@rizom/ops 0.2.0-alpha.2 → 0.2.0-alpha.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (46) hide show
  1. package/README.md +6 -2
  2. package/dist/age-key-bootstrap.d.ts +17 -0
  3. package/dist/brains-ops.js +314 -145
  4. package/dist/cert-bootstrap.d.ts +22 -0
  5. package/dist/content-repo.d.ts +12 -0
  6. package/dist/default-user-runner.d.ts +1 -1
  7. package/dist/deploy.js +70 -70
  8. package/dist/index.d.ts +4 -0
  9. package/dist/index.js +314 -145
  10. package/dist/load-registry.d.ts +19 -3
  11. package/dist/observed-status.d.ts +12 -0
  12. package/dist/onboard-user.d.ts +2 -2
  13. package/dist/origin-ca.d.ts +1 -0
  14. package/dist/parse-args.d.ts +1 -0
  15. package/dist/push-secrets.d.ts +9 -0
  16. package/dist/push-target.d.ts +2 -0
  17. package/dist/reconcile-all.d.ts +2 -2
  18. package/dist/reconcile-cohort.d.ts +2 -2
  19. package/dist/reconcile-lib.d.ts +4 -2
  20. package/dist/run-command.d.ts +8 -2
  21. package/dist/run-subprocess.d.ts +6 -0
  22. package/dist/schema.d.ts +103 -6
  23. package/dist/secrets-encrypt.d.ts +32 -0
  24. package/dist/secrets-push.d.ts +2 -5
  25. package/dist/ssh-key-bootstrap.d.ts +26 -0
  26. package/dist/user-runner.d.ts +5 -0
  27. package/package.json +5 -3
  28. package/templates/rover-pilot/.env.schema +5 -0
  29. package/templates/rover-pilot/.github/workflows/build.yml +1 -0
  30. package/templates/rover-pilot/.github/workflows/deploy.yml +52 -14
  31. package/templates/rover-pilot/.github/workflows/reconcile.yml +1 -1
  32. package/templates/rover-pilot/README.md +5 -2
  33. package/templates/rover-pilot/deploy/Dockerfile +22 -7
  34. package/templates/rover-pilot/deploy/kamal/deploy.yml +3 -2
  35. package/templates/rover-pilot/deploy/scripts/decrypt-user-secrets.ts +83 -0
  36. package/templates/rover-pilot/deploy/scripts/provision-server.ts +1 -1
  37. package/templates/rover-pilot/deploy/scripts/resolve-deploy-handles.ts +3 -1
  38. package/templates/rover-pilot/deploy/scripts/resolve-user-config.ts +12 -12
  39. package/templates/rover-pilot/deploy/scripts/sync-content-repo.ts +179 -0
  40. package/templates/rover-pilot/docs/onboarding-checklist.md +23 -8
  41. package/templates/rover-pilot/docs/operator-playbook.md +59 -0
  42. package/templates/rover-pilot/docs/user-onboarding.md +384 -0
  43. package/templates/rover-pilot/package.json +3 -0
  44. package/templates/rover-pilot/pilot.yaml +3 -0
  45. package/templates/rover-pilot/users/alice.yaml +5 -1
  46. package/dist/user-secret-names.d.ts +0 -6
@@ -0,0 +1,384 @@
1
+ # Rover Pilot User Onboarding
2
+
3
+ Welcome to the Rover pilot.
4
+
5
+ This document is written for **first-time users**. You do **not** need prior experience with Rover, MCP, git, or the rest of the system to get started.
6
+
7
+ ## What Rover is
8
+
9
+ Rover is your private AI assistant for working with your own notes, links, and ideas.
10
+
11
+ In this pilot, Rover is intentionally simple:
12
+
13
+ - you will usually talk to it in **Discord**
14
+ - **there is no website to browse**
15
+ - **MCP is optional** and only needed for direct client access or specific testing workflows
16
+ - your content can also live in a normal git repo of markdown/text files; **Obsidian is optional** if you want a nicer note-editing interface
17
+
18
+ You can think of Rover as a private knowledge companion that helps you:
19
+
20
+ - save notes
21
+ - save links
22
+ - reflect on your own material
23
+ - find patterns in what you have collected
24
+ - think through questions with AI
25
+
26
+ ## What you will receive from us
27
+
28
+ We will send you the details you need to get started.
29
+
30
+ That usually includes:
31
+
32
+ - confirmation that Discord is enabled for you, plus the invite/setup steps
33
+ - if needed, your Rover MCP URL: `https://<handle>.rizom.ai/mcp`
34
+ - if needed, your **Bearer token**
35
+ - if needed, an invite to your **private** Rover content repo
36
+ - any extra instructions if we are testing a specific workflow with your cohort
37
+
38
+ If we give you a **Bearer token**, treat it like a password. Do not share it.
39
+
40
+ ## One important idea: Discord is the default, MCP is optional
41
+
42
+ If you are new to Rover, the shortest explanation is:
43
+
44
+ - **Rover** is the assistant
45
+ - **Discord** is the default way most pilot users will talk to it
46
+ - **MCP** is an optional direct connection method for supported AI clients
47
+
48
+ You do not need to understand the protocol details unless we specifically ask you to use MCP.
49
+
50
+ For most users, the practical meaning is simple:
51
+
52
+ - join Discord
53
+ - message Rover there
54
+ - start using it
55
+
56
+ If your cohort is also testing MCP, we will send the URL, Bearer token, and setup help separately.
57
+
58
+ ## What to use first
59
+
60
+ For most users, the easiest first setup is:
61
+
62
+ - **Discord** for talking to Rover
63
+ - a normal **git repo of markdown/text files** only if you also want to work directly with your content later
64
+ - **Obsidian** only if you want a friendlier interface for those same files
65
+ - **Claude Desktop** or another MCP client only if we explicitly ask you to test a direct MCP workflow
66
+
67
+ ## Default setup: Discord
68
+
69
+ For most users, getting started means:
70
+
71
+ - join the Discord server we send you
72
+ - open the Rover channel or DM
73
+ - send a first message
74
+
75
+ Try a first message like:
76
+
77
+ > What can you help me do, and what should I use you for?
78
+
79
+ Or:
80
+
81
+ > Help me save my first note.
82
+
83
+ If Discord is not enabled for you yet, tell us and we will share the right next step.
84
+
85
+ ## Optional: direct MCP access
86
+
87
+ If we have asked you to use an MCP client, use one that supports:
88
+
89
+ - **HTTP / Streamable HTTP MCP**
90
+ - **Bearer token authentication**
91
+
92
+ When your client asks for connection details, use:
93
+
94
+ - **Server URL:** `https://<handle>.rizom.ai/mcp`
95
+ - **Authentication type:** Bearer token
96
+ - **Bearer token:** the token we sent you
97
+
98
+ If the client asks for a name, use something simple like:
99
+
100
+ - `Rover (<handle>)`
101
+
102
+ ## Optional: Claude Desktop setup
103
+
104
+ If we ask you to connect through Claude Desktop and your version supports a **remote HTTP / Streamable HTTP MCP server**, enter:
105
+
106
+ - **Server URL:** `https://<handle>.rizom.ai/mcp`
107
+ - **Authentication:** Bearer token
108
+ - **Token:** the token we sent you
109
+
110
+ Then try a first message like:
111
+
112
+ > What can you help me do, and what should I use you for?
113
+
114
+ Or:
115
+
116
+ > Help me save my first note.
117
+
118
+ If your Claude Desktop version only supports local MCP servers and not remote HTTP MCP cleanly, tell us what version you are using and we will help you.
119
+
120
+ ## Your first 5 minutes
121
+
122
+ Once you are connected, try this sequence:
123
+
124
+ ### 1. Check that Rover responds
125
+
126
+ Ask:
127
+
128
+ > What can you help me do?
129
+
130
+ ### 2. Save a first note
131
+
132
+ Ask:
133
+
134
+ > Save a note: I want to use Rover to collect ideas from my work, reading, and conversations.
135
+
136
+ ### 3. Save a useful link
137
+
138
+ Ask:
139
+
140
+ > Save this link and note why it matters to me: <paste URL>
141
+
142
+ ### 4. Ask Rover to reflect back what it knows
143
+
144
+ Ask:
145
+
146
+ > Based on what I’ve stored so far, what themes are starting to emerge?
147
+
148
+ ### 5. Use it as a thinking partner
149
+
150
+ Ask:
151
+
152
+ > I am thinking through a problem in my work. Help me structure the question and identify what context is missing.
153
+
154
+ ## Wishlist: when Rover cannot do something yet
155
+
156
+ Rover has a built-in **wishlist**.
157
+
158
+ This is important for first-time users because Rover will not be able to do everything yet.
159
+
160
+ If you ask for something Rover cannot do, it should add that request to the wishlist instead of just failing silently.
161
+
162
+ You can think of the wishlist as:
163
+
164
+ - a backlog of missing capabilities
165
+ - a record of things users want Rover to do
166
+ - a way for the pilot team to see which missing features matter most
167
+
168
+ ### When the wishlist is useful
169
+
170
+ The wishlist is especially useful when you ask Rover to do something like:
171
+
172
+ - connect to a tool it does not support yet
173
+ - perform an action it cannot perform yet
174
+ - add a workflow or feature that does not exist yet
175
+
176
+ Examples:
177
+
178
+ > I want Rover to draft and send emails for me.
179
+
180
+ > I want Rover to connect to my calendar.
181
+
182
+ > I want Rover to summarize voice notes automatically.
183
+
184
+ If Rover cannot actually do those things yet, it should tell you that and add the request to the wishlist.
185
+
186
+ ### What happens when something is added to the wishlist
187
+
188
+ When a request is added to the wishlist:
189
+
190
+ - it is saved as a **wish**
191
+ - it starts in a **new** state
192
+ - similar requests can be grouped together instead of creating endless duplicates
193
+ - repeated demand can increase the count of how many times that wish was requested
194
+
195
+ That helps us see which gaps are one-off ideas and which ones keep coming up across real usage.
196
+
197
+ ### How you should use it
198
+
199
+ You do **not** need special commands.
200
+
201
+ Just ask naturally.
202
+
203
+ If Rover cannot do what you asked, a good response from Rover is something like:
204
+
205
+ - it explains the limitation clearly
206
+ - it says the request was added to the wishlist
207
+
208
+ If that does **not** happen, that is useful feedback for us too.
209
+
210
+ ## Git, text files, and Obsidian
211
+
212
+ The underlying content workflow is a normal **git repo** with normal **markdown/text files**.
213
+
214
+ Obsidian is optional. It is just one possible editor for those files.
215
+
216
+ That means:
217
+
218
+ - use **Discord** as the main way to talk to Rover
219
+ - use a normal editor plus **git** if you want to browse, draft, and edit your files directly
220
+ - use **Obsidian** only if you want a more note-focused interface for the same files
221
+ - Rover can pick up those file changes through the normal git-sync / directory-sync flow
222
+
223
+ A simple mental model:
224
+
225
+ - **Discord** = talk to Rover
226
+ - **git repo + text files** = the underlying content
227
+ - **Obsidian** = an optional editor for that content
228
+
229
+ ### Important: your content repo is private
230
+
231
+ If you use the git/text-file workflow, you will be working in your own **private** GitHub repo.
232
+
233
+ That means:
234
+
235
+ - you do **not** need repo access just to use Rover in Discord or through MCP
236
+ - you **do** need GitHub access if you want to clone, edit, and push to your content repo
237
+ - we will invite you only to **your own** content repo, not to the operator repo and not to other users' repos
238
+
239
+ ### How you get access
240
+
241
+ If you want the git/text-file workflow, we will:
242
+
243
+ 1. create or confirm your private content repo
244
+ 2. invite your GitHub account to that repo
245
+ 3. ask you to accept the GitHub invite
246
+ 4. send you the repo URL
247
+
248
+ ### Easiest setup for most users
249
+
250
+ The easiest path for most first-time users is:
251
+
252
+ 1. install **GitHub Desktop**
253
+ 2. accept the repo invite in GitHub
254
+ 3. clone the private repo with GitHub Desktop
255
+ 4. open the cloned folder in your normal editor and edit the markdown/text files directly
256
+ 5. optionally open that same folder as an **Obsidian** vault if you prefer
257
+ 6. commit and push your changes
258
+
259
+ ### Authentication options
260
+
261
+ To work with a private repo, you need GitHub authentication.
262
+
263
+ Usually the easiest order is:
264
+
265
+ 1. **GitHub Desktop** or normal GitHub sign-in
266
+ 2. **SSH key** if you already use git that way
267
+ 3. a **fine-grained personal access token** only if another tool specifically requires it
268
+
269
+ You do **not** need a personal access token just to use Rover in Discord or through MCP.
270
+
271
+ If we have already shared your content repo workflow with you, the normal setup is:
272
+
273
+ 1. clone your Rover content repo locally
274
+ 2. edit the markdown/text files in your normal editor, or open that same folder as an Obsidian vault if you prefer
275
+ 3. optionally install the **Obsidian Git** plugin if you want in-app commit/push/pull support
276
+ 4. edit or organize your notes there
277
+ 5. commit and push your changes through normal git, GitHub Desktop, or the Obsidian Git plugin
278
+ 6. let the normal git-sync flow carry those changes into Rover
279
+
280
+ If we have **not** given you a direct content repo workflow yet, that is fine. You can ignore git, text files, and Obsidian for now and use Rover in Discord. If we have also asked you to test MCP, you can use that too.
281
+
282
+ ## Discord (default)
283
+
284
+ Discord is the default interface for this pilot.
285
+
286
+ Think of it as the main place to:
287
+
288
+ - save quick notes
289
+ - drop in links to save
290
+ - ask short or long questions
291
+ - use Rover day to day without setting up a separate client
292
+
293
+ Important:
294
+
295
+ - **Discord is the main pilot interface moving forward**
296
+ - MCP is **optional**
297
+ - if Discord is enabled, we will send the exact invite/setup steps separately
298
+ - for some pilot setups, Discord-enabled users may need to supply their own bot token
299
+
300
+ If Discord is **not** enabled for you yet, ask us and we will tell you whether your cohort is on the Discord-first workflow.
301
+
302
+ ## What to expect in the pilot
303
+
304
+ This is a real working system, but it is still an early pilot.
305
+
306
+ So you should expect:
307
+
308
+ - some rough edges
309
+ - a setup process that may still be a bit manual
310
+ - a Rover that becomes more useful as you add more notes and links
311
+ - occasional follow-up questions from us about your experience
312
+ - improvements and changes during the pilot
313
+
314
+ That is normal. The point of the pilot is to learn from real use.
315
+
316
+ ## Privacy and boundaries
317
+
318
+ For the pilot:
319
+
320
+ - your Rover is deployed specifically for you
321
+ - if you are using MCP, access to `/mcp` is protected by your Bearer token
322
+ - you should avoid putting highly sensitive material into the pilot unless we have explicitly agreed that it is in scope
323
+
324
+ If you are unsure whether something belongs in Rover, ask us first.
325
+
326
+ ## Troubleshooting
327
+
328
+ ### I opened the domain and it does not look like a normal site
329
+
330
+ That is expected. In this pilot, **there is no website to browse**. Rover runs through Discord and, optionally, a direct MCP endpoint.
331
+
332
+ ### I got an authentication error in MCP
333
+
334
+ Usually this means one of three things:
335
+
336
+ - the Bearer token was missing
337
+ - the Bearer token was pasted incorrectly
338
+ - the client is using the wrong authentication type
339
+
340
+ Double-check that you are using:
341
+
342
+ - URL: `https://<handle>.rizom.ai/mcp`
343
+ - auth type: **Bearer token**
344
+ - token: exactly the token we sent you
345
+
346
+ ### My MCP client says it cannot connect
347
+
348
+ Some clients support local MCP servers better than remote HTTP MCP servers.
349
+
350
+ If that happens, send us:
351
+
352
+ - the name of the client
353
+ - the version you are using
354
+ - the exact error message
355
+ - a screenshot if possible
356
+
357
+ ## What feedback helps us most
358
+
359
+ We especially want to hear:
360
+
361
+ - what was confusing during setup
362
+ - what felt useful immediately
363
+ - what felt weak, awkward, or unclear
364
+ - what you expected Rover to do but could not get it to do
365
+ - whether you would keep using it after the pilot
366
+
367
+ Short, honest feedback is perfect.
368
+
369
+ ## Quick handoff template
370
+
371
+ When we onboard you, the message will look roughly like this:
372
+
373
+ ```text
374
+ Discord enabled: yes/no
375
+ Discord setup: <invite link or setup steps>
376
+ MCP access: optional / enabled / not enabled
377
+
378
+ If MCP is enabled:
379
+ MCP URL: https://<handle>.rizom.ai/mcp
380
+ Auth type: Bearer token
381
+ Bearer token: <token>
382
+ ```
383
+
384
+ If anything is unclear, reply with the exact error text or a screenshot and we will help.
@@ -3,6 +3,9 @@
3
3
  "private": true,
4
4
  "type": "module",
5
5
  "packageManager": "bun@__BUN_VERSION__",
6
+ "dependencies": {
7
+ "age-encryption": "^0.3.0"
8
+ },
6
9
  "devDependencies": {
7
10
  "@rizom/ops": "__BRAINS_OPS_VERSION__"
8
11
  }
@@ -6,3 +6,6 @@ contentRepoPrefix: rover-
6
6
  domainSuffix: .rizom.ai
7
7
  preset: core
8
8
  aiApiKey: AI_API_KEY
9
+ gitSyncToken: GIT_SYNC_TOKEN
10
+ mcpAuthToken: MCP_AUTH_TOKEN
11
+ agePublicKey: age1replace-with-your-public-key
@@ -1,3 +1,7 @@
1
1
  handle: alice
2
+ anchorProfile:
3
+ name: Alice Example
4
+ description: Replace this with Alice's real public profile summary.
2
5
  discord:
3
- enabled: false
6
+ enabled: true
7
+ # anchorUserId: "123456789012345678"
@@ -1,6 +0,0 @@
1
- export interface UserSecretNames {
2
- gitSyncTokenSecretName: string;
3
- mcpAuthTokenSecretName: string;
4
- discordBotTokenSecretName: string;
5
- }
6
- export declare function deriveUserSecretNames(handle: string): UserSecretNames;