@celilo/cli 2.2.1 → 3.0.0

package/src/db/schema.ts

@@ -212,6 +212,45 @@ export const capabilityBindings = sqliteTable(
   }),
 );
 
+/**
+ * One build-bus `on_upstream_publish` hook execution (services/build-bus/hook-dispatcher.ts).
+ *
+ * The self-update path had no durable record: outcomes were console output
+ * inside the receiver daemon, so a CLI that never upgraded looked like a
+ * healthy fleet (celilo#1304). One row per (event, module, hook) run — the
+ * newest row answers "did the self-update for @celilo/cli@X fire and succeed?".
+ *
+ * `exit_code` is NULL when the script never ran to an exit (spawn failure).
+ * Not an event-bus delivery: hooks run from the receiver's in-process
+ * dispatcher, which no `deliveries` row was ever written for.
+ *
+ * @owner celilo — build-bus self-update audit trail (celilo#1304)
+ */
+export const buildBusHookRuns = sqliteTable(
+  'build_bus_hook_runs',
+  {
+    id: integer('id').primaryKey({ autoIncrement: true }),
+    /** The PublishEvent's dedup id — joins back to the bus's `build-bus.publish` event. */
+    eventId: text('event_id').notNull(),
+    packageName: text('package_name').notNull(),
+    packageVersion: text('package_version').notNull(),
+    tag: text('tag').notNull(),
+    moduleId: text('module_id').notNull(),
+    hookName: text('hook_name').notNull(),
+    scriptPath: text('script_path').notNull(),
+    /** Null means the script never reached an exit (spawn failure). */
+    exitCode: integer('exit_code'),
+    timedOut: integer('timed_out', { mode: 'boolean' }).notNull().default(false),
+    durationMs: integer('duration_ms').notNull(),
+    stdoutTail: text('stdout_tail'),
+    stderrTail: text('stderr_tail'),
+    ranAt: integer('created_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
+  },
+  (table) => ({
+    ranAtLookup: index('build_bus_hook_runs_created_at_idx').on(table.ranAt),
+  }),
+);
+
 /**
  * Capability secrets table - stores encrypted secrets owned by capabilities
  * Values are encrypted with AES-256-GCM using master key
@@ -310,6 +349,28 @@ export const moduleIntegrity = sqliteTable('module_integrity', {
   updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
 });
 
+/**
+ * Per-module hook jail policy — the operator's row in the four-step
+ * precedence (per-module-jail-policy task 1.1), ranked between the
+ * `CELILO_HOOK_JAIL` environment variable and the system-wide
+ * `hooks.jail_policy` key.
+ *
+ * One row per module; an absent row means "follow the system", so there is
+ * no default column to get wrong. The value is validated at set time by the
+ * `module jail` verb and re-validated at read time by `resolveJailPolicy`,
+ * which throws rather than coercing — a restored or hand-edited row outside
+ * the accepted set must fail loudly, the same rule the system key follows
+ * (peba's ruling on ce-8832).
+ * @owner celilo — operator-set per-module jail policy
+ */
+export const moduleJailPolicies = sqliteTable('module_jail_policies', {
+  moduleId: text('module_id')
+    .primaryKey()
+    .references(() => modules.id, { onDelete: 'cascade' }),
+  policy: text('policy').$type<'auto' | 'off' | 'required'>().notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
+});
+
 /**
  * Lifecycle states an instance moves through.
  *
@@ -1579,3 +1640,5 @@ export type NotificationDelivery = typeof notificationDeliveries.$inferSelect;
 export type NewNotificationDelivery = typeof notificationDeliveries.$inferInsert;
 export type CapabilityBinding = typeof capabilityBindings.$inferSelect;
 export type NewCapabilityBinding = typeof capabilityBindings.$inferInsert;
+export type BuildBusHookRun = typeof buildBusHookRuns.$inferSelect;
+export type NewBuildBusHookRun = typeof buildBusHookRuns.$inferInsert;

package/src/hooks/broker.test.ts

@@ -12,7 +12,7 @@
 
 import { describe, expect, test } from 'bun:test';
 import { execSync } from 'node:child_process';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { MissingProviderInputError } from '@celilo/capabilities';
@@ -60,10 +60,13 @@ async function runCapabilityHook(): Promise<Record<string, unknown>> {
       stateDir: dir,
       capabilities: demoCapabilities(),
     };
-    return await executeHookScript(join(FIXTURES, 'capability-calling-hook.ts'), context, {
+    await executeHookScript(join(FIXTURES, 'capability-calling-hook.ts'), context, {
       timeoutMs: 30_000,
       idleTimeoutMs: 30_000,
     });
+    // The fixture hands its report through the state directory: hook return
+    // values are no longer carried anywhere (hook-owned-state D5).
+    return JSON.parse(readFileSync(join(dir, 'report.json'), 'utf-8')) as Record<string, unknown>;
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }
@@ -137,11 +140,14 @@ async function runStoreHook(
       capabilities: {},
       ...contextData,
     } as unknown as HookContext;
-    return await executeHookScript(join(FIXTURES, 'store-writing-hook.ts'), context, {
+    await executeHookScript(join(FIXTURES, 'store-writing-hook.ts'), context, {
       timeoutMs: 30_000,
       idleTimeoutMs: 30_000,
       hookStores: () => Promise.resolve(memoryStores()),
     });
+    // The fixture hands its report through the state directory: hook return
+    // values are no longer carried anywhere (hook-owned-state D5).
+    return JSON.parse(readFileSync(join(dir, 'report.json'), 'utf-8')) as Record<string, unknown>;
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }

package/src/hooks/capability-loader-firewall.test.ts

@@ -293,6 +293,8 @@ describe('Firewall Chain Building', () => {
       upsertModuleConfig(db, 'iptables', 'nat_ip', '192.168.0.253');
       upsertModuleConfig(db, 'iptables', 'default_route_zone', 'isp-transit');
       upsertModuleConfig(db, 'iptables', 'isolate_transit_network', true);
+      upsertModuleConfig(db, 'iptables', 'interface_baseline', 'eth0,eth2');
+      upsertModuleConfig(db, 'iptables', 'interface_zone_map', 'eth0=isp-transit,eth2=internal');
 
       const config = await loadedConfig();
       expect(config.defaultRouteZone).toBe('isp-transit');
@@ -300,6 +302,8 @@ describe('Firewall Chain Building', () => {
       // preserves the manifest-declared type, and the module tests
       // `state.isolateTransitNetwork && ...` — where 'false' would be truthy.
       expect(config.isolateTransitNetwork).toBe(true);
+      expect(config.interfaceBaseline).toEqual(['eth0', 'eth2']);
+      expect(config.interfaceZoneMap).toBe('eth0=isp-transit,eth2=internal');
     });
 
     test('single provider: the recorded interface_baseline is forwarded as a parsed list', async () => {
@@ -358,13 +362,15 @@ describe('Firewall Chain Building', () => {
       upsertModuleConfig(db, 'iptables', 'default_route_zone', 'internal');
       upsertModuleConfig(db, 'iptables', 'isolate_transit_network', true);
       upsertModuleConfig(db, 'iptables', 'interface_baseline', 'eth0,eth1');
+      upsertModuleConfig(db, 'iptables', 'interface_zone_map', 'eth0=isp-transit,eth1=internal');
 
       const config = await loadedConfig();
       expect(config.defaultRouteZone).toBe('internal');
       expect(config.isolateTransitNetwork).toBe(true);
-      // The downstream construction site already forwarded this; pinned so the
+      // The downstream construction site already forwarded these; pinned so the
       // two sites cannot drift apart again.
       expect(config.interfaceBaseline).toEqual(['eth0', 'eth1']);
+      expect(config.interfaceZoneMap).toBe('eth0=isp-transit,eth1=internal');
     });
 
     test('unset settings arrive undefined, not as a wrong default', async () => {
@@ -378,6 +384,8 @@ describe('Firewall Chain Building', () => {
       // would be silently overridden by a stale copy here.
       expect(config.defaultRouteZone).toBeUndefined();
       expect(config.isolateTransitNetwork).toBeUndefined();
+      expect(config.interfaceBaseline).toBeUndefined();
+      expect(config.interfaceZoneMap).toBeUndefined();
     });
   });
 });

package/src/hooks/capability-loader.ts

@@ -838,6 +838,10 @@ function buildCapabilityInterface(
           // baseline was recorded but never read back, so every converge stayed
           // in onboarding mode and refused instead of isolating (ce-qzxm).
           interfaceBaseline: parseInterfaceBaseline(config.interface_baseline),
+          // The learned zone-to-leg map, same round trip and the same site that
+          // dropped it. The module writes it at the end of a clean converge and
+          // reads it back to keep a managed /32 on its declared zone leg.
+          interfaceZoneMap: config.interface_zone_map as string | undefined,
           // Operator settings, forwarded verbatim. `parseStoredConfigValue`
           // preserves each manifest-declared type, so the boolean arrives as a
           // boolean and needs no coercion here.
@@ -1361,6 +1365,10 @@ async function buildFirewallChain(
         // Absent means the box has never converged cleanly, so an interface
         // celilo cannot attribute refuses rather than being disabled.
         interfaceBaseline: parseInterfaceBaseline(provConfig.interface_baseline),
+        // The managed-address resolver consults this before it reads the live
+        // address table. Dropping it makes the fallback select the management
+        // (SSH) interface, after which the bad alias can corrupt the learned map.
+        interfaceZoneMap: provConfig.interface_zone_map as string | undefined,
         // Which declared zone carries this firewall's default route, and
         // whether fronted zones may initiate into it. Both are operator
         // settings and both are read HERE or nowhere: the module declares them

package/src/hooks/executor.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
-import { systemConfig } from '../db/schema';
+import { modules, systemConfig } from '../db/schema';
 import type { ContractHookSignature } from '../manifest/contracts';
 import { resetTestDbPath } from '../test-utils/db-path';
 import {
@@ -131,7 +131,8 @@ describe('Hook Executor', () => {
         vps_ip: '10.0.0.1',
       });
 
-      expect(result).toEqual({ api_key: 'test-key-for-10.0.0.1' });
+      // Void hook: no outputs. The envelope carries an empty record.
+      expect(result).toEqual({});
       expect(messages).toContainEqual({ level: 'info', message: 'Starting test hook' });
       expect(messages).toContainEqual({ level: 'success', message: 'Test hook completed' });
     });
@@ -347,18 +348,53 @@ describe('Hook Executor', () => {
       getDb().insert(systemConfig).values({ key: 'hooks.jail_policy', value }).run();
     };
 
-    const runVoidHook = (): Promise<Record<string, unknown>> => {
+    // The per-module row is keyed by module id, but the executor is handed
+    // the module's tree — the join the production read makes (task 1.4). The
+    // path is fake: nothing in this describe touches the filesystem beyond
+    // the scratch DB, and `existsSync(scriptPath)` fails before any policy
+    // read when it is not fake.
+    const moduleTree = (): string => join(dir, 'modules', 'fixture-module');
+    const plantModulePolicyRow = (moduleId: string, policy: string): void => {
+      getDb()
+        .insert(modules)
+        .values({
+          id: moduleId,
+          name: moduleId,
+          version: '1.0.0',
+          manifestData: {},
+          sourcePath: moduleTree(),
+        })
+        .run();
+      // Raw SQL, not the drizzle table, on purpose: the drizzle type only
+      // accepts 'auto' | 'off' | 'required', and the bad-value test models a
+      // row that arrived past every typed writer — a restore or a hand edit,
+      // the untrusted path the resolver throws on (Rule 3.7).
+      getDb()
+        .$client.prepare('INSERT INTO module_jail_policies (module_id, policy) VALUES (?, ?)')
+        .run(moduleId, policy);
+    };
+
+    const runVoidHook = (moduleTree?: string): Promise<Record<string, unknown>> => {
       const { logger } = createCapturingLogger();
-      return executeHookScript(join(FIXTURES_DIR, 'void-hook.ts'), {
-        config: configStore(),
-        secrets: secretStore(),
-        systems: [],
-        logger,
-        debug: false,
-        screenshotDir: '/tmp',
-        stateDir: '/tmp',
-        capabilities: {},
-      });
+      return executeHookScript(
+        join(FIXTURES_DIR, 'void-hook.ts'),
+        {
+          config: configStore(),
+          secrets: secretStore(),
+          systems: [],
+          logger,
+          debug: false,
+          screenshotDir: '/tmp',
+          stateDir: '/tmp',
+          capabilities: {},
+        },
+        {
+          // Absent means the system-config-only path: exactly what the tests
+          // above exercise. Present means the executor reads the module's row
+          // and resolves through it.
+          jail: moduleTree === undefined ? undefined : { modulePath: moduleTree, pathInputs: [] },
+        },
+      );
     };
 
     beforeEach(async () => {
@@ -413,6 +449,45 @@ describe('Hook Executor', () => {
       // resolver falls through to the default, which jails nobody.
       await expect(runVoidHook()).resolves.toBeDefined();
     });
+
+    test('the module row beats system config (per-module-jail-policy task 1.4)', async () => {
+      // System says jail hard; the module is exempted. The exempted module's
+      // hook runs unjailed while every other module of this host would fail —
+      // the spec's own "A module runs unjailed while the fleet is jailed".
+      plantPolicyRow('required');
+      plantModulePolicyRow('exempted-module', 'off');
+      await expect(runVoidHook(moduleTree())).resolves.toBeDefined();
+      // And the same host still jails a module with no row: `required` with
+      // no jail backend is a hard failure, so the system row stays in force.
+      // Which surface the failure takes is host-determined, and both prove
+      // the hook did not run: on a host with a jail backend it dies at mount
+      // planning (the fake module tree does not exist, "cannot be built");
+      // on a host with no backend it dies at backend detection ("no hook
+      // jail is available"). The point under test is policy precedence, not
+      // the surface. (celilo#1342: the CI runner has no bubblewrap, so the
+      // mount-planning surface is unreachable there.)
+      await expect(runVoidHook(join(dir, 'modules', 'other-module'))).rejects.toThrow(
+        /cannot be built|no hook jail is available/,
+      );
+    });
+
+    test('a bad per-module row fails the hook instead of running it unjailed', async () => {
+      plantModulePolicyRow('broken-module', 'alwayssafe');
+      await expect(runVoidHook(moduleTree())).rejects.toThrow(/module's jail policy='alwayssafe'/);
+    });
+
+    test('env beats a conflicting module row', async () => {
+      plantModulePolicyRow('exempted-module', 'off');
+      process.env.CELILO_HOOK_JAIL = 'required';
+      // The point is that the env overrode the module's `off`, so the hook
+      // is jailed and fails, not exempted and successful. Which failure it
+      // hits is host-determined: mount planning (the fake module tree does
+      // not exist) on a host with a jail backend, backend detection on a
+      // host without one. Either proves the hook did not run.
+      await expect(runVoidHook(moduleTree())).rejects.toThrow(
+        /cannot be built|no hook jail is available/,
+      );
+    });
   });
 
   describe('resolveHookTimeouts', () => {
@@ -548,7 +623,9 @@ describe('Hook Executor', () => {
       );
 
       expect(result.success).toBe(true);
-      expect(result.outputs).toEqual({ api_key: 'test-key-for-10.0.0.5' });
+      // Hook return values are no longer consumed (hook-owned-state D5): a
+      // void hook's outputs are empty, and nothing persists them.
+      expect(result.outputs).toEqual({});
       expect(result.duration).toBeGreaterThanOrEqual(0);
       expect(messages.some((m) => m.message.includes('completed successfully'))).toBe(true);
     });

package/src/hooks/executor.ts

@@ -366,6 +366,32 @@ function readStoredJailPolicy(): string | undefined {
   return row?.value;
 }
 
+/**
+ * The module's own recorded jail policy, or undefined when there is no row
+ * (per-module-jail-policy task 1.4). The system-key read stays its own
+ * function because the two answers come from different tables.
+ *
+ * The executor is handed the module's tree, `options.jail.modulePath`, which
+ * is `mod.sourcePath` — not its id, which the caller holds. The row is found
+ * the way the jail inputs identify the module: by joining `modules` on
+ * `source_path`, the exact string the caller passed, so no second identity
+ * is invented and none of invokeHook's callers need plumbing. Absent jail
+ * inputs (an invocation that cannot be jailed) also means no module identity
+ * and no module row to read.
+ *
+ * A bad stored value is not coerced here — `resolveJailPolicy` throws on it,
+ * the same rule the system key follows (peba's ruling on ce-8832).
+ */
+function readStoredModuleJailPolicy(modulePath: string | undefined): string | undefined {
+  if (!modulePath || !existsSync(getDbPath())) return undefined;
+  const row = getDb()
+    .$client.prepare(
+      'SELECT p.policy AS policy FROM module_jail_policies p JOIN modules m ON m.id = p.module_id WHERE m.source_path = ?',
+    )
+    .get(modulePath) as { policy: string } | undefined;
+  return row?.policy;
+}
+
 /**
  * Execute a hook script
  *
@@ -430,7 +456,11 @@ export async function executeHookScript(
       [process.execPath, HOOK_RUNNER_SPAWN_PATH],
       mountSet,
       detectJailBackend(),
-      resolveJailPolicy(process.env.CELILO_HOOK_JAIL, readStoredJailPolicy()).policy,
+      resolveJailPolicy(
+        process.env.CELILO_HOOK_JAIL,
+        readStoredModuleJailPolicy(options.jail?.modulePath),
+        readStoredJailPolicy(),
+      ).policy,
     );
     reportJail(jail, logger);
     // Only a real module hook says anything about whether this HOST jails. An

package/src/hooks/hook-jail-toolchain-reach.test.ts

@@ -31,7 +31,7 @@
  */
 
 import { describe, expect, test } from 'bun:test';
-import { existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { executeHookScript } from './executor';
@@ -132,7 +132,7 @@ async function measureReach(): Promise<{ reach: Reach; cleanup: () => void }> {
   const savedPolicy = process.env.CELILO_HOOK_JAIL;
   process.env.CELILO_HOOK_JAIL = 'required';
   try {
-    const reach = (await executeHookScript(PROBE_HOOK, context, {
+    await executeHookScript(PROBE_HOOK, context, {
       timeoutMs: 60_000,
       idleTimeoutMs: 60_000,
       jail: {
@@ -145,7 +145,12 @@ async function measureReach(): Promise<{ reach: Reach; cleanup: () => void }> {
           ? [{ name: 'browser_executable', value: probeBrowserDir(), access: 'read' as const }]
           : [],
       },
-    })) as unknown as Reach;
+    });
+    // The fixture hands its report through the state directory: hook return
+    // values are no longer carried anywhere (hook-owned-state D5).
+    const reach = JSON.parse(
+      readFileSync(join(stateDir, 'report.json'), 'utf-8'),
+    ) as unknown as Reach;
 
     return { reach, cleanup: restorePolicy };
   } catch (error) {

package/src/hooks/hook-jail-unreachability.test.ts

@@ -33,7 +33,7 @@ import { join, resolve } from 'node:path';
 /** Uniquely named so it never collides with a real key on a jailed dev box. */
 const PLANTED_KEY_NAME = 'id_celilo_jail_probe';
 import { executeHookScript } from './executor';
-import { detectJailBackend, jailPolicy } from './jail';
+import { detectJailBackend } from './jail';
 import { createCapturingLogger } from './logger';
 import { configStore, secretStore } from './test-fixtures/store-backed';
 import type { HookContext } from './types';
@@ -46,12 +46,15 @@ interface Probe {
 }
 
 const availability = detectJailBackend();
-// A host with a backend is not a host that JAILS: `CELILO_HOOK_JAIL=off` is an
-// operator switch and the executor honours it, so without this the suite runs
-// its assertions against a deliberately unjailed hook and reports the jail
-// broken. Only reachable since macOS gained a backend (task 4.8) — before that
-// every Mac skipped for want of one and the hole never showed.
-const jailed = availability.backend !== 'none' && jailPolicy() !== 'off';
+// Gated on the BACKEND alone, not on `jailPolicy()`. The ambient policy is an
+// operator switch (`CELILO_HOOK_JAIL=off` is the default), and reading it here
+// made the suite skip on every host with the default — measuring nothing, on
+// any platform, forever. The suite does not need the operator's blessing: it
+// sets the policy to `required` inside `runProbe()` and restores it after, so
+// the jail under test is this suite's own act, deterministic wherever a
+// backend exists. (celilo#1359: since the default became `off`, all three
+// jailed suites skipped everywhere.)
+const jailed = availability.backend !== 'none';
 
 interface Rig {
   outputs: {
@@ -66,6 +69,9 @@ interface Rig {
   cleanup: () => void;
 }
 
+/** Where the probe fixture hands its report to the parent (hook-owned-state D5). */
+const REPORT_PATH = 'report.json';
+
 /**
  * Lay out a module store the way celilo does, run the probe hook against it,
  * and hand back both the hook's report and the paths so the parent can check
@@ -131,14 +137,19 @@ async function runProbe(): Promise<Rig> {
   const savedPolicy = process.env.CELILO_HOOK_JAIL;
   process.env.CELILO_HOOK_JAIL = 'required';
   try {
-    const outputs = (await executeHookScript(PROBE_HOOK, context, {
+    await executeHookScript(PROBE_HOOK, context, {
       timeoutMs: 60_000,
       idleTimeoutMs: 60_000,
       jail: {
         modulePath,
         pathInputs: [{ name: 'staged_input', value: stagedInput, access: 'write' }],
       },
-    })) as unknown as Rig['outputs'];
+    });
+    // The fixture hands its report through the state directory: hook return
+    // values are no longer carried anywhere (hook-owned-state D5).
+    const outputs = JSON.parse(
+      readFileSync(join(stateDir, REPORT_PATH), 'utf-8'),
+    ) as unknown as Rig['outputs'];
     return {
       outputs,
       stagedInput,
@@ -208,18 +219,14 @@ describe.skipIf(!jailed)(`the jail is real (backend: ${availability.backend})`,
 describe.skipIf(jailed)('this run is not jailed', () => {
   test('says so, rather than reporting a pass it did not earn', () => {
     // Not an assertion about the product. It is the line that stops a green
-    // run on an unjailed host reading as "the jail was proven".
-    const why =
-      availability.backend === 'none'
-        ? (availability.reason ?? 'no backend')
-        : `CELILO_HOOK_JAIL=${process.env.CELILO_HOOK_JAIL}, so the operator switched the ${availability.backend} jail off here`;
+    // run on a backend-less host reading as "the jail was proven". The only
+    // way here is `backend === 'none'` — an operator who set the policy off
+    // does NOT land in this companion, because the live suite above now pins
+    // the policy itself and runs anyway (celilo#1359).
+    const why = availability.reason ?? 'no backend';
     console.log(
-      `\nhook jail: SKIPPED the live suite — ${why}\nThese properties are proven wherever a backend is available and enabled. The hermetic half runs everywhere (jail.test.ts).`,
+      `\nhook jail: SKIPPED the live suite — ${why}\nThese properties are proven wherever a jail backend is available. The hermetic half runs everywhere (jail.test.ts).`,
     );
-    // Both reasons are legitimate and they are different facts, so assert the
-    // disjunction rather than one of them. Asserting `backend === 'none'` alone
-    // went red the day macOS got a backend AND the operator turned it off — a
-    // combination that is not a defect in anything.
-    expect(availability.backend === 'none' || jailPolicy() === 'off').toBe(true);
+    expect(availability.backend === 'none').toBe(true);
   });
 });

package/src/hooks/hook-trespass.test.ts

@@ -33,7 +33,7 @@ import {
 } from '../../../../scripts/workspace-fallback';
 import { CLI_BIN_DIR, childPath, executeHookScript, hookChildEnv } from './executor';
 import { HOOK_PROTOCOL_VERSION } from './hook-protocol';
-import { detectJailBackend, jailPolicy } from './jail';
+import { detectJailBackend } from './jail';
 import { createCapturingLogger } from './logger';
 import { configStore, secretStore } from './test-fixtures/store-backed';
 import type { HookContext } from './types';
@@ -155,14 +155,16 @@ afterAll(() => {
 
 async function runTrespass(jail = false): Promise<{ report: TrespassReport; lines: string[] }> {
   const { logger, messages } = createCapturingLogger();
+  const screenshotDir = mkdtempSync(join(tmpdir(), 'celilo-trespass-artifacts-'));
+  const stateDir = mkdtempSync(join(tmpdir(), 'celilo-trespass-artifacts-'));
   const context: HookContext = {
     config: configStore({ sibling_module_id: 'hello-foo', other_system_ip: '' }),
     secrets: secretStore(),
     systems: [],
     logger,
     debug: false,
-    screenshotDir: mkdtempSync(join(tmpdir(), 'celilo-trespass-artifacts-')),
-    stateDir: mkdtempSync(join(tmpdir(), 'celilo-trespass-artifacts-')),
+    screenshotDir,
+    stateDir,
     capabilities: {},
   };
 
@@ -173,7 +175,7 @@ async function runTrespass(jail = false): Promise<{ report: TrespassReport; line
   const savedPolicy = process.env.CELILO_HOOK_JAIL;
   if (jail) process.env.CELILO_HOOK_JAIL = 'required';
   try {
-    const outputs = await executeHookScript(TRESPASS_SCRIPT, context, {
+    await executeHookScript(TRESPASS_SCRIPT, context, {
       timeoutMs: 60_000,
       idleTimeoutMs: 60_000,
       // The module's own tree, two levels above the hook script. Absent means
@@ -181,12 +183,19 @@ async function runTrespass(jail = false): Promise<{ report: TrespassReport; line
       ...(jail ? { jail: { modulePath: dirname(dirname(TRESPASS_SCRIPT)), pathInputs: [] } } : {}),
     });
     return {
-      report: outputs as unknown as TrespassReport,
+      // The fixture hands its report through the state directory the jail
+      // binds read-write: the same channel works jailed and unjailed (D5
+      // removed the return channel).
+      report: JSON.parse(
+        readFileSync(join(stateDir, 'report.json'), 'utf-8'),
+      ) as unknown as TrespassReport,
       lines: messages.map((m) => m.message),
     };
   } finally {
     if (savedPolicy === undefined) delete process.env.CELILO_HOOK_JAIL;
     else process.env.CELILO_HOOK_JAIL = savedPolicy;
+    rmSync(screenshotDir, { recursive: true, force: true });
+    rmSync(stateDir, { recursive: true, force: true });
   }
 }
 
@@ -302,7 +311,14 @@ describe('hook process boundary — hello-trespass gate', () => {
 });
 
 const availability = detectJailBackend();
-const jailed = availability.backend !== 'none' && jailPolicy() !== 'off';
+// Gated on the BACKEND alone, not on `jailPolicy()`. The ambient policy is an
+// operator switch (`CELILO_HOOK_JAIL=off` is the default), and reading it here
+// made stage 2 skip on every host with the default — measuring nothing. The
+// jailed run pins the policy to `required` inside `runTrespass(true)` and
+// restores it after, so the jail under test is this suite's own act wherever a
+// backend exists. (celilo#1359: since the default became `off`, all three
+// jailed suites skipped everywhere.)
+const jailed = availability.backend !== 'none';
 
 describe.skipIf(!jailed)(
   `stage 2: the same hook, jailed (backend: ${availability.backend})`,