Repository navigation
Add cloudfall domains observe and the domains MCP tools (S-004-4, 14, 15, 16) #118
Description
Builds part of spec S-004, docs/specs/004-domains-apply.md (feature issue #87): the acceptance criteria below. Each needs a test that names its id (test_s004_<k>_..., or a proves: S-004-4 comment line).
This is the cloudfall domains observe command, the unknown-Domain refusal for both commands, and their MCP tools.
- S-004-4:
domains apply nopeanddomains observe nopein a valid project with no DomainnopeexitPRECONDITIONwith context codelifecycle_domain_missing, and neither the inventory render noransible-playbookruns - S-004-14:
domains observe <d>reportsvhost.present,vhost.sha256,certificate.notAfter,certbotTimer.enabledandcertbotTimer.activeas read on the proxy server, exits 0 when the vhost file is missing, and changes no file on the server or in the project - S-004-15:
domains observe <d>reportsreceipt.matches: falseonce the vhost file was edited after the last receipt,truewhile it is unchanged, andreceipt: nullwhen no receipt exists - S-004-16:
cloudfall mcp serveon a project lists a tool fordomains applyand one fordomains observe
Depends on #117
Activity
migrate, which converges every server #87shipmill-romamo commentedon Oct 27, 2026
Triage: implement, for the next release candidate.
The plan: build the criteria listed in the body, as
docs/specs/004-domains-apply.md(S-004, approved in #100) says, each with a test that names its id. A departure from a criterion goes back as a question, never a quiet change. Build issues start in order: this one starts once every issue on itsDepends onlines has closed. I'll link the PR here.shipmill-romamo commentedon Oct 27, 2026
PR #142 adds
cloudfall domains observe <d>(a read-only playbook on the proxy server: vhost presence and sha256, certificate expiry,certbot.timerstate, and whether the vhost still matches the last receipt), thelifecycle_domain_missingrefusal for both domain commands, and thedomains_apply/domains_observeMCP tools (domains_applykeeps theyesgate). It marks spec 004built.Trade-off: nothing ran over SSH on a live Debian host (real
opensslon a Let's Encrypt certificate, realsystemctlstates); tests use stand-in tools.shipmill-romamo commentedon Oct 27, 2026
Released in v0.8.0rc7 (pre-release). uv tool install --prerelease allow cloudfall==0.8.0rc7
A plain install gets it with the next stable release.
If you filed this: react 👍 on this comment once it works for you, or reply if it doesn't.