@celilo/cli 4.0.0 → 5.0.0

package/src/services/api-access.test.ts

@@ -3,6 +3,7 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb } from '@/db/client';
+import { COMMANDS, flattenLeaves, isReadOnlyPath, opOf, readOnlyGrants } from '@celilo/core';
 import {
   getPrincipalByName,
   grantPrincipal,
@@ -136,3 +137,46 @@ describe('api-access (DB-backed)', () => {
     expect(await listPrincipals()).toHaveLength(0);
   });
 });
+
+/**
+ * The recurrence gate for celilo#1404: every command classified read-only must
+ * actually be reachable by the read-only principal.
+ *
+ * The check is cross-instrument on purpose: `readOnlyGrants` decides what the RO
+ * principal is granted, and `grantsAllow` is the SERVER's own matcher deciding
+ * what that grant admits. What it catches is the two disagreeing about the shape
+ * of an op — which is how a derived list still leaves a read command denied.
+ * Verified by mutation (Rule 7.6): rendering the op as `module.journal` instead of
+ * `module:journal` turns this red.
+ *
+ * What it does NOT catch is the classifier itself calling a read a write — both
+ * sides read the same derivation, so they move together. That direction is
+ * covered in read-only-classifier.test.ts by a hand-written list of ops that must
+ * never be granted.
+ */
+describe('read-only principal reachability (celilo#1404)', () => {
+  const grants = readOnlyGrants(COMMANDS);
+  const readLeaves = flattenLeaves(COMMANDS).filter((l) => isReadOnlyPath(l.path));
+
+  test('the registry has read-only leaves at all', () => {
+    // Otherwise the sweep below is vacuously green.
+    expect(readLeaves.length).toBeGreaterThan(20);
+  });
+
+  test('the server admits every read-only command for the RO principal', () => {
+    const denied = readLeaves
+      .map((l) => ({ path: l.path.join(' '), op: opOf(l.path) }))
+      .filter((l) => !grantsAllow(grants, l.op.split(':')[0], l.op.split(':')[1]));
+    expect(denied).toEqual([]);
+  });
+
+  test('module journal — the op the live server denied with a bare exit 126', () => {
+    expect(grantsAllow(grants, 'module', 'journal')).toBe(true);
+    expect(grantsAllow(grants, 'module', 'where')).toBe(true);
+  });
+
+  test('and still denies a write op', () => {
+    expect(grantsAllow(grants, 'module', 'deploy')).toBe(false);
+    expect(grantsAllow(grants, 'api', 'grant')).toBe(false);
+  });
+});

package/src/services/aspect-approvals.test.ts

@@ -28,7 +28,7 @@ function insertModule(id: string, version: string) {
       id,
       name: id,
       version,
-      manifestData: { id, name: id, version, celilo_contract: '1.0' },
+      manifestData: { id, name: id, version, celilo_contract: '2.0' },
       sourcePath: `/tmp/${id}`,
     })
     .run();
@@ -160,7 +160,7 @@ describe('aspect-approvals', () => {
           id: 'knot-unbound-internal-v2',
           name: 'knot',
           version: '2.0.0',
-          manifestData: { id: 'knot', name: 'knot', version: '2.0.0', celilo_contract: '1.0' },
+          manifestData: { id: 'knot', name: 'knot', version: '2.0.0', celilo_contract: '2.0' },
           sourcePath: '/tmp/knot',
         })
         .run();

package/src/services/aspect-reconcile.test.ts

@@ -62,7 +62,7 @@ function seedProvider(opts: {
         id: opts.moduleId,
         name: opts.moduleId,
         version: '1.0.0',
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         base_module_aspect: aspect,
       },
       sourcePath: `/tmp/${opts.moduleId}`,
@@ -108,7 +108,7 @@ function seedTargetSystem(opts: {
         id: opts.moduleId,
         name: opts.moduleId,
         version: '1.0.0',
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
       },
       sourcePath: `/tmp/${opts.moduleId}`,
     })

package/src/services/aspect-runner.test.ts

@@ -85,7 +85,7 @@ function seedLxc(opts: {
         id: opts.moduleId,
         name: opts.moduleId,
         version: '1.0.0',
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
       },
       sourcePath: `/tmp/${opts.moduleId}`,
     })
@@ -320,7 +320,7 @@ describe('aspect-runner', () => {
             id: 'knot-unbound-internal',
             name: 'knot-unbound-internal',
             version: '1.0.0',
-            celilo_contract: '1.0',
+            celilo_contract: '2.0',
           },
           sourcePath: '/tmp/knot',
         })
@@ -386,7 +386,7 @@ describe('aspect-runner', () => {
 
   describe('maybeRunAspectForTrigger', () => {
     const manifestWithAspect: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: 'knot-unbound-internal',
       name: 'Knot Unbound Internal',
       version: '1.0.0',
@@ -413,7 +413,7 @@ describe('aspect-runner', () => {
             id: opts.id,
             name: opts.id,
             version: opts.version,
-            celilo_contract: '1.0',
+            celilo_contract: '2.0',
           },
           sourcePath: `/tmp/${opts.id}`,
         })

package/src/services/audit/backups.test.ts

@@ -20,7 +20,7 @@ function makeModule(
     id,
     name: id,
     version: '1.0.0',
-    celilo_contract: '1.0',
+    celilo_contract: '2.0',
     hooks: opts.hasBackupHook ? { on_backup: { script: './backup.ts' } } : {},
     backup: opts.schedule ? { schedule: opts.schedule } : undefined,
   } as unknown as ModuleManifest;

package/src/services/audit/capability-abi.test.ts

@@ -14,7 +14,7 @@ function makeModule(
     id,
     name: id,
     version: '1.0.0',
-    celilo_contract: '1.0',
+    celilo_contract: '2.0',
     provides: opts.provides
       ? {
           capabilities: opts.provides.map((p) => ({ ...p, data: {}, functions: [] })),

package/src/services/audit/index.test.ts

@@ -20,6 +20,12 @@ const emptyDeps = {
     db: fakeDb,
   },
   browserPin: { consumers: [], provisioned: null },
+  serverBunPin: {
+    pinnedVersion: '1.4.2',
+    runningVersion: '1.4.2',
+    pinPath: '/etc/celilo/mise.pin.toml',
+  },
+  rebootPending: { verdict: { pending: false, unmeasured: false, reasons: [] }, marker: null },
   capabilityAbi: { modules: [] },
   terraformPlan: {
     modules: [],
@@ -42,6 +48,7 @@ const emptyDeps = {
   secretsDecryptable: { results: [] },
   servicesReachable: { results: [] },
   machinesReachable: { results: [] },
+  machineInterfaceZones: { machines: [] },
   diskSpace: { results: [] },
   transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
   trustedSources: { firewalls: [], unreachableFirewalls: [] },

package/src/services/audit/index.ts

@@ -25,13 +25,19 @@ import {
 import { type DiskSpaceAuditDeps, auditDiskSpace } from './disk-space';
 import { type HealthAuditDeps, auditHealth } from './health';
 import { type JailExemptionsAuditDeps, auditJailExemptions } from './jail-exemptions';
+import {
+  type MachineInterfaceZonesAuditDeps,
+  auditMachineInterfaceZones,
+} from './machine-interface-zones';
 import { type MachinesReachableAuditDeps, auditMachinesReachable } from './machines-reachable';
 import { type ModuleConfigsAuditDeps, auditModuleConfigs } from './module-configs';
 import { type ModuleIntegrityAuditDeps, auditModuleIntegrity } from './module-integrity';
 import { type ModuleVersionsAuditDeps, auditModuleVersions } from './module-versions';
 import { type PublicDnsAuditDeps, auditPublicDns } from './public-dns';
+import { type RebootPendingAuditDeps, auditRebootPending } from './reboot-pending';
 import { type SchemaAuditDeps, auditSchema } from './schema';
 import { type SecretsDecryptableAuditDeps, auditSecretsDecryptable } from './secrets-decryptable';
+import { type ServerBunPinAuditDeps, auditServerBunPin } from './server-bun-pin';
 import {
   type ServicesCredentialsAuditDeps,
   auditServicesCredentials,
@@ -57,6 +63,8 @@ export interface AuditDeps {
   schema: SchemaAuditDeps;
   capabilityAbi: CapabilityAbiAuditDeps;
   browserPin: BrowserPinAuditDeps;
+  serverBunPin: ServerBunPinAuditDeps;
+  rebootPending: RebootPendingAuditDeps;
   terraformPlan: TerraformPlanAuditDeps;
   moduleVersions: ModuleVersionsAuditDeps;
   moduleConfigs: ModuleConfigsAuditDeps;
@@ -72,6 +80,7 @@ export interface AuditDeps {
   secretsDecryptable: SecretsDecryptableAuditDeps;
   servicesReachable: ServicesReachableAuditDeps;
   machinesReachable: MachinesReachableAuditDeps;
+  machineInterfaceZones: MachineInterfaceZonesAuditDeps;
   publicDns: PublicDnsAuditDeps;
   diskSpace: DiskSpaceAuditDeps;
   transportReads: TransportReadsAuditDeps;
@@ -115,6 +124,8 @@ export async function runAudit(
     wrap('schema', auditSchema(deps.schema)),
     wrap('capability_abi', auditCapabilityAbi(deps.capabilityAbi)),
     wrap('browser_pin', auditBrowserPin(deps.browserPin)),
+    wrap('server_bun_pin', Promise.resolve(auditServerBunPin(deps.serverBunPin))),
+    wrap('reboot_pending', Promise.resolve(auditRebootPending(deps.rebootPending))),
     wrap('terraform_plan', auditTerraformPlan(deps.terraformPlan)),
     wrap('module_versions', auditModuleVersions(deps.moduleVersions)),
     wrap('module_configs', auditModuleConfigs(deps.moduleConfigs)),
@@ -136,6 +147,10 @@ export async function runAudit(
     wrap('secrets_decryptable', auditSecretsDecryptable(deps.secretsDecryptable)),
     wrap('services_reachable', auditServicesReachable(deps.servicesReachable)),
     wrap('machines_reachable', auditMachinesReachable(deps.machinesReachable)),
+    wrap(
+      'interface_classification',
+      Promise.resolve(auditMachineInterfaceZones(deps.machineInterfaceZones)),
+    ),
     wrap('public_dns', auditPublicDns(deps.publicDns)),
     wrap('disk_space', Promise.resolve(auditDiskSpace(deps.diskSpace))),
     wrap('transport_reads', auditTransportReads(deps.transportReads)),

package/src/services/audit/machine-interface-zones.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from 'bun:test';
+import { auditMachineInterfaceZones } from './machine-interface-zones';
+
+describe('auditMachineInterfaceZones', () => {
+  test('reports a machine whose stored labels predate the zone model', () => {
+    const findings = auditMachineInterfaceZones({
+      machines: [
+        {
+          hostname: 'celilo-mgr',
+          changes: [
+            { name: 'eth0', ipAddress: '10.0.120.10', from: 'external', to: 'secure-mgmt' },
+          ],
+        },
+      ],
+    });
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0].severity).toBe('drift');
+    expect(findings[0].code).toBe('stale_interface_zone_labels');
+    expect(findings[0].subject).toBe('celilo-mgr');
+    expect(findings[0].message).toContain('external → secure-mgmt');
+    expect(findings[0].remediation).toContain('celilo machine reclassify celilo-mgr --apply');
+  });
+
+  test('reports nothing for a machine whose labels agree', () => {
+    expect(auditMachineInterfaceZones({ machines: [{ hostname: 'pi-01', changes: [] }] })).toEqual(
+      [],
+    );
+  });
+});

package/src/services/audit/machine-interface-zones.ts

@@ -0,0 +1,43 @@
+/**
+ * Stored machine interface zone labels that no longer match the zone model.
+ *
+ * A label written at `machine add` is never revisited, so a zone-model change
+ * leaves every earlier machine describing a topology that no longer exists.
+ * Nothing said so until this check: celilo#1382 surfaced only as an upgrade
+ * failing with "no non-loopback interface in zone 'secure-mgmt'", on a machine
+ * that had one.
+ *
+ * `drift`, not `blocked`: a stale label breaks a deploy only when something
+ * resolves by zone, and the remediation is one command.
+ *
+ * Pure over a pre-computed diff — see services/machine-interface-zones.ts.
+ */
+
+import type { ZoneReclassification } from '../machine-interface-zones';
+import type { DriftFinding } from './types';
+
+export interface MachineInterfaceZonesAuditDeps {
+  /** One entry per machine, carrying only the labels that disagree. */
+  machines: Array<{ hostname: string; changes: ZoneReclassification[] }>;
+}
+
+export function auditMachineInterfaceZones(deps: MachineInterfaceZonesAuditDeps): DriftFinding[] {
+  return deps.machines
+    .filter((m) => m.changes.length > 0)
+    .map(({ hostname, changes }) => {
+      const named = changes
+        .map((c) => `${c.name} (${c.ipAddress}): ${c.from} → ${c.to}`)
+        .join(', ');
+      return {
+        category: 'interface_classification',
+        severity: 'drift',
+        code: 'stale_interface_zone_labels',
+        subject: hostname,
+        message: `${hostname}: ${changes.length} stored interface zone label(s) predate the current zone model — ${named}`,
+        details:
+          'Interface zones are decided once, at `machine add`, and never re-checked. When a zone is added or a subnet is declared for one that had none, every machine added earlier keeps the old label. Anything resolving a machine by zone then reports the interface as absent rather than as mislabelled.',
+        remediation: `celilo machine reclassify ${hostname} --apply`,
+        actionable: true,
+      };
+    });
+}

package/src/services/audit/module-configs.test.ts

@@ -21,7 +21,7 @@ function makeModule(
     id,
     name: id,
     version: '1.0.0',
-    celilo_contract: '1.0',
+    celilo_contract: '2.0',
     variables: { owns: variables, imports: [] },
   } as unknown as ModuleManifest;
   // Default state INSTALLED so existing tests continue to expect

package/src/services/audit/reboot-pending.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, it } from 'bun:test';
+import { auditRebootPending } from './reboot-pending';
+
+const CLEAN = { pending: false, unmeasured: false, reasons: [] };
+const NOW = 1_700_000_000_000;
+
+describe('auditRebootPending', () => {
+  it('reports a pending reboot as drift, carrying the reason', () => {
+    const [finding] = auditRebootPending({
+      verdict: {
+        pending: true,
+        unmeasured: false,
+        reasons: ['the running kernel is 6.8.0-1063-raspi'],
+      },
+      marker: null,
+      now: () => NOW,
+    });
+
+    expect(finding.severity).toBe('drift');
+    expect(finding.code).toBe('reboot_pending');
+    expect(finding.message).toContain('6.8.0-1063-raspi');
+    expect(finding.remediation).toContain('celilo system reboot');
+  });
+
+  it('reports an unverified reboot as BLOCKED — a control plane may not have come back', () => {
+    const [finding] = auditRebootPending({
+      verdict: CLEAN,
+      marker: { bootIdBefore: 'a', requestedAt: NOW - 3 * 60 * 60 * 1000, reason: 'kernel' },
+      now: () => NOW,
+    });
+
+    expect(finding.severity).toBe('blocked');
+    expect(finding.code).toBe('reboot_unverified');
+    expect(finding.message).toContain('3h ago');
+  });
+
+  it('is silent on a host that is current and has no reboot outstanding', () => {
+    expect(auditRebootPending({ verdict: CLEAN, marker: null, now: () => NOW })).toEqual([]);
+  });
+
+  it('reports UNMEASURED rather than clean when the host could not be asked', () => {
+    const [finding] = auditRebootPending({
+      verdict: { pending: false, unmeasured: true, reasons: [] },
+      marker: null,
+      now: () => NOW,
+    });
+
+    expect(finding.severity).toBe('unmeasured');
+    expect(finding.actionable).toBe(false);
+  });
+
+  it('still reports the unverified reboot when the host itself is unmeasurable', () => {
+    // The two facts are independent: not being able to read the kernel does
+    // not make an outstanding reboot request go away.
+    const findings = auditRebootPending({
+      verdict: { pending: false, unmeasured: true, reasons: [] },
+      marker: { bootIdBefore: 'a', requestedAt: NOW, reason: '' },
+      now: () => NOW,
+    });
+
+    expect(findings.map((f) => f.code)).toEqual(['reboot_unverified', 'reboot_pending_unmeasured']);
+  });
+});

package/src/services/audit/reboot-pending.ts

@@ -0,0 +1,85 @@
+/**
+ * Pending reboot on the management server (celilo#1378).
+ *
+ * `apt-upgrade` printed needrestart's pending-kernel block and that was the
+ * only place the condition was ever visible — so it was visible exactly when
+ * an operator happened to run an upgrade, and invisible the rest of the time.
+ * celilo-mgr sat on a kernel it was not running for days that way.
+ *
+ * Two findings, and they are different facts:
+ *
+ *   reboot_pending    — the host needs a reboot and has not had one.
+ *   reboot_unverified — celilo ASKED for a reboot and nothing has confirmed
+ *                       the host came back. That is the more serious of the
+ *                       two: it is the shape of a control plane that went
+ *                       down and did not return, or returned without its
+ *                       dispatcher.
+ */
+
+import type { RebootMarker, RebootPendingVerdict } from '../system-reboot';
+import type { DriftFinding } from './types';
+
+export interface RebootPendingAuditDeps {
+  verdict: RebootPendingVerdict;
+  /** A reboot celilo requested that `verifyReturn` has not yet cleared. */
+  marker: RebootMarker | null;
+  /** Defaults to `Date.now()`. */
+  now?: () => number;
+}
+
+const HOUR = 60 * 60 * 1000;
+
+export function auditRebootPending(deps: RebootPendingAuditDeps): DriftFinding[] {
+  const findings: DriftFinding[] = [];
+  const now = (deps.now ?? Date.now)();
+
+  if (deps.marker !== null) {
+    const ageHours = Math.round((now - deps.marker.requestedAt) / HOUR);
+    findings.push({
+      category: 'reboot_pending',
+      severity: 'blocked',
+      code: 'reboot_unverified',
+      subject: 'system',
+      message: `celilo requested a reboot ${ageHours}h ago and nothing has confirmed the host came back.`,
+      details:
+        'The process that asks for a reboot goes down with the host, so the return is verified by a second call. An uncleared marker means that call never succeeded — either the host did not reboot, or it came back without its dispatcher.',
+      remediation:
+        'Run `celilo system reboot --verify`. It passes only once the boot id has changed and the dispatcher and CLI answer, and it names which of those is missing.',
+      actionable: true,
+    });
+  }
+
+  if (deps.verdict.unmeasured) {
+    findings.push({
+      category: 'reboot_pending',
+      severity: 'unmeasured',
+      code: 'reboot_pending_unmeasured',
+      subject: 'system',
+      message:
+        'Neither the reboot-required marker nor a kernel pair could be read, so nothing was compared.',
+      details:
+        'An absent /var/run/reboot-required is not evidence of a current kernel — a host without that path simply never writes one.',
+      remediation:
+        'Run `celilo system audit` on the management server itself (Debian/Ubuntu), where /var/run/reboot-required and `uname -r` are readable.',
+      actionable: false,
+    });
+    return findings;
+  }
+
+  if (deps.verdict.pending) {
+    findings.push({
+      category: 'reboot_pending',
+      severity: 'drift',
+      code: 'reboot_pending',
+      subject: 'system',
+      message: `The management server needs a reboot: ${deps.verdict.reasons.join('; ')}.`,
+      details:
+        'A kernel or service the host has installed is not the one it is running. Until it reboots, an upgrade that has been applied on disk has not taken effect.',
+      remediation:
+        'Reboot through celilo: `celilo system reboot --allow-reboot`. It refuses while a module operation is in flight, and `--verify` confirms the host came back.',
+      actionable: true,
+    });
+  }
+
+  return findings;
+}

package/src/services/audit/recurrence-gate.test.ts

@@ -38,7 +38,9 @@ import { auditInterfaceClassification } from './interface-classification';
 import { auditModuleIntegrity } from './module-integrity';
 import { auditModuleVersions } from './module-versions';
 import { auditPublicDns } from './public-dns';
+import { auditRebootPending } from './reboot-pending';
 import { auditSchema } from './schema';
+import { auditServerBunPin } from './server-bun-pin';
 import { auditTerraformPlan } from './terraform-plan';
 import { auditTrustedSources } from './trusted-sources';
 import type { DriftCategory, DriftFinding, DriftSeverity } from './types';
@@ -68,6 +70,25 @@ const GATE: Record<DriftCategory, GateEntry> = {
     because:
       'compares capability versions claimed in installed module manifests against the framework registry and deployed providers, all read from celilo own DB and local manifests — the subject is celilo itself and is always reachable',
   },
+  reboot_pending: {
+    probe: () =>
+      auditRebootPending({
+        verdict: { pending: false, unmeasured: true, reasons: [] },
+        marker: null,
+      }),
+    because:
+      'probed: a host with no /var/run/reboot-required and no readable kernel pair was not measured, and an absent marker is not a current kernel',
+  },
+  server_bun_pin: {
+    probe: () =>
+      auditServerBunPin({
+        pinnedVersion: null,
+        runningVersion: '1.4.2',
+        pinPath: '/etc/celilo/mise.pin.toml',
+      }),
+    because:
+      'probed: the deb pin file can be absent (a non-deb install), and then nothing was compared',
+  },
   browser_pin: {
     because:
       'compares a bundled client playwright revision against the locally provisioned browser binary, both on this machine — always reachable',

package/src/services/audit/server-bun-pin.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, test } from 'bun:test';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { auditServerBunPin, readPinnedBunVersion } from './server-bun-pin';
+
+const PIN = '/etc/celilo/mise.pin.toml';
+
+describe('server bun pin audit', () => {
+  test('silent when the running bun is the pinned bun', () => {
+    expect(
+      auditServerBunPin({ pinnedVersion: '1.4.2', runningVersion: '1.4.2', pinPath: PIN }),
+    ).toEqual([]);
+  });
+
+  test('reports drift naming both versions — the celilo#1379 shape', () => {
+    const [finding] = auditServerBunPin({
+      pinnedVersion: '1.4.2',
+      runningVersion: '1.3.3',
+      pinPath: PIN,
+    });
+    expect(finding?.code).toBe('server_bun_pin_drift');
+    expect(finding?.severity).toBe('drift');
+    expect(finding?.message).toContain('1.3.3');
+    expect(finding?.message).toContain('1.4.2');
+  });
+
+  test('an unreadable pin is unmeasured, never green', () => {
+    const [finding] = auditServerBunPin({
+      pinnedVersion: null,
+      runningVersion: '1.4.2',
+      pinPath: PIN,
+    });
+    expect(finding?.severity).toBe('unmeasured');
+  });
+
+  test('reads the bun line out of the shipped pin file', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'celilo-pin-'));
+    const path = join(dir, 'mise.pin.toml');
+    writeFileSync(path, '# comment\n[tools]\nbun = "1.4.2"\nterraform = "1.10.0"\n');
+    expect(readPinnedBunVersion(path)).toBe('1.4.2');
+    expect(readPinnedBunVersion(join(dir, 'absent.toml'))).toBeNull();
+  });
+});

package/src/services/audit/server-bun-pin.ts

@@ -0,0 +1,95 @@
+/**
+ * Server bun-pin drift (celilo#1379).
+ *
+ * The deb pins the bun celilo was built and tested against, and the CLI runs
+ * on whatever bun mise resolves at /var/celilo. Those can disagree: for three
+ * months celilo-mgr ran on bun 1.3.3 while the shipped pin said 1.4.2,
+ * because the postinst seeded the pin file once and an upgrade never
+ * rewrote it. 1.3.3's `Bun.YAML.parse` reads a bare `on:` key as `true`, so
+ * production was running a parser no gate had ever exercised.
+ *
+ * The postinst now rewrites the pin on every configure, which closes the way
+ * that drift arose. This check is what makes the drift VISIBLE if it arises
+ * some other way — an operator's `mise use`, a hand-edited config, a
+ * dispatcher still holding an old runtime.
+ *
+ * It compares the pin the deb shipped against the bun THIS process is
+ * running on. Not `mise which bun`, which answers what mise would resolve
+ * now rather than what is actually executing (measured 2026-09-10: mise
+ * named 1.4.2 and ran 1.3.3 on the same box).
+ */
+
+import { readFileSync } from 'node:fs';
+import type { DriftFinding } from './types';
+
+export interface ServerBunPinAuditDeps {
+  /** The bun version the installed deb pins, or `null` when unreadable. */
+  pinnedVersion: string | null;
+  /** The bun this process is running on, or `null` when not under bun. */
+  runningVersion: string | null;
+  /** Where `pinnedVersion` was read from — named in the finding. */
+  pinPath: string;
+}
+
+export function auditServerBunPin(deps: ServerBunPinAuditDeps): DriftFinding[] {
+  const { pinnedVersion, runningVersion, pinPath } = deps;
+
+  if (pinnedVersion === null || runningVersion === null) {
+    return [
+      {
+        category: 'server_bun_pin',
+        severity: 'unmeasured',
+        code: 'server_bun_pin_unmeasured',
+        subject: 'system',
+        message:
+          pinnedVersion === null
+            ? `No bun pin could be read from ${pinPath}, so the running bun was compared against nothing.`
+            : 'This process is not running under bun, so the running bun version is unknown.',
+        remediation:
+          pinnedVersion === null
+            ? `Confirm the celilo deb is installed and ${pinPath} exists (\`sudo apt install --reinstall celilo\`).`
+            : 'Run `celilo system audit` from the deb-installed celilo (/usr/local/bin/celilo).',
+        actionable: false,
+      },
+    ];
+  }
+
+  if (pinnedVersion === runningVersion) return [];
+
+  return [
+    {
+      category: 'server_bun_pin',
+      severity: 'drift',
+      code: 'server_bun_pin_drift',
+      subject: 'system',
+      message: `celilo is running on bun ${runningVersion}, but the installed deb pins bun ${pinnedVersion} (${pinPath}).`,
+      details:
+        'celilo is tested against the pinned bun only. A different runtime is not a version-number mismatch — bun 1.3.3 and 1.4.2 parse the same YAML differently, which is how a deploy shipped on an untested parser (celilo#1379).',
+      remediation:
+        'Reconcile the runtime: `sudo apt install --reinstall celilo` rewrites /var/celilo/mise.local.toml from the deb pin, then `celilo events restart-daemon` puts the dispatcher on it.',
+      actionable: false,
+    },
+  ];
+}
+
+/** The pin the deb ships. Read at audit time — never a copy in celilo's code. */
+export const DEB_PIN_PATH = '/etc/celilo/mise.pin.toml';
+
+export function readPinnedBunVersion(path: string = DEB_PIN_PATH): string | null {
+  try {
+    // One `bun = "x.y.z"` line under [tools]. A TOML parser for one key would
+    // be a dependency to read a file this file's own format gate keeps simple.
+    const match = readFileSync(path, 'utf-8').match(/^\s*bun\s*=\s*"([^"]+)"/m);
+    return match?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export function collectServerBunPinDeps(pinPath: string = DEB_PIN_PATH): ServerBunPinAuditDeps {
+  return {
+    pinnedVersion: readPinnedBunVersion(pinPath),
+    runningVersion: process.versions.bun ?? null,
+    pinPath,
+  };
+}

package/src/services/audit/types.ts

@@ -27,6 +27,8 @@ export type DriftCategory =
   | 'schema'
   | 'capability_abi'
   | 'browser_pin'
+  | 'server_bun_pin'
+  | 'reboot_pending'
   | 'terraform_plan'
   | 'module_versions'
   | 'module_configs'