@celilo/cli 0.8.2 → 0.9.1

package/src/cli/validators.test.ts

@@ -3,149 +3,7 @@
  */
 
 import { describe, expect, test } from 'bun:test';
-import {
-  validateDomain,
-  validateEmail,
-  validateIpAddress,
-  validateIpAddressList,
-  validateProxmoxUrl,
-  validateRequired,
-  validateRequiredNoDefault,
-  validateSubnet,
-} from './validators';
-
-describe('validateProxmoxUrl', () => {
-  test('accepts valid HTTPS URL with port', () => {
-    expect(validateProxmoxUrl('https://proxmox.example.com:8006')).toBeUndefined();
-    expect(validateProxmoxUrl('https://192.168.1.100:8006')).toBeUndefined();
-  });
-
-  test('rejects non-HTTPS URLs', () => {
-    expect(validateProxmoxUrl('http://proxmox.example.com:8006')).toBe(
-      'URL must start with https://',
-    );
-  });
-
-  test('rejects URLs without port', () => {
-    expect(validateProxmoxUrl('https://proxmox.example.com')).toBe(
-      'URL must include port (e.g., :8006)',
-    );
-  });
-
-  test('allows undefined (for default values)', () => {
-    expect(validateProxmoxUrl(undefined)).toBeUndefined();
-  });
-
-  test('rejects empty input', () => {
-    expect(validateProxmoxUrl('')).toBe('URL is required');
-    expect(validateProxmoxUrl('   ')).toBe('URL is required');
-  });
-
-  test('rejects invalid URLs', () => {
-    expect(validateProxmoxUrl('https://:8006')).toBe('Invalid URL format');
-    expect(validateProxmoxUrl('not-a-url')).toBe('URL must start with https://');
-  });
-});
-
-describe('validateSubnet', () => {
-  test('accepts valid CIDR notation', () => {
-    expect(validateSubnet('10.0.10.0/24')).toBeUndefined();
-    expect(validateSubnet('192.168.1.0/16')).toBeUndefined();
-    expect(validateSubnet('172.16.0.0/12')).toBeUndefined();
-  });
-
-  test('rejects invalid CIDR format', () => {
-    expect(validateSubnet('10.0.10.0')).toBe('Subnet must be in CIDR format (e.g., 10.0.10.0/24)');
-    expect(validateSubnet('10.0.10/24')).toBe('Subnet must be in CIDR format (e.g., 10.0.10.0/24)');
-  });
-
-  test('rejects invalid IP octets', () => {
-    expect(validateSubnet('256.0.10.0/24')).toBe('Invalid IP address (octets must be 0-255)');
-    expect(validateSubnet('10.300.10.0/24')).toBe('Invalid IP address (octets must be 0-255)');
-  });
-
-  test('rejects invalid prefix', () => {
-    expect(validateSubnet('10.0.10.0/33')).toBe('Invalid prefix length (must be 0-32)');
-    expect(validateSubnet('10.0.10.0/-1')).toBe('Invalid prefix length (must be 0-32)');
-  });
-
-  test('allows undefined (for default values)', () => {
-    expect(validateSubnet(undefined)).toBeUndefined();
-  });
-
-  test('rejects empty input', () => {
-    expect(validateSubnet('')).toBe('Subnet is required');
-  });
-});
-
-describe('validateDomain', () => {
-  test('accepts valid domains', () => {
-    expect(validateDomain('homelab.local')).toBeUndefined();
-    expect(validateDomain('example.com')).toBeUndefined();
-    expect(validateDomain('sub.domain.co.uk')).toBeUndefined();
-  });
-
-  test('rejects invalid domain format', () => {
-    expect(validateDomain('not-a-domain')).toBe('Invalid domain format (e.g., homelab.local)');
-    expect(validateDomain('.example.com')).toBe('Invalid domain format (e.g., homelab.local)');
-    expect(validateDomain('example..com')).toBe('Invalid domain format (e.g., homelab.local)');
-  });
-
-  test('allows undefined (for default values)', () => {
-    expect(validateDomain(undefined)).toBeUndefined();
-  });
-
-  test('rejects empty input', () => {
-    expect(validateDomain('')).toBe('Domain is required');
-  });
-});
-
-describe('validateEmail', () => {
-  test('accepts valid emails', () => {
-    expect(validateEmail('admin@example.com')).toBeUndefined();
-    expect(validateEmail('user.name@domain.co.uk')).toBeUndefined();
-  });
-
-  test('rejects invalid email format', () => {
-    expect(validateEmail('not-an-email')).toBe('Invalid email format');
-    expect(validateEmail('@example.com')).toBe('Invalid email format');
-    expect(validateEmail('user@')).toBe('Invalid email format');
-  });
-
-  test('allows undefined (for default values)', () => {
-    expect(validateEmail(undefined)).toBeUndefined();
-  });
-
-  test('rejects empty input', () => {
-    expect(validateEmail('')).toBe('Email is required');
-  });
-});
-
-describe('validateIpAddress', () => {
-  test('accepts valid IP addresses', () => {
-    expect(validateIpAddress('1.1.1.1')).toBeUndefined();
-    expect(validateIpAddress('192.168.1.100')).toBeUndefined();
-    expect(validateIpAddress('10.0.0.1')).toBeUndefined();
-  });
-
-  test('rejects invalid IP format', () => {
-    expect(validateIpAddress('not-an-ip')).toBe('Invalid IP format (e.g., 1.1.1.1)');
-    expect(validateIpAddress('192.168.1')).toBe('Invalid IP format (e.g., 1.1.1.1)');
-  });
-
-  test('rejects invalid octets', () => {
-    expect(validateIpAddress('256.1.1.1')).toBe('Invalid IP address (octets must be 0-255)');
-    expect(validateIpAddress('192.168.1.300')).toBe('Invalid IP address (octets must be 0-255)');
-  });
-
-  test('allows undefined (for default values)', () => {
-    expect(validateIpAddress(undefined)).toBeUndefined();
-  });
-
-  test('rejects empty input', () => {
-    expect(validateIpAddress('')).toBe('IP address is required');
-  });
-});
+import { validateRequired } from './validators';
 
 describe('validateRequired', () => {
   test('accepts non-empty strings', () => {
@@ -170,66 +28,3 @@ describe('validateRequired', () => {
     expect(validator('')).toBe('Custom field is required');
   });
 });
-
-describe('validateRequiredNoDefault', () => {
-  test('accepts non-empty strings', () => {
-    const validator = validateRequiredNoDefault('Password');
-    expect(validator('value')).toBeUndefined();
-    expect(validator('  text  ')).toBeUndefined();
-  });
-
-  test('rejects undefined (no default values)', () => {
-    const validator = validateRequiredNoDefault('Password');
-    expect(validator(undefined)).toBe('Password is required');
-  });
-
-  test('rejects empty strings', () => {
-    const validator = validateRequiredNoDefault('Password');
-    expect(validator('')).toBe('Password is required');
-    expect(validator('   ')).toBe('Password is required');
-  });
-
-  test('uses custom field name in error message', () => {
-    const validator = validateRequiredNoDefault('Custom password');
-    expect(validator('')).toBe('Custom password is required');
-  });
-});
-
-describe('validateIpAddressList', () => {
-  test('accepts single IP address', () => {
-    expect(validateIpAddressList('1.1.1.1')).toBeUndefined();
-    expect(validateIpAddressList('192.168.1.100')).toBeUndefined();
-  });
-
-  test('accepts space-separated IP addresses', () => {
-    expect(validateIpAddressList('8.8.8.8 1.1.1.1')).toBeUndefined();
-    expect(validateIpAddressList('192.168.0.1 10.0.0.1 1.1.1.1')).toBeUndefined();
-  });
-
-  test('accepts multiple spaces between IPs', () => {
-    expect(validateIpAddressList('8.8.8.8  1.1.1.1')).toBeUndefined();
-    expect(validateIpAddressList('1.1.1.1   8.8.8.8   1.0.0.1')).toBeUndefined();
-  });
-
-  test('rejects comma-separated IPs', () => {
-    expect(validateIpAddressList('1.1.1.1,8.8.8.8')).toContain('Invalid IP address');
-  });
-
-  test('rejects invalid IP in list', () => {
-    expect(validateIpAddressList('8.8.8.8 999.999.999.999')).toContain(
-      "Invalid IP address '999.999.999.999'",
-    );
-    expect(validateIpAddressList('192.168.0.1 not-an-ip')).toContain(
-      "Invalid IP address 'not-an-ip'",
-    );
-  });
-
-  test('allows undefined (for default values)', () => {
-    expect(validateIpAddressList(undefined)).toBeUndefined();
-  });
-
-  test('rejects empty input', () => {
-    expect(validateIpAddressList('')).toBe('At least one IP address is required');
-    expect(validateIpAddressList('   ')).toBe('At least one IP address is required');
-  });
-});

package/src/cli/validators.ts

@@ -3,137 +3,6 @@
  * Validation functions for interactive prompts
  */
 
-/**
- * Validate URL format (must start with https:// and include port)
- */
-export function validateProxmoxUrl(value: string | undefined): string | Error | undefined {
-  // Allow undefined (default will be used)
-  if (value === undefined) {
-    return;
-  }
-
-  if (!value.trim()) {
-    return 'URL is required';
-  }
-
-  if (!value.startsWith('https://')) {
-    return 'URL must start with https://';
-  }
-
-  if (!value.includes(':') || !value.match(/:\d+/)) {
-    return 'URL must include port (e.g., :8006)';
-  }
-
-  // Basic URL validation
-  try {
-    new URL(value);
-  } catch {
-    return 'Invalid URL format';
-  }
-}
-
-/**
- * Validate subnet CIDR notation (e.g., 10.0.10.0/24)
- */
-export function validateSubnet(value: string | undefined): string | Error | undefined {
-  // Allow undefined (default will be used)
-  if (value === undefined) {
-    return;
-  }
-
-  if (!value.trim()) {
-    return 'Subnet is required';
-  }
-
-  // Check CIDR format: IP/prefix
-  const cidrPattern = /^(\d{1,3}\.){3}\d{1,3}\/(.+)$/;
-  if (!cidrPattern.test(value)) {
-    return 'Subnet must be in CIDR format (e.g., 10.0.10.0/24)';
-  }
-
-  // Validate IP octets (0-255)
-  const [ip, prefix] = value.split('/');
-  const octets = ip.split('.').map(Number);
-
-  for (const octet of octets) {
-    if (octet < 0 || octet > 255) {
-      return 'Invalid IP address (octets must be 0-255)';
-    }
-  }
-
-  // Validate prefix (0-32)
-  const prefixNum = Number(prefix);
-  if (prefixNum < 0 || prefixNum > 32) {
-    return 'Invalid prefix length (must be 0-32)';
-  }
-}
-
-/**
- * Validate domain name format
- */
-export function validateDomain(value: string | undefined): string | Error | undefined {
-  // Allow undefined (default will be used)
-  if (value === undefined) {
-    return;
-  }
-
-  if (!value.trim()) {
-    return 'Domain is required';
-  }
-
-  // Basic domain format: lowercase, alphanumeric, hyphens, dots
-  const domainPattern = /^[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,}$/i;
-  if (!domainPattern.test(value)) {
-    return 'Invalid domain format (e.g., homelab.local)';
-  }
-}
-
-/**
- * Validate email format
- */
-export function validateEmail(value: string | undefined): string | Error | undefined {
-  // Allow undefined (default will be used)
-  if (value === undefined) {
-    return;
-  }
-
-  if (!value.trim()) {
-    return 'Email is required';
-  }
-
-  const emailPattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-  if (!emailPattern.test(value)) {
-    return 'Invalid email format';
-  }
-}
-
-/**
- * Validate IP address format
- */
-export function validateIpAddress(value: string | undefined): string | Error | undefined {
-  // Allow undefined (default will be used)
-  if (value === undefined) {
-    return;
-  }
-
-  if (!value.trim()) {
-    return 'IP address is required';
-  }
-
-  const ipPattern = /^(\d{1,3}\.){3}\d{1,3}$/;
-  if (!ipPattern.test(value)) {
-    return 'Invalid IP format (e.g., 1.1.1.1)';
-  }
-
-  // Validate octets (0-255)
-  const octets = value.split('.').map(Number);
-  for (const octet of octets) {
-    if (octet < 0 || octet > 255) {
-      return 'Invalid IP address (octets must be 0-255)';
-    }
-  }
-}
-
 /**
  * Validate non-empty string (allows undefined for prompts with default values)
  */
@@ -149,40 +18,3 @@ export function validateRequired(fieldName: string) {
     }
   };
 }
-
-/**
- * Validate required field with no defaults (for password fields)
- */
-export function validateRequiredNoDefault(fieldName: string) {
-  return (value: string | undefined): string | Error | undefined => {
-    // Reject undefined - no default value for this field
-    if (value === undefined || !value.trim()) {
-      return `${fieldName} is required`;
-    }
-  };
-}
-
-/**
- * Validate space-separated list of IP addresses
- */
-export function validateIpAddressList(value: string | undefined): string | Error | undefined {
-  // Allow undefined (default will be used)
-  if (value === undefined) {
-    return;
-  }
-
-  if (!value.trim()) {
-    return 'At least one IP address is required';
-  }
-
-  // Split by spaces (any amount of whitespace)
-  const ips = value.trim().split(/\s+/);
-
-  // Validate each IP
-  for (const ip of ips) {
-    const error = validateIpAddress(ip);
-    if (error) {
-      return `Invalid IP address '${ip}': ${error}`;
-    }
-  }
-}

package/src/db/schema.ts

@@ -392,6 +392,17 @@ export const moduleSystems = sqliteTable(
     serviceId: text('service_id').references(() => containerServices.id),
     /** Proxmox VMID — set only for proxmox containers. */
     vmid: integer('vmid'),
+    // Canonical deployed SIZE of this system (ISS-0150). For celilo-provisioned
+    // VM/LXC instances only (null for machine-pool systems celilo doesn't size).
+    // Seeded from the module's `requires.system` at first provision, then owned
+    // by `celilo proxmox … resize` — `requires.system` is only the minimum floor,
+    // never the live size. See CLAUDE.md "requires.system is the MINIMUM".
+    /** vCPU cores. */
+    cpu: integer('cpu'),
+    /** RAM in MB. */
+    memory: integer('memory'),
+    /** Root disk in GB. */
+    disk: integer('disk'),
     createdAt: integer('created_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
     updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
   },
@@ -492,8 +503,17 @@ export const dnsInternalRecords = sqliteTable(
       .references(() => modules.id, { onDelete: 'cascade' }),
     /** The registered hostname (e.g. "git-ssh.git.celilo.computer"). */
     host: text('host').notNull(),
-    /** The A-record value celilo asked the resolver to serve. */
+    /** The A-record value celilo asked the resolver to serve — the LAN/default
+     *  answer (firewall natIp for a caddy-fronted host). */
     ip: text('ip').notNull(),
+    /**
+     * In-zone split-horizon answer (caddy's zone-routable IP), when this is a
+     * caddy-fronted hostname that needs source-based views (ISS-0156,
+     * v2/INTERNAL_DNS_ZONE_VIEWS.md). NULL for records with no zone override
+     * (per-system identity, plain A records). This column is the durable
+     * desired-state the resolver's view config is reconciled from.
+     */
+    zoneRoutableIp: text('zone_routable_ip'),
     registeredAt: integer('registered_at', { mode: 'timestamp' })
       .notNull()
       .default(sql`(unixepoch())`),

package/src/hooks/capability-loader.ts

@@ -124,6 +124,28 @@ export async function resolveFirewallNatIp(db: DbClient): Promise<string | undef
   return undefined;
 }
 
+/**
+ * Caddy's zone-routable IP — its own DMZ ingress address (`target_ip`, the same
+ * value public_web exposes as `dmz_ip`). This is the in-zone split-horizon
+ * answer (ISS-0156): clients INSIDE the segmented zones reach caddy here, since
+ * they can't route to the firewall natIp. Returns undefined when no public_web
+ * provider advertises a `target_ip`. Shared by the live public_web registration
+ * and the deploy-time backfill so both write the same `zoneRoutableValue`.
+ */
+export async function resolveCaddyZoneIp(db: DbClient): Promise<string | undefined> {
+  const webProviders = db
+    .select()
+    .from(capabilities)
+    .where(eq(capabilities.capabilityName, 'public_web'))
+    .all();
+  for (const wp of webProviders) {
+    const cfg = await loadModuleConfig(wp.moduleId, db);
+    const ip = String(cfg.target_ip ?? '').split('/')[0];
+    if (ip) return ip;
+  }
+  return undefined;
+}
+
 export async function loadCapabilityFunctions(
   consumingModuleId: string,
   db: DbClient,

package/src/manifest/template-validator.test.ts

@@ -1,6 +1,13 @@
 import { describe, expect, test } from 'bun:test';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import type { ModuleManifest } from './schema';
-import { type TemplateValidationError, formatTemplateValidationErrors } from './template-validator';
+import {
+  type TemplateValidationError,
+  formatTemplateValidationErrors,
+  validateModuleTemplates,
+} from './template-validator';
 
 /**
  * Create a minimal valid manifest for testing
@@ -66,6 +73,29 @@ describe('template-validator', () => {
       expect(system?.storage).toBe('local-lvm');
     });
 
+    test('accepts $self:{cores,memory,disk,storage} as auto-allocated sizing (ISS-0150)', async () => {
+      // ISS-0150 repointed instance Terraform to read $self:cores/memory/disk/
+      // storage, which are injected at generate time from module_systems (see
+      // variables/context.ts) — not declared in the manifest. They must validate
+      // at `module import` time like vmid/target_ip, or every VM/CT module fails
+      // to import. Regression guard: this previously errored "Self variable
+      // 'cores' not found in module configuration".
+      const manifest = createTestManifest();
+      const dir = await mkdtemp(join(tmpdir(), 'celilo-tpl-'));
+      try {
+        await mkdir(join(dir, 'terraform'), { recursive: true });
+        await writeFile(
+          join(dir, 'terraform/main.tf.tpl'),
+          'cores  = $self:cores\nmemory = $self:memory\ndisk   = $self:disk\nstorage = "$self:storage"\n',
+        );
+        const result = await validateModuleTemplates(dir, manifest);
+        expect(result.errors).toEqual([]);
+        expect(result.success).toBe(true);
+      } finally {
+        await rm(dir, { recursive: true, force: true });
+      }
+    });
+
     test('validates capability references', async () => {
       const manifest = createTestManifest({
         requires: {

package/src/manifest/template-validator.ts

@@ -73,6 +73,15 @@ const AUTO_ALLOCATED_VARIABLES = new Set([
   'gateway', // Auto-derived from zone configuration
   'target_node', // Can be auto-derived from system config
   'lxc_nameserver', // Composed at generate time from dns_internal + dns.primary (v2/LXC_INTERNAL_DNS.md)
+  // Instance sizing (ISS-0150): the instance Terraform reads $self:{cores,memory,
+  // disk,storage}, which are injected during resolution from the module_systems
+  // table (falling back to requires.system.*) — see variables/context.ts. Like
+  // vmid/target_ip they are populated at generate time, not declared in the
+  // manifest, so they are auto-allocated rather than import-time validation errors.
+  'cores', // requires.system.cpu / module_systems.cpu
+  'memory', // requires.system.memory / module_systems.memory
+  'disk', // requires.system.disk / module_systems.disk
+  'storage', // storage pool name (requires.system.storage)
 ]);
 
 /**

package/src/services/aspect-approvals.test.ts

@@ -247,5 +247,57 @@ describe('aspect-approvals', () => {
       const status = checkAspectApproval('knot-unbound-internal', '1.0.0', newAspect, db);
       expect(status).toBe('scope_changed');
     });
+
+    // #262 — scope-keyed carry-forward across versions. The ISS-0156 cutover
+    // hung because consent was recorded at the imported version, then a
+    // `module update` bumped the version and the deploy re-prompted (no row for
+    // the new version) — and nothing answered the prompt. Per D7, only a SCOPE
+    // change requires re-consent; a pure version bump must not.
+    it('carries approval forward to a bumped version with the SAME scope (#262 — no re-prompt)', () => {
+      insertModule('technitium', '1.0.2+4');
+      const db = getDb();
+      recordAspectApproval({
+        moduleId: 'technitium',
+        version: '1.0.2+4',
+        scopeHash: computeAspectScopeHash(baseAspect),
+        approver: null,
+        db,
+      });
+      // `module update` bumped +4 → +6; aspect scope unchanged.
+      expect(checkAspectApproval('technitium', '1.0.2+6', baseAspect, db)).toBe('approved');
+    });
+
+    it('carries a DENIAL forward to a bumped version with the same scope', () => {
+      insertModule('technitium', '1.0.2+4');
+      const db = getDb();
+      recordAspectConsent({
+        moduleId: 'technitium',
+        version: '1.0.2+4',
+        scopeHash: computeAspectScopeHash(baseAspect),
+        approver: null,
+        consented: false,
+        db,
+      });
+      expect(checkAspectApproval('technitium', '1.0.2+6', baseAspect, db)).toBe('denied');
+    });
+
+    it('does NOT carry forward to a bumped version when the scope changed', () => {
+      insertModule('technitium', '1.0.2+4');
+      const db = getDb();
+      recordAspectApproval({
+        moduleId: 'technitium',
+        version: '1.0.2+4',
+        scopeHash: computeAspectScopeHash(baseAspect),
+        approver: null,
+        db,
+      });
+      const narrowed: BaseModuleAspect = {
+        ansible_role: 'dns-client-config',
+        applicable_zones: ['dmz'],
+        triggers: ['on_install'],
+      };
+      // Bumped version AND narrowed scope → no exact row, no scope match → re-prompt.
+      expect(checkAspectApproval('technitium', '1.0.2+6', narrowed, db)).toBe('no_approval');
+    });
   });
 });

package/src/services/aspect-approvals.ts

@@ -21,7 +21,7 @@
  */
 
 import { createHash, randomUUID } from 'node:crypto';
-import { and, eq, sql } from 'drizzle-orm';
+import { and, desc, eq, sql } from 'drizzle-orm';
 import type { getDb } from '../db/client';
 import { aspectApprovals } from '../db/schema';
 import type { BaseModuleAspect } from '../manifest/schema';
@@ -65,6 +65,26 @@ export function findAspectApproval(
     .get();
 }
 
+/**
+ * Find the most recent consent row for a (moduleId, scopeHash) pair across ALL
+ * versions. Used to carry an operator's decision forward when a module version
+ * bump leaves the aspect scope (applicable_zones + triggers) unchanged — so a
+ * `module update` auto-revision doesn't force re-consent (#262). The latest
+ * decision (by approvedAt) for that scope wins.
+ */
+export function findAspectApprovalByScope(
+  moduleId: string,
+  scopeHash: string,
+  db: DbClient,
+): typeof aspectApprovals.$inferSelect | undefined {
+  return db
+    .select()
+    .from(aspectApprovals)
+    .where(and(eq(aspectApprovals.moduleId, moduleId), eq(aspectApprovals.scopeHash, scopeHash)))
+    .orderBy(desc(aspectApprovals.approvedAt))
+    .get();
+}
+
 /**
  * Record the operator's consent DECISION for a module version's
  * base-module aspect — `consented: true` (approve) or `false`
@@ -132,9 +152,17 @@ export function recordAspectApproval(args: {
  *   - 'approved': a matching-scope row with `consented: true` — run.
  *   - 'denied': a matching-scope row with `consented: false` — the
  *     operator explicitly refused (ISS-0027). Skip; do NOT re-prompt.
- *   - 'scope_changed': a row exists but the manifest's scope differs
- *     (D7 — the prior decision was about a different scope; re-prompt).
- *   - 'no_approval': no row for this version — undecided; prompt.
+ *   - 'scope_changed': a row exists for THIS version but the manifest's scope
+ *     differs (D7 — the prior decision was about a different scope; re-prompt).
+ *   - 'no_approval': no row for this version AND no prior decision for this
+ *     scope at any version — undecided; prompt.
+ *
+ * #262: when there's no row for the exact version, the operator's decision is
+ * carried forward by SCOPE. A pure version bump (e.g. a `module update`
+ * auto-revision) that leaves applicable_zones + triggers unchanged must NOT
+ * re-prompt — that re-prompt, unanswerable headlessly, is what hung the
+ * ISS-0156 cutover. A genuine scope change has a different scopeHash, so it
+ * finds no match and correctly falls through to 'no_approval'.
  */
 export function checkAspectApproval(
   moduleId: string,
@@ -142,9 +170,14 @@ export function checkAspectApproval(
   aspect: BaseModuleAspect,
   db: DbClient,
 ): 'approved' | 'denied' | 'scope_changed' | 'no_approval' {
-  const existing = findAspectApproval(moduleId, version, db);
-  if (!existing) return 'no_approval';
   const currentHash = computeAspectScopeHash(aspect);
-  if (existing.scopeHash !== currentHash) return 'scope_changed';
-  return existing.consented ? 'approved' : 'denied';
+  const exact = findAspectApproval(moduleId, version, db);
+  if (exact) {
+    if (exact.scopeHash !== currentHash) return 'scope_changed';
+    return exact.consented ? 'approved' : 'denied';
+  }
+  // No row for this exact version — carry the decision forward by scope (#262).
+  const byScope = findAspectApprovalByScope(moduleId, currentHash, db);
+  if (byScope) return byScope.consented ? 'approved' : 'denied';
+  return 'no_approval';
 }