@rizom/ops 0.2.0-alpha.276 → 0.2.0-alpha.277

package/dist/run-command.d.ts

@@ -5,7 +5,7 @@ import { type LookupHost } from "./observed-status";
 import { type RunCommand as OpsRunCommand } from "./run-subprocess";
 import { type SshKeygen } from "./ssh-key-bootstrap";
 import type { UserRunner } from "./user-runner";
-import type { cleanupDirectorySyncStress, runDeployedDirectorySyncStress } from "./directory-sync-stress-system";
+import type { cleanupDirectorySyncStress, runDeployedDirectorySyncStress, verifyDirectorySyncStressAccess } from "./directory-sync-stress-system";
 export interface CommandResult {
     success: boolean;
     message?: string;
@@ -19,6 +19,7 @@ export interface CommandDependencies extends LoadPilotRegistryOptions {
     bootstrapRunCommand?: OpsRunCommand | undefined;
     sshKeygen?: SshKeygen | undefined;
     directorySyncStressRunner?: typeof runDeployedDirectorySyncStress | undefined;
+    directorySyncStressAccessRunner?: typeof verifyDirectorySyncStressAccess | undefined;
     directorySyncStressCleanupRunner?: typeof cleanupDirectorySyncStress | undefined;
 }
 export declare const globalFlags: FlagDefinitions;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizom/ops",
-  "version": "0.2.0-alpha.276",
+  "version": "0.2.0-alpha.277",
   "description": "Operator CLI for managing private brain fleet registry repos",
   "keywords": [
     "brains",

package/templates/rover-pilot/.github/workflows/directory-sync-stress.yml

@@ -23,6 +23,11 @@ on:
         description: Type stress:<handle> to confirm reversible content writes
         required: true
         type: string
+      verify_only:
+        description: Verify the content credential path without remote writes or a workload
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -48,7 +53,18 @@ jobs:
         env:
           BWS_ACCESS_TOKEN: ${{ secrets.BWS_ACCESS_TOKEN }}
 
+      - name: Verify smoke directory-sync credential path
+        if: ${{ github.event_name != 'schedule' && inputs.verify_only }}
+        env:
+          HANDLE_INPUT: ${{ inputs.handle }}
+          CONFIRM_INPUT: ${{ inputs.confirm }}
+        run: |
+          bunx brains-ops stress:directory-sync:verify-access "$GITHUB_WORKSPACE" "$HANDLE_INPUT" \
+            --confirm "$CONFIRM_INPUT" \
+            --artifacts-dir "$RUNNER_TEMP/directory-sync-stress"
+
       - name: Run smoke directory-sync stress profile
+        if: ${{ github.event_name == 'schedule' || !inputs.verify_only }}
         env:
           HANDLE_INPUT: ${{ github.event_name == 'schedule' && 'smoke' || inputs.handle }}
           PROFILE_INPUT: ${{ github.event_name == 'schedule' && 'regression' || inputs.profile }}
@@ -69,7 +85,7 @@ jobs:
 
   cleanup:
     needs: stress
-    if: always()
+    if: ${{ always() && (github.event_name == 'schedule' || !inputs.verify_only) }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:

package/templates/rover-pilot/docs/operator-playbook.md

@@ -76,6 +76,8 @@ embeddingEnabled: false
 topicExtractionEnabled: false
 ```
 
+Before authorizing a workload, dispatch the workflow once with `verify_only: true`. That mode loads the same Bitwarden/Varlock content credential, clones the smoke content repository, and runs `git push --dry-run` against a temporary stress ref. It creates no ref, performs no content write, does not contact the deployed runtime, and skips cleanup because no probes were created.
+
 Profiles are deterministic and reversible:
 
 - `regression`: 20 probes;