@celilo/cli 1.5.0 → 1.7.0

package/src/cli/commands/module-update.ts

@@ -9,18 +9,28 @@
  * The module ID is read from the manifest at the given path.
  */
 
-import { cpSync, existsSync, readFileSync, readdirSync } from 'node:fs';
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+} from 'node:fs';
 import { unlink } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join, resolve } from 'node:path';
+import { join, relative, resolve } from 'node:path';
 import { eq } from 'drizzle-orm';
 import { parse as parseYaml } from 'yaml';
 import { registerModuleCapabilities } from '../../capabilities/registration';
 import { getDb } from '../../db/client';
-import { capabilities, modules } from '../../db/schema';
+import { capabilities, moduleIntegrity, modules } from '../../db/schema';
 import { ModuleManifestSchema } from '../../manifest/schema';
 import type { ModuleManifest } from '../../manifest/schema';
+import { computeChecksums } from '../../module/packaging/build';
 import { cleanupTempDir, extractPackage } from '../../module/packaging/extract';
+import { classifyModulePath } from '../../module/packaging/package-rules';
 import { RegistryClient } from '../../registry/client';
 import { askConfirm, withInterviewSession } from '../../services/bus-interview';
 import { InterviewAbandonedError, InterviewUnansweredError } from '../../services/interview-errors';
@@ -152,6 +162,119 @@ export async function fetchAndUpdate(
 /**
  * Upgrade a single module from a source path
  */
+/**
+ * Every file under an installed module that an update is entitled to remove:
+ * `package` (the new version decides whether it survives) and `unknown` (no
+ * version ever shipped it, so it self-heals a tree an older update polluted).
+ *
+ * `derived` is neither walked nor removed. It is celilo's or the operator's —
+ * `generated/`, the hook runtime closure, `screenshots/`, `cookies.json` — and
+ * `generated/` alone carries terraform state and provider binaries.
+ */
+/**
+ * What an update leaves alone: celilo's own output and the operator's state,
+ * never the package's. The set the in-place update skipped, kept verbatim so
+ * the staging swap changes only WHEN files move, not WHICH ones.
+ */
+const PRESERVED_ENTRIES = new Set(['generated', 'screenshots', 'cookies.json']);
+
+function listPrunableFiles(root: string, dir = root): string[] {
+  const found: string[] = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name);
+    const rel = relative(root, full);
+    if (classifyModulePath(rel) === 'derived') continue;
+    if (entry.isDirectory()) {
+      found.push(...listPrunableFiles(root, full));
+    } else if (entry.isFile()) {
+      found.push(rel);
+    }
+  }
+  return found;
+}
+
+/**
+ * Replace an installed module tree atomically (celilo#1008).
+ *
+ * The install used to be built in place: copy the new files over the old,
+ * then prune what the new version dropped. A failure anywhere in that
+ * sequence left a module half old and half new, with nothing on disk or in
+ * the DB recording which files were which. The comment on the in-place copy
+ * already named the hazard — "the copy dies partway, after the prune has
+ * already run".
+ *
+ * So the new tree is assembled in a sibling directory and swapped in with two
+ * renames. Everything that can fail — the copy, the prune, a bad source —
+ * fails while the live install is still untouched, because nothing has moved
+ * yet. If the second rename throws, the first is undone and the original is
+ * back. A sibling is deliberate: it is on the same filesystem, so the renames
+ * are atomic rather than a copy in disguise.
+ *
+ * The staging tree is removed on both paths, so a failure leaves no debris
+ * beside the module for the next reader to wonder about.
+ *
+ * `prune` receives the STAGED root, so the surviving-path rule is the one
+ * `updateOne` has always applied — only where it runs has changed.
+ *
+ * Adapted from `replaceInstalledModule` in Jeremy Banka's `f9a57f1b`. The rest
+ * of that commit is superseded by celilo#925; this half is not. It uses
+ * celilo's `classifyModulePath` rather than that commit's hand-rolled
+ * preserve/skip sets, which is what makes the `celilo/types.d.ts` special case
+ * it carried unnecessary — the classifier already calls that file `derived`.
+ */
+function replaceInstalledModule(
+  actualPath: string,
+  installedPath: string,
+  prune: (stagedRoot: string) => void,
+): void {
+  const suffix = `${process.pid}-${Date.now()}`;
+  const stagedPath = `${installedPath}.update-${suffix}`;
+  const previousPath = `${installedPath}.previous-${suffix}`;
+
+  rmSync(stagedPath, { recursive: true, force: true });
+  mkdirSync(stagedPath, { recursive: true });
+
+  try {
+    // The incoming version, filtered by the same classifier the in-place copy
+    // used, so an update from a directory still cannot plant `e2e/`,
+    // `*.test.ts` or `scripts/tsconfig.json` in the install.
+    for (const entry of readdirSync(actualPath)) {
+      if (PRESERVED_ENTRIES.has(entry)) continue;
+      cpSync(join(actualPath, entry), join(stagedPath, entry), {
+        recursive: true,
+        force: true,
+        filter: (from) => classifyModulePath(relative(actualPath, from)) !== 'unknown',
+      });
+    }
+
+    // Carry the live tree's own copies across. Same three entries the in-place
+    // update left alone, for the same reason: they are celilo's or the
+    // operator's, not the package's. Every other `derived` path — the hook
+    // runtime closure under `scripts/node_modules`, `celilo/types.d.ts` —
+    // still comes from the incoming version exactly as it did before, so a new
+    // module version can still deliver new hook dependencies.
+    for (const entry of PRESERVED_ENTRIES) {
+      const from = join(installedPath, entry);
+      if (!existsSync(from)) continue;
+      cpSync(from, join(stagedPath, entry), { recursive: true, force: true });
+    }
+
+    prune(stagedPath);
+
+    renameSync(installedPath, previousPath);
+    try {
+      renameSync(stagedPath, installedPath);
+    } catch (error) {
+      renameSync(previousPath, installedPath);
+      throw error;
+    }
+    rmSync(previousPath, { recursive: true, force: true });
+  } catch (error) {
+    rmSync(stagedPath, { recursive: true, force: true });
+    throw error;
+  }
+}
+
 export async function updateOne(
   sourcePath: string,
   db: ReturnType<typeof getDb>,
@@ -241,6 +364,20 @@ export async function updateOne(
     };
   }
 
+  // Pointed at the module's OWN install, `updateOne` used to copy every file
+  // onto itself and die inside `cpSync` with `EINVAL: copy_file_range` — an
+  // error that names a syscall and not the mistake. Worse since D1: the copy
+  // dies partway, after the prune has already run. Refuse by name instead
+  // (D11).
+  if (resolve(actualPath) === resolve(module.sourcePath)) {
+    if (tempDir) await cleanupTempDir(tempDir);
+    return {
+      status: 'failed',
+      moduleId,
+      error: `'${sourcePath}' IS the installed copy of ${moduleId}. There is nothing to update it from. Point 'module update' at the module's source tree or a .netapp, or run 'celilo module upgrade ${moduleId}' to take the registry's version.`,
+    };
+  }
+
   // Old version comes from the DB so we capture whatever was last
   // recorded (which IS the registry-versioned form, e.g. "1.0.0+5",
   // for registry-driven installs/upgrades).
@@ -253,22 +390,79 @@ export async function updateOne(
     log.info(`Upgrading ${moduleId}: ${previousVersion} → ${newVersion}`);
   }
 
-  // Copy new module files, preserving generated output and state
   const installedPath = module.sourcePath;
-  const preserveDirs = new Set(['generated', 'screenshots', 'cookies.json']);
 
-  const skipDirs = new Set(['.git', 'node_modules', '.next', '.cache']);
-  const entries = readdirSync(actualPath);
-  for (const entry of entries) {
-    if (preserveDirs.has(entry) || skipDirs.has(entry)) continue;
-    const src = join(actualPath, entry);
-    const dest = join(installedPath, entry);
-    cpSync(src, dest, { recursive: true, force: true });
+  // The integrity baseline for the version just installed. Prefer the package's
+  // own signed `checksums.json`; a directory update has none, so compute over
+  // the source we just copied. Read before the temp dir goes away.
+  const packagedChecksumsPath = join(actualPath, 'checksums.json');
+  const packagedSignaturePath = join(actualPath, 'signature.sig');
+  let baselineChecksums: Record<string, string>;
+  if (existsSync(packagedChecksumsPath)) {
+    const parsed = JSON.parse(readFileSync(packagedChecksumsPath, 'utf-8')) as {
+      files?: Record<string, string>;
+    };
+    baselineChecksums = parsed.files ?? {};
+  } else {
+    baselineChecksums = (await computeChecksums(actualPath)).files;
   }
+  const packagedSignature = existsSync(packagedSignaturePath)
+    ? readFileSync(packagedSignaturePath, 'utf-8').trim()
+    : null;
 
   // Clean up temp dir if we extracted a .netapp
   if (tempDir) await cleanupTempDir(tempDir);
 
+  // Remove what the new version dropped. `updateOne` only ever overlaid files,
+  // so a hook script deleted in 1.1.0 stayed on the box and stayed runnable —
+  // code celilo no longer believes it has installed, which is the same class of
+  // lie as celilo#925 pointing the other way. Only `package`-class paths are
+  // pruned: `generated/`, the hook runtime closure, `screenshots/` and
+  // `cookies.json` are celilo's or the operator's, and survive an update by
+  // design.
+  //
+  // Unchanged except for WHERE it runs. It now prunes the staged tree, before
+  // anything is swapped in, so a prune that throws cannot leave the live
+  // install short of files (celilo#1008).
+  const survivingPaths = new Set(
+    Object.keys(baselineChecksums).filter((p) => classifyModulePath(p) === 'package'),
+  );
+  const pruneDropped = (root: string) => {
+    for (const relPath of listPrunableFiles(root)) {
+      if (!survivingPaths.has(relPath)) {
+        rmSync(join(root, relPath));
+      }
+    }
+  };
+
+  // Build the new tree beside the install and swap it in with two renames.
+  // Everything above this line is reversible by doing nothing; everything
+  // below it runs only once the files are really in place.
+  replaceInstalledModule(actualPath, installedPath, pruneDropped);
+
+  // Record it. `updateOne` never touched this table, so the baseline stayed
+  // frozen at the module's FIRST import no matter how many times it was
+  // updated. That is why `module verify` reported the same violations whether
+  // the files were old or the checksums were old, and could not answer the one
+  // question that matters (celilo#925).
+  db.insert(moduleIntegrity)
+    .values({
+      moduleId,
+      checksums: baselineChecksums,
+      version: newVersion,
+      signature: packagedSignature,
+    })
+    .onConflictDoUpdate({
+      target: moduleIntegrity.moduleId,
+      set: {
+        checksums: baselineChecksums,
+        version: newVersion,
+        signature: packagedSignature,
+        updatedAt: new Date(),
+      },
+    })
+    .run();
+
   // Update manifest in database. We persist the display version (with
   // +N when known) so subsequent `module list` / `module update` calls
   // see the same version string the registry reported.

package/src/cli/commands/module-verify.ts

@@ -1,53 +1,117 @@
 import { auditModule } from '../../module/packaging/audit';
+import type { IntegrityViolation } from '../../module/packaging/extract';
+import { hasFlag } from '../parser';
 import type { CommandResult } from '../types';
 
 /**
- * Verify module integrity (signature + checksums).
+ * Verify module integrity across the three planes a module lives in.
  *
- * Usage: celilo module verify <module-id>
+ * Usage: celilo module verify <module-id> [--deep] [--json]
+ *
+ *   installed tree vs baseline      did anything change the files since install?
+ *   generated project vs installed  is what we would deploy built from it?
+ *   host vs generated project       is what is running what we generated?  (--deep)
+ *
+ * The first two are local and take milliseconds. `--deep` is one SSH per
+ * system, so it is opt-in (openspec/changes/module-integrity-rigor, D3).
  *
  * Renamed from `module audit` per CELILO_UPDATE D11 — `audit` is now
  * reserved for system-level drift detection (`celilo system audit`).
  * The legacy `module audit` continues to work via a deprecation alias
  * (see `module-audit.ts`).
  *
- * Returns a CommandResult so the dispatcher controls process exit
- * behavior.
+ * Returns a CommandResult so the dispatcher controls process exit behavior.
  */
-export async function moduleVerify(args: string[]): Promise<CommandResult> {
+export async function moduleVerify(
+  args: string[],
+  flags: Record<string, string | boolean> = {},
+): Promise<CommandResult> {
   if (args.length === 0) {
     return {
       success: false,
-      error: 'Module ID is required\n\nUsage: celilo module verify <module-id>',
+      error: 'Module ID is required\n\nUsage: celilo module verify <module-id> [--deep] [--json]',
     };
   }
 
   const moduleId = args[0];
+  const deep = hasFlag(flags, 'deep');
+  const json = hasFlag(flags, 'json');
+
+  const result = await auditModule(moduleId, undefined, { deep });
 
-  const result = await auditModule(moduleId);
+  if (json) {
+    // The whole point of D9: one call answers "is the installed tree the
+    // version celilo thinks it is", with the digests on both sides, so nobody
+    // needs a shell on celilo-mgr to settle a celilo#925-shaped question.
+    const payload = {
+      moduleId,
+      deep,
+      ok: result.success && !result.error,
+      error: result.error ?? null,
+      moduleVersion: result.moduleVersion ?? null,
+      baselineVersion: result.baselineVersion ?? null,
+      violations: result.violations.map((v) => ({
+        type: v.type,
+        path: v.path,
+        message: v.message,
+        expectedDigest: v.expectedDigest ?? null,
+        actualDigest: v.actualDigest ?? null,
+      })),
+      hosts: result.hostPlane?.findings ?? [],
+      deepOptOut: result.hostPlane?.optedOut ?? null,
+    };
+    const text = JSON.stringify(payload, null, 2);
+    return payload.ok ? { success: true, message: text } : { success: false, error: text };
+  }
 
   if (result.error) {
     return { success: false, error: result.error };
   }
 
+  const lines: string[] = [];
+
+  // An opt-out nobody sees is a check that quietly disappeared, so it prints
+  // whether the module is clean or not (task 6.3).
+  if (result.hostPlane?.optedOut) {
+    lines.push(
+      `  ⚠ [DEEP SKIPPED] This module opts out of the host check: ${result.hostPlane.optedOut.reason}`,
+    );
+  }
+  for (const finding of result.hostPlane?.findings ?? []) {
+    if (finding.state === 'converged') {
+      lines.push(`  ✓ [HOST] ${finding.hostname}: running what celilo generated`);
+    } else {
+      const tag = finding.state === 'drift' ? 'HOST-DRIFT' : 'HOST-UNMEASURED';
+      lines.push(
+        `  ${finding.state === 'drift' ? '✗' : '⚠'} [${tag}] ${finding.hostname}: ${finding.detail}`,
+      );
+    }
+  }
+
   if (result.success) {
     return {
       success: true,
-      message: `Module '${moduleId}' passed integrity check\n  No violations found.`,
+      message: [`Module '${moduleId}' passed integrity check`, ...lines, '  No violations found.']
+        .join('\n')
+        .trimEnd(),
     };
   }
 
-  const violationLines = result.violations.map((v) => {
-    const icon = v.type === 'missing' ? '⚠' : v.type === 'modified' ? '✗' : '!';
-    return `  ${icon} [${v.type.toUpperCase()}] ${v.message}`;
-  });
+  const ICONS: Record<IntegrityViolation['type'], string> = {
+    missing: '⚠',
+    modified: '✗',
+    extra: '!',
+    'stale-baseline': '⚠',
+    'stale-generated': '✗',
+  };
 
   return {
     success: false,
     error: [
       `Module '${moduleId}' failed integrity check`,
       `  Found ${result.violations.length} violation(s):`,
-      ...violationLines,
+      ...result.violations.map((v) => `  ${ICONS[v.type]} [${v.type.toUpperCase()}] ${v.message}`),
+      ...lines,
     ].join('\n'),
   };
 }

package/src/cli/commands/service-set-credentials.test.ts

@@ -0,0 +1,108 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { closeDb } from '../../db/client';
+import { runMigrations } from '../../db/migrate';
+import {
+  type ProxmoxCredentials,
+  addContainerService,
+  getContainerService,
+  getServiceCredentials,
+  updateVerificationStatus,
+} from '../../services/container-service';
+import { handleServiceSetCredentials } from './service-set-credentials';
+
+describe('service set-credentials', () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = mkdtempSync(join(tmpdir(), 'celilo-service-credentials-test-'));
+    process.env.CELILO_DB_PATH = join(testDir, 'test.db');
+    process.env.CELILO_MASTER_KEY_PATH = join(testDir, 'master.key');
+    writeFileSync(process.env.CELILO_MASTER_KEY_PATH, 'a'.repeat(64), 'utf8');
+    await runMigrations(process.env.CELILO_DB_PATH);
+  });
+
+  afterEach(() => {
+    closeDb();
+    delete process.env.CELILO_DB_PATH;
+    delete process.env.CELILO_MASTER_KEY_PATH;
+    delete process.env.PROXMOX_API_URL;
+    delete process.env.PROXMOX_API_TOKEN_ID;
+    delete process.env.PROXMOX_API_TOKEN_SECRET;
+    delete process.env.DIGITALOCEAN_API_TOKEN;
+    rmSync(testDir, { recursive: true, force: true });
+  });
+
+  it('updates only the Proxmox endpoint and retains the token', async () => {
+    const service = await addContainerService({
+      name: 'Chubs',
+      providerName: 'proxmox',
+      zones: ['internal'],
+      providerConfig: {},
+      apiCredentials: {
+        api_url: 'https://192.168.0.50:8006',
+        api_token_id: 'root@pam!celilo',
+        api_token_secret: 'existing-secret',
+      },
+    });
+    await updateVerificationStatus(service.id, { success: true, message: 'Connected' });
+
+    const result = await handleServiceSetCredentials(['chubs'], {
+      'api-url': 'https://10.77.20.50:8006',
+    });
+
+    expect(result.success).toBe(true);
+    expect(await getServiceCredentials(service.id)).toEqual({
+      api_url: 'https://10.77.20.50:8006',
+      api_token_id: 'root@pam!celilo',
+      api_token_secret: 'existing-secret',
+    });
+    expect((await getContainerService(service.id))?.verified).toBe(false);
+    if (!result.success) throw new Error(result.error);
+    expect(result.message).not.toContain('existing-secret');
+  });
+
+  it('accepts the endpoint through the documented environment variable', async () => {
+    const service = await addContainerService({
+      name: 'Nubs',
+      providerName: 'proxmox',
+      zones: ['internal'],
+      providerConfig: {},
+      apiCredentials: {
+        api_url: 'https://192.168.0.51:8006',
+        api_token_id: 'root@pam!celilo',
+        api_token_secret: 'existing-secret',
+      },
+    });
+    process.env.PROXMOX_API_URL = 'https://10.77.20.51:8006';
+
+    const result = await handleServiceSetCredentials(['nubs']);
+
+    expect(result.success).toBe(true);
+    expect(((await getServiceCredentials(service.id)) as ProxmoxCredentials).api_url).toBe(
+      'https://10.77.20.51:8006',
+    );
+  });
+
+  it('refuses a no-op that would only churn encrypted state', async () => {
+    await addContainerService({
+      name: 'Chubs',
+      providerName: 'proxmox',
+      zones: ['internal'],
+      providerConfig: {},
+      apiCredentials: {
+        api_url: 'https://192.168.0.50:8006',
+        api_token_id: 'root@pam!celilo',
+        api_token_secret: 'existing-secret',
+      },
+    });
+
+    const result = await handleServiceSetCredentials(['chubs']);
+
+    expect(result.success).toBe(false);
+    if (result.success) throw new Error('Expected set-credentials to reject a no-op');
+    expect(result.error).toContain('No credential changes supplied');
+  });
+});

package/src/cli/commands/service-set-credentials.ts

@@ -0,0 +1,115 @@
+/**
+ * Service set-credentials command.
+ *
+ * Credential values travel only by flag or environment variable (D7). Fields
+ * omitted from the invocation retain their existing encrypted values, which
+ * lets an operator move a provider endpoint without rotating its API token.
+ */
+
+import {
+  type DigitalOceanCredentials,
+  type ProxmoxCredentials,
+  getContainerServiceByServiceId,
+  getServiceCredentials,
+  updateServiceCredentials,
+} from '../../services/container-service';
+import type { CommandResult } from '../types';
+
+type Flags = Record<string, boolean | string>;
+
+function credentialUpdateValue(flags: Flags, flag: string, envVar: string): string | undefined {
+  const flagValue = flags[flag];
+  if (flagValue === true) {
+    throw new Error(`--${flag} requires a value`);
+  }
+  if (typeof flagValue === 'string') {
+    const value = flagValue.trim();
+    if (!value) throw new Error(`--${flag} requires a non-empty value`);
+    return value;
+  }
+
+  const envValue = process.env[envVar]?.trim();
+  return envValue || undefined;
+}
+
+export async function handleServiceSetCredentials(
+  args: string[],
+  flags: Flags = {},
+): Promise<CommandResult> {
+  const serviceId = args[0];
+  if (!serviceId) {
+    return {
+      success: false,
+      error:
+        'Service ID is required\n\nUsage: celilo service set-credentials <service-id> [options]',
+    };
+  }
+
+  try {
+    const service = await getContainerServiceByServiceId(serviceId);
+    if (!service) {
+      return {
+        success: false,
+        error: `Service not found: ${serviceId}\n\nRun 'celilo service list' to see available services.`,
+      };
+    }
+
+    const current = await getServiceCredentials(service.id);
+    let changed = false;
+
+    if (service.providerName === 'proxmox') {
+      const existing = current as ProxmoxCredentials;
+      const apiUrl = credentialUpdateValue(flags, 'api-url', 'PROXMOX_API_URL');
+      const apiTokenId = credentialUpdateValue(flags, 'api-token-id', 'PROXMOX_API_TOKEN_ID');
+      const apiTokenSecret = credentialUpdateValue(
+        flags,
+        'api-token-secret',
+        'PROXMOX_API_TOKEN_SECRET',
+      );
+      changed = Boolean(apiUrl || apiTokenId || apiTokenSecret);
+
+      if (changed) {
+        await updateServiceCredentials(service.id, {
+          api_url: apiUrl ?? existing.api_url,
+          api_token_id: apiTokenId ?? existing.api_token_id,
+          api_token_secret: apiTokenSecret ?? existing.api_token_secret,
+        });
+      }
+    } else if (service.providerName === 'digitalocean') {
+      const existing = current as DigitalOceanCredentials;
+      const apiToken = credentialUpdateValue(flags, 'api-token', 'DIGITALOCEAN_API_TOKEN');
+      changed = Boolean(apiToken);
+
+      if (changed) {
+        await updateServiceCredentials(service.id, {
+          api_token: apiToken ?? existing.api_token,
+        });
+      }
+    } else {
+      return {
+        success: false,
+        error: `Credential updates are not supported for provider: ${service.providerName}`,
+      };
+    }
+
+    if (!changed) {
+      return {
+        success: false,
+        error:
+          service.providerName === 'proxmox'
+            ? 'No credential changes supplied. Pass --api-url, --api-token-id, or --api-token-secret (or set the corresponding PROXMOX_API_* environment variable).'
+            : 'No credential changes supplied. Pass --api-token or set $DIGITALOCEAN_API_TOKEN.',
+      };
+    }
+
+    return {
+      success: true,
+      message: `Updated credentials for service '${serviceId}'. Verification status cleared; run: celilo service verify ${serviceId}`,
+    };
+  } catch (error) {
+    return {
+      success: false,
+      error: `Failed to update service credentials: ${error instanceof Error ? error.message : String(error)}`,
+    };
+  }
+}

package/src/cli/commands/system-audit.ts

@@ -211,6 +211,13 @@ async function buildAuditDeps(onProgress?: (msg: string) => void) {
 
   const healthResults = await runAllHealthChecks(db, { onProgress });
 
+  // Module integrity. Shallow by default: the installed tree against its
+  // baseline, and the generated project against the installed tree. Both are
+  // local and take milliseconds. The host plane is one SSH per system and is
+  // reached through `module verify --deep`, not from here.
+  const { auditModule } = await import('../../module/packaging/audit');
+  const integrityResults = await Promise.all(installed.map((m) => auditModule(m.id, db)));
+
   // Services-credentials: try decrypting each container service's
   // credential envelope. Failures (missing master key, wrong
   // provider shape, corrupt envelope) become BLOCKED audit findings.
@@ -369,6 +376,14 @@ async function buildAuditDeps(onProgress?: (msg: string) => void) {
       fetcher: makeRegistryFetcher(registryClient),
     },
     moduleConfigs: { modules: installedConfigs },
+    moduleIntegrity: { results: integrityResults },
+    detectWithoutConverge: {
+      modules: deployedModules.map((m) => ({
+        id: m.id,
+        state: m.state,
+        manifest: m.manifestData as ModuleManifest,
+      })),
+    },
     health: { results: healthResults },
     backups: { modules: installedBackupInfo },
     abandonedOperations: { records: loadAbandonedOperations(db) },
@@ -419,11 +434,13 @@ async function buildAuditDeps(onProgress?: (msg: string) => void) {
 
 const VERDICT_ICON: Record<string, string> = {
   READY: '●',
+  UNKNOWN: '?',
   DRIFT: '⚠',
   BLOCKED: '✗',
 };
 
 const SEVERITY_ICON: Record<string, string> = {
+  unmeasured: '?',
   drift: '⚠',
   blocked: '✗',
 };