feat(wfctl): dns-policy + OnBeforeAction hook + relocate dns packages (Phase 3a)#787

Merged

intel352 merged 8 commits into

mainfrom

feat/wfctl-dns-policy-2026-05-26T1900

May 27, 2026

Commits on May 27, 2026

feat(iac): add OnBeforeAction FATAL hook to ApplyPlanHooks
intel352
committed
feat(dns): relocate dns/policy + dns/audit from workflow-plugin-infra/internal
intel352
committed
feat(dns/gate): relocate; adapt to ResourceDriver.Read for TXT scanning
intel352
committed
feat(wfctl): add dns-policy command (show/set/transfer-ownership/drift)
intel352
committed
feat(wfctl): wire dns-gate as OnBeforeAction for infra.dns during apply
intel352
committed
feat(wfctl): register dns-policy in wfctl.yaml command surface
intel352
committed
fix(dns/gate): add DriverReader.UpsertTXT so it satisfies policy.DNSPolicyReader
intel352
committed
fix(dns/audit): nilerr — propagate non-NotExist legacy-read errors
intel352
committed