@rizom/ops 0.2.0-alpha.34 → 0.2.0-alpha.341

package/dist/stress-health-monitor.d.ts

@@ -0,0 +1,46 @@
+import type { FetchLike } from "@brains/deploy-support/origin-ca";
+import { type StressHealthSample, type StressRuntimeSample } from "./directory-sync-stress";
+export interface HealthPayload {
+    version: string;
+    entities: number;
+    entityCounts: {
+        entityType: string;
+        count: number;
+    }[];
+}
+export declare function noteCount(payload: HealthPayload): number;
+export interface StressHealthMonitorOptions {
+    domain: string;
+    fetchImpl: FetchLike;
+    now: () => Date;
+    sleep: (milliseconds: number) => Promise<void>;
+    /** Take one runtime sample (e.g. docker stats over SSH), if available. */
+    sampleRuntime: () => Promise<StressRuntimeSample | undefined>;
+}
+/**
+ * Samples deployment health and runtime resource usage during a stress run,
+ * and answers entity-baseline waits against the operational health endpoint.
+ */
+export declare class StressHealthMonitor {
+    #private;
+    constructor(options: StressHealthMonitorOptions);
+    /** ISO timestamp of the most recent start() call. */
+    get startedAt(): string;
+    /** The first sampling failure since start(), if any. */
+    get error(): unknown;
+    get healthSamples(): readonly StressHealthSample[];
+    get runtimeSamples(): readonly StressRuntimeSample[];
+    /** Health samples between start() and markGateEnd() (or now). */
+    gateHealthSamples(): StressHealthSample[];
+    /** Exclude samples taken after this point from the gate window. */
+    markGateEnd(): void;
+    /** Probe optional health endpoints and add responsive ones to the loop. */
+    discoverEndpoints(): Promise<void>;
+    start(): void;
+    /** Stop sampling and wait for the loops; a loop error stays on `error`. */
+    stop(): Promise<void>;
+    waitForHealthSnapshot(timeoutMs: number): Promise<HealthPayload | undefined>;
+    waitForEntityBaseline(expectedNotes: number | undefined, expectedEntities: number | undefined, timeoutMs: number): Promise<HealthPayload | undefined>;
+    waitForStableEntityBaseline(expectedNotes: number | undefined, expectedEntities: number | undefined, timeoutMs: number): Promise<HealthPayload | undefined>;
+    fetchHealthPayload(): Promise<HealthPayload | undefined>;
+}

package/dist/upgrade.d.ts

@@ -0,0 +1,10 @@
+export type UpgradeExec = (command: string[], cwd: string) => Promise<void>;
+export interface UpgradeOptions {
+    exec?: UpgradeExec | undefined;
+    version?: string | undefined;
+}
+export interface UpgradeResult {
+    from: string;
+    to: string;
+}
+export declare function upgradePilotRepo(rootDir: string, options?: UpgradeOptions): Promise<UpgradeResult>;

package/dist/user-add.d.ts

@@ -0,0 +1,15 @@
+export interface AddPilotUserOptions {
+    cohort: string;
+    anchorId?: string | undefined;
+}
+export interface AddPilotUserResult {
+    handle: string;
+    cohort: string;
+    userPath: string;
+    secretsTemplatePath: string;
+    cohortPath: string;
+    createdUser: boolean;
+    createdSecretsTemplate: boolean;
+    addedToCohort: boolean;
+}
+export declare function addPilotUser(rootDir: string, handle: string, options: AddPilotUserOptions): Promise<AddPilotUserResult>;

package/dist/verify-user.d.ts

@@ -0,0 +1,22 @@
+import type { FetchLike } from "@brains/deploy-support/origin-ca";
+import { type ResolvedUser } from "./load-registry";
+export interface VerifyPilotUserOptions {
+    fetchImpl?: FetchLike;
+    logger?: (message: string) => void;
+    operationalRetryAttempts?: number;
+    operationalRetryDelayMs?: number;
+    sleep?: (delayMs: number) => Promise<void>;
+}
+export interface FailedCheck {
+    name: string;
+    message: string;
+}
+export interface VerifyPilotUserResult {
+    handle: string;
+    bundles: ResolvedUser["bundles"];
+    domain: string;
+    contentRepo: string;
+    checks: string[];
+    failedChecks: FailedCheck[];
+}
+export declare function verifyPilotUser(rootDir: string, handle: string, options?: VerifyPilotUserOptions): Promise<VerifyPilotUserResult>;

package/package.json

@@ -1,67 +1,73 @@
 {
   "name": "@rizom/ops",
+  "version": "0.2.0-alpha.341",
   "description": "Operator CLI for managing private brain fleet registry repos",
-  "publishConfig": {
-    "access": "public"
+  "keywords": [
+    "brains",
+    "ops",
+    "cli",
+    "deploy",
+    "fleet",
+    "operator"
+  ],
+  "license": "AGPL-3.0-only",
+  "author": "Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",
+  "bin": {
+    "brains-ops": "./dist/brains-ops.js"
+  },
+  "bugs": "https://github.com/rizom-ai/brains/issues",
+  "dependencies": {
+    "age-encryption": "^0.3.0",
+    "yaml": "^2.9.0"
+  },
+  "devDependencies": {
+    "@brains/deploy-support": "workspace:*",
+    "@brains/eslint-config": "workspace:*",
+    "@brains/profile": "workspace:*",
+    "@brains/site-composition": "workspace:*",
+    "@brains/test-utils": "workspace:*",
+    "@brains/typescript-config": "workspace:*",
+    "@brains/utils": "workspace:*",
+    "@types/bun": "^1.4.0",
+    "typescript": "^7.0.2"
+  },
+  "engines": {
+    "bun": ">=1.3.3"
   },
-  "version": "0.2.0-alpha.34",
-  "type": "module",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
     "./deploy": {
-      "bun": "./dist/deploy.js",
       "types": "./dist/deploy.d.ts",
-      "import": "./dist/deploy.js"
+      "import": "./dist/deploy.js",
+      "bun": "./dist/deploy.js"
     }
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "bin": {
-    "brains-ops": "./dist/brains-ops.js"
-  },
   "files": [
     "dist",
     "templates"
   ],
-  "scripts": {
-    "build": "bun scripts/build.ts",
-    "prepublishOnly": "bun scripts/build.ts",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint . --ext .ts",
-    "lint:fix": "eslint . --ext .ts --fix",
-    "test": "bun test --timeout 20000"
-  },
-  "dependencies": {
-    "age-encryption": "^0.3.0"
-  },
-  "devDependencies": {
-    "@brains/eslint-config": "workspace:*",
-    "@brains/typescript-config": "workspace:*",
-    "@brains/utils": "workspace:*",
-    "@types/bun": "latest",
-    "typescript": "^5.3.3"
+  "homepage": "https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",
+  "main": "./dist/index.js",
+  "publishConfig": {
+    "access": "public"
   },
   "repository": {
     "type": "git",
     "url": "https://github.com/rizom-ai/brains.git",
     "directory": "packages/brains-ops"
   },
-  "license": "Apache-2.0",
-  "author": "Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",
-  "homepage": "https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",
-  "bugs": "https://github.com/rizom-ai/brains/issues",
-  "engines": {
-    "bun": ">=1.3.3"
+  "scripts": {
+    "build": "bun scripts/build.ts",
+    "lint": "eslint . --max-warnings 0",
+    "lint:fix": "eslint . --max-warnings 0 --fix",
+    "prepublishOnly": "bun scripts/build.ts",
+    "test": "bun run build && bun test --timeout 20000",
+    "test:smoke": "bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",
+    "typecheck": "tsc --noEmit"
   },
-  "keywords": [
-    "brains",
-    "ops",
-    "cli",
-    "deploy",
-    "fleet",
-    "operator"
-  ]
+  "type": "module",
+  "types": "./dist/index.d.ts"
 }

package/templates/rover-pilot/.env.schema

@@ -14,16 +14,37 @@ AI_API_KEY=
 # @required @sensitive
 GIT_SYNC_TOKEN=
 
-# MCP interface
-# Comes from the decrypted users/<handle>.secrets.yaml.age file.
+# Content repo administration
+# Local/operator secret only. Used by brains-ops to create missing GitHub repos;
+# do not deploy it into Rover runtime config.
 # @required @sensitive
-MCP_AUTH_TOKEN=
+CONTENT_REPO_ADMIN_TOKEN=
 
 # Discord (optional, per-user)
 # Comes from the decrypted users/<handle>.secrets.yaml.age file when enabled.
 # @sensitive
 DISCORD_BOT_TOKEN=
 
+# Stored with the per-user Discord credentials and injected at deploy time.
+# @sensitive
+DISCORD_PUBLIC_KEY=
+
+# @sensitive
+DISCORD_APPLICATION_ID=
+
+# AT Protocol publishing/discovery (optional, per-user)
+# Comes from the decrypted users/<handle>.secrets.yaml.age file when configured.
+# @sensitive
+ATPROTO_APP_PASSWORD=
+
+# Setup email delivery (optional, shared)
+# Used when a user file declares setup.delivery: email.
+# @sensitive
+SETUP_EMAIL_API_KEY=
+
+# @sensitive
+SETUP_EMAIL_FROM=
+
 # ---- deploy/provision vars ----
 
 # @required @sensitive

package/templates/rover-pilot/.github/actions/varlock-env/action.yml

@@ -0,0 +1,47 @@
+name: Load Bitwarden environment through Varlock
+description: Load, mask, and export the pilot environment from Varlock
+
+runs:
+  using: composite
+  steps:
+    - name: Load shared environment
+      shell: bash
+      run: |
+        for attempt in 1 2 3; do
+          if bunx varlock@1.1.0 load --path .env.schema --format json --compact > /tmp/varlock-env.json; then
+            break
+          fi
+          if [ "$attempt" = "3" ]; then
+            exit 1
+          fi
+          echo "Varlock load failed (attempt $attempt/3); retrying in 5s..."
+          sleep 5
+        done
+        node <<'NODE'
+        import { appendFileSync, readFileSync, rmSync } from "node:fs";
+        const env = JSON.parse(readFileSync("/tmp/varlock-env.json", "utf8"));
+        const output = process.env.GITHUB_ENV;
+        if (!output) throw new Error("Missing GITHUB_ENV");
+        const newline = "\n";
+        const chunks = [];
+        for (const [key, value] of Object.entries(env)) {
+          if (key === "BWS_ACCESS_TOKEN" || value === null || value === undefined) continue;
+          const text = String(value).replace(/\r\n/g, newline);
+          const escapedMask = text
+            .replace(/%/g, "%25")
+            .replace(/\r/g, "%0D")
+            .replace(/\n/g, "%0A");
+          if (escapedMask.length > 0) {
+            process.stdout.write(`::add-mask::${escapedMask}${newline}`);
+          }
+          if (text.includes(newline)) {
+            let delimiter = `VARLOCK_${key}_EOF`;
+            while (text.includes(delimiter)) delimiter += "_X";
+            chunks.push(`${key}<<${delimiter}${newline}${text}${newline}${delimiter}`);
+          } else {
+            chunks.push(`${key}=${text}`);
+          }
+        }
+        appendFileSync(output, `${chunks.join(newline)}${newline}`);
+        rmSync("/tmp/varlock-env.json", { force: true });
+        NODE

package/templates/rover-pilot/.github/workflows/build.yml

@@ -2,10 +2,29 @@ name: Build
 
 on:
   workflow_dispatch:
+    inputs:
+      brain_version:
+        description: Force one explicit build at this brain version (skips the registry-derived resolve)
+        required: false
+        type: string
+      site_packages:
+        description: 'Space-separated site packages for a per-instance site image (e.g. "@rizom/site-rizom-ai@0.2.0-alpha.148"). Empty builds the default fleet image.'
+        required: false
+        type: string
+      overwrite:
+        description: Rebuild an existing tag in place. Published tags are immutable; confirm only when replacing a tag whose containers were never deployed.
+        required: false
+        type: boolean
+        default: false
   push:
     branches: ["main"]
     paths:
+      # The image set is a pure function of the declared fleet state: a push
+      # that changes it builds exactly what it declares, so the deploy (fired
+      # off the same push via Reconcile) finds its tag ready.
       - pilot.yaml
+      - cohorts/**
+      - users/*.yaml
       - deploy/**
       - .github/workflows/build.yml
 
@@ -14,50 +33,84 @@ permissions:
   packages: write
 
 jobs:
-  build:
+  resolve:
     runs-on: ubuntu-latest
+    outputs:
+      images_json: ${{ steps.resolve.outputs.images_json }}
     steps:
       - uses: actions/checkout@v5
         with:
           ref: ${{ github.sha }}
 
-      - name: Extract image metadata inputs
-        run: |
-          BRAIN_VERSION="$(grep '^brainVersion:' pilot.yaml | sed 's/^brainVersion:[[:space:]]*//' | tr -d '"' | tr -d "'")"
-          if [ -z "$BRAIN_VERSION" ]; then
-            echo "Missing brainVersion in pilot.yaml" >&2
-            exit 1
-          fi
-          echo "BRAIN_VERSION=$BRAIN_VERSION" >> "$GITHUB_ENV"
-          echo "IMAGE_REPOSITORY=ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}" >> "$GITHUB_ENV"
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install operator tooling
+        run: bun install
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve images to build
+        id: resolve
+        env:
+          BRAIN_VERSION_INPUT: ${{ inputs.brain_version || '' }}
+          SITE_PACKAGES_INPUT: ${{ inputs.site_packages || '' }}
+          ALLOW_TAG_OVERWRITE: ${{ inputs.overwrite && 'true' || 'false' }}
+        run: bun deploy/scripts/resolve-missing-images.ts
+
+  no_builds:
+    needs: resolve
+    if: needs.resolve.outputs.images_json == '[]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Skip when every declared image exists
+        run: echo "All declared images already exist; nothing to build."
+
+  build:
+    needs: resolve
+    if: needs.resolve.outputs.images_json != '[]'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        image: ${{ fromJson(needs.resolve.outputs.images_json) }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Extract image metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
-          images: ${{ env.IMAGE_REPOSITORY }}
+          images: ghcr.io/${{ github.repository }}
           tags: |
-            type=raw,value=brain-${{ env.BRAIN_VERSION }}
+            type=raw,value=${{ matrix.image.tag }}
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: deploy/Dockerfile
           target: fleet
           push: true
           build-args: |
-            BRAIN_VERSION=${{ env.BRAIN_VERSION }}
+            BRAIN_VERSION=${{ matrix.image.brain_version }}
+            SITE_PACKAGES=${{ matrix.image.site_packages }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: |
             ${{ steps.meta.outputs.labels }}

package/templates/rover-pilot/.github/workflows/deploy.yml

@@ -7,6 +7,11 @@ on:
         description: User handle
         required: true
         type: string
+      release_stale_lock:
+        description: Release an operator-confirmed stale Kamal deploy lock before retrying
+        required: false
+        type: boolean
+        default: false
   push:
     branches: ["main"]
     paths:
@@ -82,51 +87,29 @@ jobs:
       - name: Install operator tooling
         run: bun install
 
+      - name: Load shared env via Varlock
+        uses: ./.github/actions/varlock-env
+        env:
+          BWS_ACCESS_TOKEN: ${{ secrets.BWS_ACCESS_TOKEN }}
+
       - name: Decrypt user secrets
         id: user_secrets
-        env:
-          AGE_SECRET_KEY: ${{ secrets.AGE_SECRET_KEY }}
         run: bun deploy/scripts/decrypt-user-secrets.ts "$HANDLE"
 
       - name: Reconcile selected user config
-        env:
-          SHARED_GIT_SYNC_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_git_sync_token_secret_name] }}
-        run: |
-          export GIT_SYNC_TOKEN="${GIT_SYNC_TOKEN:-$SHARED_GIT_SYNC_TOKEN}"
-          bunx brains-ops onboard "$GITHUB_WORKSPACE" "$HANDLE"
+        run: bunx brains-ops onboard "$GITHUB_WORKSPACE" "$HANDLE"
 
       - name: Resolve generated user config
         id: user_config
         run: bun deploy/scripts/resolve-user-config.ts
 
       - name: Validate selected secrets
-        env:
-          SHARED_AI_API_KEY: ${{ secrets[steps.user_secrets.outputs.shared_ai_api_key_secret_name] }}
-          SHARED_GIT_SYNC_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_git_sync_token_secret_name] }}
-          SHARED_MCP_AUTH_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_mcp_auth_token_secret_name] }}
-          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
-          HCLOUD_SSH_KEY_NAME: ${{ secrets.HCLOUD_SSH_KEY_NAME }}
-          HCLOUD_SERVER_TYPE: ${{ secrets.HCLOUD_SERVER_TYPE }}
-          HCLOUD_LOCATION: ${{ secrets.HCLOUD_LOCATION }}
-          KAMAL_SSH_PRIVATE_KEY: ${{ secrets.KAMAL_SSH_PRIVATE_KEY }}
-          KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
-          CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
-          CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
-          CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
-          PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
-        run: |
-          export AI_API_KEY="${AI_API_KEY:-$SHARED_AI_API_KEY}"
-          export GIT_SYNC_TOKEN="${GIT_SYNC_TOKEN:-$SHARED_GIT_SYNC_TOKEN}"
-          export MCP_AUTH_TOKEN="${MCP_AUTH_TOKEN:-$SHARED_MCP_AUTH_TOKEN}"
-          bun deploy/scripts/validate-secrets.ts
+        run: bun deploy/scripts/validate-secrets.ts
 
       - name: Seed content repo
         env:
           CONTENT_REPO: ${{ steps.user_config.outputs.content_repo }}
-          SHARED_GIT_SYNC_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_git_sync_token_secret_name] }}
-        run: |
-          export GIT_SYNC_TOKEN="${GIT_SYNC_TOKEN:-$SHARED_GIT_SYNC_TOKEN}"
-          bun deploy/scripts/sync-content-repo.ts
+        run: bun deploy/scripts/sync-content-repo.ts
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
@@ -135,15 +118,18 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Wait for shared image tag
+      - name: Wait for image tag
         run: |
-          IMAGE_TAG="${{ steps.user_config.outputs.image_repository }}:brain-${{ steps.user_config.outputs.brain_version }}"
-          for attempt in $(seq 1 24); do
+          # The Build workflow fires off the same config push (it derives the
+          # declared image set from the registry), so this wait must cover a
+          # full image build, not just registry propagation.
+          IMAGE_TAG="${{ steps.user_config.outputs.image_repository }}:${{ steps.user_config.outputs.image_tag }}"
+          for attempt in $(seq 1 60); do
             if docker manifest inspect "$IMAGE_TAG" >/dev/null 2>&1; then
               exit 0
             fi
-            echo "Shared image tag not ready yet ($attempt/24): $IMAGE_TAG"
-            sleep 10
+            echo "Image tag not ready yet ($attempt/60): $IMAGE_TAG"
+            sleep 20
           done
           echo "Timed out waiting for $IMAGE_TAG" >&2
           exit 1
@@ -154,8 +140,6 @@ jobs:
           ruby -r rubygems -e 'puts Gem.user_dir + "/bin"' >> "$GITHUB_PATH"
 
       - name: Write Kamal SSH key
-        env:
-          KAMAL_SSH_PRIVATE_KEY: ${{ secrets.KAMAL_SSH_PRIVATE_KEY }}
         run: bun deploy/scripts/write-ssh-key.ts
 
       - name: Configure SSH client
@@ -172,38 +156,26 @@ jobs:
           chmod 600 ~/.ssh/config
 
       - name: Write .kamal/secrets
-        env:
-          SHARED_AI_API_KEY: ${{ secrets[steps.user_secrets.outputs.shared_ai_api_key_secret_name] }}
-          SHARED_GIT_SYNC_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_git_sync_token_secret_name] }}
-          SHARED_MCP_AUTH_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_mcp_auth_token_secret_name] }}
-          KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
-          CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
-          PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
-        run: |
-          export AI_API_KEY="${AI_API_KEY:-$SHARED_AI_API_KEY}"
-          export GIT_SYNC_TOKEN="${GIT_SYNC_TOKEN:-$SHARED_GIT_SYNC_TOKEN}"
-          export MCP_AUTH_TOKEN="${MCP_AUTH_TOKEN:-$SHARED_MCP_AUTH_TOKEN}"
-          bun deploy/scripts/write-kamal-secrets.ts
+        run: bun deploy/scripts/write-kamal-secrets.ts
 
       - name: Provision server
         id: provision
         env:
-          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
-          HCLOUD_SSH_KEY_NAME: ${{ secrets.HCLOUD_SSH_KEY_NAME }}
-          HCLOUD_SERVER_TYPE: ${{ secrets.HCLOUD_SERVER_TYPE }}
-          HCLOUD_LOCATION: ${{ secrets.HCLOUD_LOCATION }}
           INSTANCE_NAME: ${{ steps.user_config.outputs.instance_name }}
         run: bun deploy/scripts/provision-server.ts
 
       - name: Update Cloudflare DNS
         env:
-          CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
-          CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
+          CF_ZONE_ID: ${{ steps.user_config.outputs.cloudflare_zone_id }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
           PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
         run: |
           bun deploy/scripts/update-dns.ts
+          if [ -n "$WWW_DOMAIN" ]; then
+            BRAIN_DOMAIN="$WWW_DOMAIN" bun deploy/scripts/update-dns.ts
+          fi
           BRAIN_DOMAIN="$PREVIEW_DOMAIN" bun deploy/scripts/update-dns.ts
 
       - name: Validate SSH key
@@ -224,26 +196,54 @@ jobs:
           echo "SSH never became ready for $SSH_USER@$SERVER_IP" >&2
           exit 1
 
+      - name: Release operator-confirmed stale deploy lock
+        if: ${{ inputs.release_stale_lock }}
+        env:
+          SERVER_IP: ${{ steps.provision.outputs.server_ip }}
+          VERSION: ${{ steps.user_config.outputs.image_tag }}
+          IMAGE_REPOSITORY: ${{ steps.user_config.outputs.image_repository }}
+          REGISTRY_USERNAME: ${{ steps.user_config.outputs.registry_username }}
+          BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
+          PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
+          BRAIN_YAML_PATH: ${{ steps.user_config.outputs.brain_yaml_path }}
+        run: kamal lock release -c deploy/kamal/deploy.yml
+
       - name: Deploy
         env:
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
-          VERSION: brain-${{ steps.user_config.outputs.brain_version }}
+          VERSION: ${{ steps.user_config.outputs.image_tag }}
           IMAGE_REPOSITORY: ${{ steps.user_config.outputs.image_repository }}
           REGISTRY_USERNAME: ${{ steps.user_config.outputs.registry_username }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
           PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
           BRAIN_YAML_PATH: ${{ steps.user_config.outputs.brain_yaml_path }}
         run: kamal setup --skip-push -c deploy/kamal/deploy.yml
 
+      - name: Install container health watchdog
+        env:
+          SERVER_IP: ${{ steps.provision.outputs.server_ip }}
+        run: |
+          SSH_USER="$(ruby -e 'require "yaml"; config = YAML.load_file("deploy/kamal/deploy.yml") || {}; puts(config.dig("ssh", "user") || "root")')" \
+            bun deploy/scripts/install-health-watchdog.ts
+
       - name: Verify origin TLS
         env:
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
           PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
         run: |
-          curl -I -k --max-time 20 --resolve "$BRAIN_DOMAIN:443:$SERVER_IP" "https://$BRAIN_DOMAIN/health"
+          curl -I -k --max-time 20 --resolve "$BRAIN_DOMAIN:443:$SERVER_IP" "https://$BRAIN_DOMAIN/health/live"
+          if [ -n "$WWW_DOMAIN" ]; then
+            curl -I -k --max-time 20 --resolve "$WWW_DOMAIN:443:$SERVER_IP" "https://$WWW_DOMAIN/"
+          fi
           curl -I -k --max-time 20 --resolve "$PREVIEW_DOMAIN:443:$SERVER_IP" "https://$PREVIEW_DOMAIN/"
 
+      - name: Verify operational health
+        run: bunx brains-ops verify-user "$GITHUB_WORKSPACE" "$HANDLE"
+
       - name: Upload generated config
         uses: actions/upload-artifact@v4
         with:
@@ -297,6 +297,12 @@ jobs:
 
       - name: Commit generated config
         run: |
+          # A newly added user's generated directory is untracked, and
+          # `git diff` cannot see untracked files — without intent-to-add
+          # the new config is silently dropped here and every later deploy
+          # skips that user (their files never appear in a commit range).
+          git add --intent-to-add -- users views
+
           if git diff --quiet -- users views; then
             exit 0
           fi