@rizom/ops 0.2.0-alpha.207 → 0.2.0-alpha.208

package/dist/load-registry.d.ts

@@ -36,6 +36,8 @@ export interface ResolvedAtprotoConfig {
     identifier: string;
     /** Owner account DID served at /.well-known/atproto-did for handle verification. */
     accountDid?: string | undefined;
+    /** Whether this account publishes the canonical ai.rizom.brain.* schemas. */
+    lexiconAuthority?: boolean | undefined;
 }
 export interface ResolvedPlaybooksConfig {
     onboarding?: boolean | undefined;

package/dist/schema.d.ts

@@ -47,6 +47,7 @@ declare const setupDeliverySchema: z.ZodObject<{
 declare const atprotoSchema: z.ZodObject<{
     identifier: z.ZodString;
     accountDid: z.ZodOptional<z.ZodString>;
+    lexiconAuthority: z.ZodOptional<z.ZodBoolean>;
 }>;
 declare const siteOverrideSchema: z.ZodObject<{
     package: z.ZodString;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizom/ops",
-  "version": "0.2.0-alpha.207",
+  "version": "0.2.0-alpha.208",
   "description": "Operator CLI for managing private brain fleet registry repos",
   "keywords": [
     "brains",

package/templates/rover-pilot/docs/operator-playbook.md

@@ -180,6 +180,10 @@ Use this when enabling AT Protocol publishing for a single pilot user.
      accountDid: did:plc:example123
    ```
 
+   Only for the PDS account designated by the protocol authority's `_lexicon`
+   DNS TXT record, also set `lexiconAuthority: true`. Every other fleet user
+   must omit it.
+
 2. Put the app password in `users/<handle>.secrets.yaml`:
 
    ```yaml
@@ -191,11 +195,11 @@ Use this when enabling AT Protocol publishing for a single pilot user.
 4. Reconcile/deploy the user or cohort:
    - `bunx brains-ops onboard . <handle>`
    - or `bunx brains-ops reconcile-cohort . <cohort>`
-5. Verify the generated `users/<handle>/brain.yaml` contains `plugins.atproto.identifier` (plus `accountDid` when configured) and `appPassword: ${ATPROTO_APP_PASSWORD}`.
+5. Verify the generated `users/<handle>/brain.yaml` contains `plugins.atproto.identifier` (plus `accountDid` and `lexiconAuthority` when configured) and `appPassword: ${ATPROTO_APP_PASSWORD}`.
 
 Notes:
 
-- The ATProto identifier is public instance config and belongs in `users/<handle>.yaml`.
+- The ATProto identifier and authority flag are public instance config and belong in `users/<handle>.yaml`. Only the DNS-designated authority account may set `lexiconAuthority: true`.
 - The ATProto app password is secret and belongs only in the encrypted per-user secret payload.
 - For smoke deployments, pin only the smoke cohort/user to the released brain version that contains ATProto support.