@rizom/ops 0.2.0-alpha.243 → 0.2.0-alpha.245

package/dist/legacy-pilot-migration.d.ts

@@ -0,0 +1,11 @@
+import { type CohortConfig, type PilotConfig } from "./schema";
+/** Offline-only conversion. Active desired-state loading never calls this. */
+export declare function migrateLegacyPilotConfig(input: unknown): PilotConfig;
+/** Offline-only cohort conversion. */
+export declare function migrateLegacyCohortConfig(input: unknown): CohortConfig;
+/** Offline-only YAML rewrite that retains comments while changing the schema. */
+export declare function migrateLegacyPilotYaml(input: string): string;
+/** Offline-only cohort rewrite that retains comments while changing selection. */
+export declare function migrateLegacyCohortYaml(input: string): string;
+export declare function renderPilotConfig(config: PilotConfig): string;
+export declare function renderCohortConfig(config: CohortConfig): string;

package/dist/load-registry.d.ts

@@ -1,4 +1,4 @@
-import { type PilotConfig, type PilotPreset } from "./schema";
+import { type PilotConfig, type CanonicalBundleId } from "./schema";
 export type ExternalStatus = "unknown" | "ready" | "failed";
 export type SnapshotStatus = "present" | "missing";
 export interface ObservedUserStatus {
@@ -11,7 +11,9 @@ export interface ResolvedCohort {
     id: string;
     members: string[];
     brainVersionOverride?: string;
-    presetOverride?: PilotPreset;
+    bundlesOverride?: CanonicalBundleId[];
+    addOverride?: string[];
+    removeOverride?: string[];
     aiApiKeyOverride?: string;
     gitSyncTokenOverride?: string;
 }
@@ -74,13 +76,13 @@ export interface ResolvedUserIdentity {
     handle: string;
     cohort: string;
     brainVersion: string;
-    model: "rover";
-    preset: PilotPreset;
+    bundles: CanonicalBundleId[];
+    add: string[];
+    remove: string[];
     domain: string;
     cloudflareZoneId?: string | undefined;
     contentRepo: string;
     profileKind?: string | undefined;
-    addOverride?: string[];
     siteOverride?: ResolvedSiteOverride;
     discordEnabled: boolean;
     discordAnchorUserId?: string;

package/dist/reconcile-dry-run.d.ts

@@ -0,0 +1,9 @@
+export interface ReconcileDryRunResult {
+    firstPassChangedFiles: string[];
+    secondPassChangedFiles: string[];
+}
+/**
+ * Reconcile an isolated copy twice with external content-repo access disabled.
+ * The source repository is never written.
+ */
+export declare function dryRunReconcileAll(rootDir: string): Promise<ReconcileDryRunResult>;

package/dist/schema.d.ts

@@ -1,26 +1,46 @@
 import { z } from "@brains/utils/zod";
-export declare const presetSchema: z.ZodEnum<{
-    core: "core";
-    default: "default";
-    pro: "pro";
-}>;
 export declare const exactVersionSchema: z.ZodString;
 export declare const handleSchema: z.ZodString;
 export declare const secretNameSchema: z.ZodString;
 export declare const agePublicKeySchema: z.ZodString;
-export declare const pilotSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<1>;
-    brainVersion: z.ZodString;
-    model: z.ZodLiteral<"rover">;
-    githubOrg: z.ZodString;
-    contentRepoPrefix: z.ZodString;
-    domainSuffix: z.ZodString;
-    preset: typeof presetSchema;
-    aiApiKey: z.ZodString;
-    gitSyncToken: z.ZodString;
-    contentRepoAdminToken: z.ZodString;
-    agePublicKey: z.ZodString;
+export declare const canonicalBundleIdSchema: z.ZodEnum<{
+    core: "core";
+    site: "site";
+    publishing: "publishing";
+    team: "team";
 }>;
+export type CanonicalBundleId = z.output<typeof canonicalBundleIdSchema>;
+export interface PilotConfig {
+    brainVersion: string;
+    bundles: CanonicalBundleId[];
+    add?: string[] | undefined;
+    remove?: string[] | undefined;
+    githubOrg: string;
+    contentRepoPrefix: string;
+    domainSuffix: string;
+    aiApiKey: string;
+    gitSyncToken: string;
+    contentRepoAdminToken: string;
+    agePublicKey: string;
+}
+export interface SiteOverrideConfig {
+    package: string;
+    version: string;
+    theme?: string | undefined;
+    themeVersion?: string | undefined;
+}
+export interface CohortConfig {
+    members: string[];
+    brainVersionOverride?: string | undefined;
+    bundlesOverride?: CanonicalBundleId[] | undefined;
+    addOverride?: string[] | undefined;
+    removeOverride?: string[] | undefined;
+    aiApiKeyOverride?: string | undefined;
+    gitSyncTokenOverride?: string | undefined;
+}
+/** Sole active desired-state contract for the canonical brain. */
+export declare const pilotSchema: z.ZodType<PilotConfig>;
+export declare const cohortSchema: z.ZodType<CohortConfig>;
 declare const anchorProfileSocialLinkSchema: z.ZodObject<{
     platform: z.ZodEnum<{
         github: "github";
@@ -70,12 +90,7 @@ declare const atprotoSchema: z.ZodObject<{
     lexiconAuthority: z.ZodOptional<z.ZodBoolean>;
     jetstream: z.ZodOptional<typeof atprotoJetstreamSchema>;
 }>;
-declare const siteOverrideSchema: z.ZodObject<{
-    package: z.ZodString;
-    version: z.ZodOptional<typeof exactVersionSchema>;
-    theme: z.ZodOptional<z.ZodString>;
-    themeVersion: z.ZodOptional<typeof exactVersionSchema>;
-}>;
+export declare const siteOverrideSchema: z.ZodType<SiteOverrideConfig>;
 declare const playbooksSchema: z.ZodObject<{
     onboarding: z.ZodOptional<z.ZodBoolean>;
 }>;
@@ -92,24 +107,15 @@ export declare const userSchema: z.ZodObject<{
     contentRepoOverride: z.ZodOptional<z.ZodString>;
     profileKind: z.ZodOptional<z.ZodString>;
     addOverride: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    removeOverride: z.ZodOptional<z.ZodArray<z.ZodString>>;
     siteOverride: z.ZodOptional<typeof siteOverrideSchema>;
     setup: z.ZodOptional<typeof setupDeliverySchema>;
     atproto: z.ZodOptional<typeof atprotoSchema>;
     playbooks: z.ZodOptional<typeof playbooksSchema>;
     anchorProfile: z.ZodOptional<typeof anchorProfileSchema>;
 }>;
-export declare const cohortSchema: z.ZodObject<{
-    members: z.ZodArray<z.ZodString>;
-    brainVersionOverride: z.ZodOptional<z.ZodString>;
-    presetOverride: z.ZodOptional<typeof presetSchema>;
-    aiApiKeyOverride: z.ZodOptional<z.ZodString>;
-    gitSyncTokenOverride: z.ZodOptional<z.ZodString>;
-}>;
-export type PilotConfig = z.output<typeof pilotSchema>;
 export type PilotConfigInput = z.input<typeof pilotSchema>;
 export type UserConfig = z.output<typeof userSchema>;
 export type UserConfigInput = z.input<typeof userSchema>;
-export type CohortConfig = z.output<typeof cohortSchema>;
 export type CohortConfigInput = z.input<typeof cohortSchema>;
-export type PilotPreset = z.output<typeof presetSchema>;
 export {};

package/dist/secrets-encrypt.d.ts

@@ -2,6 +2,8 @@ import { z } from "@brains/utils/zod";
 declare const encryptedUserSecretsSchema: z.ZodObject<{
     gitSyncToken: z.ZodOptional<z.ZodString>;
     discordBotToken: z.ZodOptional<z.ZodString>;
+    discordPublicKey: z.ZodOptional<z.ZodString>;
+    discordApplicationId: z.ZodOptional<z.ZodString>;
     aiApiKey: z.ZodOptional<z.ZodString>;
     atprotoAppPassword: z.ZodOptional<z.ZodString>;
     certificatePem: z.ZodOptional<z.ZodString>;

package/dist/stage-legacy-crossover.d.ts

@@ -0,0 +1,20 @@
+import { type SiteOverrideConfig } from "./schema";
+export interface StagedCrossover {
+    outputDir: string;
+    changedFiles: string[];
+}
+interface ReviewedSitePinManifest {
+    sites: Record<string, SiteOverrideConfig>;
+}
+export type ReviewedSitePins = ReviewedSitePinManifest["sites"];
+export interface StageLegacyCrossoverOptions {
+    sitePins?: ReviewedSitePins | undefined;
+}
+export declare function parseReviewedSitePins(input: string): ReviewedSitePins;
+export declare function loadReviewedSitePins(filePath: string): Promise<ReviewedSitePins>;
+/**
+ * Build a complete review copy without mutating the source repository.
+ * This is offline migration tooling; active desired-state loading is canonical-only.
+ */
+export declare function stageLegacyCrossover(sourceDir: string, outputDir: string, options?: StageLegacyCrossoverOptions): Promise<StagedCrossover>;
+export {};

package/dist/verify-user.d.ts

@@ -10,7 +10,7 @@ export interface FailedCheck {
 }
 export interface VerifyPilotUserResult {
     handle: string;
-    preset: ResolvedUser["preset"];
+    bundles: ResolvedUser["bundles"];
     domain: string;
     contentRepo: string;
     checks: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizom/ops",
-  "version": "0.2.0-alpha.243",
+  "version": "0.2.0-alpha.245",
   "description": "Operator CLI for managing private brain fleet registry repos",
   "keywords": [
     "brains",
@@ -17,7 +17,8 @@
   },
   "bugs": "https://github.com/rizom-ai/brains/issues",
   "dependencies": {
-    "age-encryption": "^0.3.0"
+    "age-encryption": "^0.3.0",
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@brains/deploy-support": "workspace:*",

package/templates/rover-pilot/.env.schema

@@ -25,6 +25,13 @@ CONTENT_REPO_ADMIN_TOKEN=
 # @sensitive
 DISCORD_BOT_TOKEN=
 
+# Stored with the per-user Discord credentials and injected at deploy time.
+# @sensitive
+DISCORD_PUBLIC_KEY=
+
+# @sensitive
+DISCORD_APPLICATION_ID=
+
 # AT Protocol publishing/discovery (optional, per-user)
 # Comes from the decrypted users/<handle>.secrets.yaml.age file when configured.
 # @sensitive

package/templates/rover-pilot/.github/workflows/reconcile.yml

@@ -39,23 +39,23 @@ jobs:
           # `git diff` cannot see untracked files — without intent-to-add
           # the new config is silently dropped here and every later deploy
           # skips that user (their files never appear in a commit range).
-          git add --intent-to-add -- views users
+          git add --intent-to-add -- users
 
-          if git diff --quiet -- views users; then
+          if git diff --quiet -- users; then
             exit 0
           fi
 
           git fetch origin "${{ github.ref_name }}"
-          if git diff --quiet "origin/${{ github.ref_name }}" -- views users; then
+          if git diff --quiet "origin/${{ github.ref_name }}" -- users; then
             exit 0
           fi
 
           patch_file="$(mktemp)"
-          git diff --binary -- views users > "$patch_file"
+          git diff --binary -- users > "$patch_file"
           git reset --hard "origin/${{ github.ref_name }}"
           git apply --3way --index "$patch_file"
 
-          if git diff --cached --quiet -- views users; then
+          if git diff --cached --quiet -- users; then
             exit 0
           fi
 

package/templates/rover-pilot/README.md

@@ -1,6 +1,6 @@
-# rover-pilot
+# private brain pilot
 
-Private desired-state repo for the rover pilot.
+Private desired-state repository for the hosted brain pilot. The generated repository/service name may remain `rover-pilot` for deployment identity compatibility.
 
 This is a single operator-owned repo. Pilot users do not get their own brain repos.
 Per-user deploy config lives under `users/<handle>/`, while content stays in per-user content repos.
@@ -31,7 +31,7 @@ The repo also checks in its deploy contract:
 `.env.schema` is the single source of truth for required and sensitive deploy vars.
 Use separate GitHub tokens: `CONTENT_REPO_ADMIN_TOKEN` for operator-side content repo creation/checks, and `GIT_SYNC_TOKEN` for runtime directory-sync git access.
 The default pilot image tag is `brain-${brainVersion}` end to end. A user with `siteOverride` gets an isolated `brain-${brainVersion}-sites-${packageHash}` image instead.
-When the effective brain version (`pilot.yaml.brainVersion`, or a cohort override) changes and you push, CI rebuilds the required default/site tags, refreshes generated user env files, and redeploys affected users. An omitted `siteOverride.version` follows that effective version; an explicit exact version remains pinned.
+When the effective brain version (`pilot.yaml.brainVersion`, or a cohort override) changes and you push, CI rebuilds the required default/site tags, refreshes generated user env files, and redeploys affected users. Every external site and theme package uses its own required exact version pin; ops never infers either version from the brain or from another package.
 When a push changes only deploy contract files, CI prints `No affected user configs; skipping deploy.` and stops before Kamal.
 
 ## Commands
@@ -46,3 +46,8 @@ When a push changes only deploy contract files, CI prints `No affected user conf
 - `brains-ops secrets:encrypt <repo> <handle>`
 - `brains-ops reconcile-cohort <repo> <cohort>`
 - `brains-ops reconcile-all <repo>`
+- `brains-ops reconcile-all <repo> --dry-run` (isolated, no external content-repository access; lists both passes' changed files)
+
+`render` owns the observational `views/users.md` projection. Reconcile owns generated per-user config and never rewrites observed status rows.
+
+Use `docs/canonical-crossover-record.md` to record exact forward and rollback artifact pins before an approved crossover window.

package/templates/rover-pilot/deploy/scripts/decrypt-user-secrets.ts

@@ -25,6 +25,8 @@ writeSecretGitHubEnv(
   secrets["cmsContentRepoPat"] ?? secrets["gitSyncToken"],
 );
 writeSecretGitHubEnv("DISCORD_BOT_TOKEN", secrets["discordBotToken"]);
+writeSecretGitHubEnv("DISCORD_PUBLIC_KEY", secrets["discordPublicKey"]);
+writeSecretGitHubEnv("DISCORD_APPLICATION_ID", secrets["discordApplicationId"]);
 // Per-user AT Protocol publishing credential (optional; from the user's
 // encrypted secrets file). The scaffold wires this so a pilot can publish its
 // brain's agent card to its PDS; a deployment that doesn't publish simply

package/templates/rover-pilot/deploy/scripts/validate-secrets.ts

@@ -14,6 +14,17 @@ for (const key of requiredKeys) {
   }
 }
 
+const discordKeys = [
+  "DISCORD_BOT_TOKEN",
+  "DISCORD_PUBLIC_KEY",
+  "DISCORD_APPLICATION_ID",
+];
+if (discordKeys.some((key) => process.env[key])) {
+  for (const key of discordKeys) {
+    if (!process.env[key]) missing.push(key);
+  }
+}
+
 if (missing.length > 0) {
   throw new Error(`Missing required secrets: ${missing.join(", ")}`);
 }

package/templates/rover-pilot/docs/canonical-crossover-record.md

@@ -0,0 +1,104 @@
+# Canonical Crossover Approval Record
+
+> Draft evidence record only. Completing this file does not authorize a merge, publish, reconcile, or deployment.
+
+Do not include secret values, private keys, access tokens, or decrypted user configuration.
+
+## Authorization and freeze
+
+- Operator:
+- Approval reference:
+- Approved window:
+- Freeze start:
+- Build workflow disabled and idle:
+- Reconcile workflow disabled and idle:
+- Deploy workflow disabled and idle:
+
+## Reviewed inputs
+
+- `brains` crossover commit:
+- Private-pilot source commit used for staging:
+- Canonical review commit:
+- Secret-free review diff SHA-256:
+- Identity-review evidence SHA-256:
+- Reviewed hosted-site pin manifest SHA-256:
+- Source and review worktrees clean:
+
+## Hosted site and theme pins
+
+List every hosted site. External site and theme package versions must be exact and must
+match the staged user desired state; do not infer them from the brain or from each other.
+
+| Handle | Site package | Exact site version | Theme package | Exact theme version | Package/image evidence |
+| ------ | ------------ | ------------------ | ------------- | ------------------- | ---------------------- |
+|        |              |                    |               |                     |                        |
+
+## Forward artifact pins
+
+| Artifact               | Exact version | Registry integrity or digest | Verified installable |
+| ---------------------- | ------------- | ---------------------------- | -------------------- |
+| `@rizom/brain`         |               |                              |                      |
+| `@rizom/ops`           |               |                              |                      |
+| private-pilot lockfile | n/a           |                              |                      |
+
+Record every image. Tags alone are not immutable evidence.
+
+| Cohort/handle | Config commit | Image repository | Image tag | Image digest |
+| ------------- | ------------- | ---------------- | --------- | ------------ |
+|               |               |                  |           |              |
+
+## Rollback pair
+
+- Prior private-pilot commit:
+- Prior `@rizom/ops` version and registry integrity:
+
+| Cohort/handle | Prior config commit | Prior image repository | Prior image tag | Prior image digest |
+| ------------- | ------------------- | ---------------------- | --------------- | ------------------ |
+|               |                     |                        |                 |                    |
+
+## Identity review
+
+- Repository and image names unchanged or explicitly approved:
+- GitHub organization and content repository identities unchanged:
+- Server, domain, Cloudflare zone, and ATProto identities unchanged:
+- Secret selector names and encrypted secret artifacts unchanged:
+- Per-user runtime-version and site-package tag inputs reviewed:
+- No plaintext source secrets copied into the review artifact:
+- No removed model, preset, or old-format schema discriminator remains:
+- Every external hosted site and theme package has an exact reviewed pin:
+
+## Offline convergence
+
+Command:
+
+```sh
+bunx brains-ops reconcile-all <canonical-review-copy> --dry-run
+```
+
+- First-pass reconciler-owned changed files:
+- Second-pass reconciler-owned changed files (must be zero):
+- Observational `views/users.md` unchanged by reconciliation:
+- Review copy unchanged:
+- External content-repository access blocked:
+
+## Pre-window validation
+
+- Package tests, typecheck, lint, build, and packed-consumer startup:
+- Architecture and dependency boundaries:
+- Environment-schema and workspace checks:
+- Crossover migration and comment preservation:
+- Canary-first order and health checks reviewed:
+- Paired rollback reviewed:
+
+## Execution record
+
+Complete only inside the explicitly approved maintenance window.
+
+- Unified packages published and verified:
+- Canonical desired state committed while automation remained frozen:
+- Image digest set matched this record:
+- First reconcile reviewed:
+- Per-instance health, MCP authorization, identity, content, and site checks:
+- Second reconcile produced zero reconciler-owned drift and no deploy work:
+- Freeze lifted:
+- One-week soak start:

package/templates/rover-pilot/docs/onboarding-checklist.md

@@ -23,18 +23,14 @@
 10. Run `bunx brains-ops secrets:encrypt <repo> <handle>`.
 11. Commit and push `users/<handle>.secrets.yaml.age`.
 12. Run `bunx brains-ops onboard <repo> <handle>`.
-13. Verify the deployed Rover contract:
-    - all presets:
-      - `https://<handle>.rizom.ai/health` returns `200`
-      - `https://<handle>.rizom.ai/chat` loads the web chat and accepts passkey sign-in
-      - `https://<handle>.rizom.ai/` loads the dashboard (or site surface on `default` preset)
-      - `https://<handle>.rizom.ai/cms` loads the CMS/login surface
-      - unauthenticated `POST https://<handle>.rizom.ai/mcp` returns the expected auth failure
-      - content repo exists and runtime sync is healthy
-      - background jobs are not repeatedly failing, except for expected missing optional integrations
-    - for `presetOverride: default` users:
-      - initial site build completes
-14. For fleet upgrades, edit `pilot.yaml.brainVersion` and push once; CI rebuilds the required default/site image tags, refreshes generated user env files, and redeploys affected users. Site overrides follow the user's effective brain version unless they declare an explicit exact `version` pin.
+13. Verify the deployed canonical contract:
+    - `https://<handle>.rizom.ai/health` returns `200`
+    - `https://<handle>.rizom.ai/chat` loads the web chat and accepts passkey sign-in
+    - unauthenticated `POST https://<handle>.rizom.ai/mcp` returns the expected auth failure
+    - content repo exists and runtime sync is healthy
+    - background jobs are not repeatedly failing, except for expected missing optional integrations
+    - when `site` is selected, the browser/CMS surfaces load and the initial app-managed site build completes
+14. For fleet upgrades, edit `pilot.yaml.brainVersion` and push once; CI rebuilds the required default/site image tags, refreshes generated user env files, and redeploys affected users. Every external site and theme package keeps its own required exact version pin and never follows the brain version implicitly.
 15. Confirm the user received the setup email, registered their passkey, and can sign in to web chat at `https://<handle>.rizom.ai/chat`. That completes the default onboarding; everything below is per-cohort extras.
 16. Hand over the browser surfaces:
     - Chat (primary): `https://<handle>.rizom.ai/chat`