[devantler]

🤖 Generated by the Agentic Engineer

Why

Cloudflare recovery currently retains the old DNS snapshot but lacks the imported infrastructure state needed to resume declarative management after an incident.

What

Retain the encrypted imported state together with its matching desired configuration and recovery instructions. This provides an independently recoverable starting point before the first infrastructure change.

Part of #35

[devantler]

🤖 Generated by the Agentic Engineer

Evaluated the real retained recovery package: authenticated both encrypted files with the independently held matching identity, verified all manifest bindings, and repeated authenticated recovery from a clean archive of the committed source. The imported state and complete desired configuration match the confirmed plan producer, run 41368905763 at source 0925d15. The saved binary plan was independently rendered with the pinned native OpenTofu version and matched its exported JSON exactly: one create, no updates or deletes. No provider write was performed.

The full repository checks passed locally; current-head hosted checks also pass. This change retains the initial imported generation and updates its custody instructions. It does not activate a backend, prove remote locking or enable provider applies. Those retain their named migration gates.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a6642b31-431a-471f-8567-d6ca3ee5e74c

Commits

Reviewing files that changed from the base of the PR and between 0925d15 and cd658e6.

Files selected for processing: 6

• AGENTS.md
• README.md
• docs/runbooks/bootstrap-and-recovery.md
• recovery/state/configuration.json.age
• recovery/state/manifest.json
• recovery/state/state.json.age

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 1

• GitHub Check: CodeRabbit

Additional context used

Learnings: 1

Common learnings

Learnt from: CR
Repo: devantler-tech/cloudflare

Timestamp: 2026-11-02T08:53:57.025Z
Learning: Source excerpt:
# AGENTS.md — devantler-tech/cloudflare

## Maintenance

- Pass credentials only through environment variables or the approved private
  CI secret store. Never commit plaintext credentials, private keys, state or
  plans. The maintainer-approved exception is authenticated ciphertext for
  essential bootstrap recovery in `recovery/`, bound by its registered package
  validator and an independently recoverable key. Ordinary service credentials
  stay in OpenBao. Paired state packages bind encrypted state and desired
  configuration to their reviewed source and run; authenticate recovery with
  the independently held identity before using either file.

Additional comments: 4

recovery/state/manifest.json: 1

1-16: LGTM!

README.md: 1

97-102: LGTM!

AGENTS.md: 1

33-35: LGTM!

docs/runbooks/bootstrap-and-recovery.md: 1

5-6: LGTM!

Also applies to: 315-318

Walkthrough

The changes add a schema-version-1 recovery manifest with capture metadata and SHA-256 hashes. Repository guidance describes the retained encrypted state and desired configuration, authentication before use, and refreshing the package after reviewed applies. The runbook identifies the initial generation as containing the runner-local zone import and matching configuration. It also states that this generation does not establish provider convergence or remote backend locking.

Possibly related issues

• devantler-tech/cloudflare#35 — The retained package supports the issue’s state custody and recovery stage, but does not complete its inventory or adoption gates.
• devantler-tech/cloudflare#21 — The package and custody instructions support the issue’s recovery roadmap, but do not make the repository authoritative or enable provider applies.

Possibly related PRs

• devantler-tech/cloudflare#50 — Defines the recovery format and verification that this change documents and retains.
• devantler-tech/cloudflare#51 — Produces the initial imported state and matching configuration described by this change.
• devantler-tech/cloudflare#34 — Establishes the encrypted recovery package and recipient custody extended by this change.

Merge Risk: Minimal · up to cd658

The recovery package and its documented authentication limits are consistent and ready to merge.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title "fix(recovery): retain the imported Cloudflare state package" matches the main change. The PR adds encrypted imported OpenTofu state, its matching desired configuration, a manifest, and upda…
Description check		The description states the problem (Cloudflare recovery keeps the old DNS snapshot but lacks imported infrastructure state) and the change (retaining encrypted imported state with matching desired con…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "fix(recovery): retain the imported Cloudflare state package" matches the main change. The PR adds encrypted imported OpenTofu state, its matching desired configuration, a manifest, and updated recovery docs under recovery/state/. The title names the primary change and uses a conventional prefix.

Full details: Description check

Explanation

The description states the problem (Cloudflare recovery keeps the old DNS snapshot but lacks imported infrastructure state) and the change (retaining encrypted imported state with matching desired configuration and recovery instructions). This matches the raw summary's changes to README, runbook, AGENTS.md, and the recovery manifest.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[devantler]

🤖 Generated by the Agentic Engineer

Ready at cd658e6552e3d74bec0b2183af08cae1c5776713: all required and selected CI checks pass, the branch is mergeable against current main, and there are no unresolved threads or other findings. The authenticated current-head CodeRabbit summary returns GREEN under the repository's native verdict helper.

The real package has also passed authenticated recovery from a fresh fetch/archive of this exact published head. Both retained ciphertext files match the verified producer. The custody instructions are documentation; their named state/configuration authentication path was exercised. No provider resources, credential privileges or remote backend have changed.