@celilo/cli 2.2.1 → 3.0.0

package/src/secrets/storage.test.ts

@@ -7,13 +7,20 @@ import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { eq } from 'drizzle-orm';
+import { and, eq } from 'drizzle-orm';
 import { drizzle } from 'drizzle-orm/bun-sqlite';
 import { migrate } from 'drizzle-orm/bun-sqlite/migrator';
 import type { DbClient } from '../db/client';
 import * as schema from '../db/schema';
-import { systemSecrets } from '../db/schema';
-import { getSystemSecret, storeSystemSecret, systemSecretExists } from './storage';
+import { secrets, systemSecrets } from '../db/schema';
+import { decryptSecret } from './encryption';
+import { getOrCreateMasterKey } from './master-key';
+import {
+  getSystemSecret,
+  recordProviderSecret,
+  storeSystemSecret,
+  systemSecretExists,
+} from './storage';
 
 describe('secret storage', () => {
   let testDir: string;
@@ -36,7 +43,7 @@ describe('secret storage', () => {
   afterEach(() => {
     // Cleanup
     rmSync(testDir, { recursive: true, force: true });
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_MASTER_KEY_PATH;
   });
 
   test('stores and retrieves system secret', async () => {
@@ -112,4 +119,63 @@ describe('secret storage', () => {
     const decrypted = await getSystemSecret('test.long', testDb);
     expect(decrypted).toBe(longSecret);
   });
+
+  describe('recordProviderSecret (hook-owned-state D3)', () => {
+    const providerRow = (moduleId: string, name: string) =>
+      testDb
+        .select()
+        .from(secrets)
+        .where(and(eq(secrets.moduleId, moduleId), eq(secrets.name, name)))
+        .get();
+
+    const decryptRow = async (moduleId: string, name: string) => {
+      const row = providerRow(moduleId, name);
+      expect(row).toBeDefined();
+      if (!row) throw new Error('provider secret row missing');
+      const mk = await getOrCreateMasterKey();
+      return decryptSecret(
+        { encryptedValue: row.encryptedValue, iv: row.iv, authTag: row.authTag },
+        mk,
+      );
+    };
+
+    test('records an encrypted secret onto the provider module', async () => {
+      await recordProviderSecret(testDb, 'some-provider', 'api_key', 'minted-value');
+
+      expect(await decryptRow('some-provider', 'api_key')).toBe('minted-value');
+      // Encrypted on disk, never the plaintext.
+      const row = providerRow('some-provider', 'api_key');
+      expect(row && row.encryptedValue !== 'minted-value').toBe(true);
+    });
+
+    test('upserts on (moduleId, name) instead of duplicating', async () => {
+      await recordProviderSecret(testDb, 'some-provider', 'api_key', 'first');
+      await recordProviderSecret(testDb, 'some-provider', 'api_key', 'second');
+
+      const rows = testDb.select().from(secrets).all();
+      expect(rows).toHaveLength(1);
+      expect(await decryptRow('some-provider', 'api_key')).toBe('second');
+    });
+
+    test('keeps two providers with the same secret name distinct', async () => {
+      await recordProviderSecret(testDb, 'provider-a', 'api_key', 'value-a');
+      await recordProviderSecret(testDb, 'provider-b', 'api_key', 'value-b');
+
+      const rows = testDb.select().from(secrets).all();
+      expect(rows).toHaveLength(2);
+    });
+
+    test('refuses an empty module id, name, or value', async () => {
+      await expect(recordProviderSecret(testDb, '', 'api_key', 'v')).rejects.toThrow(
+        'providerModuleId is required',
+      );
+      await expect(recordProviderSecret(testDb, 'p', '  ', 'v')).rejects.toThrow(
+        'name is required',
+      );
+      await expect(recordProviderSecret(testDb, 'p', 'api_key', '')).rejects.toThrow(
+        'value is required',
+      );
+      expect(testDb.select().from(secrets).all()).toHaveLength(0);
+    });
+  });
 });

package/src/secrets/storage.ts

@@ -3,7 +3,7 @@
  * Reusable functions for storing encrypted secrets
  */
 
-import { eq } from 'drizzle-orm';
+import { and, eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { getDb } from '../db/client';
 import { systemSecrets } from '../db/schema';
@@ -104,3 +104,73 @@ export function systemSecretExists(key: string, db: DbClient = getDb()): boolean
 
   return secret !== undefined;
 }
+
+/**
+ * Record a secret on a PROVIDER module on behalf of the framework.
+ *
+ * This is the named, single-purpose path that replaced the generic
+ * return-value capture sweep (openspec/changes/hook-owned-state, D3/D5):
+ * `container_created` used to persist whatever the provider hook returned
+ * onto the provider module, keyed by the provider's own id — a write a
+ * per-module hook accessor cannot express and must never be able to. The
+ * framework still needs to mint provider secrets on a deploy's authority,
+ * so that write keeps a broker-side home: an explicit call in framework
+ * code, not reachable from any hook, not driven by a hook return value.
+ *
+ * Policy function (Rule 10.1) - validates name before storing
+ * Execution function - performs encryption and database write
+ *
+ * @param db - Database client
+ * @param providerModuleId - The module that OWNS the secret (the provider)
+ * @param name - Secret name
+ * @param value - Plaintext secret value
+ * @throws Error if name or value is empty
+ */
+export async function recordProviderSecret(
+  db: DbClient,
+  providerModuleId: string,
+  name: string,
+  value: string,
+): Promise<void> {
+  if (!providerModuleId.trim()) {
+    throw new Error('recordProviderSecret: providerModuleId is required');
+  }
+  if (!name.trim()) {
+    throw new Error('recordProviderSecret: secret name is required');
+  }
+  if (!value.trim()) {
+    throw new Error('recordProviderSecret: secret value is required');
+  }
+
+  const { secrets } = await import('../db/schema');
+  const masterKey = await getOrCreateMasterKey();
+  const encrypted = encryptSecret(value, masterKey);
+
+  const existing = db
+    .select()
+    .from(secrets)
+    .where(and(eq(secrets.moduleId, providerModuleId), eq(secrets.name, name)))
+    .get();
+
+  if (existing) {
+    db.update(secrets)
+      .set({
+        encryptedValue: encrypted.encryptedValue,
+        iv: encrypted.iv,
+        authTag: encrypted.authTag,
+        updatedAt: new Date(),
+      })
+      .where(eq(secrets.id, existing.id))
+      .run();
+  } else {
+    db.insert(secrets)
+      .values({
+        moduleId: providerModuleId,
+        name,
+        encryptedValue: encrypted.encryptedValue,
+        iv: encrypted.iv,
+        authTag: encrypted.authTag,
+      })
+      .run();
+  }
+}

package/src/services/alerting/keys.test.ts

@@ -116,6 +116,10 @@ describe('severityForItemStatus', () => {
     expect(severityForItemStatus('fail', 'critical')).toBe('critical');
     expect(severityForItemStatus('fail', 'warning')).toBe('warning');
   });
+
+  test('skip produces no alert — a check that could not run is not a failure', () => {
+    expect(severityForItemStatus('skip', 'critical')).toBeNull();
+  });
 });
 
 describe('failingKeysFromHealthItems', () => {

package/src/services/alerting/keys.ts

@@ -134,14 +134,24 @@ export function parentModuleKey(key: string): string | null {
  * and never pages. That gives module authors somewhere to put "cert expires in
  * 20 days" without anyone having to decide whether it is a 3am problem.
  *
+ * `skip` produces no alert either: a check that could not perform its probe
+ * is not a failure. Note the honest cost — a previously-failing key whose
+ * item now reports skip leaves this run's failing set, so the reconciler
+ * reads "recovered" off a run that measured nothing. That is the same hazard
+ * class design D5 handles at run level (a run that could not execute is the
+ * caller's branch); there is no per-item sticky-key mechanism here, so a
+ * module whose credential disappeared needs the audit's `unmeasured` finding
+ * to be seen (celilo#1326).
+ *
  * See design D6.
  */
 export function severityForItemStatus(
-  itemStatus: 'pass' | 'warn' | 'fail',
+  itemStatus: 'pass' | 'warn' | 'fail' | 'skip',
   monitorSeverity: AlertSeverity,
 ): AlertSeverity | null {
   if (itemStatus === 'pass') return null;
   if (itemStatus === 'warn') return 'warning';
+  if (itemStatus === 'skip') return null;
   return monitorSeverity;
 }
 
@@ -155,7 +165,7 @@ export interface FailingKey {
 
 export interface HealthCheckItemLike {
   name: string;
-  status: 'pass' | 'warn' | 'fail';
+  status: 'pass' | 'warn' | 'fail' | 'skip';
   message: string;
   details?: string;
 }

package/src/services/audit/health.test.ts

@@ -1,14 +1,167 @@
 import { describe, expect, test } from 'bun:test';
 import type { HealthCheckResult } from '../health-runner';
 import { auditHealth } from './health';
+import { computeVerdict } from './types';
 
 describe('auditHealth', () => {
-  test('no findings when every module is healthy or has no checks', async () => {
+  test('a healthy module produces no finding; a module with no hook is unmeasured, never green', async () => {
     const results: HealthCheckResult[] = [
       { moduleId: 'caddy', status: 'healthy', checks: [] },
       { moduleId: 'iptables', status: 'no-checks', checks: [] },
     ];
-    expect(await auditHealth({ results })).toEqual([]);
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({
+      category: 'health',
+      severity: 'unmeasured',
+      code: 'health_unmeasured',
+      subject: 'iptables',
+      actionable: false,
+    });
+    expect(result[0].message).toContain('no health_check hook');
+    expect(computeVerdict(result)).toBe('UNKNOWN');
+  });
+
+  test('a module whose checks all report skip is unmeasured and names the skipped checks', async () => {
+    // The smoketest_bot_token incident, as an audit finding: the hook ran,
+    // every meaningful check refused to guess, and the fleet must not read
+    // READY off that.
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'smoketest',
+        status: 'no-checks',
+        checks: [
+          {
+            name: 'bot_token_valid',
+            status: 'skip',
+            message: 'smoketest_bot_token not yet provisioned',
+          },
+          {
+            name: 'webhook_reachable',
+            status: 'skip',
+            message: 'smoketest_bot_token not yet provisioned',
+          },
+        ],
+      },
+    ];
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({
+      severity: 'unmeasured',
+      code: 'health_unmeasured',
+      subject: 'smoketest',
+      actionable: true,
+      remediation: 'celilo module health smoketest --debug',
+    });
+    expect(result[0].message).toContain('all 2 health checks skipped');
+    expect(result[0].details).toContain('bot_token_valid');
+    expect(result[0].details).toContain('not yet provisioned');
+  });
+
+  test('skipped checks on an otherwise healthy module render unmeasured', async () => {
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'caddy',
+        status: 'healthy',
+        checks: [
+          { name: 'config_valid', status: 'pass', message: 'config parses' },
+          {
+            name: 'origin_reachable',
+            status: 'skip',
+            message: 'peer unreachable from control plane',
+          },
+        ],
+      },
+    ];
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({
+      severity: 'unmeasured',
+      code: 'health_checks_skipped',
+      subject: 'caddy',
+    });
+    expect(result[0].message).toContain('1 of 2');
+    expect(result[0].details).toContain('origin_reachable');
+    expect(computeVerdict(result)).toBe('UNKNOWN');
+  });
+
+  test('a degraded module with a skipped check yields both a drift and an unmeasured finding', async () => {
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'iptables',
+        status: 'degraded',
+        checks: [
+          {
+            name: 'persistence_drift',
+            status: 'warn',
+            message: '1 live rule(s) absent from rules.v4',
+          },
+          { name: 'ssh_access', status: 'skip', message: 'fw01 unreachable' },
+        ],
+      },
+    ];
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(2);
+    expect(result.map((f) => f.severity).sort()).toEqual(['drift', 'unmeasured']);
+    expect(computeVerdict(result)).toBe('UNKNOWN');
+  });
+
+  test('a waived module still emits unmeasured, annotated with who and why', async () => {
+    // The waiver annotates the finding; it never replaces it. Severity
+    // stays `unmeasured` so the fleet verdict stays UNKNOWN (D3). Zero
+    // unmeasured findings after a waiver would mean the waiver re-greened.
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'namecheap',
+        status: 'no-checks',
+        checks: [],
+        waiver: {
+          reason: 'API-only: a real check is hard and may not be worth forcing',
+          by: 'peba',
+          at: '2026-09-09',
+        },
+      },
+    ];
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({
+      severity: 'unmeasured',
+      code: 'health_unmeasured',
+      subject: 'namecheap',
+    });
+    expect(result[0].message).toContain(
+      'WAIVED by peba (2026-09-09): API-only: a real check is hard and may not be worth forcing',
+    );
+    expect(computeVerdict(result)).toBe('UNKNOWN');
+  });
+
+  test('a waiver does not green an all-skipped module either', async () => {
+    const results: HealthCheckResult[] = [
+      {
+        moduleId: 'homebridge',
+        status: 'no-checks',
+        checks: [{ name: 'bridge_reachable', status: 'skip', message: 'no operator time' }],
+        waiver: {
+          reason: 'deferred: should eventually have one, no operator time now',
+          by: 'peba',
+          at: '2026-09-09',
+        },
+      },
+    ];
+    const result = await auditHealth({ results });
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({ severity: 'unmeasured', code: 'health_unmeasured' });
+    expect(result[0].message).toContain('all 1 health checks skipped');
+    expect(result[0].message).toContain('WAIVED by peba');
+    expect(computeVerdict(result)).toBe('UNKNOWN');
+  });
+
+  test('a module without a waiver is not annotated', async () => {
+    const results: HealthCheckResult[] = [
+      { moduleId: 'iptables', status: 'no-checks', checks: [] },
+    ];
+    const result = await auditHealth({ results });
+    expect(result[0].message).not.toContain('WAIVED');
   });
 
   test('drift finding for unhealthy module', async () => {

package/src/services/audit/health.ts

@@ -5,24 +5,98 @@
  * informational (DRIFT, not BLOCKED) — the user might want to update
  * even if some module is currently unhealthy (an update could fix it).
  *
+ * Unmeasured is reported, never folded into green: a module with no
+ * health_check hook, and a module whose checks all reported skip, have
+ * contributed no measurement at all, and both render the fleet UNKNOWN
+ * rather than READY (celilo#1326). The same rule reaches one level down —
+ * a module that measured something but skipped a check gets an
+ * `unmeasured` finding beside its verdict, so a VERIFIED module whose
+ * meaningful probe was skipped is still visible.
+ *
  * The health-runner result is passed in directly so this file stays
  * pure for testing. The aggregator wires `runAllHealthChecks` to it.
  */
 
+import type { HealthWaiver } from '../../manifest/schema';
 import type { HealthCheckResult } from '../health-runner';
 import type { DriftFinding } from './types';
 
+/** Render a waiver as the annotation carried on the `unmeasured` finding. */
+export function waiverAnnotation(waiver: HealthWaiver): string {
+  return `WAIVED by ${waiver.by} (${waiver.at}): ${waiver.reason}`;
+}
+
 export interface HealthAuditDeps {
   results: HealthCheckResult[];
 }
 
+function skippedChecksFinding(r: HealthCheckResult, code: string, message: string): DriftFinding {
+  const details = r.checks
+    .filter((c) => c.status === 'skip')
+    .map((c) => `  • ${c.name}: ${c.message}`)
+    .join('\n');
+
+  return {
+    category: 'health',
+    severity: 'unmeasured',
+    code,
+    message,
+    details: details || undefined,
+    remediation: `celilo module health ${r.moduleId} --debug`,
+    actionable: true,
+    subject: r.moduleId,
+  };
+}
+
 export async function auditHealth(deps: HealthAuditDeps): Promise<DriftFinding[]> {
   const findings: DriftFinding[] = [];
 
   for (const r of deps.results) {
-    if (r.status === 'healthy' || r.status === 'no-checks') continue;
+    const skipped = r.checks.filter((c) => c.status === 'skip');
+    const measured = r.checks.filter((c) => c.status !== 'skip');
+
+    // A waiver annotates an `unmeasured` finding; it never replaces it.
+    // The severity stays `unmeasured` so the fleet verdict stays UNKNOWN
+    // (D3) — zero unmeasured findings after a waiver would mean the
+    // waiver re-greened the board, which is the failure it guards.
+    const waiverNote = r.waiver ? ` — ${waiverAnnotation(r.waiver)}` : '';
+
+    if (r.status === 'no-checks') {
+      // Either the module declares no health_check hook, or the hook ran
+      // and every check reported skip. Neither measured anything.
+      findings.push(
+        skipped.length > 0
+          ? skippedChecksFinding(
+              r,
+              'health_unmeasured',
+              `${r.moduleId}: all ${skipped.length} health checks skipped — nothing measured${waiverNote}`,
+            )
+          : {
+              category: 'health',
+              severity: 'unmeasured',
+              code: 'health_unmeasured',
+              message: `${r.moduleId}: no health_check hook — never measured${waiverNote}`,
+              remediation: `Add a health_check hook to the ${r.moduleId} module manifest`,
+              actionable: false,
+              subject: r.moduleId,
+            },
+      );
+      continue;
+    }
+
+    if (skipped.length > 0) {
+      findings.push(
+        skippedChecksFinding(
+          r,
+          'health_checks_skipped',
+          `${r.moduleId}: ${skipped.length} of ${r.checks.length} health checks skipped${waiverNote}`,
+        ),
+      );
+    }
+
+    if (r.status === 'healthy') continue;
 
-    const failingChecks = r.checks
+    const failingChecks = measured
       .filter((c) => c.status === 'fail' || c.status === 'warn')
       .map((c) => `  • ${c.name}: ${c.message}`)
       .join('\n');

package/src/services/audit/index.test.ts

@@ -32,6 +32,7 @@ const emptyDeps = {
   moduleConfigs: { modules: [] },
   moduleIntegrity: { results: [] },
   detectWithoutConverge: { modules: [] },
+  jailExemptions: { exemptions: [] },
   health: { results: [] },
   backups: { modules: [] },
   abandonedOperations: { records: [] },
@@ -41,8 +42,9 @@ const emptyDeps = {
   secretsDecryptable: { results: [] },
   servicesReachable: { results: [] },
   machinesReachable: { results: [] },
+  diskSpace: { results: [] },
   transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
-  trustedSources: { firewalls: [] },
+  trustedSources: { firewalls: [], unreachableFirewalls: [] },
   publicDns: { records: [], probe: unusedPublicDnsProbe },
 };
 
@@ -88,6 +90,26 @@ describe('runAudit', () => {
     expect(report.findings.some((f) => f.category === 'schema')).toBe(true);
   });
 
+  test('disk_space is wired into the report (celilo#1336)', async () => {
+    const events: string[] = [];
+    const report = await runAudit(
+      {
+        ...emptyDeps,
+        diskSpace: {
+          results: [{ hostname: 'celilo-mgr', ipAddress: '10.0.0.5', usedPercent: 96 }],
+        },
+      },
+      (event) => events.push(`${event.category}:${event.phase}`),
+    );
+
+    // 96% is at the blocked threshold, so the wired category alone flips
+    // the fleet verdict — which is the point of wiring it.
+    expect(report.verdict).toBe('BLOCKED');
+    expect(report.findings.map((f) => f.category)).toContain('disk_space');
+    expect(events).toContain('disk_space:start');
+    expect(events).toContain('disk_space:end');
+  });
+
   test('aggregates findings across all categories', async () => {
     const report = await runAudit({
       ...emptyDeps,

package/src/services/audit/index.ts

@@ -22,7 +22,9 @@ import {
   type DetectWithoutConvergeAuditDeps,
   auditDetectWithoutConverge,
 } from './detect-without-converge';
+import { type DiskSpaceAuditDeps, auditDiskSpace } from './disk-space';
 import { type HealthAuditDeps, auditHealth } from './health';
+import { type JailExemptionsAuditDeps, auditJailExemptions } from './jail-exemptions';
 import { type MachinesReachableAuditDeps, auditMachinesReachable } from './machines-reachable';
 import { type ModuleConfigsAuditDeps, auditModuleConfigs } from './module-configs';
 import { type ModuleIntegrityAuditDeps, auditModuleIntegrity } from './module-integrity';
@@ -60,6 +62,7 @@ export interface AuditDeps {
   moduleConfigs: ModuleConfigsAuditDeps;
   moduleIntegrity: ModuleIntegrityAuditDeps;
   detectWithoutConverge: DetectWithoutConvergeAuditDeps;
+  jailExemptions: JailExemptionsAuditDeps;
   health: HealthAuditDeps;
   backups: BackupsAuditDeps;
   abandonedOperations: AbandonedOperationsAuditDeps;
@@ -70,6 +73,7 @@ export interface AuditDeps {
   servicesReachable: ServicesReachableAuditDeps;
   machinesReachable: MachinesReachableAuditDeps;
   publicDns: PublicDnsAuditDeps;
+  diskSpace: DiskSpaceAuditDeps;
   transportReads: TransportReadsAuditDeps;
   trustedSources: TrustedSourcesAuditDeps;
   /** Defaults to `Date.now()`-based ISO string. */
@@ -95,8 +99,8 @@ export async function runAudit(
 ): Promise<SystemAuditReport> {
   // Wrap each category's promise so the caller sees per-category
   // start/end events. `start` fires synchronously when this function
-  // schedules the category; in practice all 14 fire roughly at once
-  // since Promise.all spawns them in parallel.
+  // schedules the category; in practice all of them fire roughly at
+  // once since Promise.all spawns them in parallel.
   const wrap = (category: DriftCategory, p: Promise<DriftFinding[]>): Promise<DriftFinding[]> => {
     onProgress?.({ category, phase: 'start' });
     return p.then((findings) => {
@@ -119,6 +123,7 @@ export async function runAudit(
       'detect_without_converge',
       Promise.resolve(auditDetectWithoutConverge(deps.detectWithoutConverge)),
     ),
+    wrap('jail_exemptions', Promise.resolve(auditJailExemptions(deps.jailExemptions))),
     wrap('health', auditHealth(deps.health)),
     wrap('backups', auditBackups(deps.backups)),
     wrap(
@@ -132,6 +137,7 @@ export async function runAudit(
     wrap('services_reachable', auditServicesReachable(deps.servicesReachable)),
     wrap('machines_reachable', auditMachinesReachable(deps.machinesReachable)),
     wrap('public_dns', auditPublicDns(deps.publicDns)),
+    wrap('disk_space', Promise.resolve(auditDiskSpace(deps.diskSpace))),
     wrap('transport_reads', auditTransportReads(deps.transportReads)),
     wrap('trusted_sources', auditTrustedSources(deps.trustedSources)),
   ]);

package/src/services/audit/interface-classification.test.ts

@@ -207,14 +207,25 @@ describe('describeClassification — the picture, not a finding', () => {
 
 describe('auditInterfaceClassification — every firewall, flattened', () => {
   test('reports across several firewalls, each subjected on its own hostname', () => {
-    const findings = auditInterfaceClassification([
-      liveFleetShape(),
-      liveFleetShape({ hostname: 'fw-branch' }),
-    ]);
+    const findings = auditInterfaceClassification({
+      unreachableFirewalls: [],
+      views: [liveFleetShape(), liveFleetShape({ hostname: 'fw-branch' })],
+    });
     expect(findings.map((f) => f.subject).sort()).toEqual(['fw-branch', 'fw-main']);
   });
 
   test('no firewalls means no findings', () => {
-    expect(auditInterfaceClassification([])).toEqual([]);
+    expect(auditInterfaceClassification({ views: [], unreachableFirewalls: [] })).toEqual([]);
+  });
+
+  test('a firewall whose interfaces could not be read is unmeasured, not silent (D7)', () => {
+    const findings = auditInterfaceClassification({
+      views: [liveFleetShape()],
+      unreachableFirewalls: ['fw-branch'],
+    });
+    const unmeasured = findings.filter((f) => f.severity === 'unmeasured');
+    expect(unmeasured).toHaveLength(1);
+    expect(unmeasured[0].subject).toBe('fw-branch');
+    expect(unmeasured[0].code).toBe('interface_classification_unmeasured');
   });
 });

package/src/services/audit/interface-classification.ts

@@ -142,8 +142,31 @@ export function auditFirewallInterfaces(view: FirewallInterfaceView): DriftFindi
 }
 
 /** Every firewall's findings, flattened. */
-export function auditInterfaceClassification(views: FirewallInterfaceView[]): DriftFinding[] {
-  return views.flatMap(auditFirewallInterfaces);
+export interface InterfaceClassificationAuditDeps {
+  views: FirewallInterfaceView[];
+  /**
+   * Firewalls celilo knows about but whose interface state could not be read
+   * over SSH. Each is an `unmeasured` finding: an interface survey that
+   * cannot see a firewall has measured nothing about it (D7).
+   */
+  unreachableFirewalls: string[];
+}
+
+export function auditInterfaceClassification(
+  deps: InterfaceClassificationAuditDeps,
+): DriftFinding[] {
+  const unreachable = deps.unreachableFirewalls.map((firewallIp): DriftFinding => {
+    return {
+      category: 'interface_classification',
+      severity: 'unmeasured',
+      code: 'interface_classification_unmeasured',
+      subject: firewallIp,
+      message: `${firewallIp}: interfaces could not be read, so classification is unknown`,
+      remediation: `Check SSH reachability of ${firewallIp}, then re-audit. This finding records that the interfaces were not read, not that they are classified.`,
+      actionable: true,
+    };
+  });
+  return [...unreachable, ...deps.views.flatMap(auditFirewallInterfaces)];
 }
 
 /**