feat(infra): infrastructure TAC trees + Tailscale Docker registration - #949
Conversation
- Coverage: 96.6% (down from 100%) - New commands added without parity updates: chit:review-sweep, chit:sign-trail, docs:reconcile, tac:review - Timestamp updated from 2026-02-28 to 2026-03-13 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
… tree **PMOVES-a0-plugins Submodule:** - Adds POWERFULMOVES/PMOVES-a0-plugins as submodule - Tracks PMOVES.AI-Edition-Hardened branch for security hardening - Enables curated plugin ecosystem for Agent Zero customizations - README includes PMOVES.AI-specific integration patterns: - TensorZero Gateway (port 3030/3000) for all LLM calls - NATS (nats://nats:pmoves@nats:4222) for event coordination - Hi-RAG v2 (port 8086/8087) for knowledge retrieval - Archon (port 8091) for prompt management - Security: non-root containers, healthchecks, metrics, CHIT **Agent Zero Customization TAC Tree:** - 50 checks across 9 phases for comprehensive review - 100% pass rate validates: - TensorZero integration and model naming format - Extension system proper use (23 extension points) - PMOVES.AI service leverage (not duplication) - Docker hardening (tier-agent-hardened anchor) - Observability (healthz/metrics endpoints, NATS heartbeat) - 4-tier context loading strategy - Plugin ecosystem integration - Subordinate agent model - Tools & prompts customization patterns Related: Agent Zero customization documentation and integration patterns
- PMOVES.AI_INTEGRATION.md: Complete service integration reference - QUICKSTART.md: 15-minute getting started guide This documentation provides: - Service connection details (TensorZero, NATS, Hi-RAG, Archon, Neo4j) - MCP API usage examples - Extension system guide (23 lifecycle hooks) - Security hardening patterns - Troubleshooting section Related: Agent Zero TAC tree (50/50 checks passing) Related: PMOVES-a0-plugins submodule initialization
**Plugin Added:** pmoves-notes-integration - Repository: https://github.com/POWERFULMOVES/a0-plugin-pmoves-notes - Branch: PMOVES.AI-Edition-Hardened **Plugin Features:** - Auto-save conversation summaries (message_loop_end extension) - Save reasoning traces to memory (monologue_end extension) - Manual tools: save_note, search_notes - NATS events: agent.notes.saved.v1, agent.notes.searched.v1 - Open Notebook integration (SurrealDB knowledge base) **TAC Review Results:** - Agent Zero Customization Review: 50/50 passing (100%) - All 9 phases validated successfully Related: Agent Zero integration documentation Related: PMOVES-a0-plugins submodule initialization
- Simplify NATS subject pattern: agent\.task\.|agent\.subordinate\. → agent\.task|agent\.subordinate - Update description to explicitly state "across 9 phases (51 checks)" - Removes unnecessary escape before pipe operator - More robust pattern matching for NATS subjects Suggested by code review feedback - all 50 checks still passing.
- Fix playwright default port: 3100 → 4482 (matches docker-compose) - Fix base64url decoding in boot-jwt route (JWT uses -/_ instead of +/) - Add spawn error handler to with-env.mjs These fixes were applied to all UI Testing PRs (#908-#913). PR branches will rebase onto main to pick up these core fixes.
Keep v1.2.0 TAC tree (newer), adopt robust base64url padding for JWT decode. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add Docker-based Tailscale mesh client for POWERFULMOVES node (userspace networking, Windows Docker Desktop compatible) and create 3 infrastructure TAC trees covering the connective tissue that was previously undocumented. New files: - docker-compose.tailscale.yml: Standalone Tailscale client container with TS_USERSPACE=true (no TUN device needed on Windows) - TAC_INFRASTRUCTURE.md: Master infra TAC (nodes, mesh, runners, DNS) - TAC_TAILSCALE.md: VPN layer TAC (node registration, auth keys, exit node, Headscale migration path) - TAC_RUNNERS.md: CI runner fleet TAC (4 containerized runners, workflow mapping, phase policy, cert management) Modified: - infra.mk: Add tailscale-up/down/status/ip Make targets - TOPOLOGY.md: Add POWERFULMOVES node to inventory and NATS mesh diagram - AGNOTE4482PHI.t1.md: Register CLAUDE-OPUS claim for infra TAC lane Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Docker Hardening ValidationHardening Validation ReportValidated: Sun Mar 15 18:08:26 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
…TE handoff Host-level `tailscale-*` targets in the main Makefile (tailscale-status, tailscale-join, etc.) collided with Docker-container targets added to infra.mk. Renamed Docker targets to `tailscale-docker-*` prefix. Updated TAC docs (TAC_INFRASTRUCTURE, TAC_TAILSCALE) with corrected Make target references. Added Post-Phase E handoff REVIEW + RELEASE entries to AGNOTE: - Triaged 6 remaining handoff items from Z890 Phase E session - 3 deferred (ClawZ CHIT, Health/Wealth NATS, Agent Zero task NATS) - 3 tracked for future sessions (BoTZ MCP auth, Cipher metrics, cipher-mcp submodule) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughIntroduces Tailscale Docker support for the POWERFULMOVES node, including a docker-compose configuration with environment variables, Makefile management targets, and comprehensive TAC documentation for infrastructure, runners, and Tailscale setup. Topology documentation registers the new node with Tailscale hostname and updates NATS mesh diagram. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
e640a7e to
c70a32b
Compare
Docker Hardening ValidationHardening Validation ReportValidated: Sun Mar 15 18:09:43 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
pmoves/docker-compose.tailscale.yml (1)
15-15: Use Tailscale's recommendedstabletag instead oflatest.Tailscale's documentation recommends using the
tailscale/tailscale:stabletag (a floating tag) for Docker deployments so that each restart pulls the latest stable client. This differs from the general practice of pinning to fixed versions—Tailscale does not recommend pinning to an immutable digest for production and explicitly prefers thestabletag to ensure you receive security updates and bug fixes automatically.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docker-compose.tailscale.yml` at line 15, Change the Docker image tag for the Tailscale service from "tailscale/tailscale:latest" to the recommended floating stable tag "tailscale/tailscale:stable"; locate the service definition that uses the image key (image: tailscale/tailscale:latest) and update it to image: tailscale/tailscale:stable so container restarts pull the latest stable Tailscale client automatically.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pmoves/docker-compose.tailscale.yml`:
- Around line 7-9: Update the usage comments in docker-compose.tailscale.yml to
reference the current Make targets: replace references to tailscale-up,
tailscale-status, and tailscale-ip with tailscale-docker-up,
tailscale-docker-status, and tailscale-docker-ip (the active targets used by the
build system). Locate the comment block that mentions the old targets and edit
the three lines so operators run the correct make targets (e.g., use
tailscale-docker-up/status/ip instead of tailscale-up/status/ip).
In `@pmoves/docs/TAC/TAC_INFRASTRUCTURE.md`:
- Around line 30-62: The TAC doc adds new "Upstream Dependencies", "Downstream
Consumers" and "NATS Mesh Subjects" entries (Docker Engine, NATS, Tailscale,
Cloudflare, Supabase, Prometheus; consumers like "All 62 agents", "Agent Zero
(8080)", "Model Registry"; and subjects such as `mesh.node.announce.v1`,
`mesh.gpu.status.v1`, `mesh.gpu.model.loaded.v1`, etc.), but the Claude context
docs are out of sync—update services-catalog.md to include the new services,
port assignments (e.g., 4222 for NATS, 8080 for Agent Zero, 3010 for Supabase,
9090 for Prometheus, Grafana 3002) and any health endpoints, and update
nats-subjects.md to document the new NATS subjects with publisher, direction and
interval details matching the "NATS Mesh Subjects" table; ensure entries use the
exact subject strings (`mesh.node.announce.v1`, `mesh.gpu.command.v1`,
`mesh.gpu.command.result.v1`, `model.registry.updated.v1`, etc.) so the
operator-facing context stays consistent.
In `@pmoves/docs/TAC/TAC_RUNNERS.md`:
- Around line 35-43: The TAC_RUNNERS.md routing table is inaccurate versus the
Cloudflare Worker routing logic that analyzes changed files and selects runners
(the worker function that inspects change patterns and returns runners). Update
the table rows so Docker builds map to vps as the primary runner, lightweight
workflows map to ubuntu-latest, and non-lightweight/default workflows map to vps
to mirror the worker's selection; specifically change the "Docker builds"
primary runner from kvm4 to vps and adjust the "Tests" / "Docs/Lint" entries to
reflect that lightweight jobs use ubuntu-latest while non-lightweight defaults
to vps, ensuring the table text matches the worker's routing behavior.
- Around line 47-57: The policy table in the docs (runner_phase_policy.json) is
out of sync with the canonical policy under
pmoves/integrations/github-runners/compose/runner_phase_policy.json: remove the
non-existent "lightweight" phase, add the missing "vps-deployment" phase, and
update each Phase row (local-certification, staging, production, vps-deployment)
so the Allowed Labels column and any required/optional label semantics exactly
match the required/optional entries in the canonical runner_phase_policy.json;
ensure the table text and label lists mirror the source file verbatim and keep
the file name runner_phase_policy.json referenced in the doc.
In `@pmoves/mk/infra.mk`:
- Around line 92-94: The tailscale-docker-up Make target currently runs "docker
compose -f docker-compose.tailscale.yml --env-file env.shared up -d" even when
TAILSCALE_AUTHKEY is missing; add a preflight guard in the tailscale-docker-up
target to check the TAILSCALE_AUTHKEY environment variable (or its value in
env.shared) and fail fast with a clear error if empty/missing before invoking
the docker compose command so the container doesn't start and fail later.
---
Nitpick comments:
In `@pmoves/docker-compose.tailscale.yml`:
- Line 15: Change the Docker image tag for the Tailscale service from
"tailscale/tailscale:latest" to the recommended floating stable tag
"tailscale/tailscale:stable"; locate the service definition that uses the image
key (image: tailscale/tailscale:latest) and update it to image:
tailscale/tailscale:stable so container restarts pull the latest stable
Tailscale client automatically.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: af146a14-296e-4d8d-be02-292bc8bfba3d
📒 Files selected for processing (7)
pmoves/docker-compose.tailscale.ymlpmoves/docs/AGENTS/AGNOTE4482PHI.t1.mdpmoves/docs/TAC/TAC_INFRASTRUCTURE.mdpmoves/docs/TAC/TAC_RUNNERS.mdpmoves/docs/TAC/TAC_TAILSCALE.mdpmoves/docs/operations/TOPOLOGY.mdpmoves/mk/infra.mk
| # make -C pmoves tailscale-up # Start and join tailnet | ||
| # make -C pmoves tailscale-status # Check connection | ||
| # make -C pmoves tailscale-ip # Show Tailscale IP |
There was a problem hiding this comment.
Usage comments reference removed Make targets.
Line 7 through Line 9 still point to tailscale-up/status/ip, but the active targets are tailscale-docker-up/status/ip in pmoves/mk/infra.mk. This will cause operator command failures.
🛠️ Suggested comment fix
-# make -C pmoves tailscale-up # Start and join tailnet
-# make -C pmoves tailscale-status # Check connection
-# make -C pmoves tailscale-ip # Show Tailscale IP
+# make -C pmoves tailscale-docker-up # Start and join tailnet
+# make -C pmoves tailscale-docker-status # Check connection
+# make -C pmoves tailscale-docker-ip # Show Tailscale IP📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # make -C pmoves tailscale-up # Start and join tailnet | |
| # make -C pmoves tailscale-status # Check connection | |
| # make -C pmoves tailscale-ip # Show Tailscale IP | |
| # make -C pmoves tailscale-docker-up # Start and join tailnet | |
| # make -C pmoves tailscale-docker-status # Check connection | |
| # make -C pmoves tailscale-docker-ip # Show Tailscale IP |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/docker-compose.tailscale.yml` around lines 7 - 9, Update the usage
comments in docker-compose.tailscale.yml to reference the current Make targets:
replace references to tailscale-up, tailscale-status, and tailscale-ip with
tailscale-docker-up, tailscale-docker-status, and tailscale-docker-ip (the
active targets used by the build system). Locate the comment block that mentions
the old targets and edit the three lines so operators run the correct make
targets (e.g., use tailscale-docker-up/status/ip instead of
tailscale-up/status/ip).
| ## Upstream Dependencies | ||
|
|
||
| | Dependency | Type | Required | | ||
| |------------|------|----------| | ||
| | Docker Engine (all nodes) | Container runtime | Yes | | ||
| | NATS (4222) | Mesh node announcements | Yes | | ||
| | Tailscale Cloud / Headscale | VPN control plane | Yes | | ||
| | Cloudflare | DNS and edge routing | Yes (production) | | ||
| | Supabase (3010) | Node metadata storage | Optional | | ||
| | Prometheus (9090) | Metrics collection | Optional | | ||
|
|
||
| ## Downstream Consumers | ||
|
|
||
| | Consumer | Dependency | Description | | ||
| |----------|-----------|-------------| | ||
| | All 62 agents | Tailscale mesh | Inter-node connectivity | | ||
| | Agent Zero (8080) | `mesh.node.announce.v1` | Host discovery via NATS | | ||
| | Model Registry | `mesh.gpu.model.*` | GPU model lifecycle events | | ||
| | CI/CD Workflows (19) | Runner fleet | Workflow execution | | ||
| | Grafana (3002) | Prometheus | Infrastructure dashboards | | ||
|
|
||
| ## NATS Mesh Subjects | ||
|
|
||
| | Subject | Publisher | Direction | Interval | | ||
| |---------|-----------|-----------|----------| | ||
| | `mesh.node.announce.v1` | mesh_agent | Publishes | 15s heartbeat | | ||
| | `mesh.gpu.status.v1` | gpu-orchestrator | Publishes | 5s heartbeat | | ||
| | `mesh.gpu.model.loaded.v1` | gpu-orchestrator | Publishes | on-event | | ||
| | `mesh.gpu.model.unloaded.v1` | gpu-orchestrator | Publishes | on-event | | ||
| | `mesh.gpu.command.v1` | agent-zero | Publishes | on-demand | | ||
| | `mesh.gpu.command.result.v1` | gpu-orchestrator | Publishes | on-event | | ||
| | `model.registry.updated.v1` | model-registry | Publishes | on-event | | ||
|
|
There was a problem hiding this comment.
Sync this TAC update into the Claude context docs.
Line 30 through Line 62 add infra dependencies, ports, and NATS subjects, but this PR does not include matching updates to .claude/context/services-catalog.md and .claude/context/nats-subjects.md. This creates doc drift for operator-facing context.
As per coding guidelines, "**/*.md: Document NATS event topology in .claude/context/nats-subjects.md and maintain services catalog with port assignments and health endpoints in .claude/context/services-catalog.md."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/docs/TAC/TAC_INFRASTRUCTURE.md` around lines 30 - 62, The TAC doc adds
new "Upstream Dependencies", "Downstream Consumers" and "NATS Mesh Subjects"
entries (Docker Engine, NATS, Tailscale, Cloudflare, Supabase, Prometheus;
consumers like "All 62 agents", "Agent Zero (8080)", "Model Registry"; and
subjects such as `mesh.node.announce.v1`, `mesh.gpu.status.v1`,
`mesh.gpu.model.loaded.v1`, etc.), but the Claude context docs are out of
sync—update services-catalog.md to include the new services, port assignments
(e.g., 4222 for NATS, 8080 for Agent Zero, 3010 for Supabase, 9090 for
Prometheus, Grafana 3002) and any health endpoints, and update nats-subjects.md
to document the new NATS subjects with publisher, direction and interval details
matching the "NATS Mesh Subjects" table; ensure entries use the exact subject
strings (`mesh.node.announce.v1`, `mesh.gpu.command.v1`,
`mesh.gpu.command.result.v1`, `model.registry.updated.v1`, etc.) so the
operator-facing context stays consistent.
| | Category | Workflows | Primary Runner | Fallback | | ||
| |----------|-----------|----------------|----------| | ||
| | GPU builds | Docker multi-arch, model training | `ai-lab` | — | | ||
| | Docker builds | Service images, Dockerfile lint | `kvm4` | `cloudstartup` | | ||
| | Tests | Python tests, smoke tests, CodeQL | `cloudstartup` | `ubuntu-latest` | | ||
| | Docs/Lint | SQL lint, CHIT contract check | `ubuntu-latest` | — | | ||
| | Deploy | Production deploy, secrets sync | `kvm4` | `kvm2` | | ||
|
|
||
| **Routing logic:** Cloudflare Worker (`deploy/cloudflare/worker.js`) analyzes changed files to select appropriate runner. |
There was a problem hiding this comment.
Workflow routing table is out of sync with actual orchestrator logic.
Line 38 and Line 39 describe Docker/test routing that does not match deploy/cloudflare/worker.js:378-431 (which routes Docker builds to vps, lightweight to ubuntu-latest, and defaults non-lightweight to vps).
As per coding guidelines, "pmoves/docs/**: Check docs for operational accuracy: Keep status claims aligned with evidence in runbooks and smokes."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/docs/TAC/TAC_RUNNERS.md` around lines 35 - 43, The TAC_RUNNERS.md
routing table is inaccurate versus the Cloudflare Worker routing logic that
analyzes changed files and selects runners (the worker function that inspects
change patterns and returns runners). Update the table rows so Docker builds map
to vps as the primary runner, lightweight workflows map to ubuntu-latest, and
non-lightweight/default workflows map to vps to mirror the worker's selection;
specifically change the "Docker builds" primary runner from kvm4 to vps and
adjust the "Tests" / "Docs/Lint" entries to reflect that lightweight jobs use
ubuntu-latest while non-lightweight defaults to vps, ensuring the table text
matches the worker's routing behavior.
| **File:** `runner_phase_policy.json` | ||
|
|
||
| Defines which runner labels are allowed per deployment phase: | ||
|
|
||
| | Phase | Allowed Labels | Purpose | | ||
| |-------|---------------|---------| | ||
| | `local-certification` | `ai-lab` | Local Docker container runners (both on Z890) | | ||
| | `staging` | `cloudstartup`, `kvm4` | VPS runners for staging validation | | ||
| | `production` | `kvm4`, `kvm2` | Production deployment runners | | ||
| | `lightweight` | `ubuntu-latest` | GitHub-hosted for non-sensitive tasks | | ||
|
|
There was a problem hiding this comment.
Phase policy table does not match runner_phase_policy.json.
Line 53 through Line 57 diverge from pmoves/integrations/github-runners/compose/runner_phase_policy.json:1-45:
- Missing
vps-deployment - Adds
lightweightphase (not present) - Label sets do not match required/optional policy entries.
🛠️ Suggested doc correction (table-level)
-| `local-certification` | `ai-lab` | Local Docker container runners (both on Z890) |
-| `staging` | `cloudstartup`, `kvm4` | VPS runners for staging validation |
-| `production` | `kvm4`, `kvm2` | Production deployment runners |
-| `lightweight` | `ubuntu-latest` | GitHub-hosted for non-sensitive tasks |
+| `local-certification` | `self-hosted,Linux,X64`; `self-hosted,Linux,X64,ai-lab,gpu` | Local Docker container runners |
+| `staging` | `self-hosted,cloudstartup,staging` | Staging deployment on cloudstartup |
+| `vps-deployment` | `self-hosted,vps,kvm4-1`; `self-hosted,vps,kvm4-2`; `self-hosted,vps,kvm2` | VPS fleet deployment |
+| `production` | `self-hosted,kvm4,production`; `self-hosted,kvm4` (optional: `self-hosted,vps,kvm2`) | Production deployment |As per coding guidelines, "pmoves/docs/**: Check docs for operational accuracy: Keep status claims aligned with evidence in runbooks and smokes."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/docs/TAC/TAC_RUNNERS.md` around lines 47 - 57, The policy table in the
docs (runner_phase_policy.json) is out of sync with the canonical policy under
pmoves/integrations/github-runners/compose/runner_phase_policy.json: remove the
non-existent "lightweight" phase, add the missing "vps-deployment" phase, and
update each Phase row (local-certification, staging, production, vps-deployment)
so the Allowed Labels column and any required/optional label semantics exactly
match the required/optional entries in the canonical runner_phase_policy.json;
ensure the table text and label lists mirror the source file verbatim and keep
the file name runner_phase_policy.json referenced in the doc.
| tailscale-docker-up: ## Start Tailscale Docker container and join tailnet | ||
| docker compose -f docker-compose.tailscale.yml --env-file env.shared up -d | ||
|
|
There was a problem hiding this comment.
Add auth-key preflight to avoid opaque startup failures.
Line 93 can start the container even when TAILSCALE_AUTHKEY is missing/empty, then fail later inside Tailscale. Add a guard before compose up.
🛠️ Suggested Make target hardening
tailscale-docker-up: ## Start Tailscale Docker container and join tailnet
+ `@if` ! grep -qE '^TAILSCALE_AUTHKEY=.+$$' env.shared; then \
+ echo "ERROR: TAILSCALE_AUTHKEY is missing in env.shared"; \
+ exit 1; \
+ fi
docker compose -f docker-compose.tailscale.yml --env-file env.shared up -d📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| tailscale-docker-up: ## Start Tailscale Docker container and join tailnet | |
| docker compose -f docker-compose.tailscale.yml --env-file env.shared up -d | |
| tailscale-docker-up: ## Start Tailscale Docker container and join tailnet | |
| `@if` ! grep -qE '^TAILSCALE_AUTHKEY=.+$$' env.shared; then \ | |
| echo "ERROR: TAILSCALE_AUTHKEY is missing in env.shared"; \ | |
| exit 1; \ | |
| fi | |
| docker compose -f docker-compose.tailscale.yml --env-file env.shared up -d |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/mk/infra.mk` around lines 92 - 94, The tailscale-docker-up Make target
currently runs "docker compose -f docker-compose.tailscale.yml --env-file
env.shared up -d" even when TAILSCALE_AUTHKEY is missing; add a preflight guard
in the tailscale-docker-up target to check the TAILSCALE_AUTHKEY environment
variable (or its value in env.shared) and fail fast with a clear error if
empty/missing before invoking the docker compose command so the container
doesn't start and fail later.
2 participants
Summary
Cherry-picked from
feat/pr-skill-chain-integration(bb66ba22) — this commit was the second commit on PR #947 but was lost during squash merge.tailscale-docker-up,tailscale-docker-down,tailscale-docker-status,tailscale-docker-ipFix: Tailscale Make target name collision
Renamed Docker-container Tailscale targets from
tailscale-*totailscale-docker-*to avoid collision with existing host-level targets in the main Makefile (tailscale-status,tailscale-join,tailscale-save-key, etc.).Handoff Triage (Phase E remaining items)
/metricsPrometheusFiles
pmoves/docs/TAC/TAC_INFRASTRUCTURE.mdpmoves/docs/TAC/TAC_TAILSCALE.mdpmoves/docs/TAC/TAC_RUNNERS.mdpmoves/docker-compose.tailscale.ymlpmoves/mk/infra.mkpmoves/docs/operations/TOPOLOGY.mdpmoves/docs/AGENTS/AGNOTE4482PHI.t1.mdTest plan
make -C pmoves tailscale-docker-statustarget is callable (dry-run OK)tailscale-statuscollision:make -C pmoves tailscale-statusruns host command,tailscale-docker-statusruns container commanddocker compose -f pmoves/docker-compose.tailscale.yml configpasses🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
tailscale-docker-up,tailscale-docker-down,tailscale-docker-status, andtailscale-docker-ipDocumentation