@celilo/cli 0.8.1 → 0.9.0

package/src/cli/commands/proxmox-service.ts

@@ -0,0 +1,38 @@
+/**
+ * Shared Proxmox-service resolution for the `celilo proxmox …` command tree
+ * (node list, vm/ct list|show|resize). Resolves an explicit service-id arg, else
+ * the sole Proxmox service; errors when ambiguous or unknown.
+ */
+
+import type { listContainerServices } from '../../services/container-service';
+
+type Services = Awaited<ReturnType<typeof listContainerServices>>;
+
+export function resolveProxmoxService(
+  services: Services,
+  requested: string | undefined,
+): { service: Services[number] } | { error: string } {
+  const proxmox = services.filter((s) => s.providerName === 'proxmox');
+  if (proxmox.length === 0) {
+    return {
+      error: 'No Proxmox container service configured. Add one: celilo service add proxmox',
+    };
+  }
+  if (requested) {
+    const match = proxmox.find((s) => s.serviceId === requested);
+    if (!match) {
+      return {
+        error: `No Proxmox service '${requested}'. Known: ${proxmox.map((s) => s.serviceId).join(', ')}`,
+      };
+    }
+    return { service: match };
+  }
+  if (proxmox.length > 1) {
+    return {
+      error: `Multiple Proxmox services — specify one with <service-id>:\n  ${proxmox
+        .map((s) => s.serviceId)
+        .join('\n  ')}`,
+    };
+  }
+  return { service: proxmox[0] };
+}

package/src/cli/completion.ts

@@ -248,13 +248,21 @@ export async function getCompletions(words: string[], current: number): Promise<
   // Service subcommands
   // Proxmox subcommands
   if (command === 'proxmox' && currentIndex === 1) {
-    return filterSuggestions(['node'], args[1] || '');
+    return filterSuggestions(['node', 'vm', 'ct'], args[1] || '');
   }
   if (command === 'proxmox' && args[1] === 'node' && currentIndex === 2) {
     return filterSuggestions(['list'], args[2] || '');
   }
-  // proxmox node list <service-id> — proxmox services only
-  if (command === 'proxmox' && args[1] === 'node' && args[2] === 'list' && currentIndex === 3) {
+  if (command === 'proxmox' && (args[1] === 'vm' || args[1] === 'ct') && currentIndex === 2) {
+    return filterSuggestions(['list', 'resize'], args[2] || '');
+  }
+  // proxmox <node|vm|ct> list <service-id> — proxmox services only
+  if (
+    command === 'proxmox' &&
+    (args[1] === 'node' || args[1] === 'vm' || args[1] === 'ct') &&
+    args[2] === 'list' &&
+    currentIndex === 3
+  ) {
     const services = await listContainerServices();
     const serviceIds = services.filter((s) => s.providerName === 'proxmox').map((s) => s.serviceId);
     return filterSuggestions(serviceIds, args[3] || '');

package/src/cli/index.ts

@@ -69,6 +69,8 @@ import { handleModuleUpgrade } from './commands/module-upgrade';
 import { moduleVerify } from './commands/module-verify';
 import { handleModuleVersion } from './commands/module-version';
 import { handlePackage } from './commands/package';
+import { handleProxmoxInstanceList } from './commands/proxmox-instance-list';
+import { handleProxmoxInstanceResize } from './commands/proxmox-instance-resize';
 import { handleProxmoxNodeList } from './commands/proxmox-node-list';
 import { main as runPublish } from './commands/publish';
 import { handleSecretList } from './commands/secret-list';
@@ -1822,6 +1824,19 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
         error: 'Proxmox node action required (list)\n\nRun "celilo proxmox --help" for usage',
       };
     }
+    if (parsed.subcommand === 'vm' || parsed.subcommand === 'ct') {
+      const action = parsed.args[0];
+      if (action === 'list') {
+        return handleProxmoxInstanceList(parsed.subcommand, parsed.args.slice(1));
+      }
+      if (action === 'resize') {
+        return handleProxmoxInstanceResize(parsed.subcommand, parsed.args.slice(1), parsed.flags);
+      }
+      return {
+        success: false,
+        error: `Proxmox ${parsed.subcommand} action required (list, resize)\n\nRun "celilo proxmox --help" for usage`,
+      };
+    }
     return {
       success: false,
       error: `Unknown proxmox subcommand: ${parsed.subcommand}\n\nRun "celilo proxmox --help" for usage`,

package/src/db/schema.ts

@@ -392,6 +392,17 @@ export const moduleSystems = sqliteTable(
     serviceId: text('service_id').references(() => containerServices.id),
     /** Proxmox VMID — set only for proxmox containers. */
     vmid: integer('vmid'),
+    // Canonical deployed SIZE of this system (ISS-0150). For celilo-provisioned
+    // VM/LXC instances only (null for machine-pool systems celilo doesn't size).
+    // Seeded from the module's `requires.system` at first provision, then owned
+    // by `celilo proxmox … resize` — `requires.system` is only the minimum floor,
+    // never the live size. See CLAUDE.md "requires.system is the MINIMUM".
+    /** vCPU cores. */
+    cpu: integer('cpu'),
+    /** RAM in MB. */
+    memory: integer('memory'),
+    /** Root disk in GB. */
+    disk: integer('disk'),
     createdAt: integer('created_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
     updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
   },
@@ -492,8 +503,17 @@ export const dnsInternalRecords = sqliteTable(
       .references(() => modules.id, { onDelete: 'cascade' }),
     /** The registered hostname (e.g. "git-ssh.git.celilo.computer"). */
     host: text('host').notNull(),
-    /** The A-record value celilo asked the resolver to serve. */
+    /** The A-record value celilo asked the resolver to serve — the LAN/default
+     *  answer (firewall natIp for a caddy-fronted host). */
     ip: text('ip').notNull(),
+    /**
+     * In-zone split-horizon answer (caddy's zone-routable IP), when this is a
+     * caddy-fronted hostname that needs source-based views (ISS-0156,
+     * v2/INTERNAL_DNS_ZONE_VIEWS.md). NULL for records with no zone override
+     * (per-system identity, plain A records). This column is the durable
+     * desired-state the resolver's view config is reconciled from.
+     */
+    zoneRoutableIp: text('zone_routable_ip'),
     registeredAt: integer('registered_at', { mode: 'timestamp' })
       .notNull()
       .default(sql`(unixepoch())`),

package/src/hooks/capability-loader.ts

@@ -124,6 +124,28 @@ export async function resolveFirewallNatIp(db: DbClient): Promise<string | undef
   return undefined;
 }
 
+/**
+ * Caddy's zone-routable IP — its own DMZ ingress address (`target_ip`, the same
+ * value public_web exposes as `dmz_ip`). This is the in-zone split-horizon
+ * answer (ISS-0156): clients INSIDE the segmented zones reach caddy here, since
+ * they can't route to the firewall natIp. Returns undefined when no public_web
+ * provider advertises a `target_ip`. Shared by the live public_web registration
+ * and the deploy-time backfill so both write the same `zoneRoutableValue`.
+ */
+export async function resolveCaddyZoneIp(db: DbClient): Promise<string | undefined> {
+  const webProviders = db
+    .select()
+    .from(capabilities)
+    .where(eq(capabilities.capabilityName, 'public_web'))
+    .all();
+  for (const wp of webProviders) {
+    const cfg = await loadModuleConfig(wp.moduleId, db);
+    const ip = String(cfg.target_ip ?? '').split('/')[0];
+    if (ip) return ip;
+  }
+  return undefined;
+}
+
 export async function loadCapabilityFunctions(
   consumingModuleId: string,
   db: DbClient,

package/src/manifest/template-validator.test.ts

@@ -1,6 +1,13 @@
 import { describe, expect, test } from 'bun:test';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import type { ModuleManifest } from './schema';
-import { type TemplateValidationError, formatTemplateValidationErrors } from './template-validator';
+import {
+  type TemplateValidationError,
+  formatTemplateValidationErrors,
+  validateModuleTemplates,
+} from './template-validator';
 
 /**
  * Create a minimal valid manifest for testing
@@ -66,6 +73,29 @@ describe('template-validator', () => {
       expect(system?.storage).toBe('local-lvm');
     });
 
+    test('accepts $self:{cores,memory,disk,storage} as auto-allocated sizing (ISS-0150)', async () => {
+      // ISS-0150 repointed instance Terraform to read $self:cores/memory/disk/
+      // storage, which are injected at generate time from module_systems (see
+      // variables/context.ts) — not declared in the manifest. They must validate
+      // at `module import` time like vmid/target_ip, or every VM/CT module fails
+      // to import. Regression guard: this previously errored "Self variable
+      // 'cores' not found in module configuration".
+      const manifest = createTestManifest();
+      const dir = await mkdtemp(join(tmpdir(), 'celilo-tpl-'));
+      try {
+        await mkdir(join(dir, 'terraform'), { recursive: true });
+        await writeFile(
+          join(dir, 'terraform/main.tf.tpl'),
+          'cores  = $self:cores\nmemory = $self:memory\ndisk   = $self:disk\nstorage = "$self:storage"\n',
+        );
+        const result = await validateModuleTemplates(dir, manifest);
+        expect(result.errors).toEqual([]);
+        expect(result.success).toBe(true);
+      } finally {
+        await rm(dir, { recursive: true, force: true });
+      }
+    });
+
     test('validates capability references', async () => {
       const manifest = createTestManifest({
         requires: {

package/src/manifest/template-validator.ts

@@ -73,6 +73,15 @@ const AUTO_ALLOCATED_VARIABLES = new Set([
   'gateway', // Auto-derived from zone configuration
   'target_node', // Can be auto-derived from system config
   'lxc_nameserver', // Composed at generate time from dns_internal + dns.primary (v2/LXC_INTERNAL_DNS.md)
+  // Instance sizing (ISS-0150): the instance Terraform reads $self:{cores,memory,
+  // disk,storage}, which are injected during resolution from the module_systems
+  // table (falling back to requires.system.*) — see variables/context.ts. Like
+  // vmid/target_ip they are populated at generate time, not declared in the
+  // manifest, so they are auto-allocated rather than import-time validation errors.
+  'cores', // requires.system.cpu / module_systems.cpu
+  'memory', // requires.system.memory / module_systems.memory
+  'disk', // requires.system.disk / module_systems.disk
+  'storage', // storage pool name (requires.system.storage)
 ]);
 
 /**

package/src/services/deployed-systems.test.ts

@@ -1,6 +1,7 @@
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { existsSync } from 'node:fs';
 import { rm } from 'node:fs/promises';
+import { and, eq } from 'drizzle-orm';
 import { type DbClient, createDbClient } from '../db/client';
 import {
   containerServices,
@@ -10,7 +11,7 @@ import {
   moduleSystems,
   modules,
 } from '../db/schema';
-import { backfillModuleSystems, getModuleSystems } from './deployed-systems';
+import { backfillModuleSystems, getModuleSystems, upsertDeployedSystem } from './deployed-systems';
 
 const TEST_DB_PATH = './test-deployed-systems.db';
 
@@ -233,3 +234,74 @@ describe('backfillModuleSystems', () => {
     expect(getModuleSystems('namecheap', db)).toHaveLength(0);
   });
 });
+
+/**
+ * Canonical instance sizing (ISS-0150): sizing is seeded onto module_systems
+ * once at first provision and then OWNED by `celilo proxmox … resize` — a routine
+ * re-deploy must never reset a resized instance back to its manifest minimum.
+ */
+describe('upsertDeployedSystem sizing — seed-once (ISS-0150)', () => {
+  let db: DbClient;
+
+  beforeEach(() => {
+    db = createDbClient({ path: TEST_DB_PATH });
+    db.insert(modules)
+      .values({
+        id: 'm1',
+        name: 'm1',
+        version: '1.0.0',
+        manifestData: {},
+        sourcePath: '/tmp/m1',
+        state: 'VERIFIED',
+      })
+      .run();
+  });
+
+  afterEach(async () => {
+    db.$client.close();
+    for (const suffix of ['', '-shm', '-wal']) {
+      const p = `${TEST_DB_PATH}${suffix}`;
+      if (existsSync(p)) await rm(p);
+    }
+  });
+
+  const sizeArgs = (memory: number) => ({
+    name: 'main',
+    hostname: 'h',
+    ipv4Address: '10.0.0.5/24',
+    zone: 'app' as const,
+    infraType: 'container_service' as const,
+    vmid: 200,
+    cpu: 4,
+    memory,
+    disk: 80,
+  });
+
+  const row = () =>
+    db
+      .select()
+      .from(moduleSystems)
+      .where(and(eq(moduleSystems.moduleId, 'm1'), eq(moduleSystems.name, 'main')))
+      .get();
+
+  test('seeds sizing on first insert', () => {
+    upsertDeployedSystem(db, 'm1', sizeArgs(8192));
+    const r = row();
+    expect(r?.cpu).toBe(4);
+    expect(r?.memory).toBe(8192);
+    expect(r?.disk).toBe(80);
+  });
+
+  test('a re-deploy does NOT reset a resized instance to the manifest minimum', () => {
+    upsertDeployedSystem(db, 'm1', sizeArgs(8192)); // first provision: seed 8 GB
+    // Simulate `celilo proxmox vm resize` bumping the canonical size to 16 GB.
+    db.update(moduleSystems)
+      .set({ memory: 16384 })
+      .where(and(eq(moduleSystems.moduleId, 'm1'), eq(moduleSystems.name, 'main')))
+      .run();
+    // Re-deploy passes the manifest minimum (8 GB) again — must be ignored.
+    upsertDeployedSystem(db, 'm1', sizeArgs(8192));
+    expect(row()?.memory).toBe(16384);
+    expect(row()?.cpu).toBe(4);
+  });
+});

package/src/services/deployed-systems.ts

@@ -52,6 +52,52 @@ export function getModuleSystems(moduleId: string, db: DbClient): DeployedSystem
   return rows.map(rowToSystem).sort((a, b) => a.name.localeCompare(b.name));
 }
 
+/**
+ * A celilo-provisioned instance with its canonical size (ISS-0150). CLI-internal
+ * shape (NOT the `DeployedSystem` capability type) for the `celilo proxmox
+ * vm/ct …` surface, which needs the sizing columns the capability type omits.
+ */
+export interface ProvisionedSystem {
+  moduleId: string;
+  name: string;
+  hostname: string;
+  ipv4Address: string;
+  zone: NetworkZone;
+  serviceId: string | null;
+  vmid: number | null;
+  /** Canonical desired size (null until seeded / for non-Proxmox). */
+  cpu: number | null;
+  memory: number | null;
+  disk: number | null;
+}
+
+/**
+ * Every celilo-provisioned (container_service) system with a Proxmox vmid, across
+ * all modules, including its canonical sizing — the read model behind
+ * `celilo proxmox vm/ct list|show`. Ordered by vmid for stable output.
+ */
+export function getProvisionedSystems(db: DbClient): ProvisionedSystem[] {
+  return db
+    .select()
+    .from(moduleSystems)
+    .where(eq(moduleSystems.infraType, 'container_service'))
+    .all()
+    .filter((r) => r.vmid != null)
+    .map((r) => ({
+      moduleId: r.moduleId,
+      name: r.name,
+      hostname: r.hostname,
+      ipv4Address: r.ipv4Address,
+      zone: r.zone,
+      serviceId: r.serviceId,
+      vmid: r.vmid,
+      cpu: r.cpu,
+      memory: r.memory,
+      disk: r.disk,
+    }))
+    .sort((a, b) => (a.vmid ?? 0) - (b.vmid ?? 0));
+}
+
 /**
  * All container_service systems (Proxmox LXCs, droplets, …) whose zone is in
  * `zones`, across every module — the LXC complement to machine-pool's
@@ -93,6 +139,15 @@ export interface DeployedSystemInput {
   machineId?: string | null;
   serviceId?: string | null;
   vmid?: number | null;
+  /**
+   * Canonical deployed size (ISS-0150), seeded from the module's
+   * `requires.system` at first provision. Seed-once: written on INSERT only and
+   * preserved across re-deploys (omitted from the conflict update), so a later
+   * `celilo proxmox … resize` is not reset back to the manifest minimum.
+   */
+  cpu?: number | null;
+  memory?: number | null;
+  disk?: number | null;
 }
 
 /**
@@ -117,6 +172,11 @@ export function upsertDeployedSystem(
       machineId: system.machineId ?? null,
       serviceId: system.serviceId ?? null,
       vmid: system.vmid ?? null,
+      // Seed-once (ISS-0150): set on insert; deliberately omitted from the
+      // conflict update below so a resize survives re-deploys.
+      cpu: system.cpu ?? null,
+      memory: system.memory ?? null,
+      disk: system.disk ?? null,
       updatedAt: new Date(),
     })
     .onConflictDoUpdate({
@@ -129,6 +189,9 @@ export function upsertDeployedSystem(
         machineId: system.machineId ?? null,
         serviceId: system.serviceId ?? null,
         vmid: system.vmid ?? null,
+        // NOTE: cpu/memory/disk intentionally NOT updated here — sizing is
+        // canonical state owned by `celilo proxmox … resize`, not reset by a
+        // routine re-deploy (seed-once). See ISS-0150 / CLAUDE.md.
         updatedAt: new Date(),
       },
     })
@@ -207,6 +270,11 @@ export async function recordDeployedSystemForModule(
     machineId: infrastructure?.machineId ?? null,
     serviceId: infrastructure?.serviceId ?? null,
     vmid: Number.isNaN(vmid as number) ? null : vmid,
+    // Seed canonical size from requires.system (seed-once; preserved across
+    // re-deploys). Only meaningful for celilo-provisioned instances.
+    cpu: decl.resources.cpu ?? null,
+    memory: decl.resources.memory ?? null,
+    disk: decl.resources.disk ?? null,
   });
 
   return getModuleSystems(moduleId, db);
@@ -279,6 +347,10 @@ export function backfillModuleSystems(db: DbClient): string[] {
       machineId: infra.machineId ?? null,
       serviceId: infra.serviceId ?? null,
       vmid: vmid != null && !Number.isNaN(vmid) ? vmid : null,
+      // Seed canonical size from requires.system for upgraded deployments.
+      cpu: decl.resources.cpu ?? null,
+      memory: decl.resources.memory ?? null,
+      disk: decl.resources.disk ?? null,
     });
     backfilled.push(infra.moduleId);
   }

package/src/services/dns-internal-records.test.ts

@@ -3,11 +3,13 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { DnsRecordRequest } from '@celilo/capabilities';
+import type { ViewOverride } from '@celilo/capabilities';
 import type { DbClient } from '../db/client';
 import { modules } from '../db/schema';
 import { setupTestDatabase } from '../test-utils/setup-test-db';
 import {
   listDnsInternalRecords,
+  listViewOverrides,
   recordDnsInternalRecord,
   removeDnsInternalRecord,
   withDnsInternalLedger,
@@ -70,10 +72,27 @@ describe('dns-internal-records ledger', () => {
     expect(rows.map((r) => r.host)).toEqual(['b.x']);
   });
 
+  it('listViewOverrides returns only fronted records (zone IP set), as host→zoneIp', () => {
+    recordDnsInternalRecord(db, { ...ctx(), host: 'plain.x', ip: '192.168.0.253' });
+    recordDnsInternalRecord(db, {
+      ...ctx(),
+      host: 'git.celilo.computer',
+      ip: '192.168.0.253',
+      zoneRoutableIp: '10.0.10.10',
+    });
+    const overrides = listViewOverrides(db, 'technitium');
+    expect(overrides).toEqual([{ host: 'git.celilo.computer', ip: '10.0.10.10' }]);
+  });
+
   describe('withDnsInternalLedger', () => {
-    function fakeProvider() {
+    function fakeProvider(withViews = false) {
       const calls: Array<['register' | 'delete', DnsRecordRequest]> = [];
-      const iface = {
+      const reconcileCalls: ViewOverride[][] = [];
+      const iface: {
+        registerRecord(req: DnsRecordRequest): Promise<void>;
+        deleteRecord(req: DnsRecordRequest): Promise<void>;
+        reconcileViews?(o: ViewOverride[]): Promise<void>;
+      } = {
         async registerRecord(req: DnsRecordRequest) {
           calls.push(['register', req]);
         },
@@ -81,7 +100,12 @@ describe('dns-internal-records ledger', () => {
           calls.push(['delete', req]);
         },
       };
-      return { iface, calls };
+      if (withViews) {
+        iface.reconcileViews = async (o: ViewOverride[]) => {
+          reconcileCalls.push(o);
+        };
+      }
+      return { iface, calls, reconcileCalls };
     }
 
     it('records A-record registrations and passes the call through', async () => {
@@ -109,6 +133,55 @@ describe('dns-internal-records ledger', () => {
       expect(listDnsInternalRecords(db)).toHaveLength(0);
     });
 
+    it('reconciles views from the full ledger set when a fronted record is registered', async () => {
+      const { iface, reconcileCalls } = fakeProvider(true);
+      const wrapped = withDnsInternalLedger(iface, ctx());
+      // A plain (non-fronted) record must NOT trigger a view reconcile.
+      await wrapped.registerRecord({ host: 'plain.x', type: 'A', value: '192.168.0.253' });
+      expect(reconcileCalls).toHaveLength(0);
+      // A fronted record (zoneRoutableValue set) triggers a reconcile from the
+      // COMPLETE fronted set in the ledger.
+      await wrapped.registerRecord({
+        host: 'git.celilo.computer',
+        type: 'A',
+        value: '192.168.0.253',
+        zoneRoutableValue: '10.0.10.10',
+      });
+      expect(reconcileCalls).toHaveLength(1);
+      expect(reconcileCalls[0]).toEqual([{ host: 'git.celilo.computer', ip: '10.0.10.10' }]);
+    });
+
+    it('reconciles views on delete (a removed host drops from the set)', async () => {
+      const { iface, reconcileCalls } = fakeProvider(true);
+      const wrapped = withDnsInternalLedger(iface, ctx());
+      await wrapped.registerRecord({
+        host: 'git.celilo.computer',
+        type: 'A',
+        value: '192.168.0.253',
+        zoneRoutableValue: '10.0.10.10',
+      });
+      await wrapped.deleteRecord({
+        host: 'git.celilo.computer',
+        type: 'A',
+        value: '192.168.0.253',
+      });
+      // Last reconcile reflects the now-empty fronted set.
+      expect(reconcileCalls.at(-1)).toEqual([]);
+    });
+
+    it('is a no-op reconcile path for providers without view support', async () => {
+      const { iface } = fakeProvider(false);
+      const wrapped = withDnsInternalLedger(iface, ctx());
+      // Must not throw despite a fronted registration when reconcileViews is absent.
+      await wrapped.registerRecord({
+        host: 'git.celilo.computer',
+        type: 'A',
+        value: '192.168.0.253',
+        zoneRoutableValue: '10.0.10.10',
+      });
+      expect(listViewOverrides(db, 'technitium')).toHaveLength(1);
+    });
+
     it('does not write the ledger if the underlying register throws', async () => {
       const iface = {
         async registerRecord(): Promise<void> {

package/src/services/dns-internal-records.ts

@@ -13,14 +13,16 @@
  * Row lifecycle is FK cascade — records die with their provider or consumer.
  */
 
-import type { DnsInternalCapability, DnsRecordRequest } from '@celilo/capabilities';
-import { and, eq } from 'drizzle-orm';
+import type { DnsInternalCapability, DnsRecordRequest, ViewOverride } from '@celilo/capabilities';
+import { and, eq, isNotNull } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { dnsInternalRecords } from '../db/schema';
 
 export interface DnsInternalRecordRow {
   host: string;
   ip: string;
+  /** In-zone split-horizon answer (caddy's zone IP), or null for plain records. */
+  zoneRoutableIp: string | null;
   providerModuleId: string;
   consumerModuleId: string;
   registeredAt: Date;
@@ -34,6 +36,7 @@ export function listDnsInternalRecords(
     .select({
       host: dnsInternalRecords.host,
       ip: dnsInternalRecords.ip,
+      zoneRoutableIp: dnsInternalRecords.zoneRoutableIp,
       providerModuleId: dnsInternalRecords.providerModuleId,
       consumerModuleId: dnsInternalRecords.consumerModuleId,
       registeredAt: dnsInternalRecords.registeredAt,
@@ -44,16 +47,45 @@ export function listDnsInternalRecords(
     : query.all();
 }
 
+/**
+ * The COMPLETE set of source-based split-horizon view overrides a provider
+ * should serve — every ledger record that carries a zone-routable IP (ISS-0156).
+ * This is the desired state the resolver's view config is reconciled from; the
+ * provider's `reconcileViews` is the single writer that materializes it.
+ */
+export function listViewOverrides(db: DbClient, providerModuleId: string): ViewOverride[] {
+  return db
+    .select({ host: dnsInternalRecords.host, ip: dnsInternalRecords.zoneRoutableIp })
+    .from(dnsInternalRecords)
+    .where(
+      and(
+        eq(dnsInternalRecords.providerModuleId, providerModuleId),
+        isNotNull(dnsInternalRecords.zoneRoutableIp),
+      ),
+    )
+    .all()
+    .map((r) => ({ host: r.host, ip: r.ip as string }));
+}
+
 export function recordDnsInternalRecord(
   db: DbClient,
-  record: { providerModuleId: string; consumerModuleId: string; host: string; ip: string },
+  record: {
+    providerModuleId: string;
+    consumerModuleId: string;
+    host: string;
+    ip: string;
+    /** In-zone split-horizon answer (caddy's zone IP); null/absent for plain records. */
+    zoneRoutableIp?: string | null;
+  },
 ): void {
+  const zoneRoutableIp = record.zoneRoutableIp ?? null;
   db.insert(dnsInternalRecords)
     .values({
       providerModuleId: record.providerModuleId,
       consumerModuleId: record.consumerModuleId,
       host: record.host,
       ip: record.ip,
+      zoneRoutableIp,
       registeredAt: new Date(),
     })
     .onConflictDoUpdate({
@@ -61,6 +93,7 @@ export function recordDnsInternalRecord(
       set: {
         consumerModuleId: record.consumerModuleId,
         ip: record.ip,
+        zoneRoutableIp,
         registeredAt: new Date(),
       },
     })
@@ -93,6 +126,17 @@ export function withDnsInternalLedger(
   ctx: { db: DbClient; providerModuleId: string; consumerModuleId: string },
 ): DnsInternalCapability {
   const isA = (request: DnsRecordRequest) => request.type.toUpperCase() === 'A';
+
+  // Source-based split-horizon (ISS-0156): after the ledger changes, re-materialize
+  // the provider's view config from the COMPLETE desired set. The provider's
+  // reconcileViews is the single writer; driving it from the ledger here (which
+  // both the live public_web path and the deploy-time backfill flow through)
+  // keeps live and reconcile in agreement. No-op for providers without views.
+  const reconcileViews = async (): Promise<void> => {
+    if (typeof iface.reconcileViews !== 'function') return;
+    await iface.reconcileViews(listViewOverrides(ctx.db, ctx.providerModuleId));
+  };
+
   return {
     ...iface,
     async registerRecord(request: DnsRecordRequest): Promise<void> {
@@ -103,7 +147,10 @@ export function withDnsInternalLedger(
           consumerModuleId: ctx.consumerModuleId,
           host: request.host,
           ip: request.value,
+          zoneRoutableIp: request.zoneRoutableValue ?? null,
         });
+        // Only a fronted record (one carrying a zone-routable IP) changes views.
+        if (request.zoneRoutableValue) await reconcileViews();
       }
     },
     async deleteRecord(request: DnsRecordRequest): Promise<void> {
@@ -113,6 +160,8 @@ export function withDnsInternalLedger(
           providerModuleId: ctx.providerModuleId,
           host: request.host,
         });
+        // The removed host may have been a fronted override — recompute the set.
+        await reconcileViews();
       }
     },
   };