@celilo/cli 0.26.1 → 0.27.0

package/src/services/machine-pool.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { and, eq, inArray } from 'drizzle-orm';
-import { getDb } from '../db/client';
+import { type DbClient, getDb } from '../db/client';
 import {
   type AllocatableZone,
   type NetworkZone,
@@ -8,15 +8,11 @@ import {
   ipAllocations,
   machines,
   moduleInfrastructure,
+  moduleSystems,
 } from '../db/schema';
 import { decryptSecret, encryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
-import type {
-  Machine,
-  MachineRole,
-  NetworkInterface,
-  ResourceAllocation,
-} from '../types/infrastructure';
+import type { Machine, MachineRole, NetworkInterface } from '../types/infrastructure';
 import { EncryptionEnvelopeSchema, parseJsonWithValidation } from '../validation/schemas';
 
 /**
@@ -57,7 +53,6 @@ export async function addMachine(
     hardware: machine.hardware, // Drizzle auto-stringifies with mode: 'json'
     role: machine.role ?? 'host',
     interfaces: machine.interfaces ?? [],
-    assignedModuleIds: machine.assignedModuleIds, // Drizzle auto-stringifies with mode: 'json'
     earmarkedModule: machine.earmarkedModule || null,
     createdAt: now,
     updatedAt: now,
@@ -75,7 +70,6 @@ export async function addMachine(
     hardware: machine.hardware,
     role: (machine.role ?? 'host') as MachineRole,
     interfaces: (machine.interfaces ?? []) as NetworkInterface[],
-    assignedModuleIds: machine.assignedModuleIds,
     earmarkedModule: machine.earmarkedModule || null,
     apiOnly: false, // defaults to false; toggled later via separate flow
     createdAt: now,
@@ -88,7 +82,6 @@ export async function addMachine(
  */
 function rowToMachine(row: typeof machines.$inferSelect): Machine {
   const hardware = row.hardware || { cpu_cores: 0, memory_mb: 0, disk_gb: 0, arch: 'unknown' };
-  const assignedModuleIds = Array.isArray(row.assignedModuleIds) ? row.assignedModuleIds : [];
   const interfaces = Array.isArray(row.interfaces) ? (row.interfaces as NetworkInterface[]) : [];
 
   return {
@@ -101,7 +94,6 @@ function rowToMachine(row: typeof machines.$inferSelect): Machine {
     hardware,
     role: (row.role as MachineRole) || 'host',
     interfaces,
-    assignedModuleIds,
     earmarkedModule: row.earmarkedModule ?? undefined,
     apiOnly: row.apiOnly,
     createdAt: new Date(row.createdAt),
@@ -180,12 +172,15 @@ export async function findMachineForModule(
   if (!zone) return null;
   const allMachines = await listMachines({ zone });
 
+  const db = getDb();
   for (const machine of allMachines) {
     // Skip machines earmarked for other modules
     if (machine.earmarkedModule && machine.earmarkedModule !== moduleId) continue;
-    // Skip machines already assigned to other modules
-    if (machine.assignedModuleIds.length > 0 && !machine.assignedModuleIds.includes(moduleId))
-      continue;
+    // Skip machines occupied by other modules. Derived, not read from a stored
+    // snapshot — this preview offered an occupied machine's address with no
+    // error at all while the snapshot said the box was free (celilo#773).
+    const occupants = getModulesOnMachine(machine.id, db);
+    if (occupants.length > 0 && !occupants.includes(moduleId)) continue;
     // Match role if required
     if (requiredRole && (machine.role || 'host') !== requiredRole) continue;
     return machine;
@@ -385,76 +380,65 @@ export async function removeMachine(id: string): Promise<void> {
 }
 
 /**
- * Assign a module to a machine
- */
-export async function assignModuleToMachine(machineId: string, moduleId: string): Promise<void> {
-  const machine = await getMachine(machineId);
-  if (!machine) {
-    throw new Error(`Machine not found: ${machineId}`);
-  }
-
-  const updatedModuleIds = [...machine.assignedModuleIds, moduleId];
-  const db = getDb();
-
-  await db
-    .update(machines)
-    .set({
-      assignedModuleIds: updatedModuleIds, // Drizzle auto-stringifies with mode: 'json'
-      updatedAt: new Date(),
-    })
-    .where(eq(machines.id, machineId));
-}
-
-/**
- * Unassign a module from a machine
- */
-export async function unassignModuleFromMachine(
-  machineId: string,
-  moduleId: string,
-): Promise<void> {
-  const machine = await getMachine(machineId);
-  if (!machine) {
-    throw new Error(`Machine not found: ${machineId}`);
-  }
-
-  const updatedModuleIds = machine.assignedModuleIds.filter((id) => id !== moduleId);
-  const db = getDb();
-
-  await db
-    .update(machines)
-    .set({
-      assignedModuleIds: updatedModuleIds, // Drizzle auto-stringifies with mode: 'json'
-      updatedAt: new Date(),
-    })
-    .where(eq(machines.id, machineId));
-}
-
-/**
- * Get resource allocation for all modules on a machine
- * Calculates total CPU, memory, and disk used by assigned modules
+ * Which modules occupy this machine, ANSWERED AT THE POINT OF USE (celilo#773).
+ *
+ * There used to be a `machines.assigned_module_ids` array holding this. It had
+ * one writer, which only ever appended, no reader that reconciled it, and no
+ * removal path at all — and it was load-bearing, because placement refuses a
+ * machine whose list is non-empty and does not name the module being placed.
+ * It diverged in both directions on the live fleet:
+ *
+ *   - OVER-recorded, permanently: removing a module left its id behind, so
+ *     placement rejected an empty machine citing a module that no longer
+ *     existed, and `machine remove` refused to remove it. No command could
+ *     clear the entry; the only remedy was editing the database.
+ *   - UNDER-recorded: `briq` hosted a VERIFIED `iptables` and reported
+ *     "None (available)", so a second module could be placed onto an occupied
+ *     box — the exact collision the filter exists to prevent — and the
+ *     `machine remove` guard was equally blind. Only a separately-set earmark
+ *     was keeping placement off it.
+ *
+ * Both silent. Deriving costs one indexed query and cannot drift, and removal
+ * frees the machine for free: both source tables cascade on the module row.
+ *
+ * ⚠️ The UNION of both tables is deliberate, and is not the "two sources that
+ * disagree" problem the old column was. Neither is a copy — both are FK columns
+ * owned by the deploy path — and for a SAFETY guard the liberal read is the
+ * correct one: reporting an occupied box as free is how two modules land on one
+ * machine, while reporting a free box as occupied merely sends the operator to
+ * look. `module_infrastructure` records the CLAIM at selection time and
+ * `module_systems` the realized deployment, so a module mid-deploy is visible
+ * in the first before it appears in the second.
  */
-export async function getModuleResourcesOnMachine(machineId: string): Promise<ResourceAllocation> {
-  const machine = await getMachine(machineId);
-  if (!machine) {
-    throw new Error(`Machine not found: ${machineId}`);
-  }
-
-  // If no modules assigned, return zero allocation
-  if (machine.assignedModuleIds.length === 0) {
-    return { cpu: 0, memory: 0, disk: 0 };
-  }
-
-  const db = getDb();
-
-  // Get all module infrastructure records for this machine
-  const _infraRecords = await db
-    .select()
+export function getModulesOnMachine(machineId: string, db: DbClient = getDb()): string[] {
+  const claimed = db
+    .select({ moduleId: moduleInfrastructure.moduleId })
     .from(moduleInfrastructure)
-    .where(eq(moduleInfrastructure.machineId, machineId));
-
-  // TODO: Load module manifests to get resource requirements
-  // For now, return placeholder allocation
-  // This will be implemented when we integrate with module-generator
-
-  return { cpu: 0, memory: 0, disk: 0 };
+    .where(eq(moduleInfrastructure.machineId, machineId))
+    .all();
+  const deployed = db
+    .select({ moduleId: moduleSystems.moduleId })
+    .from(moduleSystems)
+    .where(eq(moduleSystems.machineId, machineId))
+    .all();
+
+  return [...new Set([...claimed, ...deployed].map((r) => r.moduleId))].sort();
 }
+
+// `getModuleResourcesOnMachine` is deleted (celilo#773, Rule 1.2 / 7.6).
+//
+// It queried `module_infrastructure`, discarded the result into an unused
+// variable, and returned `{cpu: 0, memory: 0, disk: 0}` behind a TODO. Its
+// three callers subtracted that zero from the machine's hardware before
+// comparing against the module's requirements — so the subtraction was
+// ceremony and the comparison was really "is this machine big enough at all".
+//
+// That is a genuinely useful check and it survives, stated plainly, in
+// `machineHasCapacity`. What is gone is the appearance of multi-tenant capacity
+// accounting that never accounted for anything: a gate nobody has seen fail is
+// not a gate, and one that cannot fail reads as protection that is not there.
+//
+// Real accounting needs a decision this issue does not make — whether a
+// module's draw is its manifest MINIMUM (`requires.system`) or its deployed
+// size, which for pool machines celilo does not own. That belongs to whoever
+// builds capacity-aware placement for the machine pool.

package/src/services/module-deploy.ts

@@ -59,38 +59,18 @@ export interface DeployResult {
   };
 }
 
-/**
- * Update machine's assigned module IDs after successful deployment
- * Execution function - updates database
- *
- * @param moduleId - Module identifier
- * @param machineId - Machine identifier
- * @param db - Database connection
- */
-async function updateMachineAssignment(
-  moduleId: string,
-  machineId: string,
-  db: DbClient,
-): Promise<void> {
-  // Get current machine record
-  const machine = await db.select().from(machines).where(eq(machines.id, machineId)).get();
-
-  if (!machine) {
-    throw new Error(`Machine not found: ${machineId}`);
-  }
-
-  // Add module ID if not already assigned
-  const assignedIds = machine.assignedModuleIds || [];
-  if (!assignedIds.includes(moduleId)) {
-    const updatedIds = [...assignedIds, moduleId];
-    await db
-      .update(machines)
-      .set({ assignedModuleIds: updatedIds })
-      .where(eq(machines.id, machineId))
-      .run();
-    log.success(`Machine ${machineId} updated with module assignment`);
-  }
-}
+// `updateMachineAssignment` is deleted (celilo#773).
+//
+// It was the sole writer of `machines.assigned_module_ids`, it only ever
+// APPENDED, and nothing ever removed an entry — `module remove` deletes the
+// module row and never touches `machines`. So a machine accumulated the ids of
+// modules that no longer existed and could never be freed except by editing the
+// database.
+//
+// Nothing replaces it. Occupancy is now derived from `module_infrastructure`
+// and `module_systems` at the point of use (`getModulesOnMachine`), both of
+// which the deploy path already writes and both of which cascade on module
+// removal — so the machine frees itself with no bookkeeping step to forget.
 
 export interface DeployOptions {
   debug?: boolean;
@@ -1203,13 +1183,11 @@ async function deployModuleImpl(
         };
       }
 
-      if (plan.infrastructure?.type === 'machine' && plan.infrastructure.machineId) {
-        // Update machine's assigned_module_ids
-        await updateMachineAssignment(moduleId, plan.infrastructure.machineId, db);
-      } else if (
-        plan.infrastructure?.type === 'container_service' &&
-        plan.infrastructure.serviceId
-      ) {
+      if (plan.infrastructure?.type === 'container_service' && plan.infrastructure.serviceId) {
+        // Placeholder branch retained below; the machine branch is gone because
+        // occupancy is no longer a stored fact to update (celilo#773).
+      }
+      if (plan.infrastructure?.type === 'container_service' && plan.infrastructure.serviceId) {
         // TODO: extract Terraform outputs and persist them on
         // module_infrastructure.containerMetadata. Until that lands,
         // the deploy still succeeds — we just don't track which

package/src/services/ssh-key-manager.test.ts

@@ -55,7 +55,6 @@ describe('a machine with no stored SSH key fails loudly, not silently', () => {
       hardware: { cpu_cores: 4, memory_mb: 4096, disk_gb: 100 },
       role: 'host',
       interfaces: [],
-      assignedModuleIds: [],
     });
 
     await expect(writeTemporarySshKey(machine.id)).rejects.toThrow(/has no SSH key stored/);
@@ -114,7 +113,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const keyPath = await writeTemporarySshKey(machine.id);
@@ -142,7 +140,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const keyPath = await writeTemporarySshKey(machine.id);
@@ -163,7 +160,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const keyPath = await writeTemporarySshKey(machine.id);
@@ -189,7 +185,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const machine2 = await addMachine({
@@ -201,7 +196,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const keyPath1 = await writeTemporarySshKey(machine1.id);
@@ -232,7 +226,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const managedKey = new ManagedSshKey(machine.id);
@@ -252,7 +245,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const managedKey = new ManagedSshKey(machine.id);
@@ -274,7 +266,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const managedKey = new ManagedSshKey(machine.id);
@@ -301,7 +292,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const managedKey = new ManagedSshKey(machine.id);

package/src/types/infrastructure.ts

@@ -90,7 +90,17 @@ export interface Machine {
   hardware: MachineHardware;
   role: MachineRole;
   interfaces: NetworkInterface[];
-  assignedModuleIds: string[];
+  // No `assignedModuleIds` (celilo#773). Occupancy is DERIVED — call
+  // `getModulesOnMachine(machineId)` in machine-pool.ts. It used to be a stored
+  // array with an append-only writer and no removal path, which diverged in
+  // both directions on the live fleet: a removed module's id stranded forever
+  // so placement rejected an empty box citing a module that no longer existed,
+  // and a machine genuinely hosting `iptables` reported "None (available)" so a
+  // second module could be placed on top of it.
+  //
+  // It is gone from the TYPE rather than merely unused, so nothing can read it
+  // back: leaving the field is what would let a new call site compile clean
+  // against a value nobody maintains (Rule 3.9).
   /** Module ID this machine is earmarked for, or null/undefined */
   earmarkedModule?: string | null;
   /**