@celilo/cli 2.2.0 → 2.3.0

package/src/module/packaging/build-paths.ts

@@ -0,0 +1,175 @@
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+/**
+ * Publish-time gate on a module build command's filesystem references.
+ *
+ * A `build:` block runs when the module is packaged (publish/package/import),
+ * inside a staged copy of the module, with `CELILO_MODULE_SOURCE_DIR` pointing
+ * back at the authored source tree. A `cd` in that command is the build's
+ * claim about where its inputs live; a target that does not resolve there
+ * means the module ships inputs it does not carry, which is how celilo-registry
+ * was unbuildable on every real install for four months without anyone finding
+ * out (celilo#1307). The packager refuses up front and names the path.
+ *
+ * The gate does not interpret shell. It finds `cd` commands lexically, knows
+ * the two variables the packager supplies, and probes what those resolve to.
+ * A target it cannot resolve (an untracked shell variable, a command
+ * substitution, a glob) is SKIPPED, not failed: guessing would reject working
+ * modules, and a guard that rejects working modules is worse than none.
+ */
+
+export interface BuildPathViolation {
+  /** The path exactly as the build command wrote it, before substitution. */
+  rawPath: string;
+  /** The absolute path the packaging runtime would resolve it to. */
+  resolvedPath: string;
+}
+
+export interface ResolveBuildCommandPathsOptions {
+  /** What `$CELILO_MODULE_SOURCE_DIR` resolves to when the command runs. */
+  moduleSourceDir: string;
+  /** The staged tree the command runs in (its initial cwd, and `$STAGE`). */
+  buildDir: string;
+  /** Injectable existence probe; defaults to existsSync. */
+  exists?: (path: string) => boolean;
+}
+
+/**
+ * Extract the argument of every unquoted `cd` command in the string, with the
+ * quoting preserved so later substitution can strip it.
+ *
+ * A `cd` counts only at a command position: string start, or after `&&`, `||`,
+ * `;`, `|`, `(`, or a newline, ignoring whitespace. Quoted spans (single and
+ * double) are skipped whole, so a `cd` inside a string is not mistaken for a
+ * command.
+ */
+export function findCdTargets(command: string): string[] {
+  const targets: string[] = [];
+  let atCommandStart = true;
+  let i = 0;
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === "'") {
+      const end = command.indexOf("'", i + 1);
+      i = end === -1 ? command.length : end + 1;
+      atCommandStart = false;
+      continue;
+    }
+    if (ch === '"') {
+      const end = command.indexOf('"', i + 1);
+      i = end === -1 ? command.length : end + 1;
+      atCommandStart = false;
+      continue;
+    }
+    if (ch === '\\' && i + 1 < command.length) {
+      i += 2;
+      atCommandStart = false;
+      continue;
+    }
+    if (ch === '&' || ch === '|' || ch === ';' || ch === '\n' || ch === '(') {
+      atCommandStart = true;
+      i += 1;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      i += 1;
+      continue;
+    }
+    if (atCommandStart && command.startsWith('cd', i) && /\s/.test(command[i + 2] ?? '')) {
+      const { target, next } = readCdTarget(command, i + 2);
+      if (target.length > 0) targets.push(target);
+      i = next;
+      atCommandStart = false;
+      continue;
+    }
+    atCommandStart = false;
+    i += 1;
+  }
+  return targets;
+}
+
+/**
+ * Read one `cd` argument starting just after the `cd` keyword. Stops at an
+ * unquoted command terminator. Backslash escapes are carried through so the
+ * caller sees exactly what the shell would.
+ */
+function readCdTarget(command: string, start: number): { target: string; next: number } {
+  let i = start;
+  while (i < command.length && /\s/.test(command[i])) i += 1;
+  const begin = i;
+  let end = i;
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === "'") {
+      const close = command.indexOf("'", i + 1);
+      i = close === -1 ? command.length : close + 1;
+      end = i;
+      continue;
+    }
+    if (ch === '"') {
+      const close = command.indexOf('"', i + 1);
+      i = close === -1 ? command.length : close + 1;
+      end = i;
+      continue;
+    }
+    if (ch === '\\' && i + 1 < command.length) {
+      i += 2;
+      end = i;
+      continue;
+    }
+    if (ch === '&' || ch === '|' || ch === ';' || ch === '\n') break;
+    i += 1;
+    if (!/\s/.test(ch) || command.slice(begin, i).trim().length > 0) end = i;
+  }
+  return { target: command.slice(begin, end).trim(), next: i };
+}
+
+/**
+ * Substitute the packager-supplied variables, strip quoting, and drop the
+ * target to `null` when anything unresolvable remains. `null` means "this
+ * gate cannot answer whether this path exists", never "it does not exist".
+ */
+function resolveTarget(target: string, options: ResolveBuildCommandPathsOptions): string | null {
+  const substituted = target
+    .replaceAll('$CELILO_MODULE_SOURCE_DIR', options.moduleSourceDir)
+    .replaceAll('$(pwd)', options.buildDir)
+    .replaceAll('$STAGE', options.buildDir)
+    .replaceAll('"', '')
+    .replaceAll("'", '');
+  if (/[$`*?~[(]/.test(substituted)) return null;
+  if (substituted.startsWith('-')) return null; // `cd -` / flags, not a path
+  return substituted;
+}
+
+export function resolveBuildCommandPaths(
+  command: string,
+  options: ResolveBuildCommandPathsOptions,
+): BuildPathViolation[] {
+  const exists = options.exists ?? existsSync;
+  const violations: BuildPathViolation[] = [];
+  // The simulated working directory of the build. `null` means unknown: the
+  // previous cd could not be resolved, so a later relative cd cannot be either.
+  let cwd: string | null = options.buildDir;
+  for (const rawTarget of findCdTargets(command)) {
+    const target = resolveTarget(rawTarget, options);
+    if (target === null) {
+      cwd = null;
+      continue;
+    }
+    const resolved: string | null = target.startsWith('/')
+      ? target
+      : cwd === null
+        ? null
+        : resolve(cwd, target);
+    if (resolved === null) {
+      cwd = null;
+      continue;
+    }
+    if (!exists(resolved)) {
+      violations.push({ rawPath: rawTarget, resolvedPath: resolved });
+    }
+    cwd = resolved;
+  }
+  return violations;
+}

package/src/module/packaging/build.test.ts

@@ -7,10 +7,11 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { execFileSync } from 'node:child_process';
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { computeChecksums } from './build';
+import { buildModule, computeChecksums } from './build';
 
 describe('computeChecksums — scripts/node_modules bundling (ISS-0046)', () => {
   let dir: string;
@@ -73,3 +74,72 @@ describe('computeChecksums — scripts/node_modules bundling (ISS-0046)', () =>
     expect(paths.some((p) => p.startsWith('e2e/'))).toBe(false);
   });
 });
+
+/**
+ * The pack-staging branch must not eat the hook runtime (celilo#1310).
+ *
+ * `buildModule` stages through `bun pm pack` whenever a module has a root
+ * package.json, and npm-pack semantics drop every `node_modules` — a `files`
+ * entry naming the path does not override it. That silently contradicted
+ * `includeNodeModulesPath`, which exists to ship `scripts/node_modules` in full
+ * so hooks resolve their deps on a target with no reachable registry.
+ *
+ * Nothing in `modules/` can reach this branch: every module there has only
+ * `scripts/package.json` and takes the `cpSync` path. So the regression is only
+ * visible against a fixture shaped like a module that is ALSO a bun project.
+ */
+describe('buildModule — a root package.json must not strip the hook runtime', () => {
+  let source: string;
+  let out: string;
+
+  function write(rel: string, content: string): void {
+    const full = join(source, rel);
+    mkdirSync(join(full, '..'), { recursive: true });
+    writeFileSync(full, content, 'utf-8');
+  }
+
+  beforeEach(() => {
+    source = mkdtempSync(join(tmpdir(), 'celilo-pack-root-pkg-'));
+    out = join(mkdtempSync(join(tmpdir(), 'celilo-pack-out-')), 'm.netapp');
+
+    write('manifest.yml', 'celilo_contract: "1.0"\nid: root-pkg-module\nname: M\nversion: 0.1.0\n');
+    // The shape that triggers it: a module that is also a bun project. `files`
+    // deliberately names scripts/ — proving the loss is npm-pack semantics and
+    // not a missing entry.
+    write(
+      'package.json',
+      JSON.stringify({
+        name: 'root-pkg-module',
+        version: '0.1.0',
+        private: true,
+        files: ['manifest.yml', 'scripts/'],
+      }),
+    );
+    write('scripts/on_install.ts', "import '@celilo/capabilities';\n");
+    write(
+      'scripts/package.json',
+      JSON.stringify({ name: 'm-hooks', dependencies: { tldts: '^7.0.0' } }),
+    );
+    write('scripts/node_modules/tldts/index.js', 'module.exports = {};\n');
+    write(
+      'scripts/node_modules/tldts/package.json',
+      JSON.stringify({ name: 'tldts', version: '7.4.12' }),
+    );
+    write('scripts/node_modules/.bin/tldts', '#!/bin/sh\n');
+  });
+
+  afterEach(() => {
+    rmSync(source, { recursive: true, force: true });
+    rmSync(join(out, '..'), { recursive: true, force: true });
+  });
+
+  it('ships scripts/node_modules even though bun pm pack dropped it', async () => {
+    const result = await buildModule({ sourceDir: source, outputPath: out });
+    expect(result.success).toBe(true);
+
+    const listed = execFileSync('tar', ['tzf', out], { encoding: 'utf-8' }).split('\n');
+    expect(listed).toContain('scripts/node_modules/tldts/index.js');
+    // The one thing the runtime closure still excludes.
+    expect(listed).not.toContain('scripts/node_modules/.bin/tldts');
+  });
+});

package/src/module/packaging/build.ts

@@ -9,6 +9,7 @@ import { parse as parseYaml } from 'yaml';
 import { log } from '../../cli/prompts';
 import { formatViolations, scanModuleDirectory } from '../../policy/module-script-scan';
 import { validateModuleDirectory } from '../import';
+import { resolveBuildCommandPaths } from './build-paths';
 import { computeFileChecksum } from './checksum';
 import { classifyModulePath, includeNodeModulesPath } from './package-rules';
 import { signChecksums } from './signature';
@@ -23,6 +24,37 @@ export interface ChecksumsData {
   files: Record<string, string>; // filepath -> xxhash
 }
 
+/**
+ * Put `scripts/node_modules` back after a `bun pm pack` staging.
+ *
+ * `bun pm pack` drops every `node_modules` unconditionally — that is npm-pack
+ * semantics, and a `files` entry naming the path does not override it. But the
+ * packager is explicit downstream (`includeNodeModulesPath`) that
+ * `scripts/node_modules` is the module's HOOK RUNTIME and ships in full, so
+ * hooks resolve their third-party deps on a target with no reachable registry.
+ *
+ * Those two rules disagreed, and which one won was decided by whether a module
+ * happened to have a root `package.json`. Every module in `modules/` has only
+ * `scripts/package.json`, so all of them take the `cpSync` branch below and
+ * keep their runtime. A module that is ALSO a bun project — a build script, a
+ * data pipeline, its own tests — takes this branch instead and shipped without
+ * one. Nothing caught it: package, publish, import and deploy all succeed, and
+ * the first symptom is the hook dying on the target with
+ * `Cannot find package '@celilo/capabilities'` (celilo#1310).
+ *
+ * The hook runtime is not build input, so `files` has no business filtering it.
+ * Symlinks are materialised for the same reason the `cpSync` branch does it: a
+ * `file:` workspace link would point at a path the target does not have.
+ */
+function stageHookRuntime(sourceDir: string, buildDir: string): void {
+  const from = join(sourceDir, 'scripts', 'node_modules');
+  if (!existsSync(from)) return;
+  cpSync(from, join(buildDir, 'scripts', 'node_modules'), {
+    recursive: true,
+    dereference: true,
+  });
+}
+
 /**
  * Module build options
  */
@@ -215,6 +247,7 @@ export async function buildModule(options: ModuleBuildOptions): Promise<ModuleBu
           timeout: 60_000,
         });
         rmSync(tarballs[0], { force: true });
+        stageHookRuntime(sourceDir, buildDir);
       } catch (err) {
         const errMsg = err instanceof Error ? err.message : String(err);
         return {
@@ -258,6 +291,33 @@ export async function buildModule(options: ModuleBuildOptions): Promise<ModuleBu
     if (manifest.build?.command || manifest.build?.script) {
       log.info(`Building module (${manifest.build.command ? 'command' : 'script'})...`);
 
+      // Publish-time gate on the build command's paths (D3 of
+      // control-plane-stops-building-modules). A `cd` whose target does not
+      // resolve where the command runs means the module depends on inputs it
+      // does not carry. celilo-registry did exactly this for four months
+      // (`cd ../../packages/registry-server`) and the failure surfaced on a
+      // production control plane, months after publish, as a /bin/sh error.
+      // Refuse here, at the only point where a human is watching, and name the
+      // path. Targets the gate cannot resolve (untracked shell variables,
+      // command substitution) are skipped, never guessed at.
+      if (manifest.build.command) {
+        const pathViolations = resolveBuildCommandPaths(manifest.build.command, {
+          moduleSourceDir: sourceDir,
+          buildDir,
+        });
+        if (pathViolations.length > 0) {
+          return {
+            success: false,
+            error: [
+              `Refusing to build ${moduleId}: the build command references a path that does not exist where the command runs.`,
+              ...pathViolations.map((v) => `  ${v.rawPath}\n    resolves to: ${v.resolvedPath}`),
+              '',
+              'A build input that does not resolve at publish time makes the module unbuildable wherever it is installed. Fix the path in manifest.yml (keep it module-local, or reach the monorepo through $CELILO_MODULE_SOURCE_DIR) and re-publish.',
+            ].join('\n'),
+          };
+        }
+      }
+
       // Resolve `workspace:` build deps (ISS-0147 / celilo#216). The staged
       // buildDir has no workspace root, so a sibling monorepo package pulled in
       // via `workspace:^` won't resolve during the build's `bun install`.

package/src/module/packaging/extract.ts

@@ -19,12 +19,8 @@ export interface IntegrityViolation {
    * being old rather than by the files having changed. Only `auditModule`
    * produces it; package verification compares a package to its own manifest
    * and cannot be stale in this sense.
-   *
-   * `stale-generated` is the second plane (D3): a verbatim role asset in
-   * `generated/` whose bytes are not the installed module's. That is what
-   * celilo#925 was, and what would ship on the next deploy.
    */
-  type: 'missing' | 'modified' | 'extra' | 'stale-baseline' | 'stale-generated';
+  type: 'missing' | 'modified' | 'extra' | 'stale-baseline';
   /**
    * What the baseline says the file should hash to, and what it actually
    * hashes to. Both optional because not every violation is about a digest —

package/src/policy/module-script-scan.ts

@@ -82,28 +82,36 @@ export const SWALLOWED_REFUSAL_RULE = 'swallowed framework refusal';
  */
 const CLI_SPAWN_RE =
   /\b(?:execSync|execFileSync|execFile|exec|spawnSync|spawn)\s*\(\s*(?:['"`]\s*celilo(?=\s|['"`])|`[^`]*\bcelilo(?=\s|`))/;
+
+/**
+ * The spawn rule runs against the WHOLE FILE, not one line at a time. The
+ * per-line pass above could not see a call whose argv wrapped onto the next
+ * line — `execFileSync(\n  'celilo', …` — and that blind spot was live:
+ * celilo-registry setup.ts carried a four-line spawn and iptables
+ * firewall-functions.ts three more, all scanning clean while the gate was
+ * green (found by ce-y0we's reach check on 2026-09-09). The regex itself
+ * needs no change — `\s*` already crosses newlines, and `[^\`]*` never
+ * matches a backtick so a template cannot swallow the rest of the file — it
+ * just has to be applied to text wider than a line. Line numbers come from
+ * the match index, so reports still name the line an author fixes.
+ */
+const CLI_SPAWN_BLOCK_RE = new RegExp(CLI_SPAWN_RE.source, 'g');
+
+/** Same wording the rule carried when it ran per line; moved with the pass. */
+const CLI_SPAWN_HINT =
+  'A jailed hook has no celilo binary and no shell, so this dies with ' +
+  '"Executable not found in $PATH" (celilo#1225). Replace the spawn with an ' +
+  'injected capability — context.secrets/context.config for self-config and ' +
+  'self-secrets (openspec/changes/hook-owned-state) — or move the operation ' +
+  'into the framework the way celilo-mgmt on_install did (5e0e624d).';
+
 const FRAMEWORK_CALL_RE = new RegExp(`${CLI_SPAWN_RE.source}|\\brunCelilo\\s*\\(`);
 
 const PATTERN_RULES: Array<{ rule: string; re: RegExp; hint: string }> = [
-  {
-    rule: JAILED_CLI_SPAWN_RULE,
-    // Same regex as CLI_SPAWN_RE below — one definition of "reaches the
-    // framework", used by both rules that key on it. Matches the CLI as
-    // argv[0] of a spawn-family call ('celilo' / "celilo"), or inside a shell
-    // string passed to one, where celilo is followed by a word (a subcommand)
-    // or the closing quote — so `docker exec celilo-mgr …`, a `celilo.db` file
-    // name, and prose that merely names the CLI do not fire. What it
-    // deliberately cannot see: a binary path resolved into a variable, or a
-    // spawn reached through an indirection. Same honesty class as the
-    // namespace rule — a lint, not a boundary.
-    re: CLI_SPAWN_RE,
-    hint:
-      'A jailed hook has no celilo binary and no shell, so this dies with ' +
-      '"Executable not found in $PATH" (celilo#1225). Replace the spawn with an ' +
-      'injected capability — context.secrets/context.config for self-config and ' +
-      'self-secrets (openspec/changes/hook-owned-state) — or move the operation ' +
-      'into the framework the way celilo-mgmt on_install did (5e0e624d).',
-  },
+  // NOTE: the jailed-CLI-spawn rule is NOT in this array — it runs in its own
+  // whole-file pass in scanModuleScriptSource (CLI_SPAWN_BLOCK_RE), because a
+  // per-line match missed every spawn whose argv wrapped. Everything else
+  // stays per-line.
   {
     rule: 'raw ssh invocation (StrictHostKeyChecking)',
     re: /StrictHostKeyChecking/,
@@ -200,6 +208,20 @@ export function scanModuleScriptSource(file: string, source: string): ScanViolat
   const violations: ScanViolation[] = [];
   const lines = source.split('\n');
 
+  // The jailed-CLI-spawn pass: whole-file, so a spawn whose argv wraps onto
+  // the next line is still seen (see CLI_SPAWN_BLOCK_RE for the blind spot
+  // that motivated this). Reported on the line the CALL starts, because that
+  // is the site an author fixes.
+  CLI_SPAWN_BLOCK_RE.lastIndex = 0;
+  for (let m = CLI_SPAWN_BLOCK_RE.exec(source); m !== null; m = CLI_SPAWN_BLOCK_RE.exec(source)) {
+    violations.push({
+      file,
+      line: source.slice(0, m.index).split('\n').length,
+      rule: JAILED_CLI_SPAWN_RULE,
+      hint: CLI_SPAWN_HINT,
+    });
+  }
+
   lines.forEach((text, i) => {
     for (const { rule, re, hint } of PATTERN_RULES) {
       if (re.test(text)) violations.push({ file, line: i + 1, rule, hint });
@@ -337,85 +359,19 @@ export interface PolicyDebtEntry {
  * the test goes red, and the entry must be deleted in the same change.
  */
 export const JAILED_CLI_SPAWN_DEBT: readonly PolicyDebtEntry[] = [
-  {
-    module: 'celilo-mgmt',
-    file: 'scripts/on_backup.ts',
-    matches: 1,
-    reason:
-      'hook-owned-state 5.5 / survey class G: machine list becomes a machine-pool read capability',
-  },
-  {
-    module: 'caddy-internal',
-    file: 'scripts/private-web-functions.ts',
-    matches: 1,
-    reason: 'hook-owned-state 5.5 (routes, capability-owned-tables Group B1)',
-  },
   {
     module: 'dnsmasq-dhcp',
     file: 'scripts/dhcp-server-functions.ts',
     matches: 1,
     reason:
-      'hook-owned-state 5.5 shape (self-config write); not in its 10-site table — reconcile there',
-  },
-  {
-    module: 'forgejo',
-    file: 'scripts/on-consumer-removed.ts',
-    matches: 1,
-    reason: 'hook-owned-state 5.5 (runner_registrations, Group B3)',
-  },
-  {
-    module: 'forgejo',
-    file: 'scripts/setup.ts',
-    matches: 1,
-    reason: 'hook-owned-state 5.5 (secret set)',
-  },
-  {
-    module: 'forgejo',
-    file: 'scripts/source-forge-functions.ts',
-    matches: 1,
-    reason:
-      'hook-owned-state 5.5 shape (self-config write); not in its 10-site table — reconcile there',
+      'capability provider, no hook entry imports it — ce-mqay (jail does not constrain it; conversion is dedup, not breakage)',
   },
   {
-    module: 'generic-cpanel-hosting-provider',
-    file: 'scripts/on-consumer-removed.ts',
-    matches: 1,
-    reason: 'hook-owned-state 5.5 (publications, Group B4)',
-  },
-  {
-    module: 'generic-cpanel-hosting-provider',
-    file: 'scripts/publish-functions.ts',
-    matches: 1,
-    reason:
-      'hook-owned-state 5.5 shape (self-config write); not in its 10-site table — reconcile there',
-  },
-  {
-    module: 'wireguard',
-    file: 'scripts/control-plane-vpn-functions.ts',
-    matches: 1,
-    reason:
-      'hook-owned-state 5.5 shape (self-config write); not in its 10-site table — reconcile there',
-  },
-  {
-    module: 'wireguard',
-    file: 'scripts/health-check.ts',
-    matches: 1,
-    reason:
-      'survey class C: system config get becomes an injected read; not in hook-owned-state 5.5 — reconcile there',
-  },
-  {
-    module: 'wireguard',
-    file: 'scripts/on_install.ts',
-    matches: 1,
-    reason:
-      'hook-owned-state 5.5 (registered_peers, Group B2); THE five-suite blocker per the wave-0 census',
-  },
-  {
-    module: 'wireguard-manager',
-    file: 'scripts/setup.ts',
+    module: 'iptables',
+    file: 'scripts/firewall-functions.ts',
     matches: 3,
     reason:
-      'hook-owned-state 5.5 (vpn_endpoint/vpn_server_public_key/client_pool, category 3; secret set)',
+      'ce-mqay: capability provider, no hook entry imports it. Two config-set writes and one events emit. INVISIBLE to the scan until ce-y0we taught it continuation lines (2026-09-09) — these three were live spawns the green gate could not see',
   },
 ];
 
@@ -427,25 +383,13 @@ export const JAILED_CLI_SPAWN_DEBT: readonly PolicyDebtEntry[] = [
  * same guarded rot: when a site converts, the count drops, the debt test goes
  * red, and the entry must be deleted in the same change.
  *
- * Converted on 2026-09-07 by ce-pvii: knot-unbound-internal/scripts/on-install.ts
- * dropped its last swallow (the runCelilo wrapper), so the rule fires on
- * exactly these two sites and nothing else in the tree.
+ * EMPTY as of ce-y0we (2026-09-09): knot-unbound-internal's on-install dropped
+ * its last swallow on 2026-09-07 (ce-pvii), wireguard's health-check converted
+ * the same evening (01575380), and celilo-mgmt's on_backup machine-pool read
+ * retired the last entry. A NEW swallowed refusal must never land here — it
+ * gets fixed, not tracked.
  */
-export const SWALLOWED_REFUSAL_DEBT: readonly PolicyDebtEntry[] = [
-  {
-    module: 'celilo-mgmt',
-    file: 'scripts/on_backup.ts',
-    matches: 1,
-    reason:
-      'hook-owned-state 5.5 / survey class G: machine list becomes a typed-absent machine-pool read',
-  },
-  {
-    module: 'wireguard',
-    file: 'scripts/health-check.ts',
-    matches: 1,
-    reason: 'survey class C: system config get becomes an injected typed-absent read',
-  },
-];
+export const SWALLOWED_REFUSAL_DEBT: readonly PolicyDebtEntry[] = [];
 
 /**
  * The files inside `@celilo/capabilities` that implement the remote-exec

package/src/policy/no-hand-built-ssh.test.ts

@@ -85,7 +85,11 @@ describe('recurrence gate: the jailed-CLI-spawn debt list is honest', () => {
   });
 
   test('the debt list is non-trivial (the guard actually reached the entries)', () => {
-    expect(JAILED_CLI_SPAWN_DEBT.length).toBeGreaterThan(5);
+    // Was >5 while the list still carried the hook-owned-state 5.5 batch. The
+    // conversions retire entries faster than new debt arrives (ce-y0we), so
+    // the floor is now "at least one tracked site" — enough to prove the test
+    // reached the list without pinning the retirement schedule.
+    expect(JAILED_CLI_SPAWN_DEBT.length).toBeGreaterThan(0);
   });
 });
 

package/src/policy/no-swallowed-refusal.test.ts

@@ -212,9 +212,9 @@ describe('recurrence gate: a hook does not swallow a refused framework call', ()
     }
   });
 
-  test('today’s tree: the remaining known sites are flagged, and nothing else is', () => {
+  test('today’s tree: no swallowed refusals anywhere, and the scan still reaches every module', () => {
     // Raw scan, deliberately NOT scanModuleDirectory: the debt list below
-    // exempts these same files so the merged gate stays green while
+    // exempts the same files so the merged gate stays green while
     // hook-owned-state converts them, and this assertion has to outlive that
     // exemption to prove the rule still reaches them.
     const violations = moduleDirs().flatMap((d) =>
@@ -225,15 +225,11 @@ describe('recurrence gate: a hook does not swallow a refused framework call', ()
       ),
     );
     const sites = violations.map((v) => v.file.replace(`${repoRoot()}/`, '')).sort();
-    // Pinned to the exact sites from e2e-suite-recovery task 4.2, as measured
-    // on 2026-09-07 at on_backup.ts:52 and health-check.ts:73 (a third,
-    // on-install.ts:69, converted by ce-pvii the same day). A converted site
-    // drops out and the debt entry must go; a NEW site appearing here is the
-    // next instance this scan exists to stop.
-    expect(sites).toEqual([
-      'modules/celilo-mgmt/scripts/on_backup.ts',
-      'modules/wireguard/scripts/health-check.ts',
-    ]);
+    // Empty since ce-y0we (2026-09-09): on_backup.ts:52 was the last site —
+    // its machine-pool read is staged input now — and the two before it
+    // converted on 2026-09-07 (ce-pvii and 01575380). A NEW site appearing
+    // here is the next instance this scan exists to stop.
+    expect(sites, `Module script policy violations:\n${formatViolations(violations)}`).toEqual([]);
   });
 });
 
@@ -257,9 +253,12 @@ describe('recurrence gate: the swallow debt list is honest', () => {
     }
   });
 
-  test('the debt list is non-trivial (the guard actually reached the entries)', () => {
-    // The list held three entries until ce-pvii converted the on-install.ts
-    // entry (2026-09-07); two remain, so the guard still proves engagement.
-    expect(SWALLOWED_REFUSAL_DEBT.length).toBeGreaterThan(1);
+  test('the debt list is retired (empty), and this test pins that fact', () => {
+    // The list held three entries when the gate landed; ce-pvii and 01575380
+    // converted two on 2026-09-07 and ce-y0we retired the last (on_backup's
+    // machine-pool read) on 2026-09-09. Kept as an explicit pin so a future
+    // entry has to be justified against this sentence: a swallowed refusal is
+    // a defect to fix, never debt to track.
+    expect(SWALLOWED_REFUSAL_DEBT).toEqual([]);
   });
 });

package/src/registry/client.test.ts

@@ -48,14 +48,14 @@ describe('RegistryClient constructor', () => {
 
   afterEach(() => {
     if (origEnv === undefined) {
-      process.env.CELILO_REGISTRY_URL = undefined;
+      delete process.env.CELILO_REGISTRY_URL;
     } else {
       process.env.CELILO_REGISTRY_URL = origEnv;
     }
   });
 
   test('uses DEFAULT_REGISTRY when no arg and no env var', () => {
-    process.env.CELILO_REGISTRY_URL = undefined;
+    delete process.env.CELILO_REGISTRY_URL;
     const client = new RegistryClient();
     expect(client.baseUrl).toBe(DEFAULT_REGISTRY);
   });

package/src/secrets/storage.test.ts

@@ -36,7 +36,7 @@ describe('secret storage', () => {
   afterEach(() => {
     // Cleanup
     rmSync(testDir, { recursive: true, force: true });
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_MASTER_KEY_PATH;
   });
 
   test('stores and retrieves system secret', async () => {