@celilo/cli 2.2.0 → 2.3.0

package/src/hooks/capability-loader-firewall.test.ts

@@ -293,6 +293,8 @@ describe('Firewall Chain Building', () => {
       upsertModuleConfig(db, 'iptables', 'nat_ip', '192.168.0.253');
       upsertModuleConfig(db, 'iptables', 'default_route_zone', 'isp-transit');
       upsertModuleConfig(db, 'iptables', 'isolate_transit_network', true);
+      upsertModuleConfig(db, 'iptables', 'interface_baseline', 'eth0,eth2');
+      upsertModuleConfig(db, 'iptables', 'interface_zone_map', 'eth0=isp-transit,eth2=internal');
 
       const config = await loadedConfig();
       expect(config.defaultRouteZone).toBe('isp-transit');
@@ -300,6 +302,8 @@ describe('Firewall Chain Building', () => {
       // preserves the manifest-declared type, and the module tests
       // `state.isolateTransitNetwork && ...` — where 'false' would be truthy.
       expect(config.isolateTransitNetwork).toBe(true);
+      expect(config.interfaceBaseline).toEqual(['eth0', 'eth2']);
+      expect(config.interfaceZoneMap).toBe('eth0=isp-transit,eth2=internal');
     });
 
     test('single provider: the recorded interface_baseline is forwarded as a parsed list', async () => {
@@ -358,13 +362,15 @@ describe('Firewall Chain Building', () => {
       upsertModuleConfig(db, 'iptables', 'default_route_zone', 'internal');
       upsertModuleConfig(db, 'iptables', 'isolate_transit_network', true);
       upsertModuleConfig(db, 'iptables', 'interface_baseline', 'eth0,eth1');
+      upsertModuleConfig(db, 'iptables', 'interface_zone_map', 'eth0=isp-transit,eth1=internal');
 
       const config = await loadedConfig();
       expect(config.defaultRouteZone).toBe('internal');
       expect(config.isolateTransitNetwork).toBe(true);
-      // The downstream construction site already forwarded this; pinned so the
+      // The downstream construction site already forwarded these; pinned so the
       // two sites cannot drift apart again.
       expect(config.interfaceBaseline).toEqual(['eth0', 'eth1']);
+      expect(config.interfaceZoneMap).toBe('eth0=isp-transit,eth1=internal');
     });
 
     test('unset settings arrive undefined, not as a wrong default', async () => {
@@ -378,6 +384,8 @@ describe('Firewall Chain Building', () => {
       // would be silently overridden by a stale copy here.
       expect(config.defaultRouteZone).toBeUndefined();
       expect(config.isolateTransitNetwork).toBeUndefined();
+      expect(config.interfaceBaseline).toBeUndefined();
+      expect(config.interfaceZoneMap).toBeUndefined();
     });
   });
 });

package/src/hooks/capability-loader.test.ts

@@ -7,7 +7,9 @@ import { mkdirSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { HookLogger, RouteReadView } from '@celilo/capabilities';
+import { and, eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
+import { moduleConfigs } from '../db/schema';
 import { upsertModuleConfig } from '../services/module-config';
 import { cleanupTestDatabase, setupTestDatabase } from '../test-utils/database';
 import { loadCapabilityFunctions } from './capability-loader';
@@ -40,6 +42,36 @@ export default function createDhcpServer(context) {
 }
 `;
 
+/**
+ * A factory that WRITES through the hook-owned-state accessor, so the loader's
+ * store view is proven end to end: the method's write lands as a hook-owned
+ * row, and an undeclared name throws instead of landing. Branded
+ * (defineCapabilityFunction, the Phase 8 pattern) — the branded path is the
+ * one the loader hands the store views to. The temp dir the fixture is
+ * dropped into has no node_modules link, so the import uses the workspace
+ * package by absolute path, the same trick capability-loader-firewall uses.
+ */
+const TEST_STORE_WRITING_DHCP_MODULE = `
+import { defineCapabilityFunction } from '${join(__dirname, '../../../..', 'packages/capabilities/src/index.ts')}';
+
+export default defineCapabilityFunction({
+  capability: 'dhcp_server',
+  handler: (context) => ({
+    async setDnsServers() {},
+    async getDnsServers() { return [context.config.marker]; },
+    async setDomainName() {},
+    async getDomainName() { return context.config.marker; },
+    async claimIp() {
+      await context.config.set('public_ip', '203.0.113.7');
+      return 'claimed';
+    },
+    async claimUndeclared() {
+      await context.config.set('no_such_key', 'x');
+    },
+  }),
+});
+`;
+
 describe('Capability Loader', () => {
   let db: DbClient;
   let tempDir: string;
@@ -134,6 +166,52 @@ describe('Capability Loader', () => {
     expect(await dhcp.getDomainName()).toBe('internal-dhcp');
   });
 
+  test('a provider factory writes hook-owned config through the injected store view', async () => {
+    // The store view must do more than carry the plain record a factory reads.
+    // A method writing `context.config.set` lands a hook-owned row (validated
+    // against the PROVIDER's manifest, source column 'hook'), and an
+    // undeclared name throws instead of writing a phantom row.
+    const modulePath = join(tempDir, 'storewriting-vpn');
+    const scriptsDir = join(modulePath, 'scripts');
+    mkdirSync(scriptsDir, { recursive: true });
+    writeFileSync(join(scriptsDir, 'dhcp-server-functions.ts'), TEST_STORE_WRITING_DHCP_MODULE);
+    const manifest = JSON.stringify({
+      variables: { owns: [{ name: 'public_ip', type: 'string', source: 'hook' }] },
+    });
+    db.$client.run(
+      `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('storewriting-vpn', 'StoreWritingVpn', '1.0.0', '${modulePath}', '${manifest.replace(/'/g, "''")}')`,
+    );
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data, registered_at) VALUES ('storewriting-vpn', 'dhcp_server', '1.0.0', '{}', unixepoch())`,
+    );
+    upsertModuleConfig(db, 'storewriting-vpn', 'marker', 'storewriting-vpn');
+
+    const result = await loadCapabilityFunctions('store-consumer', db, noopLogger);
+    const dhcp = result.dhcp_server as {
+      claimIp(): Promise<string>;
+      claimUndeclared(): Promise<void>;
+    };
+
+    expect(await dhcp.claimIp()).toBe('claimed');
+    const row = db
+      .select()
+      .from(moduleConfigs)
+      .where(
+        and(eq(moduleConfigs.moduleId, 'storewriting-vpn'), eq(moduleConfigs.key, 'public_ip')),
+      )
+      .get();
+    expect(row?.valueJson).toBe('"203.0.113.7"');
+    expect(row?.source).toBe('hook');
+
+    // The store round-trips text, so the map read the NEXT load takes sees the
+    // same string the write sent.
+    const reloaded = await loadCapabilityFunctions('store-consumer', db, noopLogger);
+    const dhcpAgain = reloaded.dhcp_server as { getDnsServers(): Promise<string[]> };
+    expect(await dhcpAgain.getDnsServers()).toEqual(['storewriting-vpn']);
+
+    await expect(dhcp.claimUndeclared()).rejects.toThrow(/no declared hook-owned config/);
+  });
+
   test('falls back to a zone-agnostic provider when no explicit zone provider exists', async () => {
     const modulePath = join(tempDir, 'upstream-dhcp');
     const scriptsDir = join(modulePath, 'scripts');

package/src/hooks/capability-loader.ts

@@ -60,6 +60,9 @@ import {
 import { resolveComputedFields } from '../variables/computed/evaluate';
 import { containsComputedMarker } from '../variables/computed/marker';
 import { buildProviderLookup } from '../variables/computed/provider-lookup';
+import type { BufferedStoreOp } from './hook-protocol';
+import { type HookStores, createHookStores } from './hook-store';
+import { type StoreTransport, buildStoreView } from './hook-store-proxy';
 import { loadHookConfigMap } from './load-hook-config';
 
 /**
@@ -260,6 +263,13 @@ export async function loadCapabilityFunctions(
   // This allows modules to optionally consume capabilities at runtime
   // (e.g., caddy uses dns_registrar if available, falls back if not).
   const verbose = process.env.CELILO_DEBUG === '1';
+
+  // The broker-side stores, resolved from the PROVIDER on the first store
+  // call this consumer load makes, and shared across every capability it
+  // builds. Nothing pays for the manifest read until a factory actually
+  // writes or reads through the accessor. See the storeTransport construction
+  // at the factory-invocation site below.
+  let storesPromise: Promise<HookStores> | undefined;
   const debugLog = verbose
     ? (msg: string) => process.stderr.write(`[capability-loader] ${msg}\n`)
     : (_msg: string) => {};
@@ -392,10 +402,35 @@ export async function loadCapabilityFunctions(
       // Phase 8 path: branded defineCapabilityFunction factory. Call with
       // the canonical { config, secrets, logger } context. The factory
       // applies wrapWithLogging internally so we don't double-wrap.
+      //
+      // Both maps arrive as the hook-owned-state view (buildStoreView): the
+      // plain record the factory reads, PLUS get/set/delete/transaction that
+      // reach the broker-side stores (createHookStores), validated against
+      // the PROVIDER module's own manifest. The transport is in-process — a
+      // capability factory runs here in celilo's process, not in the jail —
+      // but the view is the same object a jailed hook sees, so a provider's
+      // self-config write goes through the same validated door regardless of
+      // which process it runs in (hook-owned-state tasks 0.7 and 5.5 shape).
       if (isCompiledCapabilityFactory(exported)) {
+        const storeTransport: StoreTransport = (store, method, args) => {
+          storesPromise ??= createHookStores(db, capability.moduleId);
+          return storesPromise.then((backend: HookStores): Promise<unknown> => {
+            const one = backend[store];
+            switch (method) {
+              case 'transaction':
+                return one.applyTransaction(args[0] as readonly BufferedStoreOp[]);
+              case 'set':
+                return one.set(args[0] as string, args[1] as string);
+              case 'delete':
+                return one.delete(args[0] as string);
+              default:
+                return one.get(args[0] as string);
+            }
+          });
+        };
         const capabilityInterface = exported({
-          config: providerConfig,
-          secrets: providerSecrets,
+          config: buildStoreView('config', providerConfig, storeTransport),
+          secrets: buildStoreView('secrets', providerSecrets, storeTransport),
           systems: getModuleSystems(capability.moduleId, db),
           logger,
           // WHO IS CALLING, so a provider can scope per-consumer state to them.
@@ -803,6 +838,10 @@ function buildCapabilityInterface(
           // baseline was recorded but never read back, so every converge stayed
           // in onboarding mode and refused instead of isolating (ce-qzxm).
           interfaceBaseline: parseInterfaceBaseline(config.interface_baseline),
+          // The learned zone-to-leg map, same round trip and the same site that
+          // dropped it. The module writes it at the end of a clean converge and
+          // reads it back to keep a managed /32 on its declared zone leg.
+          interfaceZoneMap: config.interface_zone_map as string | undefined,
           // Operator settings, forwarded verbatim. `parseStoredConfigValue`
           // preserves each manifest-declared type, so the boolean arrives as a
           // boolean and needs no coercion here.
@@ -1326,6 +1365,10 @@ async function buildFirewallChain(
         // Absent means the box has never converged cleanly, so an interface
         // celilo cannot attribute refuses rather than being disabled.
         interfaceBaseline: parseInterfaceBaseline(provConfig.interface_baseline),
+        // The managed-address resolver consults this before it reads the live
+        // address table. Dropping it makes the fallback select the management
+        // (SSH) interface, after which the bad alias can corrupt the learned map.
+        interfaceZoneMap: provConfig.interface_zone_map as string | undefined,
         // Which declared zone carries this firewall's default route, and
         // whether fronted zones may initiate into it. Both are operator
         // settings and both are read HERE or nowhere: the module declares them

package/src/hooks/executor.test.ts

@@ -1,8 +1,12 @@
-import { describe, expect, test } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { existsSync, mkdtempSync, readdirSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { closeDb, getDb } from '../db/client';
+import { runMigrations } from '../db/migrate';
+import { modules, systemConfig } from '../db/schema';
 import type { ContractHookSignature } from '../manifest/contracts';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   checkRequiredCapabilities,
   declaredPathInputs,
@@ -329,6 +333,162 @@ describe('Hook Executor', () => {
     });
   });
 
+  describe('the executor resolves the jail policy through stored config (hook-jail-config-surface slice 4)', () => {
+    // Each test gets its own migrated scratch database and its own jail-mode
+    // store, so a planted row here never leaks into another test (or another
+    // host). With no module tree in `options.jail`, `planJailedSpawn` treats a
+    // `required` policy as a hard failure on EVERY host — which makes the
+    // resolution outcome observable without depending on what jail backend a
+    // given machine happens to have.
+    let dir: string;
+    const saved: Record<string, string | undefined> = {};
+
+    const plantPolicyRow = (value: string): void => {
+      getDb().insert(systemConfig).values({ key: 'hooks.jail_policy', value }).run();
+    };
+
+    // The per-module row is keyed by module id, but the executor is handed
+    // the module's tree — the join the production read makes (task 1.4). The
+    // path is fake: nothing in this describe touches the filesystem beyond
+    // the scratch DB, and `existsSync(scriptPath)` fails before any policy
+    // read when it is not fake.
+    const moduleTree = (): string => join(dir, 'modules', 'fixture-module');
+    const plantModulePolicyRow = (moduleId: string, policy: string): void => {
+      getDb()
+        .insert(modules)
+        .values({
+          id: moduleId,
+          name: moduleId,
+          version: '1.0.0',
+          manifestData: {},
+          sourcePath: moduleTree(),
+        })
+        .run();
+      // Raw SQL, not the drizzle table, on purpose: the drizzle type only
+      // accepts 'auto' | 'off' | 'required', and the bad-value test models a
+      // row that arrived past every typed writer — a restore or a hand edit,
+      // the untrusted path the resolver throws on (Rule 3.7).
+      getDb()
+        .$client.prepare('INSERT INTO module_jail_policies (module_id, policy) VALUES (?, ?)')
+        .run(moduleId, policy);
+    };
+
+    const runVoidHook = (moduleTree?: string): Promise<Record<string, unknown>> => {
+      const { logger } = createCapturingLogger();
+      return executeHookScript(
+        join(FIXTURES_DIR, 'void-hook.ts'),
+        {
+          config: configStore(),
+          secrets: secretStore(),
+          systems: [],
+          logger,
+          debug: false,
+          screenshotDir: '/tmp',
+          stateDir: '/tmp',
+          capabilities: {},
+        },
+        {
+          // Absent means the system-config-only path: exactly what the tests
+          // above exercise. Present means the executor reads the module's row
+          // and resolves through it.
+          jail: moduleTree === undefined ? undefined : { modulePath: moduleTree, pathInputs: [] },
+        },
+      );
+    };
+
+    beforeEach(async () => {
+      for (const key of ['CELILO_HOOK_JAIL', 'CELILO_HOOK_JAIL_MODE_PATH']) {
+        saved[key] = process.env[key];
+      }
+      dir = mkdtempSync(join(tmpdir(), 'celilo-executor-policy-'));
+      process.env.CELILO_DB_PATH = join(dir, 'celilo.db');
+      process.env.CELILO_HOOK_JAIL_MODE_PATH = join(dir, 'mode.json');
+      delete process.env.CELILO_HOOK_JAIL;
+      await runMigrations(process.env.CELILO_DB_PATH);
+    });
+
+    afterEach(() => {
+      closeDb();
+      // The db path resets to the scratch path rather than restoring the
+      // saved value: that value may be another suite's temp database, or
+      // unset — which sends the next var-less reader to the operator's real
+      // celilo.db (celilo#1315).
+      resetTestDbPath();
+      for (const key of ['CELILO_HOOK_JAIL', 'CELILO_HOOK_JAIL_MODE_PATH']) {
+        if (saved[key] === undefined) delete process.env[key];
+        else process.env[key] = saved[key];
+      }
+      rmSync(dir, { recursive: true, force: true });
+    });
+
+    test('a stored row decides when the env is silent', async () => {
+      plantPolicyRow('required');
+      await expect(runVoidHook()).rejects.toThrow(/no hook jail is available/);
+    });
+
+    test('env wins over a conflicting stored row', async () => {
+      process.env.CELILO_HOOK_JAIL = 'off';
+      plantPolicyRow('required');
+      await expect(runVoidHook()).resolves.toBeDefined();
+    });
+
+    test('env=required still reaches the planner when the row says off', async () => {
+      process.env.CELILO_HOOK_JAIL = 'required';
+      plantPolicyRow('off');
+      await expect(runVoidHook()).rejects.toThrow(/no hook jail is available/);
+    });
+
+    test('a bad stored row fails the hook instead of running it unjailed', async () => {
+      plantPolicyRow('alwayssafe');
+      await expect(runVoidHook()).rejects.toThrow(/hooks\.jail_policy='alwayssafe'/);
+    });
+
+    test('nothing set resolves to the default, off (peba’s ruling on ce-rez7)', async () => {
+      // Migrated DB with no row: the stored-row read returns undefined and the
+      // resolver falls through to the default, which jails nobody.
+      await expect(runVoidHook()).resolves.toBeDefined();
+    });
+
+    test('the module row beats system config (per-module-jail-policy task 1.4)', async () => {
+      // System says jail hard; the module is exempted. The exempted module's
+      // hook runs unjailed while every other module of this host would fail —
+      // the spec's own "A module runs unjailed while the fleet is jailed".
+      plantPolicyRow('required');
+      plantModulePolicyRow('exempted-module', 'off');
+      await expect(runVoidHook(moduleTree())).resolves.toBeDefined();
+      // And the same host still jails a module with no row: `required` with
+      // no jail backend is a hard failure, so the system row stays in force.
+      // Which surface the failure takes is host-determined, and both prove
+      // the hook did not run: on a host with a jail backend it dies at mount
+      // planning (the fake module tree does not exist, "cannot be built");
+      // on a host with no backend it dies at backend detection ("no hook
+      // jail is available"). The point under test is policy precedence, not
+      // the surface. (celilo#1342: the CI runner has no bubblewrap, so the
+      // mount-planning surface is unreachable there.)
+      await expect(runVoidHook(join(dir, 'modules', 'other-module'))).rejects.toThrow(
+        /cannot be built|no hook jail is available/,
+      );
+    });
+
+    test('a bad per-module row fails the hook instead of running it unjailed', async () => {
+      plantModulePolicyRow('broken-module', 'alwayssafe');
+      await expect(runVoidHook(moduleTree())).rejects.toThrow(/module's jail policy='alwayssafe'/);
+    });
+
+    test('env beats a conflicting module row', async () => {
+      plantModulePolicyRow('exempted-module', 'off');
+      process.env.CELILO_HOOK_JAIL = 'required';
+      // The point is that the env overrode the module's `off`, so the hook
+      // is jailed and fails, not exempted and successful. Which failure it
+      // hits is host-determined: mount planning (the fake module tree does
+      // not exist) on a host with a jail backend, backend detection on a
+      // host without one. Either proves the hook did not run.
+      await expect(runVoidHook(moduleTree())).rejects.toThrow(
+        /cannot be built|no hook jail is available/,
+      );
+    });
+  });
+
   describe('resolveHookTimeouts', () => {
     test('no declaration: 60s total, 30s idle heuristic', () => {
       expect(resolveHookTimeouts(undefined, false)).toEqual({

package/src/hooks/executor.ts

@@ -51,6 +51,8 @@ import {
   moduleArtifactDir,
   moduleStateDir,
 } from '@celilo/capabilities';
+import { getDbPath } from '../config/paths';
+import { getDb } from '../db/client';
 import {
   type ContractHookSignature,
   contractHookSignature,
@@ -73,10 +75,10 @@ import {
 import {
   type JailPlan,
   detectJailBackend,
-  jailPolicy,
   planJailedSpawn,
   realpathRequest,
   recordJailMode,
+  resolveJailPolicy,
   runtimeModulePathsFor,
 } from './jail';
 import {
@@ -171,32 +173,47 @@ const FORWARDED_ENV = [
 ] as const;
 
 /**
- * The PATH a hook child gets: the CLI's own directory ahead of the inherited
- * one, so the child can exec the SAME `celilo` the parent runs.
+ * The directory holding the `celilo` bin of the running CLI package, resolved
+ * from this file's own location: src/hooks -> the package's bin/. Every
+ * distribution layout lands there. The .deb wrapper execs
+ * `$CELILO_HOME/node_modules/@celilo/cli/bin/celilo` directly (packaging/celilo/
+ * scripts/wrapper.sh), and a bun global install symlinks ~/.bun/bin/celilo into
+ * that same bin directory, whose script self-locates its package dir.
+ */
+export const CLI_BIN_DIR = join(import.meta.dir, '..', '..', 'bin');
+
+/**
+ * The PATH a hook child gets: the CLI package's own bin directory, then the
+ * runtime's, ahead of the inherited one — so the child can exec the SAME
+ * `celilo` the parent runs, and that celilo can still find its interpreter.
  *
- * A bun global install lands the `celilo` bin beside the bun binary itself
- * (install.sh sets `BUN_INSTALL/bin`, default `~/.bun/bin`), so
- * `dirname(process.execPath)` is that directory. The inherited PATH carries no
- * such guarantee: the e2e management image runs the CLI only through an
- * absolute-path wrapper at /usr/local/bin because its ENV has no /root/.bun/bin,
- * and every hook that spawned `celilo` by name — caddy-internal's
- * `on_consumer_removed` route withdrawal — died with "Executable not found in
- * $PATH", leaving the stale routes it was withdrawing in place (celilo#1300).
- * A real fleet hits the same class whenever the CLI is launched by a systemd
- * unit or an absolute path with a minimal PATH.
+ * `dirname(process.execPath)` alone is NOT the CLI's directory under the fleet
+ * layout: the .deb runs the CLI through a wrapper at /usr/local/bin/celilo that
+ * execs bun on `node_modules/@celilo/cli/src/cli/index.ts`, so the directory
+ * beside the bun binary holds only bun (measured on the fleet, 2026-09-07,
+ * ce-y0fd). Hooks then found `celilo` only because the systemd unit happened to
+ * inherit /usr/local/bin on its PATH — the same accident that broke every hook
+ * spawning `celilo` by name in the e2e management image (celilo#1300).
+ * CLI_BIN_DIR resolves where the bin actually lives, whatever layout launched
+ * the parent, and comes FIRST so `celilo` is the package's own bin rather than
+ * an operator's wrapper. The runtime directory stays second because bin/celilo
+ * needs `command -v bun` (it is bash, not a shebanged TS file).
  *
- * Already-present wins: an operator who has the directory on PATH sees an
- * unchanged value. An absent inherited PATH still yields the CLI directory,
- * so a hook can always reach `celilo` even from a stripped parent.
+ * Already-present wins: an operator who has a directory on PATH sees an
+ * unchanged value. An absent inherited PATH still yields both directories, so
+ * a hook can always reach `celilo` even from a stripped parent; bash resolves
+ * through the loader's default search.
  *
  * Exported for the allow-list tests (hook-trespass.test.ts), which pin this
  * contract the same way they pin the rest of the child environment.
  */
 export function childPath(inherited: string | undefined): string {
-  const cliDir = dirname(process.execPath);
-  if (inherited === undefined) return cliDir;
-  if (inherited.split(':').includes(cliDir)) return inherited;
-  return `${cliDir}:${inherited}`;
+  const base = inherited === undefined ? [] : inherited.split(':');
+  const prepended: string[] = [];
+  for (const dir of [CLI_BIN_DIR, dirname(process.execPath)]) {
+    if (!base.includes(dir) && !prepended.includes(dir)) prepended.push(dir);
+  }
+  return [...prepended, ...base].join(':');
 }
 
 /** The shim celilo spawns. Resolved from here so an npm install finds it too. */
@@ -330,6 +347,51 @@ export interface ExecuteHookOptions {
   hookStores?: HookStoresProvider;
 }
 
+/**
+ * The stored `hooks.jail_policy` value, or undefined when there is no row or
+ * no celilo DB to ask (a dev box). Same row-read pattern as
+ * `ipam/auto-allocator.ts` and the executor's fellow consumer
+ * `cli/commands/system-doctor.ts`; the drizzle table is `systemConfig` in
+ * `db/schema.ts`.
+ *
+ * Unlike `remoteAccess`, this read happens here rather than through a
+ * caller-built input because D2 names the executor itself as one of the two
+ * consumers that fetch the stored row and hand it to the pure resolver.
+ */
+function readStoredJailPolicy(): string | undefined {
+  if (!existsSync(getDbPath())) return undefined;
+  const row = getDb()
+    .$client.prepare('SELECT value FROM system_config WHERE key = ?')
+    .get('hooks.jail_policy') as { value: string } | undefined;
+  return row?.value;
+}
+
+/**
+ * The module's own recorded jail policy, or undefined when there is no row
+ * (per-module-jail-policy task 1.4). The system-key read stays its own
+ * function because the two answers come from different tables.
+ *
+ * The executor is handed the module's tree, `options.jail.modulePath`, which
+ * is `mod.sourcePath` — not its id, which the caller holds. The row is found
+ * the way the jail inputs identify the module: by joining `modules` on
+ * `source_path`, the exact string the caller passed, so no second identity
+ * is invented and none of invokeHook's callers need plumbing. Absent jail
+ * inputs (an invocation that cannot be jailed) also means no module identity
+ * and no module row to read.
+ *
+ * A bad stored value is not coerced here — `resolveJailPolicy` throws on it,
+ * the same rule the system key follows (peba's ruling on ce-8832).
+ */
+function readStoredModuleJailPolicy(modulePath: string | undefined): string | undefined {
+  if (!modulePath || !existsSync(getDbPath())) return undefined;
+  const row = getDb()
+    .$client.prepare(
+      'SELECT p.policy AS policy FROM module_jail_policies p JOIN modules m ON m.id = p.module_id WHERE m.source_path = ?',
+    )
+    .get(modulePath) as { policy: string } | undefined;
+  return row?.policy;
+}
+
 /**
  * Execute a hook script
  *
@@ -394,7 +456,11 @@ export async function executeHookScript(
       [process.execPath, HOOK_RUNNER_SPAWN_PATH],
       mountSet,
       detectJailBackend(),
-      jailPolicy(),
+      resolveJailPolicy(
+        process.env.CELILO_HOOK_JAIL,
+        readStoredModuleJailPolicy(options.jail?.modulePath),
+        readStoredJailPolicy(),
+      ).policy,
     );
     reportJail(jail, logger);
     // Only a real module hook says anything about whether this HOST jails. An

package/src/hooks/hook-jail-unreachability.test.ts

@@ -33,7 +33,7 @@ import { join, resolve } from 'node:path';
 /** Uniquely named so it never collides with a real key on a jailed dev box. */
 const PLANTED_KEY_NAME = 'id_celilo_jail_probe';
 import { executeHookScript } from './executor';
-import { detectJailBackend, jailPolicy } from './jail';
+import { detectJailBackend } from './jail';
 import { createCapturingLogger } from './logger';
 import { configStore, secretStore } from './test-fixtures/store-backed';
 import type { HookContext } from './types';
@@ -46,12 +46,15 @@ interface Probe {
 }
 
 const availability = detectJailBackend();
-// A host with a backend is not a host that JAILS: `CELILO_HOOK_JAIL=off` is an
-// operator switch and the executor honours it, so without this the suite runs
-// its assertions against a deliberately unjailed hook and reports the jail
-// broken. Only reachable since macOS gained a backend (task 4.8) — before that
-// every Mac skipped for want of one and the hole never showed.
-const jailed = availability.backend !== 'none' && jailPolicy() !== 'off';
+// Gated on the BACKEND alone, not on `jailPolicy()`. The ambient policy is an
+// operator switch (`CELILO_HOOK_JAIL=off` is the default), and reading it here
+// made the suite skip on every host with the default — measuring nothing, on
+// any platform, forever. The suite does not need the operator's blessing: it
+// sets the policy to `required` inside `runProbe()` and restores it after, so
+// the jail under test is this suite's own act, deterministic wherever a
+// backend exists. (celilo#1359: since the default became `off`, all three
+// jailed suites skipped everywhere.)
+const jailed = availability.backend !== 'none';
 
 interface Rig {
   outputs: {
@@ -208,18 +211,14 @@ describe.skipIf(!jailed)(`the jail is real (backend: ${availability.backend})`,
 describe.skipIf(jailed)('this run is not jailed', () => {
   test('says so, rather than reporting a pass it did not earn', () => {
     // Not an assertion about the product. It is the line that stops a green
-    // run on an unjailed host reading as "the jail was proven".
-    const why =
-      availability.backend === 'none'
-        ? (availability.reason ?? 'no backend')
-        : `CELILO_HOOK_JAIL=${process.env.CELILO_HOOK_JAIL}, so the operator switched the ${availability.backend} jail off here`;
+    // run on a backend-less host reading as "the jail was proven". The only
+    // way here is `backend === 'none'` — an operator who set the policy off
+    // does NOT land in this companion, because the live suite above now pins
+    // the policy itself and runs anyway (celilo#1359).
+    const why = availability.reason ?? 'no backend';
     console.log(
-      `\nhook jail: SKIPPED the live suite — ${why}\nThese properties are proven wherever a backend is available and enabled. The hermetic half runs everywhere (jail.test.ts).`,
+      `\nhook jail: SKIPPED the live suite — ${why}\nThese properties are proven wherever a jail backend is available. The hermetic half runs everywhere (jail.test.ts).`,
     );
-    // Both reasons are legitimate and they are different facts, so assert the
-    // disjunction rather than one of them. Asserting `backend === 'none'` alone
-    // went red the day macOS got a backend AND the operator turned it off — a
-    // combination that is not a defect in anything.
-    expect(availability.backend === 'none' || jailPolicy() === 'off').toBe(true);
+    expect(availability.backend === 'none').toBe(true);
   });
 });

package/src/hooks/hook-store.test.ts

@@ -14,6 +14,7 @@ import { join } from 'node:path';
 import { type DbClient, closeDb, createDbClient } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { moduleConfigs, modules, secrets } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { createHookStores } from './hook-store';
 
 describe('hook stores', () => {
@@ -54,6 +55,11 @@ describe('hook stores', () => {
 
   afterEach(() => {
     closeDb();
+    // The variable pointed at this suite's (now removed) temp database;
+    // leaving it set sends the next var-less reader at a dangling path.
+    // Reset to the scratch path so no later reader reaches the operator's
+    // real celilo.db (celilo#1315).
+    resetTestDbPath();
     rmSync(testDir, { recursive: true, force: true });
     delete process.env.CELILO_MASTER_KEY_PATH;
   });