[devantler]

🤖 Generated by the Agentic Engineer

Why

The first Cloudflare infrastructure change needs a recoverable path even when the cluster is unavailable. A failed change must preserve the information needed to resume safely.

What

Add a guarded manual path for the reviewed proposal, with an independent recovery check before any change and encrypted recovery copies afterward. Broader infrastructure migration remains separately gated.

Part of #35

[devantler]

🤖 Generated by the Agentic Engineer

Validation at 510f0f3f459d7600fb0fe8d9861cd3ae22abde80: the full local repository suite, shell checks and workflow syntax checks pass with the pinned OpenTofu CLI. The new approved-byte and publication regressions failed before implementation and now pass. The input decoder also accepted the real independently authenticated frozen plan/state/configuration at this exact head, with no provider writes and no new credentials.

The network-free publication fixture checks the fixed ciphertext payload, signature, parent/branch binding, remote byte readback and immutable result ref, including refused signatures, moved branches, API/tag failures and an unsuccessful custody canary. The Linux/tmpfs lifecycle cases are explicitly skipped on this Mac and must pass Ubuntu CI; Docker is unavailable locally. They cover a partial apply, changed convergence, failed capture/publication, an existing bucket and a failed canary, with native age-authenticated recovery checks.

The actual main-only GitHub Actions-token custody check is not yet run; that specific runtime credential surface is unavailable on the host. The provider apply also remains unrun. The default check mode changes no provider resource, and apply requires its successful same-main-revision receipt, the frozen reviewed bytes, an unchanged zone and one absent bucket. Broader adoption and backend-locking gates remain separate. No DATA secret has been uploaded.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2fe7ff43-a3b2-4e55-b299-8c00ee488fe3

Commits

Reviewing files that changed from the base of the PR and between 44f2130 and 510f0f3.

Files selected for processing: 12

• .github/bootstrap-plan-approval.json
• .github/workflows/state-bootstrap-apply.yaml
• AGENTS.md
• README.md
• docs/runbooks/bootstrap-and-recovery.md
• scripts/apply-state-bootstrap.sh
• scripts/decode-bootstrap-apply-input.sh
• scripts/publish-bootstrap-state.sh
• scripts/test.sh
• scripts/tests/test-bootstrap-apply-input.sh
• scripts/tests/test-bootstrap-apply-lifecycle.sh
• scripts/tests/test-bootstrap-state-publication.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Additional context used

Learnings: 1

Common learnings

Learnt from: CR
Repo: devantler-tech/cloudflare

Timestamp: 2026-11-02T10:07:40.569Z
Learning: Applicability reference:
AGENTS.md: # AGENTS.md — devantler-tech/cloudflare
## What this repo is
CI checks links in `README.md` and this file against the repository-owned retired
catalogue list in `.github/retired-repo-links.json`. The required guard verifies
clean documentation, rejected retired links, and missing configuration. Run
`bash scripts/test-retired-repo-links.sh <released-validator-binary>` to repeat
the clean and disposable failure fixtures locally.

Source excerpt:
# cloudflare

## Safety state

The configuration is deliberately import-first. The manual state-bootstrap
workflow defaults to checking independent encrypted recovery publication. Its
apply mode accepts only the frozen, reviewed first proposal and requires a
successful custody check from that same main revision. General applies remain
disabled until inventory, imports, remote locking and recovery pass their gates.

Learnt from: CR
Repo: devantler-tech/cloudflare

Timestamp: 2026-11-02T10:07:32.942Z
Learning: Source excerpt:
# AGENTS.md — devantler-tech/cloudflare

## Maintenance

- Use OpenTofu 1.12.x and the official Cloudflare provider version pinned in
  `versions.tf`.

Learnt from: CR
Repo: devantler-tech/cloudflare

Timestamp: 2026-11-02T10:07:32.942Z
Learning: Source excerpt:
# AGENTS.md — devantler-tech/cloudflare

## Maintenance

- The confirmed main-only state-bootstrap workflow is a programmed data writer.
  It owns `recovery/cloudflare-state-<run>` branches and immutable
  `cloudflare-state-<run>-before` / `-result` tags. It writes only the registered
  ciphertext package and its fixed custody receipt, never `main` or credentials.
  Provider apply requires a successful custody check at that exact main revision.

Learnt from: CR
Repo: devantler-tech/cloudflare

Timestamp: 2026-11-02T10:07:32.942Z
Learning: Source excerpt:
# AGENTS.md — devantler-tech/cloudflare

## Maintenance

- Pass credentials only through environment variables or the approved private
  CI secret store. Never commit plaintext credentials, private keys, state or
  plans. The maintainer-approved exception is authenticated ciphertext for
  essential bootstrap recovery in `recovery/`, bound by its registered package
  validator and an independently recoverable key. Ordinary service credentials
  stay in OpenBao. Paired state packages bind encrypted state and desired
  configuration to their reviewed source and run; authenticate recovery with
  the independently held identity before using either file.

ast-grep (0.50.0)

scripts/tests/test-bootstrap-state-publication.sh

[warning] 53-53: A credential-bearing variable (e.g. PASSWORD, PASSWD, SECRET, TOKEN, API_KEY) is assigned a hardcoded string literal. Secrets committed to a script are exposed in source control, process listings, and shell history, and cannot be rotated without a code change. Read the value from a secrets manager or an injected environment variable at runtime instead (e.g. PASSWORD="${DB_PASSWORD:?must be set}"), and never commit the literal.
Context: GH_TOKEN=SYNTHETIC_TOKEN
Note: [CWE-798] Use of Hard-coded Credentials.

(hardcoded-password-assignment-bash)

[warning] 53-53: A credential-bearing variable (e.g. PASSWORD, PASSWD, SECRET, TOKEN, API_KEY) is assigned a hardcoded string literal. Secrets committed to a script are exposed in source control, process listings, and shell history, and cannot be rotated without a code change. Read the value from a secrets manager or an injected environment variable at runtime instead (e.g. PASSWORD="${DB_PASSWORD:?must be set}"), and never commit the literal.
Context: CLOUDFLARE_API_TOKEN=SYNTHETIC_PROVIDER_TOKEN
Note: [CWE-798] Use of Hard-coded Credentials.

(hardcoded-password-assignment-bash)

zizmor (1.30.1)

.github/workflows/state-bootstrap-apply.yaml

[info] 27-27: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)

Additional comments: 11

.github/bootstrap-plan-approval.json: 1

1-15: LGTM!

.github/workflows/state-bootstrap-apply.yaml: 1

1-90: LGTM!

scripts/decode-bootstrap-apply-input.sh: 1

1-39: LGTM!

scripts/tests/test-bootstrap-apply-input.sh: 1

1-51: LGTM!

docs/runbooks/bootstrap-and-recovery.md: 1

179-231: LGTM!

scripts/apply-state-bootstrap.sh: 1

1-132: LGTM!

AGENTS.md: 1

47-51: LGTM!

README.md: 1

23-24: LGTM!

Also applies to: 77-81

scripts/test.sh: 1

16-18: LGTM!

scripts/tests/test-bootstrap-apply-lifecycle.sh: 1

1-106: LGTM!

scripts/tests/test-bootstrap-state-publication.sh: 1

1-91: LGTM!

Walkthrough

This PR adds a manually dispatched Cloudflare state-bootstrap workflow with check and apply modes. It validates dispatch context and approved plan data, publishes and verifies encrypted recovery state, and gates provider changes on a successful custody check from the same main revision. It also adds runbook and repository guidance for the workflow, plus tests for input validation, publication, and apply lifecycle outcomes.

Possibly related issues

• devantler-tech/cloudflare#21 — The PR adds guarded first-apply and encrypted recovery publication steps related to the roadmap’s first-apply and recovery goals.
• devantler-tech/cloudflare#35 — The PR adds first-apply gates and state custody steps described as preconditions; it does not add the read-only inventory workflow.

Possibly related PRs

• devantler-tech/cloudflare#51 — This PR consumes and validates the approved plan artifacts produced by the plan-producer PR.
• devantler-tech/cloudflare#53 — This PR binds approval and apply inputs to the retained state generation introduced there.
• devantler-tech/cloudflare#50 — This PR uses the recovery-package format and verification helpers added there.

Merge Risk: Minimal · up to 510f0

No actionable merge-blocking issue remains after normal checks; the custody gate fails closed for non-commit tags.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

Failed checks: 1 error

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: guarding the first infrastructure apply with independent recovery.
Description check		The description directly explains why the guarded Cloudflare bootstrap path is needed and what recovery protections it adds.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 6 functions across 7 files. (5 skipped: 5 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[devantler]

🤖 Generated by the Agentic Engineer

Resolution of the ancillary findings in the review of 510f0f3:

• Added adjacent documentation for the production failure/capture, isolated provider, immutable readback, signed-parent and exclusive-ref helpers, plus the fixture assertions. These explain their trust and recovery boundaries rather than suppressing the documentation check.
• Added the missing human-readable workflow job name.
• Refuted the hardcoded-credential warnings: both cited strings are explicitly synthetic fixtures. The test installs its local gh double before invoking the publisher, records the complete request boundary, and asserts the dummy token is absent from payloads and receipts. No real credential is stored or used. Replacing them with live secrets would undermine this intentionally network-free test.

Shell and workflow checks pass. The preceding head's complete Ubuntu CI passed the native age/tmpfs failure scenarios; this update changes comments and the job label only. Fresh current-head CI and substantive review still apply. The actual Actions-token custody check and provider apply remain unrun.

[devantler]

🤖 Generated by the Agentic Engineer

cr:no-gate@1f69687df5b8e8a1cced1e20edd261461254a4de — all ancillary findings from the preceding review are addressed or specifically refuted in the linked resolution. A fresh read of that same-PR authenticated review receipt still reports zero included reviews remaining in its hourly allowance. The new head does not reset that ongoing limit. The native guard found no delivered current-head review; continue to Codex without a redundant request or paid review.

Fresh current-head CI passes, including Ubuntu's actual tmpfs/native-age lifecycle scenarios. The live Actions-token custody check and provider apply remain separate, unrun gates.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T10:31:11.806101Z	1f69687	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 1f69687df5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Current head 1f69687df5b8e8a1cced1e20edd261461254a4de has passing required/selected CI, no conflicts or unresolved threads, and a clean current-head Codex review. The preceding review's ancillary findings have specific fixes/refutations. Ubuntu CI 41428724969 exercised the native age/tmpfs lifecycle and refused partial/failed operations; the real frozen input was separately evaluated without provider writes.

The maintainer's repeated explicit full approval for completing this work covers protected merge and the first main-only custody check. That exact Actions-token surface is unreachable on the host, so its live result is a named post-merge gate, not a condition claimed already satisfied. The first dispatch will be mode=check, with no provider credential or resource change. Apply is mechanically blocked without that successful same-source native receipt and all frozen-plan/absence guards. The existing provider capability hold remains; no provider apply or DATA-secret upload is authorized by a successful custody receipt alone.