@rizom/ops 0.2.0-alpha.3 → 0.2.0-alpha.300

package/dist/verify-user.d.ts

@@ -0,0 +1,22 @@
+import type { FetchLike } from "@brains/deploy-support/origin-ca";
+import { type ResolvedUser } from "./load-registry";
+export interface VerifyPilotUserOptions {
+    fetchImpl?: FetchLike;
+    logger?: (message: string) => void;
+    operationalRetryAttempts?: number;
+    operationalRetryDelayMs?: number;
+    sleep?: (delayMs: number) => Promise<void>;
+}
+export interface FailedCheck {
+    name: string;
+    message: string;
+}
+export interface VerifyPilotUserResult {
+    handle: string;
+    bundles: ResolvedUser["bundles"];
+    domain: string;
+    contentRepo: string;
+    checks: string[];
+    failedChecks: FailedCheck[];
+}
+export declare function verifyPilotUser(rootDir: string, handle: string, options?: VerifyPilotUserOptions): Promise<VerifyPilotUserResult>;

package/package.json

@@ -1,65 +1,72 @@
 {
   "name": "@rizom/ops",
+  "version": "0.2.0-alpha.300",
   "description": "Operator CLI for managing private brain fleet registry repos",
-  "publishConfig": {
-    "access": "public"
+  "keywords": [
+    "brains",
+    "ops",
+    "cli",
+    "deploy",
+    "fleet",
+    "operator"
+  ],
+  "license": "AGPL-3.0-only",
+  "author": "Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",
+  "bin": {
+    "brains-ops": "./dist/brains-ops.js"
+  },
+  "bugs": "https://github.com/rizom-ai/brains/issues",
+  "dependencies": {
+    "age-encryption": "^0.3.0",
+    "yaml": "^2.9.0"
+  },
+  "devDependencies": {
+    "@brains/deploy-support": "workspace:*",
+    "@brains/eslint-config": "workspace:*",
+    "@brains/profile": "workspace:*",
+    "@brains/site-composition": "workspace:*",
+    "@brains/typescript-config": "workspace:*",
+    "@brains/utils": "workspace:*",
+    "@types/bun": "^1.3.14",
+    "typescript": "^7.0.2"
+  },
+  "engines": {
+    "bun": ">=1.3.3"
   },
-  "version": "0.2.0-alpha.3",
-  "type": "module",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
     "./deploy": {
-      "bun": "./dist/deploy.js",
       "types": "./dist/deploy.d.ts",
-      "import": "./dist/deploy.js"
+      "import": "./dist/deploy.js",
+      "bun": "./dist/deploy.js"
     }
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "bin": {
-    "brains-ops": "./dist/brains-ops.js"
-  },
   "files": [
     "dist",
     "templates"
   ],
-  "scripts": {
-    "build": "bun scripts/build.ts",
-    "prepublishOnly": "bun scripts/build.ts",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint . --ext .ts",
-    "lint:fix": "eslint . --ext .ts --fix",
-    "test": "bun test"
-  },
-  "dependencies": {},
-  "devDependencies": {
-    "@brains/eslint-config": "workspace:*",
-    "@brains/typescript-config": "workspace:*",
-    "@brains/utils": "workspace:*",
-    "@types/bun": "latest",
-    "typescript": "^5.3.3"
+  "homepage": "https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",
+  "main": "./dist/index.js",
+  "publishConfig": {
+    "access": "public"
   },
   "repository": {
     "type": "git",
     "url": "https://github.com/rizom-ai/brains.git",
     "directory": "packages/brains-ops"
   },
-  "license": "Apache-2.0",
-  "author": "Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",
-  "homepage": "https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",
-  "bugs": "https://github.com/rizom-ai/brains/issues",
-  "engines": {
-    "bun": ">=1.3.3"
+  "scripts": {
+    "build": "bun scripts/build.ts",
+    "lint": "eslint . --max-warnings 0",
+    "lint:fix": "eslint . --max-warnings 0 --fix",
+    "prepublishOnly": "bun scripts/build.ts",
+    "test": "bun run build && bun test --timeout 20000",
+    "test:smoke": "bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",
+    "typecheck": "tsc --noEmit"
   },
-  "keywords": [
-    "brains",
-    "ops",
-    "cli",
-    "deploy",
-    "fleet",
-    "operator"
-  ]
+  "type": "module",
+  "types": "./dist/index.d.ts"
 }

package/templates/rover-pilot/.env.schema

@@ -4,21 +4,47 @@
 # ----------
 
 # AI provider
+# Shared GitHub secret by default; a per-user override may come from the decrypted
+# users/<handle>.secrets.yaml.age file at deploy time.
 # @required @sensitive
 AI_API_KEY=
 
 # Git sync
+# Comes from the decrypted users/<handle>.secrets.yaml.age file.
 # @required @sensitive
 GIT_SYNC_TOKEN=
 
-# MCP interface
+# Content repo administration
+# Local/operator secret only. Used by brains-ops to create missing GitHub repos;
+# do not deploy it into Rover runtime config.
 # @required @sensitive
-MCP_AUTH_TOKEN=
+CONTENT_REPO_ADMIN_TOKEN=
 
 # Discord (optional, per-user)
+# Comes from the decrypted users/<handle>.secrets.yaml.age file when enabled.
 # @sensitive
 DISCORD_BOT_TOKEN=
 
+# Stored with the per-user Discord credentials and injected at deploy time.
+# @sensitive
+DISCORD_PUBLIC_KEY=
+
+# @sensitive
+DISCORD_APPLICATION_ID=
+
+# AT Protocol publishing/discovery (optional, per-user)
+# Comes from the decrypted users/<handle>.secrets.yaml.age file when configured.
+# @sensitive
+ATPROTO_APP_PASSWORD=
+
+# Setup email delivery (optional, shared)
+# Used when a user file declares setup.delivery: email.
+# @sensitive
+SETUP_EMAIL_API_KEY=
+
+# @sensitive
+SETUP_EMAIL_FROM=
+
 # ---- deploy/provision vars ----
 
 # @required @sensitive

package/templates/rover-pilot/.github/actions/varlock-env/action.yml

@@ -0,0 +1,47 @@
+name: Load Bitwarden environment through Varlock
+description: Load, mask, and export the pilot environment from Varlock
+
+runs:
+  using: composite
+  steps:
+    - name: Load shared environment
+      shell: bash
+      run: |
+        for attempt in 1 2 3; do
+          if bunx varlock@1.1.0 load --path .env.schema --format json --compact > /tmp/varlock-env.json; then
+            break
+          fi
+          if [ "$attempt" = "3" ]; then
+            exit 1
+          fi
+          echo "Varlock load failed (attempt $attempt/3); retrying in 5s..."
+          sleep 5
+        done
+        node <<'NODE'
+        import { appendFileSync, readFileSync, rmSync } from "node:fs";
+        const env = JSON.parse(readFileSync("/tmp/varlock-env.json", "utf8"));
+        const output = process.env.GITHUB_ENV;
+        if (!output) throw new Error("Missing GITHUB_ENV");
+        const newline = "\n";
+        const chunks = [];
+        for (const [key, value] of Object.entries(env)) {
+          if (key === "BWS_ACCESS_TOKEN" || value === null || value === undefined) continue;
+          const text = String(value).replace(/\r\n/g, newline);
+          const escapedMask = text
+            .replace(/%/g, "%25")
+            .replace(/\r/g, "%0D")
+            .replace(/\n/g, "%0A");
+          if (escapedMask.length > 0) {
+            process.stdout.write(`::add-mask::${escapedMask}${newline}`);
+          }
+          if (text.includes(newline)) {
+            let delimiter = `VARLOCK_${key}_EOF`;
+            while (text.includes(delimiter)) delimiter += "_X";
+            chunks.push(`${key}<<${delimiter}${newline}${text}${newline}${delimiter}`);
+          } else {
+            chunks.push(`${key}=${text}`);
+          }
+        }
+        appendFileSync(output, `${chunks.join(newline)}${newline}`);
+        rmSync("/tmp/varlock-env.json", { force: true });
+        NODE

package/templates/rover-pilot/.github/workflows/build.yml

@@ -2,10 +2,29 @@ name: Build
 
 on:
   workflow_dispatch:
+    inputs:
+      brain_version:
+        description: Force one explicit build at this brain version (skips the registry-derived resolve)
+        required: false
+        type: string
+      site_packages:
+        description: 'Space-separated site packages for a per-instance site image (e.g. "@rizom/site-rizom-ai@0.2.0-alpha.148"). Empty builds the default fleet image.'
+        required: false
+        type: string
+      overwrite:
+        description: Rebuild an existing tag in place. Published tags are immutable; confirm only when replacing a tag whose containers were never deployed.
+        required: false
+        type: boolean
+        default: false
   push:
     branches: ["main"]
     paths:
+      # The image set is a pure function of the declared fleet state: a push
+      # that changes it builds exactly what it declares, so the deploy (fired
+      # off the same push via Reconcile) finds its tag ready.
       - pilot.yaml
+      - cohorts/**
+      - users/*.yaml
       - deploy/**
       - .github/workflows/build.yml
 
@@ -14,49 +33,84 @@ permissions:
   packages: write
 
 jobs:
-  build:
+  resolve:
     runs-on: ubuntu-latest
+    outputs:
+      images_json: ${{ steps.resolve.outputs.images_json }}
     steps:
       - uses: actions/checkout@v5
         with:
           ref: ${{ github.sha }}
 
-      - name: Extract image metadata inputs
-        run: |
-          BRAIN_VERSION="$(grep '^brainVersion:' pilot.yaml | sed 's/^brainVersion:[[:space:]]*//' | tr -d '"' | tr -d "'")"
-          if [ -z "$BRAIN_VERSION" ]; then
-            echo "Missing brainVersion in pilot.yaml" >&2
-            exit 1
-          fi
-          echo "BRAIN_VERSION=$BRAIN_VERSION" >> "$GITHUB_ENV"
-          echo "IMAGE_REPOSITORY=ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}" >> "$GITHUB_ENV"
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install operator tooling
+        run: bun install
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve images to build
+        id: resolve
+        env:
+          BRAIN_VERSION_INPUT: ${{ inputs.brain_version || '' }}
+          SITE_PACKAGES_INPUT: ${{ inputs.site_packages || '' }}
+          ALLOW_TAG_OVERWRITE: ${{ inputs.overwrite && 'true' || 'false' }}
+        run: bun deploy/scripts/resolve-missing-images.ts
+
+  no_builds:
+    needs: resolve
+    if: needs.resolve.outputs.images_json == '[]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Skip when every declared image exists
+        run: echo "All declared images already exist; nothing to build."
+
+  build:
+    needs: resolve
+    if: needs.resolve.outputs.images_json != '[]'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        image: ${{ fromJson(needs.resolve.outputs.images_json) }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Extract image metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
-          images: ${{ env.IMAGE_REPOSITORY }}
+          images: ghcr.io/${{ github.repository }}
           tags: |
-            type=raw,value=brain-${{ env.BRAIN_VERSION }}
+            type=raw,value=${{ matrix.image.tag }}
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: deploy/Dockerfile
+          target: fleet
           push: true
           build-args: |
-            BRAIN_VERSION=${{ env.BRAIN_VERSION }}
+            BRAIN_VERSION=${{ matrix.image.brain_version }}
+            SITE_PACKAGES=${{ matrix.image.site_packages }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: |
             ${{ steps.meta.outputs.labels }}

package/templates/rover-pilot/.github/workflows/deploy.yml

@@ -7,13 +7,24 @@ on:
         description: User handle
         required: true
         type: string
+      release_stale_lock:
+        description: Release an operator-confirmed stale Kamal deploy lock before retrying
+        required: false
+        type: boolean
+        default: false
   push:
     branches: ["main"]
     paths:
       - users/*/.env
       - users/*/brain.yaml
+      - users/*/content/**
+      - users/*.secrets.yaml.age
       - deploy/**
       - .github/workflows/deploy.yml
+  workflow_run:
+    workflows: [Reconcile]
+    types: [completed]
+    branches: [main]
 
 permissions:
   contents: write
@@ -21,13 +32,16 @@ permissions:
 
 jobs:
   resolve_handles:
+    if: >
+      github.event_name != 'workflow_run' ||
+      github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     outputs:
       handles_json: ${{ steps.resolve.outputs.handles_json }}
     steps:
       - uses: actions/checkout@v5
         with:
-          ref: ${{ github.sha }}
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.sha }}
           fetch-depth: 0
 
       - uses: oven-sh/setup-bun@v2
@@ -39,7 +53,7 @@ jobs:
         id: resolve
         env:
           HANDLE_INPUT: ${{ inputs.handle || '' }}
-          BEFORE_SHA: ${{ github.event.before || '' }}
+          BEFORE_SHA: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.event.before || '' }}
         run: bun deploy/scripts/resolve-deploy-handles.ts
 
   no_changes:
@@ -66,13 +80,22 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         with:
-          ref: ${{ github.sha }}
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.sha }}
 
       - uses: oven-sh/setup-bun@v2
 
       - name: Install operator tooling
         run: bun install
 
+      - name: Load shared env via Varlock
+        uses: ./.github/actions/varlock-env
+        env:
+          BWS_ACCESS_TOKEN: ${{ secrets.BWS_ACCESS_TOKEN }}
+
+      - name: Decrypt user secrets
+        id: user_secrets
+        run: bun deploy/scripts/decrypt-user-secrets.ts "$HANDLE"
+
       - name: Reconcile selected user config
         run: bunx brains-ops onboard "$GITHUB_WORKSPACE" "$HANDLE"
 
@@ -81,23 +104,13 @@ jobs:
         run: bun deploy/scripts/resolve-user-config.ts
 
       - name: Validate selected secrets
-        env:
-          AI_API_KEY: ${{ secrets[steps.user_config.outputs.ai_api_key_secret_name] }}
-          GIT_SYNC_TOKEN: ${{ secrets[steps.user_config.outputs.git_sync_token_secret_name] }}
-          MCP_AUTH_TOKEN: ${{ secrets[steps.user_config.outputs.mcp_auth_token_secret_name] }}
-          DISCORD_BOT_TOKEN: ${{ steps.user_config.outputs.discord_bot_token_secret_name != '' && secrets[steps.user_config.outputs.discord_bot_token_secret_name] || '' }}
-          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
-          HCLOUD_SSH_KEY_NAME: ${{ secrets.HCLOUD_SSH_KEY_NAME }}
-          HCLOUD_SERVER_TYPE: ${{ secrets.HCLOUD_SERVER_TYPE }}
-          HCLOUD_LOCATION: ${{ secrets.HCLOUD_LOCATION }}
-          KAMAL_SSH_PRIVATE_KEY: ${{ secrets.KAMAL_SSH_PRIVATE_KEY }}
-          KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
-          CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
-          CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
-          CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
-          PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
         run: bun deploy/scripts/validate-secrets.ts
 
+      - name: Seed content repo
+        env:
+          CONTENT_REPO: ${{ steps.user_config.outputs.content_repo }}
+        run: bun deploy/scripts/sync-content-repo.ts
+
       - name: Log in to GHCR
         uses: docker/login-action@v3
         with:
@@ -105,15 +118,18 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Wait for shared image tag
+      - name: Wait for image tag
         run: |
-          IMAGE_TAG="${{ steps.user_config.outputs.image_repository }}:brain-${{ steps.user_config.outputs.brain_version }}"
-          for attempt in $(seq 1 24); do
+          # The Build workflow fires off the same config push (it derives the
+          # declared image set from the registry), so this wait must cover a
+          # full image build, not just registry propagation.
+          IMAGE_TAG="${{ steps.user_config.outputs.image_repository }}:${{ steps.user_config.outputs.image_tag }}"
+          for attempt in $(seq 1 60); do
             if docker manifest inspect "$IMAGE_TAG" >/dev/null 2>&1; then
               exit 0
             fi
-            echo "Shared image tag not ready yet ($attempt/24): $IMAGE_TAG"
-            sleep 10
+            echo "Image tag not ready yet ($attempt/60): $IMAGE_TAG"
+            sleep 20
           done
           echo "Timed out waiting for $IMAGE_TAG" >&2
           exit 1
@@ -124,8 +140,6 @@ jobs:
           ruby -r rubygems -e 'puts Gem.user_dir + "/bin"' >> "$GITHUB_PATH"
 
       - name: Write Kamal SSH key
-        env:
-          KAMAL_SSH_PRIVATE_KEY: ${{ secrets.KAMAL_SSH_PRIVATE_KEY }}
         run: bun deploy/scripts/write-ssh-key.ts
 
       - name: Configure SSH client
@@ -142,33 +156,27 @@ jobs:
           chmod 600 ~/.ssh/config
 
       - name: Write .kamal/secrets
-        env:
-          AI_API_KEY: ${{ secrets[steps.user_config.outputs.ai_api_key_secret_name] }}
-          GIT_SYNC_TOKEN: ${{ secrets[steps.user_config.outputs.git_sync_token_secret_name] }}
-          MCP_AUTH_TOKEN: ${{ secrets[steps.user_config.outputs.mcp_auth_token_secret_name] }}
-          DISCORD_BOT_TOKEN: ${{ steps.user_config.outputs.discord_bot_token_secret_name != '' && secrets[steps.user_config.outputs.discord_bot_token_secret_name] || '' }}
-          KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
-          CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
-          PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
         run: bun deploy/scripts/write-kamal-secrets.ts
 
       - name: Provision server
         id: provision
         env:
-          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
-          HCLOUD_SSH_KEY_NAME: ${{ secrets.HCLOUD_SSH_KEY_NAME }}
-          HCLOUD_SERVER_TYPE: ${{ secrets.HCLOUD_SERVER_TYPE }}
-          HCLOUD_LOCATION: ${{ secrets.HCLOUD_LOCATION }}
           INSTANCE_NAME: ${{ steps.user_config.outputs.instance_name }}
         run: bun deploy/scripts/provision-server.ts
 
       - name: Update Cloudflare DNS
         env:
-          CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
-          CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
+          CF_ZONE_ID: ${{ steps.user_config.outputs.cloudflare_zone_id }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
+          PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
-        run: bun deploy/scripts/update-dns.ts
+        run: |
+          bun deploy/scripts/update-dns.ts
+          if [ -n "$WWW_DOMAIN" ]; then
+            BRAIN_DOMAIN="$WWW_DOMAIN" bun deploy/scripts/update-dns.ts
+          fi
+          BRAIN_DOMAIN="$PREVIEW_DOMAIN" bun deploy/scripts/update-dns.ts
 
       - name: Validate SSH key
         run: ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null
@@ -188,17 +196,53 @@ jobs:
           echo "SSH never became ready for $SSH_USER@$SERVER_IP" >&2
           exit 1
 
+      - name: Release operator-confirmed stale deploy lock
+        if: ${{ inputs.release_stale_lock }}
+        env:
+          SERVER_IP: ${{ steps.provision.outputs.server_ip }}
+          VERSION: ${{ steps.user_config.outputs.image_tag }}
+          IMAGE_REPOSITORY: ${{ steps.user_config.outputs.image_repository }}
+          REGISTRY_USERNAME: ${{ steps.user_config.outputs.registry_username }}
+          BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
+          PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
+          BRAIN_YAML_PATH: ${{ steps.user_config.outputs.brain_yaml_path }}
+        run: kamal lock release -c deploy/kamal/deploy.yml
+
       - name: Deploy
         env:
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
-          VERSION: brain-${{ steps.user_config.outputs.brain_version }}
+          VERSION: ${{ steps.user_config.outputs.image_tag }}
+          IMAGE_REPOSITORY: ${{ steps.user_config.outputs.image_repository }}
+          REGISTRY_USERNAME: ${{ steps.user_config.outputs.registry_username }}
+          BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
+          PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
+          BRAIN_YAML_PATH: ${{ steps.user_config.outputs.brain_yaml_path }}
         run: kamal setup --skip-push -c deploy/kamal/deploy.yml
 
+      - name: Install container health watchdog
+        env:
+          SERVER_IP: ${{ steps.provision.outputs.server_ip }}
+        run: |
+          SSH_USER="$(ruby -e 'require "yaml"; config = YAML.load_file("deploy/kamal/deploy.yml") || {}; puts(config.dig("ssh", "user") || "root")')" \
+            bun deploy/scripts/install-health-watchdog.ts
+
       - name: Verify origin TLS
         env:
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
-        run: curl -I -k --max-time 20 --resolve "$BRAIN_DOMAIN:443:$SERVER_IP" "https://$BRAIN_DOMAIN/health"
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
+          PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
+        run: |
+          curl -I -k --max-time 20 --resolve "$BRAIN_DOMAIN:443:$SERVER_IP" "https://$BRAIN_DOMAIN/health/live"
+          if [ -n "$WWW_DOMAIN" ]; then
+            curl -I -k --max-time 20 --resolve "$WWW_DOMAIN:443:$SERVER_IP" "https://$WWW_DOMAIN/"
+          fi
+          curl -I -k --max-time 20 --resolve "$PREVIEW_DOMAIN:443:$SERVER_IP" "https://$PREVIEW_DOMAIN/"
+
+      - name: Verify operational health
+        run: bunx brains-ops verify-user "$GITHUB_WORKSPACE" "$HANDLE"
 
       - name: Upload generated config
         uses: actions/upload-artifact@v4
@@ -207,6 +251,7 @@ jobs:
           path: |
             users/${{ matrix.handle }}/brain.yaml
             users/${{ matrix.handle }}/.env
+            users/${{ matrix.handle }}/content
 
       - name: Dump remote proxy diagnostics
         if: failure()
@@ -233,7 +278,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         with:
-          ref: ${{ github.sha }}
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.sha }}
 
       - uses: oven-sh/setup-bun@v2
 
@@ -252,11 +297,31 @@ jobs:
 
       - name: Commit generated config
         run: |
+          # A newly added user's generated directory is untracked, and
+          # `git diff` cannot see untracked files — without intent-to-add
+          # the new config is silently dropped here and every later deploy
+          # skips that user (their files never appear in a commit range).
+          git add --intent-to-add -- users views
+
           if git diff --quiet -- users views; then
             exit 0
           fi
+
+          git fetch origin "${{ github.ref_name }}"
+          if git diff --quiet "origin/${{ github.ref_name }}" -- users views; then
+            exit 0
+          fi
+
+          patch_file="$(mktemp)"
+          git diff --binary -- users views > "$patch_file"
+          git reset --hard "origin/${{ github.ref_name }}"
+          git apply --3way --index "$patch_file"
+
+          if git diff --cached --quiet -- users views; then
+            exit 0
+          fi
+
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add users views
           git commit -m "chore(ops): reconcile generated config"
-          git push
+          git push origin HEAD:${{ github.ref_name }}