@celilo/cli 4.0.0 → 5.0.0

package/AGENTS.md

@@ -30,7 +30,7 @@ web** — they are the source of truth; the hosted copies at
 An **app** is a module that provides no capability (it serves content), so set
 `version_source: { kind: changeset }`.
 
-1. **`manifest.yml`** — `id` (kebab-case), `celilo_contract: "1.0"`, `version`,
+1. **`manifest.yml`** — `id` (kebab-case), `celilo_contract: "2.0"`, `version`,
    the capabilities you `requires:` (e.g. `public_web`, `idp`), `variables`,
    `hooks`, and `version_source`. Keep the schema directive on line 1 so your
    editor validates:
@@ -60,7 +60,7 @@ celilo module deploy <id> / update / health   # deploy + verify on the fleet
 
 ## Conventions / rules
 
-- Module `id` is **kebab-case**; pin `celilo_contract: "1.0"`.
+- Module `id` is **kebab-case**; pin `celilo_contract: "2.0"`.
 - **`version_source`** picks how `version` is sourced: `changeset` (apps/content —
   authored via changesets, ordered by `+N`), `pin` (wraps upstream software —
   `version` = the installed upstream version, resolver-checked), `recipe`

package/CELILO_SUBSYSTEMS.md

@@ -212,6 +212,7 @@ runner seam (`execRunner` real / `createMockRunner` for tests) lives in
   - **Inbound** (`reconcileAspectsForSystems`): every approved aspect applied to systems that have just come into existence. Called from `module-deploy.ts` between `waitForSSH` and `executeAnsible` (so a module's playbook and `on_install` see a correctly configured host) and from `machine-add.ts`. Eligibility is `applicable_zones` + approval; the aspect's `triggers` list is deliberately NOT consulted, so convergence is not opt-in per manifest. A failure here IS fatal to the deploy that created the system — the aspect is a prerequisite of that host — while a failure on `machine add` is only a warning. PAUSED providers are skipped, which is the escape hatch for a wedged aspect. Nothing is rolled back: rows, guest and IPAM allocation persist and a re-run converges on the same system. Fixes celilo#902, where a system provisioned after its provider deployed silently never received the aspect. See `openspec/changes/aspect-fanout-new-systems/`.
   - **Coverage verification** — `verifyAspectCoverage` + `celilo system doctor --deep [--fix]`. Answers "is any system missing an aspect its zone entitles it to" WITHOUT stored state: the entitled set is `planAspectFanOut` itself, and coverage is measured by evaluating the role against the host in Ansible check mode (`executeAnsible({check:true})` + `parseAnsibleRecap`). Three outcomes, not two — `changed=0,skipped=0` applied, `changed>0` missing, **`skipped>0` unknown**, because check mode SKIPS a task it cannot evaluate and a `command`/`shell` role would otherwise report clean having never run.
 - **In-flight operation lock** — `apps/celilo/src/services/module-operations.ts` — `startOperation`/`completeOperation`/`failOperation` record deploy/uninstall/backup/restore in `module_operations`; `refuseIfInFlight`/`checkInFlight` are what backup and restore consult. Deploy and uninstall REGISTER but never check: it is a one-way guard protecting backup/restore consistency, not a general mutex (`openspec/specs/management-server-backup/spec.md` "In-flight operation refusal"). A row stops holding the lock once it is GONE, STOPPED/zombie (`isPidRunnable`, `ps -o state=` — `kill(pid,0)` calls a Ctrl-Z'd process alive), or older than `OPERATION_TTL_MS` (2h). The TTL is not redundancy: a pid is a recycled number, and once the pid space wraps an old row names an unrelated healthy process. Operator surface: `celilo module operations [list|clear] [--abandoned] [--all]` (`apps/celilo/src/cli/commands/module-operations.ts`); `list` shows only what holds the lock, abandoned rows are summarised unless `--abandoned`. Abandoned rows are reclaimed hourly by the `celilo-operations-sweep` bus subscriber (`timer.tick.1h` → `celilo module operations clear`, armed by `ensureOperationsSweepSubscriber` from module registration and `celilo system migrate`). `clear` MARKS rows failed rather than deleting them, and that is load-bearing: the `abandoned_operations` audit reads exactly those released rows to notice one module's operation dying over and over.
+- **Management-server reboot** — `apps/celilo/src/services/system-reboot.ts`, surfaced as `celilo system reboot [--allow-reboot] [--verify]` (`apps/celilo/src/cli/commands/system-reboot.ts`) and reachable over MCP like any other registry leaf. Rebooting THIS box takes down the dispatcher, the MCP server and the remote API, so `requestReboot` refuses while `checkInFlight` reports a module operation running and names it, and consent follows the flag-or-interview rule (`--allow-reboot` wins, otherwise an event-bus question — never stdin). **Verification is a second call, by construction**: the process asking for the reboot dies in it, so no single invocation can both reboot the host and report that it came back. `requestReboot` records `state/reboot-requested.json` carrying the boot id at request time; `verifyReturn` (`--verify`) passes only once that boot id has CHANGED and the dispatcher heartbeat and installed CLI both answer, and names which of the three is missing when it has not. It refuses up front when the boot id is unreadable, because a reboot whose return could never be verified is the out-of-band `sudo reboot` this replaces. `judgeRebootPending` compares the running kernel against the newest installed one and reads Debian's `/var/run/reboot-required`; either tell is enough, neither readable is `unmeasured` rather than clean. Both facts surface as the `reboot_pending` audit category (`apps/celilo/src/services/audit/reboot-pending.ts`): a pending reboot is `drift`, an UNVERIFIED one is `blocked` — that is a control plane that may not have come back. celilo#1378.
 - **Module pause / unpause (control-plane quiescence)** — `apps/celilo/src/services/module-pause.ts` — pure `planPause`/`planUnpause` producing an ordered plan, `executePause`/`executeUnpause` performing it, plus `listPausedModules`/`pausedAmong`/`formatPausedDuration`/`describePausedModule` (the ONE place an age is formatted). CLI: `apps/celilo/src/cli/commands/module-pause.ts` (`celilo module pause|unpause <id> [--cascade] [--stop-infra] [--reason] [--dry-run] [--yes]`). Pausing takes a module out of the CONTROL plane — no dispatched events, no timer hooks, no health checks, alerts suppressed — while leaving the DATA plane running, because capability consumption is deploy-time: every consumer calls `firewall`/`dhcp_server` from `on_install` and nothing calls it while serving. Config, secrets, IPAM/VMID and placement are preserved; `on_uninstall` does NOT run. Quiescence is enforced in two places: pausing drops the module's bus subscriptions (`unregisterModuleSubscriptions`), and `run-named-hook.ts` refuses any non-lifecycle hook for a PAUSED module (`skippedPaused`), which catches the paths that skip the bus — `events resync-subscriptions`, a restore that starts events.db empty, aspect fan-out, public-web republish. `on_install`/`on_uninstall` are exempt by hook NAME (not a caller flag): unpause redeploys through `on_install`, and removing a paused provider needs `on_uninstall`. Unpause always REDEPLOYS (`deployModule`) — that is what rebinds a consumer to a replacement provider and recreates provider-local state from the consumers that own it — and re-registers subscriptions, which a plain deploy does not do. A failed unpause restores `PAUSED` rather than leaving the module live and mis-bound. Cascade order reuses `services/update/dep-graph.ts` unchanged (pause = consumers first, unpause = providers first) and is computed from the GRAPH, never from which modules are currently paused, so a cascade walks THROUGH already-done members and is resumable. See `openspec/specs/module-pause/spec.md`.
 - **Provider-removal guard** — `apps/celilo/src/services/remove-guard.ts` — `findRemovalBlockers`/`describeRemovalRefusal`, called from `apps/celilo/src/cli/commands/module-remove.ts`. A PAUSED module is not a dependent (unpause cannot return it to service without a redeploy, and a redeploy re-resolves capabilities), which is what makes a provider swap possible at all. A dependent is one declaring the capability under `requires` **or** `optional` — the same relation `dep-graph.ts` uses, so the guard and the cascade agree on the set; the guard previously read `requires` alone, which let a removal silently orphan `technitium`'s `optional` `dhcp_server`. Refusals name each blocker AND which declaration makes it one. It deliberately does NOT exempt a dependent because another provider of the same capability exists (celilo#683).
 - **Consumer-removal cleanup (every provider is told)** — `apps/celilo/src/services/consumer-cleanup.ts` — pure `planConsumerCleanup` + `loadConsumerCleanupPlan` + `runConsumerCleanup`, called from `apps/celilo/src/cli/commands/module-remove.ts` after `on_uninstall` and before `terraform destroy`. A capability is two-sided: the consumer asks, the provider mints something in ITS world (a caddy site block, a DNAT rule, an OIDC client at authentik, a registered CI runner), and removal only ever touched one side — the FK cascade dropped celilo's row, so the provider's next converge had no way to learn the thing existed. This dispatches the `on_consumer_removed` hook to every provider of every capability the departing module declared under `requires` OR `optional` (the same relation `remove-guard.ts` counts as a dependency edge), **once per provider** rather than once per capability, sorted by provider id. The hook receives one input, `consumer`, and NOTHING else: a provider that cannot answer "what do I hold for this module" without being told has a different defect — the consumer's id was never recorded at mint time. It replaces `services/web-route-cleanup.ts`, which did the same job for exactly one capability, by name, from core. Semantics that are easy to get backwards: **a failed withdrawal never blocks the removal** — the consumer goes and the failing PROVIDER is marked `ERROR` with the departing consumer named in `error_message` (surfaced as a `blocked` finding by `services/audit/undeployed-modules.ts`), because the hook is a full converge and after a failure the provider's state is unknown rather than "one thing missed". **Dispatch continues past a failure**, so one broken provider cannot leave the others holding state. A PAUSED provider is skipped with a warning naming what it keeps (`run-named-hook.ts` refuses non-lifecycle hooks on a paused module, and `on_consumer_removed` must NOT join `LIFECYCLE_HOOKS`), and a never-deployed one is skipped silently. Providers implementing it: caddy, caddy-internal, iptables, greenwave, axon, authentik, forgejo, generic-cpanel-hosting-provider. See `openspec/changes/consumer-removal-cleanup/`.

package/drizzle/0034_private_routes.sql

@@ -0,0 +1,41 @@
+-- The internal ingress's declared routes, in core, in their own table.
+--
+-- `caddy-internal` kept the routes its consumers registered in a `routes`
+-- module-config key: the same rows as `web_routes`, stored as one module's
+-- business rather than as declared state core owns. That key is why the two
+-- ingresses could not share plumbing — the private provider had nothing core
+-- could render, converge or audit.
+--
+-- Same columns as `web_routes`, separate table, and the separation is the
+-- point. The PUBLIC provider derives the hostnames it serves from every row of
+-- `web_routes`, so a private route stored there would be picked up and served
+-- publicly, with a public certificate, by the ingress caddy-internal exists to
+-- keep it away from (celilo#846). One table with a flag would make that leak a
+-- missing `WHERE` clause away; two tables make it impossible.
+--
+-- No data migration (design D9 of providers-converge-declared-state). The
+-- table starts empty. When caddy-internal deploys, provider arrival
+-- re-registers its consumers and their hooks write their routes into it inside
+-- that same deploy — observed 2026-09-17, "Re-registered 1 consumer(s) with
+-- 'caddy-internal': wireguard-manager". A one-time backfill would be code that
+-- runs once and is then wrong to keep.
+CREATE TABLE `private_routes` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`slug` text NOT NULL,
+	`module_id` text NOT NULL,
+	`type` text NOT NULL,
+	`path` text NOT NULL,
+	`hostname` text NOT NULL,
+	`target_host` text,
+	`target_port` integer,
+	`websocket` integer DEFAULT false NOT NULL,
+	`content_hash` text,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`updated_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`module_id`) REFERENCES `modules`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+-- Scoped to hostname as `web_routes` is, and scoped to THIS table: the same
+-- hostname and path may exist on both ingresses, which is a legitimate
+-- split-horizon arrangement and not a collision.
+CREATE UNIQUE INDEX `private_routes_hostname_path_idx` ON `private_routes` (`hostname`,`path`);

package/drizzle/meta/_journal.json

@@ -239,6 +239,13 @@
       "when": 1789082481000,
       "tag": "0033_build_bus_hook_runs",
       "breakpoints": true
+    },
+    {
+      "idx": 34,
+      "version": "6",
+      "when": 1789947740964,
+      "tag": "0034_private_routes",
+      "breakpoints": true
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/cli",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "Celilo — home lab orchestration CLI",
   "type": "module",
   "bin": {
@@ -35,6 +35,7 @@
     "dev": "bun run src/cli/index.ts",
     "test": "bun test --timeout 60000 src/",
     "test:integration": "bun test --timeout 60000 test-integration/",
+    "test:integration:pr": "bun test --timeout 60000 test-integration/alerting test-integration/ansible test-integration/api test-integration/cli test-integration/completion test-integration/deploy test-integration/golden test-integration/machine test-integration/module test-integration/publish test-integration/secrets test-integration/service test-integration/sizing test-integration/system test-integration/values test-integration/module-integrity-baseline.test.ts",
     "test:integration-slow": "bun test --timeout 300000 test-integration/",
     "test:completion": "bun test --timeout 60000 test-integration/completion/",
     "test:all": "bun test --timeout 60000 src/ test-integration/",
@@ -58,10 +59,10 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1109.0",
     "@aws-sdk/lib-storage": "^3.1101.0",
-    "@celilo/capabilities": "^5.1.0",
+    "@celilo/capabilities": "^6.0.0",
     "@celilo/cli-display": "^0.2.0",
-    "@celilo/core": "^0.13.0",
-    "@celilo/event-bus": "^0.6.0",
+    "@celilo/core": "^0.14.0",
+    "@celilo/event-bus": "^0.7.0",
     "ajv": "^8.18.0",
     "drizzle-orm": "^0.36.4",
     "ink": "^7.0.1",

package/src/api/sessions.test.ts

@@ -79,7 +79,7 @@ beforeEach(() => {
       name: 'iptables',
       sourcePath: join(dir, 'installed'),
       version: '1.0.2+9',
-      manifestData: { celilo_contract: '1.0', id: 'iptables', name: 'iptables', version: '1.0.2' },
+      manifestData: { celilo_contract: '2.0', id: 'iptables', name: 'iptables', version: '1.0.2' },
     })
     .run();
 

package/src/capabilities/registration.test.ts

@@ -17,7 +17,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -50,7 +50,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -89,7 +89,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -126,7 +126,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -155,7 +155,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -185,7 +185,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -213,7 +213,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -244,7 +244,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -280,7 +280,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -312,7 +312,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -343,7 +343,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',

package/src/capabilities/secrets.test.ts

@@ -11,7 +11,7 @@ describe('Capability Secret Access', () => {
   describe('isCapabilityFieldSecret', () => {
     test('should return true when field is marked as secret', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -56,7 +56,7 @@ describe('Capability Secret Access', () => {
 
     test('should return true for any secret in the list', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -98,7 +98,7 @@ describe('Capability Secret Access', () => {
 
     test('should return false when field is not in secrets list', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -137,7 +137,7 @@ describe('Capability Secret Access', () => {
 
     test('should return false when capability has no secrets', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -183,7 +183,7 @@ describe('Capability Secret Access', () => {
 
     test('should match exact secret name', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -227,7 +227,7 @@ describe('Capability Secret Access', () => {
   describe('checkCapabilitySecretAccess', () => {
     test('should return true when consumer matches allowlist', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -253,7 +253,7 @@ describe('Capability Secret Access', () => {
       };
 
       const consumerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'caddy',
         name: 'Caddy',
         version: '1.0.0',
@@ -298,7 +298,7 @@ describe('Capability Secret Access', () => {
 
     test('should return false when consumer does not match allowlist', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -324,7 +324,7 @@ describe('Capability Secret Access', () => {
       };
 
       const consumerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'some-app',
         name: 'Some App',
         version: '1.0.0',
@@ -367,7 +367,7 @@ describe('Capability Secret Access', () => {
 
     test('should return true when secret has no readable_by restriction', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -393,7 +393,7 @@ describe('Capability Secret Access', () => {
       };
 
       const consumerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',
@@ -429,7 +429,7 @@ describe('Capability Secret Access', () => {
 
     test('should return true when readable_by is empty array', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -455,7 +455,7 @@ describe('Capability Secret Access', () => {
       };
 
       const consumerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',
@@ -507,7 +507,7 @@ describe('Capability Secret Access', () => {
 
     test('should return false when consumer not found', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -558,7 +558,7 @@ describe('Capability Secret Access', () => {
 
     test('should return false when secret not found in capability', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -583,7 +583,7 @@ describe('Capability Secret Access', () => {
       };
 
       const consumerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',
@@ -623,7 +623,7 @@ describe('Capability Secret Access', () => {
 
     test('should return false when capability has no secrets', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -643,7 +643,7 @@ describe('Capability Secret Access', () => {
       };
 
       const consumerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',

package/src/capabilities/validation.test.ts

@@ -95,7 +95,7 @@ describe('Capability Access Validation', () => {
   describe('getProviderManifest', () => {
     test('should return manifest when capability exists', () => {
       const mockManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -153,7 +153,7 @@ describe('Capability Access Validation', () => {
 
     test('should parse JSON manifest correctly', () => {
       const mockManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -190,7 +190,7 @@ describe('Capability Access Validation', () => {
   describe('validateCapabilityAccess', () => {
     test('should return success when module does not require capabilities', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -209,7 +209,7 @@ describe('Capability Access Validation', () => {
 
     test('should return success when module requires capabilities array is empty', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -236,7 +236,7 @@ describe('Capability Access Validation', () => {
       // fails the test after this one: the difference is entirely which
       // capability is asked for.
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'celilo-web-console',
         name: 'Celilo Web Console',
         version: '1.0.0',
@@ -261,7 +261,7 @@ describe('Capability Access Validation', () => {
 
     test('should return error when required capability not found', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'caddy',
         name: 'Caddy',
         version: '1.0.0',
@@ -292,7 +292,7 @@ describe('Capability Access Validation', () => {
       // not demand a providing module for it — otherwise celilo-mgmt
       // can't be imported (regression: openspec/specs/progressive-zone-disclosure/spec.md).
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'celilo-mgmt',
         name: 'Celilo Management Server',
         version: '1.0.0',
@@ -318,7 +318,7 @@ describe('Capability Access Validation', () => {
 
     test('should return success when capability has no secrets', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',
@@ -331,7 +331,7 @@ describe('Capability Access Validation', () => {
       };
 
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -364,7 +364,7 @@ describe('Capability Access Validation', () => {
 
     test('should return success when secret has no readable_by restriction', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',
@@ -377,7 +377,7 @@ describe('Capability Access Validation', () => {
       };
 
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -418,7 +418,7 @@ describe('Capability Access Validation', () => {
 
     test('should return success when consumer matches allowlist', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'caddy',
         name: 'Caddy',
         version: '1.0.0',
@@ -439,7 +439,7 @@ describe('Capability Access Validation', () => {
       };
 
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -480,7 +480,7 @@ describe('Capability Access Validation', () => {
 
     test('should return error when consumer does not match allowlist', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'some-app',
         name: 'Some App',
         version: '1.0.0',
@@ -501,7 +501,7 @@ describe('Capability Access Validation', () => {
       };
 
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -546,7 +546,7 @@ describe('Capability Access Validation', () => {
 
     test('should return error when consumer provides no capabilities', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',
@@ -559,7 +559,7 @@ describe('Capability Access Validation', () => {
       };
 
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -601,7 +601,7 @@ describe('Capability Access Validation', () => {
 
     test('should validate all required capabilities', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'complex-app',
         name: 'Complex App',
         version: '1.0.0',
@@ -697,7 +697,7 @@ describe('Capability Access Validation', () => {
   // dependency graph that six core services read.
   describe('celilo#854 — secret access is gated on reference, not on declaration', () => {
     const knotManifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: 'knot-unbound-internal',
       name: 'Knot + Unbound',
       version: '1.0.0',
@@ -730,7 +730,7 @@ describe('Capability Access Validation', () => {
 
     test('a consumer that requires the capability but never names the secret imports', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'caddy-internal',
         name: 'Caddy (fleet-only ingress)',
         version: '1.0.0',
@@ -752,7 +752,7 @@ describe('Capability Access Validation', () => {
 
     test('a consumer that DOES name the restricted secret is still refused', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'nosy-app',
         name: 'Nosy App',
         version: '1.0.0',
@@ -817,7 +817,7 @@ describe('Capability Access Validation', () => {
     test('naming one secret enforces that secret allow-list and no other', async () => {
       function consumer(deriveFrom: string): ModuleManifest {
         return {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'caddy-internal',
           name: 'Caddy (fleet-only ingress)',
           version: '1.0.0',
@@ -871,7 +871,7 @@ describe('Capability Access Validation', () => {
      */
     test('a secret named only in a template is refused at import', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'nosy-app',
         name: 'Nosy App',
         version: '1.0.0',
@@ -890,7 +890,7 @@ describe('Capability Access Validation', () => {
 
     test('a non-secret template reference is still not a secret reference', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'caddy-internal',
         name: 'Caddy (fleet-only ingress)',
         version: '1.0.0',

package/src/cli/cli.test.ts

@@ -100,7 +100,7 @@ describe('CLI Integration', () => {
     await writeFile(
       join(TEST_MODULE_DIR, 'manifest.yml'),
       `
-celilo_contract: "1.0"
+celilo_contract: "2.0"
 id: test-module
 name: Test Module
 version: 1.0.0
@@ -255,7 +255,7 @@ description: Test module for CLI
       const db = getDb();
       // Insert test module with variable declarations
       const manifestData = JSON.stringify({
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -440,7 +440,7 @@ description: Test module for CLI
       const db = getDb();
       // Insert test module with secrets manifest
       const manifestData = JSON.stringify({
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',

package/src/cli/command-tree-parser.test.ts

@@ -162,6 +162,24 @@ Commands:
       expect(commands.filter((c: string) => c === 'module')).toHaveLength(1);
     });
 
+    test('treats wrapped description lines as continuations, not subcommands', () => {
+      // celilo#1409: a wrapped help description's continuation lines matched the
+      // subcommand regex, so prose words were reported as missing registry entries.
+      const helpText = `
+Commands:
+  reboot                   Reboot the system if an operation
+                           dies, and it
+                           came back
+  status                   Show system status
+`;
+
+      // biome-ignore lint/suspicious/noExplicitAny: accessing private method for testing
+      const parseMethod = (parser as any).parseHelpText.bind(parser);
+      const commands = parseMethod(helpText);
+
+      expect(commands).toEqual(['reboot', 'status']);
+    });
+
     test('handles hyphenated command names', () => {
       const helpText = `
 Commands: