@rizom/ops 0.2.0-alpha.558 → 0.2.0-alpha.559

package/dist/run-command.d.ts

@@ -1,6 +1,6 @@
 import type { FetchLike } from "@brains/utils/fetch-like";
 import { type CommandDefinition, type FlagDefinitions, type ParsedCliArgs } from "@brains/deploy-support/cli-kit";
-import type { LoadPilotRegistryOptions } from "./load-registry";
+import { type LoadPilotRegistryOptions } from "./load-registry";
 import { type LookupHost } from "./observed-status";
 import { type RunCommand as OpsRunCommand } from "@brains/deploy-support/run-subprocess";
 import { type SshKeygen } from "./ssh-key-bootstrap";
@@ -23,6 +23,7 @@ export interface CommandDependencies extends LoadPilotRegistryOptions {
     verificationRetryDelayMs?: number | undefined;
     sleep?: ((delayMs: number) => Promise<void>) | undefined;
     bootstrapRunCommand?: OpsRunCommand | undefined;
+    imageLockRunCommand?: OpsRunCommand | undefined;
     sshKeygen?: SshKeygen | undefined;
     directorySyncStressRunner?: typeof runDeployedDirectorySyncStress | undefined;
     directorySyncStressAccessRunner?: typeof verifyDirectorySyncStressAccess | undefined;

package/dist/runtime-image-lock.d.ts

@@ -0,0 +1,12 @@
+import type { RequiredImage } from "./image-types";
+import { type RunCommand } from "@brains/deploy-support/run-subprocess";
+/** Operator-owned build inputs, not generated per-user deploy output. */
+export declare function runtimeImageLockDirectory(image: RequiredImage): string;
+/** Fail before publishing when a required build has no reviewed, matching inputs. */
+export declare function assertRuntimeImageLock(rootDir: string, image: RequiredImage): Promise<void>;
+/**
+ * Resolve once for operator review; CI and Docker only consume the frozen result.
+ * Existing entries are never refreshed or overwritten. Failed new entries retain
+ * their incomplete marker and diagnostic files and cannot be used by a build.
+ */
+export declare function lockRuntimeImage(rootDir: string, image: RequiredImage, run?: RunCommand): Promise<"created" | "existing">;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizom/ops",
-  "version": "0.2.0-alpha.558",
+  "version": "0.2.0-alpha.559",
   "description": "Operator CLI for managing private brain fleet registry repos",
   "keywords": [
     "brains",

package/templates/rover-pilot/.github/workflows/build.yml

@@ -4,11 +4,11 @@ on:
   workflow_dispatch:
     inputs:
       brain_version:
-        description: Build one Brain version with the full fleet package union
+        description: Build one Brain version from its checked-in runtime lock
         required: false
         type: string
       site_packages:
-        description: "Extra exact site/theme package pins for an explicit build. All builds include the full fleet package union; conflicting pins are rejected."
+        description: "Exact site/theme pins for an explicit build; a matching checked-in runtime lock is required."
         required: false
         type: string
       overwrite:
@@ -43,9 +43,11 @@ jobs:
           ref: ${{ github.sha }}
 
       - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.0
 
       - name: Install operator tooling
-        run: bun install
+        run: bun install --frozen-lockfile --ignore-scripts
 
       - name: Log in to GHCR
         uses: docker/login-action@v4
@@ -109,8 +111,7 @@ jobs:
           target: fleet
           push: true
           build-args: |
-            BRAIN_VERSION=${{ matrix.image.brain_version }}
-            SITE_PACKAGES=${{ matrix.image.site_packages }}
+            RUNTIME_IMAGE_TAG=${{ matrix.image.tag }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: |
             ${{ steps.meta.outputs.labels }}

package/templates/rover-pilot/docs/operator-playbook.md

@@ -24,9 +24,43 @@ The fleet has one image topology:
 - generated `users/<handle>/.env` carries `BRAIN_VERSION=<brainVersion>`, and `IMAGE_TAG=<tag>` for an instance with site pins
 - build and deploy derive the same effective image tag from the resolved registry
 
+## Reviewed runtime dependencies
+
+Use Bun 1.4.0 to prepare the full dependency graph before building a new image:
+
+```sh
+brains-ops images:lock .
+# Or prepare one version/pin set before promotion:
+brains-ops images:lock . --brain-version <exact-version> --site-packages "<exact site/theme pins>"
+```
+
+Review and commit each new `deploy/runtime/<image-tag>/package.json` and `bun.lock`
+together with its desired-state change. The manifest pins Brain and exactly that
+image's site/theme packages, and overrides `postcss-selector-parser` to 7.1.6.
+Review fresh runtime audit and behavior checks; a frozen lock is not proof that
+bundled code, operating-system packages, or every dependency is vulnerability-free.
+
+The command resolves dependencies with lifecycle scripts disabled; it does not
+build, publish, deploy, decrypt secrets, or inspect fleet hosts. Existing entries
+are validated and left untouched, never refreshed. A failed new entry retains an
+`.incomplete` marker and diagnostic files and blocks reuse; inspect and preserve
+that evidence before separately approving any recovery.
+
+Build refuses missing, incomplete, or mismatched manifests. Docker copies only the
+reviewed manifest and lock for the selected tag and installs production packages
+with `--frozen-lockfile --ignore-scripts`; it never resolves updates with `bun add`.
+Commit both inputs: changing only the manifest without a matching lock fails the
+frozen install before publication.
+
+Existing published tags remain immutable and are not rebuilt by adopting this
+scaffold. Existing-image verification still checks only the exact top-level Brain
+and site/theme versions; it does not certify a legacy image's transitive graph.
+The parser fix reaches running instances only through a separately approved new
+image/version rollout, never by overwriting a deployed tag.
+
 ## Version bump flow
 
-When `pilot.yaml.brainVersion` changes and you push:
+First generate and review the matching runtime locks. When `pilot.yaml.brainVersion` changes and you push:
 
 1. build publishes each missing image, named by Brain version and site pins, and verifies existing images against what their names say they hold
 2. reconcile refreshes generated `users/<handle>/.env`