@celilo/cli 0.26.0 → 0.27.0

package/src/services/machine-pool.test.ts

@@ -7,18 +7,17 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
-import { closeDb, createDbClient } from '../db/client';
+import { closeDb, createDbClient, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
-import { machines } from '../db/schema';
+import { machines, moduleInfrastructure, modules } from '../db/schema';
 import {
   addMachine,
-  assignModuleToMachine,
   getMachine,
   getMachineByHostname,
   getMachineSshKey,
+  getModulesOnMachine,
   listMachines,
   removeMachine,
-  unassignModuleFromMachine,
 } from './machine-pool';
 
 describe('machine-pool', () => {
@@ -72,7 +71,6 @@ describe('machine-pool', () => {
         },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       expect(machine.id).toBeDefined();
@@ -80,7 +78,6 @@ describe('machine-pool', () => {
       expect(machine.zone).toBe('internal');
       expect(machine.ipAddress).toBe('192.168.1.100');
       expect(machine.hardware.cpu_cores).toBe(4);
-      expect(machine.assignedModuleIds).toEqual([]);
       expect(machine.createdAt).toBeInstanceOf(Date);
     });
 
@@ -94,7 +91,6 @@ describe('machine-pool', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 64 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       // Verify key is encrypted in database
@@ -115,7 +111,6 @@ describe('machine-pool', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 64 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const externalMachine = await addMachine({
@@ -127,7 +122,6 @@ describe('machine-pool', () => {
         hardware: { cpu_cores: 1, memory_mb: 1024, disk_gb: 25 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       expect(dmzMachine.zone).toBe('dmz');
@@ -146,7 +140,6 @@ describe('machine-pool', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 64 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const retrieved = await getMachine(created.id);
@@ -173,7 +166,6 @@ describe('machine-pool', () => {
         hardware: { cpu_cores: 4, memory_mb: 4096, disk_gb: 128 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const retrieved = await getMachineByHostname('unique-hostname');
@@ -204,7 +196,6 @@ describe('machine-pool', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 64 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       await addMachine({
@@ -216,7 +207,6 @@ describe('machine-pool', () => {
         hardware: { cpu_cores: 4, memory_mb: 4096, disk_gb: 128 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const result = await listMachines();
@@ -233,7 +223,6 @@ describe('machine-pool', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 64 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       await addMachine({
@@ -245,7 +234,6 @@ describe('machine-pool', () => {
         hardware: { cpu_cores: 1, memory_mb: 1024, disk_gb: 25 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const dmzMachines = await listMachines({ zone: 'dmz' });
@@ -269,7 +257,6 @@ describe('machine-pool', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 64 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const decryptedKey = await getMachineSshKey(machine.id);
@@ -281,10 +268,19 @@ describe('machine-pool', () => {
     });
   });
 
-  describe('assignModuleToMachine', () => {
-    it('assigns module to machine', async () => {
+  /**
+   * celilo#773. `assignModuleToMachine` / `unassignModuleFromMachine` are gone
+   * along with the column they wrote — both were exported, neither had a single
+   * caller, and the column they maintained had an append-only writer elsewhere
+   * with no removal path at all.
+   *
+   * Occupancy is derived now, so these assert the two divergences that actually
+   * bit the fleet rather than that a setter sets.
+   */
+  describe('getModulesOnMachine', () => {
+    async function machineWithModuleDeployed(hostname: string, moduleId: string) {
       const machine = await addMachine({
-        hostname: 'test-machine',
+        hostname,
         zone: 'internal',
         ipAddress: '192.168.1.100',
         sshUser: 'ubuntu',
@@ -292,86 +288,59 @@ describe('machine-pool', () => {
         hardware: { cpu_cores: 4, memory_mb: 4096, disk_gb: 128 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
+      const db = getDb();
+      db.insert(modules)
+        .values({
+          id: moduleId,
+          name: moduleId,
+          version: '1.0.0',
+          manifestData: {},
+          sourcePath: `/tmp/${moduleId}`,
+        })
+        .run();
+      db.insert(moduleInfrastructure)
+        .values({
+          id: `infra-${moduleId}`,
+          moduleId,
+          infrastructureType: 'machine',
+          machineId: machine.id,
+        })
+        .run();
+      return machine;
+    }
 
-      await assignModuleToMachine(machine.id, 'homebridge');
-
-      const updated = await getMachine(machine.id);
-      expect(updated?.assignedModuleIds).toEqual(['homebridge']);
+    it('reports a machine that is hosting a module as occupied', async () => {
+      // The live case: briq hosted a VERIFIED iptables and reported
+      // "None (available)", so a second module could be placed on top of it.
+      const machine = await machineWithModuleDeployed('briq', 'iptables');
+      expect(getModulesOnMachine(machine.id)).toEqual(['iptables']);
     });
 
-    it('supports multiple modules on same machine', async () => {
-      const machine = await addMachine({
-        hostname: 'multi-module-machine',
-        zone: 'internal',
-        ipAddress: '192.168.1.100',
-        sshUser: 'ubuntu',
-        sshKey: 'test-key',
-        hardware: { cpu_cores: 8, memory_mb: 16384, disk_gb: 256 },
-        role: 'host',
-        interfaces: [],
-        assignedModuleIds: [],
-      });
+    it('frees the machine when the module is removed, with no manual step', async () => {
+      // The other direction: the id used to survive the module forever, so
+      // placement rejected an empty box citing a module that no longer existed
+      // and `machine remove` refused to remove it. Nothing could clear it.
+      const machine = await machineWithModuleDeployed('rpi4-lr', 'homebridge');
+      expect(getModulesOnMachine(machine.id)).toEqual(['homebridge']);
 
-      await assignModuleToMachine(machine.id, 'module-1');
-      await assignModuleToMachine(machine.id, 'module-2');
-      await assignModuleToMachine(machine.id, 'module-3');
+      getDb().delete(modules).where(eq(modules.id, 'homebridge')).run();
 
-      const updated = await getMachine(machine.id);
-      expect(updated?.assignedModuleIds).toEqual(['module-1', 'module-2', 'module-3']);
+      expect(getModulesOnMachine(machine.id)).toEqual([]);
     });
 
-    it('throws error for non-existent machine', async () => {
-      await expect(assignModuleToMachine('non-existent-id', 'module-id')).rejects.toThrow(
-        /Machine not found/,
-      );
-    });
-  });
-
-  describe('unassignModuleFromMachine', () => {
-    it('removes module from machine', async () => {
+    it('reports an empty machine as empty', async () => {
       const machine = await addMachine({
-        hostname: 'test-machine',
+        hostname: 'spare',
         zone: 'internal',
-        ipAddress: '192.168.1.100',
+        ipAddress: '192.168.1.101',
         sshUser: 'ubuntu',
         sshKey: 'test-key',
-        hardware: { cpu_cores: 4, memory_mb: 4096, disk_gb: 128 },
-        role: 'host',
-        interfaces: [],
-        assignedModuleIds: ['homebridge'],
-      });
-
-      await unassignModuleFromMachine(machine.id, 'homebridge');
-
-      const updated = await getMachine(machine.id);
-      expect(updated?.assignedModuleIds).toEqual([]);
-    });
-
-    it('removes specific module from multiple assignments', async () => {
-      const machine = await addMachine({
-        hostname: 'test-machine',
-        zone: 'internal',
-        ipAddress: '192.168.1.100',
-        sshUser: 'ubuntu',
-        sshKey: 'test-key',
-        hardware: { cpu_cores: 8, memory_mb: 16384, disk_gb: 256 },
+        hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 64 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: ['module-1', 'module-2', 'module-3'],
       });
-
-      await unassignModuleFromMachine(machine.id, 'module-2');
-
-      const updated = await getMachine(machine.id);
-      expect(updated?.assignedModuleIds).toEqual(['module-1', 'module-3']);
-    });
-
-    it('throws error for non-existent machine', async () => {
-      await expect(unassignModuleFromMachine('non-existent-id', 'module-id')).rejects.toThrow(
-        /Machine not found/,
-      );
+      expect(getModulesOnMachine(machine.id)).toEqual([]);
     });
   });
 
@@ -386,7 +355,6 @@ describe('machine-pool', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 64 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       await removeMachine(machine.id);

package/src/services/machine-pool.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { and, eq, inArray } from 'drizzle-orm';
-import { getDb } from '../db/client';
+import { type DbClient, getDb } from '../db/client';
 import {
   type AllocatableZone,
   type NetworkZone,
@@ -8,15 +8,11 @@ import {
   ipAllocations,
   machines,
   moduleInfrastructure,
+  moduleSystems,
 } from '../db/schema';
 import { decryptSecret, encryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
-import type {
-  Machine,
-  MachineRole,
-  NetworkInterface,
-  ResourceAllocation,
-} from '../types/infrastructure';
+import type { Machine, MachineRole, NetworkInterface } from '../types/infrastructure';
 import { EncryptionEnvelopeSchema, parseJsonWithValidation } from '../validation/schemas';
 
 /**
@@ -57,7 +53,6 @@ export async function addMachine(
     hardware: machine.hardware, // Drizzle auto-stringifies with mode: 'json'
     role: machine.role ?? 'host',
     interfaces: machine.interfaces ?? [],
-    assignedModuleIds: machine.assignedModuleIds, // Drizzle auto-stringifies with mode: 'json'
     earmarkedModule: machine.earmarkedModule || null,
     createdAt: now,
     updatedAt: now,
@@ -75,7 +70,6 @@ export async function addMachine(
     hardware: machine.hardware,
     role: (machine.role ?? 'host') as MachineRole,
     interfaces: (machine.interfaces ?? []) as NetworkInterface[],
-    assignedModuleIds: machine.assignedModuleIds,
     earmarkedModule: machine.earmarkedModule || null,
     apiOnly: false, // defaults to false; toggled later via separate flow
     createdAt: now,
@@ -88,7 +82,6 @@ export async function addMachine(
  */
 function rowToMachine(row: typeof machines.$inferSelect): Machine {
   const hardware = row.hardware || { cpu_cores: 0, memory_mb: 0, disk_gb: 0, arch: 'unknown' };
-  const assignedModuleIds = Array.isArray(row.assignedModuleIds) ? row.assignedModuleIds : [];
   const interfaces = Array.isArray(row.interfaces) ? (row.interfaces as NetworkInterface[]) : [];
 
   return {
@@ -101,7 +94,6 @@ function rowToMachine(row: typeof machines.$inferSelect): Machine {
     hardware,
     role: (row.role as MachineRole) || 'host',
     interfaces,
-    assignedModuleIds,
     earmarkedModule: row.earmarkedModule ?? undefined,
     apiOnly: row.apiOnly,
     createdAt: new Date(row.createdAt),
@@ -180,12 +172,15 @@ export async function findMachineForModule(
   if (!zone) return null;
   const allMachines = await listMachines({ zone });
 
+  const db = getDb();
   for (const machine of allMachines) {
     // Skip machines earmarked for other modules
     if (machine.earmarkedModule && machine.earmarkedModule !== moduleId) continue;
-    // Skip machines already assigned to other modules
-    if (machine.assignedModuleIds.length > 0 && !machine.assignedModuleIds.includes(moduleId))
-      continue;
+    // Skip machines occupied by other modules. Derived, not read from a stored
+    // snapshot — this preview offered an occupied machine's address with no
+    // error at all while the snapshot said the box was free (celilo#773).
+    const occupants = getModulesOnMachine(machine.id, db);
+    if (occupants.length > 0 && !occupants.includes(moduleId)) continue;
     // Match role if required
     if (requiredRole && (machine.role || 'host') !== requiredRole) continue;
     return machine;
@@ -385,76 +380,65 @@ export async function removeMachine(id: string): Promise<void> {
 }
 
 /**
- * Assign a module to a machine
- */
-export async function assignModuleToMachine(machineId: string, moduleId: string): Promise<void> {
-  const machine = await getMachine(machineId);
-  if (!machine) {
-    throw new Error(`Machine not found: ${machineId}`);
-  }
-
-  const updatedModuleIds = [...machine.assignedModuleIds, moduleId];
-  const db = getDb();
-
-  await db
-    .update(machines)
-    .set({
-      assignedModuleIds: updatedModuleIds, // Drizzle auto-stringifies with mode: 'json'
-      updatedAt: new Date(),
-    })
-    .where(eq(machines.id, machineId));
-}
-
-/**
- * Unassign a module from a machine
- */
-export async function unassignModuleFromMachine(
-  machineId: string,
-  moduleId: string,
-): Promise<void> {
-  const machine = await getMachine(machineId);
-  if (!machine) {
-    throw new Error(`Machine not found: ${machineId}`);
-  }
-
-  const updatedModuleIds = machine.assignedModuleIds.filter((id) => id !== moduleId);
-  const db = getDb();
-
-  await db
-    .update(machines)
-    .set({
-      assignedModuleIds: updatedModuleIds, // Drizzle auto-stringifies with mode: 'json'
-      updatedAt: new Date(),
-    })
-    .where(eq(machines.id, machineId));
-}
-
-/**
- * Get resource allocation for all modules on a machine
- * Calculates total CPU, memory, and disk used by assigned modules
+ * Which modules occupy this machine, ANSWERED AT THE POINT OF USE (celilo#773).
+ *
+ * There used to be a `machines.assigned_module_ids` array holding this. It had
+ * one writer, which only ever appended, no reader that reconciled it, and no
+ * removal path at all — and it was load-bearing, because placement refuses a
+ * machine whose list is non-empty and does not name the module being placed.
+ * It diverged in both directions on the live fleet:
+ *
+ *   - OVER-recorded, permanently: removing a module left its id behind, so
+ *     placement rejected an empty machine citing a module that no longer
+ *     existed, and `machine remove` refused to remove it. No command could
+ *     clear the entry; the only remedy was editing the database.
+ *   - UNDER-recorded: `briq` hosted a VERIFIED `iptables` and reported
+ *     "None (available)", so a second module could be placed onto an occupied
+ *     box — the exact collision the filter exists to prevent — and the
+ *     `machine remove` guard was equally blind. Only a separately-set earmark
+ *     was keeping placement off it.
+ *
+ * Both silent. Deriving costs one indexed query and cannot drift, and removal
+ * frees the machine for free: both source tables cascade on the module row.
+ *
+ * ⚠️ The UNION of both tables is deliberate, and is not the "two sources that
+ * disagree" problem the old column was. Neither is a copy — both are FK columns
+ * owned by the deploy path — and for a SAFETY guard the liberal read is the
+ * correct one: reporting an occupied box as free is how two modules land on one
+ * machine, while reporting a free box as occupied merely sends the operator to
+ * look. `module_infrastructure` records the CLAIM at selection time and
+ * `module_systems` the realized deployment, so a module mid-deploy is visible
+ * in the first before it appears in the second.
  */
-export async function getModuleResourcesOnMachine(machineId: string): Promise<ResourceAllocation> {
-  const machine = await getMachine(machineId);
-  if (!machine) {
-    throw new Error(`Machine not found: ${machineId}`);
-  }
-
-  // If no modules assigned, return zero allocation
-  if (machine.assignedModuleIds.length === 0) {
-    return { cpu: 0, memory: 0, disk: 0 };
-  }
-
-  const db = getDb();
-
-  // Get all module infrastructure records for this machine
-  const _infraRecords = await db
-    .select()
+export function getModulesOnMachine(machineId: string, db: DbClient = getDb()): string[] {
+  const claimed = db
+    .select({ moduleId: moduleInfrastructure.moduleId })
     .from(moduleInfrastructure)
-    .where(eq(moduleInfrastructure.machineId, machineId));
-
-  // TODO: Load module manifests to get resource requirements
-  // For now, return placeholder allocation
-  // This will be implemented when we integrate with module-generator
-
-  return { cpu: 0, memory: 0, disk: 0 };
+    .where(eq(moduleInfrastructure.machineId, machineId))
+    .all();
+  const deployed = db
+    .select({ moduleId: moduleSystems.moduleId })
+    .from(moduleSystems)
+    .where(eq(moduleSystems.machineId, machineId))
+    .all();
+
+  return [...new Set([...claimed, ...deployed].map((r) => r.moduleId))].sort();
 }
+
+// `getModuleResourcesOnMachine` is deleted (celilo#773, Rule 1.2 / 7.6).
+//
+// It queried `module_infrastructure`, discarded the result into an unused
+// variable, and returned `{cpu: 0, memory: 0, disk: 0}` behind a TODO. Its
+// three callers subtracted that zero from the machine's hardware before
+// comparing against the module's requirements — so the subtraction was
+// ceremony and the comparison was really "is this machine big enough at all".
+//
+// That is a genuinely useful check and it survives, stated plainly, in
+// `machineHasCapacity`. What is gone is the appearance of multi-tenant capacity
+// accounting that never accounted for anything: a gate nobody has seen fail is
+// not a gate, and one that cannot fail reads as protection that is not there.
+//
+// Real accounting needs a decision this issue does not make — whether a
+// module's draw is its manifest MINIMUM (`requires.system`) or its deployed
+// size, which for pool machines celilo does not own. That belongs to whoever
+// builds capacity-aware placement for the machine pool.

package/src/services/machine-probe.test.ts

@@ -21,8 +21,8 @@ describe('local machine reachability', () => {
   test('a reachable local box produces no finding', async () => {
     const findings = await auditMachinesReachable({
       results: [
-        { id: 'mgr', hostname: 'celilo-mgr', ipAddress: LOCAL_MACHINE_IP, reachable: true },
-        { id: 'briq', hostname: 'briq', ipAddress: '192.168.0.254', reachable: true },
+        { hostname: 'celilo-mgr', ipAddress: LOCAL_MACHINE_IP, reachable: true },
+        { hostname: 'briq', ipAddress: '192.168.0.254', reachable: true },
       ],
     });
 
@@ -33,9 +33,8 @@ describe('local machine reachability', () => {
     // The skip must not blunt the check for the machines it exists to watch.
     const findings = await auditMachinesReachable({
       results: [
-        { id: 'mgr', hostname: 'celilo-mgr', ipAddress: LOCAL_MACHINE_IP, reachable: true },
+        { hostname: 'celilo-mgr', ipAddress: LOCAL_MACHINE_IP, reachable: true },
         {
-          id: 'briq',
           hostname: 'briq',
           ipAddress: '192.168.0.254',
           reachable: false,

package/src/services/machine-probe.ts

@@ -38,7 +38,7 @@ export async function probeMachines(): Promise<MachineReachableResult[]> {
   return Promise.all(
     machines.map(async (m): Promise<MachineReachableResult> => {
       if (m.ipAddress === LOCAL_MACHINE_IP) {
-        return { id: m.id, hostname: m.hostname, ipAddress: m.ipAddress, reachable: true };
+        return { hostname: m.hostname, ipAddress: m.ipAddress, reachable: true };
       }
       try {
         await execFileAsync(
@@ -57,11 +57,10 @@ export async function probeMachines(): Promise<MachineReachableResult[]> {
           ],
           { timeout: 8000 },
         );
-        return { id: m.id, hostname: m.hostname, ipAddress: m.ipAddress, reachable: true };
+        return { hostname: m.hostname, ipAddress: m.ipAddress, reachable: true };
       } catch (err) {
         const e = err as { stderr?: string; message?: string };
         return {
-          id: m.id,
           hostname: m.hostname,
           ipAddress: m.ipAddress,
           reachable: false,

package/src/services/module-deploy.ts

@@ -59,38 +59,18 @@ export interface DeployResult {
   };
 }
 
-/**
- * Update machine's assigned module IDs after successful deployment
- * Execution function - updates database
- *
- * @param moduleId - Module identifier
- * @param machineId - Machine identifier
- * @param db - Database connection
- */
-async function updateMachineAssignment(
-  moduleId: string,
-  machineId: string,
-  db: DbClient,
-): Promise<void> {
-  // Get current machine record
-  const machine = await db.select().from(machines).where(eq(machines.id, machineId)).get();
-
-  if (!machine) {
-    throw new Error(`Machine not found: ${machineId}`);
-  }
-
-  // Add module ID if not already assigned
-  const assignedIds = machine.assignedModuleIds || [];
-  if (!assignedIds.includes(moduleId)) {
-    const updatedIds = [...assignedIds, moduleId];
-    await db
-      .update(machines)
-      .set({ assignedModuleIds: updatedIds })
-      .where(eq(machines.id, machineId))
-      .run();
-    log.success(`Machine ${machineId} updated with module assignment`);
-  }
-}
+// `updateMachineAssignment` is deleted (celilo#773).
+//
+// It was the sole writer of `machines.assigned_module_ids`, it only ever
+// APPENDED, and nothing ever removed an entry — `module remove` deletes the
+// module row and never touches `machines`. So a machine accumulated the ids of
+// modules that no longer existed and could never be freed except by editing the
+// database.
+//
+// Nothing replaces it. Occupancy is now derived from `module_infrastructure`
+// and `module_systems` at the point of use (`getModulesOnMachine`), both of
+// which the deploy path already writes and both of which cascade on module
+// removal — so the machine frees itself with no bookkeeping step to forget.
 
 export interface DeployOptions {
   debug?: boolean;
@@ -1203,13 +1183,11 @@ async function deployModuleImpl(
         };
       }
 
-      if (plan.infrastructure?.type === 'machine' && plan.infrastructure.machineId) {
-        // Update machine's assigned_module_ids
-        await updateMachineAssignment(moduleId, plan.infrastructure.machineId, db);
-      } else if (
-        plan.infrastructure?.type === 'container_service' &&
-        plan.infrastructure.serviceId
-      ) {
+      if (plan.infrastructure?.type === 'container_service' && plan.infrastructure.serviceId) {
+        // Placeholder branch retained below; the machine branch is gone because
+        // occupancy is no longer a stored fact to update (celilo#773).
+      }
+      if (plan.infrastructure?.type === 'container_service' && plan.infrastructure.serviceId) {
         // TODO: extract Terraform outputs and persist them on
         // module_infrastructure.containerMetadata. Until that lands,
         // the deploy still succeeds — we just don't track which