@celilo/cli 3.1.0 → 4.1.0

package/src/cli/index.ts

@@ -65,6 +65,7 @@ import {
 import { handleMachineAdd } from './commands/machine-add';
 import { handleMachineEarmark } from './commands/machine-earmark';
 import { handleMachineList } from './commands/machine-list';
+import { handleMachineReclassify } from './commands/machine-reclassify';
 import { handleMachineRemove } from './commands/machine-remove';
 import { handleMachineStatus } from './commands/machine-status';
 import { moduleAudit } from './commands/module-audit';
@@ -132,6 +133,7 @@ import { handleSystemDoctor } from './commands/system-doctor';
 import { handleSystemEnsureFleetKey } from './commands/system-ensure-fleet-key';
 import { handleSystemInit } from './commands/system-init';
 import { handleSystemMigrate } from './commands/system-migrate';
+import { handleSystemReboot } from './commands/system-reboot';
 import { handleSystemSecretGet } from './commands/system-secret-get';
 import { handleSystemSecretSet } from './commands/system-secret-set';
 import { handleSystemUpdate } from './commands/system-update';
@@ -1097,6 +1099,10 @@ Examples:
   celilo machine earmark 10.0.10.10 caddy
   celilo machine earmark pi-01 --clear
 
+  # Re-classify stored interface zone labels after a zone-model change
+  celilo machine reclassify celilo-mgr
+  celilo machine reclassify celilo-mgr --apply
+
   # Remove machine (by hostname or IP)
   celilo machine remove pi-01
   celilo machine remove 10.0.10.10 --force
@@ -1214,6 +1220,11 @@ Subcommands:
 
   doctor [--fix]                       Diagnose system prerequisites and @celilo/* version drift
 
+  reboot [--allow-reboot] [--verify]   Reboot the management server. Refuses while a module
+                                       operation is in flight and names it. The process asking
+                                       dies in the reboot, so --verify is what confirms the host
+                                       came back: boot id changed, dispatcher live, CLI answering.
+
 Runbook:
   https://celilo.computer/docs/system-update
   (offline summary in apps/celilo/docs/INDEX.md)
@@ -2269,6 +2280,10 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
       return handleMachineEarmark(parsed.args, parsed.flags);
     }
 
+    if (parsed.subcommand === 'reclassify') {
+      return handleMachineReclassify(parsed.args, parsed.flags);
+    }
+
     return {
       success: false,
       error: `Unknown machine subcommand: ${parsed.subcommand}\n\nRun "celilo machine --help" for usage`,
@@ -2369,6 +2384,10 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
       return handleSystemMigrate(parsed.args, parsed.flags);
     }
 
+    if (parsed.subcommand === 'reboot') {
+      return handleSystemReboot(parsed.args, parsed.flags);
+    }
+
     return {
       success: false,
       error: `Unknown system subcommand: ${parsed.subcommand}\n\nRun "celilo system --help" for usage`,

package/src/cli/tui/audit-state.ts

@@ -73,6 +73,8 @@ export const ALL_CATEGORIES: readonly DriftCategory[] = [
   'schema',
   'capability_abi',
   'browser_pin',
+  'server_bun_pin',
+  'reboot_pending',
   'terraform_plan',
   'module_versions',
   'module_configs',
@@ -96,6 +98,8 @@ export const ALL_CATEGORIES: readonly DriftCategory[] = [
 ];
 
 export const CATEGORY_LABELS: Record<DriftCategory, string> = {
+  server_bun_pin: 'Server bun pin',
+  reboot_pending: 'Pending reboot',
   module_integrity: 'Module integrity',
   detect_without_converge: 'Drift without converge',
   jail_exemptions: 'Hook jail exemptions',

package/src/hooks/broker.ts

@@ -105,6 +105,18 @@ export interface Broker {
   outcome(): HookOutcome | undefined;
   /** Every protocol-level complaint, for the error message when one matters. */
   faults(): string[];
+  /**
+   * The capability calls that are still in flight, newest last, each rendered
+   * as `provider_module:capability.method (Ns)`.
+   *
+   * A hook that dies at its total timeout has usually died WAITING on one of
+   * these, and the bare "Hook total timeout exceeded" names only the hook —
+   * never what it was waiting for. Measured 2026-09-21 (celilo#1403):
+   * bna-yard-sale's on_install died at 120s blocked on caddy's 75s route
+   * reconcile, and the log's only tell was a `publishStaticSite` push line
+   * with no matching completion. The operator had to infer the provider.
+   */
+  pendingCalls(): string[];
   /** Refuse further calls. Idempotent. Called on kill and again on cleanup. */
   stop(): void;
   /** Close the socket and remove its directory. */
@@ -184,6 +196,8 @@ export async function startBroker(options: BrokerOptions): Promise<Broker> {
   let outcome: HookOutcome | undefined;
   let stopped = false;
   const faults: string[] = [];
+  /** In-flight capability calls by frame id, so a timeout can name them. */
+  const pending = new Map<string, { capability: string; method: string; startedAt: number }>();
   let connection: Socket | undefined;
   // Already resolved: no connection means nothing left to deliver.
   let connectionClosed: Promise<void> = Promise.resolve();
@@ -300,6 +314,7 @@ export async function startBroker(options: BrokerOptions): Promise<Broker> {
       return;
     }
 
+    pending.set(id, { capability: capabilityName, method, startedAt: Date.now() });
     try {
       const value = await (fn as (...a: unknown[]) => unknown).apply(capability, args);
       options.onActivity();
@@ -307,6 +322,8 @@ export async function startBroker(options: BrokerOptions): Promise<Broker> {
     } catch (error) {
       options.onActivity();
       send({ type: 'throw', id, error: serializeError(error) });
+    } finally {
+      pending.delete(id);
     }
   }
 
@@ -384,6 +401,20 @@ export async function startBroker(options: BrokerOptions): Promise<Broker> {
       ]),
     outcome: () => outcome,
     faults: () => [...faults],
+    pendingCalls: () => {
+      const now = Date.now();
+      return [...pending.values()]
+        .sort((a, b) => a.startedAt - b.startedAt)
+        .map((call) => {
+          // `providerModuleId` is stamped onto the capability's data half by
+          // the loader, so the message can name the MODULE the hook is waiting
+          // on and not only the capability it asked through.
+          const view = options.capabilities[call.capability] as Record<string, unknown> | undefined;
+          const provider = typeof view?.providerModuleId === 'string' ? view.providerModuleId : '';
+          const waited = Math.round((now - call.startedAt) / 1000);
+          return `${provider ? `${provider}:` : ''}${call.capability}.${call.method} (${waited}s)`;
+        });
+    },
     stop: () => {
       stopped = true;
     },

package/src/hooks/capability-loader.ts

@@ -80,6 +80,57 @@ import { loadHookConfigMap } from './load-hook-config';
  * upstream-chain wiring takes a second factory argument (`upstreamFirewall`)
  * that doesn't fit the `defineCapabilityFunction` shape.
  */
+/**
+ * Make the public_web provider re-render and converge, and insist it happened.
+ *
+ * Both triggers that change what the provider must serve come through here: a
+ * route registered or withdrawn, and a static site published. They used to be
+ * two different mechanisms — an event for routes, a direct core-side content
+ * converge for publishes — which is how a publish could converge content
+ * against a config the provider had not re-rendered. One path now
+ * (providers-converge-declared-state, design D6).
+ *
+ * Authoritative (ISS-0081): a change the provider never reconciled is a
+ * FAILURE, not a warning. These used to be logger.warn while the call returned
+ * success anyway, so a consumer could report "ready" while caddy never learned
+ * the hostname — no site block, no cert, TLS internal_error for clients.
+ */
+async function requireProviderReconcile(consumingModuleId: string, what: string): Promise<void> {
+  const reconcile = await emitWebRoutesChangedAndWait(consumingModuleId);
+
+  if (reconcile.noDispatcher) {
+    throw new Error(
+      `public_web ${what} for ${consumingModuleId} was persisted but NOT delivered to the provider (caddy): no event dispatcher is running, so caddy never reconciled and the hostname has no site block or cert. Run this through \`celilo module deploy\` (which runs the dispatcher) rather than a bare hook.`,
+    );
+  }
+  // The handler's own words, when it left any. A crash is retried, so its
+  // delivery sits in `pending` with the error already recorded while the
+  // deadline runs out — which is how celilo#1401 reported a TIMEOUT for a
+  // caddy crash, for days, with `0 ok, 0 failed of 1` and the cause nowhere.
+  const because = reconcile.lastError ? ` The provider reported: ${reconcile.lastError}` : '';
+
+  if (reconcile.timedOut) {
+    throw new Error(
+      `public_web reconcile for ${consumingModuleId} (${what}) did not finish within the deadline (${reconcile.succeeded} ok, ${reconcile.failed} failed of ${reconcile.events} change event(s)) — caddy did not confirm the change is live.${because}`,
+    );
+  }
+  if (reconcile.failed > 0) {
+    throw new Error(
+      `public_web reconcile for ${consumingModuleId} (${what}): ${reconcile.failed} delivery(ies) failed — caddy could not apply the change, so the hostname is not served as declared.${because}`,
+    );
+  }
+  // ISS-0087: a change WAS persisted and the dispatcher IS alive, yet ZERO
+  // providers reconciled it (no subscriber consumed routes_changed). That
+  // would otherwise report success for something nobody applied. `events === 0`
+  // means nothing changed (benign); `events > 0 && succeeded === 0` means it
+  // changed and nobody served it — a failure.
+  if (reconcile.events > 0 && reconcile.succeeded === 0) {
+    throw new Error(
+      `public_web ${what} for ${consumingModuleId} changed (${reconcile.events} event(s)) but NO provider reconciled it — caddy has no reconcile_routes subscription on the bus, so the change is persisted yet never served. Ensure a public_web provider (caddy) is deployed and subscribed.`,
+    );
+  }
+}
+
 export const CAPABILITY_MODULE_MAP: Record<string, { script: string; legacyFactoryName: string }> =
   {
     dns_registrar: {
@@ -646,19 +697,26 @@ export async function loadCapabilityFunctions(
         caddyModuleId: provider.moduleId,
         dnsManagedDomains,
         dnsRegistrarModuleId,
-        // Design D10: the bytes move through the provider's Ansible converge,
-        // not a hand-built ssh tar pipe. Core implements it over
-        // executeAnsible against the provider's generated project (task 4.3);
-        // awaited with everything else, so a publish returns only once the
-        // host matches. A failure here fails the deploy loudly — a publish
+        // The bytes move through the provider's Ansible converge, not a
+        // hand-built ssh tar pipe (design D10). What changed in
+        // providers-converge-declared-state is WHO decides what to converge:
+        // core used to plan the whole fleet's release set here and throw when
+        // any one module had no built site (celilo#1383). Now the publish
+        // makes the PROVIDER re-render from the declared rows — the same path
+        // a route change takes — so content and config converge together and a
+        // broken consumer costs only its own site.
+        //
+        // The field keeps its name: it is passed into `createPublicWeb` inside
+        // the CONSUMER's bundled copy of @celilo/capabilities, and a module
+        // running an older bundle calls `deps.convergeStaticContent()` by that
+        // name. Renaming it here would leave that call undefined on every
+        // module that has not reinstalled.
+        //
+        // Awaited, so a publish returns only once the host matches: a publish
         // that reports ready while the host never received the bytes is the
         // exact "served but silently unreachable" anti-pattern.
         convergeStaticContent: async () => {
-          const { convergeStaticContent } = await import('../services/static-content-converge');
-          const result = await convergeStaticContent(db, provider.moduleId, consumingModuleId);
-          if (!result.success) {
-            throw new Error(result.error ?? 'static-content converge failed');
-          }
+          await requireProviderReconcile(consumingModuleId, 'static publish');
         },
         // ISS-0035: register_route/unregister_routes emit this coarse signal
         // instead of SSHing caddy; the caddy provider's reconcile_routes
@@ -667,37 +725,7 @@ export async function loadCapabilityFunctions(
         // the consuming module's health_check runs right after and would
         // otherwise race the async reconcile.
         onRoutesChanged: async () => {
-          const reconcile = await emitWebRoutesChangedAndWait(consumingModuleId);
-          // Authoritative (ISS-0081): a route the provider (caddy) never
-          // reconciled is a deploy FAILURE, not a warning. These used to be
-          // logger.warn while register_route returned success anyway, so a
-          // consumer could report "ready" while caddy never learned the
-          // hostname — no site block, no cert, TLS internal_error for clients.
-          if (reconcile.noDispatcher) {
-            throw new Error(
-              `public_web route for ${consumingModuleId} was persisted but NOT delivered to the provider (caddy): no event dispatcher is running, so caddy never reconciled and the hostname has no site block or cert. Run this through \`celilo module deploy\` (which runs the dispatcher) rather than a bare hook.`,
-            );
-          }
-          if (reconcile.timedOut) {
-            throw new Error(
-              `public_web reconcile for ${consumingModuleId} did not finish within the deadline (${reconcile.succeeded} ok, ${reconcile.failed} failed of ${reconcile.events} change event(s)) — caddy did not confirm the route is live.`,
-            );
-          }
-          if (reconcile.failed > 0) {
-            throw new Error(
-              `public_web reconcile for ${consumingModuleId}: ${reconcile.failed} delivery(ies) failed — caddy could not apply the route, so the hostname is not served.`,
-            );
-          }
-          // ISS-0087: a route WAS registered and the dispatcher IS alive, yet ZERO
-          // providers reconciled it (no subscriber consumed routes_changed). That
-          // registers a route nobody applied and would otherwise report success.
-          // `events === 0` means no routes changed (benign); `events > 0 &&
-          // succeeded === 0` means the route changed but nobody served it — a failure.
-          if (reconcile.events > 0 && reconcile.succeeded === 0) {
-            throw new Error(
-              `public_web route for ${consumingModuleId} changed (${reconcile.events} event(s)) but NO provider reconciled it — caddy has no reconcile_routes subscription on the bus, so the route is persisted yet never served (no site block, no cert). Ensure a public_web provider (caddy) is deployed and subscribed.`,
-            );
-          }
+          await requireProviderReconcile(consumingModuleId, 'route change');
         },
       });
       debugLog(`public_web: loaded via framework implementation for ${consumingModuleId}`);
@@ -734,6 +762,22 @@ export async function loadCapabilityFunctions(
           const { resolveModuleStateWebRoot, resolveModuleWebRoot } = await import(
             '../module/web-root'
           );
+
+          // Pause preserves state (module-pause spec), so a paused module's
+          // site is not re-converged. Leaving it out of the provider's site
+          // list is exactly that: the role converges only the slugs it is
+          // given and prunes nothing else, so the release already on the box
+          // stays, and the module's routes still render into the config.
+          //
+          // This is where d04a2bb7's paused filter went when core's fleet-wide
+          // plan was deleted. It moved rather than vanished, and it moved to
+          // the per-module lookup, which is the only place that can answer for
+          // one module without walking the rest.
+          const { isModulePaused } = await import('../services/module-pause');
+          if (isModulePaused(db, moduleId)) {
+            return { unavailable: `module '${moduleId}' is paused — its site is left as it is` };
+          }
+
           const sourceDir = resolveModuleWebRoot(moduleId, db);
           if (!sourceDir) {
             return { unavailable: `module '${moduleId}' is not installed` };
@@ -749,9 +793,8 @@ export async function loadCapabilityFunctions(
           return { sourceDir, ...overlayDir };
         },
         converge: async (artifacts) => {
-          const { convergeProviderConfig } = await import('../services/provider-converge');
-          const { resolveStaticContentRetention } = await import(
-            '../services/static-content-converge'
+          const { convergeProviderConfig, resolveStaticContentRetention } = await import(
+            '../services/provider-converge'
           );
           const result = await convergeProviderConfig(db, providerModuleId, {
             ...artifacts,

package/src/hooks/executor.ts

@@ -511,7 +511,14 @@ export async function executeHookScript(
       setTimeout(() => child.kill('SIGKILL'), SIGKILL_GRACE_MS).unref();
     };
 
-    const totalTimer = setTimeout(() => kill('total'), timeoutMs);
+    // Snapshotted inside the timer rather than read at throw time: the child's
+    // death rejects its in-flight calls, so by the time we build the message
+    // the map that knows the answer has drained itself.
+    let pendingCallsAtKill: string[] = [];
+    const totalTimer = setTimeout(() => {
+      pendingCallsAtKill = broker.pendingCalls();
+      kill('total');
+    }, timeoutMs);
     // Debug runs get no idle timer, same as before: an operator stepping
     // through a browser hook is silent for minutes on purpose.
     const idleTimer = context.debug
@@ -536,7 +543,18 @@ export async function executeHookScript(
     // nothing keeps running past this line. That is the difference from the
     // `Promise.race` this replaces (celilo#1003).
     if (killedFor === 'total') {
-      throw new Error(`Hook total timeout exceeded (${Math.round(timeoutMs / 1000)}s)`);
+      // Name what it was WAITING ON, not just that it waited. A hook whose
+      // budget is consumed by one slow provider used to die as a bare
+      // "Hook total timeout exceeded", so the operator had to infer the
+      // provider from a capability push line with no matching completion
+      // (celilo#1403: bna-yard-sale's 120s on_install blocked on caddy's 75s
+      // route reconcile). Captured before `close()`, while the calls are
+      // still in flight — `stop()` refuses new calls but clears nothing.
+      const waitingOn = pendingCallsAtKill;
+      const waitingSuffix = waitingOn.length > 0 ? `, waiting on ${waitingOn.join(', ')}` : '';
+      throw new Error(
+        `Hook total timeout exceeded (${Math.round(timeoutMs / 1000)}s)${waitingSuffix}`,
+      );
     }
     if (killedFor === 'idle') {
       throw new Error(

package/src/hooks/test-fixtures/slow-capability-hook.ts

@@ -0,0 +1,28 @@
+/**
+ * Test fixture: a hook that blocks inside a capability call it never gets an
+ * answer to, and is killed at its own total timeout (celilo#1403).
+ *
+ * The real shape is a consumer's `on_install` calling
+ * `public_web.publishStaticSite`, which blocks on the provider's route
+ * reconcile. This fixture reproduces the boundary condition — a call in flight
+ * when the kill lands — without a provider.
+ *
+ * It logs BEFORE the call so the run is not mistaken for an idle timeout, then
+ * awaits forever.
+ */
+
+import { defineHook } from '@celilo/capabilities';
+
+interface SlowCapability {
+  neverReturns(request: Record<string, unknown>): Promise<unknown>;
+}
+
+export default defineHook({
+  hook: 'container_created',
+  requires: [],
+  handler: async (ctx) => {
+    const slow = (ctx.capabilities as unknown as Record<string, SlowCapability>).slow_provider;
+    ctx.logger.info('calling the provider');
+    await slow.neverReturns({});
+  },
+});

package/src/hooks/timeout-names-provider.test.ts

@@ -0,0 +1,87 @@
+/**
+ * A hook killed at its TOTAL timeout must name what it was waiting on.
+ *
+ * Measured 2026-09-21 (celilo#1403): bna-yard-sale's `on_install` called
+ * `public_web.publishStaticSite`, which blocks on caddy's route reconcile —
+ * 70-75s across the fleet's sites. The consumer died at its 120s budget with:
+ *
+ *     [bna-yard-sale:on_install] -> public_web.publishStaticSite
+ *     [bna-yard-sale:on_install] OK dns_registrar.registerHost
+ *     [bna-yard-sale:on_install] OK dns_internal.registerRecord
+ *     [bna-yard-sale:on_install] FAIL Hook total timeout exceeded (120s)
+ *
+ * Both DNS calls completed; the push line had no matching completion, and that
+ * ABSENCE was the only evidence of which provider held it. The error named the
+ * hook and never the cause, so the operator had to infer it from a gap in the
+ * log — the same class of missing signal the greenwave/axon ISP-router hooks
+ * already carry a comment about.
+ */
+import { describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { executeHookScript } from './executor';
+import { createCapturingLogger } from './logger';
+import { configStore, secretStore } from './test-fixtures/store-backed';
+import type { HookContext } from './types';
+
+const FIXTURES = join(__dirname, 'test-fixtures');
+
+/** A capability whose one method never settles — the provider that holds the hook. */
+function hangingCapabilities(): Record<string, unknown> {
+  return {
+    slow_provider: {
+      providerModuleId: 'caddy',
+      version: '1.0.0',
+      neverReturns: () => new Promise(() => {}),
+    },
+  };
+}
+
+async function runUntilTotalTimeout(): Promise<Error> {
+  const dir = mkdtempSync(join(tmpdir(), 'celilo-timeout-'));
+  try {
+    const context: HookContext = {
+      config: configStore(),
+      secrets: secretStore(),
+      systems: [],
+      logger: createCapturingLogger().logger,
+      debug: false,
+      screenshotDir: dir,
+      stateDir: dir,
+      capabilities: hangingCapabilities(),
+    };
+    try {
+      await executeHookScript(join(FIXTURES, 'slow-capability-hook.ts'), context, {
+        // Total well under idle, so the kill is unambiguously the TOTAL one:
+        // a hook blocked in a capability call emits nothing, so a shorter idle
+        // timer would win the race and prove a different thing.
+        timeoutMs: 3_000,
+        idleTimeoutMs: 60_000,
+      });
+    } catch (error) {
+      return error as Error;
+    }
+    throw new Error('the hook returned; it was supposed to be killed at its total timeout');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+describe('a total-timeout error names the provider it was waiting on (celilo#1403)', () => {
+  test('the run reached the total timeout, not the idle one', async () => {
+    const error = await runUntilTotalTimeout();
+    // Anchor the subject: an idle kill would exercise none of this.
+    expect(error.message).toContain('Hook total timeout exceeded');
+    expect(error.message).not.toContain('idle');
+  }, 20_000);
+
+  test('the message names the provider, the capability and the method', async () => {
+    const error = await runUntilTotalTimeout();
+    expect(error.message).toContain('waiting on');
+    // The provider MODULE is the operationally useful half — it is what the
+    // operator goes and looks at. `caddy` comes from `providerModuleId`.
+    expect(error.message).toContain('caddy');
+    expect(error.message).toContain('slow_provider.neverReturns');
+  }, 20_000);
+});

package/src/policy/module-business-baseline.ts

@@ -514,10 +514,4 @@ export const PROVIDER_LITERAL_BASELINE: readonly ProviderLiteralRow[] = [
     count: 3,
     why: "X8 — the Caddyfile generator knows caddy's on-disk asset layout (#940)",
   },
-  {
-    file: 'apps/celilo/src/services/static-content-converge.ts',
-    literal: '/srv/www',
-    count: 1,
-    why: "D10 (capability-owned-tables stage 4): the converge's slug-collision error names the on-disk release path an operator must fix. The role under modules/caddy owns the real path handling; this is message text, not path logic.",
-  },
 ];

package/src/services/api-access.test.ts

@@ -3,6 +3,7 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb } from '@/db/client';
+import { COMMANDS, flattenLeaves, isReadOnlyPath, opOf, readOnlyGrants } from '@celilo/core';
 import {
   getPrincipalByName,
   grantPrincipal,
@@ -136,3 +137,46 @@ describe('api-access (DB-backed)', () => {
     expect(await listPrincipals()).toHaveLength(0);
   });
 });
+
+/**
+ * The recurrence gate for celilo#1404: every command classified read-only must
+ * actually be reachable by the read-only principal.
+ *
+ * The check is cross-instrument on purpose: `readOnlyGrants` decides what the RO
+ * principal is granted, and `grantsAllow` is the SERVER's own matcher deciding
+ * what that grant admits. What it catches is the two disagreeing about the shape
+ * of an op — which is how a derived list still leaves a read command denied.
+ * Verified by mutation (Rule 7.6): rendering the op as `module.journal` instead of
+ * `module:journal` turns this red.
+ *
+ * What it does NOT catch is the classifier itself calling a read a write — both
+ * sides read the same derivation, so they move together. That direction is
+ * covered in read-only-classifier.test.ts by a hand-written list of ops that must
+ * never be granted.
+ */
+describe('read-only principal reachability (celilo#1404)', () => {
+  const grants = readOnlyGrants(COMMANDS);
+  const readLeaves = flattenLeaves(COMMANDS).filter((l) => isReadOnlyPath(l.path));
+
+  test('the registry has read-only leaves at all', () => {
+    // Otherwise the sweep below is vacuously green.
+    expect(readLeaves.length).toBeGreaterThan(20);
+  });
+
+  test('the server admits every read-only command for the RO principal', () => {
+    const denied = readLeaves
+      .map((l) => ({ path: l.path.join(' '), op: opOf(l.path) }))
+      .filter((l) => !grantsAllow(grants, l.op.split(':')[0], l.op.split(':')[1]));
+    expect(denied).toEqual([]);
+  });
+
+  test('module journal — the op the live server denied with a bare exit 126', () => {
+    expect(grantsAllow(grants, 'module', 'journal')).toBe(true);
+    expect(grantsAllow(grants, 'module', 'where')).toBe(true);
+  });
+
+  test('and still denies a write op', () => {
+    expect(grantsAllow(grants, 'module', 'deploy')).toBe(false);
+    expect(grantsAllow(grants, 'api', 'grant')).toBe(false);
+  });
+});

package/src/services/audit/index.test.ts

@@ -20,6 +20,12 @@ const emptyDeps = {
     db: fakeDb,
   },
   browserPin: { consumers: [], provisioned: null },
+  serverBunPin: {
+    pinnedVersion: '1.4.2',
+    runningVersion: '1.4.2',
+    pinPath: '/etc/celilo/mise.pin.toml',
+  },
+  rebootPending: { verdict: { pending: false, unmeasured: false, reasons: [] }, marker: null },
   capabilityAbi: { modules: [] },
   terraformPlan: {
     modules: [],
@@ -42,6 +48,7 @@ const emptyDeps = {
   secretsDecryptable: { results: [] },
   servicesReachable: { results: [] },
   machinesReachable: { results: [] },
+  machineInterfaceZones: { machines: [] },
   diskSpace: { results: [] },
   transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
   trustedSources: { firewalls: [], unreachableFirewalls: [] },

package/src/services/audit/index.ts

@@ -25,13 +25,19 @@ import {
 import { type DiskSpaceAuditDeps, auditDiskSpace } from './disk-space';
 import { type HealthAuditDeps, auditHealth } from './health';
 import { type JailExemptionsAuditDeps, auditJailExemptions } from './jail-exemptions';
+import {
+  type MachineInterfaceZonesAuditDeps,
+  auditMachineInterfaceZones,
+} from './machine-interface-zones';
 import { type MachinesReachableAuditDeps, auditMachinesReachable } from './machines-reachable';
 import { type ModuleConfigsAuditDeps, auditModuleConfigs } from './module-configs';
 import { type ModuleIntegrityAuditDeps, auditModuleIntegrity } from './module-integrity';
 import { type ModuleVersionsAuditDeps, auditModuleVersions } from './module-versions';
 import { type PublicDnsAuditDeps, auditPublicDns } from './public-dns';
+import { type RebootPendingAuditDeps, auditRebootPending } from './reboot-pending';
 import { type SchemaAuditDeps, auditSchema } from './schema';
 import { type SecretsDecryptableAuditDeps, auditSecretsDecryptable } from './secrets-decryptable';
+import { type ServerBunPinAuditDeps, auditServerBunPin } from './server-bun-pin';
 import {
   type ServicesCredentialsAuditDeps,
   auditServicesCredentials,
@@ -57,6 +63,8 @@ export interface AuditDeps {
   schema: SchemaAuditDeps;
   capabilityAbi: CapabilityAbiAuditDeps;
   browserPin: BrowserPinAuditDeps;
+  serverBunPin: ServerBunPinAuditDeps;
+  rebootPending: RebootPendingAuditDeps;
   terraformPlan: TerraformPlanAuditDeps;
   moduleVersions: ModuleVersionsAuditDeps;
   moduleConfigs: ModuleConfigsAuditDeps;
@@ -72,6 +80,7 @@ export interface AuditDeps {
   secretsDecryptable: SecretsDecryptableAuditDeps;
   servicesReachable: ServicesReachableAuditDeps;
   machinesReachable: MachinesReachableAuditDeps;
+  machineInterfaceZones: MachineInterfaceZonesAuditDeps;
   publicDns: PublicDnsAuditDeps;
   diskSpace: DiskSpaceAuditDeps;
   transportReads: TransportReadsAuditDeps;
@@ -115,6 +124,8 @@ export async function runAudit(
     wrap('schema', auditSchema(deps.schema)),
     wrap('capability_abi', auditCapabilityAbi(deps.capabilityAbi)),
     wrap('browser_pin', auditBrowserPin(deps.browserPin)),
+    wrap('server_bun_pin', Promise.resolve(auditServerBunPin(deps.serverBunPin))),
+    wrap('reboot_pending', Promise.resolve(auditRebootPending(deps.rebootPending))),
     wrap('terraform_plan', auditTerraformPlan(deps.terraformPlan)),
     wrap('module_versions', auditModuleVersions(deps.moduleVersions)),
     wrap('module_configs', auditModuleConfigs(deps.moduleConfigs)),
@@ -136,6 +147,10 @@ export async function runAudit(
     wrap('secrets_decryptable', auditSecretsDecryptable(deps.secretsDecryptable)),
     wrap('services_reachable', auditServicesReachable(deps.servicesReachable)),
     wrap('machines_reachable', auditMachinesReachable(deps.machinesReachable)),
+    wrap(
+      'interface_classification',
+      Promise.resolve(auditMachineInterfaceZones(deps.machineInterfaceZones)),
+    ),
     wrap('public_dns', auditPublicDns(deps.publicDns)),
     wrap('disk_space', Promise.resolve(auditDiskSpace(deps.diskSpace))),
     wrap('transport_reads', auditTransportReads(deps.transportReads)),

package/src/services/audit/machine-interface-zones.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from 'bun:test';
+import { auditMachineInterfaceZones } from './machine-interface-zones';
+
+describe('auditMachineInterfaceZones', () => {
+  test('reports a machine whose stored labels predate the zone model', () => {
+    const findings = auditMachineInterfaceZones({
+      machines: [
+        {
+          hostname: 'celilo-mgr',
+          changes: [
+            { name: 'eth0', ipAddress: '10.0.120.10', from: 'external', to: 'secure-mgmt' },
+          ],
+        },
+      ],
+    });
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0].severity).toBe('drift');
+    expect(findings[0].code).toBe('stale_interface_zone_labels');
+    expect(findings[0].subject).toBe('celilo-mgr');
+    expect(findings[0].message).toContain('external → secure-mgmt');
+    expect(findings[0].remediation).toContain('celilo machine reclassify celilo-mgr --apply');
+  });
+
+  test('reports nothing for a machine whose labels agree', () => {
+    expect(auditMachineInterfaceZones({ machines: [{ hostname: 'pi-01', changes: [] }] })).toEqual(
+      [],
+    );
+  });
+});