Gate verified reconciliation apply mode

dns_sync/cli.py

@@ -10,6 +10,7 @@ from .engine import (
     summarize_plan,
     validate_desired,
 )
+from .executor import execute_endpoint_plans
 from .orchestrator import discover_reconcile_plan
 from .persistence import SQLiteStateStore
 from .registry import load_adapter, load_provider, load_source
@@ -41,6 +42,11 @@ def build_parser():
         action="store_true",
         help="Include disabled proxy hosts in desired DNS state",
     )
+    reconcile.add_argument(
+        "--apply",
+        action="store_true",
+        help="Apply and verify planned changes; default is read-only",
+    )
 
     sub.add_parser("plugins", help="Show the configured source/provider plugins")
     return parser
@@ -148,7 +154,8 @@ def run_reconcile(args):
             file=sys.stderr,
         )
 
-    print("Generic reconciliation mode: READ ONLY")
+    mode = "APPLY" if args.apply else "READ ONLY"
+    print(f"Generic reconciliation mode: {mode}")
     print(f"State database: {args.state_db}")
     print(f"Configured endpoints: {len(adapters)}")
     print(f"Cached/live observations: {len(result.observations)}")
@@ -181,7 +188,28 @@ def run_reconcile(args):
         f"{update_count} update, "
         f"{noop_count} unchanged"
     )
-    print("READ ONLY: no endpoint changes were applied.")
+
+    if not args.apply:
+        print("READ ONLY: no endpoint changes were applied.")
+        return 0
+
+    if result.failures:
+        raise RuntimeError(
+            "Refusing to apply while discovery failures are present"
+        )
+
+    with SQLiteStateStore(args.state_db) as store:
+        execution = execute_endpoint_plans(
+            adapters,
+            result.plans,
+            store,
+        )
+
+    print(
+        "APPLY COMPLETE: "
+        f"{len(execution.applied)} action(s) applied and verified; "
+        f"{len(execution.skipped)} unchanged/skipped."
+    )
     return 0