@celilo/cli 2.2.0 → 2.3.0

package/src/services/alerting/ack.test.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { type Route, alerts, modules, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { acknowledgeAlert, findLiveAlertByKey, resolveAlertManually, silenceAlert } from './ack';
 import { moduleCheckAlertKey } from './keys';
 import { createPerson, createRoute } from './people';
@@ -79,7 +80,7 @@ describe('ack / silence / resolve', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/cadence-migration.test.ts

@@ -16,6 +16,7 @@ import { join } from 'node:path';
 import { closeDb, getDb } from '../../db/client';
 import { runMigrations } from '../../db/migrate';
 import { modules, monitors } from '../../db/schema';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { getModuleConfigValue, upsertModuleConfig } from '../module-config';
 import { migrateMonitorCadences } from './cadence-migration';
 import { HEALTH_CHECK_INTERVAL_CONFIG_KEY, loadModuleHealthCadences } from './health-cadence';
@@ -66,7 +67,7 @@ describe('migrateMonitorCadences', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dir, { recursive: true, force: true });
   });
 
@@ -132,7 +133,7 @@ describe("a module_hook row's stored cadence is not consulted", () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dir, { recursive: true, force: true });
   });
 

package/src/services/alerting/coverage-source.test.ts

@@ -20,6 +20,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { modules } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { CONTROL_PLANE_MODULE_ID } from '../deployed-systems';
 import { loadModuleCoverage } from './coverage-source';
 import { healthCoverageFailingKeys } from './health-coverage';
@@ -37,7 +38,7 @@ describe('health coverage and the control plane', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/deferral.test.ts

@@ -6,6 +6,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type Alert, type Route, alerts, modules, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { moduleCheckAlertKey } from './keys';
 import { deliverDeferred } from './notifier';
 import { createPerson, createRoute } from './people';
@@ -80,7 +81,7 @@ describe('quiet-hours deferral', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/delivery-loop.test.ts

@@ -21,6 +21,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { type Alert, type Route, modules } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import type { EscalationStep, RouteForEscalation } from './escalation';
 import { interpretInbound } from './inbound';
 import {
@@ -249,7 +250,7 @@ describe('delivery loop against the signal-cli simulator', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/deploy-hooks.test.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { modules, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import {
   closeDeployWindows,
   ensureMonitorOnDeploy,
@@ -34,7 +35,7 @@ describe('deploy hooks', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/inbound-poller.test.ts

@@ -7,6 +7,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type Route, alerts, modules, monitors, notificationDeliveries } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import {
   type InboundPollDeps,
   type TransportReadRecord,
@@ -105,7 +106,7 @@ describe('pollInbound', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/inbound.test.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { type NotificationDelivery, modules, people, routes } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { interpretInbound, parseInbound } from './inbound';
 import { mintDelivery } from './tokens';
 
@@ -107,7 +108,7 @@ describe('interpretInbound', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/keys.test.ts

@@ -116,6 +116,10 @@ describe('severityForItemStatus', () => {
     expect(severityForItemStatus('fail', 'critical')).toBe('critical');
     expect(severityForItemStatus('fail', 'warning')).toBe('warning');
   });
+
+  test('skip produces no alert — a check that could not run is not a failure', () => {
+    expect(severityForItemStatus('skip', 'critical')).toBeNull();
+  });
 });
 
 describe('failingKeysFromHealthItems', () => {

package/src/services/alerting/keys.ts

@@ -134,14 +134,24 @@ export function parentModuleKey(key: string): string | null {
  * and never pages. That gives module authors somewhere to put "cert expires in
  * 20 days" without anyone having to decide whether it is a 3am problem.
  *
+ * `skip` produces no alert either: a check that could not perform its probe
+ * is not a failure. Note the honest cost — a previously-failing key whose
+ * item now reports skip leaves this run's failing set, so the reconciler
+ * reads "recovered" off a run that measured nothing. That is the same hazard
+ * class design D5 handles at run level (a run that could not execute is the
+ * caller's branch); there is no per-item sticky-key mechanism here, so a
+ * module whose credential disappeared needs the audit's `unmeasured` finding
+ * to be seen (celilo#1326).
+ *
  * See design D6.
  */
 export function severityForItemStatus(
-  itemStatus: 'pass' | 'warn' | 'fail',
+  itemStatus: 'pass' | 'warn' | 'fail' | 'skip',
   monitorSeverity: AlertSeverity,
 ): AlertSeverity | null {
   if (itemStatus === 'pass') return null;
   if (itemStatus === 'warn') return 'warning';
+  if (itemStatus === 'skip') return null;
   return monitorSeverity;
 }
 
@@ -155,7 +165,7 @@ export interface FailingKey {
 
 export interface HealthCheckItemLike {
   name: string;
-  status: 'pass' | 'warn' | 'fail';
+  status: 'pass' | 'warn' | 'fail' | 'skip';
   message: string;
   details?: string;
 }

package/src/services/alerting/notification-responder.test.ts

@@ -6,6 +6,7 @@ import { defineEvents, openBus } from '@celilo/event-bus';
 import type { DbClient } from '../../db/client';
 import { type Route, modules } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import {
   type NotificationResponderHandle,
   startNotificationResponder,
@@ -88,7 +89,7 @@ describe('notification responder', () => {
     handle?.stop();
     handle = undefined;
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/run-monitor.test.ts

@@ -6,6 +6,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type Monitor, alerts, monitorRuns, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import type { HealthCheckResult } from '../health-runner';
 import { HOOK_JAIL_CHECK, type HookJailState } from './hook-jail';
 import { moduleAlertKey, moduleCheckAlertKey } from './keys';
@@ -71,7 +72,7 @@ describe('runOneMonitor', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/store.test.ts

@@ -6,6 +6,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { alerts, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { moduleAlertKey, moduleCheckAlertKey } from './keys';
 import type { ReconcileAction } from './reconcile';
 import {
@@ -55,7 +56,7 @@ describe('alert store', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/sweep-runner.test.ts

@@ -6,6 +6,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type Alert, type Monitor, alerts, modules, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import type { HealthCheckResult } from '../health-runner';
 import { deleteModuleConfig, upsertModuleConfig } from '../module-config';
 import { HEALTH_CHECK_INTERVAL_CONFIG_KEY, reconcileModuleWatchState } from './health-cadence';
@@ -99,7 +100,7 @@ describe('runSweep', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/tokens.test.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { modules, people, routes } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import {
   consumeDelivery,
   deliveriesForAlert,
@@ -75,7 +76,7 @@ describe('delivery records', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/aspect-approvals.test.ts

@@ -6,6 +6,7 @@ import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
 import type { BaseModuleAspect } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   checkAspectApproval,
   computeAspectScopeHash,
@@ -44,7 +45,7 @@ describe('aspect-approvals', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/aspect-reconcile.test.ts

@@ -20,6 +20,7 @@ import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { type ModuleState, modules } from '../db/schema';
 import type { BaseModuleAspect } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   computeAspectScopeHash,
   recordAspectApproval,
@@ -159,7 +160,7 @@ describe('reconcileAspectsForSystems', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -310,7 +311,7 @@ describe('planAspectFanOut onlyHostnames', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -352,7 +353,7 @@ describe('verifyAspectCoverage', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/aspect-runner.test.ts

@@ -20,6 +20,7 @@ import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
 import type { BaseModuleAspect, ModuleManifest } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   computeAspectScopeHash,
   findAspectApproval,
@@ -109,7 +110,7 @@ describe('aspect-runner', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/audit/health.test.ts

@@ -1,14 +1,109 @@
 import { describe, expect, test } from 'bun:test';
 import type { HealthCheckResult } from '../health-runner';
 import { auditHealth } from './health';
+import { computeVerdict } from './types';
 
 describe('auditHealth', () => {
-  test('no findings when every module is healthy or has no checks', async () => {
+  test('a healthy module produces no finding; a module with no hook is unmeasured, never green', async () => {
     const results: HealthCheckResult[] = [
       { moduleId: 'caddy', status: 'healthy', checks: [] },
       { moduleId: 'iptables', status: 'no-checks', checks: [] },
     ];
-    expect(await auditHealth({ results })).toEqual([]);
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({
+      category: 'health',
+      severity: 'unmeasured',
+      code: 'health_unmeasured',
+      subject: 'iptables',
+      actionable: false,
+    });
+    expect(result[0].message).toContain('no health_check hook');
+    expect(computeVerdict(result)).toBe('UNKNOWN');
+  });
+
+  test('a module whose checks all report skip is unmeasured and names the skipped checks', async () => {
+    // The smoketest_bot_token incident, as an audit finding: the hook ran,
+    // every meaningful check refused to guess, and the fleet must not read
+    // READY off that.
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'smoketest',
+        status: 'no-checks',
+        checks: [
+          {
+            name: 'bot_token_valid',
+            status: 'skip',
+            message: 'smoketest_bot_token not yet provisioned',
+          },
+          {
+            name: 'webhook_reachable',
+            status: 'skip',
+            message: 'smoketest_bot_token not yet provisioned',
+          },
+        ],
+      },
+    ];
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({
+      severity: 'unmeasured',
+      code: 'health_unmeasured',
+      subject: 'smoketest',
+      actionable: true,
+      remediation: 'celilo module health smoketest --debug',
+    });
+    expect(result[0].message).toContain('all 2 health checks skipped');
+    expect(result[0].details).toContain('bot_token_valid');
+    expect(result[0].details).toContain('not yet provisioned');
+  });
+
+  test('skipped checks on an otherwise healthy module render unmeasured', async () => {
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'caddy',
+        status: 'healthy',
+        checks: [
+          { name: 'config_valid', status: 'pass', message: 'config parses' },
+          {
+            name: 'origin_reachable',
+            status: 'skip',
+            message: 'peer unreachable from control plane',
+          },
+        ],
+      },
+    ];
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({
+      severity: 'unmeasured',
+      code: 'health_checks_skipped',
+      subject: 'caddy',
+    });
+    expect(result[0].message).toContain('1 of 2');
+    expect(result[0].details).toContain('origin_reachable');
+    expect(computeVerdict(result)).toBe('UNKNOWN');
+  });
+
+  test('a degraded module with a skipped check yields both a drift and an unmeasured finding', async () => {
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'iptables',
+        status: 'degraded',
+        checks: [
+          {
+            name: 'persistence_drift',
+            status: 'warn',
+            message: '1 live rule(s) absent from rules.v4',
+          },
+          { name: 'ssh_access', status: 'skip', message: 'fw01 unreachable' },
+        ],
+      },
+    ];
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(2);
+    expect(result.map((f) => f.severity).sort()).toEqual(['drift', 'unmeasured']);
+    expect(computeVerdict(result)).toBe('UNKNOWN');
   });
 
   test('drift finding for unhealthy module', async () => {

package/src/services/audit/health.ts

@@ -5,6 +5,14 @@
  * informational (DRIFT, not BLOCKED) — the user might want to update
  * even if some module is currently unhealthy (an update could fix it).
  *
+ * Unmeasured is reported, never folded into green: a module with no
+ * health_check hook, and a module whose checks all reported skip, have
+ * contributed no measurement at all, and both render the fleet UNKNOWN
+ * rather than READY (celilo#1326). The same rule reaches one level down —
+ * a module that measured something but skipped a check gets an
+ * `unmeasured` finding beside its verdict, so a VERIFIED module whose
+ * meaningful probe was skipped is still visible.
+ *
  * The health-runner result is passed in directly so this file stays
  * pure for testing. The aggregator wires `runAllHealthChecks` to it.
  */
@@ -16,13 +24,67 @@ export interface HealthAuditDeps {
   results: HealthCheckResult[];
 }
 
+function skippedChecksFinding(r: HealthCheckResult, code: string, message: string): DriftFinding {
+  const details = r.checks
+    .filter((c) => c.status === 'skip')
+    .map((c) => `  • ${c.name}: ${c.message}`)
+    .join('\n');
+
+  return {
+    category: 'health',
+    severity: 'unmeasured',
+    code,
+    message,
+    details: details || undefined,
+    remediation: `celilo module health ${r.moduleId} --debug`,
+    actionable: true,
+    subject: r.moduleId,
+  };
+}
+
 export async function auditHealth(deps: HealthAuditDeps): Promise<DriftFinding[]> {
   const findings: DriftFinding[] = [];
 
   for (const r of deps.results) {
-    if (r.status === 'healthy' || r.status === 'no-checks') continue;
+    const skipped = r.checks.filter((c) => c.status === 'skip');
+    const measured = r.checks.filter((c) => c.status !== 'skip');
+
+    if (r.status === 'no-checks') {
+      // Either the module declares no health_check hook, or the hook ran
+      // and every check reported skip. Neither measured anything.
+      findings.push(
+        skipped.length > 0
+          ? skippedChecksFinding(
+              r,
+              'health_unmeasured',
+              `${r.moduleId}: all ${skipped.length} health checks skipped — nothing measured`,
+            )
+          : {
+              category: 'health',
+              severity: 'unmeasured',
+              code: 'health_unmeasured',
+              message: `${r.moduleId}: no health_check hook — never measured`,
+              remediation: `Add a health_check hook to the ${r.moduleId} module manifest`,
+              actionable: false,
+              subject: r.moduleId,
+            },
+      );
+      continue;
+    }
+
+    if (skipped.length > 0) {
+      findings.push(
+        skippedChecksFinding(
+          r,
+          'health_checks_skipped',
+          `${r.moduleId}: ${skipped.length} of ${r.checks.length} health checks skipped`,
+        ),
+      );
+    }
+
+    if (r.status === 'healthy') continue;
 
-    const failingChecks = r.checks
+    const failingChecks = measured
       .filter((c) => c.status === 'fail' || c.status === 'warn')
       .map((c) => `  • ${c.name}: ${c.message}`)
       .join('\n');

package/src/services/audit/index.test.ts

@@ -32,6 +32,7 @@ const emptyDeps = {
   moduleConfigs: { modules: [] },
   moduleIntegrity: { results: [] },
   detectWithoutConverge: { modules: [] },
+  jailExemptions: { exemptions: [] },
   health: { results: [] },
   backups: { modules: [] },
   abandonedOperations: { records: [] },
@@ -41,6 +42,7 @@ const emptyDeps = {
   secretsDecryptable: { results: [] },
   servicesReachable: { results: [] },
   machinesReachable: { results: [] },
+  diskSpace: { results: [] },
   transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
   trustedSources: { firewalls: [] },
   publicDns: { records: [], probe: unusedPublicDnsProbe },
@@ -88,6 +90,26 @@ describe('runAudit', () => {
     expect(report.findings.some((f) => f.category === 'schema')).toBe(true);
   });
 
+  test('disk_space is wired into the report (celilo#1336)', async () => {
+    const events: string[] = [];
+    const report = await runAudit(
+      {
+        ...emptyDeps,
+        diskSpace: {
+          results: [{ hostname: 'celilo-mgr', ipAddress: '10.0.0.5', usedPercent: 96 }],
+        },
+      },
+      (event) => events.push(`${event.category}:${event.phase}`),
+    );
+
+    // 96% is at the blocked threshold, so the wired category alone flips
+    // the fleet verdict — which is the point of wiring it.
+    expect(report.verdict).toBe('BLOCKED');
+    expect(report.findings.map((f) => f.category)).toContain('disk_space');
+    expect(events).toContain('disk_space:start');
+    expect(events).toContain('disk_space:end');
+  });
+
   test('aggregates findings across all categories', async () => {
     const report = await runAudit({
       ...emptyDeps,

package/src/services/audit/index.ts

@@ -22,7 +22,9 @@ import {
   type DetectWithoutConvergeAuditDeps,
   auditDetectWithoutConverge,
 } from './detect-without-converge';
+import { type DiskSpaceAuditDeps, auditDiskSpace } from './disk-space';
 import { type HealthAuditDeps, auditHealth } from './health';
+import { type JailExemptionsAuditDeps, auditJailExemptions } from './jail-exemptions';
 import { type MachinesReachableAuditDeps, auditMachinesReachable } from './machines-reachable';
 import { type ModuleConfigsAuditDeps, auditModuleConfigs } from './module-configs';
 import { type ModuleIntegrityAuditDeps, auditModuleIntegrity } from './module-integrity';
@@ -60,6 +62,7 @@ export interface AuditDeps {
   moduleConfigs: ModuleConfigsAuditDeps;
   moduleIntegrity: ModuleIntegrityAuditDeps;
   detectWithoutConverge: DetectWithoutConvergeAuditDeps;
+  jailExemptions: JailExemptionsAuditDeps;
   health: HealthAuditDeps;
   backups: BackupsAuditDeps;
   abandonedOperations: AbandonedOperationsAuditDeps;
@@ -70,6 +73,7 @@ export interface AuditDeps {
   servicesReachable: ServicesReachableAuditDeps;
   machinesReachable: MachinesReachableAuditDeps;
   publicDns: PublicDnsAuditDeps;
+  diskSpace: DiskSpaceAuditDeps;
   transportReads: TransportReadsAuditDeps;
   trustedSources: TrustedSourcesAuditDeps;
   /** Defaults to `Date.now()`-based ISO string. */
@@ -95,8 +99,8 @@ export async function runAudit(
 ): Promise<SystemAuditReport> {
   // Wrap each category's promise so the caller sees per-category
   // start/end events. `start` fires synchronously when this function
-  // schedules the category; in practice all 14 fire roughly at once
-  // since Promise.all spawns them in parallel.
+  // schedules the category; in practice all of them fire roughly at
+  // once since Promise.all spawns them in parallel.
   const wrap = (category: DriftCategory, p: Promise<DriftFinding[]>): Promise<DriftFinding[]> => {
     onProgress?.({ category, phase: 'start' });
     return p.then((findings) => {
@@ -119,6 +123,7 @@ export async function runAudit(
       'detect_without_converge',
       Promise.resolve(auditDetectWithoutConverge(deps.detectWithoutConverge)),
     ),
+    wrap('jail_exemptions', Promise.resolve(auditJailExemptions(deps.jailExemptions))),
     wrap('health', auditHealth(deps.health)),
     wrap('backups', auditBackups(deps.backups)),
     wrap(
@@ -132,6 +137,7 @@ export async function runAudit(
     wrap('services_reachable', auditServicesReachable(deps.servicesReachable)),
     wrap('machines_reachable', auditMachinesReachable(deps.machinesReachable)),
     wrap('public_dns', auditPublicDns(deps.publicDns)),
+    wrap('disk_space', Promise.resolve(auditDiskSpace(deps.diskSpace))),
     wrap('transport_reads', auditTransportReads(deps.transportReads)),
     wrap('trusted_sources', auditTrustedSources(deps.trustedSources)),
   ]);