@celilo/cli 2.0.0 → 2.2.0

package/src/hooks/test-fixtures/store-backed.ts

@@ -0,0 +1,47 @@
+import type { HookStore, HookStoreBackedMap } from '@celilo/capabilities';
+
+/**
+ * In-memory hook-owned-state stores for tests that build a HookContext
+ * without a broker. The four methods mutate the record directly; the
+ * manifest validation a real store applies lives broker-side
+ * (hook-store.ts) and has its own tests.
+ *
+ * Methods are defined non-enumerably, so the result spreads, serializes and
+ * `toEqual`s as the plain record the test wrote — the same shape a real
+ * broker-side context carries when executeHookScript frames it.
+ */
+export function configStore(
+  values: Record<string, unknown> = {},
+): Record<string, unknown> & HookStore {
+  return attach(values);
+}
+
+export function secretStore(values: Record<string, string> = {}): HookStoreBackedMap {
+  // Downcast: the caller passed Record<string, string>; attach only adds
+  // methods and never writes, so the value type is unchanged.
+  return attach(values) as HookStoreBackedMap;
+}
+
+function attach(values: Record<string, unknown>): Record<string, unknown> & HookStore {
+  const store: HookStore = {
+    get: async (name) => values[name] as string | undefined,
+    set: async (name, value) => {
+      values[name] = value;
+    },
+    delete: async (name) => {
+      delete values[name];
+    },
+    transaction: async (fn) => {
+      await fn(store);
+    },
+  };
+  for (const [name, method] of Object.entries(store)) {
+    Object.defineProperty(values, name, {
+      value: method,
+      enumerable: false,
+      writable: true,
+      configurable: true,
+    });
+  }
+  return Object.assign(values, store);
+}

package/src/hooks/test-fixtures/store-writing-hook.ts

@@ -0,0 +1,63 @@
+/**
+ * Test fixture: a hook that exercises the hook-owned-state accessor across
+ * the process boundary — set/get round trip on both stores, delete, a
+ * committed transaction, a discarded transaction, and the undeclared-name
+ * throw the whole design exists to produce.
+ */
+
+import { defineHook } from '@celilo/capabilities';
+
+export default defineHook({
+  hook: 'on_install',
+  requires: [],
+  handler: async (ctx) => {
+    const outputs: Record<string, unknown> = {};
+
+    // Round trip on each store.
+    await ctx.secrets.set('bot_token', 'token-value');
+    outputs.secretRoundTrip = await ctx.secrets.get('bot_token');
+
+    await ctx.config.set('public_ip', '203.0.113.7');
+    outputs.configRoundTrip = await ctx.config.get('public_ip');
+
+    // The map surface still answers from the values the context carried.
+    outputs.mapRead = ctx.config.mapOnlyValue;
+
+    // Delete removes; deleting a declared-but-never-written name is a no-op.
+    // (An UNDECLARED name on delete throws — that is 3.4, tested below.
+    // Declared-and-absent is the no-op case 3.7 pins.)
+    await ctx.secrets.delete('bot_token');
+    await ctx.secrets.set('api_key', 'to-delete');
+    await ctx.secrets.delete('api_key');
+    outputs.deletedIsGone = await ctx.secrets.get('api_key');
+
+    // Committed transaction: both writes land.
+    await ctx.secrets.transaction((s) => {
+      s.set('bot_token', 'committed-a');
+      s.set('api_key', 'committed-b');
+    });
+    outputs.transactionA = await ctx.secrets.get('bot_token');
+    outputs.transactionB = await ctx.secrets.get('api_key');
+
+    // Discarded transaction: nothing lands, including the overwrite of the
+    // committed value above.
+    try {
+      await ctx.secrets.transaction(async (s) => {
+        s.set('bot_token', 'discarded');
+        throw new Error('hook failed midway');
+      });
+    } catch (error) {
+      outputs.discarded = (error as Error).message;
+    }
+    outputs.afterDiscard = await ctx.secrets.get('bot_token');
+
+    // An undeclared name throws, naming the module and the declared set.
+    try {
+      await ctx.secrets.set('not_declared', 'x');
+    } catch (error) {
+      outputs.undeclaredSecret = (error as Error).message;
+    }
+
+    return outputs;
+  },
+});

package/src/hooks/unjailed-lint.test.ts

@@ -26,6 +26,7 @@ import { executeHookScript, hookChildEnv } from './executor';
 import type { MountSetWire } from './hook-protocol';
 import { createCapturingLogger } from './logger';
 import { deriveMountSet } from './mount-set';
+import { configStore, secretStore } from './test-fixtures/store-backed';
 import type { HookContext } from './types';
 import { classifyAccess, mountSetEnvValue, parseLintMountSet } from './unjailed-lint';
 
@@ -54,10 +55,25 @@ function scratchModule(script: string): string {
 
 const describeSet = (overrides: Partial<MountSetWire>): MountSetWire => ({
   entries: [
-    { path: '/tmp', mode: 'tmpfs', reason: 'private scratch, per run' },
-    { path: '/srv/celilo/mod', mode: 'ro', reason: "the module's own tree" },
-    { path: '/srv/celilo/mod/state', mode: 'rw', reason: 'the sanctioned writable directory' },
-    { path: '/srv/staged', mode: 'rw', reason: "contract input 'backup_dir' (write)" },
+    { path: '/tmp', mode: 'tmpfs', reason: 'private scratch, per run', absence: 'runtime' },
+    {
+      path: '/srv/celilo/mod',
+      mode: 'ro',
+      reason: "the module's own tree",
+      absence: 'required',
+    },
+    {
+      path: '/srv/celilo/mod/state',
+      mode: 'rw',
+      reason: 'the sanctioned writable directory',
+      absence: 'required',
+    },
+    {
+      path: '/srv/staged',
+      mode: 'rw',
+      reason: "contract input 'backup_dir' (write)",
+      absence: 'required',
+    },
   ],
   chdir: '/srv/celilo/mod',
   ...overrides,
@@ -159,8 +175,8 @@ describe('the lint inside a real hook run', () => {
     mkdirSync(join(root, 'state'), { recursive: true });
     const { logger, messages } = createCapturingLogger();
     const context: HookContext = {
-      config: {},
-      secrets: {},
+      config: configStore(),
+      secrets: secretStore(),
       systems: [],
       logger,
       debug: false,
@@ -188,7 +204,10 @@ describe('the lint inside a real hook run', () => {
       export default defineHook({
         requires: [] as const,
         handler: async () => {
-          try { readFileSync('/etc/hosts', 'utf-8'); } catch { /* the read is the point, not the bytes */ }
+          // A path outside the mount set. Not /etc/hosts — the resolver
+          // binding (celilo#1225) mounts that read-only on purpose, and the
+          // lint is right to stay silent about it.
+          try { readFileSync('/etc/passwd', 'utf-8'); } catch { /* the read is the point, not the bytes */ }
           return {};
         },
       });
@@ -196,7 +215,7 @@ describe('the lint inside a real hook run', () => {
 
     const warnings = advisories(messages);
     expect(warnings.length).toBe(1);
-    expect(warnings[0]).toContain('/etc/hosts');
+    expect(warnings[0]).toContain('/etc/passwd');
     expect(warnings[0]).toContain('on a jailed host');
     // The one sentence the task forbids losing: what it is, and what it is not.
     expect(warnings[0]).toContain('Advisory lint, not a security boundary');

package/src/manifest/schema.ts

@@ -17,6 +17,7 @@ export const VariableSourceSchema = z.enum([
   'system',
   'terraform',
   'infrastructure',
+  'hook',
 ]);
 
 /**

package/src/module/packaging/build.ts

@@ -1,8 +1,9 @@
 import { execFileSync, execSync } from 'node:child_process';
-import { cpSync, existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { cpSync, existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { readFile, readdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, join, relative } from 'node:path';
+import { gunzipSync } from 'node:zlib';
 import { create as tarCreate } from 'tar';
 import { parse as parseYaml } from 'yaml';
 import { log } from '../../cli/prompts';
@@ -120,6 +121,33 @@ export async function computeChecksums(sourceDir: string): Promise<ChecksumsData
   };
 }
 
+/**
+ * Ceiling on the final tar+gzip write of the .netapp. Every step before it
+ * (staging, the module's own build command) already carries a timeout, but the
+ * tar stream did not — and 2026-09-04 it stalled mid-write (all samples in
+ * kevent64, artifact truncated at 59 percent) and sat there for two hours with
+ * no error and no exit. A bounded wait turns that into a nameable failure.
+ */
+const PACKAGE_STREAM_TIMEOUT_MS = 300_000;
+
+/**
+ * Validate that a produced .netapp is a complete gzip stream.
+ *
+ * A .netapp is a gzipped tar (tarCreate above runs with gzip: true), so a
+ * full gunzip pass is the whole check: a stream truncated mid-write fails
+ * with 'unexpected end of file' instead of surviving to the consumer, where
+ * the same zlib error reads as a truncated DOWNLOAD from an unrelated cause.
+ * Returns null when valid, otherwise the reason.
+ */
+export function verifyNetappIntegrity(packagePath: string): string | null {
+  try {
+    gunzipSync(readFileSync(packagePath));
+    return null;
+  } catch (err) {
+    return err instanceof Error ? err.message : String(err);
+  }
+}
+
 /**
  * Build a module package (.netapp file)
  *
@@ -321,7 +349,7 @@ export async function buildModule(options: ModuleBuildOptions): Promise<ModuleBu
 
     // Create tarball
     const finalOutputPath = outputPath || join(process.cwd(), `${moduleId}.netapp`);
-    await tarCreate(
+    const tarPromise = tarCreate(
       {
         file: finalOutputPath,
         cwd: buildDir,
@@ -329,6 +357,46 @@ export async function buildModule(options: ModuleBuildOptions): Promise<ModuleBu
       },
       ['checksums.json', 'signature.sig', ...Object.keys(checksumsData.files)],
     );
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const timeout = new Promise<never>((_, reject) => {
+      timer = setTimeout(
+        () =>
+          reject(
+            new Error(
+              `packaging tar stream exceeded ${PACKAGE_STREAM_TIMEOUT_MS / 1000}s and was abandoned mid-write`,
+            ),
+          ),
+        PACKAGE_STREAM_TIMEOUT_MS,
+      );
+    });
+    timer?.unref?.();
+    try {
+      await Promise.race([tarPromise, timeout]);
+    } catch (tarError) {
+      // The losing side may still hold the output file open: swallow its
+      // eventual rejection and remove the partial artifact so nothing
+      // downstream mistakes a truncated write for a package.
+      tarPromise.catch(() => {});
+      rmSync(finalOutputPath, { force: true });
+      return {
+        success: false,
+        error: `Failed to build module: ${
+          tarError instanceof Error ? tarError.message : 'Unknown error'
+        }`,
+      };
+    }
+
+    // Refuse to declare success on an artifact we cannot read back. The tar
+    // step resolved, so this only trips if the stream left the file truncated
+    // anyway — the exact corruption build-infra shipped on 2026-09-04.
+    const integrityError = verifyNetappIntegrity(finalOutputPath);
+    if (integrityError) {
+      rmSync(finalOutputPath, { force: true });
+      return {
+        success: false,
+        error: `Produced package failed gzip integrity check (${finalOutputPath}): ${integrityError}`,
+      };
+    }
 
     return {
       success: true,

package/src/module/web-root.ts

@@ -14,7 +14,7 @@
  */
 
 import { join } from 'node:path';
-import { MODULE_WEB_ROOT } from '@celilo/capabilities';
+import { MODULE_STATE_WEB_ROOT, MODULE_WEB_ROOT } from '@celilo/capabilities';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { modules } from '../db/schema';
@@ -33,3 +33,19 @@ export function resolveModuleWebRoot(moduleId: string, db: DbClient): string | u
   if (!module) return undefined;
   return join(module.sourcePath, MODULE_WEB_ROOT);
 }
+
+/**
+ * Absolute path to `<module root>/state/site` — the state web overlay
+ * (celilo#1265) — or undefined when no such module is installed.
+ *
+ * Beside `resolveModuleWebRoot` for the same reason that function lives here:
+ * ONE application of the convention, by the one party that can resolve it for
+ * a module that is not running. Does NOT check that the directory exists — a
+ * module with no generated site content has no overlay, and deciding what an
+ * absent directory means belongs to the caller (see `requireWebRoot`).
+ */
+export function resolveModuleStateWebRoot(moduleId: string, db: DbClient): string | undefined {
+  const module = db.select().from(modules).where(eq(modules.id, moduleId)).get();
+  if (!module) return undefined;
+  return join(module.sourcePath, MODULE_STATE_WEB_ROOT);
+}

package/src/policy/fixture-capability-coverage.test.ts

@@ -0,0 +1,322 @@
+/**
+ * A module's e2e fixtures must deploy (at least import) a provider for every
+ * capability its manifest requires.
+ *
+ * The failure this exists to catch is silent in the worst way: the manifest
+ * requirement makes stage 1 of the module's own suite fail at
+ * `module import <id>` with "Required capability 'X' not found", and every
+ * later stage cascade-skips on requireStage. Nothing else goes red — the
+ * suite is quarantined, or CI never runs it, so a fixture can sit
+ * structurally incapable of passing for six weeks (celilo#1260:
+ * registry-pipeline required idp@1.2.0 from 7e2d27b9 onward and never
+ * deployed an idp provider).
+ *
+ * Both sides of the comparison are computed sets. The required set comes
+ * from each module's manifest.yml parsed by the production validator; the
+ * provided set comes from the manifests of whatever modules the module's
+ * fixtures actually import (`module import <ref>` statements, scanned in
+ * source). A hand-written list of "modules that need an idp" would rot the
+ * moment the next module declares the requirement.
+ *
+ * The check runs the real `validateCapabilityAccess` against an in-memory
+ * database seeded with the fixtures' providers — the same code path the CLI
+ * executes at import time, including the secret-allowlist gate — so the
+ * assertion is over the actual contract stage 1 exercises, not a re-derivation
+ * of it.
+ *
+ * ## What this gate does NOT prove. Read before trusting green.
+ *
+ * - Import is necessary, not sufficient. A fixture can import the provider
+ *   and still deploy the consumer before it, or never deploy the provider
+ *   at all (the consumer's on_install would then fail against a dead idp).
+ *   Only running the suite proves deploy order.
+ * - The import scan is a source scan. An import built dynamically in a way
+ *   this scanner cannot parse is invisible here (the scanner requires a
+ *   literal module id, a `${CONST}` reference to a string literal in the
+ *   same file, or a trailing path segment).
+ * - Fixtures living outside `modules/<id>/e2e/*.test.ts` (shared harness
+ *   files that deploy on the suite's behalf) are not scanned.
+ */
+
+import { Database, type Database as DatabaseType } from 'bun:sqlite';
+import { describe, expect, test } from 'bun:test';
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { validateCapabilityAccess } from '../capabilities/validation';
+import type { ModuleManifest } from '../manifest/schema';
+import { validateManifest } from '../manifest/validate';
+import { repoRoot } from './capability-shape';
+
+/** Every module manifest under `modulesDir`, parsed by the production validator. */
+function loadModuleManifests(modulesDir: string): Map<string, ModuleManifest> {
+  const manifests = new Map<string, ModuleManifest>();
+  for (const id of readdirSync(modulesDir)) {
+    const path = join(modulesDir, id, 'manifest.yml');
+    if (!existsSync(path)) continue;
+    const result = validateManifest(readFileSync(path, 'utf8'));
+    if (result.success) manifests.set(id, result.data);
+    // Manifests that fail validation are another gate's job (validate.test.ts
+    // and scripts/check-modules.sh); scanning them here would double-report.
+  }
+  return manifests;
+}
+
+/**
+ * Module ids a fixture source imports, via `module import <ref>` statements.
+ *
+ * Handles the three shapes fixtures actually use: a bare literal
+ * (`'module import authentik'`), a path (`'module import /celilo/modules/authentik'`),
+ * and a `${CONST}` reference to a string literal defined in the same file
+ * (`module import ${PRIMARY}`). Trailing CLI flags (`--accept-aspects`) and
+ * timeouts are stripped. Anything that does not resolve to a plausible
+ * module id is skipped rather than guessed.
+ */
+function scanFixtureImports(fixtureSource: string): string[] {
+  const constants = new Map<string, string>();
+  for (const match of fixtureSource.matchAll(/const\s+(\w+)\s*=\s*'([^']+)'/g)) {
+    constants.set(match[1], match[2]);
+  }
+
+  const imports: string[] = [];
+  for (const match of fixtureSource.matchAll(/module import ([^'"\n]+?)['"`]/g)) {
+    let ref = match[1].trim();
+    const constRef = ref.match(/^\$\{(\w+)\}/);
+    if (constRef) ref = constants.get(constRef[1]) ?? '';
+    const id = ref.split(/\s+/)[0]?.split('/').pop() ?? '';
+    if (id && /^[a-z0-9-]+$/.test(id)) imports.push(id);
+  }
+  return imports;
+}
+
+/** The union of modules any `*.test.ts` fixture in `moduleId`'s e2e/ imports. */
+function fixtureImportedModules(modulesDir: string, moduleId: string): string[] {
+  const e2eDir = join(modulesDir, moduleId, 'e2e');
+  if (!existsSync(e2eDir)) return [];
+  const imported = new Set<string>();
+  for (const file of readdirSync(e2eDir)) {
+    if (!file.endsWith('.test.ts')) continue;
+    for (const id of scanFixtureImports(readFileSync(join(e2eDir, file), 'utf8'))) {
+      imported.add(id);
+    }
+  }
+  return [...imported];
+}
+
+/**
+ * An in-memory database shaped like the CLI's module registry, seeded with
+ * every capability `modules` provide — what `getProviderManifest` queries.
+ */
+function providerDatabase(manifests: Map<string, ModuleManifest>): DatabaseType {
+  const db = new Database(':memory:');
+  db.exec('CREATE TABLE modules (id TEXT PRIMARY KEY, manifest_data TEXT)');
+  db.exec('CREATE TABLE capabilities (module_id TEXT, capability_name TEXT)');
+  const insertModule = db.prepare('INSERT INTO modules (id, manifest_data) VALUES (?, ?)');
+  const insertCapability = db.prepare(
+    'INSERT INTO capabilities (module_id, capability_name) VALUES (?, ?)',
+  );
+  for (const [id, manifest] of manifests) {
+    insertModule.run(id, JSON.stringify(manifest));
+    for (const capability of manifest.provides?.capabilities ?? []) {
+      insertCapability.run(id, capability.name);
+    }
+  }
+  return db;
+}
+
+/**
+ * Modules with e2e fixtures whose required capabilities no imported module
+ * provides. The provider union is seeded into a real database and each
+ * consumer is checked with the production `validateCapabilityAccess`.
+ */
+async function capabilityCoverageViolations(modulesDir: string): Promise<string[]> {
+  const manifests = loadModuleManifests(modulesDir);
+  const violations: string[] = [];
+  for (const [id, manifest] of manifests) {
+    if (fixtureImportedModules(modulesDir, id).length === 0) continue;
+    const imported = fixtureImportedModules(modulesDir, id)
+      .map((dep) => manifests.get(dep))
+      .filter((m): m is ModuleManifest => m !== undefined);
+    const db = providerDatabase(new Map(imported.map((m) => [m.id, m])));
+    try {
+      const result = await validateCapabilityAccess(manifest, db);
+      if (!result.success) {
+        violations.push(`${id}: ${result.error ?? 'unknown error'}`);
+      }
+    } finally {
+      db.close();
+    }
+  }
+  return violations;
+}
+
+describe('fixture capability coverage', () => {
+  test('every module with e2e fixtures imports a provider for each required capability', async () => {
+    const violations = await capabilityCoverageViolations(join(repoRoot(), 'modules'));
+    expect(violations).toEqual([]);
+  });
+
+  // Reach measurement (Rule 2 of the lane plan): the real scanner and checker
+  // run against a mirrored module tree with planted markers, so the pass and
+  // fail cases are both proven to fire — not reasoned about. This is the
+  // mutation test for the gate itself: the real-tree test above can only go
+  // green, so the mirror is where the gate is shown to fail.
+  describe('reach: the gate fires on a mirrored tree (synthetic modules)', () => {
+    function mirrorTree(
+      dir: string,
+      modules: Record<string, { manifest: string; fixtures?: string[] }>,
+    ): string {
+      mkdirSync(dir, { recursive: true });
+      for (const [id, spec] of Object.entries(modules)) {
+        const moduleDir = join(dir, id);
+        mkdirSync(join(moduleDir, 'e2e'), { recursive: true });
+        writeFileSync(join(moduleDir, 'manifest.yml'), spec.manifest);
+        for (const [i, fixture] of (spec.fixtures ?? []).entries()) {
+          writeFileSync(join(moduleDir, 'e2e', `fixture-${i}.test.ts`), fixture);
+        }
+      }
+      return dir;
+    }
+
+    const providerManifest = [
+      'celilo_contract: "1.0"',
+      'id: marker-provider',
+      'name: Marker Provider',
+      'version: 1.0.0',
+      'description: synthetic provider',
+      'provides:',
+      '  capabilities:',
+      '    - name: marker_cap',
+      '      version: 1.0.0',
+      '',
+    ].join('\n');
+
+    const consumerFixture = "await net.celilo('module import marker-provider');\n";
+
+    test('a fixture importing the provider satisfies the requirement', async () => {
+      const dir = mkdtempSync(join(tmpdir(), 'cap-coverage-ok-'));
+      try {
+        mirrorTree(dir, {
+          'marker-provider': { manifest: providerManifest },
+          'marker-consumer': {
+            manifest: [
+              'celilo_contract: "1.0"',
+              'id: marker-consumer',
+              'name: Marker Consumer',
+              'version: 1.0.0',
+              'description: synthetic consumer',
+              'requires:',
+              '  capabilities:',
+              '    - name: marker_cap',
+              '      version: 1.0.0',
+              '',
+            ].join('\n'),
+            fixtures: [consumerFixture],
+          },
+        });
+        expect(await capabilityCoverageViolations(dir)).toEqual([]);
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+
+    test('a fixture missing the provider fails, naming the module and capability', async () => {
+      const dir = mkdtempSync(join(tmpdir(), 'cap-coverage-fail-'));
+      try {
+        mirrorTree(dir, {
+          'marker-provider': { manifest: providerManifest },
+          'marker-consumer': {
+            manifest: [
+              'celilo_contract: "1.0"',
+              'id: marker-consumer',
+              'name: Marker Consumer',
+              'version: 1.0.0',
+              'description: synthetic consumer',
+              'requires:',
+              '  capabilities:',
+              '    - name: marker_cap',
+              '      version: 1.0.0',
+              '    - name: marker_other',
+              '      version: 1.0.0',
+              '',
+            ].join('\n'),
+            // provider-b covers marker_cap; nothing covers marker_other
+            fixtures: [consumerFixture],
+          },
+          'marker-nonprovider': {
+            manifest: providerManifest.replace('marker_cap', 'marker_other'),
+          },
+        });
+        const violations = await capabilityCoverageViolations(dir);
+        expect(violations).toEqual([
+          expect.stringContaining("marker-consumer: Required capability 'marker_other' not found"),
+        ]);
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+
+    test('a privilege the framework grants needs no provider', async () => {
+      const dir = mkdtempSync(join(tmpdir(), 'cap-coverage-priv-'));
+      try {
+        mirrorTree(dir, {
+          'marker-consumer': {
+            manifest: [
+              'celilo_contract: "1.0"',
+              'id: marker-consumer',
+              'name: Marker Consumer',
+              'version: 1.0.0',
+              'description: synthetic consumer',
+              'requires:',
+              '  capabilities:',
+              '    - name: cross_module_read',
+              '      version: 1.0.0',
+              '',
+            ].join('\n'),
+            fixtures: ["await net.celilo('module import nothing-here');\n"],
+          },
+        });
+        expect(await capabilityCoverageViolations(dir)).toEqual([]);
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+
+    test('a ${CONST} import resolves through the same-file string literal', async () => {
+      const dir = mkdtempSync(join(tmpdir(), 'cap-coverage-const-'));
+      try {
+        mirrorTree(dir, {
+          'marker-provider': { manifest: providerManifest },
+          'marker-consumer': {
+            manifest: [
+              'celilo_contract: "1.0"',
+              'id: marker-consumer',
+              'name: Marker Consumer',
+              'version: 1.0.0',
+              'description: synthetic consumer',
+              'requires:',
+              '  capabilities:',
+              '    - name: marker_cap',
+              '      version: 1.0.0',
+              '',
+            ].join('\n'),
+            fixtures: [
+              "const PROVIDER = 'marker-provider';\nawait net.celilo(`module import ${PROVIDER} --accept-aspects`);\n",
+            ],
+          },
+        });
+        expect(await capabilityCoverageViolations(dir)).toEqual([]);
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+  });
+});