Repository navigation
T32 — DNS steering fails closed, end to end #2289
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| DNS steering fails closed | M | needs care | standard | an agent | 200 (80 code, 120 tests) |
A steered name answers SERVFAIL while the proxy is down, AAAA, HTTPS and SVCB answer NODATA, and UDP 443 from a blocked box is rejected at once.
Covers:
- none
Layers:
- e2e:
- scripts/session-e2e.sh: one case: stop the proxy, resolve a steered name, query its HTTPS record, send QUIC to 443
./scripts/session-e2e.sh bep_dns_steering_fails_closed_end_to_end
Waits on:
- T30 — Steer credentialed names to the proxy and fail closed while it is down #2281
- T31 — Reject UDP to port 443 where a box's QUIC stance is blocked #2282
Plan block
### T32 — DNS steering fails closed, end to end
slice: S4
kind: integration
covers: none
size: M
est: 80 code, 120 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: the bundle's daemon log tail carries the SERVFAIL answers and the rejected datagrams of the run
observability: the warn and debug lines both tasks emit, in one run
layers:
- e2e:
- scripts/session-e2e.sh: one case: stop the proxy, resolve a steered name, query its HTTPS record, send QUIC to 443
test: ./scripts/session-e2e.sh bep_dns_steering_fails_closed_end_to_end
produces: none
consumes: none
proof: A steered name answers SERVFAIL while the proxy is down, AAAA, HTTPS and SVCB answer NODATA, and UDP 443 from a blocked box is rejected at once.
depends on:
- blocked by #2281
- blocked by #2282
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 25, 2026
Done. #2550 merged.
branch
agent/2289-dns-steering-fails-closed-end-to-end· epic #1501 · PR #25507cd002acUpdated 2026-10-25T16:11:19.395Z.