Wire NPM desired state into orchestration

dns_sync/orchestrator.py

@@ -4,6 +4,7 @@ from datetime import datetime, timezone
 from typing import Protocol
 
 from .adapters import (
+    CERTIFICATES,
     DNS_RECORDS,
     PROXY_HOSTS,
     Capability,
@@ -188,11 +189,28 @@ def discover_reconcile_plan(
         store,
         set(adapters_by_endpoint),
     )
+    npm_observations = [
+        observation
+        for observation in observations
+        if observation.object.object_type
+        in {
+            CERTIFICATES,
+            PROXY_HOSTS,
+        }
+    ]
+
+    npm_desired = (
+        reconcile_observations(npm_observations)
+        if npm_observations
+        else []
+    )
+
     proxy_observations = [
         observation
         for observation in observations
         if observation.object.object_type == PROXY_HOSTS
     ]
+
     projected_dns = project_proxy_hosts_to_dns(
         proxy_observations,
         target_ip,
@@ -204,12 +222,35 @@ def discover_reconcile_plan(
         domain=domain,
     )
 
-    desired = reconcile_observations(projected_dns)
-    store.replace_desired_state(
-        DNS_RECORDS,
-        desired,
-        timestamp,
+    dns_desired = (
+        reconcile_observations(projected_dns)
+        if projected_dns
+        else []
     )
+
+    # Keep the reconciliation domains separate until each has
+    # produced portable desired state. In particular, router DNS
+    # observations must never participate in the proxy->DNS union.
+    desired = [
+        *npm_desired,
+        *dns_desired,
+    ]
+
+    for object_type in (
+        CERTIFICATES,
+        PROXY_HOSTS,
+        DNS_RECORDS,
+    ):
+        store.replace_desired_state(
+            object_type,
+            [
+                object
+                for object in desired
+                if object.object_type == object_type
+            ],
+            timestamp,
+        )
+
     plans = build_endpoint_plans(
         adapter_list,
         desired,