@celilo/cli 1.4.0 → 1.6.0

package/src/policy/module-script-scan.ts

@@ -0,0 +1,143 @@
+/**
+ * The recurrence gate for openspec/changes/unified-management-no-ssh/proposal.md:
+ * **modules never hand-build SSH, and the one sanctioned raw-exec path is
+ * always justified in writing.**
+ *
+ * ONE definition of the rules, used by both enforcement points:
+ *
+ *   - `apps/celilo/src/policy/no-hand-built-ssh.test.ts` — every in-repo module,
+ *     on every `bun test`.
+ *   - `apps/celilo/src/module/packaging/build.ts` — every `.netapp` at the
+ *     moment it is packaged, including modules that never pass through this
+ *     repo's CI (`bun run publish` is a documented escape hatch and runs no
+ *     tests).
+ *
+ * Deliberately not two copies. The types this repo keeps re-learning that
+ * lesson on — `HookName` (celilo#821), `HookContext` — were duplicated
+ * declarations that drifted silently because nothing fails when two copies
+ * disagree. A scan rule is worse: the duplicate that drifts is the one that
+ * stops catching things, and a gate that stops catching things looks exactly
+ * like a gate with nothing to catch.
+ */
+
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+
+export interface ScanViolation {
+  /** Path as the operator should see it — relative to the scanned root. */
+  file: string;
+  /** 1-based line number of the offending line. */
+  line: number;
+  /** Short rule name, e.g. `raw ssh invocation`. */
+  rule: string;
+  /** What to do instead. */
+  hint: string;
+}
+
+/**
+ * How far above a `runAppCommand*` call the justification may sit.
+ *
+ * Calibrated against the real call sites rather than guessed: the convention is
+ * a comment block directly above the call, but a call wrapped in `waitFor(() =>
+ * …)` puts the justification above the ENCLOSING statement, a few lines up. A
+ * window covers both without needing to parse TypeScript. Eight lines is the
+ * widest real gap plus headroom; wide enough to miss nothing legitimate, narrow
+ * enough that an unrelated hatch elsewhere in the function cannot launder a
+ * fresh call.
+ */
+const ESCAPE_HATCH_LOOKBACK_LINES = 8;
+
+const PATTERN_RULES: Array<{ rule: string; re: RegExp; hint: string }> = [
+  {
+    rule: 'raw ssh invocation (StrictHostKeyChecking)',
+    re: /StrictHostKeyChecking/,
+    hint: 'Use a remote-ops primitive (remoteExec/probe/serviceCtl/…). See MODULE_PRIMITIVES.md.',
+  },
+  {
+    rule: 'raw ssh invocation (ssh … root@)',
+    re: /\bssh\s+(?:-\S+\s+|\S*root@)/,
+    hint: 'Use a remote-ops primitive, not a hand-built ssh string. See MODULE_PRIMITIVES.md.',
+  },
+  {
+    rule: "'ssh2' import",
+    re: /(?:from|require\()\s*['"]ssh2['"]/,
+    hint: 'Modules never open their own SSH connection — use the primitives. See MODULE_PRIMITIVES.md.',
+  },
+];
+
+/** A `runAppCommand(` / `runAppCommandWithSecret(` CALL — not the import. */
+const RAW_EXEC_CALL = /\brunAppCommand(?:WithSecret)?\s*\(/;
+
+const ESCAPE_HATCH_MARKER = /escape-hatch:/;
+
+/**
+ * Scan one file's source. Pure — takes the text, returns the violations, so it
+ * is testable without a filesystem and reusable over a staged package.
+ */
+export function scanModuleScriptSource(file: string, source: string): ScanViolation[] {
+  const violations: ScanViolation[] = [];
+  const lines = source.split('\n');
+
+  lines.forEach((text, i) => {
+    for (const { rule, re, hint } of PATTERN_RULES) {
+      if (re.test(text)) violations.push({ file, line: i + 1, rule, hint });
+    }
+
+    if (!RAW_EXEC_CALL.test(text)) return;
+    const from = Math.max(0, i - ESCAPE_HATCH_LOOKBACK_LINES);
+    const justified = lines.slice(from, i).some((l) => ESCAPE_HATCH_MARKER.test(l));
+    if (!justified) {
+      violations.push({
+        file,
+        line: i + 1,
+        rule: 'unjustified raw-exec escape hatch',
+        hint:
+          'runAppCommand* is the ONLY sanctioned raw-exec path and every call site must say why ' +
+          'no capability, HTTP or converge path exists. Add an `// escape-hatch: …` comment ' +
+          'immediately above the call. See MODULE_PRIMITIVES.md.',
+      });
+    }
+  });
+
+  return violations;
+}
+
+/**
+ * Every production `.ts` under a module's `scripts/` — excluding tests and
+ * `node_modules`.
+ *
+ * The exclusion is load-bearing, not tidiness: the shipped closure bundles
+ * `@celilo/capabilities`, whose `remote.ts` builds the `ssh … root@` string
+ * that every one of these rules exists to keep OUT of module code. Scanning it
+ * would fail every module in the fleet on the implementation of the primitives
+ * they were told to use.
+ */
+export function moduleScriptFiles(scriptsDir: string): string[] {
+  if (!existsSync(scriptsDir) || !statSync(scriptsDir).isDirectory()) return [];
+  const out: string[] = [];
+  const walk = (dir: string) => {
+    for (const entry of readdirSync(dir)) {
+      if (entry === 'node_modules') continue;
+      const p = join(dir, entry);
+      if (statSync(p).isDirectory()) walk(p);
+      else if (p.endsWith('.ts') && !p.endsWith('.test.ts')) out.push(p);
+    }
+  };
+  walk(scriptsDir);
+  return out;
+}
+
+/**
+ * Scan a module directory (the one holding `manifest.yml`). Returns every
+ * violation in its `scripts/`, with paths relative to `moduleDir`.
+ */
+export function scanModuleDirectory(moduleDir: string): ScanViolation[] {
+  return moduleScriptFiles(join(moduleDir, 'scripts')).flatMap((f) =>
+    scanModuleScriptSource(relative(moduleDir, f), readFileSync(f, 'utf-8')),
+  );
+}
+
+/** Render violations for a test failure message or a refused publish. */
+export function formatViolations(violations: ScanViolation[]): string {
+  return violations.map((v) => `  ${v.file}:${v.line}\n    → ${v.rule}. ${v.hint}`).join('\n');
+}

package/src/policy/no-hand-built-ssh.test.ts

@@ -1,24 +1,20 @@
 /**
- * Recurrence gate for openspec/changes/unified-management-no-ssh/proposal.md: **modules never hand-build SSH.**
+ * Recurrence gate for openspec/changes/unified-management-no-ssh/proposal.md: **modules never hand-build SSH,
+ * and every raw-exec escape hatch is justified in writing.**
  *
- * Module hooks reach a remote box through the typed primitives in
- * `@celilo/capabilities` (probe / serviceCtl / applyRenderedConfig / … — see
- * apps/celilo/MODULE_PRIMITIVES.md), never a raw `ssh root@…` string, `ssh2`, or
- * an ad-hoc `child_process` shell-out. This test scans every production module
- * script and fails if a banned pattern reappears, so the SSH-elimination work
- * can't silently erode.
+ * The rules themselves live in `./module-script-scan`, because this is not the
+ * only place they run — `.netapp` packaging applies the same scan at publish
+ * time, which is the enforcement point that also covers a module built outside
+ * this repo's CI. One definition, two callers.
  *
- * Precise on purpose: `noRestrictedImports` can't see raw ssh *strings* (the real
- * risk). We ban the SSH shapes themselves — an `ssh root@…` string catches
- * hand-built SSH however it's invoked (child_process, execSync, or the Runner),
- * and `ssh2` catches the library route. We do NOT ban `child_process` outright:
- * many modules' on_install legitimately shell LOCAL `celilo`/system commands
- * (`celilo system apply-config`), which isn't remote SSH.
+ * This file is the in-repo half: every production module script, on every
+ * `bun test`.
  */
 
 import { describe, expect, test } from 'bun:test';
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { join, resolve } from 'node:path';
+import { formatViolations, moduleScriptFiles, scanModuleDirectory } from './module-script-scan';
 
 /** Walk up from this test to the repo root (the dir holding both modules/ and apps/). */
 function repoRoot(): string {
@@ -30,61 +26,25 @@ function repoRoot(): string {
   throw new Error('could not locate repo root (no ancestor with modules/ + apps/)');
 }
 
-/** Every production `.ts` under modules/<m>/scripts/ (excludes node_modules + tests). */
-function moduleScripts(): string[] {
+function moduleDirs(): string[] {
   const modulesRoot = join(repoRoot(), 'modules');
-  const out: string[] = [];
-  const walk = (dir: string) => {
-    for (const entry of readdirSync(dir)) {
-      if (entry === 'node_modules') continue;
-      const p = join(dir, entry);
-      if (statSync(p).isDirectory()) walk(p);
-      else if (p.endsWith('.ts') && !p.endsWith('.test.ts')) out.push(p);
-    }
-  };
-  for (const mod of readdirSync(modulesRoot)) {
-    const scripts = join(modulesRoot, mod, 'scripts');
-    if (existsSync(scripts) && statSync(scripts).isDirectory()) walk(scripts);
-  }
-  return out;
+  return readdirSync(modulesRoot)
+    .map((m) => join(modulesRoot, m))
+    .filter((d) => statSync(d).isDirectory() && existsSync(join(d, 'scripts')));
 }
 
-const BANNED = [
-  {
-    name: 'raw ssh invocation (StrictHostKeyChecking)',
-    re: /StrictHostKeyChecking/,
-    hint: 'Use a remote-ops primitive (remoteExec/probe/serviceCtl/…). See MODULE_PRIMITIVES.md.',
-  },
-  {
-    name: 'raw ssh invocation (ssh … root@)',
-    re: /\bssh\s+(?:-\S+\s+|\S*root@)/,
-    hint: 'Use a remote-ops primitive, not a hand-built ssh string. See MODULE_PRIMITIVES.md.',
-  },
-  {
-    name: "'ssh2' import",
-    re: /(?:from|require\()\s*['"]ssh2['"]/,
-    hint: 'Modules never open their own SSH connection — use the primitives. See MODULE_PRIMITIVES.md.',
-  },
-];
-
 describe('recurrence gate: modules never hand-build SSH', () => {
-  const scripts = moduleScripts();
+  const dirs = moduleDirs();
 
   test('scans a non-trivial set of module scripts (sanity — the scan actually ran)', () => {
-    expect(scripts.length).toBeGreaterThan(10);
+    const scanned = dirs.flatMap((d) => moduleScriptFiles(join(d, 'scripts')));
+    expect(scanned.length).toBeGreaterThan(10);
   });
 
-  test('no production module script hand-builds SSH (ssh string / ssh2)', () => {
-    const violations: string[] = [];
-    for (const file of scripts) {
-      const src = readFileSync(file, 'utf-8');
-      for (const b of BANNED) {
-        if (b.re.test(src)) violations.push(`${file}\n    → ${b.name}. ${b.hint}`);
-      }
-    }
-    expect(
-      violations,
-      `Hand-built SSH found in module scripts:\n  ${violations.join('\n  ')}`,
-    ).toEqual([]);
+  test('no production module script hand-builds SSH, and every runAppCommand* is justified', () => {
+    const violations = dirs.flatMap((d) => scanModuleDirectory(d));
+    expect(violations, `Module script policy violations:\n${formatViolations(violations)}`).toEqual(
+      [],
+    );
   });
 });

package/src/services/audit/cli-version.test.ts

@@ -50,11 +50,15 @@ describe('auditCliVersion', () => {
     expect(result[0].message).toContain('0.1.7');
   });
 
-  test('no finding when fetcher returns null (network failure)', async () => {
+  test('a registry we could not reach is unmeasured, not up-to-date', async () => {
+    // Was `expect(result).toEqual([])`. "I could not ask npm" and "you are on
+    // the latest" are different statements and rendered identically.
     const result = await auditCliVersion({
       installedVersion: '0.1.5',
       fetcher: async () => null,
     });
-    expect(result).toEqual([]);
+    expect(result).toHaveLength(1);
+    expect(result[0]?.severity).toBe('unmeasured');
+    expect(result[0]?.code).toBe('cli_version_unmeasured');
   });
 });

package/src/services/audit/cli-version.ts

@@ -2,11 +2,12 @@
  * CLI version drift check.
  *
  * Compares the running `@celilo/cli` version against the latest version
- * on npm. A newer published version produces a single `drift` finding;
- * a network failure (offline, npm down) produces no finding — we don't
- * want a transient lookup failure to block `system update`. Instead the
- * caller logs a debug warning. Schema drift, capability ABI drift, etc.
- * are the BLOCKED gates; CLI version is informational only.
+ * on npm. A newer published version produces a single `drift` finding; a
+ * network failure (offline, npm down) produces an `unmeasured` one. It used to
+ * produce nothing, which rendered as READY — "I could not ask npm" and "you are
+ * on the latest" are different statements and the operator should be able to
+ * tell them apart (D7). It still does not BLOCK: schema drift and capability
+ * ABI drift are the blocking gates; CLI version is informational.
  *
  * `latestVersionFetcher` is injectable so tests don't hit npm.
  */
@@ -67,7 +68,20 @@ export interface CliVersionAuditDeps {
 export async function auditCliVersion(deps: CliVersionAuditDeps): Promise<DriftFinding[]> {
   const fetcher = deps.fetcher ?? fetchLatestCliVersion;
   const latest = await fetcher();
-  if (!latest) return []; // network failure — silently no finding
+  if (!latest) {
+    return [
+      {
+        category: 'cli_version',
+        severity: 'unmeasured',
+        code: 'cli_version_unmeasured',
+        message: `@celilo/cli ${deps.installedVersion}: could not reach the npm registry, so version drift is unknown`,
+        remediation:
+          'Check outbound network to registry.npmjs.org, then re-audit. This finding records that the comparison did not happen, not that the CLI is current.',
+        actionable: false,
+        subject: 'system',
+      },
+    ];
+  }
 
   if (compareSemver(deps.installedVersion, latest) >= 0) {
     return []; // up to date or ahead (dev build)

package/src/services/audit/detect-without-converge.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, test } from 'bun:test';
+import type { ModuleManifest } from '../../manifest/schema';
+import { auditDetectWithoutConverge } from './detect-without-converge';
+
+function mod(
+  id: string,
+  manifest: Partial<ModuleManifest>,
+  state = 'INSTALLED',
+): { id: string; state: string; manifest: ModuleManifest } {
+  return { id, state, manifest: manifest as ModuleManifest };
+}
+
+const HOOK = { script: 'scripts/x.ts' };
+
+describe('auditDetectWithoutConverge', () => {
+  test('a convergence hook no subscription fires is drift', () => {
+    // celilo#934's shape: the module has the correcting code and nothing runs
+    // it, so drift is computed every health check and corrected never.
+    const findings = auditDetectWithoutConverge({
+      modules: [mod('wireguard', { hooks: { reconcile_peers: HOOK } })],
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.code).toBe('converge_hook_never_fires');
+    expect(findings[0]?.message).toContain('reconcile_peers');
+    expect(findings[0]?.subject).toBe('wireguard');
+  });
+
+  test('the same module WIRED UP is not reported', () => {
+    // This is `wireguard` after celilo#968.
+    const findings = auditDetectWithoutConverge({
+      modules: [
+        mod('wireguard', {
+          hooks: { reconcile_peers: HOOK },
+          subscriptions: [
+            { name: 'wireguard-peer-converge', pattern: 'timer.tick.15m', hook: 'reconcile_peers' },
+          ],
+        } as Partial<ModuleManifest>),
+      ],
+    });
+    expect(findings).toEqual([]);
+  });
+
+  test('a subscription firing a DIFFERENT hook does not count', () => {
+    const findings = auditDetectWithoutConverge({
+      modules: [
+        mod('m', {
+          hooks: { reconcile_peers: HOOK, reconcile_routes: HOOK },
+          subscriptions: [{ name: 's', pattern: 'timer.tick.15m', hook: 'reconcile_routes' }],
+        } as Partial<ModuleManifest>),
+      ],
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.message).toContain('reconcile_peers');
+    expect(findings[0]?.message).not.toContain('reconcile_routes');
+  });
+
+  test('a module with no convergence hook at all is not reported', () => {
+    // A module that detects drift and declares no correcting hook is a missing
+    // feature, not dead wiring. Guessing at it from `health_check` alone would
+    // flag most of the fleet.
+    expect(
+      auditDetectWithoutConverge({
+        modules: [mod('caddy', { hooks: { health_check: { script: 'x.ts' } } })],
+      }),
+    ).toEqual([]);
+  });
+
+  test('`list_peers` is detection, not convergence, and is not required to fire', () => {
+    expect(
+      auditDetectWithoutConverge({ modules: [mod('wireguard', { hooks: { list_peers: HOOK } })] }),
+    ).toEqual([]);
+  });
+
+  test('an undeployed module is not reported', () => {
+    expect(
+      auditDetectWithoutConverge({
+        modules: [mod('m', { hooks: { reconcile_peers: HOOK } }, 'IMPORTED')],
+      }),
+    ).toEqual([]);
+  });
+
+  test('the remediation is prose, and is NOT marked actionable', () => {
+    // The fix is an edit to a module's manifest. Marking it actionable would
+    // put a Remediate button on a modal that cannot do anything.
+    const findings = auditDetectWithoutConverge({
+      modules: [mod('wireguard', { hooks: { reconcile_peers: HOOK } })],
+    });
+    expect(findings[0]?.actionable).toBe(false);
+    expect(findings[0]?.remediation).toContain('manifest.yml');
+  });
+});

package/src/services/audit/detect-without-converge.ts

@@ -0,0 +1,81 @@
+/**
+ * A module that carries convergence code nothing ever runs
+ * (openspec/changes/module-integrity-rigor, D10; celilo#934).
+ *
+ * No convergence framework. celilo already has one — `subscriptions:` plus
+ * `timer.tick.<n>`, driven by the event bus, used by `technitium`,
+ * `wireguard-manager`, `namecheap` and `celilo-mgmt`. celilo#934 asked whether
+ * drift detection and correction deserve a shared shape; they have one. The
+ * gap was that nothing noticed when a module had the shape and not the wiring,
+ * so `wireguard` computed peer drift and corrected none of it.
+ *
+ * **What this rule actually checks, and how it narrows D10.** The design says
+ * "a module whose health check computes drift and whose manifest declares no
+ * reconcile subscription". The first half is not decidable from a manifest —
+ * celilo cannot read a hook script and tell whether it computes drift — so
+ * this checks the decidable, strictly stronger half: a module that DECLARES a
+ * convergence hook which no subscription fires. That names dead machinery with
+ * no interpretation and no false positives. A module that detects drift and
+ * declares no correcting hook at all is a missing feature, and a rule that
+ * guessed at it from `health_check` alone would flag most of the fleet.
+ */
+
+import type { ModuleManifest } from '../../manifest/schema';
+import type { DriftFinding } from './types';
+
+/**
+ * Hooks whose whole purpose is to CORRECT something. If one of these exists
+ * and nothing calls it, the module has the fix and never applies it.
+ *
+ * `list_peers` is deliberately absent: it reports what a tunnel carries and
+ * corrects nothing, so it is a detection hook and firing it on a timer would
+ * achieve nothing.
+ */
+const CONVERGENCE_HOOKS = [
+  'reconcile_routes',
+  'reconcile_clients',
+  'reconcile_peers',
+  'refresh_registrations',
+  'reassert_dhcp_dns',
+] as const;
+
+export interface DetectWithoutConvergeAuditDeps {
+  modules: { id: string; state: string; manifest: ModuleManifest }[];
+}
+
+const DEPLOYED_STATES = new Set(['INSTALLED', 'VERIFIED']);
+
+export function auditDetectWithoutConverge(deps: DetectWithoutConvergeAuditDeps): DriftFinding[] {
+  const findings: DriftFinding[] = [];
+
+  for (const module of deps.modules) {
+    if (!DEPLOYED_STATES.has(module.state)) continue;
+
+    const hooks = module.manifest.hooks ?? {};
+    const declared = CONVERGENCE_HOOKS.filter((name) => hooks[name] !== undefined);
+    if (declared.length === 0) continue;
+
+    const fired = new Set(
+      (module.manifest.subscriptions ?? []).map((s) => s.hook).filter((h): h is string => !!h),
+    );
+    const unfired = declared.filter((name) => !fired.has(name));
+    if (unfired.length === 0) continue;
+
+    findings.push({
+      category: 'detect_without_converge',
+      severity: 'drift',
+      code: 'converge_hook_never_fires',
+      message: `${module.id}: declares ${unfired.join(', ')} but no subscription ever fires ${unfired.length === 1 ? 'it' : 'them'} — drift is detected and never corrected`,
+      details:
+        'Add a `subscriptions:` entry on a `timer.tick.<n>` event naming the hook. `technitium`, `wireguard-manager`, `namecheap` and `celilo-mgmt` all do this; the machinery exists and this module is not wired into it.',
+      remediation: `Edit ${module.id}'s manifest.yml to add a subscriptions entry for ${unfired.join(', ')}, then 'celilo module update'.`,
+      // Prose, not a command: the fix is an edit to a module's manifest, and
+      // `actionable: true` on something no `celilo …` invocation performs would
+      // put a Remediate button on a modal that cannot do anything.
+      actionable: false,
+      subject: module.id,
+    });
+  }
+
+  return findings;
+}

package/src/services/audit/disk-space.test.ts

@@ -78,13 +78,16 @@ describe('auditDiskSpace', () => {
 
   // Unmeasurable must not read as healthy — but it must not page either, since
   // machines_reachable is already alerting for the same dead host.
-  test('an unmeasurable host is recorded as todo, not as healthy', () => {
+  test('an unmeasurable host is recorded as unmeasured, not as healthy', () => {
     const findings = auditDiskSpace({
       results: [usage({ hostname: 'iot', usedPercent: null, message: 'ssh: connect timed out' })],
     });
 
     expect(findings).toHaveLength(1);
-    expect(findings[0]?.severity).toBe('todo');
+    // Was `todo`, because that was the only non-paging severity available.
+    // `unmeasured` is what it always meant, and it stops the verdict returning
+    // READY.
+    expect(findings[0]?.severity).toBe('unmeasured');
     expect(findings[0]?.code).toBe('disk_unmeasured');
     expect(findings[0]?.details).toContain('timed out');
   });

package/src/services/audit/disk-space.ts

@@ -66,12 +66,14 @@ export function auditDiskSpace(deps: DiskSpaceAuditDeps): DriftFinding[] {
   for (const result of deps.results) {
     // Unmeasurable is NOT healthy — but it does not page either. The host is
     // already unreachable, `machines_reachable` is already alerting on it, and
-    // a second page for one dead host is noise. `todo` records without
-    // notifying, which is the existing severity for exactly that.
+    // a second page for one dead host is noise. This used to be filed as `todo`
+    // because that was the only non-paging severity available; `unmeasured`
+    // (D7) is what it always meant, and unlike `todo` it stops the verdict
+    // returning READY.
     if (result.usedPercent === null) {
       findings.push({
         category: 'disk_space',
-        severity: 'todo',
+        severity: 'unmeasured',
         code: 'disk_unmeasured',
         message: `${result.hostname}: disk usage could not be measured`,
         details: result.message,

package/src/services/audit/health.test.ts

@@ -81,4 +81,43 @@ describe('auditHealth', () => {
     expect(result).toHaveLength(2);
     expect(result.map((f) => f.subject).sort()).toEqual(['a', 'b']);
   });
+
+  test('firewall persistence drift reaches the audit as a drift finding', () => {
+    // The delivery path for celilo#670's fix: the iptables module reports drift
+    // as a `warn` health item, the runner turns any warn into `degraded`, and
+    // this turns `degraded` into an audit finding. No core code knows what an
+    // iptables rule is — which is the point (#941).
+    const unpersisted = '-A POSTROUTING -s 10.9.9.0/24 -o eth1 -j MASQUERADE';
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'iptables',
+        status: 'degraded',
+        checks: [
+          { name: 'ssh_access', status: 'pass', message: 'SSH connected to fw01' },
+          {
+            name: 'persistence_drift',
+            status: 'warn',
+            message: '1 live rule(s) absent from /etc/iptables/rules.v4 (lost on reboot)',
+            details: `live only: nat ${unpersisted}`,
+          },
+        ],
+      },
+    ];
+
+    return auditHealth({ results }).then((findings) => {
+      expect(findings).toHaveLength(1);
+      expect(findings[0]).toMatchObject({
+        category: 'health',
+        severity: 'drift',
+        subject: 'iptables',
+        actionable: true,
+      });
+      expect(findings[0].details).toContain('persistence_drift');
+      expect(findings[0].details).toContain('lost on reboot');
+      // The audit is a summary: it carries the COUNT, and points at the command
+      // that names the rules. `module health` prints check.details verbatim
+      // (cli/commands/module-health.ts:49), so every drifted rule is reachable.
+      expect(findings[0].remediation).toBe('celilo module health iptables --debug');
+    });
+  });
 });

package/src/services/audit/index.test.ts

@@ -11,7 +11,11 @@ const emptyDeps = {
     fetcher: async () => '0.1.5',
   },
   schema: {
-    journal: () => null,
+    // A READABLE journal with nothing pending. It used to be `() => null`,
+    // which now (correctly) reports `unmeasured` — an unreadable journal is not
+    // the same as a schema with no pending migrations, and this fixture means
+    // the latter.
+    journal: () => ({ version: '6', dialect: 'sqlite', entries: [] }),
     applied: () => [],
     db: fakeDb,
   },
@@ -26,6 +30,8 @@ const emptyDeps = {
     fetcher: async () => ({ latest: null }),
   },
   moduleConfigs: { modules: [] },
+  moduleIntegrity: { results: [] },
+  detectWithoutConverge: { modules: [] },
   health: { results: [] },
   backups: { modules: [] },
   abandonedOperations: { records: [] },

package/src/services/audit/index.ts

@@ -18,9 +18,14 @@ import { type BackupsAuditDeps, auditBackups } from './backups';
 import { type BrowserPinAuditDeps, auditBrowserPin } from './browser-pin';
 import { type CapabilityAbiAuditDeps, auditCapabilityAbi } from './capability-abi';
 import { type CliVersionAuditDeps, auditCliVersion } from './cli-version';
+import {
+  type DetectWithoutConvergeAuditDeps,
+  auditDetectWithoutConverge,
+} from './detect-without-converge';
 import { type HealthAuditDeps, auditHealth } from './health';
 import { type MachinesReachableAuditDeps, auditMachinesReachable } from './machines-reachable';
 import { type ModuleConfigsAuditDeps, auditModuleConfigs } from './module-configs';
+import { type ModuleIntegrityAuditDeps, auditModuleIntegrity } from './module-integrity';
 import { type ModuleVersionsAuditDeps, auditModuleVersions } from './module-versions';
 import { type PublicDnsAuditDeps, auditPublicDns } from './public-dns';
 import { type SchemaAuditDeps, auditSchema } from './schema';
@@ -53,6 +58,8 @@ export interface AuditDeps {
   terraformPlan: TerraformPlanAuditDeps;
   moduleVersions: ModuleVersionsAuditDeps;
   moduleConfigs: ModuleConfigsAuditDeps;
+  moduleIntegrity: ModuleIntegrityAuditDeps;
+  detectWithoutConverge: DetectWithoutConvergeAuditDeps;
   health: HealthAuditDeps;
   backups: BackupsAuditDeps;
   abandonedOperations: AbandonedOperationsAuditDeps;
@@ -107,6 +114,11 @@ export async function runAudit(
     wrap('terraform_plan', auditTerraformPlan(deps.terraformPlan)),
     wrap('module_versions', auditModuleVersions(deps.moduleVersions)),
     wrap('module_configs', auditModuleConfigs(deps.moduleConfigs)),
+    wrap('module_integrity', Promise.resolve(auditModuleIntegrity(deps.moduleIntegrity))),
+    wrap(
+      'detect_without_converge',
+      Promise.resolve(auditDetectWithoutConverge(deps.detectWithoutConverge)),
+    ),
     wrap('health', auditHealth(deps.health)),
     wrap('backups', auditBackups(deps.backups)),
     wrap(