[nick-potts]

Summary

Managed hostnames move out of the daemon and become a Cloud feature, served by the Ployz-run Hosted DNS service (getployz/hosted-dns#1). Each Organization gets one Cluster Domain and one wildcard certificate that covers every generated hostname.

founder enrolls ──▶ Cloud reserves the Cluster Domain (Organization slug as the label)
hourly + events ──▶ sync-cluster-domain, one run at a time per Organization with a Cluster Domain (paired or not)
                      reserve       only if the row is missing; a reaped (404) or retired (410) name is replaced
                      probe         GET http://<ip>/.ployz-verify on each ingress Machine
                      records       full apex A/AAAA PUT, only when a frame exists and at least one probe succeeded
                      lease         7-day lease, renewed even with no Cluster
                      certificate   new key + CSR for name and *.name when missing or under 30 days → Hosted DNS → GTS
                      publish       PublishCertificateMaterial(*.name) ──▶ daemon
deploy          ──▶ Cloud expands prefix → prefix.<name>; the daemon only sees explicit hostnames
Organization teardown ──▶ release the name (tried once, failure ignored)

Core loses all Hosted DNS and gains one frozen RPC:

 rpc catalog
-  ReserveDomain / GetDomain / ReleaseDomain / CreateDomainRecords
+  PublishCertificateMaterial { hostname | *.wildcard, set { chain, key } | clear }
 runtime watch frame
-  hosted_dns_hostname
 IngressHostname
-  enum { Explicit, ClusterDomain { label } }
+  IngressHost (plain)
 CLI
-  ployz dns …, --no-dns, --dns-endpoint

managedHostnames stays in the authored environment document, but core lowering refuses it. Cloud expands it to explicit hostnames before lowering (spec amended). The daemon never lets ACME touch published Certificate Material. A published *.x covers matching hostnames, so ACME orders nothing for them. Custom domains keep Let's Encrypt HTTP-01 exactly as before.

dashboard/src/modules/cluster-domain/
├── hosted-dns.server.ts      # the only Hosted DNS client (mint key, per-call timeout)
├── cluster-domain.server.ts  # reserve, release, Publish now
├── sync.server.ts            # probe, records, lease, certificate, publish
├── sync.inngest.ts           # sync-cluster-domain + hourly fan-out
└── wildcard-csr.server.ts    # CSR for name + *.name with no CN (Node has no CSR builder)

Evidence

• Before: generated domains were reserved by the daemon, held in cluster state, and exposed through four DNS RPCs. Every generated hostname ordered its own Let's Encrypt certificate under one shared apex.
  After: the daemon holds no generated-domain state. rg -i 'hosted_dns|hostedDns|ReserveDomain|no-dns|dns-endpoint' core/ returns nothing.

Final run, at eaeb4ca4, after the four-axis review:

core       cargo test -p ployz-core -p ployzd -p ployz-sdk -p ployz   1442 passed
           cargo fmt --check · cargo clippy --workspace --all-targets  clean
dashboard  tsc --noEmit · oxlint --type-aware .                        clean
           vitest cluster-domain + deployments + environment-design + inngest + collections (incl. postgres)   338 passed
layer 3    certificates suite (testkit image built from this branch, at 1322fc8d)
             published_material_is_served_never_renewed_and_clear_returns_it_to_acme   ✔
             published_wildcard_covers_hostnames_so_acme_orders_nothing                ✔
             custom_https_hostname_obtains_a_certificate_from_a_fake_ca                ✘ fails the same way on main (sed on a bind-mounted /etc/hosts)

Four-axis review: Standards, Spec, Maintainability and Simplicity all pass after 3 rounds.

New tests that pin the behaviour:

sync-cluster-domain (InngestTestEngine + Postgres + fake Hosted DNS)
  full sync writes reachable IPv4/IPv6, leaves out unreachable Servers
  no frame / nothing reachable → no records PUT, lease still renewed
  reaped (404) or retired (410) name → fresh reservation, old *.name cleared on the Cluster
  Organization with no Cluster → lease still renewed
  certificate missing or < 30 days → key + CSR → chain stored, *.name published
  Hosted DNS failure → current certificate kept, retried next sync
deploy
  managed hostname → explicit prefix.<name> route with a stable id
  no row + reserve fails → refused with cluster_domain_unreserved

Merge Danger

Door: one-way

PublishCertificateMaterial becomes a frozen RPC under the Stable promise once 0.2.0 ships. Deleting the four DNS RPCs and the hosted_dns row is fine only because nothing has been released yet. The rest is two-way: one additive table and Cloud-side code.

Blast Radius: ingress

• Every deploy with a managed hostname now depends on the Organization's Cluster Domain row. With no row and Hosted DNS down, the deploy is refused by name instead of shipping a bare prefix.
• HTTPS for generated hostnames now comes from the published wildcard, not per-hostname ACME. If publishing breaks, those hostnames lose valid certificates. Custom domains are unaffected.
• The Runtime Watch frame changed shape: hosted_dns_hostname is gone, and the certificate keys are now CertificateHost. The SDK payloads are regenerated.
• Hosted DNS is live at https://dns.ployz.app (Deploy Hosted DNS to production and set Cloud's default endpoint #1018, smoke run passed). The mint key is already set on Ployz Dashboard web and worker, so hosted Cloud mints without hitting the per-IP limit.

Closes #1015
Closes #1018
Closes #1019
Closes #1020
Closes #1021
Closes #1022
Closes #1023
Closes #1024

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.