@rizom/ops 0.2.0-alpha.275 → 0.2.0-alpha.277

package/dist/load-registry.d.ts

@@ -83,6 +83,8 @@ export interface ResolvedUserIdentity {
     cloudflareZoneId?: string | undefined;
     contentRepo: string;
     profileKind?: string | undefined;
+    embeddingEnabled?: boolean | undefined;
+    topicExtractionEnabled?: boolean | undefined;
     siteOverride?: ResolvedSiteOverride;
     discordEnabled: boolean;
     discordAnchorUserId?: string;

package/dist/run-command.d.ts

@@ -5,7 +5,7 @@ import { type LookupHost } from "./observed-status";
 import { type RunCommand as OpsRunCommand } from "./run-subprocess";
 import { type SshKeygen } from "./ssh-key-bootstrap";
 import type { UserRunner } from "./user-runner";
-import type { cleanupDirectorySyncStress, runDeployedDirectorySyncStress } from "./directory-sync-stress-system";
+import type { cleanupDirectorySyncStress, runDeployedDirectorySyncStress, verifyDirectorySyncStressAccess } from "./directory-sync-stress-system";
 export interface CommandResult {
     success: boolean;
     message?: string;
@@ -19,6 +19,7 @@ export interface CommandDependencies extends LoadPilotRegistryOptions {
     bootstrapRunCommand?: OpsRunCommand | undefined;
     sshKeygen?: SshKeygen | undefined;
     directorySyncStressRunner?: typeof runDeployedDirectorySyncStress | undefined;
+    directorySyncStressAccessRunner?: typeof verifyDirectorySyncStressAccess | undefined;
     directorySyncStressCleanupRunner?: typeof cleanupDirectorySyncStress | undefined;
 }
 export declare const globalFlags: FlagDefinitions;

package/dist/schema.d.ts

@@ -118,6 +118,8 @@ export declare const userSchema: z.ZodObject<{
     cloudflareZoneId: z.ZodOptional<z.ZodString>;
     contentRepoOverride: z.ZodOptional<z.ZodString>;
     profileKind: z.ZodOptional<typeof profileKindSchema>;
+    embeddingEnabled: z.ZodOptional<z.ZodBoolean>;
+    topicExtractionEnabled: z.ZodOptional<z.ZodBoolean>;
     addOverride: z.ZodOptional<z.ZodArray<z.ZodString>>;
     removeOverride: z.ZodOptional<z.ZodArray<z.ZodString>>;
     siteOverride: z.ZodOptional<typeof siteOverrideSchema>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizom/ops",
-  "version": "0.2.0-alpha.275",
+  "version": "0.2.0-alpha.277",
   "description": "Operator CLI for managing private brain fleet registry repos",
   "keywords": [
     "brains",

package/templates/rover-pilot/.github/workflows/directory-sync-stress.yml

@@ -23,6 +23,11 @@ on:
         description: Type stress:<handle> to confirm reversible content writes
         required: true
         type: string
+      verify_only:
+        description: Verify the content credential path without remote writes or a workload
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -48,7 +53,18 @@ jobs:
         env:
           BWS_ACCESS_TOKEN: ${{ secrets.BWS_ACCESS_TOKEN }}
 
+      - name: Verify smoke directory-sync credential path
+        if: ${{ github.event_name != 'schedule' && inputs.verify_only }}
+        env:
+          HANDLE_INPUT: ${{ inputs.handle }}
+          CONFIRM_INPUT: ${{ inputs.confirm }}
+        run: |
+          bunx brains-ops stress:directory-sync:verify-access "$GITHUB_WORKSPACE" "$HANDLE_INPUT" \
+            --confirm "$CONFIRM_INPUT" \
+            --artifacts-dir "$RUNNER_TEMP/directory-sync-stress"
+
       - name: Run smoke directory-sync stress profile
+        if: ${{ github.event_name == 'schedule' || !inputs.verify_only }}
         env:
           HANDLE_INPUT: ${{ github.event_name == 'schedule' && 'smoke' || inputs.handle }}
           PROFILE_INPUT: ${{ github.event_name == 'schedule' && 'regression' || inputs.profile }}
@@ -69,7 +85,7 @@ jobs:
 
   cleanup:
     needs: stress
-    if: always()
+    if: ${{ always() && (github.event_name == 'schedule' || !inputs.verify_only) }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:

package/templates/rover-pilot/docs/operator-playbook.md

@@ -69,7 +69,14 @@ If any gate fails, disable all three workflows again. Restore the prior pilot de
 
 ## Directory-sync stress gate
 
-Use the manual `Directory Sync Stress` workflow only against a disposable smoke user. It refuses a target unless the handle, domain, and content repository all identify smoke and the confirmation input exactly matches `stress:<handle>`.
+Use the manual `Directory Sync Stress` workflow only against a disposable smoke user. It refuses a target unless the handle, domain, and content repository all identify smoke, the confirmation input exactly matches `stress:<handle>`, and the user desired state declares the hermetic posture below. Reconcile and deploy this posture before running the workload:
+
+```yaml
+embeddingEnabled: false
+topicExtractionEnabled: false
+```
+
+Before authorizing a workload, dispatch the workflow once with `verify_only: true`. That mode loads the same Bitwarden/Varlock content credential, clones the smoke content repository, and runs `git push --dry-run` against a temporary stress ref. It creates no ref, performs no content write, does not contact the deployed runtime, and skips cleanup because no probes were created.
 
 Profiles are deterministic and reversible:
 
@@ -77,7 +84,7 @@ Profiles are deterministic and reversible:
 - `load`: ramps to 350 probes, updates all, renames 100, updates again, then deletes all;
 - `stress`: ramps to 700 probes and renames 200 before cleanup.
 
-The workflow loads operator credentials through Bitwarden/Varlock, but it is separate from Deploy and cannot deploy an image. It creates a rollback branch before the first content write, gates on health timeouts during the monitored workload window, preserves warmup and cleanup samples as evidence, uploads JSON/Markdown/runtime artifacts, and runs an independent idempotent cleanup job with `if: always()`. Once cleanup confirms that no probes remain, it also prunes retained `ops/directory-sync-stress-backup-*` branches; if probes remain, the branches stay available for recovery.
+The workflow loads operator credentials through Bitwarden/Varlock, but it is separate from Deploy and cannot deploy an image. It creates a rollback branch before the first content write, gates on health timeouts, watchdog restarts, and external AI usage during the monitored workload window, preserves warmup and cleanup samples as evidence, uploads JSON/Markdown/runtime artifacts, and runs an independent idempotent cleanup job with `if: always()`. Once cleanup confirms that no probes remain, it also prunes retained `ops/directory-sync-stress-backup-*` branches; if probes remain, the branches stay available for recovery.
 
 Treat any gated health failure, restart, OOM, residual probe, or entity-baseline drift as a failed gate. Do not restart the target during measurement. Recovery is a separate operator action after evidence collection.