@celilo/cli 1.5.0 → 1.7.0

package/src/module/packaging/package-rules.ts

@@ -42,3 +42,65 @@ export function includeNodeModulesPath(relPath: string): boolean {
   if (nmIdx + 2 >= segments.length) return true; // node_modules/@celilo dir itself
   return segments[nmIdx + 2] === 'capabilities';
 }
+
+/**
+ * What a module-relative path IS, for integrity purposes.
+ *
+ * - `package`  the module's own content. Belongs in `checksums.json` and must
+ *              match it. A mismatch is a real finding.
+ * - `derived`  celilo writes or rewrites the on-disk copy, so its content is
+ *              not a stable integrity claim. Never a finding.
+ * - `unknown`  neither. Never packaged, never installed, and the only kind of
+ *              `[EXTRA]` worth printing.
+ */
+export type ModulePathClass = 'package' | 'derived' | 'unknown';
+
+/**
+ * The one answer to "what belongs to a module", replacing the four divergent
+ * copies that used to decide it independently (`build.ts#shouldExclude`,
+ * `audit.ts#FRAMEWORK_OWNED_PATHS`, `extract.ts#scanDirectory`,
+ * `import.ts#copyModuleFiles`). Every disagreement between them became a
+ * `module verify` violation — 72 of them across two healthy modules.
+ *
+ * `scripts/node_modules/**` is the interesting case: it is `derived`, because
+ * `module import` runs `bun install` over it and the bytes on disk stop
+ * matching the package's. It is nonetheless SHIPPED, because a target may have
+ * no reachable registry (ISS-0046) — that carve-out lives in `build.ts`, which
+ * composes this function with `includeNodeModulesPath` rather than restating
+ * either rule.
+ */
+export function classifyModulePath(relPath: string): ModulePathClass {
+  const segments = relPath.split('/');
+  const name = segments[segments.length - 1] ?? '';
+
+  // The module's own e2e/ tree is tests plus their deps, including a
+  // node_modules of its own. Excluded whole, before anything below.
+  if (segments[0] === 'e2e') return 'unknown';
+
+  // Anything under a `node_modules` segment is decided by the canonical rule
+  // and by nothing else. Ordering matters: a vendored dependency ships files
+  // named `*.test.ts` (`@celilo/capabilities/src/remote.test.ts` is on the
+  // fleet right now) and those are the DEPENDENCY's, not the module's.
+  if (segments.includes('node_modules')) {
+    return includeNodeModulesPath(relPath) ? 'derived' : 'unknown';
+  }
+
+  // Source-tree noise. A module's git repo has it, a module's install never
+  // should, so on an installed tree it is a real finding.
+  if (segments.some((s) => s === '.git' || s === '.next' || s === '.cache')) return 'unknown';
+  if (name === '.DS_Store') return 'unknown';
+  // scripts/tsconfig.json exists so tsc can check hooks in CI. Nothing on a
+  // target ever runs tsc.
+  if (name === 'tsconfig.json') return 'unknown';
+  if (name.endsWith('.netapp') || name.endsWith('.test.ts')) return 'unknown';
+
+  // Celilo's own output under the module's install root.
+  if (segments[0] === 'generated' || segments[0] === 'screenshots') return 'derived';
+  // A checksum manifest cannot list itself, nor the signature over it.
+  if (relPath === 'checksums.json' || relPath === 'signature.sig') return 'derived';
+  // Regenerated by `module import` from the manifest (HOOK_API_V2 Phase 2).
+  if (relPath === 'celilo/types.d.ts') return 'derived';
+  if (relPath === 'cookies.json') return 'derived';
+
+  return 'package';
+}

package/src/policy/module-business-baseline.ts

@@ -248,12 +248,6 @@ export const CAPABILITY_NAME_BASELINE: readonly CapabilityNameRow[] = [
     count: 2,
     why: "S16 — two more copies of S15's decision; fixing S15 removes all three (#938)",
   },
-  {
-    file: 'apps/celilo/src/services/public-web-republish.ts',
-    capability: 'public_web',
-    count: 1,
-    why: "S2 — encodes caddy's redeploy behaviour; generalise to a provider-declared re-assert signal (#945)",
-  },
   {
     file: 'apps/celilo/src/services/zone-policy.ts',
     capability: 'public_web',
@@ -391,11 +385,6 @@ export const SERVICE_FILENAME_BASELINE: readonly ServiceFilenameRow[] = [
     capability: 'firewall',
     why: 'S8 — core reaching into one provider implementation (#941)',
   },
-  {
-    file: 'apps/celilo/src/services/public-web-republish.ts',
-    capability: 'public_web',
-    why: "S2 — named for one provider's redeploy behaviour (#945)",
-  },
 ];
 
 export const PROVIDER_LITERAL_BASELINE: readonly ProviderLiteralRow[] = [

package/src/services/alerting/monitors.ts

@@ -214,7 +214,59 @@ export function ensureInboundSubscriber(bus: SubscriberRegistrar): void {
   });
 }
 
-export function deleteMonitor(db: DbClient, monitorId: string, now: Date): void {
-  resolveMonitorAlerts(db, monitorId, now);
+/** A live alert about to be deleted along with the monitor that owns it. */
+export interface DroppedAlert {
+  key: string;
+  message: string;
+}
+
+/**
+ * Delete a monitor, and report the live alerts that go with it.
+ *
+ * The alerts are DELETED, not resolved. `alerts.monitorId` is
+ * `on delete cascade`, so the row goes the moment the monitor does. This used
+ * to call `resolveMonitorAlerts` first; that write was unreachable — the very
+ * next statement dropped the same rows, and nothing read them in between, so
+ * the resolved state existed for the duration of one statement. Deleted rather
+ * than restored, because resolving properly would need the alert rows to
+ * outlive their monitor, which the FK forbids and which no reader wants:
+ * `resolvedAt` is only ever read as a liveness predicate (`ack.ts`), never
+ * reported. Do not put the call back without changing the FK first.
+ *
+ * What IS worth keeping is what was lost, which is why the live alerts are
+ * returned. A monitor dropped while holding a firing alert takes a real
+ * failure and the coverage of it away together, and a caller that only names
+ * the monitor cannot tell an operator what stopped being watched.
+ */
+export function deleteMonitor(db: DbClient, monitorId: string): DroppedAlert[] {
+  const dropped = db
+    .select({ key: alerts.key, message: alerts.message })
+    .from(alerts)
+    .where(and(eq(alerts.monitorId, monitorId), isNotNull(alerts.activeKey)))
+    .all();
+
   db.delete(monitors).where(eq(monitors.id, monitorId)).run();
+  return dropped;
+}
+
+/**
+ * Drop the `module_hook` monitor belonging to a module that is going away.
+ *
+ * Called from the removal path rather than expressed as a foreign key, because
+ * `monitors.target` cannot carry one: it holds a module id for `module_hook`
+ * and an audit check name for `builtin_check`, and SQLite has no conditional
+ * reference. Splitting the table to get the constraint would need a synthetic
+ * monitor identity for `alerts.monitorId` — the trade the file header already
+ * weighs and declines.
+ *
+ * Deleting cascades the monitor's alerts away (`alerts.monitorId` is
+ * `on delete cascade`), which is what releases anything they were suppressing.
+ * They are deleted, not resolved — see `deleteMonitor`. Returns what was live
+ * so the caller can say what stopped being watched, or null if the module had
+ * no monitor.
+ */
+export function deleteMonitorForModule(db: DbClient, moduleId: string): DroppedAlert[] | null {
+  const monitor = findMonitor(db, 'module_hook', moduleId);
+  if (!monitor) return null;
+  return deleteMonitor(db, monitor.id);
 }

package/src/services/alerting/sweep-runner.ts

@@ -23,6 +23,7 @@ import type { DbClient } from '../../db/client';
 import type { Alert, Monitor } from '../../db/schema';
 import { MONITOR_INTERVAL_FLOOR_MINUTES } from '../cadence';
 import { isScheduled, loadModuleHealthCadences } from './health-cadence';
+import { type DroppedAlert, deleteMonitor } from './monitors';
 import type { NotifyDeps, NotifyOutcome } from './notifier';
 import { deliverDeferred, notifyAlert } from './notifier';
 import { type MonitorRunDeps, runOneMonitor } from './run-monitor';
@@ -102,6 +103,19 @@ export interface SweepReport {
    * former, because nothing ever reached the daemon.
    */
   failures: string[];
+  /**
+   * Modules whose `module_hook` monitor was dropped because the module itself
+   * is gone, and the live alerts each one took with it.
+   *
+   * The alerts are DELETED by the monitor's cascade, not resolved, so a firing
+   * check and the coverage of it disappear in the same instant with nothing
+   * else recording either. A bare module name is not enough to act on: the row
+   * that mattered on the fleet was holding `Cannot reach router: Router login
+   * failed`, and `1 stranded-dropped (greenwave)` would not have told anyone
+   * that a router had stopped being checked. Same reason `noPolicy`, `skipped`
+   * and `failures` all name their subject rather than counting it.
+   */
+  strandedDropped: { moduleId: string; alerts: DroppedAlert[] }[];
 }
 
 /**
@@ -129,6 +143,7 @@ export async function runSweep(
     noPolicy: [],
     skipped: [],
     failures: [],
+    strandedDropped: [],
   };
 
   // 1. Run due monitors.
@@ -139,8 +154,30 @@ export async function runSweep(
   // manifest could never reach an existing install (design.md D2/D8). A
   // `builtin_check` has no module and no manifest, so its row is the config.
   const cadences = loadModuleHealthCadences(db);
+
+  // Reconcile away monitors whose module is gone, before anything tries to run
+  // them. `loadModuleHealthCadences` holds every module, so a miss here means
+  // no module row — and a `module_hook` monitor without one is unschedulable
+  // forever: its cadence resolves to null, `isScheduled` says false, and the
+  // sweep never selects it again. Anything it left firing would sit there with
+  // no path back to `resolved`, suppressing every alert it is an ancestor of
+  // (celilo#1029).
+  //
+  // The removal path deletes the monitor itself, so this only fires for rows a
+  // celilo without that fix left behind, or a removal that died between the two
+  // deletes. Same stance `setMonitorEnabled` already takes: a monitor that will
+  // never report again must not hold live alerts.
+  const stranded = monitors.filter((m) => m.kind === 'module_hook' && !cadences.has(m.target));
+  for (const monitor of stranded) {
+    report.strandedDropped.push({
+      moduleId: monitor.target,
+      alerts: deleteMonitor(db, monitor.id),
+    });
+  }
+  const active = stranded.length > 0 ? monitors.filter((m) => !stranded.includes(m)) : monitors;
+
   const due = selectDueMonitors(
-    monitors.map((m) => {
+    active.map((m) => {
       if (m.kind !== 'module_hook') {
         return {
           id: m.id,

package/src/services/audit/cli-version.test.ts

@@ -50,11 +50,15 @@ describe('auditCliVersion', () => {
     expect(result[0].message).toContain('0.1.7');
   });
 
-  test('no finding when fetcher returns null (network failure)', async () => {
+  test('a registry we could not reach is unmeasured, not up-to-date', async () => {
+    // Was `expect(result).toEqual([])`. "I could not ask npm" and "you are on
+    // the latest" are different statements and rendered identically.
     const result = await auditCliVersion({
       installedVersion: '0.1.5',
       fetcher: async () => null,
     });
-    expect(result).toEqual([]);
+    expect(result).toHaveLength(1);
+    expect(result[0]?.severity).toBe('unmeasured');
+    expect(result[0]?.code).toBe('cli_version_unmeasured');
   });
 });

package/src/services/audit/cli-version.ts

@@ -2,11 +2,12 @@
  * CLI version drift check.
  *
  * Compares the running `@celilo/cli` version against the latest version
- * on npm. A newer published version produces a single `drift` finding;
- * a network failure (offline, npm down) produces no finding — we don't
- * want a transient lookup failure to block `system update`. Instead the
- * caller logs a debug warning. Schema drift, capability ABI drift, etc.
- * are the BLOCKED gates; CLI version is informational only.
+ * on npm. A newer published version produces a single `drift` finding; a
+ * network failure (offline, npm down) produces an `unmeasured` one. It used to
+ * produce nothing, which rendered as READY — "I could not ask npm" and "you are
+ * on the latest" are different statements and the operator should be able to
+ * tell them apart (D7). It still does not BLOCK: schema drift and capability
+ * ABI drift are the blocking gates; CLI version is informational.
  *
  * `latestVersionFetcher` is injectable so tests don't hit npm.
  */
@@ -67,7 +68,20 @@ export interface CliVersionAuditDeps {
 export async function auditCliVersion(deps: CliVersionAuditDeps): Promise<DriftFinding[]> {
   const fetcher = deps.fetcher ?? fetchLatestCliVersion;
   const latest = await fetcher();
-  if (!latest) return []; // network failure — silently no finding
+  if (!latest) {
+    return [
+      {
+        category: 'cli_version',
+        severity: 'unmeasured',
+        code: 'cli_version_unmeasured',
+        message: `@celilo/cli ${deps.installedVersion}: could not reach the npm registry, so version drift is unknown`,
+        remediation:
+          'Check outbound network to registry.npmjs.org, then re-audit. This finding records that the comparison did not happen, not that the CLI is current.',
+        actionable: false,
+        subject: 'system',
+      },
+    ];
+  }
 
   if (compareSemver(deps.installedVersion, latest) >= 0) {
     return []; // up to date or ahead (dev build)

package/src/services/audit/detect-without-converge.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, test } from 'bun:test';
+import type { ModuleManifest } from '../../manifest/schema';
+import { auditDetectWithoutConverge } from './detect-without-converge';
+
+function mod(
+  id: string,
+  manifest: Partial<ModuleManifest>,
+  state = 'INSTALLED',
+): { id: string; state: string; manifest: ModuleManifest } {
+  return { id, state, manifest: manifest as ModuleManifest };
+}
+
+const HOOK = { script: 'scripts/x.ts' };
+
+describe('auditDetectWithoutConverge', () => {
+  test('a convergence hook no subscription fires is drift', () => {
+    // celilo#934's shape: the module has the correcting code and nothing runs
+    // it, so drift is computed every health check and corrected never.
+    const findings = auditDetectWithoutConverge({
+      modules: [mod('wireguard', { hooks: { reconcile_peers: HOOK } })],
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.code).toBe('converge_hook_never_fires');
+    expect(findings[0]?.message).toContain('reconcile_peers');
+    expect(findings[0]?.subject).toBe('wireguard');
+  });
+
+  test('the same module WIRED UP is not reported', () => {
+    // This is `wireguard` after celilo#968.
+    const findings = auditDetectWithoutConverge({
+      modules: [
+        mod('wireguard', {
+          hooks: { reconcile_peers: HOOK },
+          subscriptions: [
+            { name: 'wireguard-peer-converge', pattern: 'timer.tick.15m', hook: 'reconcile_peers' },
+          ],
+        } as Partial<ModuleManifest>),
+      ],
+    });
+    expect(findings).toEqual([]);
+  });
+
+  test('a subscription firing a DIFFERENT hook does not count', () => {
+    const findings = auditDetectWithoutConverge({
+      modules: [
+        mod('m', {
+          hooks: { reconcile_peers: HOOK, reconcile_routes: HOOK },
+          subscriptions: [{ name: 's', pattern: 'timer.tick.15m', hook: 'reconcile_routes' }],
+        } as Partial<ModuleManifest>),
+      ],
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.message).toContain('reconcile_peers');
+    expect(findings[0]?.message).not.toContain('reconcile_routes');
+  });
+
+  test('a module with no convergence hook at all is not reported', () => {
+    // A module that detects drift and declares no correcting hook is a missing
+    // feature, not dead wiring. Guessing at it from `health_check` alone would
+    // flag most of the fleet.
+    expect(
+      auditDetectWithoutConverge({
+        modules: [mod('caddy', { hooks: { health_check: { script: 'x.ts' } } })],
+      }),
+    ).toEqual([]);
+  });
+
+  test('`list_peers` is detection, not convergence, and is not required to fire', () => {
+    expect(
+      auditDetectWithoutConverge({ modules: [mod('wireguard', { hooks: { list_peers: HOOK } })] }),
+    ).toEqual([]);
+  });
+
+  test('an undeployed module is not reported', () => {
+    expect(
+      auditDetectWithoutConverge({
+        modules: [mod('m', { hooks: { reconcile_peers: HOOK } }, 'IMPORTED')],
+      }),
+    ).toEqual([]);
+  });
+
+  test('the remediation is prose, and is NOT marked actionable', () => {
+    // The fix is an edit to a module's manifest. Marking it actionable would
+    // put a Remediate button on a modal that cannot do anything.
+    const findings = auditDetectWithoutConverge({
+      modules: [mod('wireguard', { hooks: { reconcile_peers: HOOK } })],
+    });
+    expect(findings[0]?.actionable).toBe(false);
+    expect(findings[0]?.remediation).toContain('manifest.yml');
+  });
+});

package/src/services/audit/detect-without-converge.ts

@@ -0,0 +1,81 @@
+/**
+ * A module that carries convergence code nothing ever runs
+ * (openspec/changes/module-integrity-rigor, D10; celilo#934).
+ *
+ * No convergence framework. celilo already has one — `subscriptions:` plus
+ * `timer.tick.<n>`, driven by the event bus, used by `technitium`,
+ * `wireguard-manager`, `namecheap` and `celilo-mgmt`. celilo#934 asked whether
+ * drift detection and correction deserve a shared shape; they have one. The
+ * gap was that nothing noticed when a module had the shape and not the wiring,
+ * so `wireguard` computed peer drift and corrected none of it.
+ *
+ * **What this rule actually checks, and how it narrows D10.** The design says
+ * "a module whose health check computes drift and whose manifest declares no
+ * reconcile subscription". The first half is not decidable from a manifest —
+ * celilo cannot read a hook script and tell whether it computes drift — so
+ * this checks the decidable, strictly stronger half: a module that DECLARES a
+ * convergence hook which no subscription fires. That names dead machinery with
+ * no interpretation and no false positives. A module that detects drift and
+ * declares no correcting hook at all is a missing feature, and a rule that
+ * guessed at it from `health_check` alone would flag most of the fleet.
+ */
+
+import type { ModuleManifest } from '../../manifest/schema';
+import type { DriftFinding } from './types';
+
+/**
+ * Hooks whose whole purpose is to CORRECT something. If one of these exists
+ * and nothing calls it, the module has the fix and never applies it.
+ *
+ * `list_peers` is deliberately absent: it reports what a tunnel carries and
+ * corrects nothing, so it is a detection hook and firing it on a timer would
+ * achieve nothing.
+ */
+const CONVERGENCE_HOOKS = [
+  'reconcile_routes',
+  'reconcile_clients',
+  'reconcile_peers',
+  'refresh_registrations',
+  'reassert_dhcp_dns',
+] as const;
+
+export interface DetectWithoutConvergeAuditDeps {
+  modules: { id: string; state: string; manifest: ModuleManifest }[];
+}
+
+const DEPLOYED_STATES = new Set(['INSTALLED', 'VERIFIED']);
+
+export function auditDetectWithoutConverge(deps: DetectWithoutConvergeAuditDeps): DriftFinding[] {
+  const findings: DriftFinding[] = [];
+
+  for (const module of deps.modules) {
+    if (!DEPLOYED_STATES.has(module.state)) continue;
+
+    const hooks = module.manifest.hooks ?? {};
+    const declared = CONVERGENCE_HOOKS.filter((name) => hooks[name] !== undefined);
+    if (declared.length === 0) continue;
+
+    const fired = new Set(
+      (module.manifest.subscriptions ?? []).map((s) => s.hook).filter((h): h is string => !!h),
+    );
+    const unfired = declared.filter((name) => !fired.has(name));
+    if (unfired.length === 0) continue;
+
+    findings.push({
+      category: 'detect_without_converge',
+      severity: 'drift',
+      code: 'converge_hook_never_fires',
+      message: `${module.id}: declares ${unfired.join(', ')} but no subscription ever fires ${unfired.length === 1 ? 'it' : 'them'} — drift is detected and never corrected`,
+      details:
+        'Add a `subscriptions:` entry on a `timer.tick.<n>` event naming the hook. `technitium`, `wireguard-manager`, `namecheap` and `celilo-mgmt` all do this; the machinery exists and this module is not wired into it.',
+      remediation: `Edit ${module.id}'s manifest.yml to add a subscriptions entry for ${unfired.join(', ')}, then 'celilo module update'.`,
+      // Prose, not a command: the fix is an edit to a module's manifest, and
+      // `actionable: true` on something no `celilo …` invocation performs would
+      // put a Remediate button on a modal that cannot do anything.
+      actionable: false,
+      subject: module.id,
+    });
+  }
+
+  return findings;
+}

package/src/services/audit/disk-space.test.ts

@@ -78,13 +78,16 @@ describe('auditDiskSpace', () => {
 
   // Unmeasurable must not read as healthy — but it must not page either, since
   // machines_reachable is already alerting for the same dead host.
-  test('an unmeasurable host is recorded as todo, not as healthy', () => {
+  test('an unmeasurable host is recorded as unmeasured, not as healthy', () => {
     const findings = auditDiskSpace({
       results: [usage({ hostname: 'iot', usedPercent: null, message: 'ssh: connect timed out' })],
     });
 
     expect(findings).toHaveLength(1);
-    expect(findings[0]?.severity).toBe('todo');
+    // Was `todo`, because that was the only non-paging severity available.
+    // `unmeasured` is what it always meant, and it stops the verdict returning
+    // READY.
+    expect(findings[0]?.severity).toBe('unmeasured');
     expect(findings[0]?.code).toBe('disk_unmeasured');
     expect(findings[0]?.details).toContain('timed out');
   });

package/src/services/audit/disk-space.ts

@@ -66,12 +66,14 @@ export function auditDiskSpace(deps: DiskSpaceAuditDeps): DriftFinding[] {
   for (const result of deps.results) {
     // Unmeasurable is NOT healthy — but it does not page either. The host is
     // already unreachable, `machines_reachable` is already alerting on it, and
-    // a second page for one dead host is noise. `todo` records without
-    // notifying, which is the existing severity for exactly that.
+    // a second page for one dead host is noise. This used to be filed as `todo`
+    // because that was the only non-paging severity available; `unmeasured`
+    // (D7) is what it always meant, and unlike `todo` it stops the verdict
+    // returning READY.
     if (result.usedPercent === null) {
       findings.push({
         category: 'disk_space',
-        severity: 'todo',
+        severity: 'unmeasured',
         code: 'disk_unmeasured',
         message: `${result.hostname}: disk usage could not be measured`,
         details: result.message,

package/src/services/audit/health.test.ts

@@ -81,4 +81,43 @@ describe('auditHealth', () => {
     expect(result).toHaveLength(2);
     expect(result.map((f) => f.subject).sort()).toEqual(['a', 'b']);
   });
+
+  test('firewall persistence drift reaches the audit as a drift finding', () => {
+    // The delivery path for celilo#670's fix: the iptables module reports drift
+    // as a `warn` health item, the runner turns any warn into `degraded`, and
+    // this turns `degraded` into an audit finding. No core code knows what an
+    // iptables rule is — which is the point (#941).
+    const unpersisted = '-A POSTROUTING -s 10.9.9.0/24 -o eth1 -j MASQUERADE';
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'iptables',
+        status: 'degraded',
+        checks: [
+          { name: 'ssh_access', status: 'pass', message: 'SSH connected to fw01' },
+          {
+            name: 'persistence_drift',
+            status: 'warn',
+            message: '1 live rule(s) absent from /etc/iptables/rules.v4 (lost on reboot)',
+            details: `live only: nat ${unpersisted}`,
+          },
+        ],
+      },
+    ];
+
+    return auditHealth({ results }).then((findings) => {
+      expect(findings).toHaveLength(1);
+      expect(findings[0]).toMatchObject({
+        category: 'health',
+        severity: 'drift',
+        subject: 'iptables',
+        actionable: true,
+      });
+      expect(findings[0].details).toContain('persistence_drift');
+      expect(findings[0].details).toContain('lost on reboot');
+      // The audit is a summary: it carries the COUNT, and points at the command
+      // that names the rules. `module health` prints check.details verbatim
+      // (cli/commands/module-health.ts:49), so every drifted rule is reachable.
+      expect(findings[0].remediation).toBe('celilo module health iptables --debug');
+    });
+  });
 });

package/src/services/audit/index.test.ts

@@ -11,7 +11,11 @@ const emptyDeps = {
     fetcher: async () => '0.1.5',
   },
   schema: {
-    journal: () => null,
+    // A READABLE journal with nothing pending. It used to be `() => null`,
+    // which now (correctly) reports `unmeasured` — an unreadable journal is not
+    // the same as a schema with no pending migrations, and this fixture means
+    // the latter.
+    journal: () => ({ version: '6', dialect: 'sqlite', entries: [] }),
     applied: () => [],
     db: fakeDb,
   },
@@ -26,6 +30,8 @@ const emptyDeps = {
     fetcher: async () => ({ latest: null }),
   },
   moduleConfigs: { modules: [] },
+  moduleIntegrity: { results: [] },
+  detectWithoutConverge: { modules: [] },
   health: { results: [] },
   backups: { modules: [] },
   abandonedOperations: { records: [] },

package/src/services/audit/index.ts

@@ -18,9 +18,14 @@ import { type BackupsAuditDeps, auditBackups } from './backups';
 import { type BrowserPinAuditDeps, auditBrowserPin } from './browser-pin';
 import { type CapabilityAbiAuditDeps, auditCapabilityAbi } from './capability-abi';
 import { type CliVersionAuditDeps, auditCliVersion } from './cli-version';
+import {
+  type DetectWithoutConvergeAuditDeps,
+  auditDetectWithoutConverge,
+} from './detect-without-converge';
 import { type HealthAuditDeps, auditHealth } from './health';
 import { type MachinesReachableAuditDeps, auditMachinesReachable } from './machines-reachable';
 import { type ModuleConfigsAuditDeps, auditModuleConfigs } from './module-configs';
+import { type ModuleIntegrityAuditDeps, auditModuleIntegrity } from './module-integrity';
 import { type ModuleVersionsAuditDeps, auditModuleVersions } from './module-versions';
 import { type PublicDnsAuditDeps, auditPublicDns } from './public-dns';
 import { type SchemaAuditDeps, auditSchema } from './schema';
@@ -53,6 +58,8 @@ export interface AuditDeps {
   terraformPlan: TerraformPlanAuditDeps;
   moduleVersions: ModuleVersionsAuditDeps;
   moduleConfigs: ModuleConfigsAuditDeps;
+  moduleIntegrity: ModuleIntegrityAuditDeps;
+  detectWithoutConverge: DetectWithoutConvergeAuditDeps;
   health: HealthAuditDeps;
   backups: BackupsAuditDeps;
   abandonedOperations: AbandonedOperationsAuditDeps;
@@ -107,6 +114,11 @@ export async function runAudit(
     wrap('terraform_plan', auditTerraformPlan(deps.terraformPlan)),
     wrap('module_versions', auditModuleVersions(deps.moduleVersions)),
     wrap('module_configs', auditModuleConfigs(deps.moduleConfigs)),
+    wrap('module_integrity', Promise.resolve(auditModuleIntegrity(deps.moduleIntegrity))),
+    wrap(
+      'detect_without_converge',
+      Promise.resolve(auditDetectWithoutConverge(deps.detectWithoutConverge)),
+    ),
     wrap('health', auditHealth(deps.health)),
     wrap('backups', auditBackups(deps.backups)),
     wrap(