@rizom/ops 0.2.0-alpha.0

package/dist/init.d.ts

@@ -0,0 +1 @@
+export declare function initPilotRepo(rootDir: string): Promise<void>;

package/dist/load-registry.d.ts

@@ -0,0 +1,46 @@
+import { type PilotConfig, type PilotPreset } from "./schema";
+export type ExternalStatus = "unknown" | "ready" | "failed";
+export type SnapshotStatus = "present" | "missing";
+export interface ObservedUserStatus {
+    serverStatus?: ExternalStatus;
+    deployStatus?: ExternalStatus;
+    dnsStatus?: ExternalStatus;
+    mcpStatus?: ExternalStatus;
+}
+export interface ResolvedCohort {
+    id: string;
+    members: string[];
+    brainVersionOverride?: string;
+    presetOverride?: PilotPreset;
+    aiApiKeyOverride?: string;
+}
+export interface ResolvedUserIdentity {
+    handle: string;
+    cohort: string;
+    brainVersion: string;
+    model: "rover";
+    preset: PilotPreset;
+    domain: string;
+    contentRepo: string;
+    discordEnabled: boolean;
+    effectiveAiApiKey: string;
+    snapshotStatus: SnapshotStatus;
+}
+export interface ResolvedUser extends ResolvedUserIdentity {
+    serverStatus: ExternalStatus;
+    deployStatus: ExternalStatus;
+    dnsStatus: ExternalStatus;
+    mcpStatus: ExternalStatus;
+}
+export interface LoadPilotRegistryOptions {
+    resolveStatus?: (user: ResolvedUserIdentity) => Promise<ObservedUserStatus | undefined>;
+}
+export interface PilotRegistry {
+    pilot: PilotConfig;
+    cohorts: ResolvedCohort[];
+    users: ResolvedUser[];
+}
+declare class PilotRegistryError extends Error {
+}
+export declare function loadPilotRegistry(rootDir: string, options?: LoadPilotRegistryOptions): Promise<PilotRegistry>;
+export { PilotRegistryError };

package/dist/onboard-user.d.ts

@@ -0,0 +1,2 @@
+import { type UserRunner } from "./reconcile-lib";
+export declare function onboardUser(rootDir: string, handle: string, runner?: UserRunner): Promise<void>;

package/dist/parse-args.d.ts

@@ -0,0 +1,9 @@
+export interface ParsedArgs {
+    command: string;
+    args: string[];
+    flags: {
+        help?: boolean | undefined;
+        version?: boolean | undefined;
+    };
+}
+export declare function parseArgs(argv: string[]): ParsedArgs;

package/dist/reconcile-all.d.ts

@@ -0,0 +1,2 @@
+import { type UserRunner } from "./reconcile-lib";
+export declare function reconcileAll(rootDir: string, runner?: UserRunner): Promise<void>;

package/dist/reconcile-cohort.d.ts

@@ -0,0 +1,2 @@
+import { type UserRunner } from "./reconcile-lib";
+export declare function reconcileCohort(rootDir: string, cohortId: string, runner?: UserRunner): Promise<void>;

package/dist/reconcile-lib.d.ts

@@ -0,0 +1,16 @@
+import { type PilotRegistry, type ResolvedUser } from "./load-registry";
+import type { UserRunner } from "./user-runner";
+export type { UserRunResult, UserRunner } from "./user-runner";
+export declare function runUsers(rootDir: string, registry: PilotRegistry, users: ResolvedUser[], runner?: UserRunner): Promise<void>;
+export declare function findUser(rootDir: string, handle: string): Promise<{
+    registry: PilotRegistry;
+    user: ResolvedUser;
+}>;
+export declare function findCohortUsers(rootDir: string, cohortId: string): Promise<{
+    registry: PilotRegistry;
+    users: ResolvedUser[];
+}>;
+export declare function findAllUsers(rootDir: string): Promise<{
+    registry: PilotRegistry;
+    users: ResolvedUser[];
+}>;

package/dist/render-users-table.d.ts

@@ -0,0 +1,5 @@
+import { type LoadPilotRegistryOptions, type PilotRegistry } from "./load-registry";
+export interface WriteUsersTableOptions extends LoadPilotRegistryOptions {
+    registry?: PilotRegistry;
+}
+export declare function writeUsersTable(rootDir: string, options?: WriteUsersTableOptions): Promise<void>;

package/dist/run-command.d.ts

@@ -0,0 +1,11 @@
+import type { LoadPilotRegistryOptions } from "./load-registry";
+import type { ParsedArgs } from "./parse-args";
+import type { UserRunner } from "./user-runner";
+export interface CommandResult {
+    success: boolean;
+    message?: string;
+}
+export interface CommandDependencies extends LoadPilotRegistryOptions {
+    runner?: UserRunner;
+}
+export declare function runCommand(parsed: ParsedArgs, dependencies?: CommandDependencies): Promise<CommandResult>;

package/dist/schema.d.ts

@@ -0,0 +1,86 @@
+import { z } from "@brains/utils";
+export declare const presetSchema: z.ZodEnum<["core", "default", "pro"]>;
+export declare const exactVersionSchema: z.ZodString;
+export declare const handleSchema: z.ZodString;
+export declare const secretNameSchema: z.ZodString;
+export declare const pilotSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    brainVersion: z.ZodString;
+    model: z.ZodLiteral<"rover">;
+    githubOrg: z.ZodString;
+    contentRepoPrefix: z.ZodString;
+    domainSuffix: z.ZodString;
+    preset: z.ZodEnum<["core", "default", "pro"]>;
+    aiApiKey: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: 1;
+    brainVersion: string;
+    model: "rover";
+    githubOrg: string;
+    contentRepoPrefix: string;
+    domainSuffix: string;
+    preset: "core" | "default" | "pro";
+    aiApiKey: string;
+}, {
+    schemaVersion: 1;
+    brainVersion: string;
+    model: "rover";
+    githubOrg: string;
+    contentRepoPrefix: string;
+    domainSuffix: string;
+    preset: "core" | "default" | "pro";
+    aiApiKey: string;
+}>;
+export declare const userSchema: z.ZodObject<{
+    handle: z.ZodString;
+    discord: z.ZodObject<{
+        enabled: z.ZodBoolean;
+    }, "strict", z.ZodTypeAny, {
+        enabled: boolean;
+    }, {
+        enabled: boolean;
+    }>;
+    aiApiKeyOverride: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    handle: string;
+    discord: {
+        enabled: boolean;
+    };
+    aiApiKeyOverride?: string | undefined;
+}, {
+    handle: string;
+    discord: {
+        enabled: boolean;
+    };
+    aiApiKeyOverride?: string | undefined;
+}>;
+export declare const cohortSchema: z.ZodEffects<z.ZodObject<{
+    members: z.ZodArray<z.ZodString, "many">;
+    brainVersionOverride: z.ZodOptional<z.ZodString>;
+    presetOverride: z.ZodOptional<z.ZodEnum<["core", "default", "pro"]>>;
+    aiApiKeyOverride: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    members: string[];
+    aiApiKeyOverride?: string | undefined;
+    brainVersionOverride?: string | undefined;
+    presetOverride?: "core" | "default" | "pro" | undefined;
+}, {
+    members: string[];
+    aiApiKeyOverride?: string | undefined;
+    brainVersionOverride?: string | undefined;
+    presetOverride?: "core" | "default" | "pro" | undefined;
+}>, {
+    members: string[];
+    aiApiKeyOverride?: string | undefined;
+    brainVersionOverride?: string | undefined;
+    presetOverride?: "core" | "default" | "pro" | undefined;
+}, {
+    members: string[];
+    aiApiKeyOverride?: string | undefined;
+    brainVersionOverride?: string | undefined;
+    presetOverride?: "core" | "default" | "pro" | undefined;
+}>;
+export type PilotConfig = z.infer<typeof pilotSchema>;
+export type UserConfig = z.infer<typeof userSchema>;
+export type CohortConfig = z.infer<typeof cohortSchema>;
+export type PilotPreset = z.infer<typeof presetSchema>;

package/dist/user-runner.d.ts

@@ -0,0 +1,6 @@
+import type { ResolvedUser } from "./load-registry";
+export interface UserRunResult {
+    brainYaml?: string;
+    envFile?: string;
+}
+export type UserRunner = (user: ResolvedUser) => Promise<UserRunResult | void>;

package/dist/user-secret-names.d.ts

@@ -0,0 +1,6 @@
+export interface UserSecretNames {
+    gitSyncTokenSecretName: string;
+    mcpAuthTokenSecretName: string;
+    discordBotTokenSecretName: string;
+}
+export declare function deriveUserSecretNames(handle: string): UserSecretNames;

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@rizom/ops",
+  "description": "Operator CLI for managing private brain fleet registry repos",
+  "publishConfig": {
+    "access": "public"
+  },
+  "version": "0.2.0-alpha.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./deploy": {
+      "bun": "./src/entries/deploy.ts",
+      "types": "./dist/deploy.d.ts",
+      "import": "./dist/deploy.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "brains-ops": "./dist/brains-ops.js"
+  },
+  "files": [
+    "dist",
+    "templates"
+  ],
+  "scripts": {
+    "build": "bun scripts/build.ts",
+    "prepublishOnly": "bun scripts/build.ts",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint . --ext .ts",
+    "lint:fix": "eslint . --ext .ts --fix",
+    "test": "bun test"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@brains/eslint-config": "workspace:*",
+    "@brains/typescript-config": "workspace:*",
+    "@brains/utils": "workspace:*",
+    "@types/bun": "latest",
+    "typescript": "^5.3.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rizom-ai/brains.git",
+    "directory": "packages/brains-ops"
+  },
+  "license": "Apache-2.0",
+  "author": "Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",
+  "homepage": "https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",
+  "bugs": "https://github.com/rizom-ai/brains/issues",
+  "engines": {
+    "bun": ">=1.3.3"
+  },
+  "keywords": [
+    "brains",
+    "ops",
+    "cli",
+    "deploy",
+    "fleet",
+    "operator"
+  ]
+}

package/templates/rover-pilot/.env.schema

@@ -0,0 +1,54 @@
+# Rover pilot instance env schema
+# This file is the single source of truth for required and sensitive deploy vars.
+# @defaultRequired=false @defaultSensitive=false
+# ----------
+
+# AI provider
+# @required @sensitive
+AI_API_KEY=
+
+# Git sync
+# @required @sensitive
+GIT_SYNC_TOKEN=
+
+# MCP interface
+# @required @sensitive
+MCP_AUTH_TOKEN=
+
+# Discord (optional, per-user)
+# @sensitive
+DISCORD_BOT_TOKEN=
+
+# ---- deploy/provision vars ----
+
+# @required @sensitive
+HCLOUD_TOKEN=
+
+# @required
+HCLOUD_SSH_KEY_NAME=
+
+# @required
+HCLOUD_SERVER_TYPE=
+
+# @required
+HCLOUD_LOCATION=
+
+# @required @sensitive
+KAMAL_SSH_PRIVATE_KEY=
+
+# @required @sensitive
+KAMAL_REGISTRY_PASSWORD=
+
+# @required @sensitive
+CF_API_TOKEN=
+
+# @required
+CF_ZONE_ID=
+
+# ---- TLS cert vars ----
+
+# @required @sensitive
+CERTIFICATE_PEM=
+
+# @required @sensitive
+PRIVATE_KEY_PEM=

package/templates/rover-pilot/.github/workflows/build.yml

@@ -0,0 +1,63 @@
+name: Build
+
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+    paths:
+      - pilot.yaml
+      - deploy/**
+      - .github/workflows/build.yml
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Extract image metadata inputs
+        run: |
+          BRAIN_VERSION="$(grep '^brainVersion:' pilot.yaml | sed 's/^brainVersion:[[:space:]]*//' | tr -d '"' | tr -d "'")"
+          if [ -z "$BRAIN_VERSION" ]; then
+            echo "Missing brainVersion in pilot.yaml" >&2
+            exit 1
+          fi
+          echo "BRAIN_VERSION=$BRAIN_VERSION" >> "$GITHUB_ENV"
+          echo "IMAGE_REPOSITORY=ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}" >> "$GITHUB_ENV"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Extract image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE_REPOSITORY }}
+          tags: |
+            type=raw,value=brain-${{ env.BRAIN_VERSION }}
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: deploy/Dockerfile
+          push: true
+          build-args: |
+            BRAIN_VERSION=${{ env.BRAIN_VERSION }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: |
+            ${{ steps.meta.outputs.labels }}
+            service=rover

package/templates/rover-pilot/.github/workflows/deploy.yml

@@ -0,0 +1,261 @@
+name: Deploy
+
+on:
+  workflow_dispatch:
+    inputs:
+      handle:
+        description: User handle
+        required: true
+        type: string
+  push:
+    branches: ["main"]
+    paths:
+      - users/*/.env
+      - users/*/brain.yaml
+      - deploy/**
+      - .github/workflows/deploy.yml
+
+permissions:
+  contents: write
+  packages: read
+
+jobs:
+  resolve_handles:
+    runs-on: ubuntu-latest
+    outputs:
+      handles_json: ${{ steps.resolve.outputs.handles_json }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install operator tooling
+        run: bun install
+
+      - name: Resolve deploy handles
+        id: resolve
+        env:
+          HANDLE_INPUT: ${{ inputs.handle || '' }}
+          BEFORE_SHA: ${{ github.event.before || '' }}
+        run: bun deploy/scripts/resolve-deploy-handles.ts
+
+  no_changes:
+    needs: resolve_handles
+    if: needs.resolve_handles.outputs.handles_json == '[]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Skip when no user configs changed
+        run: echo "No affected user configs; skipping deploy."
+
+  deploy:
+    needs: resolve_handles
+    if: needs.resolve_handles.outputs.handles_json != '[]'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        handle: ${{ fromJson(needs.resolve_handles.outputs.handles_json) }}
+    concurrency:
+      group: deploy-${{ matrix.handle }}
+      cancel-in-progress: false
+    env:
+      HANDLE: ${{ matrix.handle }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install operator tooling
+        run: bun install
+
+      - name: Reconcile selected user config
+        run: bunx brains-ops onboard "$GITHUB_WORKSPACE" "$HANDLE"
+
+      - name: Resolve generated user config
+        id: user_config
+        run: bun deploy/scripts/resolve-user-config.ts
+
+      - name: Validate selected secrets
+        env:
+          AI_API_KEY: ${{ secrets[steps.user_config.outputs.ai_api_key_secret_name] }}
+          GIT_SYNC_TOKEN: ${{ secrets[steps.user_config.outputs.git_sync_token_secret_name] }}
+          MCP_AUTH_TOKEN: ${{ secrets[steps.user_config.outputs.mcp_auth_token_secret_name] }}
+          DISCORD_BOT_TOKEN: ${{ steps.user_config.outputs.discord_bot_token_secret_name != '' && secrets[steps.user_config.outputs.discord_bot_token_secret_name] || '' }}
+          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
+          HCLOUD_SSH_KEY_NAME: ${{ secrets.HCLOUD_SSH_KEY_NAME }}
+          HCLOUD_SERVER_TYPE: ${{ secrets.HCLOUD_SERVER_TYPE }}
+          HCLOUD_LOCATION: ${{ secrets.HCLOUD_LOCATION }}
+          KAMAL_SSH_PRIVATE_KEY: ${{ secrets.KAMAL_SSH_PRIVATE_KEY }}
+          KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
+          CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
+          CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
+          CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
+          PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
+        run: bun deploy/scripts/validate-secrets.ts
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Wait for shared image tag
+        run: |
+          IMAGE_TAG="${{ steps.user_config.outputs.image_repository }}:brain-${{ steps.user_config.outputs.brain_version }}"
+          for attempt in $(seq 1 24); do
+            if docker manifest inspect "$IMAGE_TAG" >/dev/null 2>&1; then
+              exit 0
+            fi
+            echo "Shared image tag not ready yet ($attempt/24): $IMAGE_TAG"
+            sleep 10
+          done
+          echo "Timed out waiting for $IMAGE_TAG" >&2
+          exit 1
+
+      - name: Install Kamal
+        run: |
+          gem install --user-install kamal
+          ruby -r rubygems -e 'puts Gem.user_dir + "/bin"' >> "$GITHUB_PATH"
+
+      - name: Write Kamal SSH key
+        env:
+          KAMAL_SSH_PRIVATE_KEY: ${{ secrets.KAMAL_SSH_PRIVATE_KEY }}
+        run: bun deploy/scripts/write-ssh-key.ts
+
+      - name: Configure SSH client
+        run: |
+          mkdir -p ~/.ssh
+          cat > ~/.ssh/config <<'EOF'
+          Host *
+            IdentityFile ~/.ssh/id_ed25519
+            IdentitiesOnly yes
+            BatchMode yes
+            StrictHostKeyChecking no
+            UserKnownHostsFile /dev/null
+          EOF
+          chmod 600 ~/.ssh/config
+
+      - name: Write .kamal/secrets
+        env:
+          AI_API_KEY: ${{ secrets[steps.user_config.outputs.ai_api_key_secret_name] }}
+          GIT_SYNC_TOKEN: ${{ secrets[steps.user_config.outputs.git_sync_token_secret_name] }}
+          MCP_AUTH_TOKEN: ${{ secrets[steps.user_config.outputs.mcp_auth_token_secret_name] }}
+          DISCORD_BOT_TOKEN: ${{ steps.user_config.outputs.discord_bot_token_secret_name != '' && secrets[steps.user_config.outputs.discord_bot_token_secret_name] || '' }}
+          KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
+          CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
+          PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
+        run: bun deploy/scripts/write-kamal-secrets.ts
+
+      - name: Provision server
+        id: provision
+        env:
+          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
+          HCLOUD_SSH_KEY_NAME: ${{ secrets.HCLOUD_SSH_KEY_NAME }}
+          HCLOUD_SERVER_TYPE: ${{ secrets.HCLOUD_SERVER_TYPE }}
+          HCLOUD_LOCATION: ${{ secrets.HCLOUD_LOCATION }}
+          INSTANCE_NAME: ${{ steps.user_config.outputs.instance_name }}
+        run: bun deploy/scripts/provision-server.ts
+
+      - name: Update Cloudflare DNS
+        env:
+          CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
+          CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
+          BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          SERVER_IP: ${{ steps.provision.outputs.server_ip }}
+        run: bun deploy/scripts/update-dns.ts
+
+      - name: Validate SSH key
+        run: ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null
+
+      - name: Wait for SSH access
+        env:
+          SERVER_IP: ${{ steps.provision.outputs.server_ip }}
+        run: |
+          SSH_USER="$(ruby -e 'require "yaml"; config = YAML.load_file("deploy/kamal/deploy.yml") || {}; puts(config.dig("ssh", "user") || "root")')"
+          for attempt in $(seq 1 18); do
+            if ssh "$SSH_USER@$SERVER_IP" true >/dev/null 2>&1; then
+              exit 0
+            fi
+            echo "SSH not ready yet (attempt $attempt/18); retrying in 5s..."
+            sleep 5
+          done
+          echo "SSH never became ready for $SSH_USER@$SERVER_IP" >&2
+          exit 1
+
+      - name: Deploy
+        env:
+          SERVER_IP: ${{ steps.provision.outputs.server_ip }}
+          VERSION: brain-${{ steps.user_config.outputs.brain_version }}
+        run: kamal setup --skip-push -c deploy/kamal/deploy.yml
+
+      - name: Verify origin TLS
+        env:
+          SERVER_IP: ${{ steps.provision.outputs.server_ip }}
+          BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+        run: curl -I -k --max-time 20 --resolve "$BRAIN_DOMAIN:443:$SERVER_IP" "https://$BRAIN_DOMAIN/health"
+
+      - name: Upload generated config
+        uses: actions/upload-artifact@v4
+        with:
+          name: generated-${{ matrix.handle }}-config
+          path: |
+            users/${{ matrix.handle }}/brain.yaml
+            users/${{ matrix.handle }}/.env
+
+      - name: Dump remote proxy diagnostics
+        if: failure()
+        env:
+          SERVER_IP: ${{ steps.provision.outputs.server_ip }}
+        run: |
+          if [ -z "$SERVER_IP" ]; then
+            echo "No server IP; skipping diagnostics"
+            exit 0
+          fi
+          SSH_USER="$(ruby -e 'require "yaml"; config = YAML.load_file("deploy/kamal/deploy.yml") || {}; puts(config.dig("ssh", "user") || "root")')"
+          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null "$SSH_USER@$SERVER_IP" '
+            docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}"
+            echo "--- kamal-proxy logs ---"
+            docker logs kamal-proxy --tail 200 || true
+            echo "--- kamal-proxy inspect ---"
+            docker inspect kamal-proxy || true
+          '
+
+  finalize_generated_config:
+    needs: [resolve_handles, deploy]
+    if: needs.resolve_handles.outputs.handles_json != '[]'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install operator tooling
+        run: bun install
+
+      - name: Finalize generated config
+        uses: actions/download-artifact@v4
+        with:
+          pattern: generated-*-config
+          merge-multiple: true
+          path: .
+
+      - name: Regenerate users table
+        run: bunx brains-ops render "$GITHUB_WORKSPACE"
+
+      - name: Commit generated config
+        run: |
+          if git diff --quiet -- users views; then
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add users views
+          git commit -m "chore(ops): reconcile generated config"
+          git push