@celilo/e2e 0.12.0 → 0.13.0

package/src/runner.ts

@@ -29,7 +29,9 @@ import {
   emitTestCompleted,
   emitTestStarted,
 } from './bus-events';
-import { extractFailureMessage, stripAnsi } from './extract-failure';
+import { diagnose, formatReport } from './doctor';
+import { type StageTally, extractFailureMessage, stripAnsi, tallyStages } from './extract-failure';
+import { writeLastRun } from './last-run';
 import { parseLine } from './parse-line';
 import { E2eBusyError, acquireRunLock, markKept } from './run-lock';
 import { SIMULATOR_IPS } from './simulator-ips';
@@ -200,6 +202,12 @@ interface TestResult {
   rawTail?: string;
   hadDebugPause?: boolean;
   projectName?: string;
+  /**
+   * Real stage failures vs stages a failing earlier stage blocked. Without the
+   * split, one bad fixture line in stage 1 of a 10-stage suite reports as "9
+   * failed" — nine counts of a defect that does not exist.
+   */
+  stages?: StageTally;
 }
 
 async function runTest(
@@ -399,12 +407,24 @@ async function runTest(
           projectName: capturedProjectName,
           error: extractFailureMessage(lines, code ?? 1),
           rawTail,
+          stages: tallyStages(lines),
         });
       }
     });
   });
 }
 
+/**
+ * " — 1 stage failed, 8 skipped (blocked by an earlier stage)". Rendered only
+ * when a cascade actually happened, so an ordinary single-stage failure stays
+ * as terse as it was.
+ */
+function stageSuffix(stages: StageTally | undefined): string {
+  if (!stages || stages.skipped === 0) return '';
+  const failed = `${stages.failed} stage${stages.failed === 1 ? '' : 's'} failed`;
+  return ` ${dim}— ${failed}, ${stages.skipped} skipped (blocked by an earlier stage)${reset}`;
+}
+
 // ─── Shared Infrastructure ───────────────────────────────────────────
 
 function dockerComposeShared(cmd: string): string {
@@ -475,11 +495,20 @@ async function main() {
   // docker mutation so a competing run can't wipe our shared infra mid-setup.
   const lockLabel = patterns.length ? patterns.join(',') : moduleDirs.length ? 'modules' : 'all';
   try {
-    acquireRunLock({
+    const outcome = acquireRunLock({
       test: lockLabel,
       runId: process.env.CELE2E_RUN_ID ?? ambientRunId,
       allowKept: flagReuse,
     });
+    if (outcome.autoReleasedOwnKept) {
+      const own = outcome.autoReleasedOwnKept;
+      console.log(
+        `${dim}Auto-released your own kept stack (${own.test}, held since ${own.startedAt}) and continuing.${reset}`,
+      );
+      console.log(
+        `${dim}Use \`cele2e run --reuse\` instead if you meant to run against it.${reset}`,
+      );
+    }
     // A --reuse run keeps using a kept stack that stays up afterwards — hold the
     // lock in kept state so it isn't freed out from under the reused network.
     if (flagReuse) markKept();
@@ -494,6 +523,25 @@ async function main() {
     throw err;
   }
 
+  // Preflight the environment BEFORE touching Docker. Every check here failed
+  // silently once and surfaced later somewhere unrelated — a missing bake as an
+  // SSH error against a firewall IP, a pruned base image as a TLS timeout 16
+  // images into a build. Refusing now costs seconds; not refusing cost a full
+  // run plus a debugging cycle each time. Lock state is excluded: we already
+  // hold the lock, so checkRunLock would report ourselves as contention.
+  const health = diagnose({ pkgDir: PKG_DIR, skipLock: true });
+  if (!health.ok) {
+    console.error(
+      `\n${red}✗ cele2e preflight failed — not starting a run that cannot succeed.${reset}`,
+    );
+    for (const line of formatReport(health)) console.error(line);
+    console.error(`\n${dim}Full environment report: cele2e doctor${reset}\n`);
+    process.exit(1);
+  }
+  for (const c of health.checks) {
+    if (c.status === 'warn') console.log(`${dim}! ${c.name}: ${c.detail}${reset}`);
+  }
+
   let testFiles: string[] = [];
 
   if (moduleDirs.length > 0) {
@@ -656,6 +704,22 @@ async function main() {
   if (!process.env.CELE2E_RUN_ID) {
     console.log(`${dim}runId: ${runId}${reset}`);
   }
+  // Print the results dir HERE, not only at the end: a run that dies mid-way
+  // still wrote logs there, and `ls -t results | head -1` is not a safe way to
+  // find them — after a refused start it returns the PREVIOUS run's numbers,
+  // which look exactly like a clean pass. `cele2e last` reads the same record.
+  console.log(`${dim}results:  ${resultsDir}${reset}`);
+  writeLastRun({
+    runId,
+    resultsDir,
+    startedAt: new Date(suiteStart).toISOString(),
+    status: 'running',
+    total: testFiles.length,
+    passed: 0,
+    failed: 0,
+    skipped: 0,
+    durationMs: 0,
+  });
   emitRunStarted({
     runId,
     scenario: testFiles.length > 1 ? 'multi-test' : 'single-test',
@@ -784,7 +848,7 @@ async function main() {
       console.log(`  ${red}  └─ ${result.error}${reset}`);
       failed++;
     } else {
-      console.log(`  ${red}✗ failed (${result.duration}s)${reset}`);
+      console.log(`  ${red}✗ failed (${result.duration}s)${reset}${stageSuffix(result.stages)}`);
       if (result.error) {
         console.log(`  ${red}  └─ ${result.error}${reset}`);
       }
@@ -817,18 +881,28 @@ async function main() {
 
   const suiteDuration = Math.floor((Date.now() - suiteStart) / 1000);
 
+  // Stages a failing earlier stage blocked are reported separately from real
+  // failures. Counting them together turns one bad fixture line into "9 failed"
+  // and buries the single defect that actually exists.
+  const stageSkipped = results.reduce((sum, r) => sum + (r.stages?.skipped ?? 0), 0);
+
   console.log();
   console.log(`${bold}╔══════════════════════════════════════════════════════════════${reset}`);
   console.log(
     `${bold}║  Results: ${green}${passed} passed${reset}${bold}, ${red}${failed} failed${reset}${bold} — ${formatDuration(suiteDuration)} total${reset}`,
   );
+  if (stageSkipped > 0) {
+    console.log(
+      `${bold}║${reset}  ${dim}${stageSkipped} stage(s) skipped — blocked by an earlier stage, not separate defects${reset}`,
+    );
+  }
   console.log(`${bold}╠══════════════════════════════════════════════════════════════${reset}`);
 
   for (const r of results) {
     const icon = r.status === 'pass' ? '✓' : '✗';
     const color = r.status === 'pass' ? green : red;
     console.log(
-      `${bold}║${reset}  ${color}${icon}${reset} ${r.name.padEnd(28)} ${dim}${(`${r.duration}s`).padStart(6)}${reset}`,
+      `${bold}║${reset}  ${color}${icon}${reset} ${r.name.padEnd(28)} ${dim}${(`${r.duration}s`).padStart(6)}${reset}${stageSuffix(r.stages)}`,
     );
     if (r.error) {
       console.log(`${bold}║${reset}    ${red}└─ ${r.error}${reset}`);
@@ -838,16 +912,36 @@ async function main() {
   console.log(`${bold}╚══════════════════════════════════════════════════════════════${reset}`);
   console.log();
   console.log(`${dim}Full logs: ${resultsDir}${reset}`);
+  console.log(`${dim}Machine-readable: cele2e last --json${reset}`);
 
   writeFileSync(
     join(resultsDir, 'summary.json'),
     JSON.stringify(
-      { timestamp, total: testFiles.length, passed, failed, duration: suiteDuration },
+      {
+        timestamp,
+        total: testFiles.length,
+        passed,
+        failed,
+        stageSkipped,
+        duration: suiteDuration,
+      },
       null,
       2,
     ),
   );
 
+  writeLastRun({
+    runId,
+    resultsDir,
+    startedAt: new Date(suiteStart).toISOString(),
+    status: failed > 0 ? 'failed' : 'completed',
+    total: testFiles.length,
+    passed,
+    failed,
+    skipped: stageSkipped,
+    durationMs: suiteDuration * 1000,
+  });
+
   const gitignore = join(testDir, '.gitignore');
   const content = existsSync(gitignore) ? readFileSync(gitignore, 'utf-8') : '';
   const adds: string[] = [];

package/src/socks-proxy.ts

@@ -44,7 +44,7 @@ export interface SocksProxyHandle {
  * Why custom: an off-the-shelf SOCKS5 image (e.g. serjs/go-socks5-proxy)
  * starts fine on the test network but can't actually route to anything.
  * Docker's IPAM-default gateway points at an IP with no listener (e.g.
- * 100.100.0.250 on isp-external), and docker rewrites resolv.conf to
+ * 203.0.113.250 on isp-external), and docker rewrites resolv.conf to
  * its embedded resolver, which can't cleanly forward to the simulated
  * network's DNS. The custom image's entrypoint replaces both.
  */
@@ -61,7 +61,7 @@ interface VantageConfig {
 const VANTAGE_CONFIGS: Record<SocksProxyVantage, VantageConfig> = {
   'isp-external': {
     network: 'isp-external',
-    ip: '100.100.0.150',
+    ip: '203.0.113.150',
   },
   internal: {
     network: 'internal',

package/src/types.ts

@@ -363,7 +363,12 @@ export interface NetworkHandle {
    * Targets fw-main (the customer firewall) using the standard topology
    * subnets from ZONE_SUBNETS / ZONE_GATEWAYS.
    *
-   * @param opts.zones - zones to provide (default: dmz, app, secure)
+   * `opts.zones` says which zones get `provided_networks` written to system
+   * config. It does NOT declare which NICs the firewall has — the topology
+   * decides that, and `deployFirewall` derives the declared list from it, so a
+   * test cannot under-declare the box's hardware by omission.
+   *
+   * @param opts.zones - zones to PROVIDE (default: dmz, app, secure)
    * @param opts.natIp - NAT IP for port-forwarded traffic (default 10.226.1.253)
    */
   deployFirewall(opts?: {
@@ -371,6 +376,22 @@ export interface NetworkHandle {
     natIp?: string;
   }): Promise<void>;
 
+  /**
+   * Deploy the `greenwave` module against the ISP router (`fw-isp`) — the box
+   * that actually owns the WAN in the `default` topology.
+   *
+   * This is what makes the production shape work end to end. celilo's own
+   * firewall is DOWNSTREAM: it holds only RFC1918 legs, reports no external
+   * edge, and `exposeService` therefore has to delegate up the chain to a
+   * provider whose firewall capability declares `has_external: true`. greenwave
+   * is that provider. Without it a `default`-topology test that exposes
+   * anything publicly fails at the delegation step, which is correct — there is
+   * genuinely nothing that knows the fleet's public address.
+   *
+   * Not needed under `direct-internet`, where fw-main owns the edge itself.
+   */
+  deployGreenwave(): Promise<void>;
+
   /** Tear down the entire network */
   stop(): Promise<void>;
 
@@ -511,7 +532,7 @@ export function greenwaveRouterIp(): string {
  * by construction. Reference this instead of hardcoding it.
  */
 export function externalWanIp(): string {
-  return '100.100.0.100';
+  return '203.0.113.100';
 }
 
 /**
@@ -520,7 +541,7 @@ export function externalWanIp(): string {
  * WAN address when it reaches a public service.
  */
 export function externalWanSubnet(): string {
-  return '100.100.0.0/24';
+  return '203.0.113.0/24';
 }
 
 /** The internal split-horizon DNS resolver (dns-int) in the e2e topology. */
@@ -530,5 +551,5 @@ export function internalResolverIp(): string {
 
 /** The public upstream recursive resolver (the comcast-resolver sim). */
 export function publicResolverIp(): string {
-  return '100.100.0.1';
+  return '203.0.113.1';
 }

package/src/vantage.test.ts

@@ -86,7 +86,7 @@ describe('assertResolvesInZone — the killer verb', () => {
 
   test('public vantage expecting a public answer passes; a leaked zone IP fails', async () => {
     const ok = new VantageProbe(
-      fakeTransport({ resolve: async () => ({ ips: ['100.100.0.100'] }) }),
+      fakeTransport({ resolve: async () => ({ ips: ['203.0.113.100'] }) }),
     );
     await ok.assertResolvesInZone({
       from: 'publicInternet',

package/src/zone-classifier.test.ts

@@ -1,11 +1,6 @@
 import { describe, expect, test } from 'bun:test';
-import {
-  classifyIp,
-  inCidr,
-  isPublicLeakSafe,
-  isSegmentedZoneIp,
-  parseIpv4,
-} from './zone-classifier';
+import { parseIpv4, subnetContains } from '@celilo/capabilities';
+import { classifyIp, isPublicLeakSafe, isSegmentedZoneIp } from './zone-classifier';
 
 describe('parseIpv4', () => {
   test('parses dotted-quad to unsigned 32-bit', () => {
@@ -25,17 +20,17 @@ describe('parseIpv4', () => {
   });
 });
 
-describe('inCidr', () => {
+describe('subnetContains (shared, @celilo/capabilities)', () => {
   test('membership within /24', () => {
-    expect(inCidr('10.226.10.5', '10.226.10.0/24')).toBe(true);
-    expect(inCidr('10.226.10.255', '10.226.10.0/24')).toBe(true);
-    expect(inCidr('10.226.11.1', '10.226.10.0/24')).toBe(false);
+    expect(subnetContains('10.226.10.0/24', '10.226.10.5')).toBe(true);
+    expect(subnetContains('10.226.10.0/24', '10.226.10.255')).toBe(true);
+    expect(subnetContains('10.226.10.0/24', '10.226.11.1')).toBe(false);
   });
   test('high-octet subnet — no sign-bit bug', () => {
     // Arithmetic fixture, not a sim address: a first octet >= 128 is what trips
     // the sign bit, and no address in the sim plan has one any more.
-    expect(inCidr('200.100.50.253', '200.100.50.0/24')).toBe(true);
-    expect(inCidr('200.100.51.1', '200.100.50.0/24')).toBe(false);
+    expect(subnetContains('200.100.50.0/24', '200.100.50.253')).toBe(true);
+    expect(subnetContains('200.100.50.0/24', '200.100.51.1')).toBe(false);
   });
 });
 
@@ -49,7 +44,7 @@ describe('classifyIp', () => {
     expect(classifyIp('10.226.1.253')).toEqual({ kind: 'zone', zone: 'internal' });
   });
   test('public: the CGNAT stand-in and real public space', () => {
-    expect(classifyIp('100.100.0.100')).toEqual({ kind: 'public' }); // sim firewall external
+    expect(classifyIp('203.0.113.100')).toEqual({ kind: 'public' }); // sim firewall external
     expect(classifyIp('8.8.8.8')).toEqual({ kind: 'public' });
     expect(classifyIp('71.36.115.155')).toEqual({ kind: 'public' }); // the prod DDNS target
   });
@@ -70,13 +65,13 @@ describe('isSegmentedZoneIp', () => {
     expect(isSegmentedZoneIp('10.226.10.10')).toBe(true); // caddy DMZ — the ISS-0101/0111 bug value
     expect(isSegmentedZoneIp('10.226.20.30')).toBe(true);
     expect(isSegmentedZoneIp('10.226.1.253')).toBe(false); // internal IS the LAN
-    expect(isSegmentedZoneIp('100.100.0.100')).toBe(false); // public
+    expect(isSegmentedZoneIp('203.0.113.100')).toBe(false); // public
   });
 });
 
 describe('isPublicLeakSafe (CLAUDE.md inviolable rule #1)', () => {
   test('only public addresses are leak-safe', () => {
-    expect(isPublicLeakSafe('100.100.0.100')).toBe(true);
+    expect(isPublicLeakSafe('203.0.113.100')).toBe(true);
     expect(isPublicLeakSafe('8.8.8.8')).toBe(true);
     expect(isPublicLeakSafe('10.226.10.10')).toBe(false); // managed segmented zone
     expect(isPublicLeakSafe('10.226.1.253')).toBe(false); // internal/RFC-1918 must not leak

package/src/zone-classifier.ts

@@ -8,14 +8,15 @@
  * e.g. "www.<domain> resolved from internalDevice must NOT be a segmented-zone
  * container IP" — the ISS-0101 / ISS-0111 bug class.
  *
- * Classification uses `ZONE_SUBNETS` (exact) + a reserved-range check — deliberately
- * NOT a blanket RFC-1918/CGNAT ban: the sim's "public" IP is a CGNAT stand-in
- * (100.100.0.100), so in this topology the RFC-1918 zones under
- * `SIM_PRIVATE_SUPERNET` are *zones* and 100.x is *public*. (A real deployment
- * would additionally treat RFC-1918 + RFC-6598 as non-public; that's the
- * caller's policy, layered on top of this primitive.)
+ * Classification uses `ZONE_SUBNETS` (exact) + a reserved-range check. RFC-1918 is
+ * deliberately absent from the reserved list: in this topology those ranges are the
+ * managed zones. RFC-6598 (CGNAT) used to be absent too, because the sim's "public"
+ * edge was a CGNAT stand-in — that exemption is gone with the renumber to TEST-NET-3
+ * (RFC 5737), and a carrier address is now correctly non-public here as it is in
+ * `@celilo/capabilities`.
  */
 
+import { parseIpv4, subnetContains } from '@celilo/capabilities';
 import { ZONE_SUBNETS, type Zone } from './types';
 
 export type ZoneClass =
@@ -33,46 +34,30 @@ export const SEGMENTED_ZONES: readonly Zone[] = ['dmz', 'app', 'secure'];
 
 /**
  * Special-use IPv4 ranges that must never be a real service address (nor appear in
- * any DNS answer). RFC-1918 and RFC-6598 (CGNAT) are intentionally absent — in this
- * topology the former are the managed zones and the latter is the public stand-in.
+ * any DNS answer). RFC-1918 is intentionally absent — in this topology those ranges
+ * are the managed zones.
+ *
+ * The `internet-external` network still numbers its public simulators out of
+ * `100.64.0.0/24`; nothing classifies those addresses, and renumbering that network
+ * is not part of this change.
  */
 const RESERVED: ReadonlyArray<{ cidr: string; label: string }> = [
   { cidr: '0.0.0.0/8', label: 'unspecified/this-host (incl. the 0.0.0.0 sentinel)' },
+  { cidr: '100.64.0.0/10', label: 'carrier-grade NAT (RFC 6598)' },
   { cidr: '127.0.0.0/8', label: 'loopback' },
   { cidr: '169.254.0.0/16', label: 'link-local (RFC 3927)' },
   { cidr: '224.0.0.0/4', label: 'multicast' },
   { cidr: '240.0.0.0/4', label: 'reserved (RFC 1112)' },
 ];
 
-/** Parse a dotted-quad IPv4 to an unsigned 32-bit int, or null if malformed. */
-export function parseIpv4(ip: string): number | null {
-  const m = ip.trim().match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (!m) return null;
-  const octets = m.slice(1, 5).map(Number);
-  if (octets.some((o) => o > 255)) return null;
-  return ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;
-}
-
-/** True if `ip` falls within `cidr` (e.g. "10.226.10.0/24"). */
-export function inCidr(ip: string, cidr: string): boolean {
-  const [base, bitsStr] = cidr.split('/');
-  const bits = Number(bitsStr);
-  const ipN = parseIpv4(ip);
-  const baseN = parseIpv4(base);
-  if (ipN === null || baseN === null || Number.isNaN(bits) || bits < 0 || bits > 32) return false;
-  if (bits === 0) return true;
-  const mask = (0xffffffff << (32 - bits)) >>> 0;
-  return (ipN & mask) >>> 0 === (baseN & mask) >>> 0;
-}
-
 /** Classify a resolved IPv4 against the e2e topology. */
 export function classifyIp(ip: string): ZoneClass {
   if (parseIpv4(ip) === null) return { kind: 'invalid' };
   for (const r of RESERVED) {
-    if (inCidr(ip, r.cidr)) return { kind: 'reserved', label: r.label };
+    if (subnetContains(r.cidr, ip)) return { kind: 'reserved', label: r.label };
   }
   for (const zone of Object.keys(ZONE_SUBNETS) as Zone[]) {
-    if (inCidr(ip, ZONE_SUBNETS[zone])) return { kind: 'zone', zone };
+    if (subnetContains(ZONE_SUBNETS[zone], ip)) return { kind: 'zone', zone };
   }
   return { kind: 'public' };
 }