@celilo/e2e 0.9.2-alpha.0 → 0.9.3

package/config/proxy/squid.conf

@@ -30,8 +30,13 @@ sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/spool/squid/ssl_db
 access_log stdio:/var/log/squid/access.log
 cache_log /var/log/squid/cache.log
 
-# Resolve via real public DNS (reachable from real-internet bridge)
-dns_nameservers 8.8.8.8 1.1.1.1
+# Resolve via Docker's embedded resolver, which relays to the host's DNS.
+# Same reason as the resolver's forward-zone (config/resolver/unbound.conf):
+# hardcoding public resolvers breaks the harness on any network that blocks
+# direct UDP/53 egress, and squid is what every simulated container's HTTP(S)
+# egress transits — so a squid that can't resolve fails every apt fetch and
+# every `bun add` with "connection refused".
+dns_nameservers 127.0.0.11
 
 # Timeouts
 connect_timeout 30 seconds

package/config/resolver/unbound.conf

@@ -50,8 +50,18 @@ stub-zone:
     name: "park-your-domain.com."
     stub-addr: 100.64.0.55
 
-# Everything else → real public DNS (reachable via real-internet bridge)
+# Everything else → the real internet, via Docker's embedded resolver.
+#
+# 127.0.0.11 is Docker's per-container DNS; it relays to whatever the HOST is
+# configured to use. Hardcoding 8.8.8.8/1.1.1.1 here made the whole harness
+# unrunnable on any network that blocks direct UDP/53 to public resolvers —
+# corporate networks and some ISPs force their own resolver, and the symptom is
+# deeply unhelpful: unbound times out, squid's `dns_nameservers` times out with
+# it, and `bun add` reports "ConnectionRefused downloading package manifest
+# drizzle-orm" from inside the bake. Going through the host's resolver works
+# everywhere the host itself has working DNS, which is the actual requirement.
+#
+# `do-not-query-localhost: no` above is what permits this.
 forward-zone:
     name: "."
-    forward-addr: 8.8.8.8
-    forward-addr: 1.1.1.1
+    forward-addr: 127.0.0.11

package/docker/Dockerfile.minio

@@ -4,7 +4,7 @@
 # s3.ts) talks plain S3 with forcePathStyle + a custom endpoint, so it drives
 # MinIO unchanged. This sim is the destination for `celilo backup --storage`
 # (push) and the source for `celilo backup pull` (download) in the migration
-# restore e2e (P5, v2/CELILO_MGMT_MIGRATION.md).
+# restore e2e (P5, openspec/specs/management-server-backup/spec.md).
 #
 # Placement: internet-external (100.64.0.0/24) like the other public services —
 # the management box reaches it OUTBOUND over its internet egress, exactly the

package/docker/Dockerfile.target-machine

@@ -34,7 +34,7 @@ RUN update-ca-certificates
 # AND /etc/environment so Ansible's SSH-invoked npm — a session that does NOT
 # inherit Docker ENV — also picks it up via pam_env. Without this, a module's
 # `npm install` against the npm-registry-sim fails SELF_SIGNED_CERT_IN_CHAIN.
-# (v2/EVENT_DRIVEN_HOOK_SUBSCRIPTIONS.md L6.)
+# (openspec/specs/event-driven-hook-subscriptions/spec.md L6.)
 ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
 RUN echo 'NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt' >> /etc/environment
 

package/docker/Dockerfile.target-machine-docker

@@ -38,7 +38,7 @@ RUN update-ca-certificates
 # Node/npm ignore the OS trust store; point them at the bundle that now includes
 # the e2e CAs (mirrors Dockerfile.management), in both the image env and
 # /etc/environment so Ansible's SSH-invoked npm picks it up via pam_env.
-# (v2/EVENT_DRIVEN_HOOK_SUBSCRIPTIONS.md L6.)
+# (openspec/specs/event-driven-hook-subscriptions/spec.md L6.)
 ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
 RUN echo 'NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt' >> /etc/environment
 

package/docker/Dockerfile.target-technitium

@@ -36,7 +36,7 @@ RUN update-ca-certificates
 # Node/npm ignore the OS trust store; point them at the bundle that now includes
 # the e2e CAs (mirrors Dockerfile.management), in both the image env and
 # /etc/environment so Ansible's SSH-invoked npm picks it up via pam_env.
-# (v2/EVENT_DRIVEN_HOOK_SUBSCRIPTIONS.md L6.)
+# (openspec/specs/event-driven-hook-subscriptions/spec.md L6.)
 ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
 RUN echo 'NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt' >> /etc/environment
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.9.2-alpha.0",
+  "version": "0.9.3",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -37,8 +37,8 @@
     "README.md"
   ],
   "dependencies": {
-    "@celilo/cli-display": "0.1.9-alpha.1",
-    "@celilo/event-bus": "0.1.8-alpha.0",
+    "@celilo/cli-display": "workspace:^",
+    "@celilo/event-bus": "workspace:^",
     "yaml": "^2.8.0",
     "zod": "^3.24.1"
   },
@@ -57,6 +57,5 @@
     "type": "git",
     "url": "https://github.com/psbanka/infra",
     "directory": "packages/e2e"
-  },
-  "gitHead": "8fe2dff30ef6a59a0aed48e5501403e43be8429e"
+  }
 }

package/scripts/pack-celilo-packages.ts

@@ -6,21 +6,21 @@
  * install.sh runs:
  *   bun add -g @celilo/cli @celilo/event-bus @celilo/e2e
  *
- * Their transitive @celilo/* dependency closure is:
- *   @celilo/cli         → @celilo/capabilities, @celilo/cli-display, @celilo/event-bus
- *   @celilo/event-bus   → (none)
- *   @celilo/e2e         → @celilo/cli-display, @celilo/event-bus
- *   @celilo/capabilities → (none)
- *   @celilo/cli-display → (none)
+ * Which packages must land in the simulator is the transitive runtime closure
+ * of those roots — DERIVED from the live workspace by `installClosure()`, never
+ * hand-listed here. A hand-maintained list is exactly what turned this red for
+ * days when `@celilo/core` was added as a cli dep and forgotten
+ * (apps/celilo/designs/WORKSPACE_PACKAGE_GRAPH.md).
  *
- * So 5 workspace packages need to land in the simulator. We rewrite each
- * package's `workspace:^` deps to concrete `^<workspace-version>` ranges
- * OURSELVES before `bun pm pack` — we do NOT rely on bun's lock-based
- * expansion, which goes stale after a cross-caret version bump and pins
- * dependents to an unresolvable old range (ISS-0103: a `0.3→0.4`
+ * We rewrite each packed package's `workspace:^` deps to concrete
+ * `^<workspace-version>` ranges OURSELVES before `bun pm pack` — we do NOT rely
+ * on bun's lock-based expansion, which goes stale after a cross-caret version
+ * bump and pins dependents to an unresolvable old range (ISS-0103: a `0.3→0.4`
  * capabilities bump left the lock at 0.3, so packed cli pinned
- * `^0.3.0-alpha.0`, excluding the 0.4.x the sim served). package.json is
- * restored after packing so `workspace:^` stays in source.
+ * `^0.3.0-alpha.0`, excluding the 0.4.x the sim served). The rewrite map is the
+ * FULL workspace version map (every @celilo/* package), so any `workspace:` dep
+ * that can't be resolved is a genuine error and throws (see rewriteWorkspacePins).
+ * package.json is restored after packing so `workspace:^` stays in source.
  *
  * Output directory is typically `packages/e2e/.npm-registry-cache/` —
  * staged into the npm-registry-sim Docker image at build time.
@@ -30,11 +30,53 @@
  */
 
 import { execSync } from 'node:child_process';
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import {
+  installClosure,
+  readWorkspace,
+  workspaceVersionMap,
+} from '../../../scripts/workspace-graph';
 import { ensureRegistryServerBundle } from '../src/registry-bundle';
 
-const REPO_ROOT = join(import.meta.dir, '..', '..', '..');
+/**
+ * Resolve the celilo monorepo root by walking up from `startDir` (the caller's
+ * cwd by default) looking for `apps/celilo/package.json`.
+ *
+ * This replaces a hardcoded `join(import.meta.dir, '..', '..', '..')`. That
+ * derivation assumed the script always lives at `<repo>/packages/e2e/scripts/`,
+ * which holds in a checkout and nowhere else: the script ships inside the
+ * published `@celilo/e2e` tarball, where `../../..` resolves to the consumer's
+ * `node_modules/` and every path built from it points at
+ * `node_modules/apps/celilo/...` → ENOENT (ce-dae). `build.ts` already spawns
+ * this script with `cwd: <repoRoot>`, so the caller is the single source of
+ * truth for where the workspace is — take it from there, don't re-derive it.
+ * Walking up (rather than requiring cwd to BE the root exactly) also lets it run
+ * from a subdir of the checkout, e.g. `bun test` from `packages/e2e`.
+ */
+export function resolveRepoRoot(startDir: string = process.cwd()): string {
+  let dir = startDir;
+  for (let i = 0; i < 10; i++) {
+    if (existsSync(join(dir, 'apps', 'celilo', 'package.json'))) return dir;
+    const parent = resolve(dir, '..');
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error(
+    `pack-celilo-packages: no celilo checkout found from '${startDir}' (looked for apps/celilo/package.json walking up). This is a monorepo-internal dev script — run it from a checkout via 'cele2e build-infra'.`,
+  );
+}
+
+// Lazily memoized so importing this module (e.g. the rewriteWorkspacePins unit
+// test) never triggers resolution — only the packing path, which runs inside a
+// checkout, resolves the root.
+let _repoRoot: string | undefined;
+function repoRoot(): string {
+  if (_repoRoot === undefined) {
+    _repoRoot = resolveRepoRoot();
+  }
+  return _repoRoot;
+}
 
 interface PackageJson {
   name?: string;
@@ -83,7 +125,14 @@ export function rewriteWorkspacePins(
     for (const [name, spec] of Object.entries(deps)) {
       if (!spec.startsWith('workspace:')) continue;
       const version = versions.get(name);
-      if (!version) continue;
+      if (!version) {
+        throw new Error(
+          `Cannot rewrite ${bucket} "${name}": "${spec}" — ${name} is not a known ` +
+            `@celilo/* workspace package. Add it to the workspace, or fix the dep name. ` +
+            `(This is the loud failure the old hardcoded pack list lacked — ` +
+            `see apps/celilo/designs/WORKSPACE_PACKAGE_GRAPH.md.)`,
+        );
+      }
       const range = spec.slice('workspace:'.length);
       let newSpec: string;
       if (range === '*' || range === '') newSpec = '*';
@@ -98,27 +147,12 @@ export function rewriteWorkspacePins(
   return rewrites;
 }
 
-/**
- * Workspace packages that install.sh's transitive @celilo/* closure depends
- * on. Hardcoded by name → relative path so a typo in package.json or a future
- * rename gets caught at build time rather than at test time. If a new
- * @celilo/* workspace package becomes a runtime dep of cli/event-bus/e2e,
- * add it here.
- */
-const PACKAGES_TO_PACK = [
-  { name: '@celilo/cli', path: 'apps/celilo' },
-  { name: '@celilo/capabilities', path: 'packages/capabilities' },
-  { name: '@celilo/cli-display', path: 'packages/cli-display' },
-  { name: '@celilo/e2e', path: 'packages/e2e' },
-  { name: '@celilo/event-bus', path: 'packages/event-bus' },
-] as const;
-
 interface CliArgs {
   destination: string;
 }
 
 function parseArgs(): CliArgs {
-  const defaultDest = join(REPO_ROOT, 'packages', 'e2e', '.npm-registry-cache');
+  const defaultDest = join(repoRoot(), 'packages', 'e2e', '.npm-registry-cache');
   let destination = defaultDest;
   for (const arg of process.argv.slice(2)) {
     if (arg.startsWith('--dest=')) {
@@ -132,7 +166,7 @@ function parseArgs(): CliArgs {
 }
 
 function pack(pkgPath: string, destination: string, versions: Map<string, string>): string {
-  const fullPath = join(REPO_ROOT, pkgPath);
+  const fullPath = join(repoRoot(), pkgPath);
   const pkgJsonPath = join(fullPath, 'package.json');
   if (!existsSync(pkgJsonPath)) {
     throw new Error(`No package.json in ${fullPath}`);
@@ -173,13 +207,6 @@ function pack(pkgPath: string, destination: string, versions: Map<string, string
   }
 }
 
-function workspaceVersion(pkgPath: string): string {
-  const json = JSON.parse(readFileSync(join(REPO_ROOT, pkgPath, 'package.json'), 'utf-8')) as {
-    version: string;
-  };
-  return json.version;
-}
-
 function main(): void {
   const { destination } = parseArgs();
 
@@ -195,22 +222,23 @@ function main(): void {
   // "published without its registry-server bundle"). Regenerate it from the
   // sibling packages/registry-server before packing, exactly as buildDockerImages
   // does in-monorepo. (This is why npm-consumer-smoke was red — ce-3rs.)
-  ensureRegistryServerBundle(join(REPO_ROOT, 'packages', 'e2e'));
+  ensureRegistryServerBundle(join(repoRoot(), 'packages', 'e2e'));
 
   console.log(`Packing @celilo/* packages → ${destination}`);
   console.log('');
 
-  // The name→version map used to rewrite each package's workspace:^ deps to
-  // concrete ranges that resolve against the co-packed versions (ISS-0103).
-  const versions = new Map<string, string>(
-    PACKAGES_TO_PACK.map(({ name, path }) => [name, workspaceVersion(path)]),
-  );
+  // Derive the package set + version map from the live workspace (never a
+  // hardcoded list). The rewrite map is the FULL workspace (every @celilo/*
+  // package) so any workspace: dep resolves or throws; the pack set is the
+  // runtime install closure of install.sh's roots.
+  const workspace = readWorkspace(repoRoot());
+  const versions = workspaceVersionMap(workspace);
+  const toPack = installClosure(workspace);
 
   const results: Array<{ name: string; version: string; tarball: string }> = [];
-  for (const { name, path } of PACKAGES_TO_PACK) {
-    const version = workspaceVersion(path);
-    console.log(`▸ ${name}@${version}  (${path})`);
-    const tarball = pack(path, destination, versions);
+  for (const { name, dir, version } of toPack) {
+    console.log(`▸ ${name}@${version}  (${dir})`);
+    const tarball = pack(dir, destination, versions);
     results.push({ name, version, tarball });
     console.log(`  → ${tarball}`);
     console.log('');

package/src/cli/build.ts

@@ -25,11 +25,22 @@ import { gunzipSync } from 'node:zlib';
 import { stageAptRepo } from '../../scripts/stage-apt-repo';
 import { ensureRegistryServerBundle } from '../registry-bundle';
 
-/** Walk up from pkgDir to find the monorepo root (contains a `modules/` dir). */
-function findMonorepoRoot(pkgDir: string): string | null {
+/**
+ * Walk up from pkgDir to find the celilo monorepo root.
+ *
+ * The marker is `apps/celilo/package.json` — a file that only a real celilo
+ * checkout has — NOT the presence of a `modules/` directory. A bare `modules/`
+ * is too weak a signal: a stray empty `node_modules/modules` (left by a botched
+ * `bun add -g`) made this return the global node_modules as "the monorepo root",
+ * which skipped `stageFromPublic()` and crashed the npm-consumer path in the
+ * workspace packer (ce-dbc). Matches the marker `container-manager.ts`'s
+ * findCeliloRoot already uses. Returns null in any consumer install, so callers
+ * correctly fall through to the published-source path.
+ */
+export function findMonorepoRoot(pkgDir: string): string | null {
   let dir = pkgDir;
   for (let i = 0; i < 10; i++) {
-    if (existsSync(join(dir, 'modules'))) return dir;
+    if (existsSync(join(dir, 'apps', 'celilo', 'package.json'))) return dir;
     const parent = resolve(dir, '..');
     if (parent === dir) break;
     dir = parent;
@@ -171,16 +182,24 @@ async function stageSimulatorInputs(pkgDir: string): Promise<void> {
 /**
  * The published @celilo/* packages the npm-registry-sim must serve so
  * install.sh's `bun add -g @celilo/cli @celilo/event-bus @celilo/e2e`
- * resolves its full transitive closure against the sim. Mirrors
- * PACKAGES_TO_PACK in scripts/pack-celilo-packages.ts (the monorepo
- * equivalent that packs from workspace source instead of fetching).
+ * resolves its full transitive closure against the sim.
+ *
+ * This is the ONE place the install closure is a literal rather than derived:
+ * build.ts runs consumer-side (inside the published @celilo/e2e tarball, with
+ * NO monorepo present), so it cannot read the workspace package.json set at
+ * runtime the way the monorepo packer does. `installClosure(readWorkspace())`
+ * is the source of truth; this literal must match it, and
+ * published-packages-in-sync.test.ts fails the instant they drift (that test is
+ * why forgetting a package here can't recur — see WORKSPACE_PACKAGE_GRAPH.md).
+ * Keep this sorted the same as installClosure()'s topo output for easy diffing.
  */
-const PUBLISHED_CELILO_PACKAGES = [
-  '@celilo/cli',
+export const PUBLISHED_CELILO_PACKAGES = [
   '@celilo/capabilities',
   '@celilo/cli-display',
-  '@celilo/e2e',
+  '@celilo/core',
   '@celilo/event-bus',
+  '@celilo/e2e',
+  '@celilo/cli',
 ] as const;
 
 /**

package/src/cli/command-registry.ts

@@ -25,16 +25,31 @@ export const COMMANDS: CommandDef[] = [
     name: 'run',
     description: 'Run e2e tests — pass a module path or pattern, or --all / --all-modules',
     flags: [
-      { name: '--all', description: 'Run the full regression: every module suite + top-level e2e/tests/' },
-      { name: '--complete', description: 'Alias of --all: run every test, including ci-unsafe (quarantined) ones' },
-      { name: '--ci-safe', description: 'Full regression EXCEPT tests marked cele2e-ci-unsafe (used by the nightly)' },
+      {
+        name: '--all',
+        description:
+          'Full regression: every module suite + top-level e2e/tests/ (quarantined cele2e-ci-unsafe tests skipped)',
+      },
+      {
+        name: '--complete',
+        description:
+          'Run EVERYTHING including quarantined (cele2e-ci-unsafe) tests — the only mode that opts into them',
+      },
+      {
+        name: '--ci-safe',
+        description:
+          'Alias for the default full regression (quarantined tests skipped); kept for the nightly',
+      },
       { name: '--all-modules', description: 'Run e2e tests for all modules with e2e/ directories' },
       { name: '--keep', description: 'Keep network running after tests' },
       { name: '--reuse', description: 'Reuse existing network if running' },
       { name: '--live', description: 'Use live (non-simulated) internet' },
       { name: '--published', description: 'Use published .netapp packages' },
       { name: '--notify', description: 'Desktop notification when the run finishes' },
-      { name: '--shuffle', description: 'Randomize test order to surface order-dependent bugs (seed is logged)' },
+      {
+        name: '--shuffle',
+        description: 'Randomize test order to surface order-dependent bugs (seed is logged)',
+      },
       { name: '--seed=', description: 'Replay a specific --shuffle order (e.g. --seed=12345)' },
     ],
   },
@@ -65,7 +80,10 @@ export const COMMANDS: CommandDef[] = [
     description: 'Rebuild Docker images and package all modules as .netapps',
     flags: [
       { name: '--save', description: 'Save Docker images to tarball after build' },
-      { name: '--skip-modules', description: 'Skip .netapp packaging (only rebuild Docker images)' },
+      {
+        name: '--skip-modules',
+        description: 'Skip .netapp packaging (only rebuild Docker images)',
+      },
     ],
   },
   {
@@ -109,7 +127,17 @@ export const COMMANDS: CommandDef[] = [
 
 export const UP_PRESETS = ['--caddy', '--full-stack', '--infrastructure'];
 
-export const RUN_FLAGS = ['--all', '--complete', '--ci-safe', '--all-modules', '--keep', '--reuse', '--live', '--published', '--notify'];
+export const RUN_FLAGS = [
+  '--all',
+  '--complete',
+  '--ci-safe',
+  '--all-modules',
+  '--keep',
+  '--reuse',
+  '--live',
+  '--published',
+  '--notify',
+];
 
 export const DOWN_FLAGS = ['--keep', '--all'];
 

package/src/cli/index.ts

@@ -19,19 +19,27 @@ import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync, readdirSync, rmSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { parse as parseYaml } from 'yaml';
+import {
+  E2eBusyError,
+  acquireRunLock,
+  clearLock,
+  formatBusy,
+  lockStatus,
+  markKept,
+} from '../run-lock';
 import { runBuild } from './build';
-import { runScaffold } from './scaffold';
 import { generateBashCompletion, generateZshCompletion, getCompletions } from './completion';
 import { findAllModules, findModulesWithMatchingTest } from './module-discovery';
-import { acquireRunLock, clearLock, E2eBusyError, formatBusy, lockStatus, markKept } from '../run-lock';
+import { runScaffold } from './scaffold';
 
 const PKG_DIR = resolve(import.meta.dir, '../..');
 const BIN_DIR = join(PKG_DIR, 'bin');
 
-
 function readManifestTestsDir(manifestPath: string): string | undefined {
   try {
-    const parsed = parseYaml(readFileSync(manifestPath, 'utf-8')) as { e2e?: { tests_dir?: string } };
+    const parsed = parseYaml(readFileSync(manifestPath, 'utf-8')) as {
+      e2e?: { tests_dir?: string };
+    };
     return parsed?.e2e?.tests_dir;
   } catch {
     return undefined;
@@ -90,14 +98,26 @@ function discoverSuiteTests(suiteRoot: string): { name: string; file: string; gr
       ? resolve(moduleDir, readManifestTestsDir(join(moduleDir, 'manifest.yml')) ?? 'e2e')
       : tp;
     if (!existsSync(testsDir)) continue;
-    for (const f of readdirSync(testsDir).filter((f) => f.endsWith('.test.ts')).sort()) {
-      out.push({ name: f.replace(/\.test\.ts$/, ''), file: join(testsDir, f), group: basename(moduleDir) });
+    for (const f of readdirSync(testsDir)
+      .filter((f) => f.endsWith('.test.ts'))
+      .sort()) {
+      out.push({
+        name: f.replace(/\.test\.ts$/, ''),
+        file: join(testsDir, f),
+        group: basename(moduleDir),
+      });
     }
   }
   const topLevel = join(suiteRoot, 'e2e', 'tests');
   if (existsSync(topLevel)) {
-    for (const f of readdirSync(topLevel).filter((f) => f.endsWith('.test.ts')).sort()) {
-      out.push({ name: f.replace(/\.test\.ts$/, ''), file: join(topLevel, f), group: '(top-level)' });
+    for (const f of readdirSync(topLevel)
+      .filter((f) => f.endsWith('.test.ts'))
+      .sort()) {
+      out.push({
+        name: f.replace(/\.test\.ts$/, ''),
+        file: join(topLevel, f),
+        group: '(top-level)',
+      });
     }
   }
   return out;
@@ -200,9 +220,10 @@ switch (command) {
       args.includes('--complete') ||
       args.includes('--ci-safe')
     ) {
-      // --complete and --ci-safe both run the full discovery (every module +
-      // the repo's top-level e2e/tests/). --ci-safe additionally has the runner
-      // skip tests marked `cele2e-ci-unsafe`. --all-modules stays modules-only.
+      // --all / --complete / --ci-safe all run the full discovery (every module +
+      // the repo's top-level e2e/tests/). Quarantined (`cele2e-ci-unsafe`) tests
+      // are skipped by default; only --complete opts back into them (the runner
+      // sees the flag — it's kept below). --all-modules stays modules-only.
       const wantTopLevel =
         args.includes('--all') || args.includes('--complete') || args.includes('--ci-safe');
       const suiteRoot = resolveSuiteRoot();
@@ -222,9 +243,9 @@ switch (command) {
       }
       runScript(
         'e2e-run',
-        // Strip the discovery aliases; KEEP --ci-safe so the runner applies the
-        // `cele2e-ci-unsafe` quarantine exclusion.
-        args.filter((a) => a !== '--all' && a !== '--all-modules' && a !== '--complete'),
+        // Strip the discovery-only aliases; KEEP --complete (the runner uses it to
+        // opt back into quarantined tests) and --ci-safe (harmless/no-op now).
+        args.filter((a) => a !== '--all' && a !== '--all-modules'),
         env,
       );
     }
@@ -236,10 +257,14 @@ switch (command) {
 
     if (modulePath) {
       const absModulePath = resolve(modulePath);
-      runScript('e2e-run', args.filter((a) => a !== modulePath), {
-        E2E_TEST_DIR: stateDir,
-        E2E_MODULE_DIR: absModulePath,
-      });
+      runScript(
+        'e2e-run',
+        args.filter((a) => a !== modulePath),
+        {
+          E2E_TEST_DIR: stateDir,
+          E2E_MODULE_DIR: absModulePath,
+        },
+      );
     }
 
     // If cwd is not a module, walk sibling modules so the user can invoke
@@ -261,7 +286,9 @@ switch (command) {
           for (const m of matches) {
             console.error(`  ${basename(m.moduleDir)}: ${m.matchedTests.join(', ')}`);
           }
-          console.error('\nDisambiguate by running from inside the module directory or passing its path.');
+          console.error(
+            '\nDisambiguate by running from inside the module directory or passing its path.',
+          );
           process.exit(1);
         }
       } else if (positionals.length === 0) {
@@ -364,7 +391,9 @@ switch (command) {
         console.log(`  Reuse:    cele2e run --reuse`);
         console.log(`  Tear down: cele2e down`);
         console.log('');
-      } catch { /* ignore parse errors */ }
+      } catch {
+        /* ignore parse errors */
+      }
     }
     runScript('e2e-status', args, projectName ? { CELILO_E2E_PROJECT: projectName } : undefined);
   }
@@ -380,7 +409,10 @@ switch (command) {
     // build-infra mutates the shared Docker images — serialize against runs.
     // Released via the lock's exit handler (runBuild may process.exit on failure).
     try {
-      acquireRunLock({ test: 'build-infra', runId: process.env.CELE2E_RUN_ID ?? crypto.randomUUID() });
+      acquireRunLock({
+        test: 'build-infra',
+        runId: process.env.CELE2E_RUN_ID ?? crypto.randomUUID(),
+      });
     } catch (err) {
       if (err instanceof E2eBusyError) {
         console.error(err.message);

package/src/container-manager.ts

@@ -922,7 +922,7 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
   if (config.managementVariant !== 'vanilla') {
     assertCliVersion(projectName, composeDir);
     console.log('[progress:start] initializing celilo | celilo initialized');
-    // Honest harness (v2/NETWORK_CONFIG_TO_FIREWALL.md): seed ONLY the
+    // Honest harness (openspec/specs/progressive-zone-disclosure/spec.md): seed ONLY the
     // `internal` zone — the network the management box is genuinely on —
     // plus DNS. dmz/app/secure are NOT pre-seeded; they come into being
     // when a test deploys the firewall (net.deployFirewall()), exactly as