Repository navigation
Export a verified DNS snapshot through encrypted read-only automation #31
Description
🤖 Generated by the Agentic Engineer
The first DNS migration needs a complete snapshot of existing records before configuration can be imported and reviewed. The repository connection is verified, but there is no reviewed way to retrieve this inventory privately through the existing automation boundary.
Add a manually enabled, read-only DNS snapshot workflow. It must refuse unreviewed branches and unintended dispatches before accessing credentials, bind reads to the owned zone, verify complete pagination, encrypt the inventory before export, and keep private data and credentials out of logs. Use a dedicated recovery recipient and short artifact retention; real export requires the maintainer to approve the transport and temporary recovery custody.
Acceptance:
- Negative controls prove that disabled or invalid dispatches make no provider request.
- Complete pagination and strict response validation reject partial, inconsistent, duplicate or foreign-zone records.
- Native encryption and decryption prove full data preservation with synthetic fixtures, with no plaintext export or log leakage.
- Reviewed workflow has bounded requests, pinned dependencies and no provider mutation, import, plan or apply capability.
- Authorized live snapshot is decrypted and verified in private recovery custody; temporary transport artifacts are removed after verified receipt.
This is the DNS inventory slice of #21 and devantler-tech/monorepo#3274. Full resource inventory, import, independent state, permanent recovery custody and a human-reviewed first no-destroy plan remain separate acceptance criteria.
Activity
devantler commentedon Oct 26, 2026
The reviewed preparation is delivered by PR #32, merged as c7adac3. Protected-main CI passed, the merged tree matches the reviewed source, and the manual snapshot workflow is registered and active. The source revision received a clean Codex review; all review findings and the fixture-only scanner warning were addressed or explicitly refuted.
The live inventory criterion remains open. Explicit approval of the temporary encrypted artifact transport is pending in the private interactive channel. No provider snapshot or Cloudflare resource change has been performed, and the broader import, state and permanent recovery requirements remain open.
devantler commentedon Oct 26, 2026
The first authorized live snapshot completed in run 40282002745 at reviewed main c7adac3. The encrypted archive's digest matched GitHub's artifact receipt; private decryption verified the owned-zone binding and complete unique record set in the approved temporary recovery custody. The Actions artifact was then deleted, with an independent authenticated read confirming no artifact remains on that run.
This completes the DNS snapshot slice. Full resource inventory, import, independent state, permanent recovery transfer and the human-reviewed first plan remain with devantler-tech/monorepo#3274 and the parent roadmap; no DNS resources were changed.