@celilo/cli 0.14.4 → 0.16.1

package/CELILO_CORE_MODULES.md

@@ -39,7 +39,7 @@ Each entry: `module id` — what it is — **provides** / **requires** capabilit
 - **celilo-mgmt** — the celilo management server itself, deployed as a module (replaces install.sh + `system init`; ships daemon, runs migrations, self-registers). **provides:** `celilo_event_bus`, `celilo_module_deploy_worker`. **requires:** `cross_module_read`. See `openspec/specs/management-as-module/spec.md`.
 - **celilo-registry** — module registry server (Cargo sparse protocol); stores `.netapp` files, serves index + search/download API. On install it provisions a confidential introspection OIDC client via `idp.create_oidc_client` (SECURE_MODULE_PUBLISH.md §5[D-A]) and converges its issuer + introspection endpoint + creds onto the box for RFC 7662 token verification. **provides:** `registry_publish`. **requires:** `public_web`, `dns_registrar`, `idp`.
 - **celilo-apt-repo** — Debian apt repository (reprepro + Bun HTTP server) serving the celilo `.deb` at apt.celilo.computer. **provides:** `apt_publish`. **requires:** `public_web`, `dns_registrar`.
-- **signal** — bidirectional Signal transport for alerts and deploy-interview questions; runs signal-cli in daemon mode with its JSON-RPC socket bound to the host's own address (never public). Enrolled as a SECONDARY DEVICE of an existing Signal account rather than registering its own number — Signal blocks most VOIP ranges and bans bot-ish registrations. Recipient addresses live on celilo routes, not in module config, so adding a person never requires a redeploy. Runs on x86_64 and aarch64. `libsignal-client` ships no linux-aarch64 native, so celilo builds one (`modules/signal/build/`) and installs it as a `libsignal-jni` .deb on ARM hosts; x86_64 uses the JAR's bundled native. **provides:** `notification` (`send`, `receive`). **requires:** no capabilities — a transport that depended on the proxy, registrar or firewall could not tell you those were broken — and a system in the **`secure-mgmt`** zone: it holds a linked Signal account (the operator's own messaging identity and keys), and its job is to observe every tier while depending on none, which is what the control-plane zone is for. See `openspec/changes/add-alerting/`.
+- **signal** — bidirectional Signal transport for alerts and deploy-interview questions; runs signal-cli in daemon mode with its JSON-RPC socket bound to the host's own address (never public) and **`--receive-mode=manual`**, which is load-bearing: signal-cli's default (`on-start`) leaves the daemon permanently receiving, so it drains every reply into an SSE stream nothing is attached to and REFUSES celilo's `receive` call — replies arrive and are unreadable, while `send` and every health check keep passing. Enrolled as a SECONDARY DEVICE of an existing Signal account rather than registering its own number — Signal blocks most VOIP ranges and bans bot-ish registrations. Recipient addresses live on celilo routes, not in module config, so adding a person never requires a redeploy. Runs on x86_64 and aarch64. `libsignal-client` ships no linux-aarch64 native, so celilo builds one (`modules/signal/build/`) and installs it as a `libsignal-jni` .deb on ARM hosts; x86_64 uses the JAR's bundled native. **provides:** `notification` (`send`, `receive`). **requires:** no capabilities — a transport that depended on the proxy, registrar or firewall could not tell you those were broken — and a system in the **`secure-mgmt`** zone: it holds a linked Signal account (the operator's own messaging identity and keys), and its job is to observe every tier while depending on none, which is what the control-plane zone is for. See `openspec/changes/add-alerting/`.
 - **celilo-website** — public docs site (static Astro) served via Caddy on celilo.computer. **requires:** `public_web`, `dns_registrar`.
 
 ## Git forge & CI pipeline

package/CELILO_SUBSYSTEMS.md

@@ -30,6 +30,7 @@ see `openspec/specs/`. Companion doc: [CELILO_CORE_MODULES.md](./CELILO_CORE_MOD
 - **Control-plane network (`secure-mgmt`)** — `apps/celilo/src/hooks/capability-loader.ts` — `loadControlPlaneSubnet` returns the subnet of the zone `celilo-mgmt` is deployed in. `secure-mgmt` is a placement zone AND the control-plane tier, deliberately NOT in `ZONE_TIER_ORDER` (it is not part of the `dmz → app → secure` data-plane chain; it reaches every tier by trust). The firewall's `trustedSubnets` derives from this rather than assuming celilo-mgr sits on `internal`. Reported as an actionable gap by `checkControlPlaneNetwork` in `apps/celilo/src/services/fleet-checks.ts` when the management address matches no configured subnet.
 - **A deployed system's zone** — `apps/celilo/src/services/deployed-systems.ts` — for machine-pool deploys the zone recorded is the ZONE OF THE MACHINE, not `requires.system.zone` (which is only the minimum used to *select* a host, as with sizing). Three writers must agree: `recordDeployedSystemForModule`, `backfillModuleSystems`, and `apps/celilo/src/variables/context.ts` — the last runs latest and will overwrite the others.
 - **Host discovery ("which host serves module X?")** — `apps/celilo/src/cli/commands/module-where.ts` (`celilo module where <id> [--json]`, MCP `celilo_module_where`) — reads deployed hosts from `module_systems` via `getModuleSystems`, reconciles the live Proxmox node via `reconcilePlacement`, and adds a role-based reachability hint per zone. CI/build infra (builder VM, Forgejo runners) is out of scope (not in `module_systems`).
+- **Daemon-journal diagnostic ("what does the module's daemon know that celilo doesn't?")** — `apps/celilo/src/services/module-journal.ts` + `apps/celilo/src/cli/commands/module-journal.ts` (`celilo module journal <id> [--unit|--lines|--since|--grep|--json]`, MCP `celilo_module_journal` on the RO principal) — resolves hosts via `getModuleSystems` and reads each one's systemd journal through the `tailLog` remote primitive. General to every module, not one. **READ-ONLY by construction**: `planJournalRead` is pure and the only remote command the op can emit is a `journalctl` read, so it cannot reconfigure a module, send anything, or consume inbound messages the collection path is waiting for (`module-journal.test.ts` asserts on the exact command reaching the SSH seam). Sibling to `celilo module logs`, which reads the LOCAL Ansible deploy log, not the remote daemon. Unit defaults to the glob `<module-id>*`. An unreachable host reports UNREADABLE, never as an empty journal. Rationale: openspec/changes/fix-signal-inbound-delivery Decision 5.
 
 ## Capability system (cross-module data & functions)
 
@@ -143,6 +144,8 @@ runner seam (`execRunner` real / `createMockRunner` for tests) lives in
 - **Deploy pipeline** — `apps/celilo/src/services/module-deploy.ts`.
 - **DNS provider backfill** (re-emit registrations when a provider deploys) — `apps/celilo/src/services/dns-provider-backfill.ts` — `isDnsInternalProvider`, `backfillProviderDns`.
 - **Base-module aspects (fan-out across the fleet)** — `apps/celilo/src/services/aspect-runner.ts` — `planAspectFanOut`, `runAspectFanOut`, `maybeRunAspectForTrigger`. Aspect content lives in `modules/<m>/base-module-aspect/` (e.g. knot-unbound-internal, technitium).
+- **In-flight operation lock** — `apps/celilo/src/services/module-operations.ts` — `startOperation`/`completeOperation`/`failOperation` record deploy/uninstall/backup/restore in `module_operations`; `refuseIfInFlight`/`checkInFlight` are what backup and restore consult. Deploy and uninstall REGISTER but never check: it is a one-way guard protecting backup/restore consistency, not a general mutex (`openspec/specs/management-server-backup/spec.md` "In-flight operation refusal"). A row stops holding the lock once it is GONE, STOPPED/zombie (`isPidRunnable`, `ps -o state=` — `kill(pid,0)` calls a Ctrl-Z'd process alive), or older than `OPERATION_TTL_MS` (2h). The TTL is not redundancy: a pid is a recycled number, and once the pid space wraps an old row names an unrelated healthy process. Operator surface: `celilo module operations [list|clear] [--all]` (`apps/celilo/src/cli/commands/module-operations.ts`).
+- **Backup artifact encryption** — `apps/celilo/src/services/backup-cipher.ts` — `encryptFileToFile`/`decryptFileToFile`, file-in/file-out and streamed, used by every backup writer (`backup-create.ts`) and reader (`backup-restore.ts`, `restore-from-file.ts`). Do NOT route artifacts through `secrets/encryption.ts`: that API is string-in/string-out for short DB values, and feeding it a tar cost base64 (1.33x) then hex (2x) then `JSON.stringify` — ~9x the artifact in memory, which OOM-killed forgejo's 774 MB backup, and a hard ~805 MB ceiling from the max string length that no amount of RAM raises. On-disk format is `magic "CELILOBK" (8) | version (1) | iv (16) | ciphertext | GCM tag (16)`; the tag is a trailer because it does not exist until the last byte is encrypted. `decryptFileToFile` still reads the pre-2026-07 JSON-envelope artifacts, discriminating on the magic bytes — the envelope's own `schemaVersion` cannot serve, as it lives inside the encrypted tar.
 
 ## Generation & templating
 
@@ -171,6 +174,7 @@ is currently wrong, and routes carry the message to a person's phone. Design:
 - **Alert identity** — `apps/celilo/src/services/alerting/keys.ts` — the key grammar (`module:<id>[/check:<name>]`, `builtin:<check>[/<kind>:<target>]`) that makes "the same problem" the same alert across runs. `moduleAlertKey`, `moduleCheckAlertKey`, `builtinAlertKey`, `parseAlertKey`.
 - **Reconciliation** — `apps/celilo/src/services/alerting/reconcile.ts` (`reconcile`) — a successful run's failing-key set is authoritative and resolution is by SET DIFFERENCE (absent ⇒ resolved). A run whose outcome is `error` resolves NOTHING and fires a module-level alert instead: the false-all-clear guard.
 - **Monitor execution** — `apps/celilo/src/services/alerting/run-monitor.ts` (`runOneMonitor`) + `sweep.ts` (`selectDueMonitors`) + `builtin-monitors.ts` / `health-coverage.ts` (the built-in checks and the "module with no health check" coverage check).
+- **Scheduled audit categories (`builtin_check` monitors)** — `apps/celilo/src/services/alerting/builtin-source.ts` — `SCHEDULABLE_BUILTIN_CHECKS` is the list of `celilo system audit` categories cheap enough to run every sweep: `machines_reachable` and `backups`. Everything else in the audit needs the whole world injected (proxmox, terraform, registry) and is not schedulable. Enable one with `celilo monitor add backups --interval 1h`. The `backups` roster comes from `apps/celilo/src/services/audit/backup-source.ts` (`loadBackupAuditInfo`), shared with `celilo system audit` so both judge the same fleet.
 - **The sweep** — `apps/celilo/src/services/alerting/sweep-runner.ts` (`runSweep`) — the ordered pass that makes alerting run by itself: run due monitors → promote past-grace alerts → re-evaluate suppression → flush quiet-hours deferrals → notify. Driven by `celilo alerts sweep` on `timer.tick.5m`. Never throws for one bad monitor.
 - **Suppression (topology-derived, never configured)** — `apps/celilo/src/services/alerting/suppression.ts` — `ancestorKeysFor`/`findSuppressor`/`machineAlertKey`. A firing machine explains its modules' failures; a firing capability provider explains its zone's consumers. Derived from `module_systems`, so it cannot drift from reality. Deploy windows: `deploy-hooks.ts` (`openDeployWindow`/`closeDeployWindows` — closed by module, so a crashed deploy self-heals).
 - **Escalation & quiet hours** — `escalation.ts` (`decideEscalation`, every reason to stay silent enumerated) + `quiet-hours.ts` (`isWithinQuietHours`, Intl-based and DST-safe). Quiet hours defer the MESSAGE while the escalation clock keeps running.
@@ -179,9 +183,21 @@ is currently wrong, and routes carry the message to a person's phone. Design:
 - **Ack / silence / resolve** — `ack.ts` — three deliberately distinct operations. An ack is broadcast to every other paged route.
 - **Interviews over a transport** — `interview-responder.ts` (delivery policy; `secret.*` families are REFUSED) + `notification-responder.ts` (queries the bus's events table for unanswered questions: a watch only sees events emitted after it registers, and `alerts poll` is one-shot. Leaves a question alone for 90s so an attached responder — terminal, or the `api-serve` wire bridge — answers first). Alerts and interviews share the send path, the token table, and the inbound path; only `targetId` differs.
 - **People, routes, policies** — `people.ts` — `createPerson`/`createRoute`/`createPolicy`/`addPolicyStep`.
-- **Persistence** — `apps/celilo/src/services/alerting/store.ts`; tables `people`, `routes`, `escalation_policies`, `escalation_steps`, `monitors`, `monitor_runs`, `suppression_windows`, `alerts`, `notification_deliveries` (`apps/celilo/src/db/schema.ts`, migration `drizzle/0017_alerting.sql`).
+- **Policy resolution** — `apps/celilo/src/services/alerting/notify-deps.ts` — `policyForAlert` (the single answer to "who would this page") + `buildNotifyDeps` (assembles steps, routes, quiet hours, transport, reply token). The policy is read from the MONITOR on every sweep, never snapshotted onto the alert, so `escalation-policy assign` takes effect on alerts that are already firing.
+- **Persistence** — `apps/celilo/src/services/alerting/store.ts`; tables `people`, `routes`, `escalation_policies`, `escalation_steps`, `monitors`, `monitor_runs`, `suppression_windows`, `alerts`, `notification_deliveries` (`apps/celilo/src/db/schema.ts`, migrations `drizzle/0017_alerting.sql`, `drizzle/0018_drop_alert_policy_snapshot.sql`).
 - **CLI** — `apps/celilo/src/cli/commands/` — `alerts-list.ts`, `alerts-act.ts` (ack/silence/resolve), `alerts-sweep.ts`, `alerts-poll.ts`, `monitor.ts`, `notify-config.ts` (`person`/`route`/`escalation-policy`).
 
+## Backups
+
+Creation, scheduling and freshness. A module declares an `on_backup` hook and a
+`backup.schedule`; celilo runs it on that cadence and alerts when it stops.
+
+- **Creation** — `apps/celilo/src/services/backup-create.ts` — `createModuleBackup` (invokes the module's `on_backup` hook into an encrypted envelope), `createSystemStateBackup` (celilo.db), `findBackupEligibleModules`, `isBackupDue`. Storage destinations: `backup-storage.ts`. Retention: `backup-retention.ts` (`pruneBackupsForModule`). Restore: `backup-restore.ts`.
+- **Cadence (one accessor)** — `apps/celilo/src/services/backup-schedule.ts` — `effectiveBackupSchedule(manifest)`. An absent `backup.schedule` means `daily`, NOT `manual`; opting out takes an explicit `manual`. Both the freshness audit and the backup sweep must read cadence through this one function, or a module can be alerted-on but never backed up.
+- **The sweep** — `apps/celilo/src/services/backup-sweep.ts` — `runBackupSweep` (the pass that makes backups run by themselves: for each eligible module, is its declared cadence due → back it up → apply declared retention) + `ensureBackupSweepSubscriber`. Driven by `celilo backup sweep` on `timer.tick.1h` — the coarsest tick that can still serve an `hourly` cadence. Armed automatically: `registerModuleSubscriptions` registers the subscriber for any module declaring an `on_backup` hook, so it appears on install or `module update`. A run refused by the in-flight operation lock is a skip retried next tick, never a failure.
+- **Freshness audit** — `apps/celilo/src/services/audit/backups.ts` (`auditBackups`) — `backup_missing` / `backup_stale` drift findings against the same declared cadence.
+- **CLI** — `apps/celilo/src/cli/commands/` — `backup-sweep.ts`, `backup-create.ts` (also `celilo module backup`), `backup-list.ts`, `backup-restore.ts`, `backup-prune.ts`, `backup-delete.ts`, `backup-import.ts`, `backup-pull.ts`, `backup-name.ts`.
+
 ## Persistence
 
 - **DB schema** — `apps/celilo/src/db/schema.ts`. Client: `apps/celilo/src/db/client.ts`. Migration runner: `apps/celilo/src/db/migrate.ts`. Migrations: `apps/celilo/drizzle/`.
@@ -209,5 +225,6 @@ Run any celilo command on celilo-mgr over SSH instead of screen-scraping `ssh <h
 
 - **cele2e harness** — `packages/e2e/src/` — `runner.ts`, `container-manager.ts` (`startNetwork`, `reconnectNetwork`), `network-builder.ts` (`NetworkBuilder`).
 - **Run wrapper** — `infra/scripts/cele2e-run.sh` lives in the separate `infra/` clone, **not** in this repo. See the cele2e section of the repo-root `CLAUDE.md` for the operator workflow.
-- **Signal simulators** — three containers, three jobs. `docker/Dockerfile.signal-cli` runs the REAL unlinked daemon (`network().withSignalCli()`, reachable at `signal-cli.lab`) so `e2e/tests/signal-contract.test.ts` can re-check celilo's understanding of the JSON-RPC surface against the actual binary — the pebble pattern. `docker/Dockerfile.signal-sim` runs `simulators/signal-cli/server.ts` (`withSignalSim()`, `signal-sim.lab`), the drivable stand-in with a control surface (`/_control/inbound`, `/_control/sent`, `/_control/unlink`). `docker/Dockerfile.signal-release` (`withSignalRelease()`, `signal-release.lab`) serves the signal-cli release tarball so the module's deploy-time download resolves inside the sealed network — the download is served, never skipped. The libsignal aarch64 native is compiled at `build-infra` time from the module's own recipe (`packages/e2e/scripts/stage-libsignal.ts` → `modules/signal/build/`) and staged into the apt-repo pool, so the recipe is exercised for real on every rebuild while the deploy stays fast and the network stays sealed.
+- **Signal simulators** — three containers, three jobs. `docker/Dockerfile.signal-cli` runs the REAL unlinked daemon (`network().withSignalCli()`, reachable at `signal-cli.lab`) so `e2e/tests/signal-contract.test.ts` can re-check celilo's understanding of the JSON-RPC surface against the actual binary — the pebble pattern. `docker/Dockerfile.signal-sim` runs `simulators/signal-cli/server.ts` (`withSignalSim()`, `signal-sim.lab`), the drivable stand-in with a control surface (`/_control/inbound`, `/_control/sent`, `/_control/unlink`). `/_control/inbound` from the LINKED account's own number emits a `syncMessage.sentMessage` transcript rather than a `dataMessage`, because that is the only shape the real daemon delivers a note-to-self in — and a note-to-self is what every reply is in the default single-operator setup (#460). `docker/Dockerfile.signal-release` (`withSignalRelease()`, `signal-release.lab`) serves the signal-cli release tarball so the module's deploy-time download resolves inside the sealed network — the download is served, never skipped. The libsignal aarch64 native is compiled at `build-infra` time from the module's own recipe (`packages/e2e/scripts/stage-libsignal.ts` → `modules/signal/build/`) and staged into the apt-repo pool, so the recipe is exercised for real on every rebuild while the deploy stays fast and the network stays sealed.
+- **Public-boundary NAT model** — `packages/e2e/config/routing/` — exactly ONE NAT sits between the fleet and the simulated internet: the customer firewall (`fw-main` in `direct-internet`, `fw-isp` in the two-layer default), which MASQUERADEs to `100.100.0.100`. The ISP edge `fw-ext` ROUTES the customer's `100.100.0.0/24` and must never re-NAT it (`-s 100.100.0.0/24 -j RETURN` ahead of its MASQUERADE) — an ISP does not NAT a subscriber that already holds a public address. This is load-bearing, not cosmetic: Namecheap-style DDNS registers the SOURCE address when the caller omits `ip=`, which is how celilo registers public names since #464/#466, so a second NAT here publishes the simulator's own address for every public hostname and quietly breaks ACME, inbound reach, and seeded apex records. Constants: `externalWanIp()` / `externalWanSubnet()` in `src/types.ts`. The corollary: every simulator on `internet-external` must default-route via fw-ext (`100.64.0.1`) so it can reply to the customer's public address — Docker's bridge gateway has no path across networks. `config/routing/public-sim-entrypoint.sh` is the shared two-liner; the DNS hierarchy, pebble, isitup and celilo-website-sim already carried it, and npm-registry / registry / apt-repo / minio / cpanel-host only appeared to work because the double NAT put fw-ext's on-link address in the source field.
 - **MCP server (agent-driven e2e)** — `packages/mcp-server/src/index.ts` — stdio MCP server exposing `start_run`/`run_status`/`run_result`/`stop_run` (detached cele2e runs read off the event bus, no ANSI scraping) + `env_check` (docker VM, run-lock, shared-infra, mgmt image CLI version, netapps). Dev/ops tool, `private`, not shipped to consumers.

package/drizzle/0018_drop_alert_policy_snapshot.sql

@@ -0,0 +1,46 @@
+-- Drop `alerts.escalation_policy_id`.
+--
+-- The escalation policy was copied onto each alert when the alert was created,
+-- and the sweep resolved it from that copy. An operator assigning a policy to a
+-- monitor therefore changed nothing for any alert that was ALREADY firing —
+-- which is the only situation in which anyone runs `escalation-policy assign`.
+-- The policy now lives only on the monitor and is resolved on every sweep.
+--
+-- Table rebuild rather than DROP COLUMN: SQLite refuses to drop a column named
+-- in a FOREIGN KEY clause.
+
+CREATE TABLE `__new_alerts` (
+	`id` text PRIMARY KEY NOT NULL,
+	`key` text NOT NULL,
+	`active_key` text,
+	`monitor_id` text NOT NULL,
+	`state` text DEFAULT 'pending' NOT NULL,
+	`severity` text NOT NULL,
+	`first_fired_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`last_seen_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`grace_until` integer NOT NULL,
+	`suppressed_by_alert_id` text,
+	`suppressed_by_window_id` text,
+	`unsuppressed_at` integer,
+	`awaiting_confirmation` integer DEFAULT false NOT NULL,
+	`acked_by` text,
+	`acked_at` integer,
+	`silenced_until` integer,
+	`escalation_step` integer DEFAULT 0 NOT NULL,
+	`next_escalation_at` integer,
+	`deferred_until` integer,
+	`deferred_route_id` text,
+	`message` text NOT NULL,
+	`details` text,
+	`resolved_at` integer,
+	FOREIGN KEY (`monitor_id`) REFERENCES `monitors`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`suppressed_by_window_id`) REFERENCES `suppression_windows`(`id`) ON UPDATE no action ON DELETE set null,
+	FOREIGN KEY (`acked_by`) REFERENCES `people`(`id`) ON UPDATE no action ON DELETE set null,
+	FOREIGN KEY (`deferred_route_id`) REFERENCES `routes`(`id`) ON UPDATE no action ON DELETE set null
+);
+--> statement-breakpoint
+INSERT INTO `__new_alerts` SELECT `id`, `key`, `active_key`, `monitor_id`, `state`, `severity`, `first_fired_at`, `last_seen_at`, `grace_until`, `suppressed_by_alert_id`, `suppressed_by_window_id`, `unsuppressed_at`, `awaiting_confirmation`, `acked_by`, `acked_at`, `silenced_until`, `escalation_step`, `next_escalation_at`, `deferred_until`, `deferred_route_id`, `message`, `details`, `resolved_at` FROM `alerts`;--> statement-breakpoint
+DROP TABLE `alerts`;--> statement-breakpoint
+ALTER TABLE `__new_alerts` RENAME TO `alerts`;--> statement-breakpoint
+CREATE UNIQUE INDEX `alerts_live_key_idx` ON `alerts` (`active_key`);--> statement-breakpoint
+CREATE INDEX `alerts_key_idx` ON `alerts` (`key`);

package/drizzle/meta/_journal.json

@@ -127,6 +127,13 @@
       "when": 1783300000000,
       "tag": "0017_alerting",
       "breakpoints": true
+    },
+    {
+      "idx": 18,
+      "version": "6",
+      "when": 1783400000000,
+      "tag": "0018_drop_alert_policy_snapshot",
+      "breakpoints": true
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/cli",
-  "version": "0.14.4",
+  "version": "0.16.1",
   "description": "Celilo — home lab orchestration CLI",
   "type": "module",
   "bin": {
@@ -59,8 +59,8 @@
     "@aws-sdk/client-s3": "^3.1024.0",
     "@celilo/capabilities": "^0.9.1",
     "@celilo/cli-display": "^0.1.9",
-    "@celilo/core": "^0.1.0",
-    "@celilo/event-bus": "^0.1.8",
+    "@celilo/core": "^0.3.0",
+    "@celilo/event-bus": "^0.1.9",
     "@clack/prompts": "^1.1.0",
     "ajv": "^8.18.0",
     "drizzle-orm": "^0.36.4",

package/src/cli/commands/alerts-list.ts

@@ -8,6 +8,8 @@
 
 import { getDb } from '../../db/client';
 import { renderAlertTable, toAlertRow } from '../../services/alerting/format';
+import { listMonitors } from '../../services/alerting/monitors';
+import { policyForAlert } from '../../services/alerting/notify-deps';
 import { loadAllLiveAlerts } from '../../services/alerting/store';
 import type { CommandResult } from '../types';
 
@@ -20,6 +22,7 @@ export async function handleAlertsList(
   const live = loadAllLiveAlerts(db);
 
   if (flags.json) {
+    const monitorsById = new Map(listMonitors(db).map((m) => [m.id, m.target]));
     return {
       success: true,
       message: JSON.stringify(
@@ -27,6 +30,13 @@ export async function handleAlertsList(
           key: alert.key,
           state: alert.state,
           severity: alert.severity,
+          // Who owns this alert and who it would page. Without these an
+          // operator told "1 live alert has no escalation policy" had no way to
+          // find out which one, from any command celilo offered (#481).
+          monitor: monitorsById.get(alert.monitorId) ?? null,
+          escalationPolicy: policyForAlert(db, alert)?.name ?? null,
+          escalationStep: alert.escalationStep,
+          nextEscalationAt: alert.nextEscalationAt,
           firstFiredAt: alert.firstFiredAt,
           lastSeenAt: alert.lastSeenAt,
           suppressed: alert.state === 'suppressed',

package/src/cli/commands/alerts-poll.ts

@@ -104,16 +104,12 @@ export async function handleAlertsPoll(
 
   responder.stop();
 
-  // Rejections are worth surfacing rather than counting silently: a run of
-  // them means someone is replying and not being heard, which looks identical
-  // to the alerting system being broken.
   const parts = [
     `${report.transportsPolled} transport(s)`,
     `${report.messagesRead} message(s)`,
     `${report.acked} acked`,
   ];
-  if (report.rejected > 0) parts.push(`${report.rejected} rejected`);
-  if (report.ignored > 0) parts.push(`${report.ignored} from unknown senders`);
+  if (report.unheard.length > 0) parts.push(`${report.unheard.length} NOT HEARD`);
   if (report.broadcast > 0) parts.push(`${report.broadcast} told someone has it`);
   if (report.answered > 0) parts.push(`${report.answered} deploy question(s) answered`);
   if (ask.asked > 0) parts.push(`${ask.asked} question(s) asked`);
@@ -121,9 +117,19 @@ export async function handleAlertsPoll(
   // indistinguishable from a deploy that is merely slow.
   if (ask.failed > 0) parts.push(`${ask.failed} question(s) COULD NOT BE DELIVERED`);
 
+  // The summary line counts; these lines say WHY. Without them "0 message(s)"
+  // means both "nobody replied" and "the reply was read and thrown away", and
+  // an operator has no way to tell which — the ambiguity that made the Signal
+  // ack path take a week to diagnose.
+  const detail = [
+    ...report.failures.map((f) => `${f.transportModuleId} COULD NOT BE READ: ${f.error}`),
+    ...report.unheard.map((u) => `not heard from ${u.senderAddress}: ${u.reason}`),
+    ...askErrors,
+  ];
+
   const message = `inbound poll: ${parts.join(', ')}`;
   return {
     success: true,
-    message: askErrors.length > 0 ? `${message}\n  ${askErrors.join('\n  ')}` : message,
+    message: detail.length > 0 ? `${message}\n  ${detail.join('\n  ')}` : message,
   };
 }

package/src/cli/commands/alerts-sweep.ts

@@ -10,19 +10,15 @@
  * report counts.
  */
 
-import { eq } from 'drizzle-orm';
 import { getDb } from '../../db/client';
-import { type Alert, escalationPolicies, modules } from '../../db/schema';
+import { modules } from '../../db/schema';
 import { runBuiltinCheckForMonitor } from '../../services/alerting/builtin-source';
 import { loadModuleCoverage } from '../../services/alerting/coverage-source';
 import { modulesInDeployWindow } from '../../services/alerting/deploy-hooks';
 import { listMonitors } from '../../services/alerting/monitors';
-import type { NotifyDeps } from '../../services/alerting/notifier';
-import { listPeople, listPolicySteps, listRoutes } from '../../services/alerting/people';
+import { buildNotifyDeps } from '../../services/alerting/notify-deps';
 import type { SuppressionTopology } from '../../services/alerting/suppression';
 import { runSweep } from '../../services/alerting/sweep-runner';
-import { mintDelivery } from '../../services/alerting/tokens';
-import { loadNotificationTransport } from '../../services/alerting/transport-loader';
 import { getModuleSystems } from '../../services/deployed-systems';
 import { runModuleHealthCheck } from '../../services/health-runner';
 import type { CommandResult } from '../types';
@@ -30,13 +26,6 @@ import type { CommandResult } from '../types';
 /** Grace window before a newly-fired alert may notify. */
 const DEFAULT_GRACE_MS = 60_000;
 
-/**
- * How long a reply token stays valid. A day is long enough that someone who
- * sees a page overnight can still act on it in the morning, and short enough
- * that a token found later is useless.
- */
-const TOKEN_TTL_MS = 24 * 60 * 60_000;
-
 /**
  * Deployment topology for suppression, read once per sweep.
  *
@@ -59,69 +48,6 @@ function loadTopology(db: ReturnType<typeof getDb>): SuppressionTopology {
   return { moduleSystems, zoneProviders: [] };
 }
 
-/**
- * Assemble everything needed to page for one alert, or null when nobody can be.
- *
- * Returning null rather than an empty policy is deliberate: "no escalation
- * policy assigned" and "policy exists but nobody is eligible" are different
- * situations, and only the second is worth an escalation decision.
- */
-function buildNotifyDeps(db: ReturnType<typeof getDb>, alert: Alert): NotifyDeps | null {
-  if (!alert.escalationPolicyId) return null;
-
-  const policy = db
-    .select()
-    .from(escalationPolicies)
-    .where(eq(escalationPolicies.id, alert.escalationPolicyId))
-    .get();
-  if (!policy) return null;
-
-  const steps = listPolicySteps(db, policy.id).map((step) => ({
-    stepIndex: step.stepIndex,
-    routeId: step.routeId,
-    delayMinutes: step.delayMinutes,
-  }));
-  if (steps.length === 0) return null;
-
-  const routeRows = listRoutes(db);
-  const people = listPeople(db);
-
-  return {
-    steps,
-    routes: new Map(
-      routeRows.map((r) => [
-        r.id,
-        { id: r.id, severityFloor: r.severityFloor, enabled: r.enabled },
-      ]),
-    ),
-    routeDetails: new Map(routeRows.map((r) => [r.id, r])),
-    quietHoursByPerson: new Map(
-      people
-        .filter((p) => p.quietHoursStart && p.quietHoursEnd)
-        .map((p) => [
-          p.id,
-          {
-            personId: p.id,
-            start: p.quietHoursStart,
-            end: p.quietHoursEnd,
-            timezone: p.timezone,
-          },
-        ]),
-    ),
-    bypassQuietHours: policy.bypassQuietHours,
-    transportFor: (route) => loadNotificationTransport(db, route.transportModuleId),
-    mintToken: (alertId, routeId) =>
-      mintDelivery(db, {
-        kind: 'alert',
-        targetId: alertId,
-        routeId,
-        now: new Date(),
-        ttlMs: TOKEN_TTL_MS,
-      }).token,
-    now: new Date(),
-  };
-}
-
 export async function handleAlertsSweep(): Promise<CommandResult> {
   const db = getDb();
   const monitorRows = listMonitors(db);
@@ -132,7 +58,7 @@ export async function handleAlertsSweep(): Promise<CommandResult> {
     monitorDeps: {
       runModuleCheck: (moduleId: string) =>
         runModuleHealthCheck(moduleId, db, { unattended: true, noInteractive: true }),
-      runBuiltinCheck: (category) => runBuiltinCheckForMonitor(category),
+      runBuiltinCheck: (category) => runBuiltinCheckForMonitor(category, db),
       loadModuleCoverage: () => loadModuleCoverage(db),
       now: () => new Date(),
       graceMs: DEFAULT_GRACE_MS,
@@ -140,7 +66,7 @@ export async function handleAlertsSweep(): Promise<CommandResult> {
     loadTopology: () => loadTopology(db),
     loadDeployWindowModules: () => modulesInDeployWindow(db),
     isSuppressible: (alert) => suppressibleByMonitor.get(alert.monitorId) ?? true,
-    notifyDepsFor: (alert) => buildNotifyDeps(db, alert),
+    notifyDepsFor: (alert) => buildNotifyDeps(db, alert, new Date()),
     now: () => new Date(),
   });
 
@@ -160,7 +86,7 @@ export async function handleAlertsSweep(): Promise<CommandResult> {
   if (report.deferred > 0) parts.push(`${report.deferred} deferred`);
   if (report.deferredDelivered > 0) parts.push(`${report.deferredDelivered} deferred-delivered`);
   if (report.failed > 0) parts.push(`${report.failed} FAILED`);
-  if (report.noPolicy > 0) parts.push(`${report.noPolicy} no-policy`);
+  if (report.noPolicy.length > 0) parts.push(`${report.noPolicy.length} no-policy`);
 
   const lines = [`alert sweep: ${parts.join(', ')}`];
 
@@ -176,10 +102,25 @@ export async function handleAlertsSweep(): Promise<CommandResult> {
   for (const failure of report.failures) {
     lines.push(`  FAILED ${failure}`);
   }
-  if (report.noPolicy > 0) {
+  // Name the alert AND the monitor that owns it. The previous wording printed a
+  // count and a template command, which is unusable: the operator cannot tell
+  // which of their live alerts is the unrouted one, so the only way to act on it
+  // is to assign a policy to every monitor and hope (#481).
+  //
+  // The wording says "no policy, or a policy with no steps" because that is
+  // genuinely all the sweep knows here — both produce a null NotifyDeps. Naming
+  // only the first would send an operator whose policy is merely empty chasing
+  // an assignment they have already made, which is the failure being fixed.
+  if (report.noPolicy.length > 0) {
     lines.push(
-      `  ${report.noPolicy} live alert(s) have no escalation policy — assign one with:\n    celilo escalation-policy assign <policy> <monitor>`,
+      `  ${report.noPolicy.length} live alert(s) reach nobody — no escalation policy, or a policy with no steps:`,
     );
+    for (const { alertKey, monitor } of report.noPolicy) {
+      lines.push(`    ${alertKey}  (monitor: ${monitor})`);
+      lines.push(`      celilo escalation-policy assign <policy> ${monitor}`);
+    }
+    lines.push('  Which policy each monitor uses:  celilo monitor list');
+    lines.push('  Whether that policy has steps:   celilo escalation-policy list');
   }
 
   return { success: true, message: lines.join('\n') };

package/src/cli/commands/backup-sweep.ts

@@ -0,0 +1,65 @@
+/**
+ * `celilo backup sweep` — one pass of the scheduled backup runner.
+ *
+ * Invoked by the event-bus dispatcher on `timer.tick.1h`, not by a human. It is
+ * a normal command so the dispatcher's existing subprocess isolation, retry,
+ * and timeout apply unchanged.
+ *
+ * Thin adapter (Rule 10.5): compose the real dependencies, call runBackupSweep,
+ * report counts.
+ */
+
+import {
+  createModuleBackup,
+  findBackupEligibleModules,
+  isBackupDue,
+} from '../../services/backup-create';
+import { pruneBackupsForModule } from '../../services/backup-retention';
+import { type BackupSweepReport, runBackupSweep } from '../../services/backup-sweep';
+import type { CommandResult } from '../types';
+
+export async function handleBackupSweep(): Promise<CommandResult> {
+  const report = await runBackupSweep({
+    listEligible: () =>
+      findBackupEligibleModules().map(({ module, manifest }) => ({ id: module.id, manifest })),
+    isDue: (moduleId, schedule) => isBackupDue(moduleId, schedule),
+    backup: (moduleId) => createModuleBackup(moduleId),
+    prune: async ({ id, manifest }) => {
+      const retention = manifest.backup?.retention;
+      if (!retention) return;
+      await pruneBackupsForModule(id, {
+        count: retention.count,
+        maxAgeDays: retention.max_age_days,
+      });
+    },
+  });
+
+  const summary = formatReport(report);
+  if (report.failures.length > 0) {
+    return { success: false, error: summary };
+  }
+  return { success: true, message: summary };
+}
+
+/**
+ * A quiet sweep stays quiet: counts that are zero are omitted. But a failure or
+ * a lock-skip is always named, never aggregated away — "0 backed up" and
+ * nothing else is indistinguishable from "nothing was due", which is exactly
+ * how a backup runner that has silently stopped working looks.
+ */
+function formatReport(report: BackupSweepReport): string {
+  const parts = [`${report.backedUp.length} backed up`];
+  if (report.skippedNotDue.length > 0) parts.push(`${report.skippedNotDue.length} not due`);
+  if (report.skippedManual.length > 0) parts.push(`${report.skippedManual.length} manual`);
+  if (report.skippedLocked.length > 0) parts.push(`${report.skippedLocked.length} locked`);
+  if (report.failures.length > 0) parts.push(`${report.failures.length} FAILED`);
+
+  const lines = [`backup sweep: ${parts.join(', ')}`];
+  for (const moduleId of report.skippedLocked) {
+    lines.push(`  skipped ${moduleId}: another operation is in flight — retrying next tick`);
+  }
+  for (const failure of report.failures) {
+    lines.push(`  FAILED ${failure.moduleId}: ${failure.error}`);
+  }
+  return lines.join('\n');
+}

package/src/cli/commands/module-config.test.ts

@@ -11,7 +11,13 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { type DbClient, getDb } from '../../db/client';
 import { modules } from '../../db/schema';
-import { handleModuleConfigSet } from './module-config';
+import { resolveDeployPosture } from '../../services/deploy-posture';
+import {
+  FRAMEWORK_CONFIG_KEYS,
+  handleModuleConfigSet,
+  validateFrameworkConfigValue,
+} from './module-config';
+import { pickUpgradePolicy } from './module-upgrade';
 
 describe('handleModuleConfigSet — infra-key contract (ISS-0069)', () => {
   let tempDir: string;
@@ -75,4 +81,74 @@ describe('handleModuleConfigSet — infra-key contract (ISS-0069)', () => {
       expect(result.error).not.toContain('vmid'); // infra keys filtered from the hint
     }
   });
+
+  // #515: these describe how celilo TREATS a module, so they must not depend on
+  // the module having declared them. `testmod` declares neither — which is the
+  // bug exactly: `upgrade_policy` was declared by NO module, so `always-safe`
+  // (the only control over unattended-upgrade risk) could never be set.
+  test('accepts upgrade_policy on a module that does not declare it', async () => {
+    const result = await handleModuleConfigSet(['testmod', 'upgrade_policy', 'always-safe']);
+    expect(result.success).toBe(true);
+  });
+
+  test('accepts auto_upgrade on a module that does not declare it', async () => {
+    const result = await handleModuleConfigSet(['testmod', 'auto_upgrade', 'true']);
+    expect(result.success).toBe(true);
+  });
+
+  test('rejects a mistyped policy instead of silently falling back to by-semver', async () => {
+    // `pickUpgradePolicy` fails OPEN: an unrecognized value becomes `by-semver`,
+    // which on a patch means fast posture and NO backup. Accepting this would
+    // leave the operator believing the safe floor was armed.
+    const result = await handleModuleConfigSet(['testmod', 'upgrade_policy', 'alwayssafe']);
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error).toContain('always-safe');
+    }
+  });
+
+  test('rejects a non-boolean auto_upgrade', async () => {
+    const result = await handleModuleConfigSet(['testmod', 'auto_upgrade', 'yes']);
+    expect(result.success).toBe(false);
+  });
+
+  test('the valid-keys hint advertises the celilo-managed keys', async () => {
+    const result = await handleModuleConfigSet(['testmod', 'nope', 'x']);
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error).toContain('upgrade_policy');
+      expect(result.error).toContain('auto_upgrade');
+    }
+  });
+});
+
+describe('validateFrameworkConfigValue (pure)', () => {
+  test('passes through non-framework keys untouched', () => {
+    expect(validateFrameworkConfigValue('app_port', 'anything')).toBeNull();
+  });
+
+  test('accepts every documented value', () => {
+    for (const [key, values] of Object.entries(FRAMEWORK_CONFIG_KEYS)) {
+      for (const v of values) expect(validateFrameworkConfigValue(key, v)).toBeNull();
+    }
+  });
+
+  test('rejects an unlisted value', () => {
+    expect(validateFrameworkConfigValue('upgrade_policy', 'always_safe')).toContain('Allowed');
+  });
+});
+
+// The point of the whole control: with always-safe set, a PATCH upgrade — which
+// by default is fast posture and skips the pre-deploy backup — becomes safe.
+// #515 made this unreachable, so this asserts the chain end to end.
+describe('always-safe actually changes posture on a patch (#515)', () => {
+  test('patch is fast by default, safe once always-safe is chosen', () => {
+    const patch = { installed: '1.0.3', next: '1.0.4' };
+    expect(
+      resolveDeployPosture({ ...patch, modulePolicy: pickUpgradePolicy(undefined) }).posture,
+    ).toBe('fast');
+    expect(
+      resolveDeployPosture({ ...patch, modulePolicy: pickUpgradePolicy('always-safe') }).posture,
+    ).toBe('safe');
+  });
 });

package/src/cli/commands/module-config.ts

@@ -14,6 +14,42 @@ import {
 import { getArg, validateRequiredArgs } from '../parser';
 import type { CommandResult } from '../types';
 
+/**
+ * Operator keys that EVERY module accepts, whether or not its manifest declares
+ * them, with their permitted values.
+ *
+ * These describe how celilo TREATS a module (its CD policy), not how the module
+ * configures itself, so gating them on `variables.owns` had it backwards: it
+ * required each module author to opt into being manageable. The failure was
+ * silent — `upgrade_policy` was declared by no module at all, so
+ * `pickUpgradePolicy()` could only ever read `undefined` and fall back to
+ * `by-semver`, leaving `always-safe` (the ONLY control over unattended-upgrade
+ * risk) permanently unreachable. `auto_upgrade` worked only because lunacycle
+ * happened to declare it. See #515.
+ *
+ * Values are checked at SET time rather than coerced at read time. Both readers
+ * fail OPEN on an unrecognized value — `pickUpgradePolicy()` returns
+ * `by-semver`, which for a patch means fast posture and NO backup. So a typo
+ * like `alwayssafe` would leave the operator believing they had armed the safe
+ * floor while nothing changed. A safety control that fails open on a typo is
+ * worse than no control.
+ */
+export const FRAMEWORK_CONFIG_KEYS: Record<string, readonly string[]> = {
+  auto_upgrade: ['true', 'false'],
+  upgrade_policy: ['by-semver', 'always-safe', 'always-fast'],
+};
+
+/**
+ * PURE (Rule 10.1): validate a framework key's value. Returns an error message,
+ * or null when the key is not a framework key or the value is permitted.
+ */
+export function validateFrameworkConfigValue(key: string, value: string): string | null {
+  const allowed = FRAMEWORK_CONFIG_KEYS[key];
+  if (!allowed) return null;
+  if (allowed.includes(value)) return null;
+  return `Invalid value '${value}' for '${key}'.\n\nAllowed: ${allowed.join(', ')}\n\nRejected rather than coerced: an unrecognized value silently falls back to the PERMISSIVE default (upgrade_policy → by-semver, which skips the pre-deploy backup on a patch), so a typo would look like it took effect.`;
+}
+
 /**
  * Handle module config set command
  *
@@ -54,6 +90,11 @@ export async function handleModuleConfigSet(args: string[]): Promise<CommandResu
     };
   }
 
+  // Framework keys bypass the manifest check entirely — see FRAMEWORK_CONFIG_KEYS.
+  const frameworkError = validateFrameworkConfigValue(key, value);
+  if (frameworkError) return { success: false, error: frameworkError };
+  const isFrameworkKey = key in FRAMEWORK_CONFIG_KEYS;
+
   // Validate key against manifest
   const manifest = module.manifestData as Record<string, unknown>;
   const variables = manifest.variables as
@@ -63,14 +104,15 @@ export async function handleModuleConfigSet(args: string[]): Promise<CommandResu
 
   // Check if key is declared in manifest
   const declaredVar = declaredVars.find((v) => v.name === key);
-  if (!declaredVar) {
+  if (!declaredVar && !isFrameworkKey) {
     const settableKeys = declaredVars
       .filter((v) => v.source !== 'infrastructure')
       .map((v) => v.name)
       .join(', ');
+    const frameworkKeys = Object.keys(FRAMEWORK_CONFIG_KEYS).join(', ');
     return {
       success: false,
-      error: `Invalid config key '${key}' for module ${moduleId}.\n\nValid keys: ${settableKeys || '(none declared)'}`,
+      error: `Invalid config key '${key}' for module ${moduleId}.\n\nValid keys: ${settableKeys || '(none declared)'}\nCelilo-managed keys (any module): ${frameworkKeys}`,
     };
   }
 
@@ -79,7 +121,7 @@ export async function handleModuleConfigSet(args: string[]): Promise<CommandResu
   // variables (vmid, target_ip, target_node, gateway, vlan, lxc_template) are
   // derived by the deploy (IPAM allocates vmid/IP; the container service supplies
   // node/template/gateway/vlan), so a value set here would be ignored.
-  if (declaredVar.source === 'infrastructure') {
+  if (declaredVar?.source === 'infrastructure') {
     return {
       success: false,
       error: `'${key}' is infrastructure-managed by celilo (source: infrastructure) — not operator-settable.\nThe deploy derives it automatically, so a value set here would be silently ignored.\n  • node placement: set the service default for NEW deploys (celilo service reconfigure); move an existing container with 'celilo proxmox migrate' (ISS-0062).\n  • vmid / IP: auto-allocated by IPAM.`,