@celilo/cli 0.20.0 → 0.21.0

package/CELILO_CORE_MODULES.md

@@ -25,12 +25,12 @@ Each entry: `module id` — what it is — **provides** / **requires** capabilit
 - **iptables** — iptables firewall + NAT; cross-VLAN port exposure with recursive upstream delegation. Converge model: `exposeService` registers into the shared-core port-forward registry, then renders the complete ruleset and applies it atomically via `iptables-restore` (default-DROP FORWARD + coarse zone-tier matrix; SSH-free). **provides:** `firewall`.
 - **knot-unbound-internal** — split-horizon internal DNS via Knot (authoritative) + Unbound (recursive); lightweight, plain apt, no .NET. **provides:** `dns_internal`. Ships a base-module-aspect (`modules/knot-unbound-internal/base-module-aspect/`).
 - **technitium** — internal split-horizon DNS resolver + authoritative server (web UI + HTTP API); heavier alternative to knot-unbound. **provides:** `dns_internal`. Ships a base-module-aspect (`modules/technitium/base-module-aspect/`).
-- **namecheap** — public DNS A-record management via Namecheap Dynamic DNS API (HTTP, no browser automation). **provides:** `dns_registrar`.
+- **namecheap** — public DNS A-record management via Namecheap Dynamic DNS API (HTTP, no browser automation). A caller supplies a NAME and nothing else: the address is the source IP of celilo's own update, re-derived on every assert. Registering `<domain>` also claims `www.<domain>` and vice versa (best effort, reported back as `outputs.companion_fqdn` so the framework's `public_dns` check watches it — Namecheap answers `ErrCount 0` for `www` updates it does not apply). DDNS passwords are keyed by the **registrable domain**, never the FQDN. **provides:** `dns_registrar`.
 - **wireguard** — owns the admin WireGuard tunnel on the firewall host: interface, listen port, peers (as records), and client subnet are module config rather than hand-maintained state. Exposes the listen port and **registers the client subnet as a trusted source**, so VPN reach into the managed zones is in the firewall registry and every converge re-emits it. Records `network.control-plane-vpn.subnet`, which the internal resolver's split-horizon view also consumes. Adopts a running tunnel in place (existing key and peers retained; `wg syncconf`, never `wg-quick down`) because that tunnel is the operator's recovery path. **requires:** `firewall` (and the provider must support trusted-source registration — `iptables` does, `greenwave` does not).
 
 ## Public edge (ingress / identity)
 
-- **caddy** — reverse proxy with automatic HTTPS (HTTP-01 ACME); the standard HTTPS ingress. **provides:** `public_web`. **requires:** `dns_registrar`, `firewall`.
+- **caddy** — reverse proxy with automatic HTTPS (HTTP-01 ACME); the standard HTTPS ingress. Emits a 301 redirect block for each served name's `www`/apex companion (kept out of the served-hostname set, so a companion never blocks the ACME wait). Its `health_check`'s DNS item is `internal_dns_resolution` — it digs from the management host behind the split-horizon resolver and is evidence about the in-fleet view only; public reachability is the framework's `public_dns` check. **provides:** `public_web`. **requires:** `dns_registrar`, `firewall`.
 - **generic-cpanel-hosting-provider** — publishes static sites into a subfolder of a domain on a cPanel/SSH web host celilo does **not** govern (the host owns the domain, DNS, TLS and web server). Systemless like **namecheap** — no `requires.system`, no zone, no IPAM; it holds credentials for an external party. One provider serves many accounts, resolved by hostname; onboarding takes the account password once, `ssh-copy-id`s celilo's key, then discards it. **provides:** `external_web`.
 - **authentik** — Authentik identity provider with OIDC (Docker Compose: server, worker, Postgres, Redis). **provides:** `idp`. **requires:** `public_web`, `dns_registrar`, `firewall`.
 

package/CELILO_SUBSYSTEMS.md

@@ -38,6 +38,7 @@ see `openspec/specs/`. Companion doc: [CELILO_CORE_MODULES.md](./CELILO_CORE_MOD
 - **Canonical capability registry** — `packages/capabilities/src/capability-registry.ts` — `KNOWN_CAPABILITY_NAMES` (the authoritative list), `CapabilityRegistry` type. Public surface: `packages/capabilities/src/index.ts`.
 - **Loader (wires provider factories into hook contexts)** — `apps/celilo/src/hooks/capability-loader.ts` — `loadCapabilityFunctions`, `resolveFirewallNatIp`.
 - **Ledger wrappers (stateful capabilities)** — `apps/celilo/src/services/dns-registrations.ts` (`withDnsRegistrationLedger`), `apps/celilo/src/services/dns-internal-records.ts` (`withDnsInternalLedger`).
+- **Public DNS ledger (`dns_registrations` + `dns_registration_consumers`)** — `apps/celilo/src/services/dns-registrations.ts` — records WHICH MODULE ASKED FOR WHICH NAME, and deliberately **no address**: the published value is source-detected on every assert and observable on demand from public DNS, and a stored copy is one careless read away from becoming an instruction again (celilo#626 — the 15-minute `refresh_registrations` replayed addresses written by an older celilo and took five public names dark for nine days while every in-fleet check stayed green). Consumers are a SET, not a column: the FK cascade on a single `consumer_module_id` decided when a LIVE record was forgotten, so a row now survives until its LAST consumer is removed (`openspec/changes/public-dns-reachability/design.md` D5). Orphaned rows are pruned on read (`pruneOrphanedRegistrations`) rather than by trigger — SQLite fires delete triggers for FK-cascaded deletes only with `recursive_triggers` on. `companion: true` marks a name celilo claimed on a module's behalf (`www.<domain>` ↔ `<domain>`) rather than one a module asked for; the provider reports it as `outputs.companion_fqdn` whether or not the claim reported success, because a provider's success response is not evidence of publication. Operator surface: `celilo dns registrations`.
 
 ### Known capabilities (impl → provider module)
 
@@ -45,7 +46,7 @@ see `openspec/specs/`. Companion doc: [CELILO_CORE_MODULES.md](./CELILO_CORE_MOD
 |---|---|---|
 | `public_web` | `packages/capabilities/src/public-web.ts` (`createPublicWeb`). **Route lifecycle** is framework-owned at both ends, not per-module: removing a consumer runs `apps/celilo/src/services/web-route-cleanup.ts` (delete rows → reclaim `/srv/www/<slug>` → emit `routes_changed`) whether or not the module has an `on_uninstall`; deploying a provider runs `apps/celilo/src/services/public-web-republish.ts` (re-run every static consumer's `on_install`) so a provider rebuild refills the web roots it destroyed. | caddy |
 | `idp` | `packages/capabilities/src/idp.ts` | authentik |
-| `dns_registrar` | `packages/capabilities/src/dns-registrar.ts` (`registerHost`) | namecheap |
+| `dns_registrar` | `packages/capabilities/src/dns-registrar.ts` (`registerHost({ fqdn })` — **there is no way to supply an address**; the provider re-derives it from its own update's source IP on every assert) | namecheap |
 | `external_web` | `packages/capabilities/src/external-web.ts` (`publishStaticSite`). **OFF-FLEET static publishing** — the counterpart to `public_web`. See the in-fleet vs off-fleet note below. | generic-cpanel-hosting-provider |
 | `firewall` | `packages/capabilities/src/firewall.ts` (`exposeService`, `unexposeService`, `listExposedServices`). **Converge model**: register into the shared-core port-forward registry → render the complete ruleset → apply atomically (see the firewall converge note below). | greenwave, iptables |
 | `dns_internal` | `packages/capabilities/src/dns-internal.ts` | knot-unbound-internal, technitium |
@@ -198,8 +199,9 @@ is currently wrong, and routes carry the message to a person's phone. Design:
 - **Alert identity** — `apps/celilo/src/services/alerting/keys.ts` — the key grammar (`module:<id>[/check:<name>]`, `builtin:<check>[/<kind>:<target>]`) that makes "the same problem" the same alert across runs. `moduleAlertKey`, `moduleCheckAlertKey`, `builtinAlertKey`, `parseAlertKey`.
 - **Reconciliation** — `apps/celilo/src/services/alerting/reconcile.ts` (`reconcile`) — a successful run's failing-key set is authoritative and resolution is by SET DIFFERENCE (absent ⇒ resolved). A run whose outcome is `error` resolves NOTHING and fires a module-level alert instead: the false-all-clear guard.
 - **Monitor execution** — `apps/celilo/src/services/alerting/run-monitor.ts` (`runOneMonitor`) + `sweep.ts` (`selectDueMonitors`) + `builtin-monitors.ts` / `health-coverage.ts` (the built-in checks and the "module with no health check" coverage check).
-- **Scheduled audit categories (`builtin_check` monitors)** — `apps/celilo/src/services/alerting/builtin-source.ts` — `SCHEDULABLE_BUILTIN_CHECKS` is the list of `celilo system audit` categories cheap enough to run every sweep: `machines_reachable`, `backups`, `disk_space`, and `abandoned_operations` (`apps/celilo/src/services/audit/abandoned-operations.ts` — ≥3 abandonments of the same (module, operation) in 7d, the fingerprint of an operation being killed mid-flight). Everything else in the audit needs the whole world injected (proxmox, terraform, registry) and is not schedulable. Enable one with `celilo monitor add backups --interval 1h`. Targets are tab-completable — `completion.ts` reads `SCHEDULABLE_BUILTIN_CHECKS` directly rather than a hand-copied list, so a newly-schedulable check is completable immediately.
+- **Scheduled audit categories (`builtin_check` monitors)** — `apps/celilo/src/services/alerting/builtin-source.ts` — `SCHEDULABLE_BUILTIN_CHECKS` is the list of `celilo system audit` categories cheap enough to run every sweep: `machines_reachable`, `backups`, `disk_space`, `abandoned_operations`, and `public_dns` (`apps/celilo/src/services/audit/abandoned-operations.ts` — ≥3 abandonments of the same (module, operation) in 7d, the fingerprint of an operation being killed mid-flight). Everything else in the audit needs the whole world injected (proxmox, terraform, registry) and is not schedulable. Enable one with `celilo monitor add backups --interval 1h`. Targets are tab-completable — `completion.ts` reads `SCHEDULABLE_BUILTIN_CHECKS` directly rather than a hand-copied list, so a newly-schedulable check is completable immediately.
 - **Disk-space check** — `apps/celilo/src/services/audit/disk-space.ts` (`auditDiskSpace`, pure over measurements) + `apps/celilo/src/services/disk-probe.ts` (`probeDiskUsage`). Thresholds: `drift` at 85%, `blocked` at 95% — early enough to act on, since a check that fires at exhaustion reports an outage rather than preventing one. ⚠️ **The local management box is MEASURED, not exempted.** `probeMachines()` deliberately reports the local box reachable without probing it (celilo has no SSH key for itself, and the question is meaningless there); copying that shortcut into a disk check would skip the host most likely to fill — the one that stages backups, caches modules and writes the logs, and the one that DID fill. Local reads `statfs`; remote runs `df -P /` over the same bounded SSH. `percentUsed` matches `df`'s capacity semantics (excludes root-reserved blocks) so an alert and an operator's own `df` agree. An unmeasurable host yields a `todo` finding — recorded, never paged, because `machines_reachable` is already paging for that host. Findings are subjected on the **hostname**, not the machine UUID, because suppression resolves a machine's ancestor key from the hostname (see #596, where `machines_reachable` gets this wrong and its alerts therefore never suppress anything). The `backups` roster comes from `apps/celilo/src/services/audit/backup-source.ts` (`loadBackupAuditInfo`), shared with `celilo system audit` so both judge the same fleet.
+- **Public-DNS reachability check (the only check with an OFF-FLEET vantage)** — `apps/celilo/src/services/audit/public-dns.ts` (`auditPublicDns`, pure over an injected probe and the previous run's counters) + `apps/celilo/src/services/public-dns-probe.ts` (the probe) + `audit/public-dns-source.ts` (ledger names + the `public_dns_evidence` counters). Every other check in celilo looks from INSIDE, behind a split-horizon resolver that deliberately answers with an in-zone address — correct for its purpose, and why all of them reported healthy for the nine days of celilo#626. This one resolves every `dns_registrations` FQDN through an **off-fleet resolver** (`public_dns.resolver`, default `1.1.1.1`) and compares it against the address the fleet appears to come from per an independent **echo service** (`public_dns.echo_url`, default `https://api.ipify.org`). Three properties are load-bearing: `assertOffFleetResolver` REFUSES a resolver matching `dns.primary`/`dns.fallback` (a check that quietly used the fleet's resolver would pass forever — the original bug one layer up); the expectation never comes from the registrar's own response (self-agreement, and Namecheap returns `ErrCount 0` for `www` updates it does not apply); and a divergence is a finding only once it OUTLIVES the record's own TTL, measured from the last assert, or it would page on every ISP re-lease. Missing evidence is counted rather than read as success — one undetermined run is silent, N consecutive ones are their own finding (`public_dns_evidence`), which is the hole celilo-website's isitup.org probe demonstrated live. Codes: `public_dns_stale`, `public_dns_missing`, `public_dns_companion_unclaimed`, `public_dns_unverifiable`. Spec: `openspec/specs/public-dns-reachability/spec.md`.
 - **The sweep** — `apps/celilo/src/services/alerting/sweep-runner.ts` (`runSweep`) — the ordered pass that makes alerting run by itself: run due monitors → promote past-grace alerts → re-evaluate suppression → flush quiet-hours deferrals → notify. Driven by `celilo alerts sweep` on `timer.tick.5m`. Never throws for one bad monitor.
 - **Suppression (topology-derived, never configured)** — `apps/celilo/src/services/alerting/suppression.ts` — `ancestorKeysFor`/`findSuppressor`/`machineAlertKey`. A firing machine explains its modules' failures; a firing capability provider explains its zone's consumers. Derived from `module_systems`, so it cannot drift from reality. Deploy windows: `deploy-hooks.ts` (`openDeployWindow`/`closeDeployWindows` — closed by module, so a crashed deploy self-heals).
 - **Escalation & quiet hours** — `escalation.ts` (`decideEscalation`, every reason to stay silent enumerated) + `quiet-hours.ts` (`isWithinQuietHours`, Intl-based and DST-safe). Quiet hours defer the MESSAGE while the escalation clock keeps running.

package/drizzle/0020_dns_registrations_drop_ip.sql

@@ -0,0 +1,25 @@
+-- Drop `dns_registrations.ip`.
+--
+-- THIS MIGRATION IS THE SWEEP, not the tidying after one.
+--
+-- A row's stored `ip` was replayed by `refresh_registrations` every 15
+-- minutes as the address to publish. Rows written before #464/#466 carry the
+-- external address the caller passed at the time, so once the ISP re-leased,
+-- the refresh re-published a dead address on a timer, indefinitely, reporting
+-- success every tick. celilo#626: five public names dark for nine days,
+-- including apt.celilo.computer and the module registry, while every in-fleet
+-- check stayed green because the split-horizon resolver answers with a
+-- reachable internal address.
+--
+-- Fixing only the write path leaves every armed legacy row armed until
+-- somebody happens to redeploy the module that owns it. Dropping the column
+-- disarms all of them at once, and makes the whole class unrepresentable
+-- rather than merely unlikely — there is no longer a value to go stale.
+--
+-- The address is not migrated anywhere. It is observable on demand from
+-- public DNS (that is what the new `public_dns` check does), and a stored
+-- copy is one careless read away from becoming an instruction again.
+--
+-- Plain DROP COLUMN: `ip` is in no index and no FOREIGN KEY clause.
+
+ALTER TABLE `dns_registrations` DROP COLUMN `ip`;

package/drizzle/0021_dns_registration_consumers.sql

@@ -0,0 +1,63 @@
+-- Replace `dns_registrations.consumer_module_id` with a consumer SET.
+--
+-- The column was overwritten by every re-assert, and it is not a label: the
+-- FK cascade on it decides when a LIVE record is forgotten. Recovering the
+-- fleet with `run-hook caddy on_install` re-attributed auth.lunacycle.net,
+-- buildyourowninternet.dev, dj-incarnadine.org and peterbanka.org to caddy,
+-- so removing caddy would have cascade-deleted registrations that authentik
+-- and the site modules still serve. Keep-first has the mirror failure: if
+-- module A introduces a name and B later needs it too, removing A drops the
+-- row out from under B. Both encode a single owner where there may be several.
+--
+-- With a set, the row survives until its LAST consumer is removed — which is
+-- also the only basis on which "can this record be deleted at the registrar?"
+-- could ever be answered. See design.md D5.
+--
+-- Existing rows are seeded from the single value they carry. The pre-recovery
+-- attribution for the four names above is NOT recoverable — it was overwritten
+-- in place before this migration existed. Seeding preserves what the table
+-- actually holds rather than pretending to reconstruct what it used to.
+--
+-- Order matters: `dns_registrations` is rebuilt (SQLite refuses to drop a
+-- column named in a FOREIGN KEY clause) and `foreign_keys` is ON, so a child
+-- table created before the rebuild would be cascade-emptied by the DROP.
+-- The seed is parked in an FK-free scratch table across it.
+
+CREATE TABLE `__dns_consumer_seed` (
+	`registration_id` integer NOT NULL,
+	`module_id` text NOT NULL,
+	`first_seen_at` integer NOT NULL
+);
+--> statement-breakpoint
+INSERT INTO `__dns_consumer_seed` SELECT `id`, `consumer_module_id`, `registered_at` FROM `dns_registrations`;
+--> statement-breakpoint
+CREATE TABLE `__new_dns_registrations` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`provider_module_id` text NOT NULL,
+	`fqdn` text NOT NULL,
+	`registered_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`refreshed_at` integer,
+	FOREIGN KEY (`provider_module_id`) REFERENCES `modules`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+INSERT INTO `__new_dns_registrations` SELECT `id`, `provider_module_id`, `fqdn`, `registered_at`, `refreshed_at` FROM `dns_registrations`;--> statement-breakpoint
+DROP TABLE `dns_registrations`;--> statement-breakpoint
+ALTER TABLE `__new_dns_registrations` RENAME TO `dns_registrations`;--> statement-breakpoint
+CREATE UNIQUE INDEX `dns_registrations_provider_fqdn_idx` ON `dns_registrations` (`provider_module_id`,`fqdn`);
+--> statement-breakpoint
+CREATE TABLE `dns_registration_consumers` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`registration_id` integer NOT NULL,
+	`module_id` text NOT NULL,
+	`first_seen_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`registration_id`) REFERENCES `dns_registrations`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`module_id`) REFERENCES `modules`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `dns_registration_consumers_unique_idx` ON `dns_registration_consumers` (`registration_id`,`module_id`);
+--> statement-breakpoint
+INSERT INTO `dns_registration_consumers` (`registration_id`, `module_id`, `first_seen_at`)
+	SELECT `registration_id`, `module_id`, `first_seen_at` FROM `__dns_consumer_seed`
+	WHERE `module_id` IN (SELECT `id` FROM `modules`);
+--> statement-breakpoint
+DROP TABLE `__dns_consumer_seed`;

package/drizzle/0022_dns_registrations_companion.sql

@@ -0,0 +1,15 @@
+-- `dns_registrations.companion` — the name celilo claimed on a module's
+-- behalf rather than one a module asked for.
+--
+-- `www.<domain>` and `<domain>` are one name pair: declaring either claims the
+-- other. The declared name fails the deploy if it cannot be published; the
+-- companion is best effort, because failing a deploy over a name nobody
+-- requested is punitive. Best effort must not mean silent, though — a working
+-- www beside a dead apex is celilo#626 in miniature — so companion rows are
+-- watched by the `public_dns` check like any other, and carry the manual
+-- registrar remediation when they diverge.
+--
+-- Existing rows are all declared names: nothing claimed a companion before
+-- this migration.
+
+ALTER TABLE `dns_registrations` ADD COLUMN `companion` integer DEFAULT false NOT NULL;

package/drizzle/0023_public_dns_evidence.sql

@@ -0,0 +1,19 @@
+-- `public_dns_evidence` — consecutive runs the public-reachability check could
+-- obtain no evidence about a subject.
+--
+-- A probe that could not run is not a pass. celilo-website's external check
+-- already got this half right and half wrong: it records an unreachable prober
+-- as *undetermined* rather than a failure (correct — a prober blip once paged
+-- three modules at once) but then emits no check item at all, so a real outage
+-- produced complete silence for nine days.
+--
+-- Counting the absences closes that without reintroducing the noise: one
+-- undetermined run is still silent, N consecutive ones are their own finding,
+-- distinguishable from "the site is unreachable". A subject that answers has
+-- its row dropped, which is what makes the count consecutive.
+
+CREATE TABLE `public_dns_evidence` (
+	`subject` text PRIMARY KEY NOT NULL,
+	`undetermined_runs` integer DEFAULT 0 NOT NULL,
+	`last_checked_at` integer DEFAULT (unixepoch()) NOT NULL
+);

package/drizzle/meta/_journal.json

@@ -141,6 +141,34 @@
       "when": 1783500000000,
       "tag": "0019_backup_pid",
       "breakpoints": true
+    },
+    {
+      "idx": 20,
+      "version": "6",
+      "when": 1783600000000,
+      "tag": "0020_dns_registrations_drop_ip",
+      "breakpoints": true
+    },
+    {
+      "idx": 21,
+      "version": "6",
+      "when": 1783700000000,
+      "tag": "0021_dns_registration_consumers",
+      "breakpoints": true
+    },
+    {
+      "idx": 22,
+      "version": "6",
+      "when": 1783800000000,
+      "tag": "0022_dns_registrations_companion",
+      "breakpoints": true
+    },
+    {
+      "idx": 23,
+      "version": "6",
+      "when": 1783900000000,
+      "tag": "0023_public_dns_evidence",
+      "breakpoints": true
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/cli",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Celilo — home lab orchestration CLI",
   "type": "module",
   "bin": {
@@ -57,7 +57,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1024.0",
-    "@celilo/capabilities": "^0.11.0",
+    "@celilo/capabilities": "^1.0.0",
     "@celilo/cli-display": "^0.1.10",
     "@celilo/core": "^0.5.0",
     "@celilo/event-bus": "^0.3.0",

package/schemas/system_config.json

@@ -13,7 +13,7 @@
     "network.dmz.subnet": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
-      "description": "DMZ subnet CIDR (not defaulted — appears only when a firewall module provides this zone; see openspec/specs/progressive-zone-disclosure/spec.md)"
+      "description": "DMZ subnet CIDR (not defaulted \u2014 appears only when a firewall module provides this zone; see openspec/specs/progressive-zone-disclosure/spec.md)"
     },
     "network.dmz.gateway": {
       "type": "string",
@@ -29,7 +29,7 @@
     "network.app.subnet": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
-      "description": "App subnet CIDR (not defaulted — appears only when a firewall module provides this zone)"
+      "description": "App subnet CIDR (not defaulted \u2014 appears only when a firewall module provides this zone)"
     },
     "network.app.gateway": {
       "type": "string",
@@ -45,7 +45,7 @@
     "network.secure.subnet": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
-      "description": "Secure subnet CIDR (not defaulted — appears only when a firewall module provides this zone)"
+      "description": "Secure subnet CIDR (not defaulted \u2014 appears only when a firewall module provides this zone)"
     },
     "network.secure.gateway": {
       "type": "string",
@@ -61,12 +61,12 @@
     "network.internal.subnet": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
-      "description": "Internal subnet CIDR (home devices, trusted; not defaulted — discovered from the management box's primary interface at celilo-mgmt install)"
+      "description": "Internal subnet CIDR (home devices, trusted; not defaulted \u2014 discovered from the management box's primary interface at celilo-mgmt install)"
     },
     "network.internal.gateway": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
-      "description": "Internal gateway IP address (not defaulted — discovered from the default route)"
+      "description": "Internal gateway IP address (not defaulted \u2014 discovered from the default route)"
     },
     "network.internal.vlan": {
       "type": "integer",
@@ -77,17 +77,17 @@
     "network.control-plane-vpn.subnet": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
-      "description": "WireGuard VPN client subnet CIDR (remote-access tunnel; consumed by technitium's split-horizon → in-zone caddy view, #275, and by the firewall's trusted sources once the wireguard module registers it)"
+      "description": "WireGuard VPN client subnet CIDR (remote-access tunnel; consumed by technitium's split-horizon \u2192 in-zone caddy view, #275, and by the firewall's trusted sources once the wireguard module registers it)"
     },
     "network.secure-mgmt.subnet": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
-      "description": "Control-plane subnet CIDR — the network celilo-mgr itself occupies when it does not sit on the internal LAN (not defaulted — discovered at celilo-mgmt install, or recorded by firewall onboarding). Derives the firewall's trusted sources and the internal resolver's split-horizon view for celilo's own traffic."
+      "description": "Control-plane subnet CIDR \u2014 the network celilo-mgr itself occupies when it does not sit on the internal LAN (not defaulted \u2014 discovered at celilo-mgmt install, or recorded by firewall onboarding). Derives the firewall's trusted sources and the internal resolver's split-horizon view for celilo's own traffic."
     },
     "network.secure-mgmt.gateway": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
-      "description": "Control-plane gateway IP address (not defaulted — discovered from the default route)"
+      "description": "Control-plane gateway IP address (not defaulted \u2014 discovered from the default route)"
     },
     "network.secure-mgmt.vlan": {
       "type": "integer",
@@ -97,20 +97,31 @@
     },
     "firewall.trusted_subnets": {
       "type": "string",
-      "description": "Operator-declared trusted source subnets (comma-separated CIDRs) permitted to reach every managed zone. ADDITIVE to the control-plane subnet celilo derives and to the sources modules register — it cannot drop control-plane trust, which would block the SSH every hook and converge runs over."
+      "description": "Operator-declared trusted source subnets (comma-separated CIDRs) permitted to reach every managed zone. ADDITIVE to the control-plane subnet celilo derives and to the sources modules register \u2014 it cannot drop control-plane trust, which would block the SSH every hook and converge runs over."
     },
     "dns.primary": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
-      "description": "Primary DNS server IP address (not defaulted — discovered from the host resolver at celilo-mgmt install; repointed at a dns_internal provider when one deploys)"
+      "description": "Primary DNS server IP address (not defaulted \u2014 discovered from the host resolver at celilo-mgmt install; repointed at a dns_internal provider when one deploys)"
     },
     "dns.fallback": {
       "type": "string",
-      "description": "Fallback DNS servers (comma-separated IP addresses; not defaulted — discovered, with 1.1.1.1 as last resort)"
+      "description": "Fallback DNS servers (comma-separated IP addresses; not defaulted \u2014 discovered, with 1.1.1.1 as last resort)"
     },
     "ssh.public_key": {
       "type": "string",
       "description": "SSH public key for container access"
+    },
+    "public_dns.resolver": {
+      "type": "string",
+      "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
+      "default": "1.1.1.1",
+      "description": "Resolver the public_dns check asks what the INTERNET resolves for the fleet's names. Must not be a resolver the fleet itself uses \u2014 the fleet resolver runs split-horizon and would make the check pass whatever the public internet sees (celilo#626). celilo refuses a value matching dns.primary / dns.fallback."
+    },
+    "public_dns.echo_url": {
+      "type": "string",
+      "default": "https://api.ipify.org",
+      "description": "Echo service reporting the address the fleet appears to come from \u2014 the expectation public DNS is compared against. Deliberately not the registrar's own response, which is self-agreement (and which Namecheap returns successfully for updates it does not apply)."
     }
   },
   "additionalProperties": true

package/src/cli/commands/dns.ts

@@ -3,7 +3,7 @@
  *
  * `registrations` lists the dns_registrations ledger: every (provider,
  * fqdn) the framework has registered via dns_registrar.registerHost,
- * with the consumer that asked for it and when it was last re-asserted
+ * with every module that depends on it and when it was last re-asserted
  * by the provider's refresh_registrations hook. Read-only; names only
  * (module ids), never UUIDs. See
  * designs/DISPATCHER_DAEMON_AND_TIMER_EVENTS.md (B2b).
@@ -40,12 +40,16 @@ export async function handleDnsRegistrations(
   }
 
   const now = new Date();
-  const header = ['FQDN', 'IP', 'PROVIDER', 'CONSUMER', 'REGISTERED', 'REFRESHED'];
+  // No address column: the ledger stores none. What a name actually resolves
+  // to publicly is what `celilo system audit`'s public_dns check reports, from
+  // off-fleet — reading it back out of celilo's own table is what made a
+  // nine-day outage invisible (design.md D1).
+  const header = ['FQDN', 'KIND', 'PROVIDER', 'CONSUMERS', 'REGISTERED', 'REFRESHED'];
   const table = rows.map((r) => [
     r.fqdn,
-    r.ip ?? 'auto',
+    r.companion ? 'companion' : 'declared',
     r.providerModuleId,
-    r.consumerModuleId,
+    r.consumerModuleIds.join(', ') || '—',
     formatAge(r.registeredAt, now),
     formatAge(r.refreshedAt, now),
   ]);

package/src/cli/commands/events.ts

@@ -152,7 +152,10 @@ export async function handleEventsRunHook(args: string[]): Promise<CommandResult
   };
 
   const logger = createConsoleLogger(moduleId, sub.hook);
-  const result = await runNamedHook(moduleId, sub.hook as HookName, db, logger, { inputs });
+  const result = await runNamedHook(moduleId, sub.hook as HookName, db, logger, {
+    inputs,
+    timeoutMs: sub.timeout_ms,
+  });
 
   if (result.notDefined) {
     return { success: false, error: `Module '${moduleId}' declares no '${sub.hook}' hook to run` };

package/src/cli/commands/system-audit.ts

@@ -46,6 +46,10 @@ import {
 } from '../../services/audit/cli-version';
 import type { MachineReachableResult } from '../../services/audit/machines-reachable';
 import type { ModuleVersionFetcher } from '../../services/audit/module-versions';
+import {
+  loadPublicDnsEvidence,
+  loadPublicDnsRecords,
+} from '../../services/audit/public-dns-source';
 import { makeJournalReader, readAppliedMigrations } from '../../services/audit/schema';
 import type { SecretCheckResult } from '../../services/audit/secrets-decryptable';
 import type { ServiceCredentialsResult } from '../../services/audit/services-credentials';
@@ -56,6 +60,7 @@ import { collectFirewallReach } from '../../services/firewall-reach';
 import { runAllHealthChecks } from '../../services/health-runner';
 import { probeMachines } from '../../services/machine-probe';
 import { parseStoredConfigValue } from '../../services/module-config';
+import { createPublicDnsProbe, loadPublicDnsProbeSettings } from '../../services/public-dns-probe';
 import { buildTerraformEnvForModule } from '../../services/terraform-env';
 import { hasFlag } from '../parser';
 import type { CommandResult } from '../types';
@@ -381,6 +386,16 @@ async function buildAuditDeps(onProgress?: (msg: string) => void) {
     secretsDecryptable: { results: secretResults },
     servicesReachable: { results: serviceReachableResults },
     machinesReachable: { results: machineReachableResults },
+    // The only check here whose vantage point is OUTSIDE the fleet. Its
+    // undetermined counters are read but not written from this path: an
+    // operator-run audit is not a run of a schedule, so counting it towards
+    // "N consecutive runs found no evidence" would misreport how long the
+    // fleet has been unverifiable. The monitor sweep owns that (D2).
+    publicDns: {
+      records: loadPublicDnsRecords(db),
+      probe: createPublicDnsProbe(loadPublicDnsProbeSettings(db)),
+      evidence: loadPublicDnsEvidence(db),
+    },
     // Reads the record the poller already writes — this check never performs a
     // read of its own. One that did would drain the queue and eat the
     // acknowledgement it exists to protect (#541).

package/src/cli/commands/system-migrate.test.ts

@@ -1,11 +1,28 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb } from '../../db/client';
+import { closeDb, findMigrationsFolder } from '../../db/client';
 import { handleSystemMigrate } from './system-migrate';
 
+/**
+ * The newest migration, read from the journal rather than written down here.
+ *
+ * These assertions used to name `0019_backup_pid` literally, so every
+ * subsequent migration broke a test that has nothing to do with it. What is
+ * under test is that `--status` REPORTS the head and any gap below it, not
+ * which migration happens to be head today.
+ */
+function latestMigrationTag(): string {
+  const journal = JSON.parse(
+    readFileSync(join(findMigrationsFolder(), 'meta', '_journal.json'), 'utf8'),
+  ) as { entries: { tag: string }[] };
+  const tag = journal.entries.at(-1)?.tag;
+  if (!tag) throw new Error('Migration journal is empty');
+  return tag;
+}
+
 describe('handleSystemMigrate', () => {
   let dir: string;
 
@@ -51,7 +68,7 @@ describe('handleSystemMigrate', () => {
       expect(result.success).toBe(true);
       if (result.success) {
         expect(result.message).toMatch(/Applied migrations: \d+/);
-        expect(result.message).toContain('0019_backup_pid');
+        expect(result.message).toContain(latestMigrationTag());
         expect(result.message).toContain('Pending:            none');
         expect(result.message).toContain('columns');
       }
@@ -61,6 +78,7 @@ describe('handleSystemMigrate', () => {
       await handleSystemMigrate();
       closeDb();
       // Rewind one migration, the way an upgrade that never ran would look.
+      const head = latestMigrationTag();
       const raw = new Database(process.env.CELILO_DB_PATH as string);
       raw.run(
         'DELETE FROM `__drizzle_migrations` WHERE created_at = (SELECT MAX(created_at) FROM `__drizzle_migrations`)',
@@ -75,7 +93,10 @@ describe('handleSystemMigrate', () => {
 
       expect(result.success).toBe(false);
       if (!result.success) {
-        expect(result.error).toContain('0019_backup_pid');
+        // The rewound migration is named as pending…
+        expect(result.error).toContain(head);
+        // …and the dropped COLUMN is reported independently, which is the
+        // thing a table count cannot see (celilo#604).
         expect(result.error).toContain('backups.pid');
       }
 

package/src/cli/commands/system-update.ts

@@ -28,6 +28,7 @@ import { RegistryClient } from '../../registry/client';
 import { runAudit } from '../../services/audit';
 import { loadAbandonedOperations } from '../../services/audit/abandoned-operations';
 import { fetchLatestCliVersion } from '../../services/audit/cli-version';
+import { unusedPublicDnsProbe } from '../../services/audit/public-dns';
 import { makeJournalReader, readAppliedMigrations } from '../../services/audit/schema';
 import { createModuleBackup, createSystemStateBackup } from '../../services/backup-create';
 import { runAllHealthChecks, runModuleHealthCheck } from '../../services/health-runner';
@@ -587,6 +588,10 @@ export async function handleSystemUpdate(
     secretsDecryptable: { results: [] },
     servicesReachable: { results: [] },
     machinesReachable: { results: [] },
+    // Public reachability needs a network round trip per name; the update
+    // flow's partial audit does no probing. `system audit` and the scheduled
+    // monitor own this check.
+    publicDns: { records: [], probe: unusedPublicDnsProbe },
     transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
     trustedSources: { firewalls: [] },
   };

package/src/cli/tui/audit-state.ts

@@ -84,6 +84,7 @@ export const ALL_CATEGORIES: readonly DriftCategory[] = [
   'secrets_decryptable',
   'services_reachable',
   'machines_reachable',
+  'public_dns',
   'disk_space',
   'transport_reads',
   'trusted_sources',
@@ -105,6 +106,7 @@ export const CATEGORY_LABELS: Record<DriftCategory, string> = {
   secrets_decryptable: 'Secrets',
   services_reachable: 'Service reachability',
   machines_reachable: 'Machine reachability',
+  public_dns: 'Public DNS reachability',
   disk_space: 'Disk space',
   transport_reads: 'Transport readability',
   trusted_sources: 'Trusted networks',