@celilo/cli 4.1.0 → 5.0.1

package/src/manifest/validate-privileged.test.ts

@@ -10,7 +10,7 @@ import { validatePrivilegedCapabilities } from './validate';
 
 function buildManifest(overrides: Partial<ModuleManifest>): ModuleManifest {
   return {
-    celilo_contract: '1.0',
+    celilo_contract: '2.0',
     id: 'some-module',
     name: 'some module',
     version: '0.0.1',

package/src/manifest/validate.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test';
-import { getSingularSystemSpec } from './schema';
+import { ModuleManifestSchema, getSingularSystemSpec } from './schema';
 import {
   validateCapabilityNames,
   validateCapabilityRequirements,
@@ -12,7 +12,7 @@ import {
   validateVariableSources,
 } from './validate';
 
-const CONTRACT_LINE = 'celilo_contract: "1.0"';
+const CONTRACT_LINE = 'celilo_contract: "2.0"';
 
 describe('validateManifest', () => {
   test('should validate minimal valid manifest', () => {
@@ -251,6 +251,45 @@ version: 1.0.0
     expect(result.success).toBe(false);
   });
 
+  test('a stored manifest at a retired version still PARSES — only importing one is refused', () => {
+    // module-pause.ts, module-remove.ts and provider-arrival.ts re-parse the
+    // manifest celilo already stored, and each `continue`s past a failure. If
+    // the retirement moved onto the schema, every installed module not yet
+    // migrated would silently vanish from the dependent-removal check and the
+    // provider backfill — a narrowing with no error, which is the failure mode
+    // this whole change exists to remove.
+    const stored = ModuleManifestSchema.safeParse({
+      celilo_contract: '1.0',
+      id: 'legacy-module',
+      name: 'Legacy',
+      version: '1.0.0',
+    });
+    expect(stored.success).toBe(true);
+
+    const imported = validateManifest(
+      'celilo_contract: "1.0"\nid: legacy-module\nname: Legacy\nversion: 1.0.0\n',
+    );
+    expect(imported.success).toBe(false);
+  });
+
+  test('should reject a retired celilo_contract version, naming the migration', () => {
+    // The whole point of retiring 1.0 rather than deleting it: a 1.0 module
+    // deploys fine and silently stores nothing, so the refusal has to say why.
+    const yaml = `
+celilo_contract: "1.0"
+id: test-module
+name: Test
+version: 1.0.0
+`;
+    const result = validateManifest(yaml);
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      const message = result.errors.find((e) => e.path === 'celilo_contract')?.message ?? '';
+      expect(message).toContain('retired');
+      expect(message).toContain('context.secrets.set');
+    }
+  });
+
   test('should reject manifest with unknown top-level key', () => {
     const yaml = `
 ${CONTRACT_LINE}
@@ -653,7 +692,7 @@ version: 1.0.0
 describe('validateCapabilityNames', () => {
   test('accepts known capability names in requires', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'lunacycle',
       name: 'LunaCycle',
       version: '1.0.0',
@@ -672,7 +711,7 @@ describe('validateCapabilityNames', () => {
 
   test('accepts known capability names in optional', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'caddy',
       name: 'Caddy',
       version: '1.0.0',
@@ -689,7 +728,7 @@ describe('validateCapabilityNames', () => {
 
   test('rejects unknown capability name in requires', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'broken',
       name: 'Broken',
       version: '1.0.0',
@@ -712,7 +751,7 @@ describe('validateCapabilityNames', () => {
 
   test('rejects unknown capability name in optional', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'broken',
       name: 'Broken',
       version: '1.0.0',
@@ -734,7 +773,7 @@ describe('validateCapabilityNames', () => {
 
   test('reports both required and optional unknowns in one pass', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'broken',
       name: 'Broken',
       version: '1.0.0',
@@ -757,7 +796,7 @@ describe('validateCapabilityNames', () => {
 
   test('passes when no capabilities declared', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'standalone',
       name: 'Standalone',
       version: '1.0.0',
@@ -773,7 +812,7 @@ describe('validateCapabilityNames', () => {
 describe('validateCapabilityRequirements', () => {
   test('should pass when all required capabilities are available', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'caddy',
       name: 'Caddy',
       version: '1.0.0',
@@ -791,7 +830,7 @@ describe('validateCapabilityRequirements', () => {
 
   test('should fail when required capability is missing', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'caddy',
       name: 'Caddy',
       version: '1.0.0',
@@ -816,7 +855,7 @@ describe('validateCapabilityRequirements', () => {
 
   test('should pass when no capabilities required', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'homebridge',
       name: 'Homebridge',
       version: '1.0.0',
@@ -834,7 +873,7 @@ describe('validateCapabilityRequirements', () => {
 describe('validateVariableSources', () => {
   test('should pass when imported capability variables reference required capabilities', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'caddy',
       name: 'Caddy',
       version: '1.0.0',
@@ -862,7 +901,7 @@ describe('validateVariableSources', () => {
 
   test('should fail when imported capability variable references unrequired capability', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'caddy',
       name: 'Caddy',
       version: '1.0.0',
@@ -891,7 +930,7 @@ describe('validateVariableSources', () => {
 
   test('should pass when imported capability variable references an optional capability', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'caddy',
       name: 'Caddy',
       version: '1.0.0',
@@ -919,7 +958,7 @@ describe('validateVariableSources', () => {
 
   test('should fail when imported capability variable has invalid reference format', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'test',
       name: 'Test',
       version: '1.0.0',
@@ -941,7 +980,7 @@ describe('validateVariableSources', () => {
 
   test('should pass when no variables import capabilities', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'homebridge',
       name: 'Homebridge',
       version: '1.0.0',
@@ -969,7 +1008,7 @@ describe('validateVariableSources', () => {
 describe('validateDeriveFromSources', () => {
   test('should pass when capability source uses $capability: prefix', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'lunacycle',
       name: 'LunaCycle',
       version: '1.0.0',
@@ -996,7 +1035,7 @@ describe('validateDeriveFromSources', () => {
   test('should reject capability source with $system: prefix in derive_from (regression)', () => {
     // This is the original lunacycle bug that motivated D7.
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'lunacycle',
       name: 'LunaCycle',
       version: '1.0.0',
@@ -1026,7 +1065,7 @@ describe('validateDeriveFromSources', () => {
 
   test('should pass for variables without derive_from', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'test',
       name: 'Test',
       version: '1.0.0',
@@ -1055,7 +1094,7 @@ describe('validateDeriveFromSources', () => {
     // doesn't introduce the cross-context mismatch the validator exists
     // to catch (e.g. authentik's auth_url derives from $self:domain).
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'authentik',
       name: 'Authentik',
       version: '1.0.0',
@@ -1090,7 +1129,7 @@ describe('validateDeriveFromSources', () => {
     // mismatch error. This guards against accidentally green-lighting
     // "$self:foo and $system:bar" combos.
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'test',
       name: 'Test',
       version: '1.0.0',
@@ -1122,7 +1161,7 @@ describe('validateDeriveFromSources', () => {
 describe('validateHookContract', () => {
   test('should pass when all declared hooks are in v1 contract', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'test',
       name: 'Test',
       version: '1.0.0',
@@ -1141,7 +1180,7 @@ describe('validateHookContract', () => {
 
   test('should pass for manifests with no hooks block', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'test',
       name: 'Test',
       version: '1.0.0',
@@ -1158,7 +1197,7 @@ describe('validateHookContract', () => {
 describe('validateProvidesNoCrossCapabilityRefs', () => {
   test('should pass when capability data has no cross-capability references', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'authentik',
       name: 'Authentik',
       version: '1.0.0',
@@ -1184,7 +1223,7 @@ describe('validateProvidesNoCrossCapabilityRefs', () => {
 
   test('should reject capability data containing $capability: reference (D9 firm rule)', () => {
     const manifest = {
-      celilo_contract: '1.0' as const,
+      celilo_contract: '2.0' as const,
       id: 'authentik',
       name: 'Authentik',
       version: '1.0.0',
@@ -1536,7 +1575,7 @@ base_module_aspect:
 
 describe('submodules (openspec/changes/submodules D1, D9)', () => {
   const parent = (over: Record<string, unknown> = {}) => ({
-    celilo_contract: '1.0' as const,
+    celilo_contract: '2.0' as const,
     id: 'forgejo',
     name: 'Forgejo',
     version: '1.0.0',
@@ -1547,7 +1586,7 @@ describe('submodules (openspec/changes/submodules D1, D9)', () => {
   });
 
   const submodule = (over: Record<string, unknown> = {}) => ({
-    celilo_contract: '1.0' as const,
+    celilo_contract: '2.0' as const,
     id: 'runner',
     name: 'Forgejo Runner',
     version: '1.0.0',
@@ -1642,7 +1681,7 @@ describe('submodules (openspec/changes/submodules D1, D9)', () => {
   describe('schema', () => {
     test('parses a manifest declaring submodules', () => {
       const yaml = `
-celilo_contract: "1.0"
+celilo_contract: "2.0"
 id: forgejo
 name: Forgejo
 version: 1.0.0
@@ -1658,7 +1697,7 @@ requires:
 
     test('rejects a non-kebab-case submodule name', () => {
       const yaml = `
-celilo_contract: "1.0"
+celilo_contract: "2.0"
 id: forgejo
 name: Forgejo
 version: 1.0.0

package/src/manifest/validate.ts

@@ -3,7 +3,7 @@ import { parse as parseYaml } from 'yaml';
 import type { ZodError } from 'zod';
 import { SUBMODULES_DIR } from '../module/packaging/package-rules';
 import { validateModuleZoneRequirements } from '../services/zone-policy';
-import { resolveContract, supportedContractVersions } from './contracts';
+import { RETIRED_CONTRACT_VERSIONS, resolveContract, supportedContractVersions } from './contracts';
 import { ModuleManifestSchema, getSingularSystemSpec } from './schema';
 import type { ModuleManifest } from './schema';
 
@@ -90,6 +90,19 @@ export function validateManifest(yamlContent: string): ValidationResult {
     return formatZodErrors(result.error);
   }
 
+  const retired = RETIRED_CONTRACT_VERSIONS[result.data.celilo_contract];
+  if (retired) {
+    return {
+      success: false,
+      errors: [
+        {
+          path: 'celilo_contract',
+          message: `celilo_contract '${result.data.celilo_contract}' is retired: ${retired}`,
+        },
+      ],
+    };
+  }
+
   return {
     success: true,
     data: result.data,

package/src/module/import.test.ts

@@ -120,7 +120,7 @@ describe('Module Import', () => {
       await writeFile(
         join(moduleDir, 'manifest.yml'),
         `
-celilo_contract: "1.0"
+celilo_contract: "2.0"
 id: homebridge
 name: Homebridge
 version: 1.0.0
@@ -173,7 +173,7 @@ version: 1.0.0
 
   describe('submodules (openspec/changes/submodules D1)', () => {
     const PARENT = `
-celilo_contract: "1.0"
+celilo_contract: "2.0"
 id: forgejo
 name: Forgejo
 version: 1.0.0
@@ -181,7 +181,7 @@ submodules:
   - runner
 `;
     const SUBMODULE = `
-celilo_contract: "1.0"
+celilo_contract: "2.0"
 id: runner
 name: Forgejo Runner
 version: 1.0.0
@@ -250,7 +250,7 @@ provides:
       const dir = await writeParent(
         'plain-module',
         `
-celilo_contract: "1.0"
+celilo_contract: "2.0"
 id: plain
 name: Plain
 version: 1.0.0
@@ -322,7 +322,7 @@ version: 1.0.0
   describe('insertModuleToDb', () => {
     test('should insert module record into database', async () => {
       const manifest: ModuleManifest = {
-        celilo_contract: '1.0',
+        celilo_contract: '2.0',
         id: 'test-module',
         name: 'Test Module',
         version: '1.0.0',
@@ -375,7 +375,7 @@ version: 1.0.0
       await writeFile(
         join(moduleDir, 'manifest.yml'),
         `
-celilo_contract: "1.0"
+celilo_contract: "2.0"
 id: homebridge
 name: Homebridge
 version: 1.0.0
@@ -453,7 +453,7 @@ version: 1.0.0
       await mkdir(moduleDir, { recursive: true });
       await writeFile(
         join(moduleDir, 'manifest.yml'),
-        'celilo_contract: "1.0"\nid: existing\nname: Existing\nversion: 2.0.0',
+        'celilo_contract: "2.0"\nid: existing\nname: Existing\nversion: 2.0.0',
       );
 
       const result = await importModule({

package/src/module/packaging/build.test.ts

@@ -102,7 +102,7 @@ describe('buildModule — a root package.json must not strip the hook runtime',
     source = mkdtempSync(join(tmpdir(), 'celilo-pack-root-pkg-'));
     out = join(mkdtempSync(join(tmpdir(), 'celilo-pack-out-')), 'm.netapp');
 
-    write('manifest.yml', 'celilo_contract: "1.0"\nid: root-pkg-module\nname: M\nversion: 0.1.0\n');
+    write('manifest.yml', 'celilo_contract: "2.0"\nid: root-pkg-module\nname: M\nversion: 0.1.0\n');
     // The shape that triggers it: a module that is also a bun project. `files`
     // deliberately names scripts/ — proving the loss is npm-pack semantics and
     // not a missing entry.

package/src/module/packaging/build.ts

@@ -348,12 +348,19 @@ export async function buildModule(options: ModuleBuildOptions): Promise<ModuleBu
       // variable expansion would strip shell-only bash variables like
       // $STAGE before bash ever sees them.
       const buildEnv = { ...process.env, CELILO_MODULE_SOURCE_DIR: sourceDir };
+      // celilo#1252: the budget is the MODULE's, not a constant three layers
+      // away. forgejo's fetch declares `curl --retry 10 --max-time 900` and was
+      // killed at 300s having emitted five of its ten retries, reporting only
+      // "spawnSync bash ETIMEDOUT" — which names neither the cap, the elapsed
+      // time, nor the module.
+      const timeoutMs = (manifest.build.timeout_seconds ?? 300) * 1000;
+      const startedAt = Date.now();
       try {
         if (manifest.build.command) {
           execFileSync('bash', ['-c', manifest.build.command], {
             cwd: buildDir,
             stdio: 'inherit',
-            timeout: 300_000,
+            timeout: timeoutMs,
             env: buildEnv,
           });
         } else {
@@ -362,12 +369,19 @@ export async function buildModule(options: ModuleBuildOptions): Promise<ModuleBu
           execFileSync(cmd, [script], {
             cwd: buildDir,
             stdio: 'inherit',
-            timeout: 300_000,
+            timeout: timeoutMs,
             env: buildEnv,
           });
         }
       } catch (buildError) {
         const msg = buildError instanceof Error ? buildError.message : String(buildError);
+        if (msg.includes('ETIMEDOUT')) {
+          const elapsed = Math.round((Date.now() - startedAt) / 1000);
+          return {
+            success: false,
+            error: `Auto-build failed: ${moduleId}'s build exceeded its ${timeoutMs / 1000}s timeout (killed after ${elapsed}s). Raise build.timeout_seconds in manifest.yml if the build legitimately needs longer, or shrink what it fetches.`,
+          };
+        }
         return { success: false, error: `Auto-build failed: Build exited with code ${msg}` };
       }
 

package/src/packaging/nfpm-depends.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse } from 'yaml';
+
+// structural
+//
+// bubblewrap is the hook jail's Linux backend, and it must NOT be in the .deb's
+// `depends` while the module conversions of
+// openspec/changes/module-orchestrator-primitives are in flight (design.md D9).
+// Shipping the backend before the modules survive it means a jail that arrives
+// with enforcement in the same apt upgrade — it would break deploys rather than
+// fail open. The jail keeps being exercised meanwhile because the e2e management
+// image installs bubblewrap in its own Dockerfile
+// (packages/e2e/docker/Dockerfile.management).
+//
+// REVERSAL CONDITION: slice 8 of module-orchestrator-primitives — the last
+// commit of that change — puts `bubblewrap` back in `depends`. Delete this test
+// in that same commit. Do not re-add the line for any other reason; the old
+// nfpm comment argued for it from the AppArmor profile alone and predates the
+// migration.
+const NFPM_PATH = join(import.meta.dir, '../../../../packaging/celilo/nfpm.yaml');
+
+function nfpmDepends(): string[] {
+  const parsed = parse(readFileSync(NFPM_PATH, 'utf8')) as { depends?: string[] };
+  return parsed.depends ?? [];
+}
+
+describe('nfpm depends (structural)', () => {
+  test('parses a non-empty depends list, so an absence assertion means something', () => {
+    // Guards the reach of the assertion below: a typo'd path or a renamed key
+    // would otherwise give an empty list, in which nothing is ever found.
+    const depends = nfpmDepends();
+    expect(depends.length).toBeGreaterThan(0);
+    expect(depends).toContain('ansible');
+  });
+
+  test('does not depend on bubblewrap', () => {
+    const offenders = nfpmDepends().filter((d) => d.split(/[\s(]/)[0] === 'bubblewrap');
+    expect(offenders).toEqual([]);
+  });
+});

package/src/policy/capability-shape-baseline.ts

@@ -115,7 +115,7 @@ export const CAPABILITY_SHAPE_BASELINE: Readonly<Record<string, CapabilityShape>
   },
   private_web: {
     version: '2.0.0',
-    hash: 'fb301f5e55ca14fdb0ede0d428d2ac72eabed77e277de8c795eaa0b955695483',
+    hash: 'd1d1ef31d51f853d5e02460387f18a86c2833bd97e45122e8e2703ff44397a44',
     requests:
       '[{kind:"alias",members:[{name:"_self",optional:false,type:"Record<string, string | number | boolean>"}],name:"ClientConfig"},{kind:"interface",members:[{name:"defaultHostname",optional:false,type:"string"},{name:"getCaCertificate",optional:false,type:"Promise<string>"},{name:"publishStaticSite",optional:false,type:"Promise<PublishStaticSiteResult>"},{name:"registerReverseProxy",optional:false,type:"Promise<RegisterReverseProxyResult>"}],name:"PrivateWebCapability"},{kind:"interface",members:[{name:"clientConfig",optional:true,type:"ClientConfig"},{name:"hostname",optional:true,type:"string"},{name:"path",optional:false,type:"string"},{name:"spaFallback",optional:true,type:"boolean"}],name:"PublishStaticSiteRequest"},{kind:"interface",members:[{name:"contentHash",optional:false,type:"string"},{name:"filesUploaded",optional:false,type:"number"},{name:"path",optional:false,type:"string"},{name:"success",optional:false,type:"boolean"}],name:"PublishStaticSiteResult"},{kind:"interface",members:[{name:"hostname",optional:true,type:"string"},{name:"path",optional:false,type:"string"},{name:"targetHost",optional:false,type:"string"},{name:"targetPort",optional:false,type:"number"},{name:"websocket",optional:true,type:"boolean"}],name:"RegisterReverseProxyRequest"},{kind:"interface",members:[{name:"path",optional:false,type:"string"},{name:"success",optional:false,type:"boolean"}],name:"RegisterReverseProxyResult"}]',
   },
@@ -149,4 +149,10 @@ export const CAPABILITY_SHAPE_BASELINE: Readonly<Record<string, CapabilityShape>
     requests:
       '[{kind:"alias",members:[{name:"_self",optional:false,type:"{\\n    sourceDir: string;\\n    overlayDir?: string;\\n} | {\\n    unavailable: string;\\n}"}],name:"ConsumerSiteResolution"},{kind:"interface",members:[{name:"content",optional:false,type:"string"},{name:"path",optional:false,type:"string"}],name:"ProviderConfigFile"},{kind:"interface",members:[{name:"converge",optional:false,type:"Promise<{\\n    success: boolean;\\n    error?: string;\\n    unresolved: string[];\\n}>"},{name:"resolveConsumerSite",optional:false,type:"Promise<ConsumerSiteResolution>"}],name:"ProviderConvergeView"},{kind:"interface",members:[{name:"contentHash",optional:false,type:"string"},{name:"hostnames",optional:false,type:"string[]"},{name:"moduleId",optional:false,type:"string"},{name:"overlayDir",optional:true,type:"string"},{name:"slug",optional:false,type:"string"},{name:"sourceDir",optional:false,type:"string"}],name:"ProviderSiteRequest"}]',
   },
+  private_routes: {
+    version: '1.0.0',
+    hash: '6b15e73c0aeca909a1d9250177e4f8c26cb414481b67e9923888af18f902b963',
+    requests:
+      '[{kind:"interface",members:[{name:"all",optional:false,type:"Promise<PrivateWebRoute[]>"},{name:"replaceAll",optional:false,type:"Promise<void>"}],name:"PrivateRouteView"},{kind:"interface",members:[{name:"hostname",optional:false,type:"string"},{name:"module_id",optional:false,type:"string"},{name:"path",optional:false,type:"string"},{name:"slug",optional:false,type:"string"},{name:"target_host",optional:true,type:"string"},{name:"target_port",optional:true,type:"number"},{name:"type",optional:false,type:"\'static\' | \'reverse_proxy\'"},{name:"websocket",optional:true,type:"boolean"}],name:"PrivateWebRoute"}]',
+  },
 };

package/src/policy/fixture-capability-coverage.test.ts

@@ -187,7 +187,7 @@ describe('fixture capability coverage', () => {
     }
 
     const providerManifest = [
-      'celilo_contract: "1.0"',
+      'celilo_contract: "2.0"',
       'id: marker-provider',
       'name: Marker Provider',
       'version: 1.0.0',
@@ -208,7 +208,7 @@ describe('fixture capability coverage', () => {
           'marker-provider': { manifest: providerManifest },
           'marker-consumer': {
             manifest: [
-              'celilo_contract: "1.0"',
+              'celilo_contract: "2.0"',
               'id: marker-consumer',
               'name: Marker Consumer',
               'version: 1.0.0',
@@ -235,7 +235,7 @@ describe('fixture capability coverage', () => {
           'marker-provider': { manifest: providerManifest },
           'marker-consumer': {
             manifest: [
-              'celilo_contract: "1.0"',
+              'celilo_contract: "2.0"',
               'id: marker-consumer',
               'name: Marker Consumer',
               'version: 1.0.0',
@@ -270,7 +270,7 @@ describe('fixture capability coverage', () => {
         mirrorTree(dir, {
           'marker-consumer': {
             manifest: [
-              'celilo_contract: "1.0"',
+              'celilo_contract: "2.0"',
               'id: marker-consumer',
               'name: Marker Consumer',
               'version: 1.0.0',
@@ -297,7 +297,7 @@ describe('fixture capability coverage', () => {
           'marker-provider': { manifest: providerManifest },
           'marker-consumer': {
             manifest: [
-              'celilo_contract: "1.0"',
+              'celilo_contract: "2.0"',
               'id: marker-consumer',
               'name: Marker Consumer',
               'version: 1.0.0',

package/src/policy/module-business-baseline.ts

@@ -102,7 +102,7 @@ export const CAPABILITY_NAME_BASELINE: readonly CapabilityNameRow[] = [
   {
     file: 'apps/celilo/src/hooks/capability-loader.ts',
     capability: 'provider_converge',
-    count: 2,
+    count: 4,
     why: 'PERMANENT — a provider VIEW, not a module-provided capability. Core injects the generic converge every provider renders through; naming it is framework plumbing, not core branching on a provider (providers-converge-declared-state)',
   },
   {
@@ -240,13 +240,13 @@ export const CAPABILITY_NAME_BASELINE: readonly CapabilityNameRow[] = [
   {
     file: 'apps/celilo/src/hooks/capability-loader.ts',
     capability: 'private_web',
-    count: 1,
+    count: 6,
     why: 'L1-L12 — core branches on the capability NAME; becomes a provider declaration in Phase 3 (#938)',
   },
   {
     file: 'apps/celilo/src/hooks/capability-loader.ts',
     capability: 'public_web',
-    count: 8,
+    count: 11,
     why: 'L1-L12 — core branches on the capability NAME; becomes a provider declaration in Phase 3 (#938)',
   },
   {
@@ -465,8 +465,37 @@ export const CAPABILITY_NAME_BASELINE: readonly CapabilityNameRow[] = [
     count: 3,
     why: 'X8 — shared helpers that name the capability they serve; moves with X8 in Phase 5 (#940)',
   },
+  {
+    file: 'apps/celilo/src/hooks/capability-loader.ts',
+    capability: 'private_routes',
+    count: 2,
+    why: "PERMANENT — a provider VIEW, not a module-provided capability, and the private-ingress sibling of the 'web_routes' row above. The name was registered so it stops being invisible to audits; these references are framework plumbing (providers-converge-declared-state slice 2)",
+  },
+  {
+    file: 'apps/celilo/src/db/schema.ts',
+    capability: 'private_routes',
+    count: 1,
+    why: "PERMANENT — the TABLE named private_routes, exactly as the 'web_routes' row above; the collision with the view name is nominal",
+  },
+  {
+    file: 'packages/capabilities/src/private-web.ts',
+    capability: 'private_routes',
+    count: 1,
+    why: "PERMANENT — the private_web implementation naming its own table; the capability package doing its job, as the public-web.ts 'web_routes' row above",
+  },
+  {
+    file: 'packages/capabilities/src/declared-tables.ts',
+    capability: 'private_web',
+    count: 1,
+    why: 'PERMANENT — the name-keyed aggregate of capability TABLE declarations, same justification as the public_web row above: naming the capability IS the mapping (openspec/changes/capability-owned-tables D2)',
+  },
+  {
+    file: 'packages/capabilities/src/capability-contract.ts',
+    capability: 'private_routes',
+    count: 1,
+    why: 'PERMANENT — a contract declaration with no implementation; this is the package doing its job',
+  },
 ];
-
 export const SERVICE_FILENAME_BASELINE: readonly ServiceFilenameRow[] = [
   {
     file: 'apps/celilo/src/services/alerting/notification-responder.ts',

package/src/registry/client.test.ts

@@ -513,10 +513,11 @@ describe('RegistryClient.download integrity', () => {
   });
 
   test('a non-digest cksum sentinel skips verification instead of failing', async () => {
-    // The registry's bootstrap path publishes `cksum: 'bootstrap'`
-    // (packages/registry-server/src/bootstrap.ts:114) because those modules are
-    // packaged on demand and have no stable digest. Treating a sentinel as a
-    // digest rejects a perfectly good 2.7MB package on every import.
+    // `bootstrap` is the sentinel an index entry carries when it has no
+    // integrity data at all. The registry's bootstrap path no longer emits it
+    // — it hashes the .netapp it packages (celilo#1262) — but the sentinel
+    // branch stays, because treating one as a digest would reject a perfectly
+    // good 2.7MB package on every import.
     fetchSpy.mockImplementation(() => new Response(body, { status: 200 }));
 
     const client = new RegistryClient('https://reg.example.com');

package/src/services/aspect-approvals.test.ts

@@ -28,7 +28,7 @@ function insertModule(id: string, version: string) {
       id,
       name: id,
       version,
-      manifestData: { id, name: id, version, celilo_contract: '1.0' },
+      manifestData: { id, name: id, version, celilo_contract: '2.0' },
       sourcePath: `/tmp/${id}`,
     })
     .run();
@@ -160,7 +160,7 @@ describe('aspect-approvals', () => {
           id: 'knot-unbound-internal-v2',
           name: 'knot',
           version: '2.0.0',
-          manifestData: { id: 'knot', name: 'knot', version: '2.0.0', celilo_contract: '1.0' },
+          manifestData: { id: 'knot', name: 'knot', version: '2.0.0', celilo_contract: '2.0' },
           sourcePath: '/tmp/knot',
         })
         .run();