Before a release candidate is tagged, two checks of current next (e8b4006), as a user would meet the program and as a reader of its code:
A trial run of the image built from next: real names watched (apex domains and hostnames, a domain and a hostname that do not exist, a name whose CNAME points into another zone, names whose nameservers rotate their answers, an expired certificate and certificates near expiry), Slack, Mattermost and ntfy pointed at a local listener, short intervals. Changes made by editing the state file between restarts (a record, a domain's nameservers, a nameserver's addresses, a port, a certificate, a failing nameserver), a network outage while the webhooks stay reachable, a stop in the middle of a check, a name added and one removed. Every notification, the log, the dashboard and /api/v1/status read against the README.
A read of the code paths for correctness against the README: resolver, watcher, state, notify, port and TLS checks, handlers and server.
Done when each real defect found is filed as its own issue with a definition of done on the 1.0 milestone, and one comment here lists them or says nothing was found. Nothing is fixed under this issue. No new features, no changes for taste. Live DNS only.
Model: opus-5-5
Before a release candidate is tagged, two checks of current `next` (`e8b4006`), as a user would meet the program and as a reader of its code:
1. A trial run of the image built from `next`: real names watched (apex domains and hostnames, a domain and a hostname that do not exist, a name whose CNAME points into another zone, names whose nameservers rotate their answers, an expired certificate and certificates near expiry), Slack, Mattermost and ntfy pointed at a local listener, short intervals. Changes made by editing the state file between restarts (a record, a domain's nameservers, a nameserver's addresses, a port, a certificate, a failing nameserver), a network outage while the webhooks stay reachable, a stop in the middle of a check, a name added and one removed. Every notification, the log, the dashboard and `/api/v1/status` read against the README.
2. A read of the code paths for correctness against the README: resolver, watcher, state, notify, port and TLS checks, handlers and server.
Done when each real defect found is filed as its own issue with a definition of done on the 1.0 milestone, and one comment here lists them or says nothing was found. Nothing is fixed under this issue. No new features, no changes for taste. Live DNS only.
Model: opus-5-5
clawbot
added this to the 1.0 milestone 2026-10-13 12:10:54 +02:00
clawbot
self-assigned this 2026-10-13 12:10:54 +02:00
Code read of next at e8b4006 (resolver, watcher, state, notify, port and TLS checks, handlers, server, middleware, config) done. Issues filed, each on milestone 1.0 with a definition of done:
#261 critical: the dashboard and /api/v1/status iterate the state's live maps without the lock, which can crash the process
#262 major: a nameserver removed from a domain's delegation is also reported as an NS Failure
#263 major: a non-numeric DNSWATCHER_TLS_EXPIRY_WARNING or PORT is silently read as 0
#264 major: the state file is renamed into place without being synced, so a crash can leave it empty and stop the next start
#265 minor: a certificate entry stays ok after its port 443 closes
#266 minor: dnswatcher keeps running without its HTTP server when the listen port is in use
#267 minor: a state file holding {} crashes the watcher on its first check
#268 minor: /metrics is served with an empty password when only DNSWATCHER_METRICS_USERNAME is set
Not checked: delivery to real Slack, Mattermost or ntfy endpoints (the notifier builds its requests by hand without a Content-Length, so they go out chunked; a local listener accepts that, a real endpoint behind a strict proxy might not), and behaviour on a host without IPv6.
Model: fable-5-1
Code read of `next` at `e8b4006` (resolver, watcher, state, notify, port and TLS checks, handlers, server, middleware, config) done. Issues filed, each on milestone 1.0 with a definition of done:
- https://git.eeqj.de/sneak/dnswatcher/issues/261 critical: the dashboard and `/api/v1/status` iterate the state's live maps without the lock, which can crash the process
- https://git.eeqj.de/sneak/dnswatcher/issues/262 major: a nameserver removed from a domain's delegation is also reported as an NS Failure
- https://git.eeqj.de/sneak/dnswatcher/issues/263 major: a non-numeric `DNSWATCHER_TLS_EXPIRY_WARNING` or `PORT` is silently read as 0
- https://git.eeqj.de/sneak/dnswatcher/issues/264 major: the state file is renamed into place without being synced, so a crash can leave it empty and stop the next start
- https://git.eeqj.de/sneak/dnswatcher/issues/265 minor: a certificate entry stays `ok` after its port 443 closes
- https://git.eeqj.de/sneak/dnswatcher/issues/266 minor: dnswatcher keeps running without its HTTP server when the listen port is in use
- https://git.eeqj.de/sneak/dnswatcher/issues/267 minor: a state file holding `{}` crashes the watcher on its first check
- https://git.eeqj.de/sneak/dnswatcher/issues/268 minor: `/metrics` is served with an empty password when only `DNSWATCHER_METRICS_USERNAME` is set
Not checked: delivery to real Slack, Mattermost or ntfy endpoints (the notifier builds its requests by hand without a `Content-Length`, so they go out chunked; a local listener accepts that, a real endpoint behind a strict proxy might not), and behaviour on a host without IPv6.
Model: fable-5-1
Trial run of the image built from next at e8b4006, about 35 minutes: 18 live targets (apex domains and hostnames, a domain and a hostname that do not exist, pool.ntp.org, names whose nameservers rotate their answers, a CNAME into another zone, an expired certificate), Slack, Mattermost and ntfy pointed at a local listener, 2-minute DNS and 3-minute TLS intervals. Restarted on a hand-edited state file with two names removed and one added; network cut and restored while the webhooks stayed reachable; stopped mid-scan; bad settings tried one by one.
Defects found:
#269 (major): a setting that is not a valid number or true/false is read as 0 or false; a typo in DNSWATCHER_TLS_EXPIRY_WARNING turns expiry warnings off.
#270 (minor): an IPv6 address joined with its port cannot be told from the port.
#271 (minor): the startup notification claims a completed scan that shutdown cut short.
Model: opus-5-5
Trial run of the image built from `next` at `e8b4006`, about 35 minutes: 18 live targets (apex domains and hostnames, a domain and a hostname that do not exist, `pool.ntp.org`, names whose nameservers rotate their answers, a CNAME into another zone, an expired certificate), Slack, Mattermost and ntfy pointed at a local listener, 2-minute DNS and 3-minute TLS intervals. Restarted on a hand-edited state file with two names removed and one added; network cut and restored while the webhooks stayed reachable; stopped mid-scan; bad settings tried one by one.
Defects found:
- https://git.eeqj.de/sneak/dnswatcher/issues/269 (major): a setting that is not a valid number or true/false is read as 0 or false; a typo in `DNSWATCHER_TLS_EXPIRY_WARNING` turns expiry warnings off.
- https://git.eeqj.de/sneak/dnswatcher/issues/270 (minor): an IPv6 address joined with its port cannot be told from the port.
- https://git.eeqj.de/sneak/dnswatcher/issues/271 (minor): the startup notification claims a completed scan that shutdown cut short.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Before a release candidate is tagged, two checks of current
next(e8b4006), as a user would meet the program and as a reader of its code:next: real names watched (apex domains and hostnames, a domain and a hostname that do not exist, a name whose CNAME points into another zone, names whose nameservers rotate their answers, an expired certificate and certificates near expiry), Slack, Mattermost and ntfy pointed at a local listener, short intervals. Changes made by editing the state file between restarts (a record, a domain's nameservers, a nameserver's addresses, a port, a certificate, a failing nameserver), a network outage while the webhooks stay reachable, a stop in the middle of a check, a name added and one removed. Every notification, the log, the dashboard and/api/v1/statusread against the README.Done when each real defect found is filed as its own issue with a definition of done on the 1.0 milestone, and one comment here lists them or says nothing was found. Nothing is fixed under this issue. No new features, no changes for taste. Live DNS only.
Model: opus-5-5
Code read of
nextate8b4006(resolver, watcher, state, notify, port and TLS checks, handlers, server, middleware, config) done. Issues filed, each on milestone 1.0 with a definition of done:/api/v1/statusiterate the state's live maps without the lock, which can crash the processDNSWATCHER_TLS_EXPIRY_WARNINGorPORTis silently read as 0okafter its port 443 closes{}crashes the watcher on its first check/metricsis served with an empty password when onlyDNSWATCHER_METRICS_USERNAMEis setNot checked: delivery to real Slack, Mattermost or ntfy endpoints (the notifier builds its requests by hand without a
Content-Length, so they go out chunked; a local listener accepts that, a real endpoint behind a strict proxy might not), and behaviour on a host without IPv6.Model: fable-5-1
Trial run of the image built from
nextate8b4006, about 35 minutes: 18 live targets (apex domains and hostnames, a domain and a hostname that do not exist,pool.ntp.org, names whose nameservers rotate their answers, a CNAME into another zone, an expired certificate), Slack, Mattermost and ntfy pointed at a local listener, 2-minute DNS and 3-minute TLS intervals. Restarted on a hand-edited state file with two names removed and one added; network cut and restored while the webhooks stayed reachable; stopped mid-scan; bad settings tried one by one.Defects found:
DNSWATCHER_TLS_EXPIRY_WARNINGturns expiry warnings off.Model: opus-5-5