URL, tags, screenshots └── thumbnail.png # Optional (square, ≤20KB)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/TAC/TAC_A0_PLUGINS.md` around lines 92 - 96, Update the fenced code block that documents the plugin directory structure to include a language specifier (e.g., use ```text) so syntax highlighters render it correctly; modify the block containing "plugins/<plugin_name>/", "index.yaml", and "thumbnail.png" to start with ```text instead of just ```.pmoves/docs/TAC/TAC_CLAWZ.md (1)
120-140: Add language specifier to fenced code block.The code block at line 120 is missing a language identifier, which affects syntax highlighting and linter compliance.
Proposed fix
-``` +```text PMOVES-ClawZ/ ├── src/ # Core source (CLI, commands, infra, media, routing)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/TAC/TAC_CLAWZ.md` around lines 120 - 140, The fenced code block showing the project tree (the block starting with ``` and the PMOVES-ClawZ/ directory listing in TAC_CLAWZ.md) lacks a language specifier; update that opening fence to include a language (e.g., ```text) so syntax highlighting and linters recognize it, leaving the rest of the directory tree content unchanged.pmoves/config/agent_registry.yaml (1)
1-2: Update the "Last updated" date in the file header.The header indicates
Last updated: 2026-03-01but this PR is dated 2026-03-15 and adds significant new entries.Proposed fix
# PMOVES Agent Registry — Single Source of Truth -# Last updated: 2026-03-01 +# Last updated: 2026-03-15🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/config/agent_registry.yaml` around lines 1 - 2, Update the header timestamp string "Last updated: 2026-03-01" in pmoves/config/agent_registry.yaml to reflect the current PR date (e.g., "Last updated: 2026-03-15"); locate the header comment line that begins with "Last updated:" and replace the date accordingly so the file metadata matches the changes in this PR.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pmoves/config/agent_registry.yaml`:
- Around line 1415-1445: The clawz registry entry currently has health: null but
TAC_CLAWZ.md documents a /healthz endpoint (implemented with a /readyz alias);
update the clawz.health field to reflect that implementation (e.g., set health
to "/healthz (implemented, alias /readyz)") so the agent_registry.yaml clawz
entry aligns with TAC_CLAWZ.md's documented /healthz and /readyz endpoints.
In `@pmoves/docs/AGENTS/BOTZ_GATEWAY_AGENT_INTEGRATION.md`:
- Line 282: The document contains conflicting Cipher endpoint references—update
all occurrences to a single canonical endpoint (match the environment variable
CIPHER_URL used in the diff) so examples and runbook steps are consistent;
search for and replace any references to :3025 and :8000 or alternate hostnames
with the chosen value (e.g., http://cipher-api:8096) and ensure the CIPHER_URL
examples, curl commands, and any smoke-test instructions use that same endpoint
string.
In `@pmoves/docs/AGENTS/DEEP_DIVE_ALIGNMENT_2026-03-15.md`:
- Line 20: Change the platform name to the official capitalization "YouTube"
wherever it appears in prose while leaving the plugin id `youtube_transcribe`
unchanged; specifically update the table header entry that currently reads
"youtube_transcribe (a0-plugin) | PMOVES.YT" and any other prose occurrences of
the lowercase platform name (e.g., the instance referenced alongside
`youtube_transcribe`) so the platform is written as "YouTube" but keep
identifiers like `youtube_transcribe` and `PMOVES.YT` exactly as-is.
- Line 32: The document contains contradictory BoTZ JWT verification status: the
table row "Auth model | DM pairing + bootstrap tokens per channel | JWT
verification (currently fail-open)" conflicts with later statements at lines
referencing "fail-closed"; pick the correct, evidence-backed state (either
"fail-open" or "fail-closed") and make all mentions consistent by updating the
table cell text and the paragraphs at the locations that currently state the
opposite; additionally, add a brief parenthetical citation or footnote
referencing the authoritative source (e.g., design spec or commit/PR id) to
justify the chosen status so readers can verify the claim.
- Line 35: The markdown table has a malformed row: the row "| **Alignment need**
| Different security domains — need shared auth strategy for when ClawZ
delegates to BoTZ skills |" has fewer cells than the header requires, triggering
MD056; update that row to include the same number of pipe-separated cells as the
table header (add the missing cell(s) or placeholders like "-" to match the
header columns) so the table's columns align with the header and render
correctly.
- Line 146: The doc claim is too broad: while compose files and gateway-agent
use cipher-api:8096, the library pmoves-cipher-mcp still falls back to
http://localhost:8096 in pmoves_registry/__init__.py (CIPHER_URL default).
Either narrow the doc line to explicitly state "docker-compose files and
gateway-agent aligned to cipher-api:8096; pmoves-cipher-mcp still defaults to
http://localhost:8096" or change the library default CIPHER_URL in
pmoves_registry.__init__.py to "http://cipher-api:8096" (and update any
tests/configs that assume localhost) so the wording and code are consistent.
- Line 55: The context catalogs are missing six NATS subjects and two service
entries; update .claude/context/nats-subjects.md to add the subjects
research.autoresearch.experiment.v1, research.autoresearch.result.v1,
openclaw.message.received.v1, openclaw.channel.connected.v1,
cipher.memory.stored.v1, and cipher.memory.searched.v1 with brief descriptions
and ownership, and update .claude/context/services-catalog.md to add service
entries for autoresearch and ClawZ (include ports, health endpoints, NATS topics
and dependencies) using pmoves/docs/TAC/TAC_AUTORESEARCH.md and
pmoves/docs/TAC/TAC_CLAWZ.md as authoritative references; also verify/update
existing Cipher and Agent Zero entries for alignment with the TAC documents.
In `@pmoves/docs/operations/diagrams/model-stack.mmd`:
- Around line 24-37: The Large tier label ("subgraph large" / Q32B) currently
states "48GB+" but its hardware mapping uses "RTX 5090 32GB" (GPU2); update
either the tier threshold or the mapped hardware so they match—for example
change the Large tier label to "32GB+ (RTX 5090)" or replace the GPU2 mapping
with a 48GB-capable card (or cloud equivalent) and update the GPU2 node text
accordingly; ensure the change is applied to the "subgraph large" block and the
corresponding mapping line large ---|"RTX 5090<br/>32GB"| GPU2 so capacity
planning remains accurate.
In `@pmoves/docs/operations/N8N_WORKFLOW_INVENTORY.md`:
- Around line 121-132: The centralized NATS subject registry is missing three
subjects from the n8n workflow inventory; add entries for
content.publish.approved.v1 (source: approval_poller), channel.new.content.v1
(source: pmoves_channel_monitor), and geometry.cgp.v1 (source: multiple
workflows / Hi-RAG) to .claude/context/nats-subjects.md with the same
description metadata format as the existing ones, and annotate geometry.cgp.v1
to indicate multiple sources; then replace the generic NATS ACLs (publish: ">",
subscribe: ">") with explicit subject-level permissions in your NATS
configuration—list allowed publish and subscribe subjects (e.g.,
content.publish.approved.v1, channel.new.content.v1, geometry.cgp.v1,
research.deepresearch.request.v1, finance.monthly.summary.v1,
health.weekly.summary.v1, ingest.transcript.ready.v1) and map them to the
appropriate workflow/service identities so the registry and ACLs remain in sync.
- Around line 135-152: The Service Dependencies table in the Service
Dependencies section of N8N_WORKFLOW_INVENTORY.md duplicates the centralized
services catalog; remove the inline table and replace it with a single
cross-reference sentence pointing readers to the canonical
`.claude/context/services-catalog.md` for port assignments and health endpoints,
and update any example workflow references (e.g., Supabase, Agent Zero, Hi-RAG
v2, ffmpeg-Whisper, Extract Worker, Flute-Gateway, ComfyUI, DeepResearch,
PMOVES.YT) to reference the catalog entry instead of listing host:port details
in this file.
- Line 5: Update the N8N_WORKFLOW_INVENTORY.md "Source:" line to point to
pmoves/n8n/flows/ (replace the incorrect PMOVES-n8n/workflows/), add the missing
workflow filename github_webhook_auto_config.json to the listed workflows so the
count matches 35, and remove the NATS subjects and Service dependencies sections
(the block currently under the "NATS subjects" and the block under "Service
dependencies") from this document and instead place their contents into the
designated context files (.claude/context/nats-subjects.md and
.claude/context/services-catalog.md) so the inventory only lists workflows and
delegates NATS/services metadata to the proper context documents.
In `@pmoves/docs/TAC/TAC_AGENT_ZERO.md`:
- Line 119: The sentence stating "NATS subject surface is minimal (1 publish, 1
subscribe)" is inconsistent with the earlier table that documents "1 publish and
2 subscribes"; update the text in TAC_AGENT_ZERO.md so the NATS surface
description matches the table (either change the sentence to "1 publish, 2
subscribes" or adjust the table if the intended surface is actually 1
subscribe), and ensure any surrounding wording about lifecycle events (e.g.,
publishing task lifecycle events) reflects the corrected publish/subscribe
counts.
- Around line 10-13: Update the Agent Zero service entry in services-catalog.md
so it matches TAC: add the missing health and metrics endpoints and submodule
reference by including "Health | `GET /healthz`, `GET /mcp/health`", "Metrics |
`GET /metrics`", and "Submodule | `PMOVES-Agent-Zero`" in the Agent Zero service
block (the same block that lists Ports 8080/8081 and the Agent Zero title).
In `@pmoves/docs/TAC/TAC_AUTORESEARCH.md`:
- Around line 41-49: Update the shared context docs to mirror the new
autoresearch service and NATS subjects: add the autoresearch service entry
(name: autoresearch, type: CLI tool, tier: llm, evolution: Pre-Stage, include
port assignment and health endpoint) to .claude/context/services-catalog.md and
add the two NATS subjects research.autoresearch.experiment.v1 and
research.autoresearch.result.v1 (with direction Publishes (planned) and brief
descriptions: experiment started/completed events and val_bpb results) to
.claude/context/nats-subjects.md so both catalogs stay in sync with
TAC_AUTORESEARCH.md.
In `@pmoves/docs/TAC/TAC_CIPHER.md`:
- Line 105: The fenced code blocks containing the ASCII diagrams are missing
language identifiers (triggering markdownlint MD040); update the opening
backticks for the two diagram blocks (the triple-backtick fences that contain
the ASCII art/diagram around the "┌──────────────┐" block and the "Claude Code
CLI ──stdio──► cipher_mcp (Python)" block) to include a language tag such as
"text" (i.e., change ``` to ```text) so both fenced blocks declare a language.
- Around line 149-155: The doc lists "CIPHER_URL default mismatch between
gateway-agent and actual deployment" and "Missing `.gitignore` in
`pmoves-cipher-mcp/`" as open items but you've already marked them Fixed
earlier; update TAC_CIPHER.md to remove or change those two bullets to "Fixed"
(or delete them) and add a short evidence note or link to the runbook/smoke that
shows the fixes (e.g., gateway-agent config change and added .gitignore in
pmoves-cipher-mcp) so the checklist is internally consistent; specifically edit
the checklist section containing those bullet strings to reflect the Fixed
status and include the supporting references.
In `@pmoves/docs/TAC/TAC_CLAWZ.md`:
- Around line 65-75: The Production Audit Checklist contradicts the Open Items:
the `/healthz` row in the "Production Audit Checklist" table is marked GREEN
while the "Open Items" section says there is no `/healthz` or `/metrics`;
reconcile by either verifying that the `/healthz` endpoint actually exists and
updating the "Open Items" to remove the missing note and reference the
runbook/smoke test, or if it does not exist change the checklist row for
`/healthz` from GREEN to MISSING (and update Notes to reflect evidence), and
ensure the runbook/smoke references (or absence) are consistent with the updated
status; look for the table row with `/healthz` and the "Open Items" mention of
`/healthz` to make the edits.
In `@pmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.md`:
- Around line 5-7: The "Related Documents" section header claims "TAC Trees (13
total)" but the list is missing TAC_INTEGRATION_TOPOLOGY.md (causing a count
mismatch); open TAC_INTEGRATION_TOPOLOGY.md, locate the "Related Documents" ->
header that reads "TAC Trees (13 total)" and either (a) decrement the count to
"TAC Trees (12 total)" to reflect the current list, or (b) add a self-reference
entry for "TAC_INTEGRATION_TOPOLOGY.md" into the listed TAC files so the header
remains correct; update only the header or the list accordingly so the header
number and items are consistent.
---
Outside diff comments:
In `@pmoves/docker-compose.vps.override.yml`:
- Around line 77-95: The override removes the shared Docker networks causing
gateway-agent to be isolated from cipher-api; update the gateway-agent service
networks in the override (the networks list under the gateway-agent entry) to
include at least one of the networks that cipher-api is on (e.g., pmoves_app or
pmoves_bus) so that gateway-agent can resolve cipher-api:8096, preserving the
existing shared network(s) instead of replacing them with only pmoves-net and
pmoves_api.
In `@pmoves/docs/TAC/TAC_BOTZ.md`:
- Around line 72-83: Update the auth security claim to correct references:
change the file reference to auth.py:51-54, replace the exception mention with
web.HTTPInternalServerError, replace JWT_SECRET with SUPABASE_JWT_SECRET, and
rewrite the stale fail-open pattern description to state the current behavior
precisely (the code raises web.HTTPInternalServerError when SUPABASE_JWT_SECRET
is unset) so the P1 FIXED entry and related lines reflect these exact symbols
and behavior.
In `@pmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.md`:
- Around line 211-226: The maturity matrix row for the submodule "BoTZ" has a
stale Auth status ("P1 fail-open"); update the table cell under the "Auth"
column for the "BoTZ" row to reflect the corrected status shown elsewhere in the
doc (replace "P1 fail-open" with the fixed status), and scan the same table for
any other inconsistency between the BoTZ runbook/smoke evidence and the matrix
to ensure they match; locate the "BoTZ" row and the "Auth" column in the
existing markdown table and change the cell value accordingly.
In `@pmoves/services/gateway-agent/README.md`:
- Around line 229-245: Update all references to Cipher in this README so they
use the same port (3025) instead of the old 8096; specifically replace instances
of "http://cipher-api:8096" (e.g., the CIPHER_URL env line in the env block and
the -e CIPHER_URL=... in the "Manual Deployment" docker run example) with
"http://cipher-api:3025", and scan the troubleshooting and any other examples to
ensure no remaining references to 8096 remain so all CIPHER_URL examples are
consistent.
---
Nitpick comments:
In `@pmoves/config/agent_registry.yaml`:
- Around line 1-2: Update the header timestamp string "Last updated: 2026-03-01"
in pmoves/config/agent_registry.yaml to reflect the current PR date (e.g., "Last
updated: 2026-03-15"); locate the header comment line that begins with "Last
updated:" and replace the date accordingly so the file metadata matches the
changes in this PR.
In `@pmoves/docs/operations/diagrams/network-routes.mmd`:
- Around line 35-39: The NATS note currently reads "Note over User,KVM2: NATS
pub/sub (port 4222)" which implies user-facing access; change the note to cover
only internal actors (for example "Note over KVM41,KVM42: NATS pub/sub (port
4222)") and/or update the text to say "internal NATS pub/sub (port 4222)" so the
diagram clearly labels NATS as internal between KVM41 and KVM42 rather than
User.
In `@pmoves/docs/operations/N8N_WORKFLOW_INVENTORY.md`:
- Around line 185-196: Add a brief platform compatibility/prerequisites note
above the Makefile commands explaining which OS/terminal environments are
supported (e.g., Linux/macOS, WSL, Windows-native) and any prerequisites (GNU
make, Docker, WSL enabled) and mention known drift or recommended alternatives
for Windows users; reference the Make targets listed (n8n-bootstrap, up-n8n,
n8n-api-bootstrap, n8n-import-flows, n8n-activate-flows,
n8n-sync-supabase-registry, n8n-export-repo-flows) so readers know which
commands the note applies to.
In `@pmoves/docs/TAC/TAC_A0_PLUGINS.md`:
- Around line 92-96: Update the fenced code block that documents the plugin
directory structure to include a language specifier (e.g., use ```text) so
syntax highlighters render it correctly; modify the block containing
"plugins/<plugin_name>/", "index.yaml", and "thumbnail.png" to start with
```text instead of just ```.
In `@pmoves/docs/TAC/TAC_CLAWZ.md`:
- Around line 120-140: The fenced code block showing the project tree (the block
starting with ``` and the PMOVES-ClawZ/ directory listing in TAC_CLAWZ.md) lacks
a language specifier; update that opening fence to include a language (e.g.,
```text) so syntax highlighting and linters recognize it, leaving the rest of
the directory tree content unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 8fc59509-5d37-41cd-838b-459969b4378e
📒 Files selected for processing (23)
pmoves/config/agent_registry.yamlpmoves/docker-compose.vps.override.ymlpmoves/docs/AGENTS/BOTZ_GATEWAY_AGENT_INTEGRATION.mdpmoves/docs/AGENTS/DEEP_DIVE_ALIGNMENT_2026-03-15.mdpmoves/docs/TAC/TAC_A0_PLUGINS.mdpmoves/docs/TAC/TAC_AGENT_ZERO.mdpmoves/docs/TAC/TAC_AUTORESEARCH.mdpmoves/docs/TAC/TAC_BOTZ.mdpmoves/docs/TAC/TAC_CIPHER.mdpmoves/docs/TAC/TAC_CLAWZ.mdpmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.mdpmoves/docs/operations/N8N_WORKFLOW_INVENTORY.mdpmoves/docs/operations/animations/agent-teams-pulse.jsonpmoves/docs/operations/animations/topology-flythrough.jsonpmoves/docs/operations/diagrams/README.mdpmoves/docs/operations/diagrams/agent-teams.mmdpmoves/docs/operations/diagrams/ci-runner-flow.mmdpmoves/docs/operations/diagrams/dns-subdomain-map.mmdpmoves/docs/operations/diagrams/model-stack.mmdpmoves/docs/operations/diagrams/network-routes.mmdpmoves/docs/operations/diagrams/node-topology.mmdpmoves/services/gateway-agent/README.mdpmoves/services/gateway-agent/app.py
Docker Hardening ValidationHardening Validation ReportValidated: Sun Mar 15 09:22:34 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (5)
pmoves/docs/AGENTS/DEEP_DIVE_ALIGNMENT_2026-03-15.md (1)
32-35:⚠️ Potential issue | 🟠 MajorBoTZ auth state is still contradictory in this table.
Line 32 says fail-closed after the fix, but Line 34 still labels the risk as a P1 fail-open vulnerability. Please update the risk row to reflect the post-fix state (or explicitly mark it as historical).
As per coding guidelines
pmoves/docs/**: Check docs for operational accuracy: Keep status claims aligned with evidence in runbooks and smokes.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/AGENTS/DEEP_DIVE_ALIGNMENT_2026-03-15.md` around lines 32 - 35, Update the "Risk" row in the table so it reflects the post-fix behavior described in the "Auth model" and the JWT verification fix (see auth.py:63-67) — either change "P1 fail-open vulnerability" to the current state (e.g., "Mitigated: fail-closed after JWT verification fix") or explicitly mark it as historical (e.g., "Historical: was P1 fail-open, now mitigated by fix in auth.py:63-67"); ensure the table's "Risk" cell language matches the asserted post-fix state elsewhere in the doc.pmoves/docs/TAC/TAC_AUTORESEARCH.md (1)
50-50:⚠️ Potential issue | 🟠 MajorDon’t defer shared catalog sync behind a TODO.
Line 50 defers NATS/topic registration to “when implemented,” but this TAC already introduces concrete planned subjects and service metadata. Please update the shared context catalogs in the same change set so TAC and central inventories stay aligned.
As per coding guidelines
**/*.md: "Document NATS event topology in.claude/context/nats-subjects.mdand maintain services catalog with port assignments and health endpoints in.claude/context/services-catalog.md".🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/TAC/TAC_AUTORESEARCH.md` at line 50, The TAC currently leaves NATS/topic and service catalog registration as a TODO in TAC_AUTORESEARCH.md; update the shared catalogs in the same change set by adding the new NATS subjects and service metadata declared in this TAC to `.claude/context/nats-subjects.md` and `pmoves/contracts/topics.json`, and add the service entry (name, port, health endpoint, and brief description) to `.claude/context/services-catalog.md` so the TAC and central inventories remain aligned. Ensure the subject names exactly match those introduced in TAC_AUTORESEARCH.md and include any expected message schemas or version tags in topics.json, and commit all three files together.pmoves/docs/AGENTS/BOTZ_GATEWAY_AGENT_INTEGRATION.md (1)
282-282:⚠️ Potential issue | 🟠 MajorEndpoint alignment is still inconsistent in the same runbook example.
Line 282 and Line 429 use
cipher-api:8096, but the compose block still exposes Cipher aspmoves-botz-cipheron8000:8000(Line 322). Please make the embedded deployment example and port reference table agree on one canonical endpoint/port to avoid broken copy-paste deployment steps.As per coding guidelines
pmoves/docs/**: Check docs for operational accuracy: Keep status claims aligned with evidence in runbooks and smokes.Also applies to: 429-429
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/AGENTS/BOTZ_GATEWAY_AGENT_INTEGRATION.md` at line 282, The runbook has inconsistent Cipher endpoints: update all occurrences so they use a single canonical endpoint and port (either cipher-api:8096 or pmoves-botz-cipher:8000) — e.g., change the CIPHER_URL value and the port reference table and compose service mapping to match; ensure the CIPHER_URL key, the embedded compose service name pmoves-botz-cipher and its ports (8000:8000) and the other references (the instances around the current CIPHER_URL lines and the occurrence near line 429) are all updated to the same hostname:port combination so copy/paste deployments work correctly.pmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.md (1)
263-275:⚠️ Potential issue | 🟡 MinorTAC count header does not match the listed items.
Line 263 says “13 total,” but Lines 264-275 list 12 TAC files. Either change the header to 12 or add the missing self-reference explicitly.
As per coding guidelines
pmoves/docs/**: Check docs for operational accuracy: Keep status claims aligned with evidence in runbooks and smokes.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.md` around lines 263 - 275, The TAC Trees count is wrong: the header "TAC Trees (13 total)" does not match the 12 listed entries (TAC_AGENT_ZERO.md, TAC_BOTZ.md, TAC_DOX.md, TAC_TOKENISM.md, TAC_HEALTH.md, TAC_WEALTH.md, TAC_FLUTE.md, TAC_CIPHER.md, TAC_CLAWZ.md, TAC_AUTORESEARCH.md, TAC_A0_PLUGINS.md, TAC_MODEL_INFRA_PERSONA_PROD_READINESS.md); fix by updating the TAC Trees header to "TAC Trees (12 total)" or alternatively add the missing TAC entry (if an omitted file should be listed) so the numeric claim and the list of filenames match.pmoves/docs/operations/N8N_WORKFLOW_INVENTORY.md (1)
5-5:⚠️ Potential issue | 🟠 MajorSource path appears stale against the documented canonical location.
Line 5 still points to
PMOVES-n8n/workflows/, which was previously flagged as non-canonical versus the repo flow path. Please switch this reference to the canonical in-repo workflow directory to prevent operator drift.As per coding guidelines
pmoves/docs/**: Check docs for operational accuracy: Flag command drift across Windows/WSL/Linux instructions.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/operations/N8N_WORKFLOW_INVENTORY.md` at line 5, The docs entry in N8N_WORKFLOW_INVENTORY.md still references the stale path string `PMOVES-n8n/workflows/`; update the Source line to point to the canonical in-repo n8n workflow directory used by this repository (replace the `PMOVES-n8n/workflows/` token in the file with the repository's canonical workflow path) so the documented canonical JSON location matches the actual repo flow.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pmoves/docs/operations/N8N_WORKFLOW_INVENTORY.md`:
- Line 3: The document claims "Comprehensive catalog of all 34 n8n workflows"
but the catalog body shows a "Total: 35" and the "Health/Wellness" section lists
4 entries while claiming 3; reconcile by either removing the extra workflow
entry or updating the summary counts to match the actual list. Specifically,
update the top summary phrase (the "34 workflows" statement), the overall
"Total" line, and the "Health/Wellness" section count so all three places
(header summary, total count, and Health/Wellness count) consistently reflect
the true number of workflows and entries in the list.
- Around line 126-135: Remove the duplicated NATS subject rows for
content.publish.approved.v1 and channel.new.content.v1 in the subjects table so
each subject appears only once; locate the table rows containing the subject
identifiers content.publish.approved.v1 and channel.new.content.v1 and delete
the repeated entries (leaving the first occurrence for each) to make the
inventory deterministic and avoid duplicate workflow mappings.
---
Duplicate comments:
In `@pmoves/docs/AGENTS/BOTZ_GATEWAY_AGENT_INTEGRATION.md`:
- Line 282: The runbook has inconsistent Cipher endpoints: update all
occurrences so they use a single canonical endpoint and port (either
cipher-api:8096 or pmoves-botz-cipher:8000) — e.g., change the CIPHER_URL value
and the port reference table and compose service mapping to match; ensure the
CIPHER_URL key, the embedded compose service name pmoves-botz-cipher and its
ports (8000:8000) and the other references (the instances around the current
CIPHER_URL lines and the occurrence near line 429) are all updated to the same
hostname:port combination so copy/paste deployments work correctly.
In `@pmoves/docs/AGENTS/DEEP_DIVE_ALIGNMENT_2026-03-15.md`:
- Around line 32-35: Update the "Risk" row in the table so it reflects the
post-fix behavior described in the "Auth model" and the JWT verification fix
(see auth.py:63-67) — either change "P1 fail-open vulnerability" to the current
state (e.g., "Mitigated: fail-closed after JWT verification fix") or explicitly
mark it as historical (e.g., "Historical: was P1 fail-open, now mitigated by fix
in auth.py:63-67"); ensure the table's "Risk" cell language matches the asserted
post-fix state elsewhere in the doc.
In `@pmoves/docs/operations/N8N_WORKFLOW_INVENTORY.md`:
- Line 5: The docs entry in N8N_WORKFLOW_INVENTORY.md still references the stale
path string `PMOVES-n8n/workflows/`; update the Source line to point to the
canonical in-repo n8n workflow directory used by this repository (replace the
`PMOVES-n8n/workflows/` token in the file with the repository's canonical
workflow path) so the documented canonical JSON location matches the actual repo
flow.
In `@pmoves/docs/TAC/TAC_AUTORESEARCH.md`:
- Line 50: The TAC currently leaves NATS/topic and service catalog registration
as a TODO in TAC_AUTORESEARCH.md; update the shared catalogs in the same change
set by adding the new NATS subjects and service metadata declared in this TAC to
`.claude/context/nats-subjects.md` and `pmoves/contracts/topics.json`, and add
the service entry (name, port, health endpoint, and brief description) to
`.claude/context/services-catalog.md` so the TAC and central inventories remain
aligned. Ensure the subject names exactly match those introduced in
TAC_AUTORESEARCH.md and include any expected message schemas or version tags in
topics.json, and commit all three files together.
In `@pmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.md`:
- Around line 263-275: The TAC Trees count is wrong: the header "TAC Trees (13
total)" does not match the 12 listed entries (TAC_AGENT_ZERO.md, TAC_BOTZ.md,
TAC_DOX.md, TAC_TOKENISM.md, TAC_HEALTH.md, TAC_WEALTH.md, TAC_FLUTE.md,
TAC_CIPHER.md, TAC_CLAWZ.md, TAC_AUTORESEARCH.md, TAC_A0_PLUGINS.md,
TAC_MODEL_INFRA_PERSONA_PROD_READINESS.md); fix by updating the TAC Trees header
to "TAC Trees (12 total)" or alternatively add the missing TAC entry (if an
omitted file should be listed) so the numeric claim and the list of filenames
match.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 5ad82685-82da-42d0-ba5d-e5a79606fae3
📒 Files selected for processing (11)
pmoves/config/agent_registry.yamlpmoves/docs/AGENTS/BOTZ_GATEWAY_AGENT_INTEGRATION.mdpmoves/docs/AGENTS/DEEP_DIVE_ALIGNMENT_2026-03-15.mdpmoves/docs/TAC/TAC_A0_PLUGINS.mdpmoves/docs/TAC/TAC_AGENT_ZERO.mdpmoves/docs/TAC/TAC_AUTORESEARCH.mdpmoves/docs/TAC/TAC_CIPHER.mdpmoves/docs/TAC/TAC_CLAWZ.mdpmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.mdpmoves/docs/operations/N8N_WORKFLOW_INVENTORY.mdpmoves/docs/operations/diagrams/model-stack.mmd
🚧 Files skipped from review as they are similar to previous changes (2)
- pmoves/docs/TAC/TAC_CIPHER.md
- pmoves/docs/operations/diagrams/model-stack.mmd
…nventory - 6 Mermaid diagrams: node topology, network routes, CI runner flow, agent teams, DNS subdomain map, model stack - 2 Remotion/A2UI animation specs: topology flythrough, agent teams pulse - Complete n8n workflow inventory (34 workflows cataloged with skill-pairing cross-references) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add missing node affinity edges for ui, automation, sandbox, life, external teams - Clarify NATS port mapping: 4222 (client) vs 9222 (WebSocket) in DNS diagram - Fix mmdc CLI path references in diagrams README - Separate internal Docker vs public endpoint tables in N8N inventory Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- dns-subdomain-map: Grafana host port is 3002 (3000 is container-internal) - animation specs: $schema path was ../../contracts, correct is ../../../contracts Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Z890 services (Hi-RAG, Agent Zero) query data stores on KVM4-2 (Qdrant, Neo4j, Meilisearch) directly, but this edge was missing from the diagram. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ins, Cipher - TAC_AGENT_ZERO.md: Control-plane orchestrator (Mega, full CHIT) - TAC_AUTORESEARCH.md: Autonomous ML training loop (Pre-Stage) - TAC_CLAWZ.md: OpenClaw multi-channel gateway (Pre-Stage, 47 extensions) - TAC_A0_PLUGINS.md: Agent Zero plugin index with overlap analysis - TAC_CIPHER.md: Knowledge-graph memory & resilience backbone Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- TAC_BOTZ.md: add deep-dive findings, plugin overlap, cross-links - TAC_INTEGRATION_TOPOLOGY.md: v1.0→v2.0 (6→13 TAC trees, expanded diagrams/matrix) - agent_registry.yaml: 3 new entries (autoresearch, clawz, a0_plugins) + topology/chit_integration on 3 existing Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Cross-submodule findings: 4 service overlaps, 4 integration gaps, 5 enhancement proposals (E1-E5), production readiness matrix. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…Cipher URL aligned - TAC_BOTZ.md: auth.py:63-67 already raises HTTPException(500), mark P1 as fixed - TAC_INTEGRATION_TOPOLOGY.md: strikethrough BoTZ P1 action item (already fixed) - DEEP_DIVE_ALIGNMENT: update maturity matrix + priority list for fixed P1s - Fix CIPHER_URL defaults to cipher-api:8096 in: - docker-compose.vps.override.yml - services/gateway-agent/app.py - services/gateway-agent/README.md (2 occurrences) - BOTZ_GATEWAY_AGENT_INTEGRATION.md - TAC_CIPHER.md: update P1 status to fully fixed Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…dpoint alignment, VRAM tier - Fix ClawZ health endpoint in agent_registry.yaml, update timestamp - Standardize Cipher endpoint to :8096 in BOTZ_GATEWAY diagram/appendix - Fix BoTZ auth status contradiction (fail-closed, not fail-open) - Fix malformed table row and YouTube capitalization in deep-dive - Narrow CIPHER_URL "all aligned" claim — note library defaults differ - Add catalog registration notes for planned NATS subjects - Fix VRAM tier: Large = 32-48GB (matches RTX 5090 32GB mapping) - Fix n8n inventory: add missing wger workflow, replace inline service table with services-catalog cross-reference, add 2 missing subjects - Fix NATS surface count in TAC_AGENT_ZERO (1 pub, 2 subs) - Add text language identifiers to code fences (MD040) - Fix stale open items in TAC_CIPHER (mark CIPHER_URL + gitignore fixed) - Fix /healthz contradiction in TAC_CLAWZ (implemented, not missing) - Fix TAC tree count in integration topology (12 + this = 13) - Update BoTZ maturity: "Fail-closed (fixed)" in topology matrix Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
28514c0 to
07e34c5
Compare
Docker Hardening ValidationHardening Validation ReportValidated: Sun Mar 15 12:20:08 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
pmoves/services/gateway-agent/app.py (1)
14-19:⚠️ Potential issue | 🟡 MinorDocstring references stale port 3025 for Cipher Memory.
The architecture docstring at line 16 states "Cipher Memory (3025)" but the actual
CIPHER_URLdefault at line 54 now uses port 8096. Update the docstring to maintain consistency.🔧 Proposed fix
Architecture: Gateway Agent (8100) ├── Agent Zero MCP API (8080) - Tool discovery - ├── Cipher Memory (3025) - Skills storage + ├── Cipher Memory (8096) - Skills storage ├── TensorZero (3030) - LLM inference ├── NATS (4222) - Event bus for BoTZ integration └── 100+ MCP Tools - Upstream servers🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/services/gateway-agent/app.py` around lines 14 - 19, Update the module docstring that lists "Cipher Memory (3025)" to reflect the current default CIPHER_URL port (8096); locate the docstring block containing the "Gateway Agent" architecture list and replace the port for "Cipher Memory" to "(8096)" so it matches the CIPHER_URL constant used elsewhere in this file (search for CIPHER_URL).pmoves/services/gateway-agent/README.md (1)
9-9:⚠️ Potential issue | 🟡 MinorPort inconsistency: Architecture section references port 3025, but CIPHER_URL uses 8096.
Line 9 states "Cipher Memory (3025)" while the deployment examples now use
cipher-api:8096. Additionally, the troubleshooting section (Line 254) referencescurl http://localhost:3025/health. Update both references to align with the new port.🔧 Proposed fix
- - **Cipher Memory** (3025) - Skills storage and retrieval + - **Cipher Memory** (8096) - Skills storage and retrievalAnd at Line 254:
-- Check Cipher: `curl http://localhost:3025/health` +- Check Cipher: `curl http://localhost:8096/health`As per coding guidelines:
pmoves/docs/**: "Check docs for operational accuracy."🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/services/gateway-agent/README.md` at line 9, Update the docs to make the port consistent: change the "Cipher Memory (3025)" reference in the Architecture section to reflect port 8096, ensure the CIPHER_URL examples show cipher-api:8096 (or explicitly mention 8096), and replace the troubleshooting curl example "curl http://localhost:3025/health" with "curl http://localhost:8096/health" so all occurrences (including the string "Cipher Memory (3025)", the CIPHER_URL examples, and the curl health check) align to port 8096.
♻️ Duplicate comments (2)
pmoves/docs/operations/N8N_WORKFLOW_INVENTORY.md (2)
126-135:⚠️ Potential issue | 🟡 MinorNATS subjects table contains duplicate entries.
Lines 133-134 duplicate the entries from lines 126-127:
content.publish.approved.v1appears at both line 126 and 133channel.new.content.v1appears at both line 127 and 134Remove the duplicate rows to keep the inventory deterministic.
🔧 Proposed fix
| `geometry.cgp.v1` | Multiple (5 workflows) | CGP constellation data via Hi-RAG | | `ingest.transcript.ready.v1` | pmoves_audio_analysis | Transcript available | -| `content.publish.approved.v1` | approval_poller | Content approved for publishing | -| `channel.new.content.v1` | pmoves_channel_monitor | New external content detected |🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/operations/N8N_WORKFLOW_INVENTORY.md` around lines 126 - 135, The NATS subjects table contains duplicate rows for `content.publish.approved.v1` (approval_poller) and `channel.new.content.v1` (pmoves_channel_monitor); remove the duplicate entries so each subject appears only once, leaving the original rows (keep the first occurrence for each subject or consolidate into a single canonical row), and verify the table still lists unique subjects like `research.deepresearch.request.v1`, `finance.monthly.summary.v1`, `health.weekly.summary.v1`, `geometry.cgp.v1`, and `ingest.transcript.ready.v1`.
3-3:⚠️ Potential issue | 🟡 MinorWorkflow count inconsistency: Line 3 says "34" but Line 26 says "35".
The summary states "34 n8n workflows" but the total row shows 35. Reconcile these counts to match the actual workflow inventory.
Also applies to: 26-26
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/operations/N8N_WORKFLOW_INVENTORY.md` at line 3, The document has a mismatch between the summary count and the total row: update the summary at "Line 3" or the total row at "Line 26" in N8N_WORKFLOW_INVENTORY.md so both reflect the actual number of workflows (either change "34" to "35" or "35" to "34" depending on the true inventory); verify the true count by checking the workflow list entries in the file and make the two numbers consistent.
🧹 Nitpick comments (3)
pmoves/docs/operations/animations/topology-flythrough.json (1)
5-5: Description mentions "6-node" but PR expands topology to 13 TAC trees.The description states "6-node infrastructure topology," but the PR objective indicates an expansion from 6 to 13 TAC trees in the integration topology. Verify whether this animation asset should reflect the updated 13-tree topology or if "6-node" refers specifically to the infrastructure nodes (Cloudflare, KVM4-1, KVM4-2, KVM2, Z890, 5090) which would be accurate.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/operations/animations/topology-flythrough.json` at line 5, The "description" property in topology-flythrough.json currently says "6-node infrastructure topology" but the PR expands the integration topology to 13 TAC trees; update the "description" field to accurately reflect the new asset scope (e.g., "Animated flythrough of the 13-TAC-tree integration topology" or clarify that it only visualizes the six infrastructure nodes if that is intentional), by editing the "description" string in topology-flythrough.json to the correct wording so it matches the PR changes.pmoves/config/agent_registry.yaml (1)
1708-1711: Consider standardizing topology schema for new entries.The new entries (
autoresearch,clawz,a0_plugins) use a different topology structure (host,placement,network) compared to existing entries which use (node_affinity,team,ci_runner,compose_profile). While this may be intentional for non-standard deployments, consider documenting this variation or standardizing the schema.Existing entries example (Line 88-92):
topology: node_affinity: [kvm4-1, z890, 5090] team: orchestration ci_runner: ai-lab compose_profile: agentsNew entries example (Line 1708-1711):
topology: host: "gpu-host (H100/4090/5090)" placement: "local-only CLI" network: "none (standalone)"Also applies to: 1740-1743, 1769-1772
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/config/agent_registry.yaml` around lines 1708 - 1711, The new entries (autoresearch, clawz, a0_plugins) use a different topology schema (host, placement, network) than existing entries (node_affinity, team, ci_runner, compose_profile); standardize by converting these new topology blocks to the existing schema or add a clear schema variant note in the YAML docs and a top-level key indicating schema_version/schema_type; update the topology blocks for autoresearch, clawz, and a0_plugins to use node_affinity/team/ci_runner/compose_profile (or add schema_version: "local-standalone" and document the host/placement/network fields) so all entries follow a consistent, documented topology structure.pmoves/docs/AGENTS/DEEP_DIVE_ALIGNMENT_2026-03-15.md (1)
20-20: Minor: Use official "YouTube" capitalization in prose.The plugin identifier
youtube_transcribeis correctly lowercase, but the column header "PMOVES.YT" section could benefit from writing the platform name as "YouTube" for consistency with official branding.Suggested fix
-| Dimension | `youtube_transcribe` (a0-plugin) | PMOVES.YT (8077) | +| Dimension | `youtube_transcribe` (a0-plugin) | PMOVES.YT (YouTube) (8077) |🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/AGENTS/DEEP_DIVE_ALIGNMENT_2026-03-15.md` at line 20, Update the table header text to use official "YouTube" capitalization: replace the column label "PMOVES.YT (8077)" in the line containing "| Dimension | `youtube_transcribe` (a0-plugin) | PMOVES.YT (8077) |" with "PMOVES.YouTube (8077)" (preserve the rest of the cell content and parentheses).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pmoves/docs/operations/animations/topology-flythrough.json`:
- Around line 1-19: This file fails the a2ui schema: add the required top-level
"version": "a2ui.animation.v1" and replace the top-level timing/engine fields
with an "animation" object containing "engine" (one of
"remotion"|"threejs"|"css"|"lottie") and "duration_ms" (convert existing
duration_seconds * 1000); move or remove non-schema fields ("fps", "resolution",
"design_system")—either relocate them under a permitted property inside
"animation" if the schema supports it or remove/record them elsewhere, ensuring
only schema-defined properties remain; specifically update the JSON keys
referenced here ($schema, version, animation.engine, animation.duration_ms,
duration_seconds, fps, resolution, design_system) so the document conforms to
the contract.
- Around line 32-52: The JSON files declare $schema a2ui-animation-schema.json
but use topology-specific element types ("node", "data_flow", "connection",
"service_cluster", "overview"), frame/timing properties ("duration_seconds",
"start_frame", "end_frame") and custom arrays ("teams") that the current schema
does not allow; fix by creating or updating a topology-specific schema and
pointing these files to it: either extend a2ui-animation-schema.json to include
the topology element enums and frame-based timing, or add a new schema (e.g.,
a2ui-topology-animation-schema.json) that defines the allowed element "type"
values ("node","data_flow", etc.), the timing model (frame-based properties and
scene-level duration_ms compatibility), and the "teams" structure, then update
the files' $schema declarations to reference the new schema and run schema
validation in CI.
In `@pmoves/docs/operations/diagrams/agent-teams.mmd`:
- Line 112: The sandbox node affinity in the Mermaid diagram is inconsistent
with the animation spec; update the node id in the diagram line that currently
reads sandbox ---|"5090"| FiveKN["🎮 5090"] to use "Z890" (so it matches the
animation spec in agent-teams-pulse.json which references "Z890"); ensure both
the label and the quoted affinity value are changed so the diagram and the
animation spec remain aligned.
In `@pmoves/docs/operations/diagrams/model-stack.mmd`:
- Around line 19-22: The diagram nodes Q8B, Q14B, Q32B and Q235B in
model-stack.mmd do not match the actual deployed models/ports in
pmoves/docker-compose/vllm-models.yml; either mark the Mermaid subgraph as
"planned/future" or update the node labels and ports to reflect the deployed
services (e.g., replace Qwen3-8B/8160, Qwen3-14B/8162, Qwen3-32B/8166,
Qwen3-235B/8168 with the actual deployed images and ports from vllm-models.yml
such as Qwen/Qwen2.5-7B-Instruct:8100, Qwen/Qwen2.5-14B-Instruct:8110,
Qwen/Qwen2.5-32B-Instruct:8130, Qwen/Qwen3-VL-8B-Instruct:8150); update node IDs
(Q8B, Q14B, etc.) and any architecture notes accordingly so the diagram and
docker-compose align or add a clear "planned" annotation.
---
Outside diff comments:
In `@pmoves/services/gateway-agent/app.py`:
- Around line 14-19: Update the module docstring that lists "Cipher Memory
(3025)" to reflect the current default CIPHER_URL port (8096); locate the
docstring block containing the "Gateway Agent" architecture list and replace the
port for "Cipher Memory" to "(8096)" so it matches the CIPHER_URL constant used
elsewhere in this file (search for CIPHER_URL).
In `@pmoves/services/gateway-agent/README.md`:
- Line 9: Update the docs to make the port consistent: change the "Cipher Memory
(3025)" reference in the Architecture section to reflect port 8096, ensure the
CIPHER_URL examples show cipher-api:8096 (or explicitly mention 8096), and
replace the troubleshooting curl example "curl http://localhost:3025/health"
with "curl http://localhost:8096/health" so all occurrences (including the
string "Cipher Memory (3025)", the CIPHER_URL examples, and the curl health
check) align to port 8096.
---
Duplicate comments:
In `@pmoves/docs/operations/N8N_WORKFLOW_INVENTORY.md`:
- Around line 126-135: The NATS subjects table contains duplicate rows for
`content.publish.approved.v1` (approval_poller) and `channel.new.content.v1`
(pmoves_channel_monitor); remove the duplicate entries so each subject appears
only once, leaving the original rows (keep the first occurrence for each subject
or consolidate into a single canonical row), and verify the table still lists
unique subjects like `research.deepresearch.request.v1`,
`finance.monthly.summary.v1`, `health.weekly.summary.v1`, `geometry.cgp.v1`, and
`ingest.transcript.ready.v1`.
- Line 3: The document has a mismatch between the summary count and the total
row: update the summary at "Line 3" or the total row at "Line 26" in
N8N_WORKFLOW_INVENTORY.md so both reflect the actual number of workflows (either
change "34" to "35" or "35" to "34" depending on the true inventory); verify the
true count by checking the workflow list entries in the file and make the two
numbers consistent.
---
Nitpick comments:
In `@pmoves/config/agent_registry.yaml`:
- Around line 1708-1711: The new entries (autoresearch, clawz, a0_plugins) use a
different topology schema (host, placement, network) than existing entries
(node_affinity, team, ci_runner, compose_profile); standardize by converting
these new topology blocks to the existing schema or add a clear schema variant
note in the YAML docs and a top-level key indicating schema_version/schema_type;
update the topology blocks for autoresearch, clawz, and a0_plugins to use
node_affinity/team/ci_runner/compose_profile (or add schema_version:
"local-standalone" and document the host/placement/network fields) so all
entries follow a consistent, documented topology structure.
In `@pmoves/docs/AGENTS/DEEP_DIVE_ALIGNMENT_2026-03-15.md`:
- Line 20: Update the table header text to use official "YouTube"
capitalization: replace the column label "PMOVES.YT (8077)" in the line
containing "| Dimension | `youtube_transcribe` (a0-plugin) | PMOVES.YT (8077) |"
with "PMOVES.YouTube (8077)" (preserve the rest of the cell content and
parentheses).
In `@pmoves/docs/operations/animations/topology-flythrough.json`:
- Line 5: The "description" property in topology-flythrough.json currently says
"6-node infrastructure topology" but the PR expands the integration topology to
13 TAC trees; update the "description" field to accurately reflect the new asset
scope (e.g., "Animated flythrough of the 13-TAC-tree integration topology" or
clarify that it only visualizes the six infrastructure nodes if that is
intentional), by editing the "description" string in topology-flythrough.json to
the correct wording so it matches the PR changes.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 444a8da9-db9b-4062-bb48-49fd8d465b8e
📒 Files selected for processing (23)
pmoves/config/agent_registry.yamlpmoves/docker-compose.vps.override.ymlpmoves/docs/AGENTS/BOTZ_GATEWAY_AGENT_INTEGRATION.mdpmoves/docs/AGENTS/DEEP_DIVE_ALIGNMENT_2026-03-15.mdpmoves/docs/TAC/TAC_A0_PLUGINS.mdpmoves/docs/TAC/TAC_AGENT_ZERO.mdpmoves/docs/TAC/TAC_AUTORESEARCH.mdpmoves/docs/TAC/TAC_BOTZ.mdpmoves/docs/TAC/TAC_CIPHER.mdpmoves/docs/TAC/TAC_CLAWZ.mdpmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.mdpmoves/docs/operations/N8N_WORKFLOW_INVENTORY.mdpmoves/docs/operations/animations/agent-teams-pulse.jsonpmoves/docs/operations/animations/topology-flythrough.jsonpmoves/docs/operations/diagrams/README.mdpmoves/docs/operations/diagrams/agent-teams.mmdpmoves/docs/operations/diagrams/ci-runner-flow.mmdpmoves/docs/operations/diagrams/dns-subdomain-map.mmdpmoves/docs/operations/diagrams/model-stack.mmdpmoves/docs/operations/diagrams/network-routes.mmdpmoves/docs/operations/diagrams/node-topology.mmdpmoves/services/gateway-agent/README.mdpmoves/services/gateway-agent/app.py
🚧 Files skipped from review as they are similar to previous changes (8)
- pmoves/docs/operations/diagrams/ci-runner-flow.mmd
- pmoves/docs/operations/diagrams/node-topology.mmd
- pmoves/docker-compose.vps.override.yml
- pmoves/docs/operations/diagrams/network-routes.mmd
- pmoves/docs/TAC/TAC_CIPHER.md
- pmoves/docs/AGENTS/BOTZ_GATEWAY_AGENT_INTEGRATION.md
- pmoves/docs/TAC/TAC_AGENT_ZERO.md
- pmoves/docs/operations/diagrams/dns-subdomain-map.mmd
Document the full pr-monitor-graphiti-chit FlOO$ pipeline in CLAUDE.md, wire existing hooks into settings.json, and resolve all remaining CodeRabbit threads from the #934-941 merge session. Changes: - CLAUDE.md: Add "PR Review & Merge Workflow" section with skill chain, usage guide, FlOO$ validation commands, and NATS subjects - CLAUDE.md: Fix skill pairing table (3-step → 4-step pipeline) - settings.json: Wire UserPromptSubmit hook for PR skill awareness - settings.json: Wire post-review-chit.sh to Skill PostToolUse - hooks/pr-skill-reminder.sh: New lightweight PR context reminder - .gitignore: Add runtime graphiti/CGP log patterns - Resolve 14 unresolved CodeRabbit threads on PRs #940 and #941 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: refresh CODEX_CLAUDE_PARITY_GAPS coverage report to 2026-03-13 - Coverage: 96.6% (down from 100%) - New commands added without parity updates: chit:review-sweep, chit:sign-trail, docs:reconcile, tac:review - Timestamp updated from 2026-02-28 to 2026-03-13 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat(submodules): add PMOVES-a0-plugins plugin index + Agent Zero TAC tree **PMOVES-a0-plugins Submodule:** - Adds POWERFULMOVES/PMOVES-a0-plugins as submodule - Tracks PMOVES.AI-Edition-Hardened branch for security hardening - Enables curated plugin ecosystem for Agent Zero customizations - README includes PMOVES.AI-specific integration patterns: - TensorZero Gateway (port 3030/3000) for all LLM calls - NATS (nats://nats:pmoves@nats:4222) for event coordination - Hi-RAG v2 (port 8086/8087) for knowledge retrieval - Archon (port 8091) for prompt management - Security: non-root containers, healthchecks, metrics, CHIT **Agent Zero Customization TAC Tree:** - 50 checks across 9 phases for comprehensive review - 100% pass rate validates: - TensorZero integration and model naming format - Extension system proper use (23 extension points) - PMOVES.AI service leverage (not duplication) - Docker hardening (tier-agent-hardened anchor) - Observability (healthz/metrics endpoints, NATS heartbeat) - 4-tier context loading strategy - Plugin ecosystem integration - Subordinate agent model - Tools & prompts customization patterns Related: Agent Zero customization documentation and integration patterns * docs(submodule): update Agent Zero with integration guide and quickstart - PMOVES.AI_INTEGRATION.md: Complete service integration reference - QUICKSTART.md: 15-minute getting started guide This documentation provides: - Service connection details (TensorZero, NATS, Hi-RAG, Archon, Neo4j) - MCP API usage examples - Extension system guide (23 lifecycle hooks) - Security hardening patterns - Troubleshooting section Related: Agent Zero TAC tree (50/50 checks passing) Related: PMOVES-a0-plugins submodule initialization * feat(submodules): add PMOVES.Notes plugin to a0-plugins index **Plugin Added:** pmoves-notes-integration - Repository: https://github.com/POWERFULMOVES/a0-plugin-pmoves-notes - Branch: PMOVES.AI-Edition-Hardened **Plugin Features:** - Auto-save conversation summaries (message_loop_end extension) - Save reasoning traces to memory (monologue_end extension) - Manual tools: save_note, search_notes - NATS events: agent.notes.saved.v1, agent.notes.searched.v1 - Open Notebook integration (SurrealDB knowledge base) **TAC Review Results:** - Agent Zero Customization Review: 50/50 passing (100%) - All 9 phases validated successfully Related: Agent Zero integration documentation Related: PMOVES-a0-plugins submodule initialization * refactor(tac): simplify NATS regex pattern and update description - Simplify NATS subject pattern: agent\.task\.|agent\.subordinate\. → agent\.task|agent\.subordinate - Update description to explicitly state "across 9 phases (51 checks)" - Removes unnecessary escape before pipe operator - More robust pattern matching for NATS subjects Suggested by code review feedback - all 50 checks still passing. * fix(ui): apply PR review fixes to main - Fix playwright default port: 3100 → 4482 (matches docker-compose) - Fix base64url decoding in boot-jwt route (JWT uses -/_ instead of +/) - Add spawn error handler to with-env.mjs These fixes were applied to all UI Testing PRs (#908-#913). PR branches will rebase onto main to pick up these core fixes. * feat(ops): PR review skill chain integration + thread resolution Document the full pr-monitor-graphiti-chit FlOO$ pipeline in CLAUDE.md, wire existing hooks into settings.json, and resolve all remaining CodeRabbit threads from the #934-941 merge session. Changes: - CLAUDE.md: Add "PR Review & Merge Workflow" section with skill chain, usage guide, FlOO$ validation commands, and NATS subjects - CLAUDE.md: Fix skill pairing table (3-step → 4-step pipeline) - settings.json: Wire UserPromptSubmit hook for PR skill awareness - settings.json: Wire post-review-chit.sh to Skill PostToolUse - hooks/pr-skill-reminder.sh: New lightweight PR context reminder - .gitignore: Add runtime graphiti/CGP log patterns - Resolve 14 unresolved CodeRabbit threads on PRs #940 and #941 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2 participants
Summary
cipher-api:8096across VPS override, gateway-agent code/docsCommits (4 atomic)
docs(tac): add TAC trees for Agent Zero, autoresearch, ClawZ, a0-plugins, Cipherdocs(tac): update BoTZ TAC, Integration Topology v2.0, agent registrydocs(agents): deep-dive alignment analysis for 6 submodulesfix(docs,config): correct stale P1 findings — BoTZ auth fail-closed, Cipher URL alignedTest plan
pmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.mdreferences all 13 treesagent_registry.yamlhas entries for all 6 target submodulescipher-api:8096in VPS override + gateway-agent🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Bug Fixes
Documentation
Chores