3 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
clawbotanduser	ee14bd01ae	fix: enforce DNS-first ordering for port and TLS checks (#64) ... ## Summary DNS checks now always complete before port or TLS checks begin, ensuring those checks use freshly resolved IP addresses instead of potentially stale ones from a previous cycle. ## Problem Port and TLS checks read IP addresses from state that was populated during the most recent DNS check. If DNS changes between cycles, port/TLS checks may target stale IPs. In particular, when the TLS ticker fired (every 12h), it ran `runTLSChecks` without refreshing DNS first — meaning TLS checks could use IPs that were up to 12 hours old. ## Changes - **Extract `runDNSChecks()`** from the former `runDNSAndPortChecks()` so DNS resolution can be invoked independently as a prerequisite for any check type. - **TLS ticker now runs DNS first**: When the TLS ticker fires, DNS checks run before TLS checks, ensuring fresh IPs. - **`RunOnce` uses explicit 3-phase ordering**: DNS → ports → TLS. Port checks must complete before TLS because TLS checks only target IPs where port 443 is open. - **New test `TestDNSRunsBeforePortAndTLSChecks`**: Verifies that when DNS IPs change between cycles, port and TLS checks pick up the new IPs. - **README updated**: Monitoring lifecycle section now documents the DNS-first ordering guarantee. ## Check ordering | Trigger | Phase 1 | Phase 2 | Phase 3 | |---------|---------|---------|----------| | Startup (`RunOnce`) | DNS | Ports | TLS | | DNS ticker | DNS | Ports | — | | TLS ticker | DNS | — | TLS | closes #58 Co-authored-by: user <user@Mac.lan guest wan> Reviewed-on: #64 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-02 00:10:49 +01:00
3 people	2835c2dc43	REPO_POLICIES compliance audit (#40) ... Brings the repository into compliance with REPO_POLICIES standards. Closes [issue #39](#39). ## Changes ### Added files - **REPO_POLICIES.md** — fetched from `sneak/prompts` (last_modified: 2026-02-22) - **.editorconfig** — fetched from `sneak/prompts`, enforces 4-space indents (tabs for Makefile) - **.dockerignore** — standard Go exclusions (.git/, bin/, *.md, LICENSE, .editorconfig, .gitignore) ### Makefile updates - Added `fmt-check` target (read-only gofmt check) - Added `hooks` target (installs pre-commit hook running `make check`) - Added `docker` target (runs `docker build .`) - Added `-timeout 30s` to both `test` and `check` targets - Updated `.PHONY` list with all new targets ### Removed files - **CLAUDE.md** — superseded by REPO_POLICIES.md - **CONVENTIONS.md** — superseded by REPO_POLICIES.md ### README updates - First line now includes project name, purpose, category (daemon), and author per REPO_POLICIES format - Updated CONVENTIONS.md reference to REPO_POLICIES.md - Added **License** section (pending author choice) - Added **Author** section: [@sneak](https://sneak.berlin) ### Intentionally skipped - **LICENSE file** — not created; license choice (MIT, GPL, or WTFPL) requires sneak's input ## Verification - `docker build .` passes (all checks green: fmt, lint, tests, build) - No changes to `.golangci.yml`, test assertions, or linter config Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: #40 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-01 21:11:49 +01:00
clawbotandclawbot	299a36660f	fix: 700ms query timeout, proper iterative resolution (closes #24) (#28) ... Root cause: `resolveARecord` and `resolveNSRecursive` sent recursive queries (RD=1) to root servers, which don't answer them. This caused 5s timeouts × 2 retries × 3 servers = hanging tests. Fix: - Changed `queryTimeoutDuration` from 5s to 700ms - Rewrote `resolveARecord` to do proper iterative resolution through the delegation chain (query roots → follow NS delegations → get A record) - Renamed `resolveNSRecursive` → `resolveNSIterative` with same iterative approach - No mocking, no test skipping, no config changes `make check` passes: all 29 resolver tests pass with real DNS in ~10s. Co-authored-by: clawbot <clawbot@git.eeqj.de> Reviewed-on: #28 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-01 21:10:38 +01:00