@rizom/ops 0.2.0-alpha.244 → 0.2.0-alpha.246

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizom/ops",
-  "version": "0.2.0-alpha.244",
+  "version": "0.2.0-alpha.246",
   "description": "Operator CLI for managing private brain fleet registry repos",
   "keywords": [
     "brains",

package/templates/rover-pilot/.github/workflows/reconcile.yml

@@ -39,23 +39,23 @@ jobs:
           # `git diff` cannot see untracked files — without intent-to-add
           # the new config is silently dropped here and every later deploy
           # skips that user (their files never appear in a commit range).
-          git add --intent-to-add -- views users
+          git add --intent-to-add -- users
 
-          if git diff --quiet -- views users; then
+          if git diff --quiet -- users; then
             exit 0
           fi
 
           git fetch origin "${{ github.ref_name }}"
-          if git diff --quiet "origin/${{ github.ref_name }}" -- views users; then
+          if git diff --quiet "origin/${{ github.ref_name }}" -- users; then
             exit 0
           fi
 
           patch_file="$(mktemp)"
-          git diff --binary -- views users > "$patch_file"
+          git diff --binary -- users > "$patch_file"
           git reset --hard "origin/${{ github.ref_name }}"
           git apply --3way --index "$patch_file"
 
-          if git diff --cached --quiet -- views users; then
+          if git diff --cached --quiet -- users; then
             exit 0
           fi
 

package/templates/rover-pilot/README.md

@@ -46,6 +46,8 @@ When a push changes only deploy contract files, CI prints `No affected user conf
 - `brains-ops secrets:encrypt <repo> <handle>`
 - `brains-ops reconcile-cohort <repo> <cohort>`
 - `brains-ops reconcile-all <repo>`
-- `brains-ops reconcile-all <repo> --dry-run` (isolated, no external content-repository access)
+- `brains-ops reconcile-all <repo> --dry-run` (isolated, no external content-repository access; lists both passes' changed files)
+
+`render` owns the observational `views/users.md` projection. Reconcile owns generated per-user config and never rewrites observed status rows.
 
 Use `docs/canonical-crossover-record.md` to record exact forward and rollback artifact pins before an approved crossover window.

package/templates/rover-pilot/docs/canonical-crossover-record.md

@@ -75,8 +75,9 @@ Command:
 bunx brains-ops reconcile-all <canonical-review-copy> --dry-run
 ```
 
-- First-pass changed files:
-- Second-pass changed files (must be zero):
+- First-pass reconciler-owned changed files:
+- Second-pass reconciler-owned changed files (must be zero):
+- Observational `views/users.md` unchanged by reconciliation:
 - Review copy unchanged:
 - External content-repository access blocked:
 
@@ -98,6 +99,6 @@ Complete only inside the explicitly approved maintenance window.
 - Image digest set matched this record:
 - First reconcile reviewed:
 - Per-instance health, MCP authorization, identity, content, and site checks:
-- Second reconcile produced zero drift and no deploy work:
+- Second reconcile produced zero reconciler-owned drift and no deploy work:
 - Freeze lifted:
 - One-week soak start:

package/templates/rover-pilot/docs/operator-playbook.md

@@ -52,7 +52,7 @@ Before the window, record and review:
 - canary-first rollout order, followed by the remaining cohorts;
 - expected `/health` version, unauthenticated MCP response, site marker, and content repository identity for each posture.
 
-Run `bunx brains-ops reconcile-all <canonical-review-copy> --dry-run` against the isolated review copy. The command blocks external content-repository access, leaves the review copy untouched, and must report second-pass zero drift.
+Run `bunx brains-ops reconcile-all <canonical-review-copy> --dry-run` against the isolated review copy. The command blocks external content-repository access, leaves the review copy untouched, lists both passes' changed files, and must report second-pass zero drift. Reconciliation owns generated per-user config; only `render` owns the observational `views/users.md` projection.
 
 During the approved window:
 
@@ -60,9 +60,9 @@ During the approved window:
 2. Publish and verify the reviewed unified runtime and matching ops artifacts. Do not update pilot desired state until the exact versions are installable and the expected images can be built.
 3. Apply the reviewed canonical pilot revision while automation remains disabled. Confirm repository names, server/domain identity, content repositories, secret selectors, image names, and tag identity against the review diff.
 4. Enable only Build, run it for the canonical desired-state revision, and record every resulting image digest. Stop if the observed digest set differs from the cutover record.
-5. Enable only Reconcile, run it once, and review its generated config commit. No generated file may combine canonical config with a retired image version.
-6. Enable Deploy and deploy one handle at a time in the approved order. After each deploy, run `bunx brains-ops verify-user . <handle>` and complete the manual identity, content-sync, and app-managed site checks.
-7. Run Reconcile a second time. Require no generated diff and no deploy work before re-enabling normal automation and lifting the merge/release freeze.
+5. Enable only Reconcile, run it once, and review its generated per-user config commit. It must not rewrite `views/users.md`, and no generated file may combine canonical config with a retired image version.
+6. Enable Deploy and deploy one handle at a time in the approved order. After each deploy, run `bunx brains-ops verify-user . <handle>`, render observed fleet status, and complete the manual identity, content-sync, and app-managed site checks.
+7. Run Reconcile a second time. Require no reconciler-owned generated diff and no deploy work before re-enabling normal automation and lifting the merge/release freeze. Observed status rendering remains separate from this convergence gate.
 
 If any gate fails, disable all three workflows again. Restore the prior pilot desired-state and dependency revision, reconcile with the prior ops version, and redeploy the prior image tag/digest as one rollback pair. Verify the prior `/health` version and identity/content/site checks before re-enabling automation. Never restore only config or only an image.