@celilo/e2e 0.10.4 → 0.11.1

package/src/container-manager.ts

@@ -186,18 +186,20 @@ process.on('SIGINT', () => {
 // FAILURE path, where the test never reaches `handle.stop()`, teardown was
 // never running and the per-test networks leaked.
 //
-// That leak is not confined to the run that caused it. The sim's networks use
-// the same subnets as a real celilo fleet (dmz 10.0.10.0/24, app 10.0.20.0/24,
-// …), so on a host that lives in those subnets — celilo's own forgejo-builder
-// does — a leaked bridge leaves a DUPLICATE route for a production prefix.
-// Traffic from any later container to the real host at that address is routed
+// That leak used not to be confined to the run that caused it. The sim's
+// networks were numbered exactly like a real celilo fleet's zones, so on a host
+// that lives in those subnets — celilo's own forgejo-builder does — a leaked
+// bridge left a DUPLICATE route for a production prefix, and
+// traffic from any later container to the real host at that address was routed
 // into the dead simulated network and blackholed. That took out three
 // consecutive release runs, each dying in `git fetch` after a ~132s connect
 // timeout, long after the e2e run that stranded the network had ended.
 //
-// The start-of-run prefix sweep stays as the crash-recovery backstop (it is
-// the only thing that can clean up after SIGKILL); this makes the common case
-// clean up after itself instead of poisoning the next job. See #508.
+// The sim now lives in SIM_PRIVATE_SUPERNET (#539), so a leak can no longer
+// collide with a fleet address — but a leak is still a leak. The start-of-run
+// prefix sweep stays as the crash-recovery backstop (it is the only thing that
+// can clean up after SIGKILL); this makes the common case clean up after itself
+// instead of leaving containers and volumes behind. See #508.
 process.on('exit', () => {
   cleanupOnExit();
 });
@@ -961,6 +963,21 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
       // in ~2-5s).
       60_000,
       `${machine.name} target-setup`,
+      // Self-diagnosing via waitFor's onTimeout (e2e-confidence #255). This
+      // timeout has twice been read as a simulator or deployment bug when the
+      // real cause was inside the unit — target-setup fetching from a slow
+      // third party (#560). The unit's own journal says which line it is on.
+      () => {
+        const dump = (label: string, cmd: string): string => {
+          const r = dockerExec(projectName, composeDir, machine.name, cmd);
+          return `--- ${label} ---\n${(r.stdout || r.stderr || '(no output)').trim()}`;
+        };
+        return [
+          `=== target-setup diagnostics (${machine.name}) ===`,
+          dump('systemctl status', 'systemctl status target-setup --no-pager 2>&1 | head -20'),
+          dump('journal', 'journalctl -u target-setup --no-pager 2>&1 | tail -30'),
+        ].join('\n');
+      },
     );
   }
 

package/src/docker-compose-generator.ts

@@ -3,8 +3,14 @@ import { join } from 'node:path';
 import { stringify } from 'yaml';
 import { normalizeObservers, observerEnv, observerPlacement } from './observer';
 import { SIMULATOR_IPS } from './simulator-ips';
-import type { MachineSpec, NetworkConfig, TopologyPreset } from './types';
-import { ZONE_GATEWAYS } from './types';
+import type { MachineSpec, NetworkConfig, TopologyPreset, Zone } from './types';
+import {
+  ZONE_GATEWAYS,
+  ZONE_SUBNETS,
+  greenwaveRouterIp,
+  internalResolverIp,
+  zoneIp,
+} from './types';
 
 /**
  * Volumes for the registry container. Picks between source-bootstrap and
@@ -52,6 +58,15 @@ function networkDef(subnet: string, gateway: string) {
   };
 }
 
+/**
+ * A zone's bridge, derived entirely from the address plan in `types.ts`. The
+ * bridge itself takes `.250` (Docker's own gateway address on the network — NOT
+ * the routing gateway, which is the firewall at `ZONE_GATEWAYS[zone]`).
+ */
+function zoneNetworkDef(zone: Zone) {
+  return networkDef(ZONE_SUBNETS[zone], zoneIp(zone, 250));
+}
+
 /**
  * Image tag prefix for pre-built e2e images. When images with these
  * tags exist locally, `docker compose build` skips rebuilding them.
@@ -117,19 +132,29 @@ export const SHARED_NETWORKS = {
  * where celilo-mgr itself lives, mirroring the production topology the suite
  * previously could not express.
  */
-const SECURE_MGMT_SUBNET = '10.0.120.0/24';
-const SECURE_MGMT_GATEWAY = '10.0.120.1';
-const SECURE_MGMT_MANAGEMENT_IP = '10.0.120.100';
+const SECURE_MGMT_GATEWAY = ZONE_GATEWAYS['secure-mgmt'];
+const SECURE_MGMT_MANAGEMENT_IP = zoneIp('secure-mgmt', 100);
+
+/**
+ * The zones fw-main routes between WITHOUT NAT, so the dmz-resident resolver
+ * sees each client's real zone (source-based split-horizon, ISS-0156).
+ * `internal` is deliberately absent: a LAN device's query must arrive SNAT'd to
+ * a zone-gateway address so it matches the passthrough view and gets the natIp
+ * answer, not the protected one.
+ */
+const PROTECTED_SUBNETS = (['dmz', 'app', 'secure', 'secure-mgmt'] as const)
+  .map((zone) => ZONE_SUBNETS[zone])
+  .join(' ');
 
 function defaultTopologyServices(): Record<string, unknown> {
   return {
     'fw-main': baseService({
       build: { context: '.', dockerfile: 'docker/Dockerfile.firewall' },
       networks: {
-        internal: { ipv4_address: '192.168.0.254' },
-        dmz: { ipv4_address: '10.0.10.1' },
-        app: { ipv4_address: '10.0.20.1' },
-        secure: { ipv4_address: '10.0.30.1' },
+        internal: { ipv4_address: ZONE_GATEWAYS.internal },
+        dmz: { ipv4_address: ZONE_GATEWAYS.dmz },
+        app: { ipv4_address: ZONE_GATEWAYS.app },
+        secure: { ipv4_address: ZONE_GATEWAYS.secure },
       },
       cap_add: ['NET_ADMIN', 'SYS_ADMIN'],
       // A firewall may also terminate a VPN (the admin tunnel the `wireguard`
@@ -138,11 +163,12 @@ function defaultTopologyServices(): Record<string, unknown> {
       devices: ['/dev/net/tun'],
       sysctls: ROUTER_SYSCTLS,
       volumes: ['ssh-keys:/ssh-keys:ro'],
+      environment: { PROTECTED_SUBNETS },
     }),
     'fw-isp': baseService({
       build: { context: '.', dockerfile: 'docker/Dockerfile.greenwave-sim' },
       networks: {
-        internal: { ipv4_address: '192.168.0.1' },
+        internal: { ipv4_address: greenwaveRouterIp() },
         'isp-external': { ipv4_address: '100.100.0.100' },
       },
       cap_add: ['NET_ADMIN', 'SYS_ADMIN'],
@@ -166,10 +192,10 @@ function directInternetTopologyServices(): Record<string, unknown> {
     'fw-main': baseService({
       build: { context: '.', dockerfile: 'docker/Dockerfile.firewall' },
       networks: {
-        internal: { ipv4_address: '192.168.0.254' },
-        dmz: { ipv4_address: '10.0.10.1' },
-        app: { ipv4_address: '10.0.20.1' },
-        secure: { ipv4_address: '10.0.30.1' },
+        internal: { ipv4_address: ZONE_GATEWAYS.internal },
+        dmz: { ipv4_address: ZONE_GATEWAYS.dmz },
+        app: { ipv4_address: ZONE_GATEWAYS.app },
+        secure: { ipv4_address: ZONE_GATEWAYS.secure },
         'isp-external': { ipv4_address: '100.100.0.100' },
       },
       cap_add: ['NET_ADMIN', 'SYS_ADMIN'],
@@ -179,6 +205,7 @@ function directInternetTopologyServices(): Record<string, unknown> {
       devices: ['/dev/net/tun'],
       sysctls: ROUTER_SYSCTLS,
       volumes: ['ssh-keys:/ssh-keys:ro'],
+      environment: { PROTECTED_SUBNETS },
     }),
     // No fw-isp — fw-main handles external routing directly
   };
@@ -379,15 +406,13 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
   // land whether or not the management box shares the network (#436).
   const needsSecureMgmt = mgmtOnOwnNetwork || (config.secureMgmtMachines ?? []).length > 0;
   const networks: Record<string, unknown> = {
-    internal: networkDef('192.168.0.0/24', '192.168.0.250'),
-    dmz: networkDef('10.0.10.0/24', '10.0.10.250'),
-    app: networkDef('10.0.20.0/24', '10.0.20.250'),
-    secure: networkDef('10.0.30.0/24', '10.0.30.250'),
+    internal: zoneNetworkDef('internal'),
+    dmz: zoneNetworkDef('dmz'),
+    app: zoneNetworkDef('app'),
+    secure: zoneNetworkDef('secure'),
     // Only when celilo-mgr lives off the internal LAN — keeps the default
     // topology's generated compose byte-identical for every existing test.
-    ...(needsSecureMgmt
-      ? { 'secure-mgmt': networkDef(SECURE_MGMT_SUBNET, '10.0.120.250') }
-      : {}),
+    ...(needsSecureMgmt ? { 'secure-mgmt': zoneNetworkDef('secure-mgmt') } : {}),
     'isp-external': networkDef('100.100.0.0/24', '100.100.0.250'),
     // internet-external is owned by shared infra; real-internet is per-test
     // (it just bridges fw-ext ↔ comcast-resolver, no shared service uses it).
@@ -411,7 +436,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
 
   // --- Management (always present) ---
   const managementDefaultGw =
-    config.topology === 'direct-internet' ? '192.168.0.254' : '192.168.0.1';
+    config.topology === 'direct-internet' ? ZONE_GATEWAYS.internal : greenwaveRouterIp();
 
   // Pick the management image based on variant. Both branches use
   // `image:` (not `build:`) so docker compose uses the existing tag —
@@ -476,24 +501,27 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
 
   services.management = mgmtOnOwnNetwork
     ? emitManagement(config.managementVariant, SECURE_MGMT_MANAGEMENT_IP, 'secure-mgmt')
-    : emitManagement(config.managementVariant, '192.168.0.100');
+    : emitManagement(config.managementVariant, zoneIp('internal', 100));
 
   if (config.secondaryManagementVariant) {
-    services['celilo-mgr-2'] = emitManagement(config.secondaryManagementVariant, '192.168.0.101');
+    services['celilo-mgr-2'] = emitManagement(
+      config.secondaryManagementVariant,
+      zoneIp('internal', 101),
+    );
   }
 
   // --- Internal split-horizon DNS resolver ---
   // Resolves the test domain to caddy's internal DMZ IP so management can
   // reach it via a direct route rather than through the external interface
   // (hairpin NAT would be needed otherwise). Management already has
-  // nameserver 192.168.0.10 as its primary resolver in /etc/resolv.conf.
+  // `internalResolverIp()` as its primary resolver in /etc/resolv.conf.
   const caddyIp =
     config.dmzMachines.find((m) => m.name === 'caddy')?.ip ??
     config.dmzMachines[0]?.ip ??
-    '10.0.10.10';
+    zoneIp('dmz', 10);
   services['dns-int'] = baseService({
     build: { context: '.', dockerfile: 'docker/Dockerfile.internal-resolver' },
-    networks: { internal: { ipv4_address: '192.168.0.10' } },
+    networks: { internal: { ipv4_address: internalResolverIp() } },
     cap_add: ['NET_ADMIN'],
     environment: {
       CADDY_IP: caddyIp,
@@ -574,7 +602,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
   if (config.dhcpClient) {
     services['dhcp-client'] = baseService({
       build: { context: '.', dockerfile: 'docker/Dockerfile.dhcp-client' },
-      networks: { internal: { ipv4_address: '192.168.0.210' } },
+      networks: { internal: { ipv4_address: zoneIp('internal', 210) } },
       cap_add: ['NET_ADMIN'],
     });
   }
@@ -586,7 +614,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
   if (config.signalCli) {
     services['signal-cli'] = baseService({
       build: { context: '.', dockerfile: 'docker/Dockerfile.signal-cli' },
-      networks: { internal: { ipv4_address: '192.168.0.90' } },
+      networks: { internal: { ipv4_address: zoneIp('internal', 90) } },
       cap_add: ['NET_ADMIN'],
     });
   }
@@ -608,7 +636,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
   if (config.signalSim) {
     services['signal-sim'] = baseService({
       build: { context: '.', dockerfile: 'docker/Dockerfile.signal-sim' },
-      networks: { internal: { ipv4_address: '192.168.0.91' } },
+      networks: { internal: { ipv4_address: zoneIp('internal', 91) } },
       cap_add: ['NET_ADMIN'],
       environment: {
         SIGNAL_ACCOUNT: '+15551234567',
@@ -649,10 +677,10 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
 
 export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): string {
   const networks: Record<string, unknown> = {
-    internal: networkDef('192.168.0.0/24', '192.168.0.250'),
-    dmz: networkDef('10.0.10.0/24', '10.0.10.250'),
-    app: networkDef('10.0.20.0/24', '10.0.20.250'),
-    secure: networkDef('10.0.30.0/24', '10.0.30.250'),
+    internal: zoneNetworkDef('internal'),
+    dmz: zoneNetworkDef('dmz'),
+    app: zoneNetworkDef('app'),
+    secure: zoneNetworkDef('secure'),
     'isp-external': networkDef('100.100.0.0/24', '100.100.0.250'),
     'internet-external': networkDef('100.64.0.0/24', '100.64.0.250'),
     'real-internet': {
@@ -668,11 +696,11 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
   const services: Record<string, unknown> = {};
 
   const managementDefaultGw =
-    config.topology === 'direct-internet' ? '192.168.0.254' : '192.168.0.1';
+    config.topology === 'direct-internet' ? ZONE_GATEWAYS.internal : greenwaveRouterIp();
 
   services.management = baseService({
     build: { context: '.', dockerfile: 'docker/Dockerfile.management' },
-    networks: { internal: { ipv4_address: '192.168.0.100' } },
+    networks: { internal: { ipv4_address: zoneIp('internal', 100) } },
     cap_add: ['NET_ADMIN'],
     volumes: [
       ...(celiloRoot ? [`${celiloRoot}:/celilo`] : []),
@@ -692,10 +720,10 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
   const legacyCaddyIp =
     config.dmzMachines.find((m) => m.name === 'caddy')?.ip ??
     config.dmzMachines[0]?.ip ??
-    '10.0.10.10';
+    zoneIp('dmz', 10);
   services['dns-int'] = baseService({
     build: { context: '.', dockerfile: 'docker/Dockerfile.internal-resolver' },
-    networks: { internal: { ipv4_address: '192.168.0.10' } },
+    networks: { internal: { ipv4_address: internalResolverIp() } },
     cap_add: ['NET_ADMIN'],
     environment: {
       CADDY_IP: legacyCaddyIp,
@@ -831,7 +859,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
   if (config.dhcpClient) {
     services['dhcp-client'] = baseService({
       build: { context: '.', dockerfile: 'docker/Dockerfile.dhcp-client' },
-      networks: { internal: { ipv4_address: '192.168.0.210' } },
+      networks: { internal: { ipv4_address: zoneIp('internal', 210) } },
       cap_add: ['NET_ADMIN'],
     });
   }

package/src/extract-failure.ts

@@ -0,0 +1,92 @@
+/**
+ * Turns a failed test file's raw output into the one line a human reads first.
+ *
+ * Pure (Rule 10.1), and split out of runner.ts so it can be tested — runner.ts
+ * calls main() at import time, so nothing inside it is reachable from a test.
+ * Sibling of parse-line.ts / parse-line.test.ts.
+ */
+
+// Strips ANSI escape sequences so pattern matching works on bun's coloured output
+const ANSI_RE = /\x1b\[[0-9;]*m/g;
+export function stripAnsi(s: string): string {
+  return s.replace(ANSI_RE, '');
+}
+
+export function extractFailureMessage(lines: string[], exitCode: number): string {
+  const plain = lines.map(stripAnsi);
+
+  // The FIRST failing test, in bun's "(fail) name [Xms]" format, wins over
+  // everything below. In a staged suite every later stage fails too — on
+  // purpose, via requireStage — so any rule that picks by content rather than
+  // by order reports a downstream symptom as the cause.
+  //
+  // That is not hypothetical. technitium-pipeline's stage 0 timed out; the
+  // reported failure was "Module 'namecheap' not found", from a stage that had
+  // only ever been reached because stage 0 died. Three people read that as a
+  // module-import bug. The line that actually mattered — "this test timed out
+  // after 120000ms" — was 60 lines up in output.log and in no summary at all.
+  //
+  // The "✗ name" branch below never fired there: bun prints "✗" only in its
+  // per-file summary, and prints "(fail)" as each test completes.
+  const failIdx = plain.findIndex((l) => /^\(fail\)\s+\S/.test(l));
+  if (failIdx >= 0) {
+    const testName = plain[failIdx]
+      .replace(/^\(fail\)\s+/, '')
+      .replace(/\s*\[[\d.]+ms\].*$/, '')
+      .trim();
+    // bun puts the reason on the next line, indented and marked with "^".
+    const reason = (plain[failIdx + 1] ?? '').trim().replace(/^\^\s*/, '');
+    return reason ? `${testName}: ${reason}` : testName;
+  }
+
+  // bun's own test failure: "✗ test name [Xms]" — extract the failing test name
+  const bunFailIdx = plain.findIndex((l) => /^\s*✗\s+\S/.test(l) && !l.includes('failed ('));
+  if (bunFailIdx >= 0) {
+    const testName = plain[bunFailIdx]
+      .replace(/^\s*✗\s+/, '')
+      .replace(/\s*\[\d+ms\].*$/, '')
+      .trim();
+    // Grab the error detail on the next few lines (bun indents it under the test)
+    const detail = plain
+      .slice(bunFailIdx + 1, bunFailIdx + 6)
+      .map((l) => l.trim())
+      .filter((l) => l.length > 0 && !l.startsWith('at ') && !l.startsWith('│') && l !== '└─')
+      .slice(0, 2)
+      .join(' — ');
+    return detail ? `${testName}: ${detail}` : testName;
+  }
+
+  // "error: ..." lines (may be indented in bun output)
+  const errorIdx = plain.findIndex(
+    (l) => l.trimStart().startsWith('error:') && !l.includes('bun test'),
+  );
+  if (errorIdx >= 0) {
+    const context = plain
+      .slice(errorIdx, errorIdx + 5)
+      .map((l) => l.trim())
+      .filter((l) => l.length > 0 && !l.startsWith('at '));
+    return context.join('\n    ');
+  }
+
+  const celiloError = plain.find(
+    (l) => l.includes('CeliloCommandError') || (l.includes('celilo') && l.includes('failed')),
+  );
+  if (celiloError) return celiloError.slice(0, 120);
+
+  const timeout = plain.find((l) => l.includes('Timeout') || l.includes('timed out'));
+  if (timeout) return timeout.slice(0, 120);
+
+  // Last resort: print the last few non-empty, non-progress lines from the output
+  const tail = plain
+    .filter(
+      (l) =>
+        l.length > 0 &&
+        !l.startsWith('[progress') &&
+        !l.startsWith('[e2e:') &&
+        !l.startsWith('[ansible:'),
+    )
+    .slice(-3)
+    .map((l) => l.trim())
+    .join(' | ');
+  return tail || `exit code ${exitCode}`;
+}

package/src/fixtures.ts

@@ -1,40 +1,33 @@
-import { NetworkBuilder, network } from './network-builder';
+import { type NetworkBuilder, network } from './network-builder';
 
 /** Single caddy machine in the DMZ — basic web server deployment */
-export const CADDY_DEPLOYMENT = (): NetworkBuilder => network().dmz({ caddy: '10.0.10.10' });
+export const CADDY_DEPLOYMENT = (): NetworkBuilder => network().dmz({ caddy: '10.226.10.10' });
 
 /** Full stack: web server, identity provider, database */
 export const FULL_STACK = (): NetworkBuilder =>
   network()
-    .dmz({ caddy: '10.0.10.10' })
-    .app({ idp: '10.0.20.100' })
-    .secure({ db: '10.0.30.50' });
+    .dmz({ caddy: '10.226.10.10' })
+    .app({ idp: '10.226.20.100' })
+    .secure({ db: '10.226.30.50' });
 
 /** Minimal: no dynamic machines, just fixed infrastructure */
 export const INFRASTRUCTURE_ONLY = (): NetworkBuilder => network();
 
 /** Caddy + Authentik: web server in DMZ, identity provider in app zone */
 export const AUTHENTIK_DEPLOYMENT = (): NetworkBuilder =>
-  network()
-    .dmz({ caddy: '10.0.10.10' })
-    .app({ authentik: '10.0.20.30' });
+  network().dmz({ caddy: '10.226.10.10' }).app({ authentik: '10.226.20.30' });
 
 /** Multiple DMZ machines for testing multi-service deployments */
 export const MULTI_DMZ = (): NetworkBuilder =>
   network().dmz({
-    caddy: '10.0.10.10',
-    'web-app': '10.0.10.20',
+    caddy: '10.226.10.10',
+    'web-app': '10.226.10.20',
   });
 
 /** Technitium DNS + Caddy: internal DNS resolver + full web stack */
 export const TECHNITIUM_STACK = (): NetworkBuilder =>
-  network()
-    .internal({ 'dns-int': '192.168.0.53' })
-    .dmz({ caddy: '10.0.10.10' });
+  network().internal({ 'dns-int': '10.226.1.53' }).dmz({ caddy: '10.226.10.10' });
 
 /** Technitium DNS with DHCP client: tests DHCP DNS propagation */
 export const TECHNITIUM_DHCP_STACK = (): NetworkBuilder =>
-  network()
-    .internal({ 'dns-int': '192.168.0.53' })
-    .dmz({ caddy: '10.0.10.10' })
-    .withDhcpClient();
+  network().internal({ 'dns-int': '10.226.1.53' }).dmz({ caddy: '10.226.10.10' }).withDhcpClient();

package/src/index.ts

@@ -12,8 +12,8 @@
  *   import { network } from '@celilo/e2e';
  *
  *   const net = await network()
- *     .dmz({ caddy: '10.0.10.10' })
- *     .app({ myapp: '10.0.20.10' })
+ *     .dmz({ caddy: '10.226.10.10' })
+ *     .app({ myapp: '10.226.20.10' })
  *     .start();
  *
  *   await net.celilo('module deploy myapp');

package/src/network-builder.ts

@@ -2,7 +2,14 @@ import { execSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { startNetwork } from './container-manager';
-import type { MachineSpec, NetworkConfig, NetworkHandle, TopologyPreset, Vantage, Zone } from './types';
+import type {
+  MachineSpec,
+  NetworkConfig,
+  NetworkHandle,
+  TopologyPreset,
+  Vantage,
+  Zone,
+} from './types';
 
 /**
  * If a mounted path looks like a celilo module (has scripts/package.json),
@@ -10,10 +17,7 @@ import type { MachineSpec, NetworkConfig, NetworkHandle, TopologyPreset, Vantage
  */
 async function ensureModuleDeps(hostPath: string): Promise<void> {
   // Check common locations for a module's scripts dir
-  for (const scriptsDir of [
-    join(hostPath, 'scripts'),
-    join(hostPath, 'celilo', 'scripts'),
-  ]) {
+  for (const scriptsDir of [join(hostPath, 'scripts'), join(hostPath, 'celilo', 'scripts')]) {
     const pkgJson = join(scriptsDir, 'package.json');
     const nodeModules = join(scriptsDir, 'node_modules');
     if (existsSync(pkgJson) && !existsSync(nodeModules)) {
@@ -24,7 +28,7 @@ async function ensureModuleDeps(hostPath: string): Promise<void> {
         const msg = err instanceof Error ? err.message : String(err);
         throw new Error(
           `Failed to install module dependencies in ${scriptsDir}:\n${msg}\n\n` +
-          `Fix: cd ${scriptsDir} && bun install`,
+            `Fix: cd ${scriptsDir} && bun install`,
         );
       }
     }
@@ -170,11 +174,12 @@ export class NetworkBuilder {
    * `VantageProbe`. `management` is not injectable (that vantage reuses the real
    * management container).
    *
-   *   network().dmz({ caddy: '10.0.10.10' }).observe('internalDevice', 'publicInternet')
+   *   network().dmz({ caddy: '10.226.10.10' }).observe('internalDevice', 'publicInternet')
    */
   observe(...vantages: Vantage[]): this {
+    this.config.observers ??= [];
     for (const vantage of vantages) {
-      (this.config.observers ??= []).push({ vantage });
+      this.config.observers.push({ vantage });
     }
     return this;
   }
@@ -219,7 +224,7 @@ export class NetworkBuilder {
   }
 
   /**
-   * Bring up a SECOND management-class box named `celilo-mgr-2` (192.168.0.101)
+   * Bring up a SECOND management-class box named `celilo-mgr-2` (10.226.1.101)
    * using the given image variant. The migration restore e2e uses this to get a
    * fresh target box alongside the primary backup source. The second box is not
    * auto-init'd (container-manager keys off the `management` name), so it stays

package/src/observer.test.ts

@@ -1,8 +1,8 @@
 import { describe, expect, test } from 'bun:test';
 import {
+  OBSERVER_PLACEMENTS,
   createObserverTransport,
   normalizeObservers,
-  OBSERVER_PLACEMENTS,
   observerEnv,
   vantageContainer,
 } from './observer';
@@ -38,7 +38,9 @@ describe('placement faithfulness (the load-bearing invariants)', () => {
   test('segmented-zone observer IPs derive from their zone gateway (no pinned subnets)', () => {
     expect(OBSERVER_PLACEMENTS.dmzSystem.gateway).toBe(ZONE_GATEWAYS.dmz);
     expect(OBSERVER_PLACEMENTS.dmzSystem.ip).toBe(ZONE_GATEWAYS.dmz.replace(/\.\d+$/, '.240'));
-    expect(OBSERVER_PLACEMENTS.secureSystem.ip).toBe(ZONE_GATEWAYS.secure.replace(/\.\d+$/, '.240'));
+    expect(OBSERVER_PLACEMENTS.secureSystem.ip).toBe(
+      ZONE_GATEWAYS.secure.replace(/\.\d+$/, '.240'),
+    );
   });
 
   test('publicInternet uses only the public resolver (never the internal split-horizon view)', () => {
@@ -55,7 +57,9 @@ describe('placement faithfulness (the load-bearing invariants)', () => {
 
 describe('normalizeObservers + vantageContainer', () => {
   test('dedupes and rejects management as an injectable observer', () => {
-    expect(normalizeObservers([{ vantage: 'internalDevice' }, { vantage: 'internalDevice' }])).toHaveLength(1);
+    expect(
+      normalizeObservers([{ vantage: 'internalDevice' }, { vantage: 'internalDevice' }]),
+    ).toHaveLength(1);
     expect(() => normalizeObservers([{ vantage: 'management' }])).toThrow(/management/);
   });
   test('management vantage maps to the real management container; others to observers', () => {
@@ -67,36 +71,55 @@ describe('normalizeObservers + vantageContainer', () => {
 describe('observer transport — parsing + container targeting', () => {
   test('resolve(system) parses getent first column and targets the right observer', async () => {
     const { handle, calls } = fakeHandle((_c, cmd) =>
-      cmd.startsWith('getent') ? { stdout: '192.168.0.253  www.iamtheinternet.org' } : {},
+      cmd.startsWith('getent') ? { stdout: '10.226.1.253  www.iamtheinternet.org' } : {},
     );
     const t = createObserverTransport(handle);
-    const r = await t.resolve({ from: 'internalDevice', name: 'www.iamtheinternet.org', method: 'system' });
-    expect(r.ips).toEqual(['192.168.0.253']);
+    const r = await t.resolve({
+      from: 'internalDevice',
+      name: 'www.iamtheinternet.org',
+      method: 'system',
+    });
+    expect(r.ips).toEqual(['10.226.1.253']);
     expect(calls[0].container).toBe('observer-internal');
   });
 
   test('resolve(dns) with explicit server', async () => {
-    const { handle, calls } = fakeHandle((_c, cmd) => (cmd.includes('dig') ? { stdout: '10.0.10.10\n' } : {}));
+    const { handle, calls } = fakeHandle((_c, cmd) =>
+      cmd.includes('dig') ? { stdout: '10.226.10.10\n' } : {},
+    );
     const t = createObserverTransport(handle);
-    const r = await t.resolve({ from: 'dmzSystem', name: 'auth.x', method: 'dns', server: '192.168.0.10' });
-    expect(r.ips).toEqual(['10.0.10.10']);
-    expect(calls[0].cmd).toContain('@192.168.0.10');
+    const r = await t.resolve({
+      from: 'dmzSystem',
+      name: 'auth.x',
+      method: 'dns',
+      server: '10.226.1.10',
+    });
+    expect(r.ips).toEqual(['10.226.10.10']);
+    expect(calls[0].cmd).toContain('@10.226.1.10');
   });
 
   test('resolve(hostfiles) parses /etc/hosts first column', async () => {
     const { handle } = fakeHandle((_c, cmd) =>
-      cmd.startsWith('grep -F') ? { stdout: '10.0.10.10 auth.iamtheinternet.org' } : {},
+      cmd.startsWith('grep -F') ? { stdout: '10.226.10.10 auth.iamtheinternet.org' } : {},
     );
     const t = createObserverTransport(handle);
-    const r = await t.resolve({ from: 'dmzSystem', name: 'auth.iamtheinternet.org', method: 'hostfiles' });
-    expect(r.ips).toEqual(['10.0.10.10']);
+    const r = await t.resolve({
+      from: 'dmzSystem',
+      name: 'auth.iamtheinternet.org',
+      method: 'hostfiles',
+    });
+    expect(r.ips).toEqual(['10.226.10.10']);
   });
 
   test('tcpConnect maps the container exit code', async () => {
     const { handle } = fakeHandle((_c, cmd) => ({ exitCode: cmd.includes('443') ? 0 : 1 }));
     const t = createObserverTransport(handle);
-    expect((await t.tcpConnect({ from: 'internalDevice', host: '192.168.0.253', port: 443 })).connected).toBe(true);
-    expect((await t.tcpConnect({ from: 'internalDevice', host: '10.0.10.10', port: 22 })).connected).toBe(false);
+    expect(
+      (await t.tcpConnect({ from: 'internalDevice', host: '10.226.1.253', port: 443 })).connected,
+    ).toBe(true);
+    expect(
+      (await t.tcpConnect({ from: 'internalDevice', host: '10.226.10.10', port: 22 })).connected,
+    ).toBe(false);
   });
 
   test('httpsRequest parses cert (CN/issuer/SAN/selfSigned) + status', async () => {
@@ -113,7 +136,10 @@ describe('observer transport — parsing + container targeting', () => {
       return { stdout: 'Caddy reverse proxy is running' };
     });
     const t = createObserverTransport(handle);
-    const r = await t.httpsRequest({ from: 'publicInternet', url: 'https://deathstar.iamtheinternet.org' });
+    const r = await t.httpsRequest({
+      from: 'publicInternet',
+      url: 'https://deathstar.iamtheinternet.org',
+    });
     expect(r.status).toBe(200);
     expect(r.cert.cn).toBe('deathstar.iamtheinternet.org');
     expect(r.cert.issuer).toContain('Pebble');
@@ -140,10 +166,15 @@ describe('host-shell footgun guard', () => {
     const { handle, calls } = fakeHandle(() => ({ stdout: '200', exitCode: 0 }));
     const t = createObserverTransport(handle);
     await t.resolve({ from: 'internalDevice', name: 'www.x', method: 'system' });
-    await t.resolve({ from: 'internalDevice', name: 'www.x', method: 'dns', server: '192.168.0.10' });
+    await t.resolve({
+      from: 'internalDevice',
+      name: 'www.x',
+      method: 'dns',
+      server: '10.226.1.10',
+    });
     await t.resolve({ from: 'internalDevice', name: 'www.x', method: 'hostfiles' });
-    await t.tcpConnect({ from: 'internalDevice', host: '10.0.10.10', port: 443 });
-    await t.ping({ from: 'internalDevice', target: '192.168.0.253' });
+    await t.tcpConnect({ from: 'internalDevice', host: '10.226.10.10', port: 443 });
+    await t.ping({ from: 'internalDevice', target: '10.226.1.253' });
     await t.httpsRequest({ from: 'internalDevice', url: 'https://www.x' });
     await t.inspectResolution({ from: 'internalDevice', name: 'www.x' });
     expect(calls.length).toBeGreaterThan(0);