@celilo/cli 0.19.0 → 0.21.0

package/CELILO_CORE_MODULES.md

@@ -25,12 +25,12 @@ Each entry: `module id` — what it is — **provides** / **requires** capabilit
 - **iptables** — iptables firewall + NAT; cross-VLAN port exposure with recursive upstream delegation. Converge model: `exposeService` registers into the shared-core port-forward registry, then renders the complete ruleset and applies it atomically via `iptables-restore` (default-DROP FORWARD + coarse zone-tier matrix; SSH-free). **provides:** `firewall`.
 - **knot-unbound-internal** — split-horizon internal DNS via Knot (authoritative) + Unbound (recursive); lightweight, plain apt, no .NET. **provides:** `dns_internal`. Ships a base-module-aspect (`modules/knot-unbound-internal/base-module-aspect/`).
 - **technitium** — internal split-horizon DNS resolver + authoritative server (web UI + HTTP API); heavier alternative to knot-unbound. **provides:** `dns_internal`. Ships a base-module-aspect (`modules/technitium/base-module-aspect/`).
-- **namecheap** — public DNS A-record management via Namecheap Dynamic DNS API (HTTP, no browser automation). **provides:** `dns_registrar`.
+- **namecheap** — public DNS A-record management via Namecheap Dynamic DNS API (HTTP, no browser automation). A caller supplies a NAME and nothing else: the address is the source IP of celilo's own update, re-derived on every assert. Registering `<domain>` also claims `www.<domain>` and vice versa (best effort, reported back as `outputs.companion_fqdn` so the framework's `public_dns` check watches it — Namecheap answers `ErrCount 0` for `www` updates it does not apply). DDNS passwords are keyed by the **registrable domain**, never the FQDN. **provides:** `dns_registrar`.
 - **wireguard** — owns the admin WireGuard tunnel on the firewall host: interface, listen port, peers (as records), and client subnet are module config rather than hand-maintained state. Exposes the listen port and **registers the client subnet as a trusted source**, so VPN reach into the managed zones is in the firewall registry and every converge re-emits it. Records `network.control-plane-vpn.subnet`, which the internal resolver's split-horizon view also consumes. Adopts a running tunnel in place (existing key and peers retained; `wg syncconf`, never `wg-quick down`) because that tunnel is the operator's recovery path. **requires:** `firewall` (and the provider must support trusted-source registration — `iptables` does, `greenwave` does not).
 
 ## Public edge (ingress / identity)
 
-- **caddy** — reverse proxy with automatic HTTPS (HTTP-01 ACME); the standard HTTPS ingress. **provides:** `public_web`. **requires:** `dns_registrar`, `firewall`.
+- **caddy** — reverse proxy with automatic HTTPS (HTTP-01 ACME); the standard HTTPS ingress. Emits a 301 redirect block for each served name's `www`/apex companion (kept out of the served-hostname set, so a companion never blocks the ACME wait). Its `health_check`'s DNS item is `internal_dns_resolution` — it digs from the management host behind the split-horizon resolver and is evidence about the in-fleet view only; public reachability is the framework's `public_dns` check. **provides:** `public_web`. **requires:** `dns_registrar`, `firewall`.
 - **generic-cpanel-hosting-provider** — publishes static sites into a subfolder of a domain on a cPanel/SSH web host celilo does **not** govern (the host owns the domain, DNS, TLS and web server). Systemless like **namecheap** — no `requires.system`, no zone, no IPAM; it holds credentials for an external party. One provider serves many accounts, resolved by hostname; onboarding takes the account password once, `ssh-copy-id`s celilo's key, then discards it. **provides:** `external_web`.
 - **authentik** — Authentik identity provider with OIDC (Docker Compose: server, worker, Postgres, Redis). **provides:** `idp`. **requires:** `public_web`, `dns_registrar`, `firewall`.
 

package/CELILO_SUBSYSTEMS.md

@@ -38,6 +38,7 @@ see `openspec/specs/`. Companion doc: [CELILO_CORE_MODULES.md](./CELILO_CORE_MOD
 - **Canonical capability registry** — `packages/capabilities/src/capability-registry.ts` — `KNOWN_CAPABILITY_NAMES` (the authoritative list), `CapabilityRegistry` type. Public surface: `packages/capabilities/src/index.ts`.
 - **Loader (wires provider factories into hook contexts)** — `apps/celilo/src/hooks/capability-loader.ts` — `loadCapabilityFunctions`, `resolveFirewallNatIp`.
 - **Ledger wrappers (stateful capabilities)** — `apps/celilo/src/services/dns-registrations.ts` (`withDnsRegistrationLedger`), `apps/celilo/src/services/dns-internal-records.ts` (`withDnsInternalLedger`).
+- **Public DNS ledger (`dns_registrations` + `dns_registration_consumers`)** — `apps/celilo/src/services/dns-registrations.ts` — records WHICH MODULE ASKED FOR WHICH NAME, and deliberately **no address**: the published value is source-detected on every assert and observable on demand from public DNS, and a stored copy is one careless read away from becoming an instruction again (celilo#626 — the 15-minute `refresh_registrations` replayed addresses written by an older celilo and took five public names dark for nine days while every in-fleet check stayed green). Consumers are a SET, not a column: the FK cascade on a single `consumer_module_id` decided when a LIVE record was forgotten, so a row now survives until its LAST consumer is removed (`openspec/changes/public-dns-reachability/design.md` D5). Orphaned rows are pruned on read (`pruneOrphanedRegistrations`) rather than by trigger — SQLite fires delete triggers for FK-cascaded deletes only with `recursive_triggers` on. `companion: true` marks a name celilo claimed on a module's behalf (`www.<domain>` ↔ `<domain>`) rather than one a module asked for; the provider reports it as `outputs.companion_fqdn` whether or not the claim reported success, because a provider's success response is not evidence of publication. Operator surface: `celilo dns registrations`.
 
 ### Known capabilities (impl → provider module)
 
@@ -45,7 +46,7 @@ see `openspec/specs/`. Companion doc: [CELILO_CORE_MODULES.md](./CELILO_CORE_MOD
 |---|---|---|
 | `public_web` | `packages/capabilities/src/public-web.ts` (`createPublicWeb`). **Route lifecycle** is framework-owned at both ends, not per-module: removing a consumer runs `apps/celilo/src/services/web-route-cleanup.ts` (delete rows → reclaim `/srv/www/<slug>` → emit `routes_changed`) whether or not the module has an `on_uninstall`; deploying a provider runs `apps/celilo/src/services/public-web-republish.ts` (re-run every static consumer's `on_install`) so a provider rebuild refills the web roots it destroyed. | caddy |
 | `idp` | `packages/capabilities/src/idp.ts` | authentik |
-| `dns_registrar` | `packages/capabilities/src/dns-registrar.ts` (`registerHost`) | namecheap |
+| `dns_registrar` | `packages/capabilities/src/dns-registrar.ts` (`registerHost({ fqdn })` — **there is no way to supply an address**; the provider re-derives it from its own update's source IP on every assert) | namecheap |
 | `external_web` | `packages/capabilities/src/external-web.ts` (`publishStaticSite`). **OFF-FLEET static publishing** — the counterpart to `public_web`. See the in-fleet vs off-fleet note below. | generic-cpanel-hosting-provider |
 | `firewall` | `packages/capabilities/src/firewall.ts` (`exposeService`, `unexposeService`, `listExposedServices`). **Converge model**: register into the shared-core port-forward registry → render the complete ruleset → apply atomically (see the firewall converge note below). | greenwave, iptables |
 | `dns_internal` | `packages/capabilities/src/dns-internal.ts` | knot-unbound-internal, technitium |
@@ -198,8 +199,9 @@ is currently wrong, and routes carry the message to a person's phone. Design:
 - **Alert identity** — `apps/celilo/src/services/alerting/keys.ts` — the key grammar (`module:<id>[/check:<name>]`, `builtin:<check>[/<kind>:<target>]`) that makes "the same problem" the same alert across runs. `moduleAlertKey`, `moduleCheckAlertKey`, `builtinAlertKey`, `parseAlertKey`.
 - **Reconciliation** — `apps/celilo/src/services/alerting/reconcile.ts` (`reconcile`) — a successful run's failing-key set is authoritative and resolution is by SET DIFFERENCE (absent ⇒ resolved). A run whose outcome is `error` resolves NOTHING and fires a module-level alert instead: the false-all-clear guard.
 - **Monitor execution** — `apps/celilo/src/services/alerting/run-monitor.ts` (`runOneMonitor`) + `sweep.ts` (`selectDueMonitors`) + `builtin-monitors.ts` / `health-coverage.ts` (the built-in checks and the "module with no health check" coverage check).
-- **Scheduled audit categories (`builtin_check` monitors)** — `apps/celilo/src/services/alerting/builtin-source.ts` — `SCHEDULABLE_BUILTIN_CHECKS` is the list of `celilo system audit` categories cheap enough to run every sweep: `machines_reachable`, `backups`, `disk_space`, and `abandoned_operations` (`apps/celilo/src/services/audit/abandoned-operations.ts` — ≥3 abandonments of the same (module, operation) in 7d, the fingerprint of an operation being killed mid-flight). Everything else in the audit needs the whole world injected (proxmox, terraform, registry) and is not schedulable. Enable one with `celilo monitor add backups --interval 1h`. Targets are tab-completable — `completion.ts` reads `SCHEDULABLE_BUILTIN_CHECKS` directly rather than a hand-copied list, so a newly-schedulable check is completable immediately.
+- **Scheduled audit categories (`builtin_check` monitors)** — `apps/celilo/src/services/alerting/builtin-source.ts` — `SCHEDULABLE_BUILTIN_CHECKS` is the list of `celilo system audit` categories cheap enough to run every sweep: `machines_reachable`, `backups`, `disk_space`, `abandoned_operations`, and `public_dns` (`apps/celilo/src/services/audit/abandoned-operations.ts` — ≥3 abandonments of the same (module, operation) in 7d, the fingerprint of an operation being killed mid-flight). Everything else in the audit needs the whole world injected (proxmox, terraform, registry) and is not schedulable. Enable one with `celilo monitor add backups --interval 1h`. Targets are tab-completable — `completion.ts` reads `SCHEDULABLE_BUILTIN_CHECKS` directly rather than a hand-copied list, so a newly-schedulable check is completable immediately.
 - **Disk-space check** — `apps/celilo/src/services/audit/disk-space.ts` (`auditDiskSpace`, pure over measurements) + `apps/celilo/src/services/disk-probe.ts` (`probeDiskUsage`). Thresholds: `drift` at 85%, `blocked` at 95% — early enough to act on, since a check that fires at exhaustion reports an outage rather than preventing one. ⚠️ **The local management box is MEASURED, not exempted.** `probeMachines()` deliberately reports the local box reachable without probing it (celilo has no SSH key for itself, and the question is meaningless there); copying that shortcut into a disk check would skip the host most likely to fill — the one that stages backups, caches modules and writes the logs, and the one that DID fill. Local reads `statfs`; remote runs `df -P /` over the same bounded SSH. `percentUsed` matches `df`'s capacity semantics (excludes root-reserved blocks) so an alert and an operator's own `df` agree. An unmeasurable host yields a `todo` finding — recorded, never paged, because `machines_reachable` is already paging for that host. Findings are subjected on the **hostname**, not the machine UUID, because suppression resolves a machine's ancestor key from the hostname (see #596, where `machines_reachable` gets this wrong and its alerts therefore never suppress anything). The `backups` roster comes from `apps/celilo/src/services/audit/backup-source.ts` (`loadBackupAuditInfo`), shared with `celilo system audit` so both judge the same fleet.
+- **Public-DNS reachability check (the only check with an OFF-FLEET vantage)** — `apps/celilo/src/services/audit/public-dns.ts` (`auditPublicDns`, pure over an injected probe and the previous run's counters) + `apps/celilo/src/services/public-dns-probe.ts` (the probe) + `audit/public-dns-source.ts` (ledger names + the `public_dns_evidence` counters). Every other check in celilo looks from INSIDE, behind a split-horizon resolver that deliberately answers with an in-zone address — correct for its purpose, and why all of them reported healthy for the nine days of celilo#626. This one resolves every `dns_registrations` FQDN through an **off-fleet resolver** (`public_dns.resolver`, default `1.1.1.1`) and compares it against the address the fleet appears to come from per an independent **echo service** (`public_dns.echo_url`, default `https://api.ipify.org`). Three properties are load-bearing: `assertOffFleetResolver` REFUSES a resolver matching `dns.primary`/`dns.fallback` (a check that quietly used the fleet's resolver would pass forever — the original bug one layer up); the expectation never comes from the registrar's own response (self-agreement, and Namecheap returns `ErrCount 0` for `www` updates it does not apply); and a divergence is a finding only once it OUTLIVES the record's own TTL, measured from the last assert, or it would page on every ISP re-lease. Missing evidence is counted rather than read as success — one undetermined run is silent, N consecutive ones are their own finding (`public_dns_evidence`), which is the hole celilo-website's isitup.org probe demonstrated live. Codes: `public_dns_stale`, `public_dns_missing`, `public_dns_companion_unclaimed`, `public_dns_unverifiable`. Spec: `openspec/specs/public-dns-reachability/spec.md`.
 - **The sweep** — `apps/celilo/src/services/alerting/sweep-runner.ts` (`runSweep`) — the ordered pass that makes alerting run by itself: run due monitors → promote past-grace alerts → re-evaluate suppression → flush quiet-hours deferrals → notify. Driven by `celilo alerts sweep` on `timer.tick.5m`. Never throws for one bad monitor.
 - **Suppression (topology-derived, never configured)** — `apps/celilo/src/services/alerting/suppression.ts` — `ancestorKeysFor`/`findSuppressor`/`machineAlertKey`. A firing machine explains its modules' failures; a firing capability provider explains its zone's consumers. Derived from `module_systems`, so it cannot drift from reality. Deploy windows: `deploy-hooks.ts` (`openDeployWindow`/`closeDeployWindows` — closed by module, so a crashed deploy self-heals).
 - **Escalation & quiet hours** — `escalation.ts` (`decideEscalation`, every reason to stay silent enumerated) + `quiet-hours.ts` (`isWithinQuietHours`, Intl-based and DST-safe). Quiet hours defer the MESSAGE while the escalation clock keeps running.

package/drizzle/0020_dns_registrations_drop_ip.sql

@@ -0,0 +1,25 @@
+-- Drop `dns_registrations.ip`.
+--
+-- THIS MIGRATION IS THE SWEEP, not the tidying after one.
+--
+-- A row's stored `ip` was replayed by `refresh_registrations` every 15
+-- minutes as the address to publish. Rows written before #464/#466 carry the
+-- external address the caller passed at the time, so once the ISP re-leased,
+-- the refresh re-published a dead address on a timer, indefinitely, reporting
+-- success every tick. celilo#626: five public names dark for nine days,
+-- including apt.celilo.computer and the module registry, while every in-fleet
+-- check stayed green because the split-horizon resolver answers with a
+-- reachable internal address.
+--
+-- Fixing only the write path leaves every armed legacy row armed until
+-- somebody happens to redeploy the module that owns it. Dropping the column
+-- disarms all of them at once, and makes the whole class unrepresentable
+-- rather than merely unlikely — there is no longer a value to go stale.
+--
+-- The address is not migrated anywhere. It is observable on demand from
+-- public DNS (that is what the new `public_dns` check does), and a stored
+-- copy is one careless read away from becoming an instruction again.
+--
+-- Plain DROP COLUMN: `ip` is in no index and no FOREIGN KEY clause.
+
+ALTER TABLE `dns_registrations` DROP COLUMN `ip`;

package/drizzle/0021_dns_registration_consumers.sql

@@ -0,0 +1,63 @@
+-- Replace `dns_registrations.consumer_module_id` with a consumer SET.
+--
+-- The column was overwritten by every re-assert, and it is not a label: the
+-- FK cascade on it decides when a LIVE record is forgotten. Recovering the
+-- fleet with `run-hook caddy on_install` re-attributed auth.lunacycle.net,
+-- buildyourowninternet.dev, dj-incarnadine.org and peterbanka.org to caddy,
+-- so removing caddy would have cascade-deleted registrations that authentik
+-- and the site modules still serve. Keep-first has the mirror failure: if
+-- module A introduces a name and B later needs it too, removing A drops the
+-- row out from under B. Both encode a single owner where there may be several.
+--
+-- With a set, the row survives until its LAST consumer is removed — which is
+-- also the only basis on which "can this record be deleted at the registrar?"
+-- could ever be answered. See design.md D5.
+--
+-- Existing rows are seeded from the single value they carry. The pre-recovery
+-- attribution for the four names above is NOT recoverable — it was overwritten
+-- in place before this migration existed. Seeding preserves what the table
+-- actually holds rather than pretending to reconstruct what it used to.
+--
+-- Order matters: `dns_registrations` is rebuilt (SQLite refuses to drop a
+-- column named in a FOREIGN KEY clause) and `foreign_keys` is ON, so a child
+-- table created before the rebuild would be cascade-emptied by the DROP.
+-- The seed is parked in an FK-free scratch table across it.
+
+CREATE TABLE `__dns_consumer_seed` (
+	`registration_id` integer NOT NULL,
+	`module_id` text NOT NULL,
+	`first_seen_at` integer NOT NULL
+);
+--> statement-breakpoint
+INSERT INTO `__dns_consumer_seed` SELECT `id`, `consumer_module_id`, `registered_at` FROM `dns_registrations`;
+--> statement-breakpoint
+CREATE TABLE `__new_dns_registrations` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`provider_module_id` text NOT NULL,
+	`fqdn` text NOT NULL,
+	`registered_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`refreshed_at` integer,
+	FOREIGN KEY (`provider_module_id`) REFERENCES `modules`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+INSERT INTO `__new_dns_registrations` SELECT `id`, `provider_module_id`, `fqdn`, `registered_at`, `refreshed_at` FROM `dns_registrations`;--> statement-breakpoint
+DROP TABLE `dns_registrations`;--> statement-breakpoint
+ALTER TABLE `__new_dns_registrations` RENAME TO `dns_registrations`;--> statement-breakpoint
+CREATE UNIQUE INDEX `dns_registrations_provider_fqdn_idx` ON `dns_registrations` (`provider_module_id`,`fqdn`);
+--> statement-breakpoint
+CREATE TABLE `dns_registration_consumers` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`registration_id` integer NOT NULL,
+	`module_id` text NOT NULL,
+	`first_seen_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`registration_id`) REFERENCES `dns_registrations`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`module_id`) REFERENCES `modules`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `dns_registration_consumers_unique_idx` ON `dns_registration_consumers` (`registration_id`,`module_id`);
+--> statement-breakpoint
+INSERT INTO `dns_registration_consumers` (`registration_id`, `module_id`, `first_seen_at`)
+	SELECT `registration_id`, `module_id`, `first_seen_at` FROM `__dns_consumer_seed`
+	WHERE `module_id` IN (SELECT `id` FROM `modules`);
+--> statement-breakpoint
+DROP TABLE `__dns_consumer_seed`;

package/drizzle/0022_dns_registrations_companion.sql

@@ -0,0 +1,15 @@
+-- `dns_registrations.companion` — the name celilo claimed on a module's
+-- behalf rather than one a module asked for.
+--
+-- `www.<domain>` and `<domain>` are one name pair: declaring either claims the
+-- other. The declared name fails the deploy if it cannot be published; the
+-- companion is best effort, because failing a deploy over a name nobody
+-- requested is punitive. Best effort must not mean silent, though — a working
+-- www beside a dead apex is celilo#626 in miniature — so companion rows are
+-- watched by the `public_dns` check like any other, and carry the manual
+-- registrar remediation when they diverge.
+--
+-- Existing rows are all declared names: nothing claimed a companion before
+-- this migration.
+
+ALTER TABLE `dns_registrations` ADD COLUMN `companion` integer DEFAULT false NOT NULL;

package/drizzle/0023_public_dns_evidence.sql

@@ -0,0 +1,19 @@
+-- `public_dns_evidence` — consecutive runs the public-reachability check could
+-- obtain no evidence about a subject.
+--
+-- A probe that could not run is not a pass. celilo-website's external check
+-- already got this half right and half wrong: it records an unreachable prober
+-- as *undetermined* rather than a failure (correct — a prober blip once paged
+-- three modules at once) but then emits no check item at all, so a real outage
+-- produced complete silence for nine days.
+--
+-- Counting the absences closes that without reintroducing the noise: one
+-- undetermined run is still silent, N consecutive ones are their own finding,
+-- distinguishable from "the site is unreachable". A subject that answers has
+-- its row dropped, which is what makes the count consecutive.
+
+CREATE TABLE `public_dns_evidence` (
+	`subject` text PRIMARY KEY NOT NULL,
+	`undetermined_runs` integer DEFAULT 0 NOT NULL,
+	`last_checked_at` integer DEFAULT (unixepoch()) NOT NULL
+);

package/drizzle/meta/_journal.json

@@ -141,6 +141,34 @@
       "when": 1783500000000,
       "tag": "0019_backup_pid",
       "breakpoints": true
+    },
+    {
+      "idx": 20,
+      "version": "6",
+      "when": 1783600000000,
+      "tag": "0020_dns_registrations_drop_ip",
+      "breakpoints": true
+    },
+    {
+      "idx": 21,
+      "version": "6",
+      "when": 1783700000000,
+      "tag": "0021_dns_registration_consumers",
+      "breakpoints": true
+    },
+    {
+      "idx": 22,
+      "version": "6",
+      "when": 1783800000000,
+      "tag": "0022_dns_registrations_companion",
+      "breakpoints": true
+    },
+    {
+      "idx": 23,
+      "version": "6",
+      "when": 1783900000000,
+      "tag": "0023_public_dns_evidence",
+      "breakpoints": true
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/cli",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Celilo — home lab orchestration CLI",
   "type": "module",
   "bin": {
@@ -57,10 +57,10 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1024.0",
-    "@celilo/capabilities": "^0.10.0",
+    "@celilo/capabilities": "^1.0.0",
     "@celilo/cli-display": "^0.1.10",
-    "@celilo/core": "^0.4.0",
-    "@celilo/event-bus": "^0.2.0",
+    "@celilo/core": "^0.5.0",
+    "@celilo/event-bus": "^0.3.0",
     "@clack/prompts": "^1.1.0",
     "ajv": "^8.18.0",
     "drizzle-orm": "^0.36.4",

package/schemas/system_config.json

@@ -13,7 +13,7 @@
     "network.dmz.subnet": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
-      "description": "DMZ subnet CIDR (not defaulted — appears only when a firewall module provides this zone; see openspec/specs/progressive-zone-disclosure/spec.md)"
+      "description": "DMZ subnet CIDR (not defaulted \u2014 appears only when a firewall module provides this zone; see openspec/specs/progressive-zone-disclosure/spec.md)"
     },
     "network.dmz.gateway": {
       "type": "string",
@@ -29,7 +29,7 @@
     "network.app.subnet": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
-      "description": "App subnet CIDR (not defaulted — appears only when a firewall module provides this zone)"
+      "description": "App subnet CIDR (not defaulted \u2014 appears only when a firewall module provides this zone)"
     },
     "network.app.gateway": {
       "type": "string",
@@ -45,7 +45,7 @@
     "network.secure.subnet": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
-      "description": "Secure subnet CIDR (not defaulted — appears only when a firewall module provides this zone)"
+      "description": "Secure subnet CIDR (not defaulted \u2014 appears only when a firewall module provides this zone)"
     },
     "network.secure.gateway": {
       "type": "string",
@@ -61,12 +61,12 @@
     "network.internal.subnet": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
-      "description": "Internal subnet CIDR (home devices, trusted; not defaulted — discovered from the management box's primary interface at celilo-mgmt install)"
+      "description": "Internal subnet CIDR (home devices, trusted; not defaulted \u2014 discovered from the management box's primary interface at celilo-mgmt install)"
     },
     "network.internal.gateway": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
-      "description": "Internal gateway IP address (not defaulted — discovered from the default route)"
+      "description": "Internal gateway IP address (not defaulted \u2014 discovered from the default route)"
     },
     "network.internal.vlan": {
       "type": "integer",
@@ -77,17 +77,17 @@
     "network.control-plane-vpn.subnet": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
-      "description": "WireGuard VPN client subnet CIDR (remote-access tunnel; consumed by technitium's split-horizon → in-zone caddy view, #275, and by the firewall's trusted sources once the wireguard module registers it)"
+      "description": "WireGuard VPN client subnet CIDR (remote-access tunnel; consumed by technitium's split-horizon \u2192 in-zone caddy view, #275, and by the firewall's trusted sources once the wireguard module registers it)"
     },
     "network.secure-mgmt.subnet": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
-      "description": "Control-plane subnet CIDR — the network celilo-mgr itself occupies when it does not sit on the internal LAN (not defaulted — discovered at celilo-mgmt install, or recorded by firewall onboarding). Derives the firewall's trusted sources and the internal resolver's split-horizon view for celilo's own traffic."
+      "description": "Control-plane subnet CIDR \u2014 the network celilo-mgr itself occupies when it does not sit on the internal LAN (not defaulted \u2014 discovered at celilo-mgmt install, or recorded by firewall onboarding). Derives the firewall's trusted sources and the internal resolver's split-horizon view for celilo's own traffic."
     },
     "network.secure-mgmt.gateway": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
-      "description": "Control-plane gateway IP address (not defaulted — discovered from the default route)"
+      "description": "Control-plane gateway IP address (not defaulted \u2014 discovered from the default route)"
     },
     "network.secure-mgmt.vlan": {
       "type": "integer",
@@ -97,20 +97,31 @@
     },
     "firewall.trusted_subnets": {
       "type": "string",
-      "description": "Operator-declared trusted source subnets (comma-separated CIDRs) permitted to reach every managed zone. ADDITIVE to the control-plane subnet celilo derives and to the sources modules register — it cannot drop control-plane trust, which would block the SSH every hook and converge runs over."
+      "description": "Operator-declared trusted source subnets (comma-separated CIDRs) permitted to reach every managed zone. ADDITIVE to the control-plane subnet celilo derives and to the sources modules register \u2014 it cannot drop control-plane trust, which would block the SSH every hook and converge runs over."
     },
     "dns.primary": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
-      "description": "Primary DNS server IP address (not defaulted — discovered from the host resolver at celilo-mgmt install; repointed at a dns_internal provider when one deploys)"
+      "description": "Primary DNS server IP address (not defaulted \u2014 discovered from the host resolver at celilo-mgmt install; repointed at a dns_internal provider when one deploys)"
     },
     "dns.fallback": {
       "type": "string",
-      "description": "Fallback DNS servers (comma-separated IP addresses; not defaulted — discovered, with 1.1.1.1 as last resort)"
+      "description": "Fallback DNS servers (comma-separated IP addresses; not defaulted \u2014 discovered, with 1.1.1.1 as last resort)"
     },
     "ssh.public_key": {
       "type": "string",
       "description": "SSH public key for container access"
+    },
+    "public_dns.resolver": {
+      "type": "string",
+      "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
+      "default": "1.1.1.1",
+      "description": "Resolver the public_dns check asks what the INTERNET resolves for the fleet's names. Must not be a resolver the fleet itself uses \u2014 the fleet resolver runs split-horizon and would make the check pass whatever the public internet sees (celilo#626). celilo refuses a value matching dns.primary / dns.fallback."
+    },
+    "public_dns.echo_url": {
+      "type": "string",
+      "default": "https://api.ipify.org",
+      "description": "Echo service reporting the address the fleet appears to come from \u2014 the expectation public DNS is compared against. Deliberately not the registrar's own response, which is self-agreement (and which Namecheap returns successfully for updates it does not apply)."
     }
   },
   "additionalProperties": true

package/src/api/remote-client.test.ts

@@ -72,7 +72,7 @@ test('renders a forwarded interview and sends the answer back', async () => {
   push({ type: 'interview', id: 'q1', kind: 'text', message: 'Hostname?' });
 
   const seen: Array<{ id: string }> = [];
-  const code = await runRemoteClient('ignored', ['module', 'deploy', 'site'], {
+  const outcome = await runRemoteClient('ignored', ['module', 'deploy', 'site'], {
     openTransport: () => transport,
     out: { write() {} },
     renderInterview: async (iv) => {
@@ -81,7 +81,7 @@ test('renders a forwarded interview and sends the answer back', async () => {
     },
   });
 
-  expect(code).toBe(0);
+  expect(outcome).toEqual({ status: 'result', exitCode: 0 });
   expect(seen).toHaveLength(1);
   expect(seen[0].id).toBe('q1');
   expect(writes.some((w) => w.includes('"command"'))).toBe(true);
@@ -98,8 +98,12 @@ test('renders a forwarded interview and sends the answer back', async () => {
  * stream) the next newline submitted the prompt at its `initialValue` — the
  * question's `defaultValue` — so a breaking update nobody saw came back as a
  * considered "no". With no terminal the client must say it cannot answer.
+ *
+ * And it must say so as `unanswerable`, NOT as an `answer` of any shape: an
+ * `answer` is what consumes the query and destroys a question nobody decided
+ * (celilo#609). The server parks and replies `blocked`.
  */
-test('no TTY and no renderer → answers with an error, never the default', async () => {
+test('no TTY and no renderer → sends unanswerable and returns blocked, never an answer', async () => {
   const writes: string[] = [];
   const encoder = new TextEncoder();
   let controller!: ReadableStreamDefaultController<Uint8Array>;
@@ -114,8 +118,15 @@ test('no TTY and no renderer → answers with an error, never the default', asyn
     stdin: {
       write(chunk: string) {
         writes.push(chunk);
-        if (chunk.includes('"answer"')) {
-          push({ type: 'result', success: false, exitCode: 1 });
+        // What a #609 server does with "I can't decide": park, don't resolve.
+        if (chunk.includes('"unanswerable"')) {
+          push({
+            type: 'blocked',
+            sessionId: 'sess-1',
+            eventId: '42',
+            question: 'Apply breaking update for iptables (1.0.2+9 → 2.0.0+1)?',
+            key: 'module-upgrade:iptables.apply_breaking',
+          });
           controller.close();
         }
       },
@@ -139,15 +150,26 @@ test('no TTY and no renderer → answers with an error, never the default', asyn
   // No `renderInterview` — exactly what runRemoteCapture used to do. bun test
   // runs with a piped stdin, i.e. the MCP server's situation.
   expect(process.stdin.isTTY).toBeFalsy();
-  const code = await runRemoteClient('ignored', ['module', 'update'], {
+  const outcome = await runRemoteClient('ignored', ['module', 'update'], {
     openTransport: () => transport,
     out: { write() {} },
   });
 
-  expect(code).toBe(1);
-  const answer = writes.find((w) => w.includes('"answer"'));
-  expect(answer).toBeDefined();
-  const parsed = JSON.parse(answer as string) as { value: unknown; error?: string };
-  expect(parsed.value).not.toBe(false);
-  expect(parsed.error).toContain('module-upgrade:iptables.apply_breaking');
+  // Never an answer — that would consume the query.
+  expect(writes.find((w) => w.includes('"answer"'))).toBeUndefined();
+
+  const unanswerable = writes.find((w) => w.includes('"unanswerable"'));
+  expect(unanswerable).toBeDefined();
+  const parsed = JSON.parse(unanswerable as string) as { id: string; reason: string };
+  expect(parsed.id).toBe('q1');
+  expect(parsed.reason).toContain('module-upgrade:iptables.apply_breaking');
+
+  // And the caller is told where it stands rather than being handed a decline.
+  expect(outcome).toEqual({
+    status: 'blocked',
+    sessionId: 'sess-1',
+    eventId: '42',
+    question: 'Apply breaking update for iptables (1.0.2+9 → 2.0.0+1)?',
+    key: 'module-upgrade:iptables.apply_breaking',
+  });
 });