@celilo/cli 2.2.0 → 2.2.1

package/src/hooks/jail.ts

@@ -418,16 +418,68 @@ function unavailableReason(error: unknown): string {
  * `CELILO_HOOK_JAIL=requried` that silently meant `auto` would read as the
  * jail being enforced when it is not, which is the one mistake this variable
  * exists to prevent.
+ *
+ * The unset/empty default is `off` (peba's ruling on ce-rez7): jailing must
+ * begin because someone set a switch, not because a package upgrade installed
+ * a backend. Turning the jail ON is a deliberate act.
  */
 export function jailPolicy(): JailPolicy {
   const raw = process.env.CELILO_HOOK_JAIL;
-  if (raw === undefined || raw === '') return 'auto';
+  if (raw === undefined || raw === '') return 'off';
   if (raw === 'auto' || raw === 'off' || raw === 'required') return raw;
   throw new Error(
     `CELILO_HOOK_JAIL='${raw}' is not a hook jail policy. Use 'auto' (jail when a backend is available), 'required' (an unavailable jail is a hard failure), or 'off'.`,
   );
 }
 
+/** Where the effective jail policy came from. Rendered by `system doctor` (D4). */
+export type JailPolicySource = 'env' | 'config' | 'default';
+
+/**
+ * Apply D2's precedence to the two sources: env wins, then stored config,
+ * then the default, which is `off` (peba's ruling on ce-rez7; see
+ * openspec/changes/hook-jail-config-surface/design.md for the reversal
+ * trigger).
+ *
+ * Pure, so both consumers (executor.ts and system-doctor.ts) can fetch the
+ * stored row themselves and stay testable without a database.
+ *
+ * The empty-string env value is treated as unset, matching `jailPolicy()`'s
+ * own handling — one rule for "what counts as set", not a second one here.
+ *
+ * The config path is deliberately stricter than the env path: a stored
+ * empty string THROWS (peba's ruling on ce-8832). The set-time pattern
+ * `^(auto|off|required)$` rejects `''`, so a stored one can only arrive via
+ * a restore from file or a hand edit to the DB — exactly the untrusted
+ * paths D3 exists to catch. Resolving it to a silent `auto` would let
+ * foreign state pick the jailing default with nobody told, and failing
+ * closed is the whole point. An empty CELILO_HOOK_JAIL stays "not set",
+ * because `jailPolicy()` relies on that and slice 1's safety rests on the
+ * two resolvers agreeing.
+ */
+export function resolveJailPolicy(
+  envValue: string | undefined,
+  configValue: string | undefined,
+): { policy: JailPolicy; source: JailPolicySource } {
+  if (envValue !== undefined && envValue !== '') {
+    if (envValue === 'auto' || envValue === 'off' || envValue === 'required') {
+      return { policy: envValue, source: 'env' };
+    }
+    throw new Error(
+      `CELILO_HOOK_JAIL='${envValue}' is not a hook jail policy. Use 'auto' (jail when a backend is available), 'required' (an unavailable jail is a hard failure), or 'off'.`,
+    );
+  }
+  if (configValue !== undefined) {
+    if (configValue === 'auto' || configValue === 'off' || configValue === 'required') {
+      return { policy: configValue, source: 'config' };
+    }
+    throw new Error(
+      `hooks.jail_policy='${configValue}' is not a hook jail policy. Use 'auto' (jail when a backend is available), 'required' (an unavailable jail is a hard failure), or 'off'.`,
+    );
+  }
+  return { policy: 'off', source: 'default' };
+}
+
 /**
  * Resolve every path in a mount-set request through the filesystem (task 4.2k).
  *

package/src/module/packaging/audit.ts

@@ -13,7 +13,6 @@ import {
 } from '../../services/module-instances';
 import { computeFileChecksum } from './checksum';
 import type { IntegrityViolation } from './extract';
-import { compareVerbatimRoleAssets, readVerbatimRoleAssets } from './generated-plane';
 import { type HostPlaneResult, verifyModuleOnHosts } from './host-plane';
 import { classifyModulePath } from './package-rules';
 
@@ -204,30 +203,11 @@ export async function auditModule(
       }
     }
 
-    // Plane two: is what we would deploy built from what we installed? Only
-    // verbatim role assets have a meaningful expected digest — Ansible
-    // templates the rest, and a `.j2` in `generated/` is SUPPOSED to differ.
-    // A module that has never been generated has nothing to compare and is not
-    // a finding; it is simply pre-deploy.
-    const generatedDir = join(moduleDir, 'generated');
-    if (existsSync(generatedDir)) {
-      const differences = compareVerbatimRoleAssets(
-        await readVerbatimRoleAssets(moduleDir),
-        await readVerbatimRoleAssets(generatedDir),
-      );
-      for (const difference of differences) {
-        violations.push({
-          type: 'stale-generated',
-          path: difference.relPath,
-          expectedDigest: difference.installedDigest,
-          actualDigest: difference.generatedDigest,
-          message:
-            difference.reason === 'missing'
-              ? `Generated project is missing ${difference.relPath} — the next deploy would ship nothing for it. Run 'celilo module generate ${moduleId}'.`
-              : `Generated project holds different bytes for ${difference.relPath} (generated ${difference.generatedDigest}, installed ${difference.installedDigest}) — the next deploy would ship the wrong ones. Run 'celilo module generate ${moduleId}'.`,
-        });
-      }
-    }
+    // The second plane (is what we would deploy built from what we installed?)
+    // retired here: the generated tree is ephemeral now (D4 of
+    // control-plane-stops-building-modules) — rendered for a deploy and
+    // deleted on success — so a persistent generated copy that verbatim role
+    // assets could be compared against no longer exists to compare.
 
     // Check for extra files (not in checksums)
     const actualFiles = await scanDirectory(moduleDir, moduleDir);
@@ -244,7 +224,10 @@ export async function auditModule(
     }
 
     // Plane three: is what is running what we generated? One SSH per system,
-    // so it is asked only when the caller says so.
+    // so it is asked only when the caller says so. With the generated tree
+    // ephemeral (D4), a deep audit after a successful deploy finds no playbook
+    // and says so — the remedy is generate, which is cheap and never builds.
+    const generatedDir = join(moduleDir, 'generated');
     let hostPlane: HostPlaneResult | undefined;
     if (options.deep) {
       hostPlane = await verifyModuleOnHosts({

package/src/module/packaging/build-paths.test.ts

@@ -0,0 +1,127 @@
+import { describe, expect, test } from 'bun:test';
+import { cpSync, existsSync, mkdtempSync, readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import { resolveBuildCommandPaths } from './build-paths';
+
+/** Repo root: this file sits at apps/celilo/src/module/packaging/. */
+const REPO_ROOT = join(import.meta.dir, '..', '..', '..', '..', '..');
+
+/** Every module in the repo that declares a `build:` block (design, Context). */
+const BUILD_MODULES = [
+  'celilo-registry',
+  'celilo-web-console',
+  'celilo-website',
+  'forgejo',
+  'npm-cache-node',
+  'wireguard-manager',
+] as const;
+
+function buildCommand(moduleId: string): string {
+  const manifestPath = join(REPO_ROOT, 'modules', moduleId, 'manifest.yml');
+  if (!existsSync(manifestPath)) throw new Error(`fixture missing: ${manifestPath}`);
+  const manifest = parseYaml(readFileSync(manifestPath, 'utf8')) as {
+    build?: { command?: string };
+  };
+  const command = manifest.build?.command;
+  if (!command) throw new Error(`${moduleId} declares no build command`);
+  return command;
+}
+
+describe('publish-time build path gate', () => {
+  test('flags celilo-registry when packaged outside the monorepo (the control-plane shape)', () => {
+    // The known-bad form, per celilo#1307: the script reaches a sibling of the
+    // module source (`../../packages/registry-server`). Inside the monorepo
+    // that resolves; from a tree where the module stands alone — a control
+    // plane, or any packaging that is not the source checkout — it does not.
+    // The spec scenario pins this: "packaged from a tree where that directory
+    // does not exist".
+    const scratch = mkdtempSync(join(tmpdir(), 'celilo-build-paths-'));
+    const moduleSourceDir = join(scratch, 'celilo-registry');
+    cpSync(join(REPO_ROOT, 'modules', 'celilo-registry'), moduleSourceDir, {
+      recursive: true,
+    });
+    const violations = resolveBuildCommandPaths(buildCommand('celilo-registry'), {
+      moduleSourceDir,
+      buildDir: moduleSourceDir,
+    });
+    expect(violations).toHaveLength(1);
+    expect(violations[0].rawPath).toContain('../../packages/registry-server');
+    expect(violations[0].resolvedPath).not.toContain(REPO_ROOT);
+  });
+
+  test('flags a plain relative escape that does not resolve (spec scenario)', () => {
+    const scratch = mkdtempSync(join(tmpdir(), 'celilo-build-paths-'));
+    const violations = resolveBuildCommandPaths(
+      'cd ../../packages/registry-server && bun install',
+      { moduleSourceDir: scratch, buildDir: scratch },
+    );
+    expect(violations).toHaveLength(1);
+    expect(violations[0].rawPath).toBe('../../packages/registry-server');
+  });
+
+  test('accepts $CELILO_MODULE_SOURCE_DIR/server when it exists (npm-cache-node shape)', () => {
+    const scratch = mkdtempSync(join(tmpdir(), 'celilo-build-paths-'));
+    const moduleSourceDir = join(scratch, 'npm-cache-node');
+    cpSync(
+      join(REPO_ROOT, 'modules', 'npm-cache-node', 'server'),
+      join(moduleSourceDir, 'server'),
+      {
+        recursive: true,
+      },
+    );
+    const violations = resolveBuildCommandPaths(buildCommand('npm-cache-node'), {
+      moduleSourceDir,
+      buildDir: moduleSourceDir,
+    });
+    expect(violations).toEqual([]);
+  });
+
+  test('accepts every module build command at publish time in the monorepo', () => {
+    // The regression surface for the five healthy modules. celilo-registry
+    // passes here too, and that is correct: at publish, inside the monorepo,
+    // its `cd` target exists (the binaries shipped on 2026-08-20 prove the
+    // build ran). The gate refuses the script only where it genuinely cannot
+    // resolve — the first test above.
+    for (const moduleId of BUILD_MODULES) {
+      const moduleSourceDir = join(REPO_ROOT, 'modules', moduleId);
+      const violations = resolveBuildCommandPaths(buildCommand(moduleId), {
+        moduleSourceDir,
+        buildDir: moduleSourceDir,
+      });
+      expect(violations, moduleId).toEqual([]);
+    }
+  });
+
+  test('skips a cd target it cannot resolve rather than guessing (forgejo shape)', () => {
+    // `cd "$D"` where D was assigned earlier in the same command: the gate
+    // does not interpret shell, so an unresolvable target is skipped, not
+    // failed. A guard that rejects working modules is worse than none.
+    const scratch = mkdtempSync(join(tmpdir(), 'celilo-build-paths-'));
+    const violations = resolveBuildCommandPaths('D=files && mkdir -p "$D" && cd "$D" && ls', {
+      moduleSourceDir: scratch,
+      buildDir: scratch,
+    });
+    expect(violations).toEqual([]);
+  });
+
+  test('tracks the working directory across chained cds (celilo-web-console shape)', () => {
+    // `cd $SOURCE/../../apps/console` then `cd ../console-server`: the second
+    // target resolves against the FIRST cd's destination, not the build dir.
+    const scratch = mkdtempSync(join(tmpdir(), 'celilo-build-paths-'));
+    const moduleSourceDir = join(scratch, 'web');
+    const monorepo = join(scratch, 'mono');
+    cpSync(join(REPO_ROOT, 'modules', 'celilo-web-console'), moduleSourceDir, { recursive: true });
+    // A monorepo-shaped sibling tree, minimal but real.
+    const { mkdirSync } = require('node:fs') as typeof import('node:fs');
+    mkdirSync(join(monorepo, 'apps', 'console'), { recursive: true });
+    mkdirSync(join(monorepo, 'apps', 'console-server'), { recursive: true });
+    cpSync(moduleSourceDir, join(monorepo, 'modules', 'celilo-web-console'), { recursive: true });
+    const violations = resolveBuildCommandPaths(buildCommand('celilo-web-console'), {
+      moduleSourceDir: join(monorepo, 'modules', 'celilo-web-console'),
+      buildDir: join(monorepo, 'modules', 'celilo-web-console'),
+    });
+    expect(violations).toEqual([]);
+  });
+});

package/src/module/packaging/build-paths.ts

@@ -0,0 +1,175 @@
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+/**
+ * Publish-time gate on a module build command's filesystem references.
+ *
+ * A `build:` block runs when the module is packaged (publish/package/import),
+ * inside a staged copy of the module, with `CELILO_MODULE_SOURCE_DIR` pointing
+ * back at the authored source tree. A `cd` in that command is the build's
+ * claim about where its inputs live; a target that does not resolve there
+ * means the module ships inputs it does not carry, which is how celilo-registry
+ * was unbuildable on every real install for four months without anyone finding
+ * out (celilo#1307). The packager refuses up front and names the path.
+ *
+ * The gate does not interpret shell. It finds `cd` commands lexically, knows
+ * the two variables the packager supplies, and probes what those resolve to.
+ * A target it cannot resolve (an untracked shell variable, a command
+ * substitution, a glob) is SKIPPED, not failed: guessing would reject working
+ * modules, and a guard that rejects working modules is worse than none.
+ */
+
+export interface BuildPathViolation {
+  /** The path exactly as the build command wrote it, before substitution. */
+  rawPath: string;
+  /** The absolute path the packaging runtime would resolve it to. */
+  resolvedPath: string;
+}
+
+export interface ResolveBuildCommandPathsOptions {
+  /** What `$CELILO_MODULE_SOURCE_DIR` resolves to when the command runs. */
+  moduleSourceDir: string;
+  /** The staged tree the command runs in (its initial cwd, and `$STAGE`). */
+  buildDir: string;
+  /** Injectable existence probe; defaults to existsSync. */
+  exists?: (path: string) => boolean;
+}
+
+/**
+ * Extract the argument of every unquoted `cd` command in the string, with the
+ * quoting preserved so later substitution can strip it.
+ *
+ * A `cd` counts only at a command position: string start, or after `&&`, `||`,
+ * `;`, `|`, `(`, or a newline, ignoring whitespace. Quoted spans (single and
+ * double) are skipped whole, so a `cd` inside a string is not mistaken for a
+ * command.
+ */
+export function findCdTargets(command: string): string[] {
+  const targets: string[] = [];
+  let atCommandStart = true;
+  let i = 0;
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === "'") {
+      const end = command.indexOf("'", i + 1);
+      i = end === -1 ? command.length : end + 1;
+      atCommandStart = false;
+      continue;
+    }
+    if (ch === '"') {
+      const end = command.indexOf('"', i + 1);
+      i = end === -1 ? command.length : end + 1;
+      atCommandStart = false;
+      continue;
+    }
+    if (ch === '\\' && i + 1 < command.length) {
+      i += 2;
+      atCommandStart = false;
+      continue;
+    }
+    if (ch === '&' || ch === '|' || ch === ';' || ch === '\n' || ch === '(') {
+      atCommandStart = true;
+      i += 1;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      i += 1;
+      continue;
+    }
+    if (atCommandStart && command.startsWith('cd', i) && /\s/.test(command[i + 2] ?? '')) {
+      const { target, next } = readCdTarget(command, i + 2);
+      if (target.length > 0) targets.push(target);
+      i = next;
+      atCommandStart = false;
+      continue;
+    }
+    atCommandStart = false;
+    i += 1;
+  }
+  return targets;
+}
+
+/**
+ * Read one `cd` argument starting just after the `cd` keyword. Stops at an
+ * unquoted command terminator. Backslash escapes are carried through so the
+ * caller sees exactly what the shell would.
+ */
+function readCdTarget(command: string, start: number): { target: string; next: number } {
+  let i = start;
+  while (i < command.length && /\s/.test(command[i])) i += 1;
+  const begin = i;
+  let end = i;
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === "'") {
+      const close = command.indexOf("'", i + 1);
+      i = close === -1 ? command.length : close + 1;
+      end = i;
+      continue;
+    }
+    if (ch === '"') {
+      const close = command.indexOf('"', i + 1);
+      i = close === -1 ? command.length : close + 1;
+      end = i;
+      continue;
+    }
+    if (ch === '\\' && i + 1 < command.length) {
+      i += 2;
+      end = i;
+      continue;
+    }
+    if (ch === '&' || ch === '|' || ch === ';' || ch === '\n') break;
+    i += 1;
+    if (!/\s/.test(ch) || command.slice(begin, i).trim().length > 0) end = i;
+  }
+  return { target: command.slice(begin, end).trim(), next: i };
+}
+
+/**
+ * Substitute the packager-supplied variables, strip quoting, and drop the
+ * target to `null` when anything unresolvable remains. `null` means "this
+ * gate cannot answer whether this path exists", never "it does not exist".
+ */
+function resolveTarget(target: string, options: ResolveBuildCommandPathsOptions): string | null {
+  const substituted = target
+    .replaceAll('$CELILO_MODULE_SOURCE_DIR', options.moduleSourceDir)
+    .replaceAll('$(pwd)', options.buildDir)
+    .replaceAll('$STAGE', options.buildDir)
+    .replaceAll('"', '')
+    .replaceAll("'", '');
+  if (/[$`*?~[(]/.test(substituted)) return null;
+  if (substituted.startsWith('-')) return null; // `cd -` / flags, not a path
+  return substituted;
+}
+
+export function resolveBuildCommandPaths(
+  command: string,
+  options: ResolveBuildCommandPathsOptions,
+): BuildPathViolation[] {
+  const exists = options.exists ?? existsSync;
+  const violations: BuildPathViolation[] = [];
+  // The simulated working directory of the build. `null` means unknown: the
+  // previous cd could not be resolved, so a later relative cd cannot be either.
+  let cwd: string | null = options.buildDir;
+  for (const rawTarget of findCdTargets(command)) {
+    const target = resolveTarget(rawTarget, options);
+    if (target === null) {
+      cwd = null;
+      continue;
+    }
+    const resolved: string | null = target.startsWith('/')
+      ? target
+      : cwd === null
+        ? null
+        : resolve(cwd, target);
+    if (resolved === null) {
+      cwd = null;
+      continue;
+    }
+    if (!exists(resolved)) {
+      violations.push({ rawPath: rawTarget, resolvedPath: resolved });
+    }
+    cwd = resolved;
+  }
+  return violations;
+}

package/src/module/packaging/build.test.ts

@@ -7,10 +7,11 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { execFileSync } from 'node:child_process';
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { computeChecksums } from './build';
+import { buildModule, computeChecksums } from './build';
 
 describe('computeChecksums — scripts/node_modules bundling (ISS-0046)', () => {
   let dir: string;
@@ -73,3 +74,72 @@ describe('computeChecksums — scripts/node_modules bundling (ISS-0046)', () =>
     expect(paths.some((p) => p.startsWith('e2e/'))).toBe(false);
   });
 });
+
+/**
+ * The pack-staging branch must not eat the hook runtime (celilo#1310).
+ *
+ * `buildModule` stages through `bun pm pack` whenever a module has a root
+ * package.json, and npm-pack semantics drop every `node_modules` — a `files`
+ * entry naming the path does not override it. That silently contradicted
+ * `includeNodeModulesPath`, which exists to ship `scripts/node_modules` in full
+ * so hooks resolve their deps on a target with no reachable registry.
+ *
+ * Nothing in `modules/` can reach this branch: every module there has only
+ * `scripts/package.json` and takes the `cpSync` path. So the regression is only
+ * visible against a fixture shaped like a module that is ALSO a bun project.
+ */
+describe('buildModule — a root package.json must not strip the hook runtime', () => {
+  let source: string;
+  let out: string;
+
+  function write(rel: string, content: string): void {
+    const full = join(source, rel);
+    mkdirSync(join(full, '..'), { recursive: true });
+    writeFileSync(full, content, 'utf-8');
+  }
+
+  beforeEach(() => {
+    source = mkdtempSync(join(tmpdir(), 'celilo-pack-root-pkg-'));
+    out = join(mkdtempSync(join(tmpdir(), 'celilo-pack-out-')), 'm.netapp');
+
+    write('manifest.yml', 'celilo_contract: "1.0"\nid: root-pkg-module\nname: M\nversion: 0.1.0\n');
+    // The shape that triggers it: a module that is also a bun project. `files`
+    // deliberately names scripts/ — proving the loss is npm-pack semantics and
+    // not a missing entry.
+    write(
+      'package.json',
+      JSON.stringify({
+        name: 'root-pkg-module',
+        version: '0.1.0',
+        private: true,
+        files: ['manifest.yml', 'scripts/'],
+      }),
+    );
+    write('scripts/on_install.ts', "import '@celilo/capabilities';\n");
+    write(
+      'scripts/package.json',
+      JSON.stringify({ name: 'm-hooks', dependencies: { tldts: '^7.0.0' } }),
+    );
+    write('scripts/node_modules/tldts/index.js', 'module.exports = {};\n');
+    write(
+      'scripts/node_modules/tldts/package.json',
+      JSON.stringify({ name: 'tldts', version: '7.4.12' }),
+    );
+    write('scripts/node_modules/.bin/tldts', '#!/bin/sh\n');
+  });
+
+  afterEach(() => {
+    rmSync(source, { recursive: true, force: true });
+    rmSync(join(out, '..'), { recursive: true, force: true });
+  });
+
+  it('ships scripts/node_modules even though bun pm pack dropped it', async () => {
+    const result = await buildModule({ sourceDir: source, outputPath: out });
+    expect(result.success).toBe(true);
+
+    const listed = execFileSync('tar', ['tzf', out], { encoding: 'utf-8' }).split('\n');
+    expect(listed).toContain('scripts/node_modules/tldts/index.js');
+    // The one thing the runtime closure still excludes.
+    expect(listed).not.toContain('scripts/node_modules/.bin/tldts');
+  });
+});

package/src/module/packaging/build.ts

@@ -9,6 +9,7 @@ import { parse as parseYaml } from 'yaml';
 import { log } from '../../cli/prompts';
 import { formatViolations, scanModuleDirectory } from '../../policy/module-script-scan';
 import { validateModuleDirectory } from '../import';
+import { resolveBuildCommandPaths } from './build-paths';
 import { computeFileChecksum } from './checksum';
 import { classifyModulePath, includeNodeModulesPath } from './package-rules';
 import { signChecksums } from './signature';
@@ -23,6 +24,37 @@ export interface ChecksumsData {
   files: Record<string, string>; // filepath -> xxhash
 }
 
+/**
+ * Put `scripts/node_modules` back after a `bun pm pack` staging.
+ *
+ * `bun pm pack` drops every `node_modules` unconditionally — that is npm-pack
+ * semantics, and a `files` entry naming the path does not override it. But the
+ * packager is explicit downstream (`includeNodeModulesPath`) that
+ * `scripts/node_modules` is the module's HOOK RUNTIME and ships in full, so
+ * hooks resolve their third-party deps on a target with no reachable registry.
+ *
+ * Those two rules disagreed, and which one won was decided by whether a module
+ * happened to have a root `package.json`. Every module in `modules/` has only
+ * `scripts/package.json`, so all of them take the `cpSync` branch below and
+ * keep their runtime. A module that is ALSO a bun project — a build script, a
+ * data pipeline, its own tests — takes this branch instead and shipped without
+ * one. Nothing caught it: package, publish, import and deploy all succeed, and
+ * the first symptom is the hook dying on the target with
+ * `Cannot find package '@celilo/capabilities'` (celilo#1310).
+ *
+ * The hook runtime is not build input, so `files` has no business filtering it.
+ * Symlinks are materialised for the same reason the `cpSync` branch does it: a
+ * `file:` workspace link would point at a path the target does not have.
+ */
+function stageHookRuntime(sourceDir: string, buildDir: string): void {
+  const from = join(sourceDir, 'scripts', 'node_modules');
+  if (!existsSync(from)) return;
+  cpSync(from, join(buildDir, 'scripts', 'node_modules'), {
+    recursive: true,
+    dereference: true,
+  });
+}
+
 /**
  * Module build options
  */
@@ -215,6 +247,7 @@ export async function buildModule(options: ModuleBuildOptions): Promise<ModuleBu
           timeout: 60_000,
         });
         rmSync(tarballs[0], { force: true });
+        stageHookRuntime(sourceDir, buildDir);
       } catch (err) {
         const errMsg = err instanceof Error ? err.message : String(err);
         return {
@@ -258,6 +291,33 @@ export async function buildModule(options: ModuleBuildOptions): Promise<ModuleBu
     if (manifest.build?.command || manifest.build?.script) {
       log.info(`Building module (${manifest.build.command ? 'command' : 'script'})...`);
 
+      // Publish-time gate on the build command's paths (D3 of
+      // control-plane-stops-building-modules). A `cd` whose target does not
+      // resolve where the command runs means the module depends on inputs it
+      // does not carry. celilo-registry did exactly this for four months
+      // (`cd ../../packages/registry-server`) and the failure surfaced on a
+      // production control plane, months after publish, as a /bin/sh error.
+      // Refuse here, at the only point where a human is watching, and name the
+      // path. Targets the gate cannot resolve (untracked shell variables,
+      // command substitution) are skipped, never guessed at.
+      if (manifest.build.command) {
+        const pathViolations = resolveBuildCommandPaths(manifest.build.command, {
+          moduleSourceDir: sourceDir,
+          buildDir,
+        });
+        if (pathViolations.length > 0) {
+          return {
+            success: false,
+            error: [
+              `Refusing to build ${moduleId}: the build command references a path that does not exist where the command runs.`,
+              ...pathViolations.map((v) => `  ${v.rawPath}\n    resolves to: ${v.resolvedPath}`),
+              '',
+              'A build input that does not resolve at publish time makes the module unbuildable wherever it is installed. Fix the path in manifest.yml (keep it module-local, or reach the monorepo through $CELILO_MODULE_SOURCE_DIR) and re-publish.',
+            ].join('\n'),
+          };
+        }
+      }
+
       // Resolve `workspace:` build deps (ISS-0147 / celilo#216). The staged
       // buildDir has no workspace root, so a sibling monorepo package pulled in
       // via `workspace:^` won't resolve during the build's `bun install`.

package/src/module/packaging/extract.ts

@@ -19,12 +19,8 @@ export interface IntegrityViolation {
    * being old rather than by the files having changed. Only `auditModule`
    * produces it; package verification compares a package to its own manifest
    * and cannot be stale in this sense.
-   *
-   * `stale-generated` is the second plane (D3): a verbatim role asset in
-   * `generated/` whose bytes are not the installed module's. That is what
-   * celilo#925 was, and what would ship on the next deploy.
    */
-  type: 'missing' | 'modified' | 'extra' | 'stale-baseline' | 'stale-generated';
+  type: 'missing' | 'modified' | 'extra' | 'stale-baseline';
   /**
    * What the baseline says the file should hash to, and what it actually
    * hashes to. Both optional because not every violation is about a digest —

package/src/policy/module-script-scan.ts

@@ -344,12 +344,6 @@ export const JAILED_CLI_SPAWN_DEBT: readonly PolicyDebtEntry[] = [
     reason:
       'hook-owned-state 5.5 / survey class G: machine list becomes a machine-pool read capability',
   },
-  {
-    module: 'caddy-internal',
-    file: 'scripts/private-web-functions.ts',
-    matches: 1,
-    reason: 'hook-owned-state 5.5 (routes, capability-owned-tables Group B1)',
-  },
   {
     module: 'dnsmasq-dhcp',
     file: 'scripts/dhcp-server-functions.ts',
@@ -389,34 +383,6 @@ export const JAILED_CLI_SPAWN_DEBT: readonly PolicyDebtEntry[] = [
     reason:
       'hook-owned-state 5.5 shape (self-config write); not in its 10-site table — reconcile there',
   },
-  {
-    module: 'wireguard',
-    file: 'scripts/control-plane-vpn-functions.ts',
-    matches: 1,
-    reason:
-      'hook-owned-state 5.5 shape (self-config write); not in its 10-site table — reconcile there',
-  },
-  {
-    module: 'wireguard',
-    file: 'scripts/health-check.ts',
-    matches: 1,
-    reason:
-      'survey class C: system config get becomes an injected read; not in hook-owned-state 5.5 — reconcile there',
-  },
-  {
-    module: 'wireguard',
-    file: 'scripts/on_install.ts',
-    matches: 1,
-    reason:
-      'hook-owned-state 5.5 (registered_peers, Group B2); THE five-suite blocker per the wave-0 census',
-  },
-  {
-    module: 'wireguard-manager',
-    file: 'scripts/setup.ts',
-    matches: 3,
-    reason:
-      'hook-owned-state 5.5 (vpn_endpoint/vpn_server_public_key/client_pool, category 3; secret set)',
-  },
 ];
 
 /**
@@ -439,12 +405,6 @@ export const SWALLOWED_REFUSAL_DEBT: readonly PolicyDebtEntry[] = [
     reason:
       'hook-owned-state 5.5 / survey class G: machine list becomes a typed-absent machine-pool read',
   },
-  {
-    module: 'wireguard',
-    file: 'scripts/health-check.ts',
-    matches: 1,
-    reason: 'survey class C: system config get becomes an injected typed-absent read',
-  },
 ];
 
 /**