@celilo/cli 0.11.0 → 0.12.0

package/src/services/build-bus/subscriber-store.ts

@@ -1,6 +1,6 @@
 /**
  * Static-config subscriber store for the build bus
- * ([[v2/BUILD_BUS.md]] Phase 2-lite).
+ * ([[openspec/changes/build-bus-poll-cd/proposal.md]] Phase 2-lite).
  *
  * The first cut of cross-machine event distribution skips the
  * registry-server switchboard described in §6 of the spec — instead

package/src/services/bus-interview.ts

@@ -9,7 +9,7 @@
  * nothing answers, the operator sees the unanswered query via
  * `celilo events list-pending` and fixes the responder setup.
  *
- * See `infra/design/INTERACTIVE_DEPLOYS_VIA_BUS.md`.
+ * See `infra/openspec/changes/interactive-deploys-via-event-bus/proposal.md`.
  */
 
 import { type Bus, defineEvents, openBus } from '@celilo/event-bus';

package/src/services/celilo-events.ts

@@ -64,7 +64,7 @@ export interface UninstallFailedPayload {
  * module) has come up / been torn down. Carries the system's identity so a
  * subscriber (e.g. a dns_internal provider) can register/deregister internal
  * DNS records without re-querying the deploying module's config.
- * v2/INTERNAL_DNS_DHCP_AND_SPLIT_HORIZON.md D5.
+ * openspec/specs/internal-dns-split-horizon/spec.md D5.
  */
 export interface SystemCreatedPayload {
   /** The module whose deploy produced this system (lets handlers resolve zones, etc.). */

package/src/services/celilo-mgmt-hooks.test.ts

@@ -1,6 +1,6 @@
 /**
  * Behavior tests for the celilo-mgmt module's on_backup / on_restore
- * hooks (Phase 3 of v2/SYSTEM_BACKUP_TERRAFORM_STATE.md).
+ * hooks (Phase 3 of openspec/specs/management-server-backup/spec.md).
  *
  * We import the hook scripts directly and call their handlers with a
  * synthesized HookContext, then assert on the side-effects (files

package/src/services/cross-module-read.ts

@@ -1,7 +1,7 @@
 /**
  * Materialization helpers for the `cross_module_read` privilege.
  *
- * Phase 2 of v2/SYSTEM_BACKUP_TERRAFORM_STATE.md. When an allow-listed
+ * Phase 2 of openspec/specs/management-server-backup/spec.md. When an allow-listed
  * module (today: only celilo-mgmt) declares `cross_module_read` in its
  * `requires.capabilities`, its on_backup hook receives a
  * `cross_module_root` input pointing at a directory mirroring OTHER

package/src/services/deploy-posture.ts

@@ -1,6 +1,6 @@
 /**
  * Deploy posture — fast vs. safe — for `celilo module upgrade` (ISS-0138,
- * v2/BUILD_BUS.md).
+ * openspec/changes/build-bus-poll-cd/proposal.md).
  *
  * CD is CI-driven, so no operator is present to pass `--no-backup`. The posture
  * (fast = skip backup + extended verify; safe = backup + full verify) is

package/src/services/deployed-systems.test.ts

@@ -17,7 +17,7 @@ const TEST_DB_PATH = './test-deployed-systems.db';
 
 /**
  * Coverage for the one-time `module_systems` upgrade backfill
- * (v2/MODULE_SYSTEMS_ADDRESSING.md): a deployment created before 0007 has its
+ * (openspec/specs/module-systems-addressing/spec.md): a deployment created before 0007 has its
  * host data in module_configs / ip_allocations / module_infrastructure but an
  * empty module_systems, and the refactored hooks resolve to no system. The
  * backfill reconstructs it. Mirrors the real turnip prod state (caddy etc.:

package/src/services/deployed-systems.ts

@@ -15,7 +15,7 @@ import type { InfraSystemFields } from '../variables/types';
 
 /**
  * The deployment-STATE layer: a module's 0..N deployed systems
- * (v2/MODULE_SYSTEMS_ADDRESSING.md). Replaces the scalar `target_ip`/`vmid`
+ * (openspec/specs/module-systems-addressing/spec.md). Replaces the scalar `target_ip`/`vmid`
  * rows that used to live in module_configs and the single-result
  * `getModuleHostAndIp`. There is deliberately no "get THE system" helper —
  * callers work with the array so the 0/1/N reality stays visible.
@@ -216,7 +216,7 @@ function asZone(value: string | undefined): NetworkZone | null {
  * `requires.system`, normalized to name `main`, or one `requires.systems`
  * entry), so this records that single host from `hostname` config + the
  * resolved IP. Returns the systems it recorded ([] for an API-only module with
- * no host — e.g. namecheap). See v2/MODULE_SYSTEMS_ADDRESSING.md.
+ * no host — e.g. namecheap). See openspec/specs/module-systems-addressing/spec.md.
  */
 export async function recordDeployedSystemForModule(
   moduleId: string,
@@ -282,7 +282,7 @@ export async function recordDeployedSystemForModule(
 
 /**
  * One-time upgrade backfill: populate `module_systems` for deployments that
- * predate `0007_module_systems` (v2/MODULE_SYSTEMS_ADDRESSING.md). A DB created
+ * predate `0007_module_systems` (openspec/specs/module-systems-addressing/spec.md). A DB created
  * before the target_ip → systems refactor has its host data in
  * `module_configs.target_ip` / `vmid` / `zone` + `ip_allocations` +
  * `module_infrastructure`, but an empty `module_systems` — so `$infra:` and
@@ -374,7 +374,7 @@ function prefixOf(subnetCidr: string | undefined): number {
  * Build the `$infra:<name>.<field>` lookup for a module — one entry per deployed
  * system, keyed by its `name`. `cidr` is derived from `ipv4_address` + the
  * zone's prefix (from `network.<zone>.subnet` in system config). Consumed by the
- * variable resolver at generate time. v2/MODULE_SYSTEMS_ADDRESSING.md.
+ * variable resolver at generate time. openspec/specs/module-systems-addressing/spec.md.
  */
 export function buildInfraSystemsMap(
   moduleId: string,

package/src/services/dns-provider-backfill.ts

@@ -7,7 +7,7 @@
  * every currently-deployed system in its zones by invoking its OWN
  * `on_system_event` hook once per host. The ongoing case (a system deploying
  * AFTER the provider) is handled by the provider's `system.created.*`
- * subscription. See v2/EVENT_DRIVEN_HOOK_SUBSCRIPTIONS.md.
+ * subscription. See openspec/specs/event-driven-hook-subscriptions/spec.md.
  *
  * All DNS mechanics (which zones, register vs delete) live in the module's
  * hook; this file only decides WHICH hosts and invokes the hook. That is the
@@ -74,7 +74,7 @@ export async function backfillProviderDns(
   const failures: string[] = [];
 
   // One register per deployed system across all modules — a module with N
-  // hosts backfills N records (v2/MODULE_SYSTEMS_ADDRESSING.md).
+  // hosts backfills N records (openspec/specs/module-systems-addressing/spec.md).
   for (const mod of deployed) {
     for (const sys of getModuleSystems(mod.id, db)) {
       const result = await runNamedHook(moduleId, 'on_system_event' as HookName, db, logger, {

package/src/services/events-daemon.ts

@@ -171,7 +171,7 @@ export function renderSystemdUnit(input: UnitInputs): string {
       : `journalctl --user -u ${SYSTEMD_UNIT_NAME}`;
   return `[Unit]
 Description=Celilo SQLite Event Bus Dispatcher
-Documentation=https://github.com/psbanka/infra/blob/main/design/SQLITE_EVENT_BUS.md
+Documentation=https://github.com/psbanka/infra/blob/main/openspec/specs/event-bus/spec.md
 After=network.target
 
 [Service]

package/src/services/machine-pool.ts

@@ -242,17 +242,17 @@ export async function listMachines(filters?: MachineFilters): Promise<Machine[]>
 /**
  * Return every machine in any of the given zones — the discovery
  * query the aspect runner uses to find fan-out targets per
- * v2/CELILO_BASE.md.
+ * openspec/specs/base-module-aspects/spec.md.
  *
  * Filters:
  * - `excludeApiOnly` (default `true`): drops machines marked
  *   `api_only` (the greenwave / ISP-modem case). Aspects use
- *   Ansible, so api_only systems are unreachable. v2/CELILO_BASE.md
+ *   Ansible, so api_only systems are unreachable. openspec/specs/base-module-aspects/spec.md
  *   D8.
  * - `excludeHostnames` (default `[]`): drops named hostnames.
  *   Aspect authors that need to skip the system running their own
  *   primary deploy pass it here; the framework doesn't auto-skip
- *   (v2/CELILO_BASE.md D3).
+ *   (openspec/specs/base-module-aspects/spec.md D3).
  *
  * NOTE on container_service systems: this Phase 1 implementation
  * covers MACHINE-based systems only (the machines table). LXCs/VMs

package/src/services/module-deploy.ts

@@ -39,6 +39,7 @@ import { E2E_CONFLICT_MESSAGE, runningE2eContainers } from './e2e-guard';
 import { resolveInfrastructureVariables } from './infrastructure-variable-resolver';
 import { findMachineForModule } from './machine-pool';
 import { checkProxmoxReachable, formatProxmoxUnreachableError } from './proxmox-preflight';
+import { republishStaticWebConsumers } from './public-web-republish';
 import { deleteTemporarySshKey, writeTemporarySshKey } from './ssh-key-manager';
 import { buildTerraformEnvForService } from './terraform-env';
 
@@ -335,7 +336,7 @@ async function deployModuleImpl(
   // events and prompts via clack. Other responder shapes (Claude
   // subagent, `celilo events respond` from another shell, autoresponder
   // daemon) compete on the bus; first reply wins. See
-  // infra/design/INTERACTIVE_DEPLOYS_VIA_BUS.md.
+  // infra/openspec/changes/interactive-deploys-via-event-bus/proposal.md.
   const terminalResponder = process.stdin.isTTY
     ? (await import('./terminal-responder')).startTerminalResponder()
     : null;
@@ -772,7 +773,7 @@ async function deployModuleImpl(
 
       // Fan out the module's base-module aspect (if any) per the
       // on_install trigger. Failures here don't fail the primary
-      // deploy — D4 in v2/CELILO_BASE.md: aspects are idempotent
+      // deploy — D4 in openspec/specs/base-module-aspects/spec.md: aspects are idempotent
       // and forward-progress; a partial fleet update is expected to
       // converge on the next fan-out. We log the result instead.
       const aspectOutcome = await maybeRunAspectForTrigger({
@@ -789,6 +790,27 @@ async function deployModuleImpl(
         log.success(`Base-module aspect fan-out for '${moduleId}' completed`);
       }
 
+      // A public_web provider deploy rebuilds its host and takes /srv/www with
+      // it, while consumers' route rows survive — so the fresh provider would
+      // render site blocks pointing at directories that no longer exist. Re-run
+      // each static consumer's on_install to refill them. Idempotent; failures
+      // are logged, never fatal to the provider's own deploy.
+      const republish = await republishStaticWebConsumers({
+        providerModuleId: moduleId,
+        manifest,
+        db,
+      });
+      if (republish.republished.length > 0) {
+        log.success(
+          `Re-published ${republish.republished.length} static site(s) to '${moduleId}': ${republish.republished.join(', ')}`,
+        );
+      }
+      for (const failure of republish.failures) {
+        log.warn(
+          `Failed to re-publish '${failure.moduleId}' to '${moduleId}': ${failure.error}. Run \`celilo module deploy ${failure.moduleId}\` to restore its content.`,
+        );
+      }
+
       // Mirror the infrastructure-path success message at the end of
       // a successful deploy. Without this, config-only deploys end
       // abruptly with whatever the last hook line was — operator sees
@@ -884,7 +906,7 @@ async function deployModuleImpl(
     // Record the module's deployed system(s) now that the IP is known for every
     // provider type (machine / proxmox IPAM / DO outputs). This populates
     // ctx.systems for on_install and is the source of truth for system.created
-    // and DNS (v2/MODULE_SYSTEMS_ADDRESSING.md). API-only modules record none.
+    // and DNS (openspec/specs/module-systems-addressing/spec.md). API-only modules record none.
     {
       const { recordDeployedSystemForModule } = await import('./deployed-systems');
       const recorded = await recordDeployedSystemForModule(
@@ -1170,7 +1192,7 @@ async function deployModuleImpl(
 
         // Inject the machine's IP as ip.primary for hooks that still read it
         // (firewall NAT target, etc.). The host's address for hooks now comes
-        // from ctx.systems (v2/MODULE_SYSTEMS_ADDRESSING.md), recorded into
+        // from ctx.systems (openspec/specs/module-systems-addressing/spec.md), recorded into
         // module_systems during generate — no target_ip is written here.
         if (machineId) {
           const { getMachine } = await import('./machine-pool');
@@ -1235,6 +1257,48 @@ async function deployModuleImpl(
             error: installResult.error,
           };
         }
+
+        // Persist on_install string outputs as secrets on this module — same
+        // as the validate_config / container_created paths above. caddy relies
+        // on this to publish its firewall external IP (`public_ip`) so
+        // public_web.register_route can point a new hostname's public A record
+        // at it (M1 / #328).
+        if (Object.keys(installResult.outputs).length > 0) {
+          const { secrets: st } = await import('../db/schema');
+          const { encryptSecret } = await import('../secrets/encryption');
+          const mk = await getOrCreateMasterKey();
+          for (const [key, value] of Object.entries(installResult.outputs)) {
+            if (typeof value !== 'string') continue;
+            const encrypted = encryptSecret(value, mk);
+            const existing = db
+              .select()
+              .from(st)
+              .where(and(eq(st.moduleId, moduleId), eq(st.name, key)))
+              .get();
+            if (existing) {
+              db.update(st)
+                .set({
+                  encryptedValue: encrypted.encryptedValue,
+                  iv: encrypted.iv,
+                  authTag: encrypted.authTag,
+                  updatedAt: new Date(),
+                })
+                .where(eq(st.id, existing.id))
+                .run();
+            } else {
+              db.insert(st)
+                .values({
+                  moduleId,
+                  name: key,
+                  encryptedValue: encrypted.encryptedValue,
+                  iv: encrypted.iv,
+                  authTag: encrypted.authTag,
+                })
+                .run();
+            }
+            log.success(`Stored hook output: ${key}`);
+          }
+        }
       }
 
       // Transition to INSTALLED
@@ -1274,7 +1338,7 @@ async function deployModuleImpl(
       // host — the event path below only covers systems that deploy AFTER the
       // provider (deliveries bind at emit time). Non-providers skip this
       // entirely; their registration rides the system.created event below.
-      // v2/EVENT_DRIVEN_HOOK_SUBSCRIPTIONS.md.
+      // openspec/specs/event-driven-hook-subscriptions/spec.md.
       const { isDnsInternalProvider, backfillProviderDns, backfillWebRouteDns } = await import(
         './dns-provider-backfill'
       );
@@ -1304,8 +1368,8 @@ async function deployModuleImpl(
 
       // Announce each deployed system on the bus (D5/D6) — one
       // system.created.<module> per host, so a dns_internal provider's
-      // subscription registers every one (v2/MODULE_SYSTEMS_ADDRESSING.md,
-      // v2/INTERNAL_DNS_DHCP_AND_SPLIT_HORIZON.md, v2/EVENT_DRIVEN_HOOK_SUBSCRIPTIONS.md).
+      // subscription registers every one (openspec/specs/module-systems-addressing/spec.md,
+      // openspec/specs/internal-dns-split-horizon/spec.md, openspec/specs/event-driven-hook-subscriptions/spec.md).
       try {
         const { emitSystemCreated } = await import('./celilo-events');
         for (const sys of getModuleSystems(moduleId, db)) {
@@ -1323,7 +1387,7 @@ async function deployModuleImpl(
 
       // Fan out the module's base-module aspect (if any) per the
       // on_install trigger. Failures here don't fail the primary
-      // deploy — D4 in v2/CELILO_BASE.md: aspects are idempotent
+      // deploy — D4 in openspec/specs/base-module-aspects/spec.md: aspects are idempotent
       // and forward-progress; a partial fleet update is expected to
       // converge on the next fan-out. We log the result instead.
       const aspectOutcome = await maybeRunAspectForTrigger({
@@ -1340,6 +1404,27 @@ async function deployModuleImpl(
         log.success(`Base-module aspect fan-out for '${moduleId}' completed`);
       }
 
+      // A public_web provider deploy rebuilds its host and takes /srv/www with
+      // it, while consumers' route rows survive — so the fresh provider would
+      // render site blocks pointing at directories that no longer exist. Re-run
+      // each static consumer's on_install to refill them. Idempotent; failures
+      // are logged, never fatal to the provider's own deploy.
+      const republish = await republishStaticWebConsumers({
+        providerModuleId: moduleId,
+        manifest,
+        db,
+      });
+      if (republish.republished.length > 0) {
+        log.success(
+          `Re-published ${republish.republished.length} static site(s) to '${moduleId}': ${republish.republished.join(', ')}`,
+        );
+      }
+      for (const failure of republish.failures) {
+        log.warn(
+          `Failed to re-publish '${failure.moduleId}' to '${moduleId}': ${failure.error}. Run \`celilo module deploy ${failure.moduleId}\` to restore its content.`,
+        );
+      }
+
       log.success(`Module '${moduleId}' deployed successfully`);
       return {
         success: true,

package/src/services/module-subscriptions.ts

@@ -7,7 +7,7 @@
  *   - `$self` in `pattern`    → the module's id
  *   - `${MODULE_PATH}` in `handler` → the module's installed targetPath
  *   - a `hook:` subscription   → a synthesized `celilo events run-hook
- *     <module> <sub-name>` handler (v2/EVENT_DRIVEN_HOOK_SUBSCRIPTIONS.md)
+ *     <module> <sub-name>` handler (openspec/specs/event-driven-hook-subscriptions/spec.md)
  *
  * The bus subscriber's name is namespaced as `<module-id>.<sub-name>`
  * so two modules can declare a subscription named `smoke` without

package/src/services/module-types-generator.ts

@@ -11,7 +11,7 @@
  * output files; this module is responsible for the translation only, so
  * unit tests can exercise every branch without touching the filesystem.
  *
- * See `design/TECHNICAL_DESIGN_HOOK_API_V2.md` D2 for the design rationale.
+ * See `openspec/changes/hook-api-v2/proposal.md` D2 for the design rationale.
  */
 
 import type { ModuleManifest, VariableDeclare, VariableImport } from '../manifest/schema';

package/src/services/module-validator/git-hygiene.ts

@@ -94,7 +94,7 @@ export function checkGitHygiene(modulePath: string, versionSourceKind?: string):
   // `celilo module version` and ordered by the +N revision, so source moving
   // past the manifest is the NORMAL case, not drift; for pin modules the version
   // is checked against the upstream resolver, not git ancestry. Skip the gate for
-  // both (v2/MODULE_VERSIONING.md / ISS-0151).
+  // both (openspec/changes/module-version-semantics/proposal.md / ISS-0151).
   if (versionSourceKind === 'changeset' || versionSourceKind === 'pin') {
     checks.push({
       category: 'git_hygiene',

package/src/services/port-forwards.test.ts

@@ -0,0 +1,92 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { PortForwardStore } from '@celilo/capabilities';
+import type { DbClient } from '../db/client';
+import { setupTestDatabase } from '../test-utils/setup-test-db';
+import { buildPortForwardStore } from './port-forwards';
+
+const FW = '192.168.0.254';
+
+describe('port-forward store', () => {
+  let dir: string;
+  let db: DbClient;
+  let store: PortForwardStore;
+
+  beforeEach(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'pf-'));
+    const dbPath = join(dir, 'celilo.db');
+    process.env.CELILO_DB_PATH = dbPath;
+    db = await setupTestDatabase(dbPath);
+    store = buildPortForwardStore(db);
+  });
+  afterEach(() => {
+    db.$client.close();
+    process.env.CELILO_DB_PATH = undefined;
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  });
+
+  it('adds and lists forwards for a firewall', () => {
+    store.add(FW, { internalIp: '10.0.20.5', port: 443, protocol: 'TCP', description: 'caddy' });
+    store.add(FW, {
+      internalIp: '10.0.20.42',
+      port: 2222,
+      protocol: 'TCP',
+      description: 'forgejo',
+    });
+    const forwards = store.list(FW);
+    expect(forwards).toHaveLength(2);
+    expect(forwards.map((f) => f.port).sort((a, b) => a - b)).toEqual([443, 2222]);
+  });
+
+  it('add is an idempotent upsert — same tuple → one row, description updated', () => {
+    store.add(FW, { internalIp: '10.0.20.5', port: 443, protocol: 'TCP', description: 'v1' });
+    store.add(FW, { internalIp: '10.0.20.5', port: 443, protocol: 'TCP', description: 'v2' });
+    const forwards = store.list(FW);
+    expect(forwards).toHaveLength(1);
+    expect(forwards[0].description).toBe('v2');
+  });
+
+  it('scopes forwards by firewallIp', () => {
+    store.add(FW, { internalIp: '10.0.20.5', port: 443, protocol: 'TCP', description: 'a' });
+    store.add('10.0.30.254', {
+      internalIp: '10.0.30.5',
+      port: 53,
+      protocol: 'UDP',
+      description: 'b',
+    });
+    expect(store.list(FW)).toHaveLength(1);
+    expect(store.list('10.0.30.254')).toHaveLength(1);
+  });
+
+  it('remove deletes exactly the tuple and leaves others', () => {
+    store.add(FW, { internalIp: '10.0.20.5', port: 443, protocol: 'TCP', description: 'x' });
+    store.add(FW, { internalIp: '10.0.20.5', port: 80, protocol: 'TCP', description: 'y' });
+    store.remove(FW, '10.0.20.5', 443, 'TCP');
+    const forwards = store.list(FW);
+    expect(forwards).toHaveLength(1);
+    expect(forwards[0].port).toBe(80);
+  });
+
+  it('ingressIp forwards are distinct from the public (NULL) ones', () => {
+    store.add(FW, { internalIp: '10.0.20.5', port: 53, protocol: 'UDP', description: 'public' });
+    store.add(FW, {
+      internalIp: '10.0.20.5',
+      port: 53,
+      protocol: 'UDP',
+      ingressIp: '10.0.10.53',
+      description: 'ingress',
+    });
+    expect(store.list(FW)).toHaveLength(2);
+    // removing the public (NULL-ingress) one leaves the ingress one intact
+    store.remove(FW, '10.0.20.5', 53, 'UDP');
+    const forwards = store.list(FW);
+    expect(forwards).toHaveLength(1);
+    expect(forwards[0].ingressIp).toBe('10.0.10.53');
+  });
+});

package/src/services/port-forwards.ts

@@ -0,0 +1,86 @@
+/**
+ * Port-forward registry — the DB-backed `PortForwardStore` (openspec/changes/unified-management-no-ssh/proposal.md).
+ *
+ * The shared-core desired-state store for the `firewall` capability. The
+ * capability-loader constructs one of these and injects it into the firewall
+ * provider factory, so `exposeService`/`unexposeService` become register/
+ * unregister and the provider's converge renders the complete ruleset from
+ * `list(firewallIp)` and applies it atomically (`iptables-restore`). Replaces
+ * "read the box back with `iptables -L`" as the source of truth.
+ */
+
+import type { PortForward, PortForwardStore, Protocol } from '@celilo/capabilities';
+import { and, eq, isNull } from 'drizzle-orm';
+import type { DbClient } from '../db/client';
+import { portForwards } from '../db/schema';
+
+/** NULL-aware match on the optional ingress IP (SQLite treats NULL as distinct). */
+function ingressMatch(ingressIp: string | undefined) {
+  return ingressIp ? eq(portForwards.ingressIp, ingressIp) : isNull(portForwards.ingressIp);
+}
+
+export function buildPortForwardStore(db: DbClient): PortForwardStore {
+  return {
+    list(firewallIp: string): PortForward[] {
+      return db
+        .select()
+        .from(portForwards)
+        .where(eq(portForwards.firewallIp, firewallIp))
+        .all()
+        .map((r) => ({
+          internalIp: r.internalIp,
+          port: r.port,
+          protocol: r.protocol,
+          ingressIp: r.ingressIp ?? undefined,
+          description: r.description,
+        }));
+    },
+
+    add(firewallIp: string, forward: PortForward): void {
+      // Idempotent upsert: delete any existing row for this exact tuple, then
+      // insert. Matches buildRouteOps' delete-then-insert (keeps the operation
+      // atomic w.r.t. the unique index, and NULL-aware on ingress_ip).
+      db.delete(portForwards)
+        .where(
+          and(
+            eq(portForwards.firewallIp, firewallIp),
+            eq(portForwards.internalIp, forward.internalIp),
+            eq(portForwards.port, forward.port),
+            eq(portForwards.protocol, forward.protocol),
+            ingressMatch(forward.ingressIp),
+          ),
+        )
+        .run();
+      db.insert(portForwards)
+        .values({
+          firewallIp,
+          internalIp: forward.internalIp,
+          port: forward.port,
+          protocol: forward.protocol,
+          ingressIp: forward.ingressIp ?? null,
+          description: forward.description,
+        })
+        .run();
+    },
+
+    remove(
+      firewallIp: string,
+      internalIp: string,
+      port: number,
+      protocol: Protocol,
+      ingressIp?: string,
+    ): void {
+      db.delete(portForwards)
+        .where(
+          and(
+            eq(portForwards.firewallIp, firewallIp),
+            eq(portForwards.internalIp, internalIp),
+            eq(portForwards.port, port),
+            eq(portForwards.protocol, protocol),
+            ingressMatch(ingressIp),
+          ),
+        )
+        .run();
+    },
+  };
+}

package/src/services/proxmox-reconcile.ts

@@ -1,5 +1,5 @@
 /**
- * Proxmox reconciliation (v2/CELILO_BASE.md D5).
+ * Proxmox reconciliation (openspec/specs/base-module-aspects/spec.md D5).
  *
  * When a base-module aspect declares `proxmox_reconcile.tfvars` and
  * its fan-out plan touches Proxmox-provisioned LXCs, the running
@@ -151,6 +151,6 @@ export function executeProxmoxReconcile(plan: ProxmoxReconcilePlan): void {
     );
   }
   log.warn(
-    'To persist these values, re-deploy the owning modules after the underlying celilo state catches up. Tracked as Phase 1c in v2/CELILO_BASE.md.',
+    'To persist these values, re-deploy the owning modules after the underlying celilo state catches up. Tracked as Phase 1c in openspec/specs/base-module-aspects/spec.md.',
   );
 }