@celilo/cli 1.13.0 → 2.0.0

package/CELILO_CORE_MODULES.md

@@ -59,7 +59,7 @@ Each entry: `module id` — what it is — **provides** / **requires** capabilit
 - **celilo-apt-repo** — Debian apt repository (reprepro + Bun HTTP server) serving the celilo `.deb` at apt.celilo.computer. **provides:** `apt_publish`. **requires:** `public_web`, `dns_registrar`.
 - **signal** — bidirectional Signal transport for alerts and deploy-interview questions; runs signal-cli in daemon mode with its JSON-RPC socket bound to the host's own address (never public) and **`--receive-mode=manual`**, which is load-bearing: signal-cli's default (`on-start`) leaves the daemon permanently receiving, so it drains every reply into an SSE stream nothing is attached to and REFUSES celilo's `receive` call — replies arrive and are unreadable, while `send` and every health check keep passing. Enrolled as a SECONDARY DEVICE of an existing Signal account rather than registering its own number — Signal blocks most VOIP ranges and bans bot-ish registrations. Recipient addresses live on celilo routes, not in module config, so adding a person never requires a redeploy. Runs on x86_64 and aarch64. `libsignal-client` ships no linux-aarch64 native, so celilo builds one (`modules/signal/build/`) and installs it as a `libsignal-jni` .deb on ARM hosts; x86_64 uses the JAR's bundled native. **provides:** `notification` (`send`, `receive`). **requires:** no capabilities — a transport that depended on the proxy, registrar or firewall could not tell you those were broken — and a system in the **`secure-mgmt`** zone: it holds a linked Signal account (the operator's own messaging identity and keys), and its job is to observe every tier while depending on none, which is what the control-plane zone is for. See `openspec/changes/add-alerting/`.
 - **celilo-website** — public docs site (static Astro) served via Caddy on celilo.computer. **requires:** `public_web`, `dns_registrar`.
-- **celilo-web-console** — the read-mostly operator console: the fleet drawn by zone, a live module roster, and the alert and backup state that says what needs attention. **Not yet deployed** — the manifest, the SPA, the console server and the read verbs exist; the `control_plane_api` enrolment and the e2e suite do not. It holds **no database handle**: every fact it displays arrives over the SSH remote API as a principal whose grants derive from the `COMMANDS` registry's read-only classifier, because an in-process console would hold the whole database including the encrypted secret store and be constrained only by its own code. **⚠️ `secure-mgmt`, and the placement is a security boundary rather than a preference:** celilo reaches into every data-plane zone by trust and no data-plane zone reaches back, so the ONLY client path in is the control-plane VPN. It registers no web route, requests no port forward, takes no `natIp` or ingress address, and gets no DNS record resolvable from a data-plane zone. `apps/celilo/src/console/control-plane-boundary.test.ts` asserts that on every pull request rather than only in e2e, because the way it erodes is a one-line manifest edit adding `private_web` so someone can reach it without bringing up the VPN. It offers no deploy, uninstall, pause, restore or config control: those can raise an interview question, a browser has no responder, and they are ABSENT rather than disabled. **provides:** nothing. **requires:** `idp`, `control_plane_api`. See `openspec/changes/web-ui-console/`.
+- **celilo-web-console** — the read-mostly operator console: the fleet drawn by zone, a live module roster, and the alert and backup state that says what needs attention. **Deployable, not yet servable.** The manifest, the SPA, the console server, the read verbs, the `control_plane_api` capability, the `on_install` that enrols the principal, and a full deployable body (`terraform/`, `ansible/` with a role, config variables, and a `build:` step compiling a per-architecture bun binary plus the SPA) all exist. What does not exist is an OIDC client: the console refuses to serve without an identity provider, and nothing creates one yet, so a deployed unit starts, fails its start limit and sits in `failed` with the reason in its journal. That is deliberate rather than hidden — leaving the service disabled would make an unfinished module look like a clean converge. The e2e suite does not exist either. It holds **no database handle**: every fact it displays arrives over the SSH remote API as a principal whose grants derive from the `COMMANDS` registry's read-only classifier, because an in-process console would hold the whole database including the encrypted secret store and be constrained only by its own code. **⚠️ `secure-mgmt`, and the placement is a security boundary rather than a preference:** celilo reaches into every data-plane zone by trust and no data-plane zone reaches back, so the ONLY client path in is the control-plane VPN. It registers no web route, requests no port forward, takes no `natIp` or ingress address, and gets no DNS record resolvable from a data-plane zone. `apps/celilo/src/console/control-plane-boundary.test.ts` asserts that on every pull request rather than only in e2e, because the way it erodes is a one-line manifest edit adding `private_web` so someone can reach it without bringing up the VPN. It offers no deploy, uninstall, pause, restore or config control: those can raise an interview question, a browser has no responder, and they are ABSENT rather than disabled. **provides:** nothing. **requires:** `idp`, `control_plane_api`. See `openspec/changes/web-ui-console/`.
 - **celilo-canary** — a deliberately minimal nginx serving one static page in **`dmz`**, permanently deployed, whose health check IS the assertion that the deploy path still works. Nothing about it is interesting except that it is *always there*: modules already deployed keep running when the pipeline breaks, so without a canary a regression in IPAM allocation, Terraform provisioning, Ansible convergence or capability wiring stays invisible until the next real deploy — which is exactly when nobody wants to discover it. One deploy exercises all four, plus a live cross-module capability call. **Fleet-only, and the absence is the design**: it registers one route through `private_web` and requires nothing that reaches the perimeter, so there is no public record, no ACME certificate and no port forward. Its `health_check` probes nginx over systemd and its `/healthz` endpoint with **`probeHttp`, from the management server** rather than by SSHing in and running `curl` — the production `ubuntu-22.04-standard` LXC ships no curl, so the old form could not tell a missing binary from a dead service, and reaching the canary at its own address additionally catches a service bound only to loopback. **requires:** `private_web`.
 
 ## Git forge & CI pipeline

package/CELILO_SUBSYSTEMS.md

@@ -93,6 +93,26 @@ content module targets either with
 `capabilities.external_web ?? capabilities.public_web`. Both are
 **authoritative**: a publish that doesn't reach clients throws (#328).
 
+- **Static-content converge (`/srv/www`, design D10)** —
+  `apps/celilo/src/services/static-content-converge.ts` (pure
+  `planStaticContent`/`buildStaticContentPlan` + `writeStaticContentVars` + the
+  `executeAnsible` caller `convergeStaticContent`). The declared `web_routes`
+  release set (slug, content hash, hostnames, the source dir core derives from
+  `modules.source_path`) is the desired state; the provider's Ansible converge
+  makes `/srv/www` match: content-hashed release dirs `/srv/www/<slug>-<hash>`,
+  an atomic symlink swap of `/srv/www/<slug>`, pruning beyond
+  `static_release_retention` (caddy manifest variable, operator config with
+  default 5 — the role never carries the number). Two callers, one plan: the
+  `public_web` capability's `convergeStaticContent` callback (tag-scoped run
+  through `executeAnsible`, so a publish returns only once the host matches)
+  and the provider's own deploy (vars written pre-Ansible in
+  `module-deploy.ts`, so a rebuilt host recovers with no consumer). The
+  content hash lands on EVERY route row sharing the slug. Replaced the
+  hand-built ssh tar pipe in `upload_static_assets` (celilo#1014); the
+  no-hand-built-SSH gate now scans `@celilo/capabilities` everywhere except
+  its primitive file (`module-script-scan.ts`, `scanCapabilityPackageSource`).
+  e2e: `modules/caddy/e2e/static-content-converge.test.ts`.
+
 ## Remote-ops primitives (the SSH seam — modules never hand-build SSH)
 
 Module hooks reach a remote box ONLY through these typed primitives
@@ -180,8 +200,10 @@ runner seam (`execRunner` real / `createMockRunner` for tests) lives in
 ## Hooks & deploy
 
 - **Hook executor / ABI** — `apps/celilo/src/hooks/executor.ts` (`invokeHook`, `executeHookScript`, `checkRequiredCapabilities`), types in `apps/celilo/src/hooks/types.ts` (`HookContext`, `HookDefinition`, `HookName`). Named-hook runner: `apps/celilo/src/hooks/run-named-hook.ts`. Manifest hook config: `apps/celilo/src/hooks/load-hook-config.ts`.
-- **Hook process boundary (a hook is a program celilo RUNS)** — `apps/celilo/src/hooks/hook-protocol.ts` (the NDJSON frame union, `HOOK_PROTOCOL_VERSION`, `serializeError`/`deserializeError`), `apps/celilo/src/hooks/broker.ts` (`startBroker`, `capabilityShape`), `apps/celilo/src/hooks/hook-runner.ts` (the spawned shim — the ONLY thing that `import()`s module code). `executeHookScript` spawns `bun hook-runner.ts` over a Unix socket instead of importing; the nine `invokeHook` call sites and `defineHook` are unchanged. **The broker does not know what a capability is**: it sends a shape descriptor built by the same own-string-key walk `wrapWithLogging` does (functions → `methods`, everything else → `data`, which is where `stampProvider`'s `providerModuleId` lives), and the shim rebuilds forwarding proxies from it — so an optional method a provider did not implement is absent rather than present-and-throwing, and `if (cap.registerTrustedSource)` keeps answering correctly. A socket rather than stdout because module scripts spawn subprocesses and a grandchild writing to fd 1 would corrupt the frame stream. Two consequences worth knowing: the child's environment is an **allow-list** (`hookChildEnv` — `PATH`, `HOME`, `LANG`, `TZ`, `TMPDIR`, `CELILO_HOOK_*`, `CELILO_DEBUG`), so a hook reading any other operator variable now gets `undefined`; and a timeout is a real SIGTERM-then-SIGKILL with the broker refusing further capability calls, replacing a `Promise.race` that cancelled nothing and let a "timed out" hook go on writing DNS and firewall state (celilo#1003). Capability PROVIDER factories still load in-process — they ARE the broker's implementation. Stages 1 and 2 of `openspec/changes/hook-process-boundary`; the filesystem is claimed by the jail below, the network is not claimed at all (stage 3, D12).
-- **Hook jail (a hook sees the paths it was given, and nothing else)** — `apps/celilo/src/hooks/mount-set.ts` (`deriveMountSet`, `toBwrapArgs`, `forbiddenPaths` — PURE, computes a filesystem view and touches nothing) and `apps/celilo/src/hooks/jail.ts` (`detectJailBackend`, `planJailedSpawn`, `realpathRequest`, `runtimeModulePathsFor`, `recordJailMode` — the half that touches the machine). `executeHookScript` spawns the shim under `bwrap` with the module's tree read-only, `state/` + `generated/` + this run's `screenshots/<run>` read-write on top of it, each contract-declared path input at its declared access, the broker's socket directory, the runtime and the `node_modules` the shim resolves through, `~/.ssh` read-only (stage 2 only — stage 3 drops it, D12), and `/tmp` a fresh tmpfs FIRST so it cannot erase the socket or a staged input. **The acceptance criterion is absence, not a check**: the module store and the data directory are simply not bound, so `master.key` and a sibling module give `ENOENT`. The set is DERIVED — a module cannot ask for more — and `bwrap` itself is never in it, because the AppArmor profile grants `userns` to `/usr/bin/bwrap` for anyone on the box (design D9). Backend detection RUNS bubblewrap rather than looking for it (four different denials all leave the binary in place), and the resulting mode is written to `hook-jail-mode.json` beside celilo's other per-machine state rather than logged, so a host that stops jailing is readable. `CELILO_HOOK_JAIL` = `auto` (default) / `required` / `off`. No backend on macOS yet (task 4.8), and the hook then runs unjailed with the mode recorded.
+- **Hook process boundary (a hook is a program celilo RUNS)** — `apps/celilo/src/hooks/hook-protocol.ts` (the NDJSON frame union, `HOOK_PROTOCOL_VERSION`, `serializeError`/`deserializeError`), `apps/celilo/src/hooks/broker.ts` (`startBroker`, `capabilityShape`), `apps/celilo/src/hooks/hook-runner-entry.ts` + `apps/celilo/src/hooks/hook-runner.ts` (the spawned shim — the ONLY thing that `import()`s module code; the entry exists to install the advisory lint before the shim's import graph can ESM-load `node:fs`, see `unjailed-lint.ts`). `executeHookScript` spawns `bun hook-runner-entry.ts` over a Unix socket instead of importing; the nine `invokeHook` call sites and `defineHook` are unchanged. **The broker does not know what a capability is**: it sends a shape descriptor built by the same own-string-key walk `wrapWithLogging` does (functions → `methods`, everything else → `data`, which is where `stampProvider`'s `providerModuleId` lives), and the shim rebuilds forwarding proxies from it — so an optional method a provider did not implement is absent rather than present-and-throwing, and `if (cap.registerTrustedSource)` keeps answering correctly. A socket rather than stdout because module scripts spawn subprocesses and a grandchild writing to fd 1 would corrupt the frame stream. Two consequences worth knowing: the child's environment is an **allow-list** (`hookChildEnv` — how to run: `PATH`, `HOME`, `LANG`, `TZ`, `TMPDIR`; whom to trust: `NODE_EXTRA_CA_CERTS`, `SSL_CERT_FILE`, `SSL_CERT_DIR`; the proxy variables; the `CELILO_HOOK_*` channels; `CELILO_DEBUG` — `FORWARDED_ENV` in executor.ts is the source of truth), so a hook reading any other operator variable now gets `undefined`; and a timeout is a real SIGTERM-then-SIGKILL with the broker refusing further capability calls, replacing a `Promise.race` that cancelled nothing and let a "timed out" hook go on writing DNS and firewall state (celilo#1003). Capability PROVIDER factories still load in-process — they ARE the broker's implementation. Stages 1 and 2 of `openspec/changes/hook-process-boundary`; the filesystem is claimed by the jail below, and SSH reachability by the remote-ops broker next.
+- **Unjailed advisory lint (task 4.7, NOT a security boundary)** — `apps/celilo/src/hooks/unjailed-lint.ts`. Where there is no jail backend the executor passes the run's derived mount set to the shim in the environment (`CELILO_HOOK_MOUNT_SET`), and the shim wraps the path-taking `node:fs` / `node:fs/promises` functions so an access outside the set (or a write to a read-only row) warns through the hook's own logger: "on a jailed host this would fail", and that it is advisory. It is the mount-set derivation's SECOND consumer, so it cannot drift from what the jail enforces. It observes JS-level `node:fs` calls only — module code bypasses it trivially — and it must never be described as a boundary, in code or output.
+- **Remote-ops broker (reachability scoped by the credential, stage 3 / D12)** — `apps/celilo/src/hooks/remote-broker.ts` (`startRemoteBroker`, `RemoteAccessPolicy`) answering a SECOND socket beside the capability one, with the policy in `apps/celilo/src/services/remote-access.ts` (`remoteAccessPolicy`) and the asking half inside `@celilo/capabilities`' own remote primitives (`packages/capabilities/src/remote.ts`, "The hook remote-ops bridge"). The jail binds no `~/.ssh`, so a hand-built `ssh` cannot authenticate; the primitives detect `CELILO_HOOK_REMOTE_SOCKET`, send each operation as a STRUCTURED request (never a shell string — the broker rebuilds the ssh line itself), and the broker checks the target against `ownedSystemModuleIds` + `getModuleSystems` before running anything, refusing with the module, the target, and the capability route named. Requests carrying the module's OWN credential (an `identityFile` crossing as content and materialised per call, or `installAuthorizedKey`'s password — the cPanel case) are scoped by that credential instead; an explicit non-root user likewise, because the fleet key's authority is root on fleet systems. Stream primitives' LOCAL paths are confined to the run's granted roots (stateDir, screenshots, generated/, declared path inputs), or `streamBackup` would be a write-as-celilo oracle. Attribution is by the module that PERFORMS the operation: a hook's request to the hook's module (the nine `invokeHook` sites build the policy), a provider's transport to the provider's module — providers run in-process and do not cross this socket, and `public_web`'s hand-built upload was replaced by the Ansible static-content converge (capability-owned-tables stage 4, celilo#1014). Residual, recorded rather than papered over: a hook can still `fetch()` any HTTP endpoint directly; only `probeHttp` consults the target check.
+- **Hook jail (a hook sees the paths it was given, and nothing else)** — `apps/celilo/src/hooks/mount-set.ts` (`deriveMountSet`, `toBwrapArgs`, `forbiddenPaths` — PURE, computes a filesystem view and touches nothing) and `apps/celilo/src/hooks/jail.ts` (`detectJailBackend`, `planJailedSpawn`, `realpathRequest`, `runtimeModulePathsFor`, `recordJailMode` — the half that touches the machine). `executeHookScript` spawns the shim under `bwrap` with the module's tree read-only, `state/` + `generated/` + this run's `screenshots/<run>` read-write on top of it, each contract-declared path input at its declared access, the broker's socket directory, the runtime and the `node_modules` the shim resolves through, and `/tmp` a fresh tmpfs FIRST so it cannot erase the socket or a staged input. `~/.ssh` is deliberately NOT bound (stage 3, D12): withholding the credential is what makes the remote-ops broker's target check a boundary. **The acceptance criterion is absence, not a check**: the module store and the data directory are simply not bound, so `master.key` and a sibling module give `ENOENT`. The set is DERIVED — a module cannot ask for more — and `bwrap` itself is never in it, because the AppArmor profile grants `userns` to `/usr/bin/bwrap` for anyone on the box (design D9). Backend detection RUNS bubblewrap rather than looking for it (four different denials all leave the binary in place), and the resulting mode is written to `hook-jail-mode.json` beside celilo's other per-machine state rather than logged, so a host that stops jailing is readable. `CELILO_HOOK_JAIL` = `auto` (default) / `required` / `off`. macOS has a `sandbox-exec` backend in the union, but `auto` defers on it (ce-29z: sandbox-exec DENIES undeclared writes where bubblewrap masks them, and D14's declared-path mechanism is not built), so the hook runs unjailed with the mode recorded; `required` bypasses the deferral for an operator who opts in. An `unjailed` record carries `lastJailed` (the jailed record it replaced on the same host), which is what the `hook_jail` self-monitor reads (`services/alerting/hook-jail.ts`, created unsuppressible by `celilo monitor add hook_jail`) to alert on a host that used to jail and has stopped. `celilo system doctor`'s "Hook execution" section (`renderHookExecutionSection`) reports the live mode and, when unjailed, why.
 - **Deploy pipeline** — `apps/celilo/src/services/module-deploy.ts`.
 - **DNS provider backfill** (re-emit registrations when a provider deploys) — `apps/celilo/src/services/dns-provider-backfill.ts` — `isDnsInternalProvider`, `backfillProviderDns`.
 - **Base-module aspects (fan-out across the fleet)** — `apps/celilo/src/services/aspect-runner.ts` — `planAspectFanOut`, `runAspectFanOut`, `maybeRunAspectForTrigger`. Aspect content lives in `modules/<m>/base-module-aspect/` (e.g. knot-unbound-internal, technitium). Two directions, with DELIBERATELY OPPOSITE failure semantics:
@@ -263,7 +285,7 @@ is currently wrong, and routes carry the message to a person's phone. Design:
 
 - **Alert identity** — `apps/celilo/src/services/alerting/keys.ts` — the key grammar (`module:<id>[/check:<name>]`, `builtin:<check>[/<kind>:<target>]`) that makes "the same problem" the same alert across runs. `moduleAlertKey`, `moduleCheckAlertKey`, `builtinAlertKey`, `parseAlertKey`.
 - **Reconciliation** — `apps/celilo/src/services/alerting/reconcile.ts` (`reconcile`) — a successful run's failing-key set is authoritative and resolution is by SET DIFFERENCE (absent ⇒ resolved). A run whose outcome is `error` resolves NOTHING and fires a module-level alert instead: the false-all-clear guard.
-- **Monitor execution** — `apps/celilo/src/services/alerting/run-monitor.ts` (`runOneMonitor`) + `sweep.ts` (`selectDueMonitors`) + `builtin-monitors.ts` / `health-coverage.ts` (the built-in checks and the "module with no health check" coverage check).
+- **Monitor execution** — `apps/celilo/src/services/alerting/run-monitor.ts` (`runOneMonitor`) + `sweep.ts` (`selectDueMonitors`) + `builtin-monitors.ts` / `health-coverage.ts` / `hook-jail.ts` (the built-in checks, the "module with no health check" coverage check, and the hook-jail regression self-monitor).
 - **Health-check cadence (one accessor)** — `apps/celilo/src/services/alerting/health-cadence.ts` — `effectiveHealthCheckCadence(manifest, override)`, `isScheduled`, `loadModuleHealthCadences`, `reconcileModuleWatchState`. The manifest's `hooks.health_check.interval` SUGGESTS; the operator's `health_check_interval` decides; both resolve at read time. `null` means nobody named a cadence (a coverage gap); `'manual'` means the operator opted out (a decision — raises no coverage finding, and resolves the module's live alerts on the way down, since nothing will report on them again).
 - **⚠️ `monitors.intervalMinutes` and `monitors.enabled` are `builtin_check`-only.** A `module_hook` row carries severity, escalation policy and `lastRunAt`; its cadence and whether it is watched resolve through the accessor above. The columns' meaning depending on `kind` is a named smell (design.md D8) — the alternatives are a cached resolved value that rots, or splitting the table, which needs a synthetic monitor identity for `alerts.monitorId`. Gates: `sweep-runner.test.ts` asserts a module row's stored values are NOT consulted; `cadence-migration.test.ts` asserts the same through `loadModuleHealthCadences`.
 - **Carrying an existing fleet over** — `apps/celilo/src/services/alerting/cadence-migration.ts` (`migrateMonitorCadences`), run from `celilo system migrate` (the `.deb` postinst runs it on every apt upgrade). A monitor row whose cadence diverges from its manifest gets that cadence written as an override; a disabled one gets `manual`. Not bookkeeping: without it the upgrade that ships read-time resolution silently reverts every hand-set cadence to the author's suggestion and resumes watching modules an operator deliberately disabled. Idempotent — writes only where no override exists.
@@ -290,6 +312,8 @@ SUGGESTS a `backup.schedule`; the operator's override decides; celilo runs it on
 the resolved cadence and alerts when it stops.
 
 - **Creation** — `apps/celilo/src/services/backup-create.ts` — `createModuleBackup` (invokes the module's `on_backup` hook into an encrypted envelope), `createSystemStateBackup` (celilo.db), `findBackupEligibleModules` (returns each module's operator config alongside its manifest, because every caller has to resolve a policy out of the two together), `isBackupDue`. Storage destinations: `backup-storage.ts`. Restore: `backup-restore.ts`.
+- **Staging celilo's own state** — `apps/celilo/src/services/system-state-stage.ts` — `stageSystemState(rootDir)` and `snapshotDatabase(src, dest)`. Before invoking `on_backup` on a `cross_module_read` module, celilo COPIES its own state (`celilo.db` snapshot, `master.key`, the fleet `ssh/`, and `module_src/<id>/` for every module's lean source) into a directory it creates, and passes the path as the contract input `system_state_root`. ⚠️ **This is what lets celilo back ITSELF up without exempting celilo-mgmt from the hook jail** (`openspec/changes/hook-process-boundary`, design D9b): the hook never READ those bytes, it copied them into `backup_dir`, so the framework does the copying and celilo's data directory is in no hook's mount set. Same allow-list as `cross_module_root` — one privilege, one list to audit. ⚠️ **`snapshotDatabase` uses a readonly connection + `serialize()`, never `copyFileSync`**: celilo runs the DB in WAL mode, so the main file is routinely one near-empty page while all the real data sits in `celilo.db-wal` (measured: 4 KB main against 832 KB WAL), and a plain copy produces a snapshot that opens cleanly, contains NOTHING, and is installed by restore. Gate: `services/system-state-stage.test.ts` writes 200 uncheckpointed rows and asserts they survive.
+- **The fleet SSH key (one accessor)** — `apps/celilo/src/services/fleet-key.ts` — `ensureFleetKey()` (idempotent mint, returns the public half) and `getFleetSshDir()`. Surfaced as `celilo system ensure-fleet-key`, which also records `ssh.public_key`. celilo-mgmt's `on_install` used to mint the keypair itself inside celilo's data directory — a WRITE into the one directory the jail exists to keep out of the mount set (design D9b), which staging does not cover because staging covers copies OUT. ⚠️ **Never re-key**: an existing key is reused, because regenerating strands every machine whose `authorized_keys` holds the old public half, and a redeploy calls this every time. `getFleetSshDir()` follows the DB (`dirname(getDbPath())/.ssh`), not `getDataDir()` — the same directory on a deb install and different when `CELILO_DB_PATH` is overridden; both the mint and `restore-from-file.ts`'s laydown read that one helper so they cannot drift apart.
 - **Cadence (one accessor)** — `apps/celilo/src/services/backup-schedule.ts` — `effectiveBackupSchedule(manifest, override)`. The manifest SUGGESTS; the operator's `backup_schedule` row in `module_configs` decides; absent from both means `daily`, NOT `manual` (opting out takes an explicit `manual`). Resolution happens at READ time — nothing is materialised at install or deploy — so a corrected manifest reaches every install that has not overridden. The one-argument form was DELETED rather than kept as an overload (Rule 3.9): it would let an un-updated reader compile clean while silently ignoring overrides. Both the freshness audit and the backup sweep must read cadence through this one function, or a module can be alerted-on but never backed up.
 - **The cadence type** — `apps/celilo/src/services/cadence.ts` — `Cadence` (`{minutes}` | `'manual'`), `parseCadence` / `formatCadence` / `cadenceMs`, and `cadenceSchema({floorMinutes})`. One spelling set for every cadence in celilo: a named period (`hourly`/`daily`/`weekly`/`monthly`), a duration (`6h`, `90m`, `3d`), or `manual`. ⚠️ **The floors are DERIVED from the sweep ticks, never written down**: this file owns `BACKUP_SWEEP_PATTERN` / `ALERTING_SWEEP_PATTERN` and computes `BACKUP_CADENCE_FLOOR_MINUTES` / `MONITOR_INTERVAL_FLOOR_MINUTES` from them (the sweeps import their pattern from here), so changing a tick moves what it can serve in the same edit. A cadence finer than its sweep's tick is REFUSED, not coerced — accepting it leaves the operator believing they configured something that can silently never happen.
 - **Retention (one accessor)** — `apps/celilo/src/services/backup-retention.ts` — `effectiveBackupRetention(manifest, configs)`, `prunesNothing`, `identifyExpiredBackups`, `pruneBackupsForModule`. Two INDEPENDENT dimensions (copies, age), each resolved override → manifest → **unbounded**. ⚠️ **An unset dimension is unbounded, never a default bound.** `backup.retention` is an optional block, so a manifest omitting it prunes nothing at all and its inner `count: 7` / `max_age_days: 30` defaults never apply; if setting one dimension let the other fall back to those, an operator asking to keep 3 copies would silently arm a 30-day deletion on a module that had been keeping everything. Unbounded is `Infinity`, which `identifyExpiredBackups` needs no special case for. Gate: `services/backup-retention.test.ts`. The four sites that used to read `manifest.backup.retention` directly (`cli/commands/backup-sweep.ts`, `backup-create.ts`, `backup-prune.ts` twice) all go through the accessor — that duplication is what let the schedule readers drift.
@@ -346,6 +370,7 @@ Run any celilo command on celilo-mgr over SSH instead of screen-scraping `ssh <h
 - **Server** — `apps/celilo/src/api/serve.ts` (`apiServeMode`); the `celilo api-serve --principal=<id>` sshd forced-command entry point (dispatched in `apps/celilo/src/cli/index.ts`). Authorizes per principal, runs the command as a protocol-mode child, streams output, audits to stderr.
 - **Client** — `packages/core/src/remote-client.ts` (`@celilo/core`) — `resolveRemote` (`--remote <dest>` / `CELILO_REMOTE`), `runRemoteClient` (`ssh -T`, renders progress via the local ProgressDisplay, answers interviews via the `@celilo/cli-display` prompts). Refuses to prompt on a non-TTY stdin, replying `unanswerable` rather than submitting a default as if a human had chosen it.
 - **Access control** — `apps/celilo/src/services/api-access.ts` — `grantPrincipal`, `isAuthorized` (deny-by-default, `command:subcommand` grants), `renderAuthorizedKeys`. Table: `api_principals` (`apps/celilo/src/db/schema.ts`). CLI: `apps/celilo/src/cli/commands/api.ts` (`api grant|list|revoke|authorized-keys|key new`).
+- **Principal enrolment for a module (`control_plane_api`)** — `apps/celilo/src/services/api-principal-enrolment.ts` — `enrolControlPlanePrincipal`, `revokeControlPlanePrincipal`, and `buildControlPlaneApi`, the method table a consuming module's hooks receive. The consumer generates an ed25519 pair on its own system and presents the public half; nothing here accepts a private key. Grants are DERIVED from `readOnlyGrants(COMMANDS)` and are not a parameter, so a caller cannot ask for more, and a write verb is never granted however it is named. **Framework-granted, so no module provides it** — enrolment writes celilo's own `api_principals` row and a module script may import nothing but `@celilo/capabilities`, which rules out celilo-mgmt as much as anyone else (`web-ui-console` D7b). Injected by `capability-loader.ts` ONLY for a module whose stored manifest declares it under `requires`/`optional`, unlike every other capability the loader hands out, and scoped to that module: a caller may not name a neighbour's principal. Contract: `packages/capabilities/src/control-plane-api.ts`.
 - **Mid-run interview bridge (`kind:daemon` responder)** — `apps/celilo/src/services/remote-responder.ts` — `startRemoteResponder` bridges bus `interview.required.*` ↔ wire.
 - **Server provisioning** — the `celilo-bootstrap` deb (`packaging/celilo-bootstrap/scripts/postinst`) creates the non-root `celilo-api` landing account + sshd; membership in the `celilo` group + `/etc/sudoers.d/celilo` (`!use_pty`) gives api-serve DB access via the wrapper's sudo-drop.
 - **Self-upgrade (apt)** — `celilo apt-upgrade` (`apps/celilo/src/cli/commands/apt-upgrade.ts`) upgrades the deb-installed `celilo`/`celilo-bootstrap` packages (`apt-get update` → `--only-upgrade install`) then spawns a fresh `celilo system migrate` (ISS-0100), then `celilo events restart-daemon` so the dispatcher actually runs the code just installed — a failure there fails the whole command and names which steps DID complete, because "upgraded" while the dispatcher serves stale code is the silent state celilo#604 documents. It's the RW target behind the MCP's registry-derived `celilo_apt_upgrade` tool; the celilo user's two apt invocations are scoped-sudo'd by `/etc/sudoers.d/celilo-apt-upgrade`, shipped by `celilo-bootstrap`. **This upgrades celilo ITSELF — not the modules it manages. For those, see Module auto-upgrade below; the two are routinely confused.**
@@ -354,14 +379,15 @@ Run any celilo command on celilo-mgr over SSH instead of screen-scraping `ssh <h
 
 ## Web console (read-mostly operator UI)
 
-The fleet drawn by zone, a live module roster, and the alert and backup state that says what needs attention. Design: `openspec/changes/web-ui-console/`. **Not yet deployed** — the SPA, its server and the console read verbs exist; the module, its `control_plane_api` enrolment and the e2e suite do not.
+The fleet drawn by zone, a live module roster, and the alert and backup state that says what needs attention. Design: `openspec/changes/web-ui-console/`. **Not yet deployed** — the SPA, its server, the console read verbs, the acknowledgement path and the `control_plane_api` capability exist; the module's `on_install` that CALLS that capability, and the e2e suite, do not. The capability issues only the derived read-only grants and has no parameter that could widen them (task 6.3b settled that deliberately), so acknowledgement renders a denial until an operator grants `alerts:ack` by hand.
 
 - **Console read verbs** — `apps/celilo/src/cli/commands/console.ts` — `celilo console status` (the dashboard's single poll: zone order, per-module systems, observed health, backup freshness) and `celilo console get <module-id> [--depth N]` (one module's bounded capability closure). Both classify **read-only** under `readOnlyGrants()`, so the console's principal covers them with no hand-maintained list. The verbs are named from the read-verb vocabulary (`status`, `get`) rather than for prose, because the API authorises at two levels and classifies a leaf by its SUBCOMMAND token — `console roster` would read better and classify as a WRITE.
 - **Console projection** — `apps/celilo/src/console/projection.ts` — the narrow payload, deliberately WITHOUT `manifestData`: `module list --json` returns 156 KB for 23 modules because it embeds every manifest blob, which is the wrong payload for a poll loop. Distinguishes *not deployed* from *not observed*; a module with no system is carried, not omitted.
 - **Bounded capability closure** — `apps/celilo/src/console/closure.ts` — `computeClosure()` wraps `planConsumerCleanup()`'s edge rather than forking it, adding distance, optionality and cycle termination. Takes a bindings map (`capability_bindings`, celilo#1072) so the walk follows what a module has ACTUALLY called into; without one it follows declarations, which answers "what could this reach" rather than "what does this stand on".
 - **Read-only classifier** — `packages/core/src/read-only-classifier.ts` — `READ_VERBS`, `isReadOnlyPath`, `opOf`, `flattenLeaves`, `readOnlyGrants()`. Lives beside `COMMANDS` because it is a property of the registry, and both the MCP server's `RO_GRANTS` and the console's principal derive from it. A new read verb is covered automatically; a new write verb is not.
 - **SSH transport** — `packages/core/src/ssh-transport.ts` — `childProcessTransport`, `sshArgs`, `sshTransportWith`, and the exit reaper. Shared rather than copied because the reaper exists after 656 orphaned ssh clients threw celilo-mgr into MaxStartups throttling (celilo#921), and the console server has the same restart-freely lifecycle.
-- **Console server** — `apps/console-server/src/upstream.ts` — holds **no database handle**; every fact arrives over the remote API as a read-only principal. An interview is a FAILURE (a browser has no responder), and an unavailable read is reported with a reason (`denied` / `unknown-verb` / `unreachable` / `interview` / `malformed`) rather than returned as an empty result. Failures are not cached, so fixing a grant recovers on the next poll.
+- **Console server** — `apps/console-server/src/upstream.ts` — holds **no database handle**; every fact arrives over the remote API as a principal granted the derived read ops plus `alerts:ack`. An interview is a FAILURE (a browser has no responder), and an unavailable read is reported with a reason (`denied` / `unknown-verb` / `unreachable` / `interview` / `malformed`) rather than returned as an empty result. Failures are not cached, so fixing a grant recovers on the next poll. `Upstream.run` is the one non-read: uncached, unparsed (the ack answers with a sentence), and it drops every cached read afterwards.
+- **Console acknowledgement** — `apps/console-server/src/verbs.ts` (`readSession`, `ackAlert`), `apps/celilo/src/cli/commands/notify-config.ts` (`celilo person list --json`) — the console's ONLY write. `celilo alerts ack` falls back to `people[0]` when `--as` is absent, which in a browser would credit every acknowledgement to whoever sorts first, so `ackAlert` takes a required `person` and there is no path through it that omits the flag. The person comes from `readSession`, which resolves the identity provider's subject against `person list --json` (display name, then the `sub` claim, case-insensitive); a subject matching nobody resolves to null and the console draws no control. `ackedAt` is re-read from celilo's row rather than stamped by the console server, which is a different machine. Gates: `apps/console-server/tests/ack.test.ts` records the argv, so "refused but written anyway" is visible.
 - **Protocol** — `packages/console-protocol/` — tsrpc definitions plus the generated `serviceProto`, shared by server and SPA. The repo's single documented exception to ESM-everywhere: no `type` field, because `tsrpc-cli proto` `require()`s the protocol sources. Gated by a test in an ESM directory that round-trips a call.
 - **SPA** — `apps/console/src/` — Vite + React 19 + atom.io + tsrpc-browser. Three routes (`dashboard`, `alerts`, `backups`); a module's detail is a panel, not a fourth route. Visual constraints live in `shell.css` and four are asserted against the source by `tests/constraints.test.ts`, including "no control for any operation that can raise an interview". Every read goes through one `Panel` that separates *unavailable* from *empty*.
 - **Zone topology renderer** — `packages/visualizer/src/gen/zone-topology.ts`, `topology-theme.ts`, `column-assignment.ts`, `render/topology-svg.ts` — bands by zone in trust order, columns assigned so a dependency edge falls as a vertical drop, orthogonal routing checked against every module rather than assumed clear, and a report naming anything it could not place. Tuning playground at `bun run dev` in `packages/visualizer`, route `/topology`; it exports a `TopologyTheme` JSON the console commits.

package/README.md

@@ -286,7 +286,6 @@ bun run test:integration    # All integration tests (run via bun test)
 # - VM resource defaults
 
 # What gets skipped:
-# - Nix builds
 # - Docker builds
 # - Slow module builds (Caddy)
 ```
@@ -296,7 +295,6 @@ bun run test:integration    # All integration tests (run via bun test)
 bun run test:integration-slow  # Full builds + end-to-end
 
 # Includes everything from fast tests PLUS:
-# - Full Nix builds (Caddy with modules)
 # - Docker builds
 # - Complete module packaging
 ```

package/drizzle/0030_drop_module_builds_environment.sql

@@ -0,0 +1,8 @@
+-- The `environment` column recorded whether a build ran inside a `nix develop`
+-- shell ('nix') or with system tools ('system'). That was the only information
+-- it carried, and the Nix build path never shipped: no module has ever carried
+-- a flake.nix, and the detection code (detectNixEnvironment / isNixAvailable /
+-- the `nix develop` wrapper in module-build.ts) is deleted in the same change.
+-- Every row ever written holds 'system' or NULL, so a constant column: deleted
+-- with the path it described rather than kept as dead weight.
+ALTER TABLE `module_builds` DROP COLUMN `environment`;

package/drizzle/meta/_journal.json

@@ -211,6 +211,13 @@
       "when": 1784400000000,
       "tag": "0029_module_instances",
       "breakpoints": true
+    },
+    {
+      "idx": 30,
+      "version": "6",
+      "when": 1784400000000,
+      "tag": "0030_drop_module_builds_environment",
+      "breakpoints": true
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/cli",
-  "version": "1.13.0",
+  "version": "2.0.0",
   "description": "Celilo — home lab orchestration CLI",
   "type": "module",
   "bin": {
@@ -58,9 +58,9 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1109.0",
     "@aws-sdk/lib-storage": "^3.1101.0",
-    "@celilo/capabilities": "^3.3.0",
+    "@celilo/capabilities": "^4.0.0",
     "@celilo/cli-display": "^0.2.0",
-    "@celilo/core": "^0.10.0",
+    "@celilo/core": "^0.11.0",
     "@celilo/event-bus": "^0.6.0",
     "ajv": "^8.18.0",
     "drizzle-orm": "^0.36.4",

package/src/capabilities/public-web-helpers.test.ts

@@ -89,7 +89,6 @@ function basePublishRequest(
 ): PublishStaticSiteRequest {
   return {
     path: '/lunacycle',
-    sourceDir: '/tmp/build/dist',
     ...overrides,
   };
 }
@@ -134,17 +133,24 @@ describe('validatePublishStaticSiteRequest', () => {
     expect(result.valid).toBe(true);
   });
 
-  test('rejects empty sourceDir', () => {
-    const result = validatePublishStaticSiteRequest(basePublishRequest({ sourceDir: '' }));
+  test('rejects a stale sourceDir, and says what to do instead', () => {
+    // Replaces 'rejects empty sourceDir'. The field is gone (D10 amendment), so
+    // the failure mode inverted: supplying one is now the error, and the
+    // message has to carry the directory move because that is not guessable
+    // from "unknown key".
+    const result = validatePublishStaticSiteRequest({
+      path: '/lunacycle',
+      sourceDir: '/tmp/site',
+    } as unknown as PublishStaticSiteRequest);
     expect(result.valid).toBe(false);
-    expect(result.errors).toContain('sourceDir is required');
+    expect(result.errors.join(' ')).toContain('site/dist');
   });
 
   test('reports multiple errors at once', () => {
     const result = validatePublishStaticSiteRequest({
       path: '',
-      sourceDir: '',
-    });
+      sourceDir: '/tmp/site',
+    } as unknown as PublishStaticSiteRequest);
     expect(result.valid).toBe(false);
     expect(result.errors.length).toBeGreaterThanOrEqual(2);
   });

package/src/capabilities/public-web-publish.test.ts

@@ -106,6 +106,7 @@ describe('publishStaticSite — clientConfig injection', () => {
   test('writes config.js into sourceDir before upload when clientConfig is provided', async () => {
     const { ops } = makeRouteOps();
     const cap = createPublicWeb({
+      webRoot: sourceDir,
       moduleId: 'lunacycle',
       logger: noopLogger,
       config: {
@@ -115,6 +116,7 @@ describe('publishStaticSite — clientConfig injection', () => {
         email: 'admin@example.com',
       },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -123,7 +125,6 @@ describe('publishStaticSite — clientConfig injection', () => {
 
     const result = await cap.publishStaticSite({
       path: '/lunacycle',
-      sourceDir,
       clientConfig: {
         AUTHENTIK_URL: 'https://auth.example.com/application/o',
         CLIENT_ID: 'lunacycle-web',
@@ -150,6 +151,7 @@ describe('publishStaticSite — clientConfig injection', () => {
   test('does not write config.js when clientConfig is omitted', async () => {
     const { ops } = makeRouteOps();
     const cap = createPublicWeb({
+      webRoot: sourceDir,
       moduleId: 'lunacycle',
       logger: noopLogger,
       config: {
@@ -159,6 +161,7 @@ describe('publishStaticSite — clientConfig injection', () => {
         email: 'admin@example.com',
       },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -167,7 +170,6 @@ describe('publishStaticSite — clientConfig injection', () => {
 
     await cap.publishStaticSite({
       path: '/lunacycle',
-      sourceDir,
       // no clientConfig
     });
 
@@ -177,6 +179,7 @@ describe('publishStaticSite — clientConfig injection', () => {
   test('registers the route as static and records moduleId/path', async () => {
     const { ops, routes } = makeRouteOps();
     const cap = createPublicWeb({
+      webRoot: sourceDir,
       moduleId: 'lunacycle',
       logger: noopLogger,
       config: {
@@ -186,6 +189,7 @@ describe('publishStaticSite — clientConfig injection', () => {
         email: 'admin@example.com',
       },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -194,7 +198,6 @@ describe('publishStaticSite — clientConfig injection', () => {
 
     await cap.publishStaticSite({
       path: '/lunacycle',
-      sourceDir,
     });
 
     const stored = routes.find((r) => r.path === '/lunacycle');
@@ -204,9 +207,16 @@ describe('publishStaticSite — clientConfig injection', () => {
     expect(stored?.slug).toBe('lunacycle');
   });
 
-  test('fails fast when sourceDir does not exist', async () => {
+  test('fails fast, and names the path to ship, when the module has no web root', async () => {
+    // The publish path's one unrecoverable input. It used to arrive on the
+    // request as `sourceDir`; core now resolves it (D10 amendment), so the
+    // missing-directory case moves onto the capability's construction.
+    //
+    // It must throw rather than upload nothing: a zero-file upload succeeds,
+    // writes a content hash over an empty release, and serves a blank page.
     const { ops } = makeRouteOps();
     const cap = createPublicWeb({
+      webRoot: '/nonexistent/path/that/should/not/exist',
       moduleId: 'lunacycle',
       logger: noopLogger,
       config: {
@@ -216,24 +226,26 @@ describe('publishStaticSite — clientConfig injection', () => {
         email: 'admin@example.com',
       },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
       dnsManagedDomains: ['www.example.com'],
     });
 
-    await expect(
-      cap.publishStaticSite({
-        path: '/lunacycle',
-        sourceDir: '/nonexistent/path/that/should/not/exist',
-        clientConfig: { FOO: 'bar' },
-      }),
-    ).rejects.toThrow('sourceDir does not exist');
+    const attempt = cap.publishStaticSite({
+      path: '/lunacycle',
+      clientConfig: { FOO: 'bar' },
+    });
+    await expect(attempt).rejects.toThrow('no built site at');
+    // The operator's next move is a directory move, so the error has to name it.
+    await expect(attempt).rejects.toThrow('site/dist');
   });
 
   test('fails validation before touching the filesystem', async () => {
     const { ops } = makeRouteOps();
     const cap = createPublicWeb({
+      webRoot: sourceDir,
       moduleId: 'lunacycle',
       logger: noopLogger,
       config: {
@@ -243,6 +255,7 @@ describe('publishStaticSite — clientConfig injection', () => {
         email: 'admin@example.com',
       },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -252,7 +265,6 @@ describe('publishStaticSite — clientConfig injection', () => {
     await expect(
       cap.publishStaticSite({
         path: '', // bad — caught by validator before any side effects
-        sourceDir,
       }),
     ).rejects.toThrow('Invalid publishStaticSite request');
 
@@ -282,6 +294,7 @@ describe('registerReverseProxy', () => {
         email: 'admin@example.com',
       },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -318,6 +331,7 @@ describe('registerReverseProxy', () => {
         email: 'admin@example.com',
       },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -355,6 +369,7 @@ describe('auto-logging — end-to-end through createPublicWeb', () => {
     const { ops } = makeRouteOps();
 
     const cap = createPublicWeb({
+      webRoot: sourceDir,
       moduleId: 'lunacycle',
       logger,
       config: {
@@ -364,6 +379,7 @@ describe('auto-logging — end-to-end through createPublicWeb', () => {
         email: 'admin@example.com',
       },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -389,6 +405,7 @@ describe('auto-logging — end-to-end through createPublicWeb', () => {
     const { ops } = makeRouteOps();
 
     const cap = createPublicWeb({
+      webRoot: sourceDir,
       moduleId: 'lunacycle',
       logger,
       config: {
@@ -398,6 +415,7 @@ describe('auto-logging — end-to-end through createPublicWeb', () => {
         email: 'admin@example.com',
       },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -424,6 +442,7 @@ describe('auto-logging — end-to-end through createPublicWeb', () => {
     const { ops } = makeRouteOps();
 
     const cap = createPublicWeb({
+      webRoot: sourceDir,
       moduleId: 'lunacycle',
       logger,
       config: {
@@ -433,13 +452,14 @@ describe('auto-logging — end-to-end through createPublicWeb', () => {
         email: 'admin@example.com',
       },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
       dnsManagedDomains: ['www.example.com'],
     });
 
-    await cap.publishStaticSite({ path: '/lunacycle', sourceDir });
+    await cap.publishStaticSite({ path: '/lunacycle' });
 
     const messageTexts = messages.map((m) => m.message);
     // The high-level call itself logs.
@@ -459,6 +479,7 @@ describe('auto-logging — end-to-end through createPublicWeb', () => {
     const { ops } = makeRouteOps();
 
     const cap = createPublicWeb({
+      webRoot: sourceDir,
       moduleId: 'lunacycle',
       logger,
       config: {
@@ -468,6 +489,7 @@ describe('auto-logging — end-to-end through createPublicWeb', () => {
         email: 'admin@example.com',
       },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -524,6 +546,7 @@ describe('register_route — public DNS wiring (D1/M1 #328)', () => {
       logger: noopLogger,
       config: { target_ip: '10.0.10.20/24' },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -551,6 +574,7 @@ describe('register_route — public DNS wiring (D1/M1 #328)', () => {
       logger: noopLogger,
       config: { target_ip: '10.0.10.20/24' },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -582,6 +606,7 @@ describe('register_route — public DNS wiring (D1/M1 #328)', () => {
       logger: noopLogger,
       config: { target_ip: '10.0.10.20/24' },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -602,6 +627,7 @@ describe('register_route — public DNS wiring (D1/M1 #328)', () => {
       logger: noopLogger,
       config: { target_ip: '10.0.10.20/24' },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -626,6 +652,7 @@ describe('register_route — public DNS wiring (D1/M1 #328)', () => {
       logger: noopLogger,
       config: { target_ip: '10.0.10.20/24' },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -652,6 +679,7 @@ describe('register_route — public DNS wiring (D1/M1 #328)', () => {
       // No target_ip and no firewallNatIp → internalDnsIp is falsy.
       config: {},
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',
@@ -682,6 +710,7 @@ describe('register_route — public DNS wiring (D1/M1 #328)', () => {
       logger: noopLogger,
       config: { target_ip: '10.0.10.20/24' },
       secrets: {},
+      convergeStaticContent: async () => {},
       routeOps: ops,
       hostnames: ['www.example.com'],
       caddyModuleId: 'caddy',

package/src/capabilities/validation.test.ts

@@ -228,6 +228,37 @@ describe('Capability Access Validation', () => {
       expect(result.success).toBe(true);
     });
 
+    test('a framework-granted capability needs no providing module', async () => {
+      // This is the breakage, not a hypothetical. `control_plane_api` has no
+      // provider module and never will — celilo grants it (web-ui-console D7b) —
+      // so the console's manifest, already merged, hit the refusal below and
+      // could not be imported at all. Note the db here is the SAME one that
+      // fails the test after this one: the difference is entirely which
+      // capability is asked for.
+      const manifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'celilo-web-console',
+        name: 'Celilo Web Console',
+        version: '1.0.0',
+        description: 'Console',
+        requires: {
+          capabilities: [{ name: 'control_plane_api', version: '1.0.0' }],
+        },
+        provides: { capabilities: [] },
+        variables: { owns: [], imports: [] },
+      };
+
+      const noProviderDb = {
+        prepare: () => ({
+          get: () => undefined,
+        }),
+      } as unknown as Database;
+
+      const result = await validateCapabilityAccess(manifest, noProviderDb);
+
+      expect(result.success).toBe(true);
+    });
+
     test('should return error when required capability not found', async () => {
       const manifest: ModuleManifest = {
         celilo_contract: '1.0',

package/src/cli/commands/alerts-sweep.ts

@@ -10,8 +10,10 @@
  * report counts.
  */
 
+import { hostname } from 'node:os';
 import { getDb } from '../../db/client';
 import { modules } from '../../db/schema';
+import { readJailMode } from '../../hooks/jail';
 import { runBuiltinCheckForMonitor } from '../../services/alerting/builtin-source';
 import { loadModuleCoverage } from '../../services/alerting/coverage-source';
 import { modulesInDeployWindow } from '../../services/alerting/deploy-hooks';
@@ -61,6 +63,7 @@ export async function handleAlertsSweep(): Promise<CommandResult> {
         runModuleHealthCheck(moduleId, db, { unattended: true, noInteractive: true }),
       runBuiltinCheck: (category) => runBuiltinCheckForMonitor(category, db),
       loadModuleCoverage: () => loadModuleCoverage(db),
+      loadJailState: () => ({ record: readJailMode(), host: hostname() }),
       now: () => new Date(),
       graceMs: DEFAULT_GRACE_MS,
     },