@celilo/cli 4.1.0 → 5.0.1

package/AGENTS.md

@@ -30,7 +30,7 @@ web** — they are the source of truth; the hosted copies at
 An **app** is a module that provides no capability (it serves content), so set
 `version_source: { kind: changeset }`.
 
-1. **`manifest.yml`** — `id` (kebab-case), `celilo_contract: "1.0"`, `version`,
+1. **`manifest.yml`** — `id` (kebab-case), `celilo_contract: "2.0"`, `version`,
    the capabilities you `requires:` (e.g. `public_web`, `idp`), `variables`,
    `hooks`, and `version_source`. Keep the schema directive on line 1 so your
    editor validates:
@@ -60,7 +60,7 @@ celilo module deploy <id> / update / health   # deploy + verify on the fleet
 
 ## Conventions / rules
 
-- Module `id` is **kebab-case**; pin `celilo_contract: "1.0"`.
+- Module `id` is **kebab-case**; pin `celilo_contract: "2.0"`.
 - **`version_source`** picks how `version` is sourced: `changeset` (apps/content —
   authored via changesets, ordered by `+N`), `pin` (wraps upstream software —
   `version` = the installed upstream version, resolver-checked), `recipe`

package/CELILO_SUBSYSTEMS.md

@@ -201,6 +201,7 @@ runner seam (`execRunner` real / `createMockRunner` for tests) lives in
 
 - **Hook executor / ABI** — `apps/celilo/src/hooks/executor.ts` (`invokeHook`, `executeHookScript`, `checkRequiredCapabilities`), types in `apps/celilo/src/hooks/types.ts` (`HookContext`, `HookDefinition`, `HookName`). Named-hook runner: `apps/celilo/src/hooks/run-named-hook.ts`. Manifest hook config: `apps/celilo/src/hooks/load-hook-config.ts`.
 - **Hook process boundary (a hook is a program celilo RUNS)** — `apps/celilo/src/hooks/hook-protocol.ts` (the NDJSON frame union, `HOOK_PROTOCOL_VERSION`, `serializeError`/`deserializeError`), `apps/celilo/src/hooks/broker.ts` (`startBroker`, `capabilityShape`), `apps/celilo/src/hooks/hook-runner-entry.ts` + `apps/celilo/src/hooks/hook-runner.ts` (the spawned shim — the ONLY thing that `import()`s module code; the entry exists to install the advisory lint before the shim's import graph can ESM-load `node:fs`, see `unjailed-lint.ts`). `executeHookScript` spawns `bun hook-runner-entry.ts` over a Unix socket instead of importing; the nine `invokeHook` call sites and `defineHook` are unchanged. **The broker does not know what a capability is**: it sends a shape descriptor built by the same own-string-key walk `wrapWithLogging` does (functions → `methods`, everything else → `data`, which is where `stampProvider`'s `providerModuleId` lives), and the shim rebuilds forwarding proxies from it — so an optional method a provider did not implement is absent rather than present-and-throwing, and `if (cap.registerTrustedSource)` keeps answering correctly. A socket rather than stdout because module scripts spawn subprocesses and a grandchild writing to fd 1 would corrupt the frame stream. Two consequences worth knowing: the child's environment is an **allow-list** (`hookChildEnv` — how to run: `PATH`, `HOME`, `LANG`, `TZ`, `TMPDIR`; whom to trust: `NODE_EXTRA_CA_CERTS`, `SSL_CERT_FILE`, `SSL_CERT_DIR`; the proxy variables; the `CELILO_HOOK_*` channels; `CELILO_DEBUG` — `FORWARDED_ENV` in executor.ts is the source of truth), so a hook reading any other operator variable now gets `undefined`; and a timeout is a real SIGTERM-then-SIGKILL with the broker refusing further capability calls, replacing a `Promise.race` that cancelled nothing and let a "timed out" hook go on writing DNS and firewall state (celilo#1003). Capability PROVIDER factories still load in-process — they ARE the broker's implementation. Stages 1 and 2 of `openspec/changes/hook-process-boundary`; the filesystem is claimed by the jail below, and SSH reachability by the remote-ops broker next.
+- **Hook-owned state (a hook WRITES what it discovers; it never returns it)** — `apps/celilo/src/hooks/hook-store.ts` (broker side, over `(db, moduleId, manifest, masterKey)`) and `apps/celilo/src/hooks/hook-store-proxy.ts` (the child-side buffering proxy). Two `HookStore` instances reach every hook as `context.config` and `context.secrets`, each with async `get`/`set`/`delete`/`transaction` — async because a hook is a subprocess and every call is a broker round trip over the `store` RPC family (hook protocol version 2). `config` validates against the `variables.owns` entries declared `source: hook` and writes plaintext via `upsertModuleConfig`; `secrets` validates against `secrets.declares` and encrypts. **An undeclared name THROWS, naming the module and the declared set** (design D2) — a silent drop is the failure this whole subsystem exists to delete. `transaction(fn)` buffers CHILD-side, so a throwing `fn` sends no frame at all and the broker applies a finished op list inside one `db.transaction`. The executor injects both lazily through a `hookStores` provider at all nine `invokeHook` sites; a provider-less run REFUSES store writes loudly rather than dropping them. **The counterpart fact is an absence**: contract 1.0 swept a hook's RETURNED record into secrets and config from three capture sites in the deploy path, and all three are gone — nothing anywhere persists a hook return value, `'1.0'` is refused by name as a RETIRED contract, and the recurrence gate is `apps/celilo/test-integration/module/hook-returns-are-never-persisted.test.ts` (behavioural for `validate_config`/`on_install`, reach-measured static over every `invokeHook` caller for `container_created`). A framework-owned provider secret goes through the named `recordProviderSecret` in `secrets/storage.ts`, which no hook can reach. See `openspec/changes/hook-owned-state/`.
 - **Unjailed advisory lint (task 4.7, NOT a security boundary)** — `apps/celilo/src/hooks/unjailed-lint.ts`. Where there is no jail backend the executor passes the run's derived mount set to the shim in the environment (`CELILO_HOOK_MOUNT_SET`), and the shim wraps the path-taking `node:fs` / `node:fs/promises` functions so an access outside the set (or a write to a read-only row) warns through the hook's own logger: "on a jailed host this would fail", and that it is advisory. It is the mount-set derivation's SECOND consumer, so it cannot drift from what the jail enforces. It observes JS-level `node:fs` calls only — module code bypasses it trivially — and it must never be described as a boundary, in code or output.
 - **Remote-ops broker (reachability scoped by the credential, stage 3 / D12)** — `apps/celilo/src/hooks/remote-broker.ts` (`startRemoteBroker`, `RemoteAccessPolicy`) answering a SECOND socket beside the capability one, with the policy in `apps/celilo/src/services/remote-access.ts` (`remoteAccessPolicy`) and the asking half inside `@celilo/capabilities`' own remote primitives (`packages/capabilities/src/remote.ts`, "The hook remote-ops bridge"). The jail binds no `~/.ssh`, so a hand-built `ssh` cannot authenticate; the primitives detect `CELILO_HOOK_REMOTE_SOCKET`, send each operation as a STRUCTURED request (never a shell string — the broker rebuilds the ssh line itself), and the broker checks the target against `ownedSystemModuleIds` + `getModuleSystems` before running anything, refusing with the module, the target, and the capability route named. Requests carrying the module's OWN credential (an `identityFile` crossing as content and materialised per call, or `installAuthorizedKey`'s password — the cPanel case) are scoped by that credential instead; an explicit non-root user likewise, because the fleet key's authority is root on fleet systems. Stream primitives' LOCAL paths are confined to the run's granted roots (stateDir, screenshots, generated/, declared path inputs), or `streamBackup` would be a write-as-celilo oracle. Attribution is by the module that PERFORMS the operation: a hook's request to the hook's module (the nine `invokeHook` sites build the policy), a provider's transport to the provider's module — providers run in-process and do not cross this socket, and `public_web`'s hand-built upload was replaced by the Ansible static-content converge (capability-owned-tables stage 4, celilo#1014). Residual, recorded rather than papered over: a hook can still `fetch()` any HTTP endpoint directly; only `probeHttp` consults the target check.
 - **Hook jail (a hook sees the paths it was given, and nothing else)** — `apps/celilo/src/hooks/mount-set.ts` (`deriveMountSet`, `toBwrapArgs`, `forbiddenPaths` — PURE, computes a filesystem view and touches nothing) and `apps/celilo/src/hooks/jail.ts` (`detectJailBackend`, `planJailedSpawn`, `realpathRequest`, `runtimeModulePathsFor`, `recordJailMode` — the half that touches the machine). `executeHookScript` spawns the shim under `bwrap` with the module's tree read-only, `state/` + `generated/` + this run's `screenshots/<run>` read-write on top of it, each contract-declared path input at its declared access, the broker's socket directory, the runtime and the `node_modules` the shim resolves through, and `/tmp` a fresh tmpfs FIRST so it cannot erase the socket or a staged input. `~/.ssh` is deliberately NOT bound (stage 3, D12): withholding the credential is what makes the remote-ops broker's target check a boundary. **The acceptance criterion is absence, not a check**: the module store and the data directory are simply not bound, so `master.key` and a sibling module give `ENOENT`. The set is DERIVED — a module cannot ask for more — and `bwrap` itself is never in it, because the AppArmor profile grants `userns` to `/usr/bin/bwrap` for anyone on the box (design D9). Backend detection RUNS bubblewrap rather than looking for it (four different denials all leave the binary in place), and the resulting mode is written to `hook-jail-mode.json` beside celilo's other per-machine state rather than logged, so a host that stops jailing is readable. The policy is `auto` / `required` / `off`, resolved in a fixed precedence: the `CELILO_HOOK_JAIL` environment variable, then the stored `hooks.jail_policy` system config key (`celilo system config set hooks.jail_policy <value>`, which asks an interview question before writing `off` unless `--force`), then the default, which is **`off`** (ce-rez7). Jailing begins because an operator set a policy, never because an upgrade installed a backend — celilo-mgr's 2026-09-07 move to 1:2.2.1 installed bubblewrap and loaded the AppArmor profile and hooks kept running unjailed, which is the ruling working. `resolveJailPolicy` returns the source alongside the policy and `system doctor` renders it, so an effective value is always locatable. macOS has a `sandbox-exec` backend in the union, but `auto` defers on it (ce-29z: sandbox-exec DENIES undeclared writes where bubblewrap masks them, and D14's declared-path mechanism is not built), so the hook runs unjailed with the mode recorded; `required` bypasses the deferral for an operator who opts in. An `unjailed` record carries `lastJailed` (the jailed record it replaced on the same host), which is what the `hook_jail` self-monitor reads (`services/alerting/hook-jail.ts`, created unsuppressible by `celilo monitor add hook_jail`) to alert on a host that used to jail and has stopped. `celilo system doctor`'s "Hook execution" section (`renderHookExecutionSection`) reports the live mode and, when unjailed, why.
@@ -252,6 +253,7 @@ to look, which is how a forgotten pause actually gets found.
 
 - **Generator** — `apps/celilo/src/templates/generator.ts` — `generateTemplates` (orchestration), plus Terraform/Ansible file handling.
 - **Variable resolution** — `apps/celilo/src/variables/resolver.ts` (parser: `apps/celilo/src/variables/parser.ts`). Supported prefixes: `$self`, `$system`, `$secret`, `$system_secret`, `$capability`, `$infra`.
+- **Where a config value came from (`module_configs.source`)** — the `source` column (migration `0031_module_config_source.sql`, nullable, no backfill — nothing in an existing row proves who wrote it). The variable `source:` enum in `apps/celilo/src/manifest/schema.ts` and `schemas/module-manifest.schema.json` carries **`hook`** alongside `user`/`system`/`capability`/`infrastructure`/`terraform`: the value is written by the owning module's own hook through `context.config.set`, so the configuration interview never prompts for it (`deploy-validation.ts`, `deploy-preflight.ts`, `templates/generator.ts` all skip it the way they skip `infrastructure`) and `celilo module config set` refuses it — `isDerivedVariable` refuses every non-`user` source, and `describeDerivedSource`/`explainNotSettable` name the accessor. An operator and a hook writing the same key would otherwise overwrite each other, which is what `source: user` on four wireguard keys actually did.
 
 ## Secrets
 

package/MODULE_PRIMITIVES.md

@@ -51,6 +51,7 @@ expect(probe(sys, { kind: 'systemd', unit: 'caddy' }, run).healthy).toBe(true);
 | Read a unit's journal | `tailLog` / `grepLog` | `ssh … journalctl` |
 | Run a secret on a command line | `runAppCommandWithSecret` | secret on argv |
 | Anything else with no capability/HTTP/converge path | `runAppCommand` (+ `// escape-hatch:`) | a raw ssh string |
+| Persist state the hook discovered | `context.config.set` / `context.secrets.set` | returning it; `execFileSync('celilo', …)` |
 
 **Reach for a capability method first.** If another module already provides the
 thing (open a port → `firewall.exposeService`; register a route →
@@ -177,6 +178,14 @@ directly — prefer the specific primitive. `opts` is `{ input?, timeoutMs? }`.
 - **No `sleep`** — `waitFor` on the real condition.
 - **Computed config → `applyRenderedConfig`**, not `ssh cat >`. It validates and
   rolls back; a broken config never goes live.
+- **State a hook discovered is WRITTEN, never returned.** `context.config.set`
+  if it is not sensitive, `context.secrets.set` if it is — sensitivity decides
+  the store, and nothing else does. Declare the name first (`source: hook` in
+  `variables.owns`, or `secrets.declares`) or the write throws. A returned
+  record is persisted nowhere, and the hook jail has no `celilo` binary, so
+  shelling out to `celilo module config set` reports success and writes
+  nothing. Details: MODULE_DEVELOPMENT_GUIDE.md, "Persisting state a hook
+  discovers".
 
 See also: `CELILO_SUBSYSTEMS.md` (the primitive impls + the firewall converge),
 `openspec/changes/unified-management-no-ssh/proposal.md` (the design), `reference/MODULE_DEVELOPMENT_GUIDE.md`.

package/drizzle/0034_private_routes.sql

@@ -0,0 +1,41 @@
+-- The internal ingress's declared routes, in core, in their own table.
+--
+-- `caddy-internal` kept the routes its consumers registered in a `routes`
+-- module-config key: the same rows as `web_routes`, stored as one module's
+-- business rather than as declared state core owns. That key is why the two
+-- ingresses could not share plumbing — the private provider had nothing core
+-- could render, converge or audit.
+--
+-- Same columns as `web_routes`, separate table, and the separation is the
+-- point. The PUBLIC provider derives the hostnames it serves from every row of
+-- `web_routes`, so a private route stored there would be picked up and served
+-- publicly, with a public certificate, by the ingress caddy-internal exists to
+-- keep it away from (celilo#846). One table with a flag would make that leak a
+-- missing `WHERE` clause away; two tables make it impossible.
+--
+-- No data migration (design D9 of providers-converge-declared-state). The
+-- table starts empty. When caddy-internal deploys, provider arrival
+-- re-registers its consumers and their hooks write their routes into it inside
+-- that same deploy — observed 2026-09-17, "Re-registered 1 consumer(s) with
+-- 'caddy-internal': wireguard-manager". A one-time backfill would be code that
+-- runs once and is then wrong to keep.
+CREATE TABLE `private_routes` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`slug` text NOT NULL,
+	`module_id` text NOT NULL,
+	`type` text NOT NULL,
+	`path` text NOT NULL,
+	`hostname` text NOT NULL,
+	`target_host` text,
+	`target_port` integer,
+	`websocket` integer DEFAULT false NOT NULL,
+	`content_hash` text,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`updated_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`module_id`) REFERENCES `modules`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+-- Scoped to hostname as `web_routes` is, and scoped to THIS table: the same
+-- hostname and path may exist on both ingresses, which is a legitimate
+-- split-horizon arrangement and not a collision.
+CREATE UNIQUE INDEX `private_routes_hostname_path_idx` ON `private_routes` (`hostname`,`path`);

package/drizzle/meta/_journal.json

@@ -239,6 +239,13 @@
       "when": 1789082481000,
       "tag": "0033_build_bus_hook_runs",
       "breakpoints": true
+    },
+    {
+      "idx": 34,
+      "version": "6",
+      "when": 1789947740964,
+      "tag": "0034_private_routes",
+      "breakpoints": true
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/cli",
-  "version": "4.1.0",
+  "version": "5.0.1",
   "description": "Celilo — home lab orchestration CLI",
   "type": "module",
   "bin": {
@@ -59,7 +59,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1109.0",
     "@aws-sdk/lib-storage": "^3.1101.0",
-    "@celilo/capabilities": "^5.1.1",
+    "@celilo/capabilities": "^6.0.0",
     "@celilo/cli-display": "^0.2.0",
     "@celilo/core": "^0.14.0",
     "@celilo/event-bus": "^0.7.0",

package/src/api/sessions.test.ts

@@ -79,7 +79,7 @@ beforeEach(() => {
       name: 'iptables',
       sourcePath: join(dir, 'installed'),
       version: '1.0.2+9',
-      manifestData: { celilo_contract: '1.0', id: 'iptables', name: 'iptables', version: '1.0.2' },
+      manifestData: { celilo_contract: '2.0', id: 'iptables', name: 'iptables', version: '1.0.2' },
     })
     .run();
 

package/src/capabilities/registration.test.ts

@@ -17,7 +17,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -50,7 +50,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -89,7 +89,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -126,7 +126,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -155,7 +155,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -185,7 +185,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -213,7 +213,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -244,7 +244,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -280,7 +280,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -312,7 +312,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -343,7 +343,7 @@ describe('Capability Registration', () => {
       };
 
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',

package/src/capabilities/secrets.test.ts

@@ -11,7 +11,7 @@ describe('Capability Secret Access', () => {
   describe('isCapabilityFieldSecret', () => {
     test('should return true when field is marked as secret', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -56,7 +56,7 @@ describe('Capability Secret Access', () => {
 
     test('should return true for any secret in the list', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -98,7 +98,7 @@ describe('Capability Secret Access', () => {
 
     test('should return false when field is not in secrets list', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -137,7 +137,7 @@ describe('Capability Secret Access', () => {
 
     test('should return false when capability has no secrets', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -183,7 +183,7 @@ describe('Capability Secret Access', () => {
 
     test('should match exact secret name', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -227,7 +227,7 @@ describe('Capability Secret Access', () => {
   describe('checkCapabilitySecretAccess', () => {
     test('should return true when consumer matches allowlist', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -253,7 +253,7 @@ describe('Capability Secret Access', () => {
       };
 
       const consumerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'caddy',
         name: 'Caddy',
         version: '1.0.0',
@@ -298,7 +298,7 @@ describe('Capability Secret Access', () => {
 
     test('should return false when consumer does not match allowlist', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -324,7 +324,7 @@ describe('Capability Secret Access', () => {
       };
 
       const consumerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'some-app',
         name: 'Some App',
         version: '1.0.0',
@@ -367,7 +367,7 @@ describe('Capability Secret Access', () => {
 
     test('should return true when secret has no readable_by restriction', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -393,7 +393,7 @@ describe('Capability Secret Access', () => {
       };
 
       const consumerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',
@@ -429,7 +429,7 @@ describe('Capability Secret Access', () => {
 
     test('should return true when readable_by is empty array', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -455,7 +455,7 @@ describe('Capability Secret Access', () => {
       };
 
       const consumerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',
@@ -507,7 +507,7 @@ describe('Capability Secret Access', () => {
 
     test('should return false when consumer not found', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -558,7 +558,7 @@ describe('Capability Secret Access', () => {
 
     test('should return false when secret not found in capability', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -583,7 +583,7 @@ describe('Capability Secret Access', () => {
       };
 
       const consumerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',
@@ -623,7 +623,7 @@ describe('Capability Secret Access', () => {
 
     test('should return false when capability has no secrets', () => {
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -643,7 +643,7 @@ describe('Capability Secret Access', () => {
       };
 
       const consumerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',

package/src/capabilities/validation.test.ts

@@ -95,7 +95,7 @@ describe('Capability Access Validation', () => {
   describe('getProviderManifest', () => {
     test('should return manifest when capability exists', () => {
       const mockManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -153,7 +153,7 @@ describe('Capability Access Validation', () => {
 
     test('should parse JSON manifest correctly', () => {
       const mockManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -190,7 +190,7 @@ describe('Capability Access Validation', () => {
   describe('validateCapabilityAccess', () => {
     test('should return success when module does not require capabilities', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -209,7 +209,7 @@ describe('Capability Access Validation', () => {
 
     test('should return success when module requires capabilities array is empty', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -236,7 +236,7 @@ describe('Capability Access Validation', () => {
       // fails the test after this one: the difference is entirely which
       // capability is asked for.
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'celilo-web-console',
         name: 'Celilo Web Console',
         version: '1.0.0',
@@ -261,7 +261,7 @@ describe('Capability Access Validation', () => {
 
     test('should return error when required capability not found', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'caddy',
         name: 'Caddy',
         version: '1.0.0',
@@ -292,7 +292,7 @@ describe('Capability Access Validation', () => {
       // not demand a providing module for it — otherwise celilo-mgmt
       // can't be imported (regression: openspec/specs/progressive-zone-disclosure/spec.md).
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'celilo-mgmt',
         name: 'Celilo Management Server',
         version: '1.0.0',
@@ -318,7 +318,7 @@ describe('Capability Access Validation', () => {
 
     test('should return success when capability has no secrets', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',
@@ -331,7 +331,7 @@ describe('Capability Access Validation', () => {
       };
 
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'provider',
         name: 'Provider',
         version: '1.0.0',
@@ -364,7 +364,7 @@ describe('Capability Access Validation', () => {
 
     test('should return success when secret has no readable_by restriction', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',
@@ -377,7 +377,7 @@ describe('Capability Access Validation', () => {
       };
 
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -418,7 +418,7 @@ describe('Capability Access Validation', () => {
 
     test('should return success when consumer matches allowlist', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'caddy',
         name: 'Caddy',
         version: '1.0.0',
@@ -439,7 +439,7 @@ describe('Capability Access Validation', () => {
       };
 
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -480,7 +480,7 @@ describe('Capability Access Validation', () => {
 
     test('should return error when consumer does not match allowlist', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'some-app',
         name: 'Some App',
         version: '1.0.0',
@@ -501,7 +501,7 @@ describe('Capability Access Validation', () => {
       };
 
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -546,7 +546,7 @@ describe('Capability Access Validation', () => {
 
     test('should return error when consumer provides no capabilities', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'consumer',
         name: 'Consumer',
         version: '1.0.0',
@@ -559,7 +559,7 @@ describe('Capability Access Validation', () => {
       };
 
       const providerManifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'dns-external',
         name: 'DNS External',
         version: '1.0.0',
@@ -601,7 +601,7 @@ describe('Capability Access Validation', () => {
 
     test('should validate all required capabilities', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'complex-app',
         name: 'Complex App',
         version: '1.0.0',
@@ -697,7 +697,7 @@ describe('Capability Access Validation', () => {
   // dependency graph that six core services read.
   describe('celilo#854 — secret access is gated on reference, not on declaration', () => {
     const knotManifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: 'knot-unbound-internal',
       name: 'Knot + Unbound',
       version: '1.0.0',
@@ -730,7 +730,7 @@ describe('Capability Access Validation', () => {
 
     test('a consumer that requires the capability but never names the secret imports', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'caddy-internal',
         name: 'Caddy (fleet-only ingress)',
         version: '1.0.0',
@@ -752,7 +752,7 @@ describe('Capability Access Validation', () => {
 
     test('a consumer that DOES name the restricted secret is still refused', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'nosy-app',
         name: 'Nosy App',
         version: '1.0.0',
@@ -817,7 +817,7 @@ describe('Capability Access Validation', () => {
     test('naming one secret enforces that secret allow-list and no other', async () => {
       function consumer(deriveFrom: string): ModuleManifest {
         return {
-          celilo_contract: '1.0',
+          celilo_contract: '2.0',
           id: 'caddy-internal',
           name: 'Caddy (fleet-only ingress)',
           version: '1.0.0',
@@ -871,7 +871,7 @@ describe('Capability Access Validation', () => {
      */
     test('a secret named only in a template is refused at import', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'nosy-app',
         name: 'Nosy App',
         version: '1.0.0',
@@ -890,7 +890,7 @@ describe('Capability Access Validation', () => {
 
     test('a non-secret template reference is still not a secret reference', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'caddy-internal',
         name: 'Caddy (fleet-only ingress)',
         version: '1.0.0',

package/src/cli/cli.test.ts

@@ -100,7 +100,7 @@ describe('CLI Integration', () => {
     await writeFile(
       join(TEST_MODULE_DIR, 'manifest.yml'),
       `
-celilo_contract: "1.0"
+celilo_contract: "2.0"
 id: test-module
 name: Test Module
 version: 1.0.0
@@ -255,7 +255,7 @@ description: Test module for CLI
       const db = getDb();
       // Insert test module with variable declarations
       const manifestData = JSON.stringify({
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -440,7 +440,7 @@ description: Test module for CLI
       const db = getDb();
       // Insert test module with secrets manifest
       const manifestData = JSON.stringify({
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',

package/src/cli/commands/module-changeset.test.ts

@@ -10,7 +10,7 @@ beforeEach(async () => {
   dir = await mkdtemp(join(tmpdir(), 'celilo-cs-'));
   await writeFile(
     join(dir, 'manifest.yml'),
-    'celilo_contract: "1.0"\nid: lunacycle\nversion: 1.0.0\n',
+    'celilo_contract: "2.0"\nid: lunacycle\nversion: 1.0.0\n',
   );
 });
 afterEach(async () => {