Juan DenisandClaude Opus 4.8 b9ee243ba2 feat(cloudflare): restore Round 2 engine — DNSSEC, Origin CA, rules, activity (plan 42 ph2) ...

Restore the plan-36 Cloudflare Round 2 backend lost in the rebuild (migrations
073/074 survived; the engine + test_cloudflare_round2.py did not):

- CfOpsChange model (verbatim from clean pyc dump, matches mig 074) +
  CfOpsChangeService.record (never-raises) / list.
- Core client (dns/cloudflare.py): get/set_dnssec; create/list/revoke Origin
  certificates; X-Auth-User-Service-Key header mode (origin_ca_key, mig 073).
- Extension service: DNSSEC get/set; Origin CA issue (panel-side CSR, key never
  leaves the box, proxied-hostname warning, scoped-cred 400 not 502) /list/revoke
  + Linux-guarded install via upload_custom_cert; Redirect+Transform rules
  (RULE_PHASES/ACTIONS/PRESETS reusing _find_custom_ruleset + injection guard);
  best-effort _record wired into every mutating method; scope_check probe;
  list_activity.
- Extension routes: /zones/<id>/dnssec, origin-ca, /rules/<slug>, /activity,
  /scope-check (admin-gated, CloudflareError->400, provider->502).
- ssl_service.list_certificates walks /etc/ssl/serverkit + "Origin CA
  (proxy-only)" badge; fixed certbot-branch early-return hiding custom certs.

Also registers EmailBounceState (plan 42 ph3) in models/__init__ (shared file).
Deviation: origin_ca_key implemented as the Fernet Origin CA *service key* (plan
Decision 3), not mig-073's docstring "generated private key" — the generated key
is used inline for install and never persisted. R2 preset backend-untouched (it
lives in the storage-provider + frontend layers). Verified: 83 passed
(round2 30 + zone_settings 42 + extraction 8 + ssl 3), no regression.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-09 05:02:54 -04:00

..

__init__.py

feat(cloudflare): restore Round 2 engine — DNSSEC, Origin CA, rules, activity (plan 42 ph2)

2026-07-09 05:02:54 -04:00

agent_plugin.py

Add agent plugin system with full lifecycle management

2026-03-23 02:08:00 -04:00

ai.py

feat(ai): add core AI assistant primitive powered by Prompture

2026-06-01 02:39:05 -04:00

api_key.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

api_usage.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

app_volume.py

fix(recovery): restore models + migration chain 056-074, cron_run_service, rbac authz

2026-07-08 00:17:55 -04:00

application_manifest.py

feat(manifest): persist manifest + seed env + health-check gate (Phase 1)

2026-07-04 01:16:29 -04:00

application_preview.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

application.py

fix(recovery): restore models + migration chain 056-074, cron_run_service, rbac authz

2026-07-08 00:17:55 -04:00

audit_log.py

Add audit fallback, builtin extensions, and ports

2026-05-03 15:57:02 -04:00

backup_policy.py

feat(backup): trust round 2 — restore drills, offsite/verify (plan 30)

2026-07-07 20:29:25 -04:00

backup_run.py

feat(backup): trust round 2 — restore drills, offsite/verify (plan 30)

2026-07-07 20:29:25 -04:00

cf_ops_change.py

feat(cloudflare): restore Round 2 engine — DNSSEC, Origin CA, rules, activity (plan 42 ph2)

2026-07-09 05:02:54 -04:00

chat_webhook.py

feat(notifications): polish — digests, prefs, deep-links (plans 24/33)

2026-07-07 20:29:29 -04:00

cloud_server.py

Backend fixes, API renames, and style utilities

2026-03-23 21:25:40 -04:00

cloudflare_tunnel.py

feat(cloudflare): Cloudflare Tunnels (Phase 5)

2026-06-22 20:34:32 -04:00

cloudflare_worker.py

feat(cloudflare): Workers edge hosting (Phase 4)

2026-06-22 20:27:36 -04:00

container_registry.py

feat(connections): authenticate private container registry pulls

2026-07-01 01:35:44 -04:00

container_scale_policy.py

feat(docker): horizontal auto-scaling (CPU thresholds, min/max, cooldown)

2026-06-19 10:13:50 -04:00

container_sleep_policy.py

feat(docker): container auto-sleep (policy, manual sleep/wake, idle sweep)

2026-06-19 09:54:40 -04:00

cron_run.py

feat(cron): completion — run history, project scope, cwd/run-as (plan 34)

2026-07-07 20:29:29 -04:00

ddns_host.py

feat(dns): dynamic DNS — token-authenticated A/AAAA updates

2026-06-19 03:12:07 -04:00

deployment_job.py

refactor(unify): §3 — canonical DeploymentJob links + unified /deployments surface

2026-06-24 14:52:04 -04:00

deployment_snapshot.py

feat: Phase 2 developer experience — build packs, config snapshots, catalog certification

2026-06-23 18:49:04 -04:00

deployment.py

Refactor to consistently use app.root_path and update deployment model

2026-01-18 04:20:30 -05:00

dns_change.py

feat(dns): change log + admin notice on failure (Phase 2 backend)

2026-06-22 16:34:17 -04:00

dns_cutover_snapshot.py

fix(recovery): restore models + migration chain 056-074, cron_run_service, rbac authz

2026-07-08 00:17:55 -04:00

dns_zone.py

feat(dns): unify Cloudflare credentials behind one connection + shared client

2026-06-22 16:12:31 -04:00

domain_registration.py

feat(domains): unify domains & DNS into one surface + admin-only Connections

2026-06-23 00:34:55 -04:00

domain.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

email_bounce.py

feat(notifications): restore email-bounce webhook slice (plan 42 ph3)

2026-07-09 04:55:53 -04:00

email_provider.py

refactor(unify): §6 Phase C6a — email provider usage flags

2026-06-24 14:32:41 -04:00

email.py

fix(recovery): restore models + migration chain 056-074, cron_run_service, rbac authz

2026-07-08 00:17:55 -04:00

env_variable.py

feat(manifest): fromSecret/fromService/generate reference binders (Phase 3)

2026-07-04 01:34:54 -04:00

environment_activity.py

Add WordPress environment pipeline API and models

2026-01-27 19:35:21 -05:00

environment.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

event_subscription.py

feat(telemetry): unified system event stream with correlation

2026-06-21 20:19:57 -04:00

exposed_service.py

feat(remote-access): NAT-traversing WireGuard tunnels to expose private services

2026-06-15 23:20:00 -04:00

fleet_doctor_result.py

fix(recovery): restore models + migration chain 056-074, cron_run_service, rbac authz

2026-07-08 00:17:55 -04:00

image_scan.py

feat(security): per-image CVE scanning (grype) and SBOM generation (syft)

2026-06-19 01:33:45 -04:00

image_update.py

feat(docker): image-digest update detection

2026-06-19 09:22:18 -04:00

invitation.py

Fleet monitor + security and agent hardening

2026-03-23 01:58:28 -04:00

login_link.py

feat(auth): one-time login links and demo mode

2026-07-03 14:23:50 -04:00

managed_database_user.py

feat(databases): managed DB users and one-click Adminer SSO

2026-07-03 14:24:15 -04:00

managed_database.py

feat(databases): track managed databases as first-class resources

2026-07-01 09:44:48 -04:00

managed_dns_record.py

feat(dns): ownership ledger + never-touch-foreign guard + zone mirror (Phase 1)

2026-06-22 16:24:53 -04:00

metric_alert.py

Fleet monitor + security and agent hardening

2026-03-23 01:58:28 -04:00

metrics_history.py

Add WordPress environment pipeline API and models

2026-01-27 19:35:21 -05:00

notification_preferences.py

fix(recovery): rebuild authz-R2 policy + notification digests/chat webhooks

2026-07-08 01:41:43 -04:00

oauth_identity.py

Add SSO/OAuth and DB migration framework

2026-03-04 01:37:22 -05:00

passkey.py

feat(auth): WebAuthn / Passkey support

2026-06-19 01:33:45 -04:00

pending_agent.py

Add short-code agent pairing flow

2026-04-29 03:08:21 -04:00

plugin.py

feat(extensions): per-plugin config store + Configure form (#49)

2026-07-02 02:09:39 -04:00

project.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

promotion_job.py

Add WordPress environment pipeline API and models

2026-01-27 19:35:21 -05:00

proxy_stack.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

registrar_connection.py

Encrypt provider secrets at rest + add Namecheap registrar (#16, #17)

2026-06-15 10:33:09 -04:00

restore_drill.py

feat(backup): trust round 2 — restore drills, offsite/verify (plan 30)

2026-07-07 20:29:25 -04:00

sanitization_profile.py

Add WordPress environment pipeline API and models

2026-01-27 19:35:21 -05:00

secret_vault.py

feat(secrets): scope vaults & webhooks to the active workspace

2026-06-20 12:47:37 -04:00

security_alert.py

Implement security features: key rotation, IP allowlist, anomaly detection

2026-01-22 18:11:22 -05:00

server_onboarding_log.py

feat: Phase 1 foundation — status aggregator, API scopes, onboarding, template magic vars

2026-06-23 18:23:47 -04:00

server_survey.py

feat(agent): V2 capability pack — survey/doctor/fleet sweep+repair (plan 28)

2026-07-07 20:29:24 -04:00

server_template.py

Add server templates with config drift detection and compliance

2026-03-23 02:11:16 -04:00

server.py

fix(recovery): restore agent scopes, DNS preflight, catalog events, thread guards

2026-07-08 02:06:01 -04:00

shared_resource.py

feat: per-service targeting for the compose env overlay

2026-06-23 23:19:41 -04:00

site_bandwidth.py

feat(hosting): per-domain bandwidth accounting

2026-07-03 15:21:48 -04:00

site_base_domain.py

feat(sites): base-domain registry so sites can publish under multiple domains

2026-07-01 00:07:00 -04:00

site_import.py

fix(recovery): rebuild DNS cutover service+API and SSH site importer

2026-07-08 01:41:22 -04:00

source_connection.py

Add registrars, GitLab, DO/Godaddy DNS and SMTP relay

2026-06-15 09:19:56 -04:00

status_page.py

feat(wordpress): per-site uptime + auto-incidents (#26)

2026-06-01 00:47:26 -04:00

system_event.py

feat(telemetry): unified system event stream with correlation

2026-06-21 20:19:57 -04:00

system_settings.py

Add admin panel with user, settings, and audit log management

2026-01-18 05:01:49 -05:00

tunnel.py

feat(remote-access): NAT-traversing WireGuard tunnels to expose private services

2026-06-15 23:20:00 -04:00

user.py

restore: remaining reconstructed July 5-7 changes (clean recovered files not attributable to one plan)

2026-07-07 20:29:31 -04:00

waf_policy.py

feat(security): per-app WAF (ModSecurity v3 + OWASP CRS)

2026-06-19 14:02:24 -04:00

webhook_gateway.py

feat(secrets): scope vaults & webhooks to the active workspace

2026-06-20 12:47:37 -04:00

webhook.py

Add git webhook and deployment management APIs

2026-01-21 21:31:57 -05:00

wordpress_custom_plugin.py

feat(wordpress): global plugin library for operator-owned plugins

2026-07-01 01:08:42 -04:00

wordpress_site.py

feat(wordpress): monthly client reports — persisted per-month rollups (#33)

2026-06-01 03:04:03 -04:00

workflow.py

Add workflow engine, models, API & UI

2026-03-23 01:10:28 -04:00

workspace.py

feat(workspaces): per-resource access grants — per-site ACL backend (#33)

2026-06-01 11:59:34 -04:00