feat(tac): YAML audit trees for DoX/ToKenism + 3 umbrella TACs (~55% coverage) - #964
Merged
Merged
Conversation
New YAML audit trees: - dox-intelligence.tac.yaml: NATS auth (P1), backend API, Supabase - tokenism-chit.tac.yaml: CGP encoding, geometry bus, skill pairings Updated: - firefly-iii.tac.yaml: fix broken submodule ref, make standalone New umbrella markdown TACs: - TAC_EMBEDDING_PIPELINE.md: Extract Worker + LangExtract + PDF Ingest - TAC_MEDIA_ANALYSIS.md: Media-Video (YOLOv8) + Media-Audio (HuBERT) - TAC_E2B_SANDBOX.md: 5 E2B submodules (cloud execution ecosystem) Integration Topology v2.2: 26 markdown + 14 YAML = 40 TAC files (~55%) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Contributor
📝 WalkthroughWalkthroughThis PR introduces three new TAC tree configuration files (DoX Intelligence, ToKenism CHIT, Firefly-III updates) and three new TAC documentation files for the Embedding Pipeline, Media Analysis, and E2B Sandbox ecosystems. Updates to the Production Audit Dashboard and Integration Topology documentation reflect expanded audit coverage from 38 to 40 TAC files (~55% of 62 agents). Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 18
🧹 Nitpick comments (1)
pmoves/configs/tac_trees/tokenism-chit.tac.yaml (1)
23-28: Task wording overstates what is being verified.This action only checks for
package.jsonexistence; it does not verify shallow/non-shallow clone state.Proposed fix
- id: tokenism.submodule.initialized - task: "Submodule initialized (not shallow)" + task: "Submodule initialized" action: type: file_exists target: "PMOVES-ToKenism-Multi/package.json" - expect: "ToKenism submodule present with package.json" + expect: "ToKenism submodule present"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/configs/tac_trees/tokenism-chit.tac.yaml` around lines 23 - 28, The task description "Submodule initialized (not shallow)" overstates the check; update the task text for the rule with id tokenism.submodule.initialized to accurately reflect that the action only verifies the presence of PMOVES-ToKenism-Multi/package.json (file_exists target) — e.g., change the task to "ToKenism submodule package.json present" or similar concise wording so it no longer claims anything about shallow vs non-shallow clone state.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pmoves/configs/tac_trees/dox-intelligence.tac.yaml`:
- Around line 53-54: The expected string contains a credential-shaped URL
"nats://nats:pmoves@nats:4222" which triggers secret scanners; update the
expectation in the config (the expect value) to a doc-safe placeholder such as
"Authenticated NATS URL used (nats://<user>:<password>@nats:4222)" or a generic
phrase like "Authenticated NATS URL used (auth-required NATS URL)" and keep the
context text "Must use authenticated NATS URL, not bare nats://nats:4222"
unchanged so the intent remains clear.
In `@pmoves/configs/tac_trees/firefly-iii.tac.yaml`:
- Around line 23-25: The check is failing because the config expects pattern:
"8075" (expect: "Port 8075 referenced (FIREFLY_PORT)") but the target document
still shows "Port | None assigned"; update the source of truth so they match by
either changing the config's pattern/expect value to reflect the current
document (e.g., adjust pattern to match "None assigned" or the actual port text)
or update the documentation to include "8075" and the FIREFLY_PORT note; locate
the entry referencing firefly-iii.docs.port and the YAML keys pattern: "8075"
and expect: "Port 8075 referenced (FIREFLY_PORT)" and make them consistent with
the TAC wealth document.
In `@pmoves/configs/tac_trees/tokenism-chit.tac.yaml`:
- Around line 104-110: The node with id tokenism.skills.pairings uses
action.type grep which only returns found/not found, but its expect text claims
"At least 3 skill pairing references"; update the TAC node so the assertion
matches grep's boolean behavior: either change the expect string to something
like "Contains tokenism skill pairing reference" (or "At least one skill pairing
reference") to reflect a boolean check, or if you actually need to enforce a
count, replace action.type grep with a counting-capable action and implement the
count check against pmoves/configs/skill-pairings.yaml; modify the node labeled
tokenism.skills.pairings accordingly.
- Around line 86-93: The compose check (id: tokenism.env.compose, task: "Docker
Compose service defined") currently uses a single regex
"tokenism-simulator|tokenism-ui" which matches if either service exists; update
the check to require both services by replacing the pattern with a combined
assertion (e.g. a regex with positive lookaheads that checks for both
"tokenism-simulator" and "tokenism-ui") or run two separate grep checks for each
service, and update the expect message to say "Both Tokenism services defined in
compose" to reflect the stricter requirement.
- Around line 8-13: The TAC references an undefined agent id "tokenism" and an
agent_hint "codex"; add canonical entries for both to the canonical agent
registry (the project's agent registry) so they can be referenced by TAC trees.
Create registry entries named "tokenism" and "codex" including required fields
(id, display name, connector/configuration, and any credentials or default
params your system expects) and ensure their ids exactly match the TAC's id:
tokenism and agent_hint: codex so lookups succeed when the TAC loader reads the
registry.
- Around line 75-83: The grep rule with id tokenism.env.no-export currently uses
pattern "^export " which only matches at the start of the entire file and misses
export statements on subsequent lines; update the rule's pattern (in the
tokenism.env.no-export action.pattern) to enable multiline matching (for example
by prefixing the regex with the inline (?m) flag) so ^ will match the start of
every line and detect any "export " occurrences anywhere in the file.
In `@pmoves/docs/PRODUCTION_AUDIT_DASHBOARD.md`:
- Line 24: The coverage percentage in PRODUCTION_AUDIT_DASHBOARD.md is
inconsistent: the line currently reads "40 TAC files (~55% of 62 agents)" but
40/62 ≈ 64.5%; update that line to either compute and display the correct
percentage ("40 TAC files (~64.5% of 62 agents)" or rounded to desired
precision) or change the denominator/explanation if you meant a different total
(e.g., agents vs. files); ensure the text "40 TAC files (~55% of 62 agents)" is
replaced with the corrected wording so the documented claim matches the actual
calculation.
In `@pmoves/docs/TAC/TAC_E2B_SANDBOX.md`:
- Around line 19-39: The fenced code block containing the ASCII architecture
diagram (starting with "Agent Zero (8080)" and the triple-backticks) lacks a
language annotation; update the opening fence to use "text" (i.e., change ``` to
```text) so the diagram complies with MD040 and renders as a plain-text block.
- Around line 133-136: The `/healthz` readiness row is incorrect for
component-specific endpoints; replace the single `/healthz` cell with explicit
endpoints matching the earlier definitions (Surf -> `/api/health`, Desktop ->
`/health`, Sandbox -> `/health`) and ensure MCP Server’s column reflects its
actual health endpoint (or mark as N/A if none); update the table row in
TAC_E2B_SANDBOX.md so the health row lists component-specific endpoints rather
than a universal `/healthz` to align with the earlier documented endpoints.
- Around line 43-50: The submodule table in TAC_E2B_SANDBOX.md is inconsistent
with .gitmodules: replace the PMOVES-Danger-infra entry with PMOVES-surf so the
listed submodules match .gitmodules (and verify the "Submodules (5)" count
remains correct); update the table row that currently shows
`PMOVES-Danger-infra` to `PMOVES-surf` and ensure the branch/purpose text
follows the same format as the other rows so the "Submodule inventory" section
and .gitmodules are aligned.
In `@pmoves/docs/TAC/TAC_EMBEDDING_PIPELINE.md`:
- Around line 58-63: The docs table uses the wrong config key name
EXTRACT_WORKER_HOST_PORT; update the entry in TAC_EMBEDDING_PIPELINE.md to match
the actual compose key EXTRACT_WORKER_PORT so operator overrides and compose
settings align; ensure the table row for the Extract Worker port lists
`EXTRACT_WORKER_PORT` (default `8083`) wherever `EXTRACT_WORKER_HOST_PORT`
appears and run a quick consistency check against the compose variable name.
- Around line 29-47: The fenced ASCII diagram starting with "Upstream Sources"
is missing a language tag (MD040); update the opening fence so it reads a
triple-backtick with the language identifier "text" (i.e., replace the current
``` with ```text) and leave the closing ``` unchanged to ensure the diagram
block is properly marked; locate the block containing "Upstream Sources",
"LangExtract (8084)", "Extract Worker (8083)", and "Hi-RAG v2 (8086)" to apply
the change.
- Around line 25-26: The doc line that lists only "Docker Profile:
orchestration" in TAC_EMBEDDING_PIPELINE.md is out of sync with the compose
setup which places the pdf-ingest service under both the workers and
orchestration profiles; update the Docker Profile entry to mention both
"workers" and "orchestration" (or change the phrasing to "Docker Profiles:
workers, orchestration") and explicitly call out the pdf-ingest service so the
documentation matches the compose configuration and avoids operational drift.
In `@pmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.md`:
- Around line 5-10: Update the stale section label so the TAC Tree Index heading
matches the document version: change the substring "TAC Tree Index (v2.1" to
"TAC Tree Index (v2.2" so the heading and the top-level "Version: 2.2" label are
consistent; look for the literal strings "Version: 2.2" and "TAC Tree Index
(v2.1" in the file and update the latter to v2.2.
- Around line 43-58: Add the missing E2B services and NATS subjects to the
`.claude/context` catalogs: in the services catalog (`services-catalog.md`) add
entries for "E2B MCP Server" (port 7073, health endpoint /healthz), "E2B Surf"
(port 3080, /api/health), "E2B Desktop" (port 6080, /health) and "E2B Sandbox"
(port 7070, /health); in the NATS subjects catalog (`nats-subjects.md`) add the
eight E2B subjects: e2b.desktop.request.v1, e2b.desktop.ready.v1,
e2b.desktop.completed.v1, e2b.desktop.failed.v1, e2b.spell.execute.v1,
e2b.spell.completed.v1, e2b.surf.request.v1, and e2b.surf.completed.v1, ensuring
entries reference TAC_E2B_SANDBOX.md as the source and follow the existing
formatting and grouping used by TAC_EMBEDDING_PIPELINE.md and
TAC_MEDIA_ANALYSIS.md.
In `@pmoves/docs/TAC/TAC_MEDIA_ANALYSIS.md`:
- Around line 27-49: The fenced code block containing the ASCII architecture
diagram is missing a language tag (triple backticks used without a language)
which triggers MD040; update the opening fence (the triple backticks before the
diagram) to include a language tag such as ```text or ```ascii so the block is
explicitly annotated, e.g., change the ``` that precedes the PMOVES.YT /
FFmpeg-Whisper diagram to ```text to satisfy MD040 while leaving the diagram
content unchanged.
- Around line 16-24: Update the Media-Video Analyzer and Media-Audio Analyzer
sections to list both active Docker profiles ("workers" and "orchestration")
instead of only "workers"; locate the headings for "Media-Video Analyzer (8081)"
and "Media-Audio Analyzer (8082)" and change their "Docker Profile:" lines to
include both profiles so the doc matches the docker-compose assignment for
media-video and media-audio.
- Around line 81-87: Replace the hardcoded container exec command `docker exec
pmoves-media-video-1 nvidia-smi` with a portable docker-compose exec invocation
using the service name (e.g., use `docker compose --profile workers exec
media-video nvidia-smi`) so the command works regardless of project name or
container instance; update the TAC_MEDIA_ANALYSIS.md snippet to use `docker
compose exec` (or suggest resolving the container with `docker compose
ps`/`docker ps` and the service name `media-video`) to verify GPU access across
environments and shells.
---
Nitpick comments:
In `@pmoves/configs/tac_trees/tokenism-chit.tac.yaml`:
- Around line 23-28: The task description "Submodule initialized (not shallow)"
overstates the check; update the task text for the rule with id
tokenism.submodule.initialized to accurately reflect that the action only
verifies the presence of PMOVES-ToKenism-Multi/package.json (file_exists target)
— e.g., change the task to "ToKenism submodule package.json present" or similar
concise wording so it no longer claims anything about shallow vs non-shallow
clone state.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: e5982a12-a841-4157-add6-02a917d8c049
📒 Files selected for processing (8)
pmoves/configs/tac_trees/dox-intelligence.tac.yamlpmoves/configs/tac_trees/firefly-iii.tac.yamlpmoves/configs/tac_trees/tokenism-chit.tac.yamlpmoves/docs/PRODUCTION_AUDIT_DASHBOARD.mdpmoves/docs/TAC/TAC_E2B_SANDBOX.mdpmoves/docs/TAC/TAC_EMBEDDING_PIPELINE.mdpmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.mdpmoves/docs/TAC/TAC_MEDIA_ANALYSIS.md
Comment on lines
+53
to
+54
| expect: "Authenticated NATS URL used (nats://nats:pmoves@nats:4222)" | ||
| context: "Must use authenticated NATS URL, not bare nats://nats:4222" |
Contributor
There was a problem hiding this comment.
Avoid embedding credential-shaped URLs in expected text.
Line 53 includes nats://nats:pmoves@nats:4222, which is flagged by secret scanners and can normalize hardcoded credential patterns in docs/config.
Suggested doc-safe expectation text
- expect: "Authenticated NATS URL used (nats://nats:pmoves@nats:4222)"
+ expect: "Authenticated NATS URL used (nats://<user>:<password>@nats:4222)"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| expect: "Authenticated NATS URL used (nats://nats:pmoves@nats:4222)" | |
| context: "Must use authenticated NATS URL, not bare nats://nats:4222" | |
| expect: "Authenticated NATS URL used (nats://<user>:<password>@nats:4222)" | |
| context: "Must use authenticated NATS URL, not bare nats://nats:4222" |
🧰 Tools
🪛 Checkov (3.2.508)
[medium] 53-54: Basic Auth Credentials
(CKV_SECRET_4)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/configs/tac_trees/dox-intelligence.tac.yaml` around lines 53 - 54, The
expected string contains a credential-shaped URL "nats://nats:pmoves@nats:4222"
which triggers secret scanners; update the expectation in the config (the expect
value) to a doc-safe placeholder such as "Authenticated NATS URL used
(nats://<user>:<password>@nats:4222)" or a generic phrase like "Authenticated
NATS URL used (auth-required NATS URL)" and keep the context text "Must use
authenticated NATS URL, not bare nats://nats:4222" unchanged so the intent
remains clear.
Comment on lines
+23
to
+25
| target: "pmoves/docs/TAC/TAC_WEALTH.md" | ||
| pattern: "8075" | ||
| expect: "Port 8075 referenced (FIREFLY_PORT)" |
Contributor
There was a problem hiding this comment.
firefly-iii.docs.port currently targets a string not present in TAC_WEALTH.md.
Line 24 requires 8075 in pmoves/docs/TAC/TAC_WEALTH.md, but provided context (pmoves/docs/TAC/TAC_WEALTH.md:1-10) still shows “Port | None assigned”. This makes the check fail deterministically.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/configs/tac_trees/firefly-iii.tac.yaml` around lines 23 - 25, The
check is failing because the config expects pattern: "8075" (expect: "Port 8075
referenced (FIREFLY_PORT)") but the target document still shows "Port | None
assigned"; update the source of truth so they match by either changing the
config's pattern/expect value to reflect the current document (e.g., adjust
pattern to match "None assigned" or the actual port text) or update the
documentation to include "8075" and the FIREFLY_PORT note; locate the entry
referencing firefly-iii.docs.port and the YAML keys pattern: "8075" and expect:
"Port 8075 referenced (FIREFLY_PORT)" and make them consistent with the TAC
wealth document.
Comment on lines
+8
to
+13
| root: | ||
| id: tokenism | ||
| task: "ToKenism CHIT engine review" | ||
| context: "PMOVES-ToKenism-Multi/ submodule + pmoves/docker-compose.yml" | ||
| agent_hint: codex | ||
| children: |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify this TAC's identifiers vs canonical registry entries.
rg -n -C2 '^\s*id:\s*tokenism\b|^\s*agent_hint:\s*' pmoves/configs/tac_trees/tokenism-chit.tac.yaml
if [ -f pmoves/config/agent_registry.yaml ]; then
rg -n -C2 '\btokenism\b|\bcodex\b' pmoves/config/agent_registry.yaml
else
echo "pmoves/config/agent_registry.yaml not found"
fiRepository: POWERFULMOVES/PMOVES.AI
Length of output: 3440
🏁 Script executed:
# Get the structure and size of the registry file
wc -l pmoves/config/agent_registry.yaml
# Find the agents list section in the registry
rg -n "^agents:|^ - " pmoves/config/agent_registry.yaml | head -80
# Search for tokenism definition in the registry (not just mentions)
rg -B5 -A10 "^tokenism:" pmoves/config/agent_registry.yaml
# Search for codex agent definition
rg -B2 -A8 "^codex:" pmoves/config/agent_registry.yamlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 225
🏁 Script executed:
# Read the agents list section (starting at line 62)
sed -n '62,150p' pmoves/config/agent_registry.yaml
# Check if tokenism appears anywhere in the registry
rg -n "tokenism" pmoves/config/agent_registry.yaml
# Check the full first agents list section
sed -n '15,25p' pmoves/config/agent_registry.yamlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 2938
🏁 Script executed:
# Check if tokenism is defined as an agent (top-level key in agents section)
rg -n "^ tokenism:" pmoves/config/agent_registry.yaml
# See what section the "- codex" list belongs to (line before it)
sed -n '330,365p' pmoves/config/agent_registry.yaml
# Count how many agents are actually defined
rg "^ [a-z_]+:" pmoves/config/agent_registry.yaml | wc -l
# Get just the agent keys
rg "^ [a-z_]+:" pmoves/config/agent_registry.yaml | head -30Repository: POWERFULMOVES/PMOVES.AI
Length of output: 1867
🏁 Script executed:
# Check if codex is defined as an agent
rg "^ codex:" pmoves/config/agent_registry.yaml
# Get all 71 agent keys to confirm tokenism is absent
rg "^ [a-z_]+:" pmoves/config/agent_registry.yaml | sed 's/.*: //' | sortRepository: POWERFULMOVES/PMOVES.AI
Length of output: 1351
Register tokenism and codex as canonical agents in pmoves/config/agent_registry.yaml.
The TAC file references id: tokenism (line 9) and agent_hint: codex throughout, but neither agent is defined in the canonical registry. Per coding guidelines, agent definitions must be maintained in pmoves/config/agent_registry.yaml as the single source of truth for all agents. Add both agents to the registry with appropriate configuration before using them in this TAC tree.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/configs/tac_trees/tokenism-chit.tac.yaml` around lines 8 - 13, The TAC
references an undefined agent id "tokenism" and an agent_hint "codex"; add
canonical entries for both to the canonical agent registry (the project's agent
registry) so they can be referenced by TAC trees. Create registry entries named
"tokenism" and "codex" including required fields (id, display name,
connector/configuration, and any credentials or default params your system
expects) and ensure their ids exactly match the TAC's id: tokenism and
agent_hint: codex so lookups succeed when the TAC loader reads the registry.
Comment on lines
+75
to
+83
| - id: tokenism.env.no-export | ||
| task: "No export syntax in env files" | ||
| action: | ||
| type: grep | ||
| target: "PMOVES-ToKenism-Multi/" | ||
| pattern: "^export " | ||
| invert: true | ||
| expect: "No export statements in env files — pattern should NOT match" | ||
| context: "Docker env_file cannot parse export VAR=val, only VAR=val" |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify runner regex behavior and this rule's pattern.
rg -n -C2 'def _check_grep|re\.search\(' pmoves/tools/tac_runner.py
rg -n -C2 'id: tokenism\.env\.no-export|pattern:|invert:' pmoves/configs/tac_trees/tokenism-chit.tac.yamlRepository: POWERFULMOVES/PMOVES.AI
Length of output: 2579
🏁 Script executed:
#!/bin/bash
# Verify Python re.search behavior with ^ anchor and multiline mode
python3 <<'EOF'
import re
# Test 1: ^ anchor without MULTILINE flag
text_multiline = "line1\nexport VAR=val\nline3"
pattern_no_flag = "^export "
pattern_with_inline = "(?m)^export "
result1 = re.search(pattern_no_flag, text_multiline)
result2 = re.search(pattern_with_inline, text_multiline)
print(f"Test 1 - Pattern without flag on multiline text: {bool(result1)}")
print(f"Test 2 - Pattern with (?m) inline flag on multiline text: {bool(result2)}")
# Test 2: ^ at file start
text_start = "export VAR=val\nline2"
result3 = re.search(pattern_no_flag, text_start)
print(f"Test 3 - Pattern at file start: {bool(result3)}")
# Test 3: with MULTILINE flag
result4 = re.search(pattern_no_flag, text_multiline, re.MULTILINE)
print(f"Test 4 - Pattern with re.MULTILINE flag on multiline text: {bool(result4)}")
EOFRepository: POWERFULMOVES/PMOVES.AI
Length of output: 285
🏁 Script executed:
#!/bin/bash
# Check the invert logic in tac_runner.py
rg -n -A10 "invert.*True\|invert.*true\|invert:" pmoves/tools/tac_runner.py | head -40Repository: POWERFULMOVES/PMOVES.AI
Length of output: 49
🏁 Script executed:
#!/bin/bash
# List files in the target directory to understand scope
ls -la PMOVES-ToKenism-Multi/ 2>/dev/null | head -20
find PMOVES-ToKenism-Multi/ -type f -name "*.env*" 2>/dev/null | head -20Repository: POWERFULMOVES/PMOVES.AI
Length of output: 179
🏁 Script executed:
#!/bin/bash
# Check for agent_registry.yaml and verify canonical agent definitions reference
fd agent_registry.yaml pmoves/
cat pmoves/config/agent_registry.yaml 2>/dev/null | head -30Repository: POWERFULMOVES/PMOVES.AI
Length of output: 926
🏁 Script executed:
#!/bin/bash
# Get full _check_grep function to see invert handling
sed -n '52,100p' pmoves/tools/tac_runner.pyRepository: POWERFULMOVES/PMOVES.AI
Length of output: 1800
🏁 Script executed:
#!/bin/bash
# Search for how invert is processed in the action evaluation
rg -n "invert|result\[.invert" pmoves/tools/tac_runner.py | head -20Repository: POWERFULMOVES/PMOVES.AI
Length of output: 296
🏁 Script executed:
#!/bin/bash
# Check if tokenism agent is referenced in agent_registry.yaml
rg -n "tokenism" pmoves/config/agent_registry.yaml | head -10Repository: POWERFULMOVES/PMOVES.AI
Length of output: 208
no-export grep pattern fails to catch export statements on non-first lines.
The pattern ^export uses the ^ anchor without the multiline flag. In Python's re.search() (which the runner uses without flags), ^ only matches the start of the entire string, not the start of each line. Files with export VAR=val on line 2 or later will incorrectly pass the check.
Use the inline (?m) flag to enable multiline mode:
Proposed fix
- id: tokenism.env.no-export
task: "No export syntax in env files"
action:
type: grep
target: "PMOVES-ToKenism-Multi/"
- pattern: "^export "
+ pattern: "(?m)^export "
invert: true
expect: "No export statements in env files — pattern should NOT match"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - id: tokenism.env.no-export | |
| task: "No export syntax in env files" | |
| action: | |
| type: grep | |
| target: "PMOVES-ToKenism-Multi/" | |
| pattern: "^export " | |
| invert: true | |
| expect: "No export statements in env files — pattern should NOT match" | |
| context: "Docker env_file cannot parse export VAR=val, only VAR=val" | |
| - id: tokenism.env.no-export | |
| task: "No export syntax in env files" | |
| action: | |
| type: grep | |
| target: "PMOVES-ToKenism-Multi/" | |
| pattern: "(?m)^export " | |
| invert: true | |
| expect: "No export statements in env files — pattern should NOT match" | |
| context: "Docker env_file cannot parse export VAR=val, only VAR=val" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/configs/tac_trees/tokenism-chit.tac.yaml` around lines 75 - 83, The
grep rule with id tokenism.env.no-export currently uses pattern "^export " which
only matches at the start of the entire file and misses export statements on
subsequent lines; update the rule's pattern (in the tokenism.env.no-export
action.pattern) to enable multiline matching (for example by prefixing the regex
with the inline (?m) flag) so ^ will match the start of every line and detect
any "export " occurrences anywhere in the file.
Comment on lines
+86
to
+93
| - id: tokenism.env.compose | ||
| task: "Docker Compose service defined" | ||
| action: | ||
| type: grep | ||
| target: "pmoves/docker-compose.yml" | ||
| pattern: "tokenism-simulator|tokenism-ui" | ||
| expect: "Tokenism services defined in compose" | ||
| context: "Port 8103 (simulator), Next.js UI" |
Contributor
There was a problem hiding this comment.
Compose check does not guarantee both services are present.
tokenism-simulator|tokenism-ui passes if either exists, but the task expects both services.
Proposed fix
- id: tokenism.env.compose
task: "Docker Compose service defined"
action:
type: grep
target: "pmoves/docker-compose.yml"
- pattern: "tokenism-simulator|tokenism-ui"
+ pattern: "(?s)(?=.*tokenism-simulator)(?=.*tokenism-ui)"
expect: "Tokenism services defined in compose"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - id: tokenism.env.compose | |
| task: "Docker Compose service defined" | |
| action: | |
| type: grep | |
| target: "pmoves/docker-compose.yml" | |
| pattern: "tokenism-simulator|tokenism-ui" | |
| expect: "Tokenism services defined in compose" | |
| context: "Port 8103 (simulator), Next.js UI" | |
| - id: tokenism.env.compose | |
| task: "Docker Compose service defined" | |
| action: | |
| type: grep | |
| target: "pmoves/docker-compose.yml" | |
| pattern: "(?s)(?=.*tokenism-simulator)(?=.*tokenism-ui)" | |
| expect: "Tokenism services defined in compose" | |
| context: "Port 8103 (simulator), Next.js UI" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/configs/tac_trees/tokenism-chit.tac.yaml` around lines 86 - 93, The
compose check (id: tokenism.env.compose, task: "Docker Compose service defined")
currently uses a single regex "tokenism-simulator|tokenism-ui" which matches if
either service exists; update the check to require both services by replacing
the pattern with a combined assertion (e.g. a regex with positive lookaheads
that checks for both "tokenism-simulator" and "tokenism-ui") or run two separate
grep checks for each service, and update the expect message to say "Both
Tokenism services defined in compose" to reflect the stricter requirement.
Comment on lines
+5
to
10
| **Version:** 2.2 | ||
| **Last Updated:** 2026-03-15 | ||
| **Scope:** 23 markdown TAC trees + 12 YAML TAC trees + this topology map | ||
| **Scope:** 26 markdown TAC trees + 14 YAML TAC trees + this topology map (~55% coverage) | ||
|
|
||
| ### TAC Tree Index (v2.1 — 7 new P1 additions) | ||
|
|
Contributor
There was a problem hiding this comment.
Section version label is stale after bump to v2.2.
Line 5 sets version 2.2, but Line 9 still says TAC Tree Index (v2.1 ...). Please keep these in sync.
🧰 Tools
🪛 markdownlint-cli2 (0.21.0)
[warning] 9-9: Heading levels should only increment by one level at a time
Expected: h2; Actual: h3
(MD001, heading-increment)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.md` around lines 5 - 10, Update the
stale section label so the TAC Tree Index heading matches the document version:
change the substring "TAC Tree Index (v2.1" to "TAC Tree Index (v2.2" so the
heading and the top-level "Version: 2.2" label are consistent; look for the
literal strings "Version: 2.2" and "TAC Tree Index (v2.1" in the file and update
the latter to v2.2.
Comment on lines
+43
to
+58
| **Pipelines (Umbrella TACs):** | ||
| - `TAC_EMBEDDING_PIPELINE.md` — Extract Worker + LangExtract + PDF Ingest (NEW) | ||
| - `TAC_MEDIA_ANALYSIS.md` — Media-Video + Media-Audio analyzers (NEW) | ||
| - `TAC_E2B_SANDBOX.md` — E2B code execution ecosystem (NEW) | ||
|
|
||
| **Integrations:** | ||
| - `TAC_HEALTH.md` — Fitness tracking (wger) | ||
| - `TAC_WEALTH.md` — Finance management (Firefly III) | ||
| - `TAC_INTEGRATION_TOPOLOGY.md` — This file (master map) | ||
|
|
||
| **YAML Audit Trees (14):** | ||
| - `agent-zero-customization.tac.yaml`, `archon-agents.tac.yaml`, `botz-mcp.tac.yaml` | ||
| - `comfyui-pipeline.tac.yaml`, `dox-intelligence.tac.yaml` (NEW), `firefly-iii.tac.yaml` (UPDATED) | ||
| - `health-wger.tac.yaml`, `hirag-retrieval.tac.yaml`, `n8n.tac.yaml` | ||
| - `observability.tac.yaml`, `security-posture.tac.yaml`, `soundcloud-ingest.tac.yaml` | ||
| - `tensorzero-gpu.tac.yaml`, `tokenism-chit.tac.yaml` (NEW) |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify new NATS subjects are captured in the shared subject catalog
rg -n 'ingest\.file\.added\.v1|ingest\.transcript\.ready\.v1|e2b\.desktop\.request\.v1|e2b\.desktop\.ready\.v1|e2b\.spell\.execute\.v1|e2b\.surf\.request\.v1' .claude/context/nats-subjects.md
# Verify newly documented services/ports/health endpoints are in services catalog
rg -n 'extract-worker|langextract|pdf-ingest|media-video|media-audio|e2b.*mcp|8083|8084|8092|8079|8082|7073|3080|6080|7070|healthz|api/health' .claude/context/services-catalog.mdRepository: POWERFULMOVES/PMOVES.AI
Length of output: 2905
🏁 Script executed:
# Check if TAC_E2B_SANDBOX.md exists and extract NATS subjects and service info
cat pmoves/docs/TAC/TAC_E2B_SANDBOX.md | head -100Repository: POWERFULMOVES/PMOVES.AI
Length of output: 3794
🏁 Script executed:
# Check TAC_EMBEDDING_PIPELINE.md for service/NATS details
cat pmoves/docs/TAC/TAC_EMBEDDING_PIPELINE.md | head -100Repository: POWERFULMOVES/PMOVES.AI
Length of output: 2756
🏁 Script executed:
# Check TAC_MEDIA_ANALYSIS.md for service/NATS details
cat pmoves/docs/TAC/TAC_MEDIA_ANALYSIS.md | head -100Repository: POWERFULMOVES/PMOVES.AI
Length of output: 2521
Document E2B sandbox services and NATS subjects in .claude/context catalogs.
TAC_EMBEDDING_PIPELINE.md and TAC_MEDIA_ANALYSIS.md services (8083, 8084, 8092, 8079, 8082) are properly documented in .claude/context/services-catalog.md, but TAC_E2B_SANDBOX.md introduces four additional services and eight NATS subjects missing from the catalogs:
Missing from services-catalog.md:
- E2B MCP Server (7073,
/healthz) - E2B Surf (3080,
/api/health) - E2B Desktop (6080,
/health) - E2B Sandbox (7070,
/health)
Missing from nats-subjects.md:
e2b.desktop.request.v1,e2b.desktop.ready.v1,e2b.desktop.completed.v1,e2b.desktop.failed.v1e2b.spell.execute.v1,e2b.spell.completed.v1e2b.surf.request.v1,e2b.surf.completed.v1
Per coding guidelines ("**/*.md: Document NATS event topology in .claude/context/nats-subjects.md and maintain services catalog with port assignments and health endpoints in .claude/context/services-catalog.md"), these E2B entries must be added to both catalogs.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/docs/TAC/TAC_INTEGRATION_TOPOLOGY.md` around lines 43 - 58, Add the
missing E2B services and NATS subjects to the `.claude/context` catalogs: in the
services catalog (`services-catalog.md`) add entries for "E2B MCP Server" (port
7073, health endpoint /healthz), "E2B Surf" (port 3080, /api/health), "E2B
Desktop" (port 6080, /health) and "E2B Sandbox" (port 7070, /health); in the
NATS subjects catalog (`nats-subjects.md`) add the eight E2B subjects:
e2b.desktop.request.v1, e2b.desktop.ready.v1, e2b.desktop.completed.v1,
e2b.desktop.failed.v1, e2b.spell.execute.v1, e2b.spell.completed.v1,
e2b.surf.request.v1, and e2b.surf.completed.v1, ensuring entries reference
TAC_E2B_SANDBOX.md as the source and follow the existing formatting and grouping
used by TAC_EMBEDDING_PIPELINE.md and TAC_MEDIA_ANALYSIS.md.
Comment on lines
+16
to
+24
| - **Docker Profile:** `workers` | ||
|
|
||
| ### Media-Audio Analyzer (8082) | ||
| - **Role:** Emotion detection and speaker identification | ||
| - **Model:** `superb/hubert-large-superb-er` | ||
| - **Output:** Supabase (speaker segments, emotion labels) | ||
| - **GPU:** Required (NVIDIA CUDA) | ||
| - **Docker Profile:** `workers` | ||
|
|
Contributor
There was a problem hiding this comment.
Document both active Docker profiles for media services.
Lines 16 and 23 list only workers, but pmoves/docker-compose.yml:51-100 places both media-video and media-audio in workers and orchestration.
Suggested doc fix
- - **Docker Profile:** `workers`
+ - **Docker Profile:** `workers`, `orchestration`
@@
- - **Docker Profile:** `workers`
+ - **Docker Profile:** `workers`, `orchestration`As per coding guidelines, "pmoves/docs/**: Check docs for operational accuracy ... Keep status claims aligned with evidence in runbooks and smokes."
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - **Docker Profile:** `workers` | |
| ### Media-Audio Analyzer (8082) | |
| - **Role:** Emotion detection and speaker identification | |
| - **Model:** `superb/hubert-large-superb-er` | |
| - **Output:** Supabase (speaker segments, emotion labels) | |
| - **GPU:** Required (NVIDIA CUDA) | |
| - **Docker Profile:** `workers` | |
| - **Docker Profile:** `workers`, `orchestration` | |
| ### Media-Audio Analyzer (8082) | |
| - **Role:** Emotion detection and speaker identification | |
| - **Model:** `superb/hubert-large-superb-er` | |
| - **Output:** Supabase (speaker segments, emotion labels) | |
| - **GPU:** Required (NVIDIA CUDA) | |
| - **Docker Profile:** `workers`, `orchestration` |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/docs/TAC/TAC_MEDIA_ANALYSIS.md` around lines 16 - 24, Update the
Media-Video Analyzer and Media-Audio Analyzer sections to list both active
Docker profiles ("workers" and "orchestration") instead of only "workers";
locate the headings for "Media-Video Analyzer (8081)" and "Media-Audio Analyzer
(8082)" and change their "Docker Profile:" lines to include both profiles so the
doc matches the docker-compose assignment for media-video and media-audio.
Comment on lines
+27
to
+49
| ``` | ||
| PMOVES.YT / FFmpeg-Whisper | ||
| │ (media files in MinIO) | ||
| │ | ||
| ├─────────────────┐ | ||
| │ │ | ||
| ▼ ▼ | ||
| Media-Video Media-Audio | ||
| (8079) (8082) | ||
| │ │ | ||
| ├── YOLOv8 ├── HuBERT | ||
| ├── Frame sample ├── Speaker ID | ||
| ├── Object detect ├── Emotion class | ||
| │ │ | ||
| └────────┬────────┘ | ||
| │ | ||
| ▼ | ||
| Supabase | ||
| (structured metadata) | ||
| │ | ||
| ▼ | ||
| Hi-RAG v2 / Dashboard | ||
| ``` |
Contributor
There was a problem hiding this comment.
Add a fenced-language tag for the architecture block.
Line 27 opens a fence without language (MD040).
🧰 Tools
🪛 markdownlint-cli2 (0.21.0)
[warning] 27-27: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/docs/TAC/TAC_MEDIA_ANALYSIS.md` around lines 27 - 49, The fenced code
block containing the ASCII architecture diagram is missing a language tag
(triple backticks used without a language) which triggers MD040; update the
opening fence (the triple backticks before the diagram) to include a language
tag such as ```text or ```ascii so the block is explicitly annotated, e.g.,
change the ``` that precedes the PMOVES.YT / FFmpeg-Whisper diagram to ```text
to satisfy MD040 while leaving the diagram content unchanged.
Comment on lines
+81
to
+87
| ```bash | ||
| # Check services running | ||
| docker compose --profile workers ps | grep -E "media-video|media-audio" | ||
|
|
||
| # Verify GPU access | ||
| docker exec pmoves-media-video-1 nvidia-smi | ||
| ``` |
Contributor
There was a problem hiding this comment.
Use portable verification commands (avoid hardcoded container names).
Line 86 (docker exec pmoves-media-video-1) is environment-specific and breaks with project-name variance or non-Bash shells.
Suggested command updates
-# Check services running
-docker compose --profile workers ps | grep -E "media-video|media-audio"
+# Check services running (portable)
+docker compose --profile workers ps media-video media-audio
# Verify GPU access
-docker exec pmoves-media-video-1 nvidia-smi
+docker compose exec media-video nvidia-smiAs per coding guidelines, "pmoves/docs/**: ... Flag command drift across Windows/WSL/Linux instructions."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/docs/TAC/TAC_MEDIA_ANALYSIS.md` around lines 81 - 87, Replace the
hardcoded container exec command `docker exec pmoves-media-video-1 nvidia-smi`
with a portable docker-compose exec invocation using the service name (e.g., use
`docker compose --profile workers exec media-video nvidia-smi`) so the command
works regardless of project name or container instance; update the
TAC_MEDIA_ANALYSIS.md snippet to use `docker compose exec` (or suggest resolving
the container with `docker compose ps`/`docker ps` and the service name
`media-video`) to verify GPU access across environments and shells.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Expands TAC coverage from 42% to ~55% with YAML audit trees for named submodules and umbrella TACs for service groups.
New YAML Audit Trees
dox-intelligence.tac.yamltokenism-chit.tac.yamlUpdated YAML TAC
firefly-iii.tac.yaml— Fixed broken submodule reference (shallow clone), made standaloneNew Umbrella Markdown TACs
TAC_EMBEDDING_PIPELINE.mdTAC_MEDIA_ANALYSIS.mdTAC_E2B_SANDBOX.mdCoverage
Test plan
find pmoves/docs/TAC -name "TAC_*.md" | wc -l→ 26find pmoves/configs/tac_trees -name "*.tac.yaml" | wc -l→ 14🤖 Generated with Claude Code
Summary by CodeRabbit
Documentation
Chores