Companion to the atcli change (PR #1 over there): every writing command is now marked as writing in every document an agent might read, and the agent skill ships as a first-class artifact.
What #
- Every runnable command (22) declares
writes: 'network' | 'local' | falseon its spec:networkfor anything that changes DNS at a provider (set,add,remove,zone create/delete/import/copy),localfor this-machine-only writes (login,logout,shell,skill install),falsefor reads (query,list,zone list/export,providers,accounts,config,version). - New generated
skills/dns/reference.md(built bytools/reference.tsfrom the command tree — never hand-written): marker line under each writing command's summary, a "Which commands write" section up top, and an exhaustiveness check — the generator refuses to run while any runnable command lacks the declaration, so a future command cannot silently skip classification. A currency test keeps the generated file honest (npm run reference -- --check). skills/dns/SKILL.mdgains the Which commands write tables (record mutations flagged with the take-a-domain-offline warning woven into the existing rules).dns skillbecomesskill show/skill install(the atcli shape); baredns skillprints guide + generated reference,--brieffor the guide only.packages/dns/README.mdgains a What writes section.
Judgment calls (flagged for review) #
zone export=falsedespite-o file: the action reads a zone; the file is redirect-like. Said explicitly in the skill ("with-oit writes a local file, and nothing at any provider").zone copy/importarenetworkunconditionally — without--prunethey still set every RRset.shell=localwholesale (bare form only prints), mirroring atcli'scompletion.- Breaking spell:
dns skill --install→dns skill install; baredns skilloutput is now the full document. Both atcli-mirroring, both README-documented.
Tests #
npm run typecheck: pass.npm test: 250 pass, 0 fail, 12 skipped (all pre-existing BIND-absent skips; +1 is the new currency test).npm run reference -- --check: pass.