@celilo/cli 2.2.1 → 2.3.0

package/src/services/audit/health.test.ts

@@ -1,14 +1,109 @@
 import { describe, expect, test } from 'bun:test';
 import type { HealthCheckResult } from '../health-runner';
 import { auditHealth } from './health';
+import { computeVerdict } from './types';
 
 describe('auditHealth', () => {
-  test('no findings when every module is healthy or has no checks', async () => {
+  test('a healthy module produces no finding; a module with no hook is unmeasured, never green', async () => {
     const results: HealthCheckResult[] = [
       { moduleId: 'caddy', status: 'healthy', checks: [] },
       { moduleId: 'iptables', status: 'no-checks', checks: [] },
     ];
-    expect(await auditHealth({ results })).toEqual([]);
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({
+      category: 'health',
+      severity: 'unmeasured',
+      code: 'health_unmeasured',
+      subject: 'iptables',
+      actionable: false,
+    });
+    expect(result[0].message).toContain('no health_check hook');
+    expect(computeVerdict(result)).toBe('UNKNOWN');
+  });
+
+  test('a module whose checks all report skip is unmeasured and names the skipped checks', async () => {
+    // The smoketest_bot_token incident, as an audit finding: the hook ran,
+    // every meaningful check refused to guess, and the fleet must not read
+    // READY off that.
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'smoketest',
+        status: 'no-checks',
+        checks: [
+          {
+            name: 'bot_token_valid',
+            status: 'skip',
+            message: 'smoketest_bot_token not yet provisioned',
+          },
+          {
+            name: 'webhook_reachable',
+            status: 'skip',
+            message: 'smoketest_bot_token not yet provisioned',
+          },
+        ],
+      },
+    ];
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({
+      severity: 'unmeasured',
+      code: 'health_unmeasured',
+      subject: 'smoketest',
+      actionable: true,
+      remediation: 'celilo module health smoketest --debug',
+    });
+    expect(result[0].message).toContain('all 2 health checks skipped');
+    expect(result[0].details).toContain('bot_token_valid');
+    expect(result[0].details).toContain('not yet provisioned');
+  });
+
+  test('skipped checks on an otherwise healthy module render unmeasured', async () => {
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'caddy',
+        status: 'healthy',
+        checks: [
+          { name: 'config_valid', status: 'pass', message: 'config parses' },
+          {
+            name: 'origin_reachable',
+            status: 'skip',
+            message: 'peer unreachable from control plane',
+          },
+        ],
+      },
+    ];
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({
+      severity: 'unmeasured',
+      code: 'health_checks_skipped',
+      subject: 'caddy',
+    });
+    expect(result[0].message).toContain('1 of 2');
+    expect(result[0].details).toContain('origin_reachable');
+    expect(computeVerdict(result)).toBe('UNKNOWN');
+  });
+
+  test('a degraded module with a skipped check yields both a drift and an unmeasured finding', async () => {
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'iptables',
+        status: 'degraded',
+        checks: [
+          {
+            name: 'persistence_drift',
+            status: 'warn',
+            message: '1 live rule(s) absent from rules.v4',
+          },
+          { name: 'ssh_access', status: 'skip', message: 'fw01 unreachable' },
+        ],
+      },
+    ];
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(2);
+    expect(result.map((f) => f.severity).sort()).toEqual(['drift', 'unmeasured']);
+    expect(computeVerdict(result)).toBe('UNKNOWN');
   });
 
   test('drift finding for unhealthy module', async () => {

package/src/services/audit/health.ts

@@ -5,6 +5,14 @@
  * informational (DRIFT, not BLOCKED) — the user might want to update
  * even if some module is currently unhealthy (an update could fix it).
  *
+ * Unmeasured is reported, never folded into green: a module with no
+ * health_check hook, and a module whose checks all reported skip, have
+ * contributed no measurement at all, and both render the fleet UNKNOWN
+ * rather than READY (celilo#1326). The same rule reaches one level down —
+ * a module that measured something but skipped a check gets an
+ * `unmeasured` finding beside its verdict, so a VERIFIED module whose
+ * meaningful probe was skipped is still visible.
+ *
  * The health-runner result is passed in directly so this file stays
  * pure for testing. The aggregator wires `runAllHealthChecks` to it.
  */
@@ -16,13 +24,67 @@ export interface HealthAuditDeps {
   results: HealthCheckResult[];
 }
 
+function skippedChecksFinding(r: HealthCheckResult, code: string, message: string): DriftFinding {
+  const details = r.checks
+    .filter((c) => c.status === 'skip')
+    .map((c) => `  • ${c.name}: ${c.message}`)
+    .join('\n');
+
+  return {
+    category: 'health',
+    severity: 'unmeasured',
+    code,
+    message,
+    details: details || undefined,
+    remediation: `celilo module health ${r.moduleId} --debug`,
+    actionable: true,
+    subject: r.moduleId,
+  };
+}
+
 export async function auditHealth(deps: HealthAuditDeps): Promise<DriftFinding[]> {
   const findings: DriftFinding[] = [];
 
   for (const r of deps.results) {
-    if (r.status === 'healthy' || r.status === 'no-checks') continue;
+    const skipped = r.checks.filter((c) => c.status === 'skip');
+    const measured = r.checks.filter((c) => c.status !== 'skip');
+
+    if (r.status === 'no-checks') {
+      // Either the module declares no health_check hook, or the hook ran
+      // and every check reported skip. Neither measured anything.
+      findings.push(
+        skipped.length > 0
+          ? skippedChecksFinding(
+              r,
+              'health_unmeasured',
+              `${r.moduleId}: all ${skipped.length} health checks skipped — nothing measured`,
+            )
+          : {
+              category: 'health',
+              severity: 'unmeasured',
+              code: 'health_unmeasured',
+              message: `${r.moduleId}: no health_check hook — never measured`,
+              remediation: `Add a health_check hook to the ${r.moduleId} module manifest`,
+              actionable: false,
+              subject: r.moduleId,
+            },
+      );
+      continue;
+    }
+
+    if (skipped.length > 0) {
+      findings.push(
+        skippedChecksFinding(
+          r,
+          'health_checks_skipped',
+          `${r.moduleId}: ${skipped.length} of ${r.checks.length} health checks skipped`,
+        ),
+      );
+    }
+
+    if (r.status === 'healthy') continue;
 
-    const failingChecks = r.checks
+    const failingChecks = measured
       .filter((c) => c.status === 'fail' || c.status === 'warn')
       .map((c) => `  • ${c.name}: ${c.message}`)
       .join('\n');

package/src/services/audit/index.test.ts

@@ -32,6 +32,7 @@ const emptyDeps = {
   moduleConfigs: { modules: [] },
   moduleIntegrity: { results: [] },
   detectWithoutConverge: { modules: [] },
+  jailExemptions: { exemptions: [] },
   health: { results: [] },
   backups: { modules: [] },
   abandonedOperations: { records: [] },
@@ -41,6 +42,7 @@ const emptyDeps = {
   secretsDecryptable: { results: [] },
   servicesReachable: { results: [] },
   machinesReachable: { results: [] },
+  diskSpace: { results: [] },
   transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
   trustedSources: { firewalls: [] },
   publicDns: { records: [], probe: unusedPublicDnsProbe },
@@ -88,6 +90,26 @@ describe('runAudit', () => {
     expect(report.findings.some((f) => f.category === 'schema')).toBe(true);
   });
 
+  test('disk_space is wired into the report (celilo#1336)', async () => {
+    const events: string[] = [];
+    const report = await runAudit(
+      {
+        ...emptyDeps,
+        diskSpace: {
+          results: [{ hostname: 'celilo-mgr', ipAddress: '10.0.0.5', usedPercent: 96 }],
+        },
+      },
+      (event) => events.push(`${event.category}:${event.phase}`),
+    );
+
+    // 96% is at the blocked threshold, so the wired category alone flips
+    // the fleet verdict — which is the point of wiring it.
+    expect(report.verdict).toBe('BLOCKED');
+    expect(report.findings.map((f) => f.category)).toContain('disk_space');
+    expect(events).toContain('disk_space:start');
+    expect(events).toContain('disk_space:end');
+  });
+
   test('aggregates findings across all categories', async () => {
     const report = await runAudit({
       ...emptyDeps,

package/src/services/audit/index.ts

@@ -22,7 +22,9 @@ import {
   type DetectWithoutConvergeAuditDeps,
   auditDetectWithoutConverge,
 } from './detect-without-converge';
+import { type DiskSpaceAuditDeps, auditDiskSpace } from './disk-space';
 import { type HealthAuditDeps, auditHealth } from './health';
+import { type JailExemptionsAuditDeps, auditJailExemptions } from './jail-exemptions';
 import { type MachinesReachableAuditDeps, auditMachinesReachable } from './machines-reachable';
 import { type ModuleConfigsAuditDeps, auditModuleConfigs } from './module-configs';
 import { type ModuleIntegrityAuditDeps, auditModuleIntegrity } from './module-integrity';
@@ -60,6 +62,7 @@ export interface AuditDeps {
   moduleConfigs: ModuleConfigsAuditDeps;
   moduleIntegrity: ModuleIntegrityAuditDeps;
   detectWithoutConverge: DetectWithoutConvergeAuditDeps;
+  jailExemptions: JailExemptionsAuditDeps;
   health: HealthAuditDeps;
   backups: BackupsAuditDeps;
   abandonedOperations: AbandonedOperationsAuditDeps;
@@ -70,6 +73,7 @@ export interface AuditDeps {
   servicesReachable: ServicesReachableAuditDeps;
   machinesReachable: MachinesReachableAuditDeps;
   publicDns: PublicDnsAuditDeps;
+  diskSpace: DiskSpaceAuditDeps;
   transportReads: TransportReadsAuditDeps;
   trustedSources: TrustedSourcesAuditDeps;
   /** Defaults to `Date.now()`-based ISO string. */
@@ -95,8 +99,8 @@ export async function runAudit(
 ): Promise<SystemAuditReport> {
   // Wrap each category's promise so the caller sees per-category
   // start/end events. `start` fires synchronously when this function
-  // schedules the category; in practice all 14 fire roughly at once
-  // since Promise.all spawns them in parallel.
+  // schedules the category; in practice all of them fire roughly at
+  // once since Promise.all spawns them in parallel.
   const wrap = (category: DriftCategory, p: Promise<DriftFinding[]>): Promise<DriftFinding[]> => {
     onProgress?.({ category, phase: 'start' });
     return p.then((findings) => {
@@ -119,6 +123,7 @@ export async function runAudit(
       'detect_without_converge',
       Promise.resolve(auditDetectWithoutConverge(deps.detectWithoutConverge)),
     ),
+    wrap('jail_exemptions', Promise.resolve(auditJailExemptions(deps.jailExemptions))),
     wrap('health', auditHealth(deps.health)),
     wrap('backups', auditBackups(deps.backups)),
     wrap(
@@ -132,6 +137,7 @@ export async function runAudit(
     wrap('services_reachable', auditServicesReachable(deps.servicesReachable)),
     wrap('machines_reachable', auditMachinesReachable(deps.machinesReachable)),
     wrap('public_dns', auditPublicDns(deps.publicDns)),
+    wrap('disk_space', Promise.resolve(auditDiskSpace(deps.diskSpace))),
     wrap('transport_reads', auditTransportReads(deps.transportReads)),
     wrap('trusted_sources', auditTrustedSources(deps.trustedSources)),
   ]);

package/src/services/audit/jail-exemptions.test.ts

@@ -0,0 +1,42 @@
+/**
+ * Tests for the `jail_exemptions` audit category (per-module-jail-policy
+ * task 3.3/3.4).
+ *
+ * The severity contract is the point: an operator-recorded exemption is
+ * `todo`, never `drift`, so `system update` never treats it as work. And the
+ * negative half: a fleet with no exemptions contributes no findings.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { auditJailExemptions } from './jail-exemptions';
+
+const EXEMPT = { moduleId: 'caddy', policy: 'off' as const, systemPolicy: 'auto' as const };
+
+describe('auditJailExemptions (per-module-jail-policy task 3.3)', () => {
+  test('no exemptions produce no findings (the negative half of task 3.4)', async () => {
+    expect(await auditJailExemptions({ exemptions: [] })).toEqual([]);
+  });
+
+  test('each exemption is one finding, severity todo, never drift', async () => {
+    const findings = await auditJailExemptions({
+      exemptions: [EXEMPT, { moduleId: 'vault', policy: 'auto', systemPolicy: 'required' }],
+    });
+    expect(findings).toHaveLength(2);
+    for (const f of findings) {
+      expect(f.category).toBe('jail_exemptions');
+      expect(f.severity).toBe('todo');
+      expect(f.severity).not.toBe('drift');
+      expect(f.code).toBe('hook_jail_exemption');
+      expect(f.actionable).toBe(false);
+    }
+  });
+
+  test('the finding names the module and both policies', async () => {
+    const [finding] = await auditJailExemptions({ exemptions: [EXEMPT] });
+    expect(finding).toBeDefined();
+    expect(finding?.subject).toBe('caddy');
+    expect(finding?.message).toContain('caddy');
+    expect(finding?.message).toContain("'off'");
+    expect(finding?.message).toContain("'auto'");
+  });
+});

package/src/services/audit/jail-exemptions.ts

@@ -0,0 +1,44 @@
+/**
+ * Per-module hook jail exemption check (per-module-jail-policy task 3.3).
+ *
+ * One finding per module the operator exempted from the fleet's jail policy.
+ * Severity `todo`, deliberately NOT `drift`: the operator chose this, so it
+ * is a list of recorded exceptions to revisit, not a system that moved away
+ * from a desired state. `todo` never escalates the verdict past READY, which
+ * is what keeps `system update` from treating an exemption as work to do.
+ */
+
+import type { JailExemption } from '../jail-exemptions';
+import type { DriftFinding } from './types';
+
+export interface JailExemptionsAuditDeps {
+  /**
+   * The exemptions, from the shared collector (`services/jail-exemptions.ts`).
+   * A fleet with none contributes nothing — that is the normal state, and
+   * emitting a "no exemptions" finding would be a surface reporting an
+   * exemption nobody set (task 3.4).
+   */
+  exemptions: JailExemption[];
+}
+
+export async function auditJailExemptions(deps: JailExemptionsAuditDeps): Promise<DriftFinding[]> {
+  return deps.exemptions.map((exemption) => ({
+    category: 'jail_exemptions' as const,
+    severity: 'todo' as const,
+    code: 'hook_jail_exemption',
+    subject: exemption.moduleId,
+    message: `${exemption.moduleId} runs under jail policy '${exemption.policy}', weaker than the system's '${exemption.systemPolicy}'`,
+    details: [
+      'Its hooks run with the weaker posture while the rest of the fleet jails.',
+      'The operator recorded this per-module policy with `celilo module jail`.',
+      'Exemptions are deliberate, which is why this is todo and not drift —',
+      'but an exemption nobody remembers is how a jail quietly stops covering',
+      'the fleet. Revisit it: either the reason still holds, or clear it.',
+      '',
+      `To review:  celilo module jail ${exemption.moduleId}`,
+      `To clear:   celilo module jail ${exemption.moduleId} --clear`,
+    ].join('\n'),
+    remediation: `Clear it with 'celilo module jail ${exemption.moduleId} --clear' if the module now jails cleanly`,
+    actionable: false,
+  }));
+}

package/src/services/audit/module-integrity.test.ts

@@ -58,7 +58,9 @@ describe('auditModuleIntegrity', () => {
     expect(findings).toHaveLength(1);
     expect(findings[0]?.code).toBe('module_integrity_stale_baseline');
     expect(findings[0]?.severity).toBe('unmeasured');
-    expect(findings[0]?.remediation).toBe('celilo module update wireguard');
+    expect(findings[0]?.remediation).toBe(
+      'no automatic remediation: the baseline predates version stamping',
+    );
   });
 
   test('file drift under a TRUSTWORTHY baseline is drift, and lists every file', () => {
@@ -122,4 +124,24 @@ describe('auditModuleIntegrity', () => {
       expect(f.actionable).toBe(true);
     }
   });
+
+  test('a stale baseline says there is no command, it does not prescribe one (celilo#1308)', () => {
+    const findings = auditModuleIntegrity({
+      results: [
+        {
+          ...clean('c'),
+          success: false,
+          violations: [
+            { type: 'stale-baseline', path: 'x', message: 'baseline is v1, manifest v2' },
+          ],
+        },
+      ],
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0].code).toBe('module_integrity_stale_baseline');
+    // `module update` takes a source path, not the module id this finding
+    // carries, and no other verb restamps a baseline. Name the gap.
+    expect(findings[0].remediation).not.toMatch(/celilo /);
+    expect(findings[0].actionable).toBe(false);
+  });
 });

package/src/services/audit/module-integrity.ts

@@ -52,8 +52,13 @@ export function auditModuleIntegrity(deps: ModuleIntegrityAuditDeps): DriftFindi
         severity: 'unmeasured',
         code: 'module_integrity_stale_baseline',
         message: `${result.moduleId}: ${violation.message}`,
-        remediation: `celilo module update ${result.moduleId}`,
-        actionable: true,
+        // No command restamps a baseline. `module update` takes a module
+        // source PATH, not an id (celilo#1308: prescribing it with the id
+        // named an argument form that does not exist), and `module upgrade`
+        // deploys the registry version instead. Say so rather than name a
+        // command that cannot run.
+        remediation: 'no automatic remediation: the baseline predates version stamping',
+        actionable: false,
         subject: result.moduleId,
       });
     }

package/src/services/audit/types.ts

@@ -45,7 +45,8 @@ export type DriftCategory =
   | 'trusted_sources'
   | 'interface_classification'
   | 'module_integrity'
-  | 'detect_without_converge';
+  | 'detect_without_converge'
+  | 'jail_exemptions';
 
 /**
  * `unmeasured` is a check that could not reach its subject

package/src/services/backup-create.ts

@@ -35,6 +35,7 @@ import {
 import type { Cadence } from './cadence';
 import { materializeCrossModuleRoot, moduleHasCrossModuleRead } from './cross-module-read';
 import { getModuleSystems } from './deployed-systems';
+import { listMachines } from './machine-pool';
 import { parseStoredConfigValue } from './module-config';
 import {
   completeOperation,
@@ -367,6 +368,14 @@ export async function createModuleBackup(
 
       const staged = stageSystemState(join(tempDir, 'system-state'));
       hookInputs.system_state_root = staged.root;
+
+      // The machine inventory rides the same privilege. on_backup used to
+      // shell `celilo machine list --json` for this, which the hook jail kills
+      // (no celilo binary, celilo#1225) and which never worked before that:
+      // the CLI had no --json flag, so the hook's JSON.parse failed and its
+      // catch wrote [] into every envelope. listMachines() is the same read
+      // the CLI performs, offered as staged data instead of a spawn.
+      hookInputs.machine_pool = JSON.stringify(await listMachines());
       if (!staged.masterKeyStaged) {
         logger.warn(
           `master.key not found at ${getMasterKeyPath()} — secrets in the DB snapshot will be unreadable on restore.`,

package/src/services/backup-envelope-roundtrip.test.ts

@@ -66,7 +66,7 @@ describe('backup envelope round-trip', () => {
   afterEach(() => {
     closeDb();
     resetTestDbPath();
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_MASTER_KEY_PATH;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/backup-in-flight-refusal.test.ts

@@ -36,7 +36,7 @@ describe('backup/restore in-flight refusal', () => {
   afterEach(() => {
     closeDb();
     resetTestDbPath();
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_MASTER_KEY_PATH;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/build-bus/hook-dispatch-mgmt.test.ts

@@ -155,3 +155,51 @@ exit 0
     expect(results).toEqual([]);
   });
 });
+
+/**
+ * The durable outcome record (celilo#1304): every dispatched run lands in
+ * the `build_bus_hook_runs` ledger via the injectable recordRun. Without it
+ * a failed self-update existed only as daemon console output, which no
+ * surface reads.
+ */
+describe('hook-dispatcher outcome record', () => {
+  test('a failing script records exit code, stderr tail, and the event identity', async () => {
+    const failDir = mkdtempSync(join(tmpdir(), 'hook-record-test-'));
+    const scriptPath = join(failDir, 'fail.sh');
+    writeFileSync(scriptPath, '#!/usr/bin/env bash\necho "boom" >&2\nexit 7\n');
+    chmodSync(scriptPath, 0o755);
+
+    const recorded: Array<{
+      event: PublishEvent;
+      result: { exitCode: number | null; stderr: string };
+    }> = [];
+    const dispatcher = await startHookDispatcher({
+      loadModules: () => [
+        {
+          moduleId: 'celilo-mgmt',
+          sourcePath: failDir,
+          hooks: [
+            {
+              name: 'self-update-celilo-cli',
+              match: { registry: 'npm', tag: 'latest', package_pattern: '@celilo/cli' },
+              script: 'fail.sh',
+            },
+          ],
+        },
+      ],
+      recordRun: (event, result) => recorded.push({ event, result }),
+    });
+
+    await dispatcher.handleEvent(
+      buildEvent({ package: { name: '@celilo/cli', version: '2.2.1' } }),
+    );
+    await dispatcher.stop();
+    rmSync(failDir, { recursive: true, force: true });
+
+    expect(recorded).toHaveLength(1);
+    expect(recorded[0].event.eventId).toBe('evt-1');
+    expect(recorded[0].event.package.name).toBe('@celilo/cli');
+    expect(recorded[0].result.exitCode).toBe(7);
+    expect(recorded[0].result.stderr).toContain('boom');
+  });
+});

package/src/services/build-bus/hook-dispatcher.ts

@@ -20,7 +20,7 @@ import { join } from 'node:path';
 import type { PublishEvent } from '@celilo/event-bus/build-bus';
 import { parse as parseYaml } from 'yaml';
 import { getDb } from '../../db/client';
-import { modules } from '../../db/schema';
+import { buildBusHookRuns, modules } from '../../db/schema';
 import {
   type HookRunResult,
   type ModuleHookContext,
@@ -43,12 +43,59 @@ export interface HookDispatcherOptions {
    * modules table.
    */
   loadModules?: () => ModuleHookContext[];
+  /**
+   * Override the durable outcome record. The production default writes one
+   * `build_bus_hook_runs` row per run — without it a failed self-update
+   * exists only as daemon console output, which no surface reads
+   * (celilo#1304). Tests inject a capture to stay DB-free.
+   */
+  recordRun?: (event: PublishEvent, result: HookRunResult) => void;
+}
+
+/** Bound on stdout/stderr tails so one chatty hook cannot bloat the ledger. */
+const TAIL_CHARS = 2000;
+
+function tail(s: string): string {
+  return s.length > TAIL_CHARS ? s.slice(-TAIL_CHARS) : s;
+}
+
+/**
+ * The production outcome record: one `build_bus_hook_runs` row per run.
+ * Throwing here would 500 nothing (the webhook already succeeded) but
+ * would kill dispatch of later plans, so a record failure is logged and
+ * swallowed — the console outcome lines below remain the fallback signal.
+ */
+function recordHookRun(event: PublishEvent, result: HookRunResult): void {
+  try {
+    getDb()
+      .insert(buildBusHookRuns)
+      .values({
+        eventId: event.eventId,
+        packageName: event.package.name,
+        packageVersion: event.package.version,
+        tag: event.tag,
+        moduleId: result.module,
+        hookName: result.hookName,
+        scriptPath: result.scriptPath,
+        exitCode: result.exitCode,
+        timedOut: result.timedOut,
+        durationMs: result.durationMs,
+        stdoutTail: result.stdout ? tail(result.stdout) : null,
+        stderrTail: result.stderr ? tail(result.stderr) : null,
+      })
+      .run();
+  } catch (err) {
+    console.warn(
+      `[build-bus] could not record hook run outcome: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
 }
 
 export async function startHookDispatcher(
   opts: HookDispatcherOptions = {},
 ): Promise<HookDispatcher> {
   const loadModules = opts.loadModules ?? loadInstalledModulesWithHooks;
+  const recordRun = opts.recordRun ?? recordHookRun;
 
   return {
     async handleEvent(event) {
@@ -66,6 +113,7 @@ export async function startHookDispatcher(
           `[build-bus] ${event.package.name}@${event.package.version} → ${plan.module.moduleId} (${plan.hook.name ?? plan.hook.script})`,
         );
         const result = await runHookDispatch(plan);
+        recordRun(event, result);
         results.push(result);
         if (result.exitCode === 0) {
           console.log(`  ✓ exit 0 in ${result.durationMs}ms`);

package/src/services/bus-ensure-flow.test.ts

@@ -176,7 +176,7 @@ describe('bus-mediated interviewForEnsureInputs', () => {
     bus.close();
     rmSync(tempDir, { recursive: true, force: true });
     resetTestDbPath();
-    process.env.EVENT_BUS_DB = undefined;
+    delete process.env.EVENT_BUS_DB;
   });
 
   test('mixed inputs: array applied deterministic, config + secret routed through bus', async () => {

package/src/services/bus-interview-park.test.ts

@@ -93,8 +93,8 @@ afterEach(() => {
   server.stop(true);
   rmSync(dir, { recursive: true, force: true });
   resetTestDbPath();
-  process.env.CELILO_ORIGINAL_CWD = undefined;
-  process.env.EVENT_BUS_DB = undefined;
+  delete process.env.CELILO_ORIGINAL_CWD;
+  delete process.env.EVENT_BUS_DB;
 });
 
 test('a command parks on an unanswered interview, then resumes with an answer given later', async () => {

package/src/services/bus-interview.test.ts

@@ -24,7 +24,7 @@ describe('busInterview', () => {
     process.env.EVENT_BUS_DB = dbPath;
   });
   afterEach(() => {
-    if (origEnv === undefined) process.env.EVENT_BUS_DB = undefined;
+    if (origEnv === undefined) delete process.env.EVENT_BUS_DB;
     else process.env.EVENT_BUS_DB = origEnv;
     try {
       rmSync(dir, { recursive: true, force: true });
@@ -156,7 +156,7 @@ describe('multi-select payload roundtrip', () => {
     process.env.EVENT_BUS_DB = dbPath;
   });
   afterEach(() => {
-    if (origEnv === undefined) process.env.EVENT_BUS_DB = undefined;
+    if (origEnv === undefined) delete process.env.EVENT_BUS_DB;
     else process.env.EVENT_BUS_DB = origEnv;
     try {
       rmSync(dir, { recursive: true, force: true });

package/src/services/bus-secret-flow.test.ts

@@ -156,7 +156,7 @@ describe('bus-mediated interviewForMissingSecrets', () => {
     bus.close();
     rmSync(tempDir, { recursive: true, force: true });
     resetTestDbPath();
-    process.env.EVENT_BUS_DB = undefined;
+    delete process.env.EVENT_BUS_DB;
   });
 
   test('user_provided: emits secret.required, responder writes, value lands in store', async () => {