@celilo/cli 2.0.0 → 2.2.0

package/src/services/health-runner.ts

@@ -11,13 +11,15 @@ import type { DbClient } from '../db/client';
 import { type ModuleState, modules } from '../db/schema';
 import { loadCapabilityFunctions } from '../hooks/capability-loader';
 import { invokeHook } from '../hooks/executor';
+import { createHookStores } from '../hooks/hook-store';
 import { loadHookConfigMap } from '../hooks/load-hook-config';
 import { createCapturingLogger, createConsoleLogger, createGaugeLogger } from '../hooks/logger';
 import type { HookLogger, HookResult } from '../hooks/types';
 import type { ModuleManifest } from '../manifest/schema';
 import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
-import { getModuleSystems } from './deployed-systems';
+import { controlPlaneHealthChecks } from './control-plane-health';
+import { CONTROL_PLANE_MODULE_ID, getModuleSystems } from './deployed-systems';
 import { remoteAccessPolicy } from './remote-access';
 
 export interface HealthCheckItem {
@@ -152,6 +154,19 @@ export async function runModuleHealthCheck(
     return { moduleId, status: 'error', checks: [], error: 'Module not found' };
   }
 
+  // The control plane checks itself, in celilo's own process (celilo#1225).
+  //
+  // This was a health_check hook and it failed under the jail in the worst
+  // possible way: it asked `existsSync(db_path)`, the jail deliberately does
+  // not bind celilo's data directory, and so it reported a healthy fleet's
+  // database MISSING and failed the deploy over a file that was right there.
+  // `runFleetChecks` is what `celilo system doctor` already runs and asks
+  // eight questions where the hook asked two.
+  if (moduleId === CONTROL_PLANE_MODULE_ID) {
+    const checks = await controlPlaneHealthChecks(db);
+    return finishHealthCheck(moduleId, module.state, checks, db, options);
+  }
+
   const manifest = module.manifestData as ModuleManifest;
   const hookDef = manifest.hooks?.health_check;
 
@@ -198,6 +213,7 @@ export async function runModuleHealthCheck(
       requiredCapabilities,
       systems: getModuleSystems(moduleId, db),
       remoteAccess: remoteAccessPolicy(moduleId, db),
+      hookStores: () => createHookStores(db, moduleId),
     },
   );
   presentation.finish(hookResult.success);
@@ -222,6 +238,23 @@ export async function runModuleHealthCheck(
   };
 
   const checks = outputs.checks || [];
+  return finishHealthCheck(moduleId, module.state, checks, db, options, hookResult.artifactPaths);
+}
+
+/**
+ * Derive the verdict from the named checks and move the module's state.
+ *
+ * Shared by the hook path and the control plane's own path so the two cannot
+ * drift on what `degraded` means or on when a state transition is suppressed.
+ */
+function finishHealthCheck(
+  moduleId: string,
+  moduleState: ModuleState,
+  checks: HealthCheckItem[],
+  db: DbClient,
+  options: HealthCheckOptions,
+  artifactPaths?: string[],
+): HealthCheckResult {
   const hasFail = checks.some((c) => c.status === 'fail');
   const hasWarn = checks.some((c) => c.status === 'warn');
 
@@ -231,12 +264,12 @@ export async function runModuleHealthCheck(
       ? 'degraded'
       : 'healthy';
 
-  const nextState = nextModuleState(module.state, status, options.unattended ?? false);
+  const nextState = nextModuleState(moduleState, status, options.unattended ?? false);
   if (nextState) {
     db.update(modules).set({ state: nextState }).where(eq(modules.id, moduleId)).run();
   }
 
-  return { moduleId, status, checks, artifactPaths: hookResult.artifactPaths };
+  return { moduleId, status, checks, ...(artifactPaths ? { artifactPaths } : {}) };
 }
 
 /**

package/src/services/module-config.ts

@@ -90,6 +90,7 @@ export function upsertModuleConfig(
   moduleId: string,
   key: string,
   value: string | number | boolean | unknown[] | Record<string, unknown> | null,
+  source?: 'hook',
 ): void {
   if (value === null || value === undefined) {
     throw new Error(`upsertModuleConfig(${moduleId}, ${key}): value must not be null/undefined`);
@@ -97,11 +98,28 @@ export function upsertModuleConfig(
   const valueJson = JSON.stringify(value);
   const displayValue = isComplexValue(value) ? valueJson : String(value);
 
+  // `source` records who owns the row (hook-owned-state design D7 — the same
+  // column `derived-value-recomputation` reads). Absent keeps the legacy
+  // pre-column shape for every existing caller: operator and interview writes
+  // stay sourceless until that change gives them their own value to write.
+  // Only the hook config store passes 'hook', and only a hook may: the
+  // manifest refuses `module config set` on any source: hook variable.
   db.insert(moduleConfigs)
-    .values({ moduleId, key, value: displayValue, valueJson })
+    .values({
+      moduleId,
+      key,
+      value: displayValue,
+      valueJson,
+      ...(source !== undefined ? { source } : {}),
+    })
     .onConflictDoUpdate({
       target: [moduleConfigs.moduleId, moduleConfigs.key],
-      set: { value: displayValue, valueJson, updatedAt: new Date() },
+      set: {
+        value: displayValue,
+        valueJson,
+        updatedAt: new Date(),
+        ...(source !== undefined ? { source } : {}),
+      },
     })
     .run();
 }

package/src/services/module-deploy.dns-repoint.test.ts

@@ -0,0 +1,187 @@
+// Slice 3 of openspec/changes/module-orchestrator-primitives: celilo performs
+// the dns.primary repoint when a dns_internal provider deploys (D5), gated on
+// an askConfirm interview. knot's on_install no longer touches these keys.
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+import { type DbClient, closeDb, getDb } from '../db/client';
+import { runMigrations } from '../db/migrate';
+import { capabilities, moduleSystems, modules, systemConfig } from '../db/schema';
+import { InterviewUnansweredError } from './interview-errors';
+import { planDnsRepoint, repointDnsPrimaryForProvider } from './module-deploy';
+
+const MODULE_ID = 'knot-unbound-internal';
+const SERVER_IP = '10.226.10.53';
+
+type AskOpts = { scope: string; key: string; message: string };
+
+function makeAsk(answer: boolean): ((opts: AskOpts) => Promise<boolean>) & { calls: AskOpts[] } {
+  const calls: AskOpts[] = [];
+  const ask = async (opts: AskOpts) => {
+    calls.push(opts);
+    return answer;
+  };
+  return Object.assign(ask, { calls });
+}
+
+function makeAskThrowing(err: Error): ((opts: AskOpts) => Promise<boolean>) & { calls: AskOpts[] } {
+  const calls: AskOpts[] = [];
+  const ask = async (opts: AskOpts) => {
+    calls.push(opts);
+    throw err;
+  };
+  return Object.assign(ask, { calls });
+}
+
+describe('repointDnsPrimaryForProvider (module-orchestrator-primitives slice 3)', () => {
+  let dir: string;
+  let db: DbClient;
+
+  beforeEach(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'celilo-dns-repoint-'));
+    process.env.CELILO_DB_PATH = join(dir, 'celilo.db');
+    await runMigrations(process.env.CELILO_DB_PATH);
+    db = getDb();
+    seedProvider();
+  });
+
+  afterEach(() => {
+    closeDb();
+    process.env.CELILO_DB_PATH = undefined;
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* temp dir cleanup is best-effort */
+    }
+  });
+
+  function seedProvider() {
+    db.insert(modules)
+      .values({
+        id: MODULE_ID,
+        name: MODULE_ID,
+        version: '1.3.4',
+        manifestData: { id: MODULE_ID, name: MODULE_ID, version: '1.3.4', celilo_contract: '1.0' },
+        sourcePath: `/tmp/${MODULE_ID}`,
+      })
+      .run();
+    db.insert(capabilities)
+      .values({ moduleId: MODULE_ID, capabilityName: 'dns_internal', version: '1.0.0', data: {} })
+      .run();
+    db.insert(moduleSystems)
+      .values({
+        moduleId: MODULE_ID,
+        name: 'main',
+        hostname: 'dns',
+        ipv4Address: SERVER_IP,
+        zone: 'dmz',
+        infraType: 'container_service',
+      })
+      .run();
+  }
+
+  function setConfig(key: string, value: string) {
+    db.insert(systemConfig)
+      .values({ key, value })
+      .onConflictDoUpdate({ target: systemConfig.key, set: { value } })
+      .run();
+  }
+
+  function configValue(key: string): string | undefined {
+    return db.select().from(systemConfig).where(eq(systemConfig.key, key)).get()?.value;
+  }
+
+  test('3.1: repoints dns.primary at the resolver and demotes the prior primary WITHOUT losing the existing fallback', async () => {
+    setConfig('dns.primary', '1.1.1.1');
+    setConfig('dns.fallback', '8.8.8.8');
+    const ask = makeAsk(true);
+
+    await repointDnsPrimaryForProvider(MODULE_ID, db, ask);
+
+    expect(configValue('dns.primary')).toBe(SERVER_IP);
+    // The WHOLE resulting value: the existing fallback must survive beside the
+    // demoted prior primary (D5's secondary observation — knot's hook lost it).
+    expect(configValue('dns.fallback')).toBe('1.1.1.1,8.8.8.8');
+    expect(ask.calls).toHaveLength(1);
+    expect(ask.calls[0].message).toContain(SERVER_IP);
+    expect(ask.calls[0].message).toContain('1.1.1.1');
+  });
+
+  test('3.1: demotes the prior primary to dns.fallback when no fallback existed', async () => {
+    setConfig('dns.primary', '1.1.1.1');
+    const ask = makeAsk(true);
+
+    await repointDnsPrimaryForProvider(MODULE_ID, db, ask);
+
+    expect(configValue('dns.primary')).toBe(SERVER_IP);
+    expect(configValue('dns.fallback')).toBe('1.1.1.1');
+  });
+
+  test('3.1: sets dns.primary without touching dns.fallback when no primary was set', async () => {
+    const ask = makeAsk(true);
+
+    await repointDnsPrimaryForProvider(MODULE_ID, db, ask);
+
+    expect(configValue('dns.primary')).toBe(SERVER_IP);
+    expect(configValue('dns.fallback')).toBeUndefined();
+  });
+
+  test('does not ask when dns.primary already names this resolver (re-deploy)', async () => {
+    setConfig('dns.primary', SERVER_IP);
+    setConfig('dns.fallback', '8.8.8.8');
+    const ask = makeAsk(true);
+
+    await repointDnsPrimaryForProvider(MODULE_ID, db, ask);
+
+    expect(ask.calls).toHaveLength(0);
+    expect(configValue('dns.primary')).toBe(SERVER_IP);
+    expect(configValue('dns.fallback')).toBe('8.8.8.8');
+  });
+
+  test('3.2: a negative answer leaves both keys unchanged and does not fail the deploy', async () => {
+    setConfig('dns.primary', '1.1.1.1');
+    setConfig('dns.fallback', '8.8.8.8');
+    const ask = makeAsk(false);
+
+    await expect(repointDnsPrimaryForProvider(MODULE_ID, db, ask)).resolves.toBeUndefined();
+
+    expect(configValue('dns.primary')).toBe('1.1.1.1');
+    expect(configValue('dns.fallback')).toBe('8.8.8.8');
+    expect(ask.calls).toHaveLength(1);
+  });
+
+  test('no responder able to answer (headless) is a defined skip, never a hang', async () => {
+    setConfig('dns.primary', '1.1.1.1');
+    const ask = makeAskThrowing(
+      new InterviewUnansweredError('interview.required.deploy:knot.repoint_dns_primary', 'nobody'),
+    );
+
+    await expect(repointDnsPrimaryForProvider(MODULE_ID, db, ask)).resolves.toBeUndefined();
+
+    expect(configValue('dns.primary')).toBe('1.1.1.1');
+  });
+});
+
+describe('planDnsRepoint', () => {
+  test('merges the existing fallback without duplicating the demoted primary', () => {
+    const plan = planDnsRepoint({
+      serverIp: SERVER_IP,
+      priorPrimary: '1.1.1.1',
+      existingFallback: '1.1.1.1,9.9.9.9',
+    });
+    expect(plan.needsRepoint).toBe(true);
+    expect(plan.newFallback).toBe('1.1.1.1,9.9.9.9');
+  });
+
+  test('already-primary is a no-op plan', () => {
+    const plan = planDnsRepoint({
+      serverIp: SERVER_IP,
+      priorPrimary: SERVER_IP,
+      existingFallback: '8.8.8.8',
+    });
+    expect(plan.needsRepoint).toBe(false);
+    expect(plan.newFallback).toBeUndefined();
+  });
+});

package/src/services/module-deploy.ts

@@ -11,9 +11,10 @@ import { generateInventory } from '../ansible/inventory';
 import { FuelGauge } from '../cli/fuel-gauge';
 import { log, setActiveDisplay } from '../cli/prompts';
 import type { DbClient } from '../db/client';
-import { capabilities, machines, modules } from '../db/schema';
+import { capabilities, machines, modules, systemConfig } from '../db/schema';
 import { loadCapabilityFunctions } from '../hooks/capability-loader';
 import { invokeHook } from '../hooks/executor';
+import { createHookStores } from '../hooks/hook-store';
 import { createGaugeLogger } from '../hooks/logger';
 import { describeArtifacts } from '../hooks/types';
 import type { HookDefinition, HookLogger, HookResult } from '../hooks/types';
@@ -22,6 +23,7 @@ import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
 import { buildResolutionContext } from '../variables/context';
 import { maybeRunAspectForTrigger } from './aspect-runner';
+import { askConfirm } from './bus-interview';
 import {
   autoDeriveMachineConfig,
   findEnsureOnProvider,
@@ -30,14 +32,17 @@ import {
   interviewForMissingSecrets,
 } from './config-interview';
 import { getContainerService } from './container-service';
+import { bootstrapControlPlane } from './control-plane-bootstrap';
 import { executeAnsible } from './deploy-ansible';
 import { planDeployment } from './deploy-planner';
 import { waitForSSH } from './deploy-ssh';
 import { executeTerraform, parseTerraformOutputs } from './deploy-terraform';
 import { validateAndPrepareDeployment } from './deploy-validation';
+import { CONTROL_PLANE_MODULE_ID } from './deployed-systems';
 import { getModuleSystems } from './deployed-systems';
 import { E2E_CONFLICT_MESSAGE, runningE2eContainers } from './e2e-guard';
 import { resolveInfrastructureVariables } from './infrastructure-variable-resolver';
+import { InterviewAbandonedError, InterviewUnansweredError } from './interview-errors';
 import { findMachineForModule } from './machine-pool';
 import { ensureRequiredNetworks } from './network-ensure';
 import {
@@ -386,6 +391,154 @@ export async function deployModule(
   return result;
 }
 
+/**
+ * Headless bound for the repoint confirm. A staged responder replies in
+ * milliseconds; this exists so an attached-but-unstaged responder produces a
+ * defined skip instead of hanging until the suite budget kills the deploy
+ * (module-orchestrator-primitives design.md D5, "never a hang"). On a TTY
+ * there is no bound: the operator IS the responder and may take minutes.
+ */
+const DNS_REPOINT_HEADLESS_TIMEOUT_MS = 60_000;
+
+/**
+ * The deploy-time DNS repoint for a `dns_internal` provider
+ * (module-orchestrator-primitives slice 3, design D5). celilo owns the whole
+ * operation because every input is already celilo's: the resolver address is
+ * the system celilo just placed, and the prior primary/fallback are celilo's
+ * own rows. knot's on_install used to do this through the CLI, one key at a
+ * time, under a catch that reported success over a repoint that never
+ * happened.
+ *
+ * D5 is a recorded DELIBERATE EXCEPTION to the framework-does-not-infer-intent
+ * rule. What makes it acceptable is the interview: the deploy ASKS before it
+ * touches the fleet resolver, and a declined repoint is an operator decision,
+ * not an error. Do not cite this as precedent (design.md D5, "So do not cite
+ * this as precedent").
+ */
+export interface DnsRepointPlan {
+  serverIp: string;
+  priorPrimary: string | undefined;
+  existingFallback: string | undefined;
+  /** Merged dns.fallback when the repoint demotes the prior primary; undefined leaves the key untouched. */
+  newFallback: string | undefined;
+  /** False when dns.primary already names this resolver: the deploy asks nothing. */
+  needsRepoint: boolean;
+}
+
+/**
+ * Pure half of the repoint. The demote keeps an existing fallback (D5's
+ * secondary observation: knot's one-key-at-a-time hook overwrote it, dropping
+ * e.g. 8.8.8.8 from the fleet's resolver list).
+ */
+export function planDnsRepoint(args: {
+  serverIp: string;
+  priorPrimary: string | undefined;
+  existingFallback: string | undefined;
+}): DnsRepointPlan {
+  const { serverIp, priorPrimary, existingFallback } = args;
+  if (priorPrimary === serverIp) {
+    return {
+      serverIp,
+      priorPrimary,
+      existingFallback,
+      newFallback: undefined,
+      needsRepoint: false,
+    };
+  }
+  const newFallback = priorPrimary ? mergeFallback(existingFallback, priorPrimary) : undefined;
+  return { serverIp, priorPrimary, existingFallback, newFallback, needsRepoint: true };
+}
+
+/** Comma-separated, demoted primary first, deduped (public-dns-probe.ts parses commas). */
+function mergeFallback(existing: string | undefined, demoted: string): string {
+  const entries = [demoted];
+  for (const part of (existing ?? '').split(',')) {
+    const ip = part.trim();
+    if (ip && !entries.includes(ip)) entries.push(ip);
+  }
+  return entries.join(',');
+}
+
+function readSystemConfigValue(db: DbClient, key: string): string | undefined {
+  const row = db.select().from(systemConfig).where(eq(systemConfig.key, key)).get();
+  return row?.value && row.value.length > 0 ? row.value : undefined;
+}
+
+function writeSystemConfigValue(db: DbClient, key: string, value: string): void {
+  db.insert(systemConfig)
+    .values({ key, value })
+    .onConflictDoUpdate({ target: systemConfig.key, set: { value } })
+    .run();
+}
+
+/**
+ * Ask, then perform (or skip) the repoint for a just-deployed `dns_internal`
+ * provider. Exported for tests; `deployModuleImpl` calls this after the DNS
+ * backfill when the deployed module provides `dns_internal`.
+ */
+export async function repointDnsPrimaryForProvider(
+  moduleId: string,
+  db: DbClient,
+  ask: typeof askConfirm = askConfirm,
+): Promise<void> {
+  const serverIp = getModuleSystems(moduleId, db)[0]?.ipv4_address;
+  if (!serverIp) {
+    log.warn(
+      `dns_internal provider '${moduleId}' has no deployed system — skipping dns.primary repoint`,
+    );
+    return;
+  }
+  const plan = planDnsRepoint({
+    serverIp,
+    priorPrimary: readSystemConfigValue(db, 'dns.primary'),
+    existingFallback: readSystemConfigValue(db, 'dns.fallback'),
+  });
+  if (!plan.needsRepoint) {
+    log.info(`dns.primary already points at ${serverIp} — no repoint needed`);
+    return;
+  }
+
+  const demoteNote = plan.newFallback
+    ? ` The old primary ${plan.priorPrimary} moves to dns.fallback (${plan.newFallback}).`
+    : '';
+  const opts = {
+    scope: `deploy:${moduleId}`,
+    key: 'repoint_dns_primary',
+    message: `Deploying '${moduleId}' made it the fleet's internal DNS resolver. Point dns.primary at ${serverIp}?${demoteNote}`,
+    defaultValue: false,
+  };
+  // Called DIRECTLY, not inside withInterviewSession: deployModuleImpl already
+  // opened the terminal responder above and closes it in its finally. A second
+  // responder instance would race the first on stdin (design.md D5).
+  let confirmed: boolean;
+  try {
+    confirmed = await ask(
+      process.stdin.isTTY ? opts : { ...opts, timeoutMs: DNS_REPOINT_HEADLESS_TIMEOUT_MS },
+    );
+  } catch (error) {
+    if (error instanceof InterviewUnansweredError || error instanceof InterviewAbandonedError) {
+      log.warn(
+        `dns.primary repoint skipped — nobody answered the confirm (${opts.scope}:${opts.key}). Stage the answer (celilo events respond --values) or set dns.primary manually later.`,
+      );
+      return;
+    }
+    throw error;
+  }
+
+  if (!confirmed) {
+    log.info('dns.primary repoint declined — fleet resolver left unchanged');
+    return;
+  }
+
+  writeSystemConfigValue(db, 'dns.primary', serverIp);
+  if (plan.newFallback !== undefined) {
+    writeSystemConfigValue(db, 'dns.fallback', plan.newFallback);
+  }
+  log.success(
+    `dns.primary repointed at internal resolver ${serverIp}${plan.newFallback ? ` (dns.fallback: ${plan.newFallback})` : ''}`,
+  );
+}
+
 async function deployModuleImpl(
   moduleId: string,
   db: DbClient,
@@ -722,6 +875,7 @@ async function deployModuleImpl(
             requiredCapabilities: manifest.requires.capabilities.map((c) => c.name),
             systems: getModuleSystems(moduleId, db),
             remoteAccess: remoteAccessPolicy(moduleId, db),
+            hookStores: () => createHookStores(db, moduleId),
           },
         );
 
@@ -861,6 +1015,7 @@ async function deployModuleImpl(
                 requiredCapabilities: (manifest.requires?.capabilities ?? []).map((c) => c.name),
                 systems: getModuleSystems(moduleId, db),
                 remoteAccess: remoteAccessPolicy(moduleId, db),
+                hookStores: () => createHookStores(db, moduleId),
               },
             };
           },
@@ -1163,6 +1318,7 @@ async function deployModuleImpl(
             requiredCapabilities: providerManifest.requires.capabilities.map((c) => c.name),
             systems: getModuleSystems(capRecord.moduleId, db),
             remoteAccess: remoteAccessPolicy(capRecord.moduleId, db),
+            hookStores: () => createHookStores(db, capRecord.moduleId),
           },
         );
 
@@ -1351,6 +1507,55 @@ async function deployModuleImpl(
         // container ID/IP got assigned per module in the DB.
       }
 
+      // celilo initialises its own box, in its own process.
+      //
+      // This was `celilo-mgmt`'s `on_install` hook until celilo#1225. The hook
+      // reached every one of these operations by spawning the `celilo` CLI,
+      // which a jailed hook cannot do — the mount set binds no `/usr/bin`, no
+      // `/usr/local/bin` and no shell — so the deploy ran Ansible to completion
+      // and then died in its own install hook on any host with a jail backend.
+      //
+      // It runs at the point the hook used to, for the reason the hook ran
+      // there: the Ansible role has just installed celilo and started the
+      // dispatcher, and none of this can be read before that.
+      if (moduleId === CONTROL_PLANE_MODULE_ID) {
+        log.success('Initializing celilo management state');
+        try {
+          const bootstrap = await bootstrapControlPlane({ db });
+
+          log.info(`  DNS: primary ${bootstrap.dns.primary}, fallback ${bootstrap.dns.fallback}`);
+          for (const applied of bootstrap.network.applied) {
+            log.info(`  Network: ${applied}`);
+          }
+          if (bootstrap.network.skipped) {
+            log.warn(`  Network not recorded: ${bootstrap.network.skipped}`);
+          }
+          // The operator authorises this key on every machine celilo manages,
+          // so it is printed rather than merely stored. It was the loudest line
+          // the hook produced and it stays the loudest line here.
+          log.success(
+            `celilo fleet SSH key — add this public key to machines celilo will manage:\n${bootstrap.fleetKey.publicKey}`,
+          );
+
+          if (bootstrap.dispatcher.status === 'fail') {
+            // A management plane with no dispatcher is broken: event-driven
+            // reconciles never deliver. Fail the install, do not whisper.
+            log.error(`Dispatcher check failed: ${bootstrap.dispatcher.summary}`);
+            return {
+              success: false,
+              phases,
+              error:
+                `celilo-mgmt: ${bootstrap.dispatcher.summary}. ${bootstrap.dispatcher.remediation ?? ''}`.trim(),
+            };
+          }
+          log.success(`Event dispatcher is live (${bootstrap.dispatcher.summary})`);
+        } catch (err) {
+          const detail = err instanceof Error ? err.message : String(err);
+          log.error(`Initializing celilo management state failed: ${detail}`);
+          return { success: false, phases, error: detail };
+        }
+      }
+
       // Run on_install hook (post-deploy actions like port forwarding, DNS registration)
       if (manifest.hooks?.on_install) {
         const onInstallDef = manifest.hooks.on_install;
@@ -1432,6 +1637,7 @@ async function deployModuleImpl(
                 requiredCapabilities: manifest.requires.capabilities.map((c) => c.name),
                 systems: getModuleSystems(moduleId, db),
                 remoteAccess: remoteAccessPolicy(moduleId, db),
+                hookStores: () => createHookStores(db, moduleId),
               },
             };
           },
@@ -1557,6 +1763,13 @@ async function deployModuleImpl(
             `DNS backfill failed for '${moduleId}': ${msg}. Some internal DNS records may need manual setup.`,
           );
         }
+
+        // The dns_internal handoff (module-orchestrator-primitives slice 3,
+        // design D5): celilo repoints dns.primary at the resolver it just
+        // deployed, gated on an interview. knot's on_install no longer does
+        // this. Runs after the backfill so a failed deploy never repoints the
+        // fleet at a resolver that never came up.
+        await repointDnsPrimaryForProvider(moduleId, db);
       }
 
       // Announce each deployed system on the bus (D5/D6) — one