markdown improvement

.beads/.gitignore

@@ -1,30 +1,45 @@
-# SQLite databases
+# Dolt database (managed by Dolt, not git)
-*.db
+dolt/
-*.db?*
+dolt-access.lock
-*.db-journal
-*.db-wal
-*.db-shm
 
-# Daemon runtime files
+# Runtime files
-daemon.lock
-daemon.log
-daemon.pid
 bd.sock
+bd.sock.startlock
 sync-state.json
 last-touched
 
 # Local version tracking (prevents upgrade notification spam after git ops)
 .local_version
 
-# Legacy database files
-db.sqlite
-bd.db
-
 # Worktree redirect file (contains relative path to main repo's .beads/)
 # Must not be committed as paths would be wrong in other clones
 redirect
 
-# Merge artifacts (temporary files from 3-way merge)
+# Sync state (local-only, per-machine)
+# These files are machine-specific and should not be shared across clones
+.sync.lock
+.jsonl.lock
+sync_base.jsonl
+export-state/
+
+# Ephemeral store (SQLite - wisps/molecules, intentionally not versioned)
+ephemeral.sqlite3
+ephemeral.sqlite3-journal
+ephemeral.sqlite3-wal
+ephemeral.sqlite3-shm
+
+# Legacy files (from pre-Dolt versions)
+*.db
+*.db?*
+*.db-journal
+*.db-wal
+*.db-shm
+db.sqlite
+bd.db
+daemon.lock
+daemon.log
+daemon-*.log.gz
+daemon.pid
 beads.base.jsonl
 beads.base.meta.json
 beads.left.jsonl
@@ -32,11 +47,6 @@ beads.left.meta.json
 beads.right.jsonl
 beads.right.meta.json
 
-# Sync state (local-only, per-machine)
-# These files are machine-specific and should not be shared across clones
-.sync.lock
-sync_base.jsonl
-
 # NOTE: Do NOT add negation patterns (e.g., !issues.jsonl) here.
 # They would override fork protection in .git/info/exclude, allowing
 # contributors to accidentally commit upstream issue databases.

.beads/metadata.json

@@ -1,4 +1,7 @@
 {
   "database": "dolt",
-  "jsonl_export": "issues.jsonl"
+  "jsonl_export": "issues.jsonl",
-}
+  "backend": "dolt",
+  "dolt_mode": "server",
+  "dolt_database": "beads_netbird-gitops"
+}

.gitattributes

@@ -1,3 +0,0 @@
-
-# Use bd merge for beads JSONL files
-.beads/issues.jsonl merge=beads

.gitea/workflows/dry-run.yml

@@ -73,67 +73,31 @@ jobs:
                   print(f"[{env}] Reconciler call failed: {e}")
                   continue
 
-              # Format as markdown table
+              # Format as markdown grouped by action
               ops = data.get("operations", [])
               summary = data.get("summary", {})
               lines = [f"## Reconciliation Plan: `{env}`\n"]
               if not ops:
                   lines.append("No changes detected.\n")
               else:
-                  def fmt_val(v):
+                  groups = {"Create": [], "Update": [], "Delete": []}
-                      if isinstance(v, bool):
-                          return str(v).lower()
-                      if isinstance(v, list):
-                          return ", ".join(str(x) for x in v) if v else "(empty)"
-                      if v is None:
-                          return "(none)"
-                      return str(v)
-
-                  def get_action(op):
-                      """Derive a human-readable action from the operation."""
-                      t = op["type"]
-                      changes = op.get("changes", [])
-                      # For updates, check if it's just an enable/disable toggle
-                      if not t.startswith("create") and not t.startswith("delete"):
-                          if len(changes) == 1 and changes[0]["field"] == "enabled":
-                              return "disable" if changes[0]["to"] is False else "enable"
-                          return "update"
-                      return t.split("_", 1)[0]
-
-                  def fmt_details(op, action):
-                      """Format details based on action type."""
-                      if action == "delete":
-                          return ""
-                      if action in ("enable", "disable"):
-                          return ""
-                      changes = op.get("changes", [])
-                      if changes:
-                          parts = []
-                          for c in changes:
-                              parts.append(f"`{c['field']}`: {fmt_val(c['from'])} → {fmt_val(c['to'])}")
-                          return "; ".join(parts)
-                      d = op.get("details", {})
-                      if not d:
-                          return ""
-                      parts = []
-                      if "sources" in d and "destinations" in d:
-                          parts.append(f"{fmt_val(d['sources'])} → {fmt_val(d['destinations'])}")
-                      if "auto_groups" in d:
-                          parts.append(f"groups: {fmt_val(d['auto_groups'])}")
-                      if "type" in d and "address" in d:
-                          parts.append(f"{d['type']}:{d['address']}")
-                      if "peers" in d:
-                          parts.append(f"peers: {fmt_val(d['peers'])}")
-                      return "; ".join(parts) if parts else ""
-
-                  lines.append("| Action | Resource | Name | Details |")
-                  lines.append("|--------|----------|------|---------|")
                   for op in ops:
-                      resource = op["type"].split("_", 1)[1] if "_" in op["type"] else op["type"]
+                      t = op["type"]
-                      action = get_action(op)
+                      if t.startswith("create"): groups["Create"].append(op)
-                      detail = fmt_details(op, action)
+                      elif t.startswith("delete"): groups["Delete"].append(op)
-                      lines.append(f"| {action} | {resource} | {op['name']} | {detail} |")
+                      else: groups["Update"].append(op)
-                  lines.append("")
+
+                  for action, items in groups.items():
+                      if not items:
+                          continue
+                      emoji = {"Create": "+", "Update": "~", "Delete": "-"}[action]
+                      lines.append(f"### {action} ({len(items)})\n")
+                      lines.append("| Resource | Name |")
+                      lines.append("|----------|------|")
+                      for op in items:
+                          resource = op["type"].split("_", 1)[1] if "_" in op["type"] else op["type"]
+                          lines.append(f"| {resource} | {op['name']} |")
+                      lines.append("")
 
                   c, u, d = summary.get("created", 0), summary.get("updated", 0), summary.get("deleted", 0)
                   lines.append(f"**Total: {c} create, {u} update, {d} delete**")

.gitea/workflows/reconcile.yml

@@ -95,32 +95,9 @@ jobs:
                     f"{summary.get('updated',0)} updated, "
                     f"{summary.get('deleted',0)} deleted")
 
-              # Log each operation with details
-              for op in data.get("operations", []):
-                  t = op["type"]
-                  n = op["name"]
-                  s = op.get("status", "?")
-                  action = "CREATE" if t.startswith("create") else "DELETE" if t.startswith("delete") else "UPDATE"
-                  resource = t.split("_", 1)[1] if "_" in t else t
-                  prefix = f"[{env}] {action} {resource} '{n}' -> {s}"
-
-                  changes = op.get("changes", [])
-                  if changes:
-                      def fmt(v):
-                          if isinstance(v, bool): return str(v).lower()
-                          if isinstance(v, list): return ", ".join(str(x) for x in v) if v else "(empty)"
-                          if v is None: return "(none)"
-                          return str(v)
-                      parts = [f"{c['field']}: {fmt(c['from'])} -> {fmt(c['to'])}" for c in changes]
-                      print(f"  {prefix} [{'; '.join(parts)}]")
-                  else:
-                      print(f"  {prefix}")
-
               keys = data.get("created_keys", {})
               if keys:
-                  print(f"[{env}] Created setup keys:")
+                  print(f"[{env}] Created setup keys: {list(keys.keys())}")
-                  for name, value in keys.items():
-                      print(f"  {name}: {value}")
 
           if failed:
               print(f"\nFailed environments: {failed}")

poc/TEST-SCENARIOS.md

@@ -1,227 +0,0 @@
-# Test Scenarios for NetBird GitOps PoC
-
-Test instance: `vps-a.networkmonitor.cc`
-State file: `state/test.json`
-Gitea: `gitea.vps-a.networkmonitor.cc`
-
-Current state on the instance: 2 groups, 3 setup keys, 1 policy, 1 user.
-
-Each scenario: create a branch, edit `state/test.json`, push, open PR (dry-run),
-review plan, merge (apply), verify on NetBird dashboard.
-
----
-
-## Scenario 1: Add a new group and policy
-
-**Goal:** Verify creating multiple resources in one PR.
-
-**Changes to `state/test.json`:**
-
-Add a new group `observers` and a policy allowing observers to see
-ground-stations:
-
-```json
-"groups": {
-    "ground-stations": { "peers": [] },
-    "pilots": { "peers": [] },
-    "observers": { "peers": [] }
-},
-"policies": {
-    "pilots-to-gs": { ... },
-    "observers-to-gs": {
-        "description": "Observers can view ground stations",
-        "enabled": true,
-        "sources": ["observers"],
-        "destinations": ["ground-stations"],
-        "bidirectional": false,
-        "protocol": "all",
-        "action": "accept"
-    }
-}
-```
-
-**Expected dry-run:**
-- Create: group `observers`, policy `observers-to-gs`
-
-**Verify after merge:**
-- Dashboard shows the `observers` group
-- Policy `observers-to-gs` exists with correct sources/destinations
-
----
-
-## Scenario 2: Update an existing policy
-
-**Goal:** Verify update detection works.
-
-**Changes to `state/test.json`:**
-
-Disable the `pilots-to-gs` policy:
-
-```json
-"pilots-to-gs": {
-    "enabled": false,
-    ...
-}
-```
-
-**Expected dry-run:**
-- Update: policy `pilots-to-gs`
-
-**Verify after merge:**
-- Policy shows as disabled on the dashboard
-
----
-
-## Scenario 3: Delete a resource
-
-**Goal:** Verify deletion works safely.
-
-**Changes to `state/test.json`:**
-
-Remove `Pilot-Vlad-2` from `setup_keys` (delete the entire key).
-
-**Expected dry-run:**
-- Delete: setup_key `Pilot-Vlad-2`
-
-**Verify after merge:**
-- Setup key no longer appears on the dashboard
-
----
-
-## Scenario 4: Enroll a peer (full lifecycle)
-
-**Goal:** Verify the enrollment detection and peer rename flow.
-
-**Prerequisite:** Runner and Gitea token must be configured for the reconciler
-poller. Run ansible-playbook with filled vault.yml first.
-
-**Steps:**
-
-1. Make sure `state/test.json` has an unenrolled setup key, e.g.:
-   ```json
-   "GS-TestHawk-1": {
-       "type": "one-off",
-       "expires_in": 604800,
-       "usage_limit": 1,
-       "auto_groups": ["ground-stations"],
-       "enrolled": false
-   }
-   ```
-
-2. Copy the setup key value from the NetBird dashboard (or from a previous
-   reconcile run's created_keys output)
-
-3. Enroll a peer:
-   ```bash
-   sudo netbird up --management-url https://vps-a.networkmonitor.cc --setup-key <KEY>
-   ```
-
-4. Wait for the poller to detect enrollment (~30 seconds)
-
-5. Verify:
-   - Peer is renamed to `GS-TestHawk-1` on the dashboard
-   - `state/test.json` in Gitea repo has `"enrolled": true` for that key
-   - The commit was made by the reconciler automatically
-
----
-
-## Scenario 5: Multi-resource create (bigger change)
-
-**Goal:** Test a realistic initial deployment scenario.
-
-**Changes to `state/test.json`:**
-
-Add network, posture check, and DNS in one PR:
-
-```json
-"posture_checks": {
-    "geo-restrict-ua": {
-        "description": "Allow only UA/PL locations",
-        "checks": {
-            "geo_location_check": {
-                "locations": [
-                    { "country_code": "UA" },
-                    { "country_code": "PL" }
-                ],
-                "action": "allow"
-            }
-        }
-    }
-},
-"dns": {
-    "nameserver_groups": {
-        "cloudflare": {
-            "nameservers": [
-                { "ip": "1.1.1.1", "ns_type": "udp", "port": 53 }
-            ],
-            "domains": [],
-            "enabled": true,
-            "primary": true,
-            "groups": ["pilots", "ground-stations"]
-        }
-    }
-}
-```
-
-**Expected dry-run:**
-- Create: posture_check `geo-restrict-ua`, dns `cloudflare`
-
-**Verify after merge:**
-- Posture check appears in dashboard
-- DNS nameserver group exists
-
----
-
-## Scenario 6: No-op (idempotency check)
-
-**Goal:** Verify that pushing state that matches what's already deployed
-produces no operations.
-
-**Steps:**
-
-1. Export current state:
-   ```bash
-   deno task export -- \
-     --netbird-api-url https://vps-a.networkmonitor.cc/api \
-     --netbird-api-token <TOKEN> > state/test.json
-   ```
-
-2. Push to a branch, open PR
-
-3. **Expected dry-run:** "No changes detected."
-
----
-
-## Scenario 7: Conflicting change (error handling)
-
-**Goal:** Verify the reconciler handles errors gracefully.
-
-**Steps:**
-
-1. Reference a group that doesn't exist in a policy:
-   ```json
-   "bad-policy": {
-       "enabled": true,
-       "sources": ["nonexistent-group"],
-       "destinations": ["pilots"],
-       "bidirectional": true
-   }
-   ```
-
-2. This should fail schema validation before hitting the API.
-
-3. **Expected:** CI job fails with a clear error message.
-
----
-
-## Quick reference
-
-```bash
-# Create test branch
-git checkout -b test-scenario-N
-# Edit state/test.json
-# Push and open PR
-git push poc test-scenario-N
-# After testing, clean up
-git checkout main && git branch -D test-scenario-N
-```

src/poller/poller.test.ts

@@ -12,7 +12,7 @@ function makeEvent(overrides: Partial<NbEvent> = {}): NbEvent {
     initiator_id: "init-1",
     initiator_name: "admin",
     target_id: "peer-1",
-    meta: { setup_key_name: "drone-key", name: "drone-01" },
+    meta: { setup_key: "drone-key", name: "drone-01" },
     ...overrides,
   };
 }
@@ -66,7 +66,7 @@ Deno.test("processEnrollmentEvents filters by lastTimestamp", () => {
 Deno.test("processEnrollmentEvents ignores unknown keys", () => {
   const events: NbEvent[] = [
     makeEvent({
-      meta: { setup_key_name: "rogue-key", name: "rogue-host" },
+      meta: { setup_key: "rogue-key", name: "rogue-host" },
       target_id: "peer-x",
     }),
   ];

src/poller/poller.ts

@@ -21,10 +21,10 @@ export function processEnrollmentEvents(
     .filter((e) => {
       if (e.activity_code !== "peer.setupkey.add") return false;
       if (lastTimestamp && e.timestamp <= lastTimestamp) return false;
-      if (!knownKeyNames.has(e.meta.setup_key_name)) {
+      if (!knownKeyNames.has(e.meta.setup_key)) {
         console.log(JSON.stringify({
           msg: "unknown_enrollment",
-          setup_key_name: e.meta.setup_key_name,
+          setup_key: e.meta.setup_key,
           peer_id: e.target_id,
         }));
         return false;
@@ -32,7 +32,7 @@ export function processEnrollmentEvents(
       return true;
     })
     .map((e) => ({
-      setupKeyName: e.meta.setup_key_name,
+      setupKeyName: e.meta.setup_key,
       peerId: e.target_id,
       peerHostname: e.meta.name,
       timestamp: e.timestamp,

src/reconcile/diff.ts

@@ -1,11 +1,7 @@
 import type { DesiredState } from "../state/schema.ts";
 import type { ActualState } from "../state/actual.ts";
 import type { NbPolicyRule } from "../netbird/types.ts";
-import {
+import { EXECUTION_ORDER, type Operation } from "./operations.ts";
-  EXECUTION_ORDER,
-  type FieldChange,
-  type Operation,
-} from "./operations.ts";
 
 /**
  * Compares desired state against actual state and returns an ordered list of
@@ -57,14 +53,10 @@ function diffPostureChecks(
       continue;
     }
 
-    const pcChanges: FieldChange[] = [];
+    if (
-    if (existing.description !== config.description) {
+      existing.description !== config.description ||
-      pcChanges.push({ field: "description", from: existing.description, to: config.description });
+      JSON.stringify(existing.checks) !== JSON.stringify(config.checks)
-    }
+    ) {
-    if (JSON.stringify(existing.checks) !== JSON.stringify(config.checks)) {
-      pcChanges.push({ field: "checks", from: existing.checks, to: config.checks });
-    }
-    if (pcChanges.length > 0) {
       ops.push({
         type: "update_posture_check",
         name,
@@ -72,7 +64,6 @@ function diffPostureChecks(
           description: config.description,
           checks: config.checks,
         },
-        changes: pcChanges,
       });
     }
   }
@@ -117,9 +108,6 @@ function diffGroups(
           desired_peers: desiredPeerNames,
           actual_peers: actualPeerNames,
         },
-        changes: [
-          { field: "peers", from: actualPeerNames, to: desiredPeerNames },
-        ],
       });
     }
   }
@@ -231,9 +219,6 @@ function diffNetworks(
         type: "update_network",
         name,
         details: { description: config.description },
-        changes: [
-          { field: "description", from: existing.description, to: config.description },
-        ],
       });
     }
 
@@ -308,23 +293,13 @@ function diffNetworkResources(
     const actualGroupNames = existing.groups.map((g) => g.name).sort();
     const desiredGroupNames = [...res.groups].sort();
 
-    const resChanges: FieldChange[] = [];
+    if (
-    if (existing.description !== res.description) {
+      existing.description !== res.description ||
-      resChanges.push({ field: "description", from: existing.description, to: res.description });
+      existing.type !== res.type ||
-    }
+      existing.address !== res.address ||
-    if (existing.type !== res.type) {
+      existing.enabled !== res.enabled ||
-      resChanges.push({ field: "type", from: existing.type, to: res.type });
+      !arraysEqual(actualGroupNames, desiredGroupNames)
-    }
+    ) {
-    if (existing.address !== res.address) {
-      resChanges.push({ field: "address", from: existing.address, to: res.address });
-    }
-    if (existing.enabled !== res.enabled) {
-      resChanges.push({ field: "enabled", from: existing.enabled, to: res.enabled });
-    }
-    if (!arraysEqual(actualGroupNames, desiredGroupNames)) {
-      resChanges.push({ field: "groups", from: actualGroupNames, to: desiredGroupNames });
-    }
-    if (resChanges.length > 0) {
       ops.push({
         type: "update_network_resource",
         name: res.name,
@@ -337,7 +312,6 @@ function diffNetworkResources(
           enabled: res.enabled,
           groups: res.groups,
         },
-        changes: resChanges,
       });
     }
   }
@@ -388,17 +362,11 @@ function diffNetworkRouters(
     }
 
     // Compare mutable fields
-    const routerChanges: FieldChange[] = [];
+    if (
-    if (existing.metric !== router.metric) {
+      existing.metric !== router.metric ||
-      routerChanges.push({ field: "metric", from: existing.metric, to: router.metric });
+      existing.masquerade !== router.masquerade ||
-    }
+      existing.enabled !== router.enabled
-    if (existing.masquerade !== router.masquerade) {
+    ) {
-      routerChanges.push({ field: "masquerade", from: existing.masquerade, to: router.masquerade });
-    }
-    if (existing.enabled !== router.enabled) {
-      routerChanges.push({ field: "enabled", from: existing.enabled, to: router.enabled });
-    }
-    if (routerChanges.length > 0) {
       ops.push({
         type: "update_network_router",
         name: key,
@@ -411,7 +379,6 @@ function diffNetworkRouters(
           masquerade: router.masquerade,
           enabled: router.enabled,
         },
-        changes: routerChanges,
       });
     }
   }
@@ -474,7 +441,7 @@ function diffPeers(
     const existing = actual.peersByName.get(name);
     if (!existing) continue; // Never create or delete peers
 
-    const peerChanges: FieldChange[] = [];
+    let changed = false;
 
     // Compare groups (excluding "All"), resolve actual peer group names
     const actualGroupNames = existing.groups
@@ -483,20 +450,19 @@ function diffPeers(
       .sort();
     const desiredGroupNames = [...config.groups].sort();
     if (!arraysEqual(actualGroupNames, desiredGroupNames)) {
-      peerChanges.push({ field: "groups", from: actualGroupNames, to: desiredGroupNames });
+      changed = true;
     }
 
-    if (existing.login_expiration_enabled !== config.login_expiration_enabled) {
+    if (
-      peerChanges.push({ field: "login_expiration_enabled", from: existing.login_expiration_enabled, to: config.login_expiration_enabled });
+      existing.login_expiration_enabled !== config.login_expiration_enabled ||
-    }
+      existing.inactivity_expiration_enabled !==
-    if (existing.inactivity_expiration_enabled !== config.inactivity_expiration_enabled) {
+        config.inactivity_expiration_enabled ||
-      peerChanges.push({ field: "inactivity_expiration_enabled", from: existing.inactivity_expiration_enabled, to: config.inactivity_expiration_enabled });
+      existing.ssh_enabled !== config.ssh_enabled
-    }
+    ) {
-    if (existing.ssh_enabled !== config.ssh_enabled) {
+      changed = true;
-      peerChanges.push({ field: "ssh_enabled", from: existing.ssh_enabled, to: config.ssh_enabled });
     }
 
-    if (peerChanges.length > 0) {
+    if (changed) {
       ops.push({
         type: "update_peer",
         name,
@@ -506,7 +472,6 @@ function diffPeers(
           inactivity_expiration_enabled: config.inactivity_expiration_enabled,
           ssh_enabled: config.ssh_enabled,
         },
-        changes: peerChanges,
       });
     }
   }
@@ -546,14 +511,10 @@ function diffUsers(
     ).sort();
     const desiredAutoGroupNames = [...config.auto_groups].sort();
 
-    const userChanges: FieldChange[] = [];
+    if (
-    if (existing.role !== config.role) {
+      existing.role !== config.role ||
-      userChanges.push({ field: "role", from: existing.role, to: config.role });
+      !arraysEqual(actualAutoGroupNames, desiredAutoGroupNames)
-    }
+    ) {
-    if (!arraysEqual(actualAutoGroupNames, desiredAutoGroupNames)) {
-      userChanges.push({ field: "auto_groups", from: actualAutoGroupNames, to: desiredAutoGroupNames });
-    }
-    if (userChanges.length > 0) {
       ops.push({
         type: "update_user",
         name: email,
@@ -562,7 +523,6 @@ function diffUsers(
           role: config.role,
           auto_groups: config.auto_groups,
         },
-        changes: userChanges,
       });
     }
   }
@@ -649,30 +609,12 @@ function diffPolicies(
       desiredPostureChecks,
     );
 
-    const changes: FieldChange[] = [];
+    if (
-    if (existing.enabled !== config.enabled) {
+      existing.enabled !== config.enabled ||
-      changes.push({ field: "enabled", from: existing.enabled, to: config.enabled });
+      !arraysEqual(actualSources, desiredSources) ||
-    }
+      destsChanged ||
-    if (!arraysEqual(actualSources, desiredSources)) {
+      postureChecksChanged
-      changes.push({ field: "sources", from: actualSources, to: desiredSources });
+    ) {
-    }
-    if (destsChanged) {
-      if (config.destination_resource) {
-        const actualDestRes = existing.rules[0]?.destinationResource;
-        changes.push({ field: "destination_resource", from: actualDestRes ?? null, to: config.destination_resource });
-      } else {
-        const actualDests = extractGroupNames(
-          existing.rules.flatMap((r) => r.destinations ?? []),
-          actual,
-        ).sort();
-        changes.push({ field: "destinations", from: actualDests, to: [...config.destinations].sort() });
-      }
-    }
-    if (postureChecksChanged) {
-      changes.push({ field: "source_posture_checks", from: actualPostureChecks, to: desiredPostureChecks });
-    }
-
-    if (changes.length > 0) {
       ops.push({
         type: "update_policy",
         name,
@@ -683,7 +625,6 @@ function diffPolicies(
           destination_resource: config.destination_resource,
           source_posture_checks: config.source_posture_checks,
         },
-        changes,
       });
     }
   }
@@ -741,17 +682,11 @@ function diffRoutes(
       continue;
     }
 
-    const routeChanges: FieldChange[] = [];
+    if (
-    if (existing.enabled !== config.enabled) {
+      existing.enabled !== config.enabled ||
-      routeChanges.push({ field: "enabled", from: existing.enabled, to: config.enabled });
+      existing.description !== config.description ||
-    }
+      existing.network !== config.network
-    if (existing.description !== config.description) {
+    ) {
-      routeChanges.push({ field: "description", from: existing.description, to: config.description });
-    }
-    if (existing.network !== config.network) {
-      routeChanges.push({ field: "network", from: existing.network, to: config.network });
-    }
-    if (routeChanges.length > 0) {
       ops.push({
         type: "update_route",
         name: networkId,
@@ -760,7 +695,6 @@ function diffRoutes(
           description: config.description,
           network: config.network,
         },
-        changes: routeChanges,
       });
     }
   }
@@ -807,17 +741,11 @@ function diffDns(
       config.nameservers,
     );
 
-    const dnsChanges: FieldChange[] = [];
+    if (
-    if (existing.enabled !== config.enabled) {
+      existing.enabled !== config.enabled ||
-      dnsChanges.push({ field: "enabled", from: existing.enabled, to: config.enabled });
+      existing.primary !== config.primary ||
-    }
+      nsChanged
-    if (existing.primary !== config.primary) {
+    ) {
-      dnsChanges.push({ field: "primary", from: existing.primary, to: config.primary });
-    }
-    if (nsChanged) {
-      dnsChanges.push({ field: "nameservers", from: existing.nameservers, to: config.nameservers });
-    }
-    if (dnsChanges.length > 0) {
       ops.push({
         type: "update_dns",
         name,
@@ -826,7 +754,6 @@ function diffDns(
           primary: config.primary,
           nameservers: config.nameservers,
         },
-        changes: dnsChanges,
       });
     }
   }

src/reconcile/operations.ts

@@ -33,17 +33,10 @@ export type OperationType =
   | "update_user"
   | "delete_user";
 
-export interface FieldChange {
-  field: string;
-  from: unknown;
-  to: unknown;
-}
-
 export interface Operation {
   type: OperationType;
   name: string;
   details?: Record<string, unknown>;
-  changes?: FieldChange[];
 }
 
 export interface OperationResult extends Operation {

src/server.ts

@@ -109,8 +109,6 @@ async function handleReconcile(
         operations: ops.map((op) => ({
           type: op.type,
           name: op.name,
-          ...(op.details && { details: op.details }),
-          ...(op.changes && { changes: op.changes }),
         })),
         summary: summarize(ops),
       });
@@ -143,8 +141,6 @@ async function handleReconcile(
         type: r.type,
         name: r.name,
         status: r.status,
-        ...(r.details && { details: r.details }),
-        ...(r.changes && { changes: r.changes }),
       })),
       created_keys: createdKeysObj,
       summary: summarize(results),

state/test.json

@@ -5,9 +5,6 @@
     },
     "pilots": {
       "peers": []
-    },
-    "observers": {
-      "peers": []
     }
   },
   "setup_keys": {
@@ -15,64 +12,36 @@
       "type": "one-off",
       "expires_in": 604800,
       "usage_limit": 1,
-      "auto_groups": [
+      "auto_groups": ["ground-stations"],
-        "ground-stations"
-      ],
       "enrolled": false
     },
     "Pilot-TestHawk-1": {
       "type": "one-off",
       "expires_in": 604800,
       "usage_limit": 1,
-      "auto_groups": [
+      "auto_groups": ["pilots"],
-        "pilots"
-      ],
       "enrolled": false
     },
-    "GS-Enroll-Test": {
+    "Pilot-Vlad-2": {
       "type": "one-off",
       "expires_in": 604800,
       "usage_limit": 1,
-      "auto_groups": [
+      "auto_groups": ["pilots"],
-        "ground-stations"
+      "enrolled": false
-      ],
-      "enrolled": true
     }
   },
   "policies": {
     "pilots-to-gs": {
       "description": "",
-      "enabled": false,
+      "enabled": true,
-      "sources": [
+      "sources": ["pilots"],
-        "pilots"
+      "destinations": ["ground-stations"],
-      ],
-      "destinations": [
-        "ground-stations"
-      ],
       "bidirectional": true,
       "protocol": "all",
       "action": "accept",
       "source_posture_checks": []
-    },
-    "observers-to-gs": {
-      "description": "",
-      "enabled": true,
-      "sources": [
-        "observers"
-      ],
-      "destinations": [
-        "ground-stations"
-      ],
-      "bidirectional": false,
-      "protocol": "all",
-      "action": "accept",
-      "source_posture_checks": []
     }
   },
-  "routes": {},
-  "dns": {
-    "nameserver_groups": {}
-  },
   "posture_checks": {},
   "networks": {},
   "peers": {},
@@ -82,5 +51,9 @@
       "role": "owner",
       "auto_groups": []
     }
+  },
+  "routes": {},
+  "dns": {
+    "nameserver_groups": {}
   }
-}
+}