@rizom/ops 0.2.0-alpha.14 → 0.2.0-alpha.141

package/dist/load-registry.d.ts

@@ -14,7 +14,6 @@ export interface ResolvedCohort {
     presetOverride?: PilotPreset;
     aiApiKeyOverride?: string;
     gitSyncTokenOverride?: string;
-    mcpAuthTokenOverride?: string;
 }
 export interface ResolvedAnchorProfileSocialLink {
     platform: "github" | "instagram" | "linkedin" | "email" | "website";
@@ -29,6 +28,16 @@ export interface ResolvedAnchorProfile {
     story?: string;
     socialLinks?: ResolvedAnchorProfileSocialLink[];
 }
+export interface ResolvedSetupDelivery {
+    delivery: "email";
+    email: string;
+}
+export interface ResolvedAtprotoConfig {
+    identifier: string;
+}
+export interface ResolvedPlaybooksConfig {
+    onboarding?: boolean | undefined;
+}
 export interface ResolvedUserIdentity {
     handle: string;
     cohort: string;
@@ -41,7 +50,9 @@ export interface ResolvedUserIdentity {
     discordAnchorUserId?: string;
     effectiveAiApiKey: string;
     effectiveGitSyncToken: string;
-    effectiveMcpAuthToken: string;
+    setup?: ResolvedSetupDelivery;
+    atproto?: ResolvedAtprotoConfig;
+    playbooks?: ResolvedPlaybooksConfig;
     anchorProfile: ResolvedAnchorProfile;
     snapshotStatus: SnapshotStatus;
 }

package/dist/observed-status.d.ts

@@ -1,4 +1,4 @@
-import type { FetchLike } from "@brains/utils/origin-ca";
+import type { FetchLike } from "@brains/deploy-support/origin-ca";
 import type { ObservedUserStatus, ResolvedUserIdentity } from "./load-registry";
 export interface LookupResult {
     address: string;

package/dist/origin-ca.d.ts

@@ -1 +1 @@
-export { createOriginCertificateRequest, generateOriginKeyPair, issueCloudflareOriginCertificate, setCloudflareZoneSslStrict, type CloudflareOriginCaResult, type FetchLike, type OriginCertificateRequest, type OriginKeyPair, } from "@brains/utils/origin-ca";
+export { createOriginCertificateRequest, generateOriginKeyPair, issueCloudflareOriginCertificate, setCloudflareZoneSslStrict, type CloudflareOriginCaResult, type FetchLike, type OriginCertificateRequest, type OriginKeyPair, } from "@brains/deploy-support/origin-ca";

package/dist/parse-args.d.ts

@@ -6,6 +6,8 @@ export interface ParsedArgs {
         version?: boolean | undefined;
         dryRun?: boolean | undefined;
         pushTo?: string | undefined;
+        cohort?: string | undefined;
+        anchorId?: string | undefined;
     };
 }
 export declare function parseArgs(argv: string[]): ParsedArgs;

package/dist/push-secrets.d.ts

@@ -1,9 +1,2 @@
-import { normalizePushTarget, type PushTarget } from "./push-target";
-import { type RunCommand } from "./run-subprocess";
-export type SecretPair = readonly [name: string, value: string];
-export interface PushSecretsOptions {
-    runCommand?: RunCommand | undefined;
-    logger?: ((message: string) => void) | undefined;
-}
-export declare function pushSecretsToBackend(_target: PushTarget, secrets: readonly SecretPair[], options?: PushSecretsOptions): Promise<void>;
-export { normalizePushTarget };
+export { pushSecretsToBackend, type PushSecretsOptions, type SecretPair, } from "@brains/deploy-support/push-secrets";
+export { normalizePushTarget } from "@brains/deploy-support/push-target";

package/dist/push-target.d.ts

@@ -1,2 +1 @@
-export type PushTarget = "gh";
-export declare function normalizePushTarget(value?: string): PushTarget | undefined;
+export { normalizePushTarget, type PushTarget, } from "@brains/deploy-support/push-target";

package/dist/run-command.d.ts

@@ -1,4 +1,4 @@
-import type { FetchLike } from "@brains/utils/origin-ca";
+import type { FetchLike } from "@brains/deploy-support/origin-ca";
 import type { LoadPilotRegistryOptions } from "./load-registry";
 import { type LookupHost } from "./observed-status";
 import type { ParsedArgs } from "./parse-args";

package/dist/run-subprocess.d.ts

@@ -1,6 +1 @@
-export type RunCommand = (command: string, args: string[], options?: {
-    stdin?: string;
-    env?: NodeJS.ProcessEnv;
-    cwd?: string;
-}) => Promise<void>;
-export declare const runSubprocess: RunCommand;
+export { runSubprocess, type RunCommand, } from "@brains/deploy-support/run-subprocess";

package/dist/schema.d.ts

@@ -1,4 +1,4 @@
-import { z } from "@brains/utils";
+import { z } from "@brains/utils/zod";
 export declare const presetSchema: z.ZodEnum<["core", "default", "pro"]>;
 export declare const exactVersionSchema: z.ZodString;
 export declare const handleSchema: z.ZodString;
@@ -14,7 +14,7 @@ export declare const pilotSchema: z.ZodObject<{
     preset: z.ZodEnum<["core", "default", "pro"]>;
     aiApiKey: z.ZodString;
     gitSyncToken: z.ZodString;
-    mcpAuthToken: z.ZodString;
+    contentRepoAdminToken: z.ZodString;
     agePublicKey: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     agePublicKey: string;
@@ -27,7 +27,7 @@ export declare const pilotSchema: z.ZodObject<{
     preset: "default" | "core" | "pro";
     aiApiKey: string;
     gitSyncToken: string;
-    mcpAuthToken: string;
+    contentRepoAdminToken: string;
 }, {
     agePublicKey: string;
     schemaVersion: 1;
@@ -39,7 +39,7 @@ export declare const pilotSchema: z.ZodObject<{
     preset: "default" | "core" | "pro";
     aiApiKey: string;
     gitSyncToken: string;
-    mcpAuthToken: string;
+    contentRepoAdminToken: string;
 }>;
 export declare const userSchema: z.ZodObject<{
     handle: z.ZodString;
@@ -55,7 +55,30 @@ export declare const userSchema: z.ZodObject<{
     }>;
     aiApiKeyOverride: z.ZodOptional<z.ZodString>;
     gitSyncTokenOverride: z.ZodOptional<z.ZodString>;
-    mcpAuthTokenOverride: z.ZodOptional<z.ZodString>;
+    setup: z.ZodOptional<z.ZodObject<{
+        delivery: z.ZodLiteral<"email">;
+        email: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        email: string;
+        delivery: "email";
+    }, {
+        email: string;
+        delivery: "email";
+    }>>;
+    atproto: z.ZodOptional<z.ZodObject<{
+        identifier: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        identifier: string;
+    }, {
+        identifier: string;
+    }>>;
+    playbooks: z.ZodOptional<z.ZodObject<{
+        onboarding: z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        onboarding?: boolean | undefined;
+    }, {
+        onboarding?: boolean | undefined;
+    }>>;
     anchorProfile: z.ZodOptional<z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
         description: z.ZodOptional<z.ZodString>;
@@ -67,12 +90,12 @@ export declare const userSchema: z.ZodObject<{
             url: z.ZodString;
             label: z.ZodOptional<z.ZodString>;
         }, "strict", z.ZodTypeAny, {
-            url: string;
             platform: "github" | "instagram" | "linkedin" | "email" | "website";
+            url: string;
             label?: string | undefined;
         }, {
-            url: string;
             platform: "github" | "instagram" | "linkedin" | "email" | "website";
+            url: string;
             label?: string | undefined;
         }>, "many">>;
     }, "strict", z.ZodTypeAny, {
@@ -82,8 +105,8 @@ export declare const userSchema: z.ZodObject<{
         description?: string | undefined;
         story?: string | undefined;
         socialLinks?: {
-            url: string;
             platform: "github" | "instagram" | "linkedin" | "email" | "website";
+            url: string;
             label?: string | undefined;
         }[] | undefined;
     }, {
@@ -93,8 +116,8 @@ export declare const userSchema: z.ZodObject<{
         description?: string | undefined;
         story?: string | undefined;
         socialLinks?: {
-            url: string;
             platform: "github" | "instagram" | "linkedin" | "email" | "website";
+            url: string;
             label?: string | undefined;
         }[] | undefined;
     }>>;
@@ -106,7 +129,16 @@ export declare const userSchema: z.ZodObject<{
     };
     aiApiKeyOverride?: string | undefined;
     gitSyncTokenOverride?: string | undefined;
-    mcpAuthTokenOverride?: string | undefined;
+    setup?: {
+        email: string;
+        delivery: "email";
+    } | undefined;
+    atproto?: {
+        identifier: string;
+    } | undefined;
+    playbooks?: {
+        onboarding?: boolean | undefined;
+    } | undefined;
     anchorProfile?: {
         name?: string | undefined;
         email?: string | undefined;
@@ -114,8 +146,8 @@ export declare const userSchema: z.ZodObject<{
         description?: string | undefined;
         story?: string | undefined;
         socialLinks?: {
-            url: string;
             platform: "github" | "instagram" | "linkedin" | "email" | "website";
+            url: string;
             label?: string | undefined;
         }[] | undefined;
     } | undefined;
@@ -127,7 +159,16 @@ export declare const userSchema: z.ZodObject<{
     };
     aiApiKeyOverride?: string | undefined;
     gitSyncTokenOverride?: string | undefined;
-    mcpAuthTokenOverride?: string | undefined;
+    setup?: {
+        email: string;
+        delivery: "email";
+    } | undefined;
+    atproto?: {
+        identifier: string;
+    } | undefined;
+    playbooks?: {
+        onboarding?: boolean | undefined;
+    } | undefined;
     anchorProfile?: {
         name?: string | undefined;
         email?: string | undefined;
@@ -135,8 +176,8 @@ export declare const userSchema: z.ZodObject<{
         description?: string | undefined;
         story?: string | undefined;
         socialLinks?: {
-            url: string;
             platform: "github" | "instagram" | "linkedin" | "email" | "website";
+            url: string;
             label?: string | undefined;
         }[] | undefined;
     } | undefined;
@@ -147,33 +188,28 @@ export declare const cohortSchema: z.ZodEffects<z.ZodObject<{
     presetOverride: z.ZodOptional<z.ZodEnum<["core", "default", "pro"]>>;
     aiApiKeyOverride: z.ZodOptional<z.ZodString>;
     gitSyncTokenOverride: z.ZodOptional<z.ZodString>;
-    mcpAuthTokenOverride: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     members: string[];
     aiApiKeyOverride?: string | undefined;
     gitSyncTokenOverride?: string | undefined;
-    mcpAuthTokenOverride?: string | undefined;
     brainVersionOverride?: string | undefined;
     presetOverride?: "default" | "core" | "pro" | undefined;
 }, {
     members: string[];
     aiApiKeyOverride?: string | undefined;
     gitSyncTokenOverride?: string | undefined;
-    mcpAuthTokenOverride?: string | undefined;
     brainVersionOverride?: string | undefined;
     presetOverride?: "default" | "core" | "pro" | undefined;
 }>, {
     members: string[];
     aiApiKeyOverride?: string | undefined;
     gitSyncTokenOverride?: string | undefined;
-    mcpAuthTokenOverride?: string | undefined;
     brainVersionOverride?: string | undefined;
     presetOverride?: "default" | "core" | "pro" | undefined;
 }, {
     members: string[];
     aiApiKeyOverride?: string | undefined;
     gitSyncTokenOverride?: string | undefined;
-    mcpAuthTokenOverride?: string | undefined;
     brainVersionOverride?: string | undefined;
     presetOverride?: "default" | "core" | "pro" | undefined;
 }>;

package/dist/secrets-encrypt.d.ts

@@ -1,19 +1,19 @@
-import { z } from "@brains/utils";
+import { z } from "@brains/utils/zod";
 declare const encryptedUserSecretsSchema: z.ZodObject<{
     gitSyncToken: z.ZodOptional<z.ZodString>;
-    mcpAuthToken: z.ZodOptional<z.ZodString>;
     discordBotToken: z.ZodOptional<z.ZodString>;
     aiApiKey: z.ZodOptional<z.ZodString>;
+    atprotoAppPassword: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     aiApiKey?: string | undefined;
     gitSyncToken?: string | undefined;
-    mcpAuthToken?: string | undefined;
     discordBotToken?: string | undefined;
+    atprotoAppPassword?: string | undefined;
 }, {
     aiApiKey?: string | undefined;
     gitSyncToken?: string | undefined;
-    mcpAuthToken?: string | undefined;
     discordBotToken?: string | undefined;
+    atprotoAppPassword?: string | undefined;
 }>;
 export type EncryptedUserSecrets = z.infer<typeof encryptedUserSecretsSchema>;
 export interface SecretsEncryptOptions {

package/dist/ssh-key-bootstrap.d.ts

@@ -1,26 +1 @@
-import { type FetchLike } from "@brains/utils/origin-ca";
-import { type RunCommand } from "./run-subprocess";
-export interface SshKeyBootstrapOptions {
-    env?: NodeJS.ProcessEnv | undefined;
-    fetchImpl?: FetchLike | undefined;
-    logger?: (message: string) => void;
-    pushTo?: string | undefined;
-    runCommand?: RunCommand | undefined;
-    sshKeygen?: SshKeygen | undefined;
-}
-export interface SshKeyBootstrapResult {
-    createdHetznerKey: boolean;
-    createdLocalKey: boolean;
-    privateKeyPath: string;
-    publicKeyPath: string;
-    sshKeyName: string;
-}
-export interface SshKeygen {
-    createEd25519KeyPair: (privateKeyPath: string, comment: string) => void;
-    derivePublicKey: (privateKeyPath: string) => string;
-}
-export declare function runPilotSshKeyBootstrap(rootDir: string, options?: SshKeyBootstrapOptions): Promise<{
-    success: boolean;
-    message?: string;
-}>;
-export declare function bootstrapPilotSshKey(rootDir: string, options?: SshKeyBootstrapOptions): Promise<SshKeyBootstrapResult>;
+export { bootstrapSshKey as bootstrapPilotSshKey, runSshKeyBootstrap as runPilotSshKeyBootstrap, type SshKeyBootstrapOptions, type SshKeyBootstrapResult, type SshKeygen, } from "@brains/deploy-support/ssh-key-bootstrap";

package/dist/user-add.d.ts

@@ -0,0 +1,15 @@
+export interface AddPilotUserOptions {
+    cohort: string;
+    anchorId?: string | undefined;
+}
+export interface AddPilotUserResult {
+    handle: string;
+    cohort: string;
+    userPath: string;
+    secretsTemplatePath: string;
+    cohortPath: string;
+    createdUser: boolean;
+    createdSecretsTemplate: boolean;
+    addedToCohort: boolean;
+}
+export declare function addPilotUser(rootDir: string, handle: string, options: AddPilotUserOptions): Promise<AddPilotUserResult>;

package/dist/verify-user.d.ts

@@ -0,0 +1,19 @@
+import type { FetchLike } from "@brains/deploy-support/origin-ca";
+import { type ResolvedUser } from "./load-registry";
+export interface VerifyPilotUserOptions {
+    fetchImpl?: FetchLike;
+    logger?: (message: string) => void;
+}
+export interface FailedCheck {
+    name: string;
+    message: string;
+}
+export interface VerifyPilotUserResult {
+    handle: string;
+    preset: ResolvedUser["preset"];
+    domain: string;
+    contentRepo: string;
+    checks: string[];
+    failedChecks: FailedCheck[];
+}
+export declare function verifyPilotUser(rootDir: string, handle: string, options?: VerifyPilotUserOptions): Promise<VerifyPilotUserResult>;

package/package.json

@@ -4,7 +4,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.2.0-alpha.14",
+  "version": "0.2.0-alpha.141",
   "type": "module",
   "exports": {
     ".": {
@@ -30,14 +30,16 @@
     "build": "bun scripts/build.ts",
     "prepublishOnly": "bun scripts/build.ts",
     "typecheck": "tsc --noEmit",
-    "lint": "eslint . --ext .ts",
-    "lint:fix": "eslint . --ext .ts --fix",
-    "test": "bun test --timeout 20000"
+    "lint": "eslint . --ext .ts,.tsx --max-warnings 0",
+    "lint:fix": "eslint . --ext .ts,.tsx --max-warnings 0 --fix",
+    "test": "bun run build && bun test --timeout 20000",
+    "test:smoke": "bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000"
   },
   "dependencies": {
     "age-encryption": "^0.3.0"
   },
   "devDependencies": {
+    "@brains/deploy-support": "workspace:*",
     "@brains/eslint-config": "workspace:*",
     "@brains/typescript-config": "workspace:*",
     "@brains/utils": "workspace:*",

package/templates/rover-pilot/.env.schema

@@ -14,16 +14,30 @@ AI_API_KEY=
 # @required @sensitive
 GIT_SYNC_TOKEN=
 
-# MCP interface
-# Comes from the decrypted users/<handle>.secrets.yaml.age file.
+# Content repo administration
+# Local/operator secret only. Used by brains-ops to create missing GitHub repos;
+# do not deploy it into Rover runtime config.
 # @required @sensitive
-MCP_AUTH_TOKEN=
+CONTENT_REPO_ADMIN_TOKEN=
 
 # Discord (optional, per-user)
 # Comes from the decrypted users/<handle>.secrets.yaml.age file when enabled.
 # @sensitive
 DISCORD_BOT_TOKEN=
 
+# AT Protocol publishing/discovery (optional, per-user)
+# Comes from the decrypted users/<handle>.secrets.yaml.age file when configured.
+# @sensitive
+ATPROTO_APP_PASSWORD=
+
+# Setup email delivery (optional, shared)
+# Used when a user file declares setup.delivery: email.
+# @sensitive
+SETUP_EMAIL_API_KEY=
+
+# @sensitive
+SETUP_EMAIL_FROM=
+
 # ---- deploy/provision vars ----
 
 # @required @sensitive

package/templates/rover-pilot/.github/workflows/build.yml

@@ -2,6 +2,11 @@ name: Build
 
 on:
   workflow_dispatch:
+    inputs:
+      brain_version:
+        description: Brain version to build; defaults to pilot.yaml brainVersion
+        required: false
+        type: string
   push:
     branches: ["main"]
     paths:
@@ -23,7 +28,10 @@ jobs:
 
       - name: Extract image metadata inputs
         run: |
-          BRAIN_VERSION="$(grep '^brainVersion:' pilot.yaml | sed 's/^brainVersion:[[:space:]]*//' | tr -d '"' | tr -d "'")"
+          BRAIN_VERSION="${{ inputs.brain_version || '' }}"
+          if [ -z "$BRAIN_VERSION" ]; then
+            BRAIN_VERSION="$(grep '^brainVersion:' pilot.yaml | sed 's/^brainVersion:[[:space:]]*//' | tr -d '"' | tr -d "'")"
+          fi
           if [ -z "$BRAIN_VERSION" ]; then
             echo "Missing brainVersion in pilot.yaml" >&2
             exit 1
@@ -32,25 +40,25 @@ jobs:
           echo "IMAGE_REPOSITORY=ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}" >> "$GITHUB_ENV"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Extract image metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.IMAGE_REPOSITORY }}
           tags: |
             type=raw,value=brain-${{ env.BRAIN_VERSION }}
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: deploy/Dockerfile

package/templates/rover-pilot/.github/workflows/deploy.yml

@@ -16,6 +16,10 @@ on:
       - users/*.secrets.yaml.age
       - deploy/**
       - .github/workflows/deploy.yml
+  workflow_run:
+    workflows: [Reconcile]
+    types: [completed]
+    branches: [main]
 
 permissions:
   contents: write
@@ -23,13 +27,16 @@ permissions:
 
 jobs:
   resolve_handles:
+    if: >
+      github.event_name != 'workflow_run' ||
+      github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     outputs:
       handles_json: ${{ steps.resolve.outputs.handles_json }}
     steps:
       - uses: actions/checkout@v5
         with:
-          ref: ${{ github.sha }}
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.sha }}
           fetch-depth: 0
 
       - uses: oven-sh/setup-bun@v2
@@ -41,7 +48,7 @@ jobs:
         id: resolve
         env:
           HANDLE_INPUT: ${{ inputs.handle || '' }}
-          BEFORE_SHA: ${{ github.event.before || '' }}
+          BEFORE_SHA: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.event.before || '' }}
         run: bun deploy/scripts/resolve-deploy-handles.ts
 
   no_changes:
@@ -68,7 +75,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         with:
-          ref: ${{ github.sha }}
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.sha }}
 
       - uses: oven-sh/setup-bun@v2
 
@@ -96,7 +103,8 @@ jobs:
         env:
           SHARED_AI_API_KEY: ${{ secrets[steps.user_secrets.outputs.shared_ai_api_key_secret_name] }}
           SHARED_GIT_SYNC_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_git_sync_token_secret_name] }}
-          SHARED_MCP_AUTH_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_mcp_auth_token_secret_name] }}
+          SETUP_EMAIL_API_KEY: ${{ secrets.SETUP_EMAIL_API_KEY }}
+          SETUP_EMAIL_FROM: ${{ secrets.SETUP_EMAIL_FROM }}
           HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
           HCLOUD_SSH_KEY_NAME: ${{ secrets.HCLOUD_SSH_KEY_NAME }}
           HCLOUD_SERVER_TYPE: ${{ secrets.HCLOUD_SERVER_TYPE }}
@@ -110,7 +118,6 @@ jobs:
         run: |
           export AI_API_KEY="${AI_API_KEY:-$SHARED_AI_API_KEY}"
           export GIT_SYNC_TOKEN="${GIT_SYNC_TOKEN:-$SHARED_GIT_SYNC_TOKEN}"
-          export MCP_AUTH_TOKEN="${MCP_AUTH_TOKEN:-$SHARED_MCP_AUTH_TOKEN}"
           bun deploy/scripts/validate-secrets.ts
 
       - name: Seed content repo
@@ -122,7 +129,7 @@ jobs:
           bun deploy/scripts/sync-content-repo.ts
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -168,14 +175,14 @@ jobs:
         env:
           SHARED_AI_API_KEY: ${{ secrets[steps.user_secrets.outputs.shared_ai_api_key_secret_name] }}
           SHARED_GIT_SYNC_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_git_sync_token_secret_name] }}
-          SHARED_MCP_AUTH_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_mcp_auth_token_secret_name] }}
+          SETUP_EMAIL_API_KEY: ${{ secrets.SETUP_EMAIL_API_KEY }}
+          SETUP_EMAIL_FROM: ${{ secrets.SETUP_EMAIL_FROM }}
           KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
           CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
           PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
         run: |
           export AI_API_KEY="${AI_API_KEY:-$SHARED_AI_API_KEY}"
           export GIT_SYNC_TOKEN="${GIT_SYNC_TOKEN:-$SHARED_GIT_SYNC_TOKEN}"
-          export MCP_AUTH_TOKEN="${MCP_AUTH_TOKEN:-$SHARED_MCP_AUTH_TOKEN}"
           bun deploy/scripts/write-kamal-secrets.ts
 
       - name: Provision server
@@ -271,7 +278,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         with:
-          ref: ${{ github.sha }}
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.sha }}
 
       - uses: oven-sh/setup-bun@v2
 
@@ -293,8 +300,22 @@ jobs:
           if git diff --quiet -- users views; then
             exit 0
           fi
+
+          git fetch origin "${{ github.ref_name }}"
+          if git diff --quiet "origin/${{ github.ref_name }}" -- users views; then
+            exit 0
+          fi
+
+          patch_file="$(mktemp)"
+          git diff --binary -- users views > "$patch_file"
+          git reset --hard "origin/${{ github.ref_name }}"
+          git apply --3way --index "$patch_file"
+
+          if git diff --cached --quiet -- users views; then
+            exit 0
+          fi
+
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add users views
           git commit -m "chore(ops): reconcile generated config"
           git push origin HEAD:${{ github.ref_name }}

package/templates/rover-pilot/.github/workflows/reconcile.yml

@@ -38,8 +38,22 @@ jobs:
           if git diff --quiet -- views users; then
             exit 0
           fi
+
+          git fetch origin "${{ github.ref_name }}"
+          if git diff --quiet "origin/${{ github.ref_name }}" -- views users; then
+            exit 0
+          fi
+
+          patch_file="$(mktemp)"
+          git diff --binary -- views users > "$patch_file"
+          git reset --hard "origin/${{ github.ref_name }}"
+          git apply --3way --index "$patch_file"
+
+          if git diff --cached --quiet -- views users; then
+            exit 0
+          fi
+
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add views users
           git commit -m "chore(ops): reconcile pilot outputs"
-          git push
+          git push origin HEAD:${{ github.ref_name }}

package/templates/rover-pilot/README.md

@@ -29,6 +29,7 @@ The repo also checks in its deploy contract:
 - `.github/workflows/*`
 
 `.env.schema` is the single source of truth for required and sensitive deploy vars.
+Use separate GitHub tokens: `CONTENT_REPO_ADMIN_TOKEN` for operator-side content repo creation/checks, and `GIT_SYNC_TOKEN` for runtime directory-sync git access.
 The shared pilot image tag is `brain-${brainVersion}` end to end.
 When `pilot.yaml.brainVersion` changes and you push, CI rebuilds the shared tag, refreshes generated user env files, and redeploys affected users.
 When a push changes only deploy contract files, CI prints `No affected user configs; skipping deploy.` and stops before Kamal.
@@ -37,7 +38,8 @@ When a push changes only deploy contract files, CI prints `No affected user conf
 
 - `brains-ops init <repo>`
 - `brains-ops render <repo>` — regenerates `views/users.md` with live DNS, `/health`, and unauthenticated `/mcp` status checks
-- `brains-ops onboard <repo> <handle>`
+- `brains-ops user:add <repo> <handle> --cohort <cohort>` — scaffolds a user file, per-user secrets template, and cohort membership
+- `brains-ops onboard <repo> <handle>` — creates/seeds the user's content repo with separate admin and sync tokens
 - `brains-ops age-key:bootstrap <repo>`
 - `brains-ops ssh-key:bootstrap <repo>`
 - `brains-ops cert:bootstrap <repo>`