@celilo/cli 2.3.0 → 3.0.0

package/src/services/health-runner.ts

@@ -15,7 +15,7 @@ import { createHookStores } from '../hooks/hook-store';
 import { loadHookConfigMap } from '../hooks/load-hook-config';
 import { createCapturingLogger, createConsoleLogger, createGaugeLogger } from '../hooks/logger';
 import type { HookLogger, HookResult } from '../hooks/types';
-import type { ModuleManifest } from '../manifest/schema';
+import type { HealthWaiver, ModuleManifest } from '../manifest/schema';
 import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
 import { controlPlaneHealthChecks } from './control-plane-health';
@@ -51,12 +51,26 @@ export interface HealthCheckResult {
    * watching to re-run the check by hand.
    */
   artifactPaths?: string[];
+  /**
+   * The module's recorded health waiver, if its manifest declares one
+   * (openspec/changes/health-waiver-mechanism). It does not change this
+   * result's severity — an unmeasured module stays unmeasured — it
+   * annotates the finding with who decided and why.
+   */
+  waiver?: HealthWaiver;
 }
 
 export interface HealthCheckOptions {
   debug?: boolean;
   noInteractive?: boolean;
   onProgress?: (msg: string) => void;
+  /**
+   * Presentation-only silence: no gauge and no plain stdout lines, hook
+   * output captured instead. Unlike `unattended` this does NOT touch the
+   * state-transition guard — a `--json` command still runs real checks
+   * and still moves lifecycle state (celilo#1362).
+   */
+  quiet?: boolean;
   /**
    * Scheduled/monitor-driven run: no FuelGauge, no stdout, and — the part
    * that matters beyond cosmetics — the module's lifecycle state is NOT
@@ -105,6 +119,15 @@ function createHealthCheckPresentation(
     return { logger: createCapturingLogger().logger, finish: NO_OP_FINISH };
   }
 
+  // Non-interactive stdout (redirected, piped, or an explicit --json
+  // caller): stdout is a data channel here (celilo#699), so neither the
+  // gauge's frames nor the gauge logger's plain lines may reach it.
+  // Capture everything instead (celilo#1362). State transitions still
+  // happen — only the presentation goes quiet.
+  if (options.quiet || !process.stdout.isTTY) {
+    return { logger: createCapturingLogger().logger, finish: NO_OP_FINISH };
+  }
+
   const gauge = new FuelGauge('Testing app', { skipAnimation: options.noInteractive });
   gauge.start();
   return {
@@ -178,7 +201,7 @@ export async function runModuleHealthCheck(
   const hookDef = manifest.hooks?.health_check;
 
   if (!hookDef) {
-    return { moduleId, status: 'no-checks', checks: [] };
+    return { moduleId, status: 'no-checks', checks: [], waiver: manifest.health_waiver };
   }
 
   // Build config + secrets for hook context. The config map shape
@@ -245,7 +268,15 @@ export async function runModuleHealthCheck(
   };
 
   const checks = outputs.checks || [];
-  return finishHealthCheck(moduleId, module.state, checks, db, options, hookResult.artifactPaths);
+  return finishHealthCheck(
+    moduleId,
+    module.state,
+    checks,
+    db,
+    options,
+    hookResult.artifactPaths,
+    manifest.health_waiver,
+  );
 }
 
 /**
@@ -277,6 +308,7 @@ function finishHealthCheck(
   db: DbClient,
   options: HealthCheckOptions,
   artifactPaths?: string[],
+  waiver?: HealthWaiver,
 ): HealthCheckResult {
   const status = deriveHealthStatus(checks);
 
@@ -298,7 +330,13 @@ function finishHealthCheck(
       .run();
   }
 
-  return { moduleId, status, checks, ...(artifactPaths ? { artifactPaths } : {}) };
+  return {
+    moduleId,
+    status,
+    checks,
+    ...(artifactPaths ? { artifactPaths } : {}),
+    ...(waiver ? { waiver } : {}),
+  };
 }
 
 /**
@@ -343,7 +381,7 @@ async function mapConcurrent<T, R>(
  */
 export async function runAllHealthChecks(
   db: DbClient,
-  options: { debug?: boolean; onProgress?: (msg: string) => void } = {},
+  options: { debug?: boolean; onProgress?: (msg: string) => void; quiet?: boolean } = {},
 ): Promise<HealthCheckResult[]> {
   const eligible = db
     .select()

package/src/services/module-deploy-prune.test.ts

@@ -0,0 +1,89 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isPreservedGeneratedPath, pruneGeneratedProject } from './module-deploy';
+
+const ROOT = '/tmp/celilo-prune-test';
+const GENERATED = join(ROOT, 'generated');
+
+/**
+ * Mirrors the layout observed on celilo-mgr at 2026-09-16T00:51Z:
+ * `generated/{ansible,deploy.log,terraform}` with state inside terraform/.
+ * Derived from the real tree rather than invented — a hand-written mirror gives
+ * confident results about a world that does not exist.
+ */
+function buildGeneratedTree(): void {
+  mkdirSync(join(GENERATED, 'ansible', 'roles'), { recursive: true });
+  mkdirSync(join(GENERATED, 'terraform', '.terraform', 'providers'), { recursive: true });
+
+  writeFileSync(join(GENERATED, 'deploy.log'), 'deploy output');
+  writeFileSync(join(GENERATED, 'ansible', 'secrets.yml'), 'vault-encrypted secrets');
+  writeFileSync(join(GENERATED, 'ansible', 'roles', 'task.yml'), 'rendered task');
+  writeFileSync(join(GENERATED, 'terraform', 'main.tf'), 'rendered terraform');
+  writeFileSync(join(GENERATED, 'terraform', 'terraform.tfvars'), 'rendered vars');
+  writeFileSync(join(GENERATED, 'terraform', 'terraform.tfstate'), '{"lxc":207}');
+  writeFileSync(join(GENERATED, 'terraform', 'terraform.tfstate.backup'), '{"lxc":207,"old":1}');
+  writeFileSync(join(GENERATED, 'terraform', '.terraform.lock.hcl'), 'provider lock');
+  writeFileSync(join(GENERATED, 'terraform', '.terraform', 'providers', 'bin'), 'huge binary');
+}
+
+beforeEach(() => {
+  rmSync(ROOT, { recursive: true, force: true });
+  buildGeneratedTree();
+});
+
+afterEach(() => {
+  rmSync(ROOT, { recursive: true, force: true });
+});
+
+describe('pruneGeneratedProject', () => {
+  // The recurrence gate for celilo#1374's root cause. Deleting this file is
+  // what armed every container module for destruction on its next deploy.
+  test('keeps terraform state and its lock', () => {
+    pruneGeneratedProject(GENERATED);
+
+    expect(existsSync(join(GENERATED, 'terraform', 'terraform.tfstate'))).toBe(true);
+    expect(existsSync(join(GENERATED, 'terraform', 'terraform.tfstate.backup'))).toBe(true);
+    expect(existsSync(join(GENERATED, 'terraform', '.terraform.lock.hcl'))).toBe(true);
+    // Intact, not merely present.
+    expect(readFileSync(join(GENERATED, 'terraform', 'terraform.tfstate'), 'utf-8')).toBe(
+      '{"lxc":207}',
+    );
+  });
+
+  // D4's actual concern. If this ever passes, the fix has quietly become
+  // "persist the rendered project", which D4 refused for good reasons.
+  test('still deletes every rendered template and secret', () => {
+    pruneGeneratedProject(GENERATED);
+
+    expect(existsSync(join(GENERATED, 'ansible'))).toBe(false);
+    expect(existsSync(join(GENERATED, 'deploy.log'))).toBe(false);
+    expect(existsSync(join(GENERATED, 'terraform', 'main.tf'))).toBe(false);
+    expect(existsSync(join(GENERATED, 'terraform', 'terraform.tfvars'))).toBe(false);
+  });
+
+  // ~19 MB per provider, rebuilt by `terraform init`; excluded from the backup
+  // envelope for the same reason (cross-module-read.ts).
+  test('drops the provider cache', () => {
+    pruneGeneratedProject(GENERATED);
+
+    expect(existsSync(join(GENERATED, 'terraform', '.terraform'))).toBe(false);
+  });
+
+  // A deploy that failed before rendering never made one.
+  test('is a no-op when generated/ is absent', () => {
+    rmSync(GENERATED, { recursive: true, force: true });
+
+    expect(() => pruneGeneratedProject(GENERATED)).not.toThrow();
+  });
+});
+
+describe('isPreservedGeneratedPath', () => {
+  test('preserves only state files directly under terraform/', () => {
+    expect(isPreservedGeneratedPath('terraform/terraform.tfstate')).toBe(true);
+    expect(isPreservedGeneratedPath('terraform/main.tf')).toBe(false);
+    expect(isPreservedGeneratedPath('ansible/terraform.tfstate')).toBe(false);
+    // A nested lookalike must not smuggle a whole tree through.
+    expect(isPreservedGeneratedPath('terraform/nested/terraform.tfstate')).toBe(false);
+  });
+});

package/src/services/module-deploy.ts

@@ -4,7 +4,7 @@
  * Coordinates full module deployment workflow across all phases
  */
 
-import { rmSync } from 'node:fs';
+import { existsSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { ProgressDisplay } from '@celilo/cli-display';
 import { and, eq } from 'drizzle-orm';
@@ -337,6 +337,61 @@ async function backfillArrivedProvider(moduleId: string, db: DbClient): Promise<
  * alerting, etc. — can react. Bus emit failures are best-effort and
  * never affect the deploy outcome.
  */
+/**
+ * Files under `generated/terraform/` that outlive the deploy.
+ *
+ * D4 (control-plane-stops-building-modules) deletes `generated/` because it
+ * holds RENDERED templates and secrets — a tree nothing can validate and what a
+ * later deploy would wrongly ship. Terraform state is neither. It is the record
+ * of what celilo actually BUILT, and `templates/generator.ts` calls it
+ * "celilo's authoritative record of placement (ISS-0090)".
+ *
+ * Deleting it meant the next deploy started from empty state, failed to create
+ * a container that already existed, auto-imported it, and planned a REPLACE —
+ * destroying the container it was asked to converge (celilo#1374, which
+ * destroyed signal's LXC and its signal-cli device identity).
+ *
+ * `.terraform/` is NOT preserved: it is the provider binary cache, ~19 MB per
+ * provider, rebuilt by `terraform init`. `cross-module-read.ts` excludes it from
+ * the backup envelope for the same reason.
+ */
+export const PRESERVED_GENERATED_FILES = [
+  'terraform.tfstate',
+  'terraform.tfstate.backup',
+  '.terraform.lock.hcl',
+];
+
+/** True for the paths, relative to `generated/`, that survive the cleanup. */
+export function isPreservedGeneratedPath(relativePath: string): boolean {
+  const [dir, file, ...rest] = relativePath.split('/');
+  if (dir !== 'terraform' || rest.length > 0) return false;
+  return file !== undefined && PRESERVED_GENERATED_FILES.includes(file);
+}
+
+/**
+ * Delete the rendered project but keep terraform's record of what exists.
+ * Absent `generated/` is not an error — a deploy that failed early never made
+ * one.
+ */
+export function pruneGeneratedProject(generatedPath: string): void {
+  if (!existsSync(generatedPath)) return;
+
+  for (const entry of readdirSync(generatedPath, { withFileTypes: true })) {
+    if (entry.name !== 'terraform') {
+      rmSync(join(generatedPath, entry.name), { recursive: true, force: true });
+    }
+  }
+
+  const terraformDir = join(generatedPath, 'terraform');
+  if (!existsSync(terraformDir)) return;
+
+  for (const entry of readdirSync(terraformDir, { withFileTypes: true })) {
+    if (!isPreservedGeneratedPath(`terraform/${entry.name}`)) {
+      rmSync(join(terraformDir, entry.name), { recursive: true, force: true });
+    }
+  }
+}
+
 export async function deployModule(
   moduleId: string,
   db: DbClient,
@@ -392,8 +447,10 @@ export async function deployModule(
       if (deployed) {
         const generatedPath = `${deployed.sourcePath}/generated`;
         try {
-          rmSync(generatedPath, { recursive: true, force: true });
-          log.info(`Removed generated/ for '${moduleId}' (ephemeral by design; --keep retains it)`);
+          pruneGeneratedProject(generatedPath);
+          log.info(
+            `Removed generated/ for '${moduleId}' (terraform state preserved; --keep retains all)`,
+          );
         } catch (cleanupError) {
           const msg = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
           log.warn(`Failed to remove generated/ for '${moduleId}': ${msg}`);
@@ -907,48 +964,10 @@ async function deployModuleImpl(
           };
         }
 
-        // Store hook outputs as secrets (e.g., refresh_token from OAuth flow)
-        if (Object.keys(hookResult.outputs).length > 0) {
-          const { secrets: secretsTable } = await import('../db/schema');
-          const { encryptSecret } = await import('../secrets/encryption');
-          const { and: andOp, eq: eqOp } = await import('drizzle-orm');
-          for (const [key, value] of Object.entries(hookResult.outputs)) {
-            if (typeof value === 'string') {
-              const masterKeyForOutputs = await getOrCreateMasterKey();
-              const encrypted = encryptSecret(value, masterKeyForOutputs);
-
-              // Check if secret already exists (no unique constraint on module_id+name)
-              const existing = db
-                .select()
-                .from(secretsTable)
-                .where(andOp(eqOp(secretsTable.moduleId, moduleId), eqOp(secretsTable.name, key)))
-                .get();
-
-              if (existing) {
-                db.update(secretsTable)
-                  .set({
-                    encryptedValue: encrypted.encryptedValue,
-                    iv: encrypted.iv,
-                    authTag: encrypted.authTag,
-                    updatedAt: new Date(),
-                  })
-                  .where(eqOp(secretsTable.id, existing.id))
-                  .run();
-              } else {
-                db.insert(secretsTable)
-                  .values({
-                    moduleId,
-                    name: key,
-                    encryptedValue: encrypted.encryptedValue,
-                    iv: encrypted.iv,
-                    authTag: encrypted.authTag,
-                  })
-                  .run();
-              }
-              log.success(`Stored hook output: ${key}`);
-            }
-          }
-        }
+        // Hook return values are no longer persisted (hook-owned-state D5):
+        // a hook that needs to persist state does so explicitly through the
+        // `context.config` / `context.secrets` accessors inside its own
+        // process. Nothing here sweeps `hookResult.outputs` into secrets.
 
         gauge.stop(true);
       } catch (error) {
@@ -1352,45 +1371,11 @@ async function deployModuleImpl(
           };
         }
 
-        // Store hook outputs as secrets on the PROVIDER module
-        if (Object.keys(hookResult.outputs).length > 0) {
-          const { secrets: st } = await import('../db/schema');
-          const { encryptSecret } = await import('../secrets/encryption');
-          for (const [key, value] of Object.entries(hookResult.outputs)) {
-            if (typeof value === 'string') {
-              const mk = await getOrCreateMasterKey();
-              const encrypted = encryptSecret(value, mk);
-              const existing = db
-                .select()
-                .from(st)
-                .where(and(eq(st.moduleId, capRecord.moduleId), eq(st.name, key)))
-                .get();
-
-              if (existing) {
-                db.update(st)
-                  .set({
-                    encryptedValue: encrypted.encryptedValue,
-                    iv: encrypted.iv,
-                    authTag: encrypted.authTag,
-                    updatedAt: new Date(),
-                  })
-                  .where(eq(st.id, existing.id))
-                  .run();
-              } else {
-                db.insert(st)
-                  .values({
-                    moduleId: capRecord.moduleId,
-                    name: key,
-                    encryptedValue: encrypted.encryptedValue,
-                    iv: encrypted.iv,
-                    authTag: encrypted.authTag,
-                  })
-                  .run();
-              }
-              log.success(`Stored ${capRecord.moduleId} hook output: ${key}`);
-            }
-          }
-        }
+        // The return-value channel is gone (hook-owned-state D5/D3): hook
+        // outputs are no longer persisted anywhere. A provider secret the
+        // framework itself must record goes through the named
+        // `recordProviderSecret` path (secrets/storage.ts) — never through a
+        // hook return value.
 
         gauge.stop(true);
       }
@@ -1678,47 +1663,9 @@ async function deployModuleImpl(
           };
         }
 
-        // Persist on_install string outputs as secrets on this module — same
-        // as the validate_config / container_created paths above. caddy relies
-        // on this to publish its firewall external IP (`public_ip`) so
-        // public_web.register_route can point a new hostname's public A record
-        // at it (M1 / #328).
-        if (Object.keys(installResult.outputs).length > 0) {
-          const { secrets: st } = await import('../db/schema');
-          const { encryptSecret } = await import('../secrets/encryption');
-          const mk = await getOrCreateMasterKey();
-          for (const [key, value] of Object.entries(installResult.outputs)) {
-            if (typeof value !== 'string') continue;
-            const encrypted = encryptSecret(value, mk);
-            const existing = db
-              .select()
-              .from(st)
-              .where(and(eq(st.moduleId, moduleId), eq(st.name, key)))
-              .get();
-            if (existing) {
-              db.update(st)
-                .set({
-                  encryptedValue: encrypted.encryptedValue,
-                  iv: encrypted.iv,
-                  authTag: encrypted.authTag,
-                  updatedAt: new Date(),
-                })
-                .where(eq(st.id, existing.id))
-                .run();
-            } else {
-              db.insert(st)
-                .values({
-                  moduleId,
-                  name: key,
-                  encryptedValue: encrypted.encryptedValue,
-                  iv: encrypted.iv,
-                  authTag: encrypted.authTag,
-                })
-                .run();
-            }
-            log.success(`Stored hook output: ${key}`);
-          }
-        }
+        // Hook return values are no longer persisted (hook-owned-state D5).
+        // caddy's `public_ip` moved to `context.config.set` + a config read
+        // (task 5.1); no other hook may rely on its return reaching the store.
       }
 
       // Transition to INSTALLED; see the first transition for errorMessage (celilo#1363).

package/src/services/module-types-drift.test.ts

@@ -8,7 +8,7 @@
  * committed types file is not regenerated, this test fails.
  *
  * Scope: `modules/<id>/manifest.yml` at the repo root. Archived
- * modules (`modules/archive/**`) and scratch extract dirs
+ * modules (`modules/__archive__/**`) and scratch extract dirs
  * (`modules/.tmp-*`) are excluded — they are not active modules.
  */
 

package/src/services/module-validator/capability-versions.test.ts

@@ -14,11 +14,15 @@ describe('validateCapabilityVersions', () => {
   });
 
   test('no errors when provides matches the runtime registry exactly', () => {
+    // Read from the registry, not pinned to a literal (see the comment on the
+    // "differs from runtime" test below — the registry moves, the test is
+    // about matching it).
+    const runtime = CAPABILITY_CONTRACT_VERSIONS.public_web;
     expect(
       validateCapabilityVersions({
         id: 'caddy',
         version: '3.0.0',
-        provides: { capabilities: [{ name: 'public_web', version: '3.0.0' }] },
+        provides: { capabilities: [{ name: 'public_web', version: runtime }] },
       }),
     ).toEqual([]);
   });
@@ -40,10 +44,17 @@ describe('validateCapabilityVersions', () => {
   });
 
   test('error when provides[X].version is newer than runtime', () => {
+    // One minor above the registry is newer without being a different major,
+    // which is what this case tests. Computed from the registry so the test
+    // stays a behaviour test as the registry moves.
+    const [maj, min, pat] = CAPABILITY_CONTRACT_VERSIONS.public_web
+      .split('.')
+      .map((n) => Number.parseInt(n, 10));
+    const tooNew = `${maj}.${(min ?? 0) + 1}.${pat ?? 0}`;
     const errors = validateCapabilityVersions({
       id: 'caddy',
       version: '4.0.0',
-      provides: { capabilities: [{ name: 'public_web', version: '4.0.0' }] },
+      provides: { capabilities: [{ name: 'public_web', version: tooNew }] },
     });
     expect(errors).toHaveLength(1);
     expect(errors[0]).toContain('provides[public_web]');

package/src/services/terraform-safety.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, test } from 'bun:test';
+import { planAfterImportVerdict, validateTerraformPlanSafety } from './terraform-safety';
+
+/**
+ * The plan terraform actually produced on celilo-mgr at 2026-09-16T00:04Z,
+ * after `module deploy signal` imported LXC 207 and re-planned. Abridged to the
+ * lines the parser reads, and kept verbatim otherwise: a fixture written from
+ * memory of the format would pass while the product still destroyed the box.
+ */
+const POST_IMPORT_REPLACEMENT_PLAN = `
+proxmox_lxc.signal: Refreshing state... [id=node3/lxc/207]
+
+Terraform used the selected providers to generate the following execution
+plan. Resource actions are indicated with the following symbols:
+-/+ destroy and then create replacement
+
+Terraform will perform the following actions:
+
+  # proxmox_lxc.signal must be replaced
+-/+ resource "proxmox_lxc" "signal" {
+      + ostemplate = "datacenter:vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst" # forces replacement
+      ~ rootfs {
+          + storage = "datacenter" # forces replacement
+        }
+    }
+
+Plan: 1 to add, 0 to change, 1 to destroy.
+`;
+
+const CLEAN_PLAN = `
+proxmox_lxc.signal: Refreshing state... [id=node3/lxc/207]
+
+No changes. Your infrastructure matches the configuration.
+`;
+
+const IN_PLACE_UPDATE_PLAN = `
+  # proxmox_lxc.signal will be updated in-place
+  ~ resource "proxmox_lxc" "signal" {
+      ~ memory = 1024 -> 2048
+    }
+
+Plan: 0 to add, 1 to change, 0 to destroy.
+`;
+
+describe('planAfterImportVerdict', () => {
+  // THE recurrence gate for celilo#1374. This exact plan was applied without
+  // validation and destroyed signal's container on a converged fleet. If this
+  // test ever passes the plan through, the defect is back.
+  test('refuses the replacement plan an import produces', () => {
+    const verdict = planAfterImportVerdict(2, POST_IMPORT_REPLACEMENT_PLAN);
+
+    expect(verdict.action).toBe('refuse');
+    if (verdict.action !== 'refuse') throw new Error('unreachable');
+    expect(verdict.error).toContain('after importing an existing resource');
+  });
+
+  // The outcome the recovery path is FOR: the import reconciled state with
+  // reality and there is nothing left to apply. Adopt, don't apply.
+  test('applies nothing when the post-import plan is clean', () => {
+    expect(planAfterImportVerdict(0, CLEAN_PLAN)).toEqual({ action: 'done' });
+  });
+
+  // A resize must still go through — refusing everything would be a different
+  // bug wearing the same fix (terraform-safety.ts rule 2, ISS-0055).
+  test('lets an in-place update through', () => {
+    expect(planAfterImportVerdict(2, IN_PLACE_UPDATE_PLAN)).toEqual({ action: 'apply' });
+  });
+
+  // An unreadable plan is not evidence of safety (D7).
+  test('refuses when the plan itself failed', () => {
+    const verdict = planAfterImportVerdict(1, 'Error: failed to refresh state');
+
+    expect(verdict.action).toBe('refuse');
+  });
+});
+
+describe('validateTerraformPlanSafety', () => {
+  // Characterises what was already true: the validator would have caught this.
+  // The defect was never a missing rule, it was a plan that never reached one.
+  test('already refuses a replacement — it was simply never asked', () => {
+    expect(validateTerraformPlanSafety(POST_IMPORT_REPLACEMENT_PLAN).safe).toBe(false);
+  });
+});

package/src/services/terraform-safety.ts

@@ -178,3 +178,56 @@ function formatUnsafeOperationError(action: TerraformAction): string {
 
   return lines.join('\n');
 }
+
+/** What the deploy should do with the plan computed AFTER an auto-import. */
+export type ImportRetryVerdict =
+  | { action: 'done' }
+  | { action: 'apply' }
+  | { action: 'refuse'; error: string };
+
+/**
+ * Decide whether the apply retried after an auto-import may proceed.
+ *
+ * An import REPLACES the plan that `deployTerraform` validated before its first
+ * apply. That plan described a create; the plan computed after the import can
+ * describe a REPLACE, because `ostemplate` and `rootfs[0].storage` do not
+ * round-trip through an import and each forces one. Nothing re-validated it, so
+ * the retry applied a destroy that `validateTerraformPlanSafety` exists to
+ * forbid — and a redeploy destroyed signal's LXC on a converged fleet
+ * (celilo#1374). The gate was present; the import walked around it.
+ *
+ * Pure (Rule 10) so the refusal is testable without terraform: the caller does
+ * the I/O and hands the exit code and output here.
+ */
+export function planAfterImportVerdict(exitCode: number, planOutput: string): ImportRetryVerdict {
+  // 0 = no changes. The import alone reconciled state with reality, which is
+  // the outcome we want: adopt the resource and apply nothing.
+  if (exitCode === 0) {
+    return { action: 'done' };
+  }
+
+  // 2 = changes pending. Anything else is an error, and an unreadable plan is
+  // never a licence to apply (D7: no measurement is not "no drift").
+  if (exitCode !== 2) {
+    return {
+      action: 'refuse',
+      error: `Refusing to apply after import: terraform plan failed (exit ${exitCode}).\n${planOutput.slice(0, 500)}`,
+    };
+  }
+
+  const safety = validateTerraformPlanSafety(planOutput);
+  if (!safety.safe) {
+    return {
+      action: 'refuse',
+      error: [
+        'Refusing to apply the plan computed after importing an existing resource.',
+        'The import adopted infrastructure that already exists, and applying this',
+        'plan would destroy it rather than adopt it.',
+        '',
+        safety.error ?? 'unsafe plan',
+      ].join('\n'),
+    };
+  }
+
+  return { action: 'apply' };
+}

package/src/services/update/orchestrator.test.ts

@@ -90,7 +90,7 @@ const cleanAudit: AuditDeps = {
   machinesReachable: { results: [] },
   diskSpace: { results: [] },
   transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
-  trustedSources: { firewalls: [] },
+  trustedSources: { firewalls: [], unreachableFirewalls: [] },
   publicDns: { records: [], probe: unusedPublicDnsProbe },
 };
 

package/tsconfig.json

@@ -1,21 +1,10 @@
 {
+  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
-    "target": "ESNext",
-    "module": "ESNext",
     "lib": ["ESNext"],
-    "moduleResolution": "bundler",
     "jsx": "react-jsx",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "resolveJsonModule": true,
-    "isolatedModules": true,
-    "types": ["bun-types"],
     "paths": {
       "@/*": ["./src/*"]
     }
-  },
-  "include": ["src/**/*", "test-integration/**/*"],
-  "exclude": ["node_modules"]
+  }
 }