@rizom/ops 0.2.0-alpha.351 → 0.2.0-alpha.352

package/dist/schema.d.ts

@@ -4,13 +4,6 @@ export declare const handleSchema: z.ZodString;
 export declare const secretNameSchema: z.ZodString;
 export declare const agePublicKeySchema: z.ZodString;
 export declare const CAPABILITY_BUNDLE_CONTRACT: "capability-bundles-v1";
-export declare const SHARED_FLEET_IMAGE_CONTRACT: "shared-fleet-v1";
-export declare const ISOLATED_SITE_IMAGE_CONTRACT: "isolated-sites-v1";
-export declare const imageContractSchema: z.ZodEnum<{
-    "shared-fleet-v1": "shared-fleet-v1";
-    "isolated-sites-v1": "isolated-sites-v1";
-}>;
-export type ImageContract = z.output<typeof imageContractSchema>;
 export declare const canonicalBundleIdSchema: z.ZodEnum<{
     core: "core";
     media: "media";
@@ -35,39 +28,34 @@ export declare const profileKindSchema: z.ZodEnum<{
     team: "team";
     organization: "organization";
 }>;
-export interface PilotConfig {
-    brainVersion: string;
-    bundleContract: typeof CAPABILITY_BUNDLE_CONTRACT;
-    imageContract: ImageContract;
-    bundles: CanonicalBundleId[];
-    add?: string[] | undefined;
-    remove?: string[] | undefined;
-    githubOrg: string;
-    contentRepoPrefix: string;
-    domainSuffix: string;
-    aiApiKey: string;
-    gitSyncToken: string;
-    contentRepoAdminToken: string;
-    agePublicKey: string;
-}
-export interface SiteOverrideConfig {
-    package: string;
-    version: string;
-    theme?: string | undefined;
-    themeVersion?: string | undefined;
-}
-export interface CohortConfig {
-    members: string[];
-    brainVersionOverride?: string | undefined;
-    bundlesOverride?: CanonicalBundleId[] | undefined;
-    addOverride?: string[] | undefined;
-    removeOverride?: string[] | undefined;
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-}
+declare const canonicalBundlesSchema: z.ZodArray<typeof canonicalBundleIdSchema>;
+declare const memberIdsSchema: z.ZodArray<z.ZodString>;
 /** Sole active desired-state contract for the canonical brain. */
-export declare const pilotSchema: z.ZodType<PilotConfig>;
-export declare const cohortSchema: z.ZodType<CohortConfig>;
+export declare const pilotSchema: z.ZodObject<{
+    brainVersion: z.ZodString;
+    bundleContract: z.ZodLiteral<typeof CAPABILITY_BUNDLE_CONTRACT>;
+    bundles: typeof canonicalBundlesSchema;
+    add: z.ZodOptional<typeof memberIdsSchema>;
+    remove: z.ZodOptional<typeof memberIdsSchema>;
+    githubOrg: z.ZodString;
+    contentRepoPrefix: z.ZodString;
+    domainSuffix: z.ZodString;
+    aiApiKey: z.ZodString;
+    gitSyncToken: z.ZodString;
+    contentRepoAdminToken: z.ZodString;
+    agePublicKey: z.ZodString;
+}, z.core.$strict>;
+export type PilotConfig = z.output<typeof pilotSchema>;
+export declare const cohortSchema: z.ZodObject<{
+    members: z.ZodArray<z.ZodString>;
+    brainVersionOverride: z.ZodOptional<z.ZodString>;
+    bundlesOverride: z.ZodOptional<typeof canonicalBundlesSchema>;
+    addOverride: z.ZodOptional<typeof memberIdsSchema>;
+    removeOverride: z.ZodOptional<typeof memberIdsSchema>;
+    aiApiKeyOverride: z.ZodOptional<z.ZodString>;
+    gitSyncTokenOverride: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type CohortConfig = z.output<typeof cohortSchema>;
 declare const anchorProfileSocialLinkSchema: z.ZodObject<{
     platform: z.ZodEnum<{
         github: "github";
@@ -117,7 +105,13 @@ declare const atprotoSchema: z.ZodObject<{
     lexiconAuthority: z.ZodOptional<z.ZodBoolean>;
     jetstream: z.ZodOptional<typeof atprotoJetstreamSchema>;
 }>;
-export declare const siteOverrideSchema: z.ZodType<SiteOverrideConfig>;
+export declare const siteOverrideSchema: z.ZodObject<{
+    package: z.ZodString;
+    version: z.ZodString;
+    theme: z.ZodOptional<z.ZodString>;
+    themeVersion: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SiteOverrideConfig = z.output<typeof siteOverrideSchema>;
 declare const playbooksSchema: z.ZodObject<{
     onboarding: z.ZodOptional<z.ZodBoolean>;
 }>;

package/dist/stage-legacy-crossover.d.ts

@@ -1,12 +1,14 @@
+import { z } from "@brains/utils/zod";
 import { type CapabilityBundleReview } from "./capability-bundle-migration";
-import { type SiteOverrideConfig } from "./schema";
+import { siteOverrideSchema } from "./schema";
 export interface StagedCrossover {
     outputDir: string;
     changedFiles: string[];
 }
-interface ReviewedSitePinManifest {
-    sites: Record<string, SiteOverrideConfig>;
-}
+declare const reviewedSitePinsSchema: z.ZodObject<{
+    sites: z.ZodRecord<z.ZodString, typeof siteOverrideSchema>;
+}, z.core.$strict>;
+type ReviewedSitePinManifest = z.output<typeof reviewedSitePinsSchema>;
 export type ReviewedSitePins = ReviewedSitePinManifest["sites"];
 export interface StageLegacyCrossoverOptions {
     sitePins?: ReviewedSitePins | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizom/ops",
-  "version": "0.2.0-alpha.351",
+  "version": "0.2.0-alpha.352",
   "description": "Operator CLI for managing private brain fleet registry repos",
   "keywords": [
     "brains",

package/templates/rover-pilot/.github/workflows/build.yml

@@ -11,14 +11,6 @@ on:
         description: "Space-separated exact site/theme packages for one explicit image build. Shared-fleet automatic builds derive the version-wide package union from desired state."
         required: false
         type: string
-      image_contract:
-        description: Image contract for an explicit version build
-        required: false
-        type: choice
-        options:
-          - isolated-sites-v1
-          - shared-fleet-v1
-        default: isolated-sites-v1
       overwrite:
         description: Rebuild an existing tag in place. Published tags are immutable; confirm only when replacing a tag whose containers were never deployed.
         required: false
@@ -67,7 +59,6 @@ jobs:
         env:
           BRAIN_VERSION_INPUT: ${{ inputs.brain_version || '' }}
           SITE_PACKAGES_INPUT: ${{ inputs.site_packages || '' }}
-          IMAGE_CONTRACT_INPUT: ${{ inputs.image_contract || 'isolated-sites-v1' }}
           ALLOW_TAG_OVERWRITE: ${{ inputs.overwrite && 'true' || 'false' }}
         run: bun deploy/scripts/resolve-missing-images.ts
 

package/templates/rover-pilot/README.md

@@ -30,8 +30,8 @@ The repo also checks in its deploy contract:
 
 `.env.schema` is the single source of truth for required and sensitive deploy vars.
 Use separate GitHub tokens: `CONTENT_REPO_ADMIN_TOKEN` for operator-side content repo creation/checks, and `GIT_SYNC_TOKEN` for runtime directory-sync git access.
-`pilot.yaml.imageContract` makes image topology explicit. The default `shared-fleet-v1` contract publishes one `brain-${brainVersion}` image per effective Brain version and installs the union of exact site/theme package pins required by instances on that version. `isolated-sites-v1` remains available only for fleets that deliberately require package-isolated images.
-When an effective brain version (`pilot.yaml.brainVersion`, or a cohort override) changes and you push, CI builds every missing shared version image, refreshes generated user env files, and redeploys affected users. Every external site and theme package keeps its own exact version pin; under the shared contract, change that package set only together with a fresh Brain version so published tags remain immutable.
+The fleet publishes one `brain-${brainVersion}` image per effective Brain version and installs the union of exact site/theme package pins required by instances on that version.
+When an effective brain version (`pilot.yaml.brainVersion`, or a cohort override) changes and you push, CI builds every missing version image, refreshes generated user env files, and redeploys affected users. Every external site and theme package keeps its own exact version pin; change that package set only together with a fresh Brain version so published tags remain immutable.
 When a push changes only deploy contract files, CI prints `No affected user configs; skipping deploy.` and stops before Kamal.
 
 ## Commands

package/templates/rover-pilot/deploy/scripts/helpers.ts

@@ -6,9 +6,7 @@ export {
   requireEnv,
   writeGitHubOutput,
   writeGitHubEnv,
-  siteImageTag,
   runtimeImageTag,
-  sitePackagesFor,
   runResolveMissingImages,
 } from "@rizom/ops/deploy";
 export type { EnvSchemaEntry } from "@rizom/ops/deploy";

package/templates/rover-pilot/deploy/scripts/resolve-user-config.ts

@@ -6,7 +6,6 @@ import {
   parseEnvFile,
   requireEnv,
   runtimeImageTag,
-  sitePackagesFor,
   writeGitHubOutput,
 } from "./helpers";
 
@@ -43,15 +42,9 @@ const wwwDomain = isFleetDomain(
 
 const brainVersion = envEntries["BRAIN_VERSION"] ?? "";
 
-// Build and deploy share one tag function. A shared fleet always resolves to
-// `brain-{version}`; an explicitly isolated fleet may include the instance's
-// exact site package set in its tag.
-const sitePackages = sitePackagesFor(user.siteOverride);
-const imageTag = runtimeImageTag(
-  registry.pilot.imageContract,
-  brainVersion,
-  sitePackages,
-);
+// Build and Deploy share one tag function: every instance on a Brain version
+// runs the same immutable fleet image.
+const imageTag = runtimeImageTag(brainVersion);
 
 const outputs: Record<string, string> = {
   brain_version: brainVersion,

package/templates/rover-pilot/docs/operator-playbook.md

@@ -16,12 +16,11 @@ Treat these as checked-in deploy artifacts in the pilot repo:
 `.env.schema` is the single source of truth for required and sensitive deploy vars.
 The deploy scripts and workflows should read from that contract instead of inventing a second list.
 
-The pilot declares its image topology with `pilot.yaml.imageContract`:
+The fleet has one image topology:
 
-- `shared-fleet-v1` publishes one `brain-${brainVersion}` image for each effective Brain version
-- each shared image contains the union of exact site/theme package pins required by instances on that version
+- one immutable `brain-${brainVersion}` image is published for each effective Brain version
+- each image contains the union of exact site/theme package pins required by instances on that version
 - conflicting versions of one package fail image resolution before build
-- `isolated-sites-v1` is an explicit alternative for fleets that require package-isolated tags
 - generated `users/<handle>/.env` carries `BRAIN_VERSION=<brainVersion>`
 - build and deploy derive the same effective image tag from the resolved registry
 
@@ -262,12 +261,12 @@ siteOverride:
   themeVersion: <exact-theme-version>
 ```
 
-Missing external package versions fail desired-state validation. Under
-`shared-fleet-v1`, every instance on one Brain version uses the same image and exact
-package union. Change a site/theme package pin only together with a fresh Brain version;
-published `brain-${brainVersion}` tags remain immutable. Conflicting pins for one package
-on the same Brain version fail before build. Bundled `@brains/*` themes omit
-`themeVersion` because they are not installed as separate packages.
+Missing external package versions fail desired-state validation. Every instance on one
+Brain version uses the same image and exact package union. Change a site/theme package
+pin only together with a fresh Brain version; published `brain-${brainVersion}` tags
+remain immutable. Conflicting pins for one package on the same Brain version fail before
+build. Bundled `@brains/*` themes omit `themeVersion` because they are not installed as
+separate packages.
 
 ### Custom-package canary and rollback
 
@@ -277,8 +276,9 @@ on the same Brain version fail before build. Bundled `@brains/*` themes omit
 4. Run `bunx brains-ops verify-user . <handle>`.
 5. Manually verify the site, theme, Studio, content sync, and passkey sign-in before adding more users.
 
-To roll back, remove or change `siteOverride`, reconcile, and redeploy that user.
-The default image and other users remain untouched.
+To roll back, remove or change `siteOverride` while selecting a fresh Brain version,
+then reconcile and redeploy that user. Never mutate an existing image tag; coordinate any
+other users intentionally sharing the selected version.
 
 ## Setup email checklist
 

package/templates/rover-pilot/pilot.yaml

@@ -1,6 +1,5 @@
 brainVersion: 0.1.1-alpha.14
 bundleContract: capability-bundles-v1
-imageContract: shared-fleet-v1
 githubOrg: <github-org>
 contentRepoPrefix: rover-
 domainSuffix: .rizom.ai