@celilo/cli 1.5.0 → 1.6.0

package/src/module/packaging/host-plane.test.ts

@@ -0,0 +1,132 @@
+import { describe, expect, test } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { ModuleManifest } from '../../manifest/schema';
+import { classifyHostRecap, verifyModuleOnHosts } from './host-plane';
+
+const recap = (over: Partial<Parameters<typeof classifyHostRecap>[0]> = {}) => ({
+  host: 'vpn-manager',
+  changed: 0,
+  unreachable: 0,
+  failed: 0,
+  skipped: 0,
+  ...over,
+});
+
+describe('classifyHostRecap', () => {
+  test('nothing would change → converged', () => {
+    expect(classifyHostRecap(recap(), 'm').state).toBe('converged');
+  });
+
+  test('something would change → drift, and never blocked', () => {
+    const finding = classifyHostRecap(recap({ changed: 3 }), 'wireguard-manager');
+    expect(finding.state).toBe('drift');
+    expect(finding.detail).toContain('celilo module deploy wireguard-manager');
+  });
+
+  test('unreachable → unmeasured, not converged', () => {
+    expect(classifyHostRecap(recap({ unreachable: 1 }), 'm').state).toBe('unmeasured');
+  });
+
+  test('failed → unmeasured', () => {
+    expect(classifyHostRecap(recap({ failed: 1 }), 'm').state).toBe('unmeasured');
+  });
+
+  test('THE case that must not read as converged: check mode skipped tasks', () => {
+    // Ansible does not evaluate a task it cannot support — it SKIPS it. A role
+    // of `command:` / `shell:` tasks can finish with changed=0 having never
+    // been applied to the host at all. Two states would call that converged.
+    const finding = classifyHostRecap(recap({ skipped: 4 }), 'm');
+    expect(finding.state).toBe('unmeasured');
+    expect(finding.detail).toContain('4 task(s)');
+  });
+
+  test('a skip outranks a change, because the run as a whole was not measured', () => {
+    expect(classifyHostRecap(recap({ skipped: 1, changed: 2 }), 'm').state).toBe('unmeasured');
+  });
+});
+
+describe('verifyModuleOnHosts', () => {
+  function generatedTreeWithPlaybook(): string {
+    const root = mkdtempSync(join(tmpdir(), 'celilo-hostplane-'));
+    mkdirSync(join(root, 'ansible'), { recursive: true });
+    writeFileSync(join(root, 'ansible', 'playbook.yml'), '---\n- hosts: all\n');
+    return root;
+  }
+
+  const manifest = { id: 'm', name: 'M', version: '1.0.0' } as unknown as ModuleManifest;
+
+  test('a manifest opt-out is carried back, not silently dropped', async () => {
+    const optedOut = {
+      ...manifest,
+      verify: { deep: false, reason: 'the role is command:-driven' },
+    } as unknown as ModuleManifest;
+
+    const result = await verifyModuleOnHosts({
+      moduleId: 'm',
+      manifest: optedOut,
+      generatedPath: '/nonexistent',
+      execute: async () => {
+        throw new Error('must not run ansible for an opted-out module');
+      },
+    });
+    expect(result.optedOut?.reason).toBe('the role is command:-driven');
+    expect(result.findings).toEqual([]);
+  });
+
+  test('no generated playbook is unmeasured, not clean', async () => {
+    const result = await verifyModuleOnHosts({
+      moduleId: 'm',
+      manifest,
+      generatedPath: '/nonexistent',
+      execute: async () => {
+        throw new Error('must not run ansible without a playbook');
+      },
+    });
+    expect(result.findings.map((f) => f.state)).toEqual(['unmeasured']);
+  });
+
+  test('a run producing no PLAY RECAP is unmeasured, not clean', async () => {
+    // celilo#951's shape in another comparator: nothing measured, rendered as
+    // nothing wrong.
+    const root = generatedTreeWithPlaybook();
+    try {
+      const result = await verifyModuleOnHosts({
+        moduleId: 'm',
+        manifest,
+        generatedPath: root,
+        execute: async () => ({ success: false, output: 'ssh: connect refused', error: 'boom' }),
+      });
+      expect(result.findings.map((f) => f.state)).toEqual(['unmeasured']);
+      expect(result.findings[0]?.detail).toContain('no PLAY RECAP');
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('one finding per host in the recap', async () => {
+    const root = generatedTreeWithPlaybook();
+    try {
+      const result = await verifyModuleOnHosts({
+        moduleId: 'm',
+        manifest,
+        generatedPath: root,
+        execute: async () => ({
+          success: true,
+          output: [
+            'PLAY RECAP *********',
+            'vpn-manager : ok=10 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0',
+            'edge : ok=4 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0',
+          ].join('\n'),
+        }),
+      });
+      expect(result.findings).toEqual([
+        { hostname: 'vpn-manager', state: 'converged' },
+        expect.objectContaining({ hostname: 'edge', state: 'drift' }),
+      ]);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});

package/src/module/packaging/host-plane.ts

@@ -0,0 +1,135 @@
+/**
+ * The third plane: is the code running on the host the code we generated?
+ *
+ * Measured by asking Ansible, not by hashing files. celilo does not know where
+ * Ansible puts what it writes — the destination lives in the role's
+ * `tasks/main.yml` `dest:`, which celilo does not parse and should not start
+ * parsing. Ansible already computes exactly this, for every task, including
+ * templated files whose content celilo could not predict
+ * (openspec/changes/module-integrity-rigor, D4).
+ *
+ * This SSHes to every system the module deploys, so it is gated behind
+ * `--deep` and never runs in a default pass.
+ *
+ * The honest caveat, in the spec and not only in the code: check mode does not
+ * evaluate a task it cannot support — it SKIPS it — so a role built from
+ * `command:` / `shell:` tasks can finish a check run with `changed=0` having
+ * never been applied to the host at all. So a skip is `unmeasured`, never a
+ * pass, and a finding here is `drift`, never `blocked`. A check that cries wolf
+ * is the disease; shipping one here would be an unusually stupid way to catch
+ * it.
+ */
+
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import type { ModuleManifest } from '../../manifest/schema';
+import { executeAnsible, parseAnsibleRecap } from '../../services/deploy-ansible';
+
+/**
+ * `unmeasured` is not a hedge and must never collapse into `converged`.
+ * Absence of a change is not evidence of convergence when nothing was assessed.
+ */
+export type HostPlaneState = 'converged' | 'drift' | 'unmeasured';
+
+export interface HostPlaneFinding {
+  hostname: string;
+  state: HostPlaneState;
+  /** Why, in operator-facing words. Always set for anything but `converged`. */
+  detail?: string;
+}
+
+export interface HostPlaneResult {
+  findings: HostPlaneFinding[];
+  /**
+   * Set when the module declared `verify.deep: false`. Carried so callers can
+   * PRINT the opt-out — an opt-out nobody sees is a check that quietly
+   * disappeared.
+   */
+  optedOut?: { reason: string };
+}
+
+/**
+ * Classify one Ansible `PLAY RECAP` line. Pure, so the interesting decisions
+ * are testable without an SSH round trip.
+ */
+export function classifyHostRecap(
+  recap: { host: string; changed: number; unreachable: number; failed: number; skipped: number },
+  moduleId: string,
+): HostPlaneFinding {
+  if (recap.unreachable > 0 || recap.failed > 0) {
+    return {
+      hostname: recap.host,
+      state: 'unmeasured',
+      detail: 'The host could not be evaluated — it did not answer, or the play errored on it.',
+    };
+  }
+  if (recap.skipped > 0) {
+    return {
+      hostname: recap.host,
+      state: 'unmeasured',
+      detail: `${recap.skipped} task(s) check mode cannot evaluate were skipped, so convergence was not measured. Prefer check-capable Ansible modules (copy, template, lineinfile, file, package, service), or give a command/shell task an honest changed_when:.`,
+    };
+  }
+  if (recap.changed > 0) {
+    return {
+      hostname: recap.host,
+      state: 'drift',
+      detail: `The playbook would change ${recap.changed} thing(s) on this host, so what is running is not what celilo generated. Run 'celilo module deploy ${moduleId}' to converge it.`,
+    };
+  }
+  return { hostname: recap.host, state: 'converged' };
+}
+
+/**
+ * Evaluate the module's generated playbook against its systems in check mode.
+ *
+ * `executeAnsible(..., { check: true })` is the existing plumbing and the only
+ * one — `--check` is one argument, not a second execution path.
+ */
+export async function verifyModuleOnHosts(args: {
+  moduleId: string;
+  manifest: ModuleManifest;
+  generatedPath: string;
+  /** Injected in tests, exactly as `verifyAspectCoverage` does it. */
+  execute?: typeof executeAnsible;
+}): Promise<HostPlaneResult> {
+  const { moduleId, manifest, generatedPath } = args;
+
+  if (manifest.verify?.deep === false) {
+    return { findings: [], optedOut: { reason: manifest.verify.reason } };
+  }
+
+  const playbookPath = join(generatedPath, 'ansible', 'playbook.yml');
+  if (!existsSync(playbookPath)) {
+    return {
+      findings: [
+        {
+          hostname: '(none)',
+          state: 'unmeasured',
+          detail: `No generated playbook at ${playbookPath}. Run 'celilo module generate ${moduleId}' first.`,
+        },
+      ],
+    };
+  }
+
+  const execute = args.execute ?? executeAnsible;
+  const result = await execute(generatedPath, { check: true, noInteractive: true });
+  const recaps = parseAnsibleRecap(result.output ?? '');
+
+  if (recaps.length === 0) {
+    // A run that produced no recap at all must not read as success. This is
+    // the shape celilo#951 got wrong in another comparator: nothing measured,
+    // rendered as nothing wrong.
+    return {
+      findings: [
+        {
+          hostname: '(none)',
+          state: 'unmeasured',
+          detail: `Ansible produced no PLAY RECAP, so nothing was measured.${result.error ? ` ${result.error}` : ''}`,
+        },
+      ],
+    };
+  }
+
+  return { findings: recaps.map((recap) => classifyHostRecap(recap, moduleId)) };
+}

package/src/module/packaging/package-rules.ts

@@ -42,3 +42,65 @@ export function includeNodeModulesPath(relPath: string): boolean {
   if (nmIdx + 2 >= segments.length) return true; // node_modules/@celilo dir itself
   return segments[nmIdx + 2] === 'capabilities';
 }
+
+/**
+ * What a module-relative path IS, for integrity purposes.
+ *
+ * - `package`  the module's own content. Belongs in `checksums.json` and must
+ *              match it. A mismatch is a real finding.
+ * - `derived`  celilo writes or rewrites the on-disk copy, so its content is
+ *              not a stable integrity claim. Never a finding.
+ * - `unknown`  neither. Never packaged, never installed, and the only kind of
+ *              `[EXTRA]` worth printing.
+ */
+export type ModulePathClass = 'package' | 'derived' | 'unknown';
+
+/**
+ * The one answer to "what belongs to a module", replacing the four divergent
+ * copies that used to decide it independently (`build.ts#shouldExclude`,
+ * `audit.ts#FRAMEWORK_OWNED_PATHS`, `extract.ts#scanDirectory`,
+ * `import.ts#copyModuleFiles`). Every disagreement between them became a
+ * `module verify` violation — 72 of them across two healthy modules.
+ *
+ * `scripts/node_modules/**` is the interesting case: it is `derived`, because
+ * `module import` runs `bun install` over it and the bytes on disk stop
+ * matching the package's. It is nonetheless SHIPPED, because a target may have
+ * no reachable registry (ISS-0046) — that carve-out lives in `build.ts`, which
+ * composes this function with `includeNodeModulesPath` rather than restating
+ * either rule.
+ */
+export function classifyModulePath(relPath: string): ModulePathClass {
+  const segments = relPath.split('/');
+  const name = segments[segments.length - 1] ?? '';
+
+  // The module's own e2e/ tree is tests plus their deps, including a
+  // node_modules of its own. Excluded whole, before anything below.
+  if (segments[0] === 'e2e') return 'unknown';
+
+  // Anything under a `node_modules` segment is decided by the canonical rule
+  // and by nothing else. Ordering matters: a vendored dependency ships files
+  // named `*.test.ts` (`@celilo/capabilities/src/remote.test.ts` is on the
+  // fleet right now) and those are the DEPENDENCY's, not the module's.
+  if (segments.includes('node_modules')) {
+    return includeNodeModulesPath(relPath) ? 'derived' : 'unknown';
+  }
+
+  // Source-tree noise. A module's git repo has it, a module's install never
+  // should, so on an installed tree it is a real finding.
+  if (segments.some((s) => s === '.git' || s === '.next' || s === '.cache')) return 'unknown';
+  if (name === '.DS_Store') return 'unknown';
+  // scripts/tsconfig.json exists so tsc can check hooks in CI. Nothing on a
+  // target ever runs tsc.
+  if (name === 'tsconfig.json') return 'unknown';
+  if (name.endsWith('.netapp') || name.endsWith('.test.ts')) return 'unknown';
+
+  // Celilo's own output under the module's install root.
+  if (segments[0] === 'generated' || segments[0] === 'screenshots') return 'derived';
+  // A checksum manifest cannot list itself, nor the signature over it.
+  if (relPath === 'checksums.json' || relPath === 'signature.sig') return 'derived';
+  // Regenerated by `module import` from the manifest (HOOK_API_V2 Phase 2).
+  if (relPath === 'celilo/types.d.ts') return 'derived';
+  if (relPath === 'cookies.json') return 'derived';
+
+  return 'package';
+}

package/src/services/audit/cli-version.test.ts

@@ -50,11 +50,15 @@ describe('auditCliVersion', () => {
     expect(result[0].message).toContain('0.1.7');
   });
 
-  test('no finding when fetcher returns null (network failure)', async () => {
+  test('a registry we could not reach is unmeasured, not up-to-date', async () => {
+    // Was `expect(result).toEqual([])`. "I could not ask npm" and "you are on
+    // the latest" are different statements and rendered identically.
     const result = await auditCliVersion({
       installedVersion: '0.1.5',
       fetcher: async () => null,
     });
-    expect(result).toEqual([]);
+    expect(result).toHaveLength(1);
+    expect(result[0]?.severity).toBe('unmeasured');
+    expect(result[0]?.code).toBe('cli_version_unmeasured');
   });
 });

package/src/services/audit/cli-version.ts

@@ -2,11 +2,12 @@
  * CLI version drift check.
  *
  * Compares the running `@celilo/cli` version against the latest version
- * on npm. A newer published version produces a single `drift` finding;
- * a network failure (offline, npm down) produces no finding — we don't
- * want a transient lookup failure to block `system update`. Instead the
- * caller logs a debug warning. Schema drift, capability ABI drift, etc.
- * are the BLOCKED gates; CLI version is informational only.
+ * on npm. A newer published version produces a single `drift` finding; a
+ * network failure (offline, npm down) produces an `unmeasured` one. It used to
+ * produce nothing, which rendered as READY — "I could not ask npm" and "you are
+ * on the latest" are different statements and the operator should be able to
+ * tell them apart (D7). It still does not BLOCK: schema drift and capability
+ * ABI drift are the blocking gates; CLI version is informational.
  *
  * `latestVersionFetcher` is injectable so tests don't hit npm.
  */
@@ -67,7 +68,20 @@ export interface CliVersionAuditDeps {
 export async function auditCliVersion(deps: CliVersionAuditDeps): Promise<DriftFinding[]> {
   const fetcher = deps.fetcher ?? fetchLatestCliVersion;
   const latest = await fetcher();
-  if (!latest) return []; // network failure — silently no finding
+  if (!latest) {
+    return [
+      {
+        category: 'cli_version',
+        severity: 'unmeasured',
+        code: 'cli_version_unmeasured',
+        message: `@celilo/cli ${deps.installedVersion}: could not reach the npm registry, so version drift is unknown`,
+        remediation:
+          'Check outbound network to registry.npmjs.org, then re-audit. This finding records that the comparison did not happen, not that the CLI is current.',
+        actionable: false,
+        subject: 'system',
+      },
+    ];
+  }
 
   if (compareSemver(deps.installedVersion, latest) >= 0) {
     return []; // up to date or ahead (dev build)

package/src/services/audit/detect-without-converge.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, test } from 'bun:test';
+import type { ModuleManifest } from '../../manifest/schema';
+import { auditDetectWithoutConverge } from './detect-without-converge';
+
+function mod(
+  id: string,
+  manifest: Partial<ModuleManifest>,
+  state = 'INSTALLED',
+): { id: string; state: string; manifest: ModuleManifest } {
+  return { id, state, manifest: manifest as ModuleManifest };
+}
+
+const HOOK = { script: 'scripts/x.ts' };
+
+describe('auditDetectWithoutConverge', () => {
+  test('a convergence hook no subscription fires is drift', () => {
+    // celilo#934's shape: the module has the correcting code and nothing runs
+    // it, so drift is computed every health check and corrected never.
+    const findings = auditDetectWithoutConverge({
+      modules: [mod('wireguard', { hooks: { reconcile_peers: HOOK } })],
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.code).toBe('converge_hook_never_fires');
+    expect(findings[0]?.message).toContain('reconcile_peers');
+    expect(findings[0]?.subject).toBe('wireguard');
+  });
+
+  test('the same module WIRED UP is not reported', () => {
+    // This is `wireguard` after celilo#968.
+    const findings = auditDetectWithoutConverge({
+      modules: [
+        mod('wireguard', {
+          hooks: { reconcile_peers: HOOK },
+          subscriptions: [
+            { name: 'wireguard-peer-converge', pattern: 'timer.tick.15m', hook: 'reconcile_peers' },
+          ],
+        } as Partial<ModuleManifest>),
+      ],
+    });
+    expect(findings).toEqual([]);
+  });
+
+  test('a subscription firing a DIFFERENT hook does not count', () => {
+    const findings = auditDetectWithoutConverge({
+      modules: [
+        mod('m', {
+          hooks: { reconcile_peers: HOOK, reconcile_routes: HOOK },
+          subscriptions: [{ name: 's', pattern: 'timer.tick.15m', hook: 'reconcile_routes' }],
+        } as Partial<ModuleManifest>),
+      ],
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.message).toContain('reconcile_peers');
+    expect(findings[0]?.message).not.toContain('reconcile_routes');
+  });
+
+  test('a module with no convergence hook at all is not reported', () => {
+    // A module that detects drift and declares no correcting hook is a missing
+    // feature, not dead wiring. Guessing at it from `health_check` alone would
+    // flag most of the fleet.
+    expect(
+      auditDetectWithoutConverge({
+        modules: [mod('caddy', { hooks: { health_check: { script: 'x.ts' } } })],
+      }),
+    ).toEqual([]);
+  });
+
+  test('`list_peers` is detection, not convergence, and is not required to fire', () => {
+    expect(
+      auditDetectWithoutConverge({ modules: [mod('wireguard', { hooks: { list_peers: HOOK } })] }),
+    ).toEqual([]);
+  });
+
+  test('an undeployed module is not reported', () => {
+    expect(
+      auditDetectWithoutConverge({
+        modules: [mod('m', { hooks: { reconcile_peers: HOOK } }, 'IMPORTED')],
+      }),
+    ).toEqual([]);
+  });
+
+  test('the remediation is prose, and is NOT marked actionable', () => {
+    // The fix is an edit to a module's manifest. Marking it actionable would
+    // put a Remediate button on a modal that cannot do anything.
+    const findings = auditDetectWithoutConverge({
+      modules: [mod('wireguard', { hooks: { reconcile_peers: HOOK } })],
+    });
+    expect(findings[0]?.actionable).toBe(false);
+    expect(findings[0]?.remediation).toContain('manifest.yml');
+  });
+});

package/src/services/audit/detect-without-converge.ts

@@ -0,0 +1,81 @@
+/**
+ * A module that carries convergence code nothing ever runs
+ * (openspec/changes/module-integrity-rigor, D10; celilo#934).
+ *
+ * No convergence framework. celilo already has one — `subscriptions:` plus
+ * `timer.tick.<n>`, driven by the event bus, used by `technitium`,
+ * `wireguard-manager`, `namecheap` and `celilo-mgmt`. celilo#934 asked whether
+ * drift detection and correction deserve a shared shape; they have one. The
+ * gap was that nothing noticed when a module had the shape and not the wiring,
+ * so `wireguard` computed peer drift and corrected none of it.
+ *
+ * **What this rule actually checks, and how it narrows D10.** The design says
+ * "a module whose health check computes drift and whose manifest declares no
+ * reconcile subscription". The first half is not decidable from a manifest —
+ * celilo cannot read a hook script and tell whether it computes drift — so
+ * this checks the decidable, strictly stronger half: a module that DECLARES a
+ * convergence hook which no subscription fires. That names dead machinery with
+ * no interpretation and no false positives. A module that detects drift and
+ * declares no correcting hook at all is a missing feature, and a rule that
+ * guessed at it from `health_check` alone would flag most of the fleet.
+ */
+
+import type { ModuleManifest } from '../../manifest/schema';
+import type { DriftFinding } from './types';
+
+/**
+ * Hooks whose whole purpose is to CORRECT something. If one of these exists
+ * and nothing calls it, the module has the fix and never applies it.
+ *
+ * `list_peers` is deliberately absent: it reports what a tunnel carries and
+ * corrects nothing, so it is a detection hook and firing it on a timer would
+ * achieve nothing.
+ */
+const CONVERGENCE_HOOKS = [
+  'reconcile_routes',
+  'reconcile_clients',
+  'reconcile_peers',
+  'refresh_registrations',
+  'reassert_dhcp_dns',
+] as const;
+
+export interface DetectWithoutConvergeAuditDeps {
+  modules: { id: string; state: string; manifest: ModuleManifest }[];
+}
+
+const DEPLOYED_STATES = new Set(['INSTALLED', 'VERIFIED']);
+
+export function auditDetectWithoutConverge(deps: DetectWithoutConvergeAuditDeps): DriftFinding[] {
+  const findings: DriftFinding[] = [];
+
+  for (const module of deps.modules) {
+    if (!DEPLOYED_STATES.has(module.state)) continue;
+
+    const hooks = module.manifest.hooks ?? {};
+    const declared = CONVERGENCE_HOOKS.filter((name) => hooks[name] !== undefined);
+    if (declared.length === 0) continue;
+
+    const fired = new Set(
+      (module.manifest.subscriptions ?? []).map((s) => s.hook).filter((h): h is string => !!h),
+    );
+    const unfired = declared.filter((name) => !fired.has(name));
+    if (unfired.length === 0) continue;
+
+    findings.push({
+      category: 'detect_without_converge',
+      severity: 'drift',
+      code: 'converge_hook_never_fires',
+      message: `${module.id}: declares ${unfired.join(', ')} but no subscription ever fires ${unfired.length === 1 ? 'it' : 'them'} — drift is detected and never corrected`,
+      details:
+        'Add a `subscriptions:` entry on a `timer.tick.<n>` event naming the hook. `technitium`, `wireguard-manager`, `namecheap` and `celilo-mgmt` all do this; the machinery exists and this module is not wired into it.',
+      remediation: `Edit ${module.id}'s manifest.yml to add a subscriptions entry for ${unfired.join(', ')}, then 'celilo module update'.`,
+      // Prose, not a command: the fix is an edit to a module's manifest, and
+      // `actionable: true` on something no `celilo …` invocation performs would
+      // put a Remediate button on a modal that cannot do anything.
+      actionable: false,
+      subject: module.id,
+    });
+  }
+
+  return findings;
+}

package/src/services/audit/disk-space.test.ts

@@ -78,13 +78,16 @@ describe('auditDiskSpace', () => {
 
   // Unmeasurable must not read as healthy — but it must not page either, since
   // machines_reachable is already alerting for the same dead host.
-  test('an unmeasurable host is recorded as todo, not as healthy', () => {
+  test('an unmeasurable host is recorded as unmeasured, not as healthy', () => {
     const findings = auditDiskSpace({
       results: [usage({ hostname: 'iot', usedPercent: null, message: 'ssh: connect timed out' })],
     });
 
     expect(findings).toHaveLength(1);
-    expect(findings[0]?.severity).toBe('todo');
+    // Was `todo`, because that was the only non-paging severity available.
+    // `unmeasured` is what it always meant, and it stops the verdict returning
+    // READY.
+    expect(findings[0]?.severity).toBe('unmeasured');
     expect(findings[0]?.code).toBe('disk_unmeasured');
     expect(findings[0]?.details).toContain('timed out');
   });

package/src/services/audit/disk-space.ts

@@ -66,12 +66,14 @@ export function auditDiskSpace(deps: DiskSpaceAuditDeps): DriftFinding[] {
   for (const result of deps.results) {
     // Unmeasurable is NOT healthy — but it does not page either. The host is
     // already unreachable, `machines_reachable` is already alerting on it, and
-    // a second page for one dead host is noise. `todo` records without
-    // notifying, which is the existing severity for exactly that.
+    // a second page for one dead host is noise. This used to be filed as `todo`
+    // because that was the only non-paging severity available; `unmeasured`
+    // (D7) is what it always meant, and unlike `todo` it stops the verdict
+    // returning READY.
     if (result.usedPercent === null) {
       findings.push({
         category: 'disk_space',
-        severity: 'todo',
+        severity: 'unmeasured',
         code: 'disk_unmeasured',
         message: `${result.hostname}: disk usage could not be measured`,
         details: result.message,

package/src/services/audit/health.test.ts

@@ -81,4 +81,43 @@ describe('auditHealth', () => {
     expect(result).toHaveLength(2);
     expect(result.map((f) => f.subject).sort()).toEqual(['a', 'b']);
   });
+
+  test('firewall persistence drift reaches the audit as a drift finding', () => {
+    // The delivery path for celilo#670's fix: the iptables module reports drift
+    // as a `warn` health item, the runner turns any warn into `degraded`, and
+    // this turns `degraded` into an audit finding. No core code knows what an
+    // iptables rule is — which is the point (#941).
+    const unpersisted = '-A POSTROUTING -s 10.9.9.0/24 -o eth1 -j MASQUERADE';
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'iptables',
+        status: 'degraded',
+        checks: [
+          { name: 'ssh_access', status: 'pass', message: 'SSH connected to fw01' },
+          {
+            name: 'persistence_drift',
+            status: 'warn',
+            message: '1 live rule(s) absent from /etc/iptables/rules.v4 (lost on reboot)',
+            details: `live only: nat ${unpersisted}`,
+          },
+        ],
+      },
+    ];
+
+    return auditHealth({ results }).then((findings) => {
+      expect(findings).toHaveLength(1);
+      expect(findings[0]).toMatchObject({
+        category: 'health',
+        severity: 'drift',
+        subject: 'iptables',
+        actionable: true,
+      });
+      expect(findings[0].details).toContain('persistence_drift');
+      expect(findings[0].details).toContain('lost on reboot');
+      // The audit is a summary: it carries the COUNT, and points at the command
+      // that names the rules. `module health` prints check.details verbatim
+      // (cli/commands/module-health.ts:49), so every drifted rule is reachable.
+      expect(findings[0].remediation).toBe('celilo module health iptables --debug');
+    });
+  });
 });

package/src/services/audit/index.test.ts

@@ -11,7 +11,11 @@ const emptyDeps = {
     fetcher: async () => '0.1.5',
   },
   schema: {
-    journal: () => null,
+    // A READABLE journal with nothing pending. It used to be `() => null`,
+    // which now (correctly) reports `unmeasured` — an unreadable journal is not
+    // the same as a schema with no pending migrations, and this fixture means
+    // the latter.
+    journal: () => ({ version: '6', dialect: 'sqlite', entries: [] }),
     applied: () => [],
     db: fakeDb,
   },
@@ -26,6 +30,8 @@ const emptyDeps = {
     fetcher: async () => ({ latest: null }),
   },
   moduleConfigs: { modules: [] },
+  moduleIntegrity: { results: [] },
+  detectWithoutConverge: { modules: [] },
   health: { results: [] },
   backups: { modules: [] },
   abandonedOperations: { records: [] },