Map stable human-readable names to workloads that move between providers, using a decentralized naming system rather than a Control-Plane-operated DNS zone. Mobility is the hard part: a name must keep resolving after auto-healing (#62) migrates a workload to a different provider, without a central party performing the update.
Blocked by: ADR-017 (see ADR-012 §6) — no implementation before acceptance. Depends on #53 and #54.
Acceptance criteria:
- name ownership is cryptographically established and transferable, with rotation and recovery consistent with ADR-012 §4;
- name-to-workload records are authenticated at the record level, so a resolver or cache cannot forge an answer;
- records update within a stated bound when a workload migrates, and stale answers are bounded by an explicit TTL rather than being unbounded;
- name squatting, hijacking, and expiry-race attacks are addressed;
- resolution degrades to an explicit failure rather than to a wrong or attacker-controlled answer;
- no personal data enters any permanent public record, per the one-way rule in ADR-012 §3;
- interoperability with conventional DNS resolvers is stated — whether via a gateway, a resolver plugin, or not at all;
- tests cover resolution, migration mid-session, ownership transfer, an expired record, a forged record, and a partitioned resolver.
Original request (FR, preserved verbatim):
Intégrer un système de nommage décentralisé pour mapper des domaines aux workloads mobiles.
Map stable human-readable names to workloads that move between providers, using a decentralized naming system rather than a Control-Plane-operated DNS zone. Mobility is the hard part: a name must keep resolving after auto-healing (#62) migrates a workload to a different provider, without a central party performing the update.
Blocked by: ADR-017 (see ADR-012 §6) — no implementation before acceptance. Depends on #53 and #54.
Acceptance criteria:
Original request (FR, preserved verbatim):