@celilo/cli 0.5.0 → 0.7.0

package/src/cli/commands/system-update.ts

@@ -41,7 +41,7 @@ import {
 import type { SystemUpdateResult } from '../../services/update/types';
 import { getFlag, hasFlag } from '../parser';
 import type { CommandResult } from '../types';
-import { fetchAndUpgrade } from './module-upgrade';
+import { fetchAndUpdate } from './module-update';
 
 /**
  * Packages we manage via the global bun install. The self-update step
@@ -275,7 +275,7 @@ async function buildSnapshots(
  * - `backup` calls `createModuleBackup`. Modules without an
  *   `on_backup` hook return ok (nothing to back up; not an error).
  * - `upgrade` fetches the latest version from the registry and runs
- *   the in-place upgrade (`fetchAndUpgrade` from module-upgrade.ts).
+ *   the in-place upgrade (`fetchAndUpdate` from module-upgrade.ts).
  *   Same code path that `module update` uses for its sweep mode.
  * - `deploy` calls `deployModule`.
  * - `health` calls `runModuleHealthCheck`.
@@ -314,7 +314,7 @@ function buildOps(registry: RegistryClient, wasDeployed: Set<string>): Orchestra
         if (!latest) {
           return { ok: false, error: `${moduleId}: no non-yanked version` };
         }
-        const result = await fetchAndUpgrade(registry, moduleId, latest.vers, db, {});
+        const result = await fetchAndUpdate(registry, moduleId, latest.vers, db, {});
         if (result.status === 'success') return { ok: true };
         if (result.status === 'failed') return { ok: false, error: result.error };
         // 'skipped' isn't expected here (the module IS installed), but

package/src/cli/completion.ts

@@ -141,6 +141,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'remove',
       'search',
       'update',
+      'upgrade',
       'verify',
       'audit',
       'backup',
@@ -247,13 +248,21 @@ export async function getCompletions(words: string[], current: number): Promise<
   // Service subcommands
   // Proxmox subcommands
   if (command === 'proxmox' && currentIndex === 1) {
-    return filterSuggestions(['node'], args[1] || '');
+    return filterSuggestions(['node', 'vm', 'ct'], args[1] || '');
   }
   if (command === 'proxmox' && args[1] === 'node' && currentIndex === 2) {
     return filterSuggestions(['list'], args[2] || '');
   }
-  // proxmox node list <service-id> — proxmox services only
-  if (command === 'proxmox' && args[1] === 'node' && args[2] === 'list' && currentIndex === 3) {
+  if (command === 'proxmox' && (args[1] === 'vm' || args[1] === 'ct') && currentIndex === 2) {
+    return filterSuggestions(['list', 'resize'], args[2] || '');
+  }
+  // proxmox <node|vm|ct> list <service-id> — proxmox services only
+  if (
+    command === 'proxmox' &&
+    (args[1] === 'node' || args[1] === 'vm' || args[1] === 'ct') &&
+    args[2] === 'list' &&
+    currentIndex === 3
+  ) {
     const services = await listContainerServices();
     const serviceIds = services.filter((s) => s.providerName === 'proxmox').map((s) => s.serviceId);
     return filterSuggestions(serviceIds, args[3] || '');

package/src/cli/index.ts

@@ -63,9 +63,12 @@ import { handleModuleShowConfig, handleModuleShowZone } from './commands/module-
 import { handleModuleStatus } from './commands/module-status';
 import { handleModuleTerraformUnlock } from './commands/module-terraform-unlock';
 import { handleModuleTypesCheck, handleModuleTypesGenerate } from './commands/module-types';
+import { handleModuleUpdate } from './commands/module-update';
 import { handleModuleUpgrade } from './commands/module-upgrade';
 import { moduleVerify } from './commands/module-verify';
 import { handlePackage } from './commands/package';
+import { handleProxmoxInstanceList } from './commands/proxmox-instance-list';
+import { handleProxmoxInstanceResize } from './commands/proxmox-instance-resize';
 import { handleProxmoxNodeList } from './commands/proxmox-node-list';
 import { main as runPublish } from './commands/publish';
 import { handleSecretList } from './commands/secret-list';
@@ -1266,6 +1269,8 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
       case 'remove':
         return handleModuleRemove(parsed.args, parsed.flags);
       case 'update':
+        return handleModuleUpdate(parsed.args, parsed.flags);
+      case 'upgrade':
         return handleModuleUpgrade(parsed.args, parsed.flags);
       case 'audit':
         return moduleAudit(parsed.args);
@@ -1813,6 +1818,19 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
         error: 'Proxmox node action required (list)\n\nRun "celilo proxmox --help" for usage',
       };
     }
+    if (parsed.subcommand === 'vm' || parsed.subcommand === 'ct') {
+      const action = parsed.args[0];
+      if (action === 'list') {
+        return handleProxmoxInstanceList(parsed.subcommand, parsed.args.slice(1));
+      }
+      if (action === 'resize') {
+        return handleProxmoxInstanceResize(parsed.subcommand, parsed.args.slice(1), parsed.flags);
+      }
+      return {
+        success: false,
+        error: `Proxmox ${parsed.subcommand} action required (list, resize)\n\nRun "celilo proxmox --help" for usage`,
+      };
+    }
     return {
       success: false,
       error: `Unknown proxmox subcommand: ${parsed.subcommand}\n\nRun "celilo proxmox --help" for usage`,

package/src/db/schema.ts

@@ -392,6 +392,17 @@ export const moduleSystems = sqliteTable(
     serviceId: text('service_id').references(() => containerServices.id),
     /** Proxmox VMID — set only for proxmox containers. */
     vmid: integer('vmid'),
+    // Canonical deployed SIZE of this system (ISS-0150). For celilo-provisioned
+    // VM/LXC instances only (null for machine-pool systems celilo doesn't size).
+    // Seeded from the module's `requires.system` at first provision, then owned
+    // by `celilo proxmox … resize` — `requires.system` is only the minimum floor,
+    // never the live size. See CLAUDE.md "requires.system is the MINIMUM".
+    /** vCPU cores. */
+    cpu: integer('cpu'),
+    /** RAM in MB. */
+    memory: integer('memory'),
+    /** Root disk in GB. */
+    disk: integer('disk'),
     createdAt: integer('created_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
     updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
   },

package/src/hooks/capability-loader.ts

@@ -63,9 +63,13 @@ const CAPABILITY_MODULE_MAP: Record<string, { script: string; legacyFactoryName:
     script: 'scripts/idp-functions.ts',
     legacyFactoryName: 'createIdp',
   },
-  git_forge: {
-    script: 'scripts/git-forge-functions.ts',
-    legacyFactoryName: 'createForgejoGitForge',
+  source_forge: {
+    script: 'scripts/source-forge-functions.ts',
+    legacyFactoryName: 'createForgejoSourceForge',
+  },
+  registry_publish: {
+    script: 'scripts/registry-publish-functions.ts',
+    legacyFactoryName: 'default',
   },
   dhcp_server: {
     script: 'scripts/dhcp-server-functions.ts',

package/src/manifest/schema.ts

@@ -237,7 +237,9 @@ export type ComputedField = z.infer<typeof ComputedFieldSchema>;
 export const CapabilityProviderSchema = z.object({
   name: z.string().min(1),
   version: z.string().min(1),
-  data: z.record(z.unknown()),
+  // A purely imperative capability (functions-only, no cross-module data —
+  // e.g. registry_publish) carries no `data` block; default to {}.
+  data: z.record(z.unknown()).default({}),
   /**
    * Computed fields, merged into the capability's data namespace at access
    * time. A consumer reads `$capability:<name>.<computed-field>` exactly like

package/src/services/deploy-posture.test.ts

@@ -0,0 +1,106 @@
+import { describe, expect, test } from 'bun:test';
+import { classifyVersionDelta, parseVersion, resolveDeployPosture } from './deploy-posture';
+
+describe('parseVersion', () => {
+  test('parses major.minor.patch+build', () => {
+    expect(parseVersion('1.2.3+28')).toEqual({
+      major: 1,
+      minor: 2,
+      patch: 3,
+      prerelease: '',
+      build: '28',
+    });
+  });
+
+  test('parses a prerelease', () => {
+    expect(parseVersion('0.5.0-alpha.9')).toEqual({
+      major: 0,
+      minor: 5,
+      patch: 0,
+      prerelease: 'alpha.9',
+      build: '',
+    });
+  });
+
+  test('tolerates a bare version', () => {
+    expect(parseVersion('2.0.0')).toEqual({
+      major: 2,
+      minor: 0,
+      patch: 0,
+      prerelease: '',
+      build: '',
+    });
+  });
+});
+
+describe('classifyVersionDelta (highest-order component that changed)', () => {
+  test('major / minor / patch', () => {
+    expect(classifyVersionDelta('1.0.0', '2.0.0')).toBe('major');
+    expect(classifyVersionDelta('1.0.0', '1.1.0')).toBe('minor');
+    expect(classifyVersionDelta('1.0.0', '1.0.1')).toBe('patch');
+  });
+
+  test('build-metadata-only change is a revision', () => {
+    expect(classifyVersionDelta('1.0.1+27', '1.0.1+28')).toBe('revision');
+  });
+
+  test('prerelease-only change counts as patch (still fast)', () => {
+    expect(classifyVersionDelta('0.5.0-alpha.8', '0.5.0-alpha.9')).toBe('patch');
+  });
+
+  test('identical versions → none', () => {
+    expect(classifyVersionDelta('1.0.1+28', '1.0.1+28')).toBe('none');
+  });
+
+  test('highest-order wins when several components differ', () => {
+    expect(classifyVersionDelta('1.0.1+5', '1.1.0+1')).toBe('minor');
+  });
+});
+
+describe('resolveDeployPosture (precedence)', () => {
+  test('default by-semver: revision + patch ⇒ fast', () => {
+    expect(resolveDeployPosture({ installed: '1.0.1+1', next: '1.0.1+2' }).posture).toBe('fast');
+    expect(resolveDeployPosture({ installed: '1.0.1', next: '1.0.2' }).posture).toBe('fast');
+  });
+
+  test('default by-semver: minor + major ⇒ safe', () => {
+    expect(resolveDeployPosture({ installed: '1.0.0', next: '1.1.0' }).posture).toBe('safe');
+    expect(resolveDeployPosture({ installed: '1.0.0', next: '2.0.0' }).posture).toBe('safe');
+  });
+
+  test('per-release deploy_posture overrides the semver default', () => {
+    // a minor bump would default to safe; the release pins fast.
+    const r = resolveDeployPosture({ installed: '1.0.0', next: '1.1.0', releasePosture: 'fast' });
+    expect(r.posture).toBe('fast');
+    expect(r.reason).toContain('release deploy_posture');
+  });
+
+  test('module always-safe is a hard floor — beats a per-release fast', () => {
+    const r = resolveDeployPosture({
+      installed: '1.0.1',
+      next: '1.0.2',
+      releasePosture: 'fast',
+      modulePolicy: 'always-safe',
+    });
+    expect(r.posture).toBe('safe');
+    expect(r.reason).toContain('always-safe');
+  });
+
+  test('module always-fast forces fast on a minor bump (when no release override)', () => {
+    expect(
+      resolveDeployPosture({ installed: '1.0.0', next: '1.1.0', modulePolicy: 'always-fast' })
+        .posture,
+    ).toBe('fast');
+  });
+
+  test('a per-release safe still beats always-fast (release intent wins below the floor)', () => {
+    expect(
+      resolveDeployPosture({
+        installed: '1.0.1',
+        next: '1.0.2',
+        releasePosture: 'safe',
+        modulePolicy: 'always-fast',
+      }).posture,
+    ).toBe('safe');
+  });
+});

package/src/services/deploy-posture.ts

@@ -0,0 +1,87 @@
+/**
+ * Deploy posture — fast vs. safe — for `celilo module upgrade` (ISS-0138,
+ * v2/BUILD_BUS.md).
+ *
+ * CD is CI-driven, so no operator is present to pass `--no-backup`. The posture
+ * (fast = skip backup + extended verify; safe = backup + full verify) is
+ * DERIVED, with this precedence:
+ *   1. per-module `upgrade_policy: always-safe` — a hard floor (always safe).
+ *   2. per-release `deploy_posture` stamped in the .netapp release metadata.
+ *   3. per-module `upgrade_policy: always-fast`.
+ *   4. default: the semver delta of installed → next (revision/patch = fast;
+ *      minor/major = safe).
+ *
+ * celilo reads version NUMBERS, never changesets — the default needs only the
+ * versions. All functions here are pure (Rule 10).
+ */
+
+export type DeployPosture = 'fast' | 'safe';
+export type VersionDelta = 'none' | 'revision' | 'patch' | 'minor' | 'major';
+export type UpgradePolicy = 'by-semver' | 'always-safe' | 'always-fast';
+
+export interface ParsedVersion {
+  major: number;
+  minor: number;
+  patch: number;
+  /** prerelease tag, e.g. "alpha.2"; '' when absent. */
+  prerelease: string;
+  /** build metadata — celilo's `+N` registry revision; '' when absent. */
+  build: string;
+}
+
+/** Parse a celilo module version: `major.minor.patch[-prerelease][+build]`. */
+export function parseVersion(version: string): ParsedVersion {
+  const [coreAndPre = '', build = ''] = version.split('+');
+  const [core = '', prerelease = ''] = coreAndPre.split('-');
+  const parts = core.split('.');
+  const num = (i: number) => Number.parseInt(parts[i] ?? '', 10) || 0;
+  return { major: num(0), minor: num(1), patch: num(2), prerelease, build };
+}
+
+/**
+ * Classify the delta between an installed version and the next one by the
+ * highest-order component that changed. Assumes `next` >= `installed` (the poll
+ * only upgrades). A prerelease-only change counts as `patch` (still fast); a
+ * build-metadata-only change (`+N`) is `revision`.
+ */
+export function classifyVersionDelta(installed: string, next: string): VersionDelta {
+  const a = parseVersion(installed);
+  const b = parseVersion(next);
+  if (a.major !== b.major) return 'major';
+  if (a.minor !== b.minor) return 'minor';
+  if (a.patch !== b.patch) return 'patch';
+  if (a.prerelease !== b.prerelease) return 'patch';
+  if (a.build !== b.build) return 'revision';
+  return 'none';
+}
+
+/**
+ * Resolve the deploy posture for an upgrade. Precedence: `always-safe` floor →
+ * per-release override → `always-fast` → semver-delta default. Returns the
+ * posture plus a short reason for operator-visible logging.
+ */
+export function resolveDeployPosture(opts: {
+  installed: string;
+  next: string;
+  releasePosture?: DeployPosture | null;
+  modulePolicy?: UpgradePolicy;
+}): { posture: DeployPosture; reason: string } {
+  const policy = opts.modulePolicy ?? 'by-semver';
+
+  if (policy === 'always-safe') {
+    return { posture: 'safe', reason: 'module upgrade_policy=always-safe' };
+  }
+  if (opts.releasePosture) {
+    return {
+      posture: opts.releasePosture,
+      reason: `release deploy_posture=${opts.releasePosture}`,
+    };
+  }
+  if (policy === 'always-fast') {
+    return { posture: 'fast', reason: 'module upgrade_policy=always-fast' };
+  }
+
+  const delta = classifyVersionDelta(opts.installed, opts.next);
+  const posture: DeployPosture = delta === 'minor' || delta === 'major' ? 'safe' : 'fast';
+  return { posture, reason: `semver delta=${delta}` };
+}

package/src/services/deployed-systems.test.ts

@@ -1,6 +1,7 @@
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { existsSync } from 'node:fs';
 import { rm } from 'node:fs/promises';
+import { and, eq } from 'drizzle-orm';
 import { type DbClient, createDbClient } from '../db/client';
 import {
   containerServices,
@@ -10,7 +11,7 @@ import {
   moduleSystems,
   modules,
 } from '../db/schema';
-import { backfillModuleSystems, getModuleSystems } from './deployed-systems';
+import { backfillModuleSystems, getModuleSystems, upsertDeployedSystem } from './deployed-systems';
 
 const TEST_DB_PATH = './test-deployed-systems.db';
 
@@ -233,3 +234,74 @@ describe('backfillModuleSystems', () => {
     expect(getModuleSystems('namecheap', db)).toHaveLength(0);
   });
 });
+
+/**
+ * Canonical instance sizing (ISS-0150): sizing is seeded onto module_systems
+ * once at first provision and then OWNED by `celilo proxmox … resize` — a routine
+ * re-deploy must never reset a resized instance back to its manifest minimum.
+ */
+describe('upsertDeployedSystem sizing — seed-once (ISS-0150)', () => {
+  let db: DbClient;
+
+  beforeEach(() => {
+    db = createDbClient({ path: TEST_DB_PATH });
+    db.insert(modules)
+      .values({
+        id: 'm1',
+        name: 'm1',
+        version: '1.0.0',
+        manifestData: {},
+        sourcePath: '/tmp/m1',
+        state: 'VERIFIED',
+      })
+      .run();
+  });
+
+  afterEach(async () => {
+    db.$client.close();
+    for (const suffix of ['', '-shm', '-wal']) {
+      const p = `${TEST_DB_PATH}${suffix}`;
+      if (existsSync(p)) await rm(p);
+    }
+  });
+
+  const sizeArgs = (memory: number) => ({
+    name: 'main',
+    hostname: 'h',
+    ipv4Address: '10.0.0.5/24',
+    zone: 'app' as const,
+    infraType: 'container_service' as const,
+    vmid: 200,
+    cpu: 4,
+    memory,
+    disk: 80,
+  });
+
+  const row = () =>
+    db
+      .select()
+      .from(moduleSystems)
+      .where(and(eq(moduleSystems.moduleId, 'm1'), eq(moduleSystems.name, 'main')))
+      .get();
+
+  test('seeds sizing on first insert', () => {
+    upsertDeployedSystem(db, 'm1', sizeArgs(8192));
+    const r = row();
+    expect(r?.cpu).toBe(4);
+    expect(r?.memory).toBe(8192);
+    expect(r?.disk).toBe(80);
+  });
+
+  test('a re-deploy does NOT reset a resized instance to the manifest minimum', () => {
+    upsertDeployedSystem(db, 'm1', sizeArgs(8192)); // first provision: seed 8 GB
+    // Simulate `celilo proxmox vm resize` bumping the canonical size to 16 GB.
+    db.update(moduleSystems)
+      .set({ memory: 16384 })
+      .where(and(eq(moduleSystems.moduleId, 'm1'), eq(moduleSystems.name, 'main')))
+      .run();
+    // Re-deploy passes the manifest minimum (8 GB) again — must be ignored.
+    upsertDeployedSystem(db, 'm1', sizeArgs(8192));
+    expect(row()?.memory).toBe(16384);
+    expect(row()?.cpu).toBe(4);
+  });
+});

package/src/services/deployed-systems.ts

@@ -52,6 +52,52 @@ export function getModuleSystems(moduleId: string, db: DbClient): DeployedSystem
   return rows.map(rowToSystem).sort((a, b) => a.name.localeCompare(b.name));
 }
 
+/**
+ * A celilo-provisioned instance with its canonical size (ISS-0150). CLI-internal
+ * shape (NOT the `DeployedSystem` capability type) for the `celilo proxmox
+ * vm/ct …` surface, which needs the sizing columns the capability type omits.
+ */
+export interface ProvisionedSystem {
+  moduleId: string;
+  name: string;
+  hostname: string;
+  ipv4Address: string;
+  zone: NetworkZone;
+  serviceId: string | null;
+  vmid: number | null;
+  /** Canonical desired size (null until seeded / for non-Proxmox). */
+  cpu: number | null;
+  memory: number | null;
+  disk: number | null;
+}
+
+/**
+ * Every celilo-provisioned (container_service) system with a Proxmox vmid, across
+ * all modules, including its canonical sizing — the read model behind
+ * `celilo proxmox vm/ct list|show`. Ordered by vmid for stable output.
+ */
+export function getProvisionedSystems(db: DbClient): ProvisionedSystem[] {
+  return db
+    .select()
+    .from(moduleSystems)
+    .where(eq(moduleSystems.infraType, 'container_service'))
+    .all()
+    .filter((r) => r.vmid != null)
+    .map((r) => ({
+      moduleId: r.moduleId,
+      name: r.name,
+      hostname: r.hostname,
+      ipv4Address: r.ipv4Address,
+      zone: r.zone,
+      serviceId: r.serviceId,
+      vmid: r.vmid,
+      cpu: r.cpu,
+      memory: r.memory,
+      disk: r.disk,
+    }))
+    .sort((a, b) => (a.vmid ?? 0) - (b.vmid ?? 0));
+}
+
 /**
  * All container_service systems (Proxmox LXCs, droplets, …) whose zone is in
  * `zones`, across every module — the LXC complement to machine-pool's
@@ -93,6 +139,15 @@ export interface DeployedSystemInput {
   machineId?: string | null;
   serviceId?: string | null;
   vmid?: number | null;
+  /**
+   * Canonical deployed size (ISS-0150), seeded from the module's
+   * `requires.system` at first provision. Seed-once: written on INSERT only and
+   * preserved across re-deploys (omitted from the conflict update), so a later
+   * `celilo proxmox … resize` is not reset back to the manifest minimum.
+   */
+  cpu?: number | null;
+  memory?: number | null;
+  disk?: number | null;
 }
 
 /**
@@ -117,6 +172,11 @@ export function upsertDeployedSystem(
       machineId: system.machineId ?? null,
       serviceId: system.serviceId ?? null,
       vmid: system.vmid ?? null,
+      // Seed-once (ISS-0150): set on insert; deliberately omitted from the
+      // conflict update below so a resize survives re-deploys.
+      cpu: system.cpu ?? null,
+      memory: system.memory ?? null,
+      disk: system.disk ?? null,
       updatedAt: new Date(),
     })
     .onConflictDoUpdate({
@@ -129,6 +189,9 @@ export function upsertDeployedSystem(
         machineId: system.machineId ?? null,
         serviceId: system.serviceId ?? null,
         vmid: system.vmid ?? null,
+        // NOTE: cpu/memory/disk intentionally NOT updated here — sizing is
+        // canonical state owned by `celilo proxmox … resize`, not reset by a
+        // routine re-deploy (seed-once). See ISS-0150 / CLAUDE.md.
         updatedAt: new Date(),
       },
     })
@@ -207,6 +270,11 @@ export async function recordDeployedSystemForModule(
     machineId: infrastructure?.machineId ?? null,
     serviceId: infrastructure?.serviceId ?? null,
     vmid: Number.isNaN(vmid as number) ? null : vmid,
+    // Seed canonical size from requires.system (seed-once; preserved across
+    // re-deploys). Only meaningful for celilo-provisioned instances.
+    cpu: decl.resources.cpu ?? null,
+    memory: decl.resources.memory ?? null,
+    disk: decl.resources.disk ?? null,
   });
 
   return getModuleSystems(moduleId, db);
@@ -279,6 +347,10 @@ export function backfillModuleSystems(db: DbClient): string[] {
       machineId: infra.machineId ?? null,
       serviceId: infra.serviceId ?? null,
       vmid: vmid != null && !Number.isNaN(vmid) ? vmid : null,
+      // Seed canonical size from requires.system for upgraded deployments.
+      cpu: decl.resources.cpu ?? null,
+      memory: decl.resources.memory ?? null,
+      disk: decl.resources.disk ?? null,
     });
     backfilled.push(infra.moduleId);
   }

package/src/services/module-subscriptions.test.ts

@@ -1,9 +1,12 @@
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { defineEvents, openBus } from '@celilo/event-bus';
+import { parse as parseYaml } from 'yaml';
 import { closeDb, getDb } from '../db/client';
+import { ModuleManifestSchema } from '../manifest/schema';
 import { ModuleSubscriptionSchema } from '../manifest/schema';
 import type { ModuleManifest } from '../manifest/schema';
 import { setupTestDatabase as migrateDbFile } from '../test-utils/setup-test-db';
@@ -341,3 +344,30 @@ describe('resyncAllSubscriptions (ISS-0088)', () => {
     expect(subscriberNames()).toEqual(['caddy.reconcile']);
   });
 });
+
+describe('build-bus registry-poll wiring (ISS-0139)', () => {
+  // The CD poll is wired as a celilo-mgmt manifest subscription so it registers
+  // ONLY on the management host. Guard the exact handler/pattern against drift.
+  const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..');
+
+  it('celilo-mgmt subscribes the registry poll to timer.tick.15m', () => {
+    const manifestPath = join(REPO_ROOT, 'modules', 'celilo-mgmt', 'manifest.yml');
+    const manifest = ModuleManifestSchema.parse(parseYaml(readFileSync(manifestPath, 'utf-8')));
+
+    const poll = manifest.subscriptions?.find((s) => s.name === 'registry-poll');
+    expect(poll).toBeDefined();
+    expect(poll?.pattern).toBe('timer.tick.15m');
+    // A literal handler command (the CLI poll), not a hook — see manifest comment.
+    expect(poll?.handler).toBe('celilo module upgrade');
+    expect(poll?.hook).toBeUndefined();
+
+    const resolved = resolveSubscription(
+      // biome-ignore lint/style/noNonNullAssertion: asserted defined above
+      poll!,
+      'celilo-mgmt',
+      '/modules/celilo-mgmt',
+    );
+    expect(resolved.name).toBe('celilo-mgmt.registry-poll');
+    expect(resolved.handler).toBe('celilo module upgrade');
+  });
+});

package/src/variables/context.ts

@@ -8,6 +8,7 @@ import {
   machines,
   moduleConfigs,
   moduleInfrastructure,
+  moduleSystems,
   modules,
   secrets,
   systemConfig,
@@ -264,20 +265,48 @@ export async function buildResolutionContext(
     const systemResources = getSingularSystemSpec(manifest);
 
     if (systemResources) {
-      // Map manifest fields to module variable names and apply defaults
+      // The DEPLOYED size is the SYSTEM's canonical state (ISS-0150), seeded from
+      // requires.system at first provision and thereafter owned by
+      // `celilo proxmox … resize`. So sizing flows: module_systems → these config
+      // vars → `$self:{cores,memory,disk}` in the instance Terraform.
+      //
+      // Precedence: the recorded system size WINS and overwrites the cached
+      // config (a resize must propagate on the next generate); only when this
+      // module has no recorded system size yet (the very first provision, before
+      // recordDeployedSystemForModule runs below) do we fall back to
+      // requires.system — and seed-when-unset, matching the prior behavior so the
+      // first-deploy / golden output is unchanged. `requires.system` stays the
+      // minimum floor, never the canonical size. (CLAUDE.md / ISS-0150.)
+      const sizedRow = db
+        .select({
+          cpu: moduleSystems.cpu,
+          memory: moduleSystems.memory,
+          disk: moduleSystems.disk,
+        })
+        .from(moduleSystems)
+        .where(eq(moduleSystems.moduleId, moduleId))
+        .all()
+        .find((r) => r.cpu != null || r.memory != null || r.disk != null);
+
       const resourceMappings: Array<{
         manifestKey: keyof typeof systemResources;
         configKey: string;
+        systemValue: number | null | undefined;
       }> = [
-        { manifestKey: 'cpu', configKey: 'cores' }, // manifest.requires.system.cpu → cores variable
-        { manifestKey: 'memory', configKey: 'memory' },
-        { manifestKey: 'disk', configKey: 'disk' },
-        { manifestKey: 'storage', configKey: 'storage' },
+        { manifestKey: 'cpu', configKey: 'cores', systemValue: sizedRow?.cpu }, // requires.system.cpu → cores
+        { manifestKey: 'memory', configKey: 'memory', systemValue: sizedRow?.memory },
+        { manifestKey: 'disk', configKey: 'disk', systemValue: sizedRow?.disk },
+        { manifestKey: 'storage', configKey: 'storage', systemValue: undefined }, // pool name, not sizing
       ];
 
-      for (const { manifestKey, configKey } of resourceMappings) {
+      for (const { manifestKey, configKey, systemValue } of resourceMappings) {
+        if (systemValue != null) {
+          // Canonical system size — always wins so a resize propagates.
+          upsertModuleConfig(db, moduleId, configKey, systemValue);
+          selfConfig[configKey] = String(systemValue);
+          continue;
+        }
         const value = systemResources[manifestKey];
-
         // Manifest fields are typed (cpu: number, storage: string, etc.).
         // Pass them through unstringified so valueJson preserves the
         // shape — see comment in the variable-defaults block above.