CodePatrol INIT 1

INIT-1: Consume Barback DNS service discovery

Implement the Bartender responsibilities in Barback's dns-service-discovery specification: validate BARBACK_CLIENT_CONFIG_PATH, join the Barback-owned NAT network, inject DNS and host-gateway plumbing into Apple Container sessions, use only the Barback OpenAI-compatible API and remote MCP endpoint, reject persisted direct HTTP MCP endpoints while preserving local stdio MCPs, stamp and enforce DNS generation during create/adoption, and automatically replace stale sessions. Gate this integration on a pinned OneCLI private-DNS-route capability that provides custom DNS, HTTP proxying, vault-backed Barback authentication, and fail-closed admission.

Status: active

Waves

• WAVE-1.1: Validate and consume the Barback client-config document (accepted)
  • WORK-1.1.1: Load and validate BARBACK_CLIENT_CONFIG_PATH (accepted)
  • WORK-1.1.2: Bounded DNS and Barback reachability probe (accepted)
• WAVE-1.2: Join the Barback NAT network and inject DNS into sessions (accepted)
  • WORK-1.2.1: Inspect and join the Barback-owned NAT network (accepted)
  • WORK-1.2.2: Inject resolver and search domain into session containers (accepted)
• WAVE-1.3: Route model and MCP traffic exclusively through Barback (accepted)
  • WORK-1.3.1: Configure the selected provider with Barback apiBaseUrl (accepted)
  • WORK-1.3.2: Synthesize Barback mcpUrl and suppress direct remote MCPs (accepted)
• WAVE-1.4: Stamp and enforce DNS generation across session lifecycle (planning)
  • WORK-1.4.1: Stamp dnsGeneration on every session container (pending)
  • WORK-1.4.2: Automatically recycle stale sessions on generation change (pending)
• WAVE-1.5: Gate admission on the OneCLI private-DNS-route capability (planning)
  • WORK-1.5.1: Detect and pin the OneCLI private-DNS-route capability (pending)
  • WORK-1.5.2: Fail closed when the capability is absent or mismatched (pending)