Gate verified reconciliation apply mode

tests/test_cli_reconcile.py

@@ -63,6 +63,12 @@ class ReconcileCliTests(unittest.TestCase):
             "/tmp/test-state.sqlite3",
         )
         self.assertTrue(args.include_disabled)
+        self.assertFalse(args.apply)
+
+        apply_args = build_parser().parse_args(
+            ["reconcile", "--apply"]
+        )
+        self.assertTrue(apply_args.apply)
 
     def test_reconcile_builds_plan_without_applying_it(self):
         npm_endpoint = Endpoint("npm", "192.168.1.3:81")
@@ -155,6 +161,7 @@ class ReconcileCliTests(unittest.TestCase):
                     SimpleNamespace(
                         state_db=str(state_path),
                         include_disabled=False,
+                        apply=False,
                     )
                 )
 
@@ -182,5 +189,61 @@ class ReconcileCliTests(unittest.TestCase):
         self.assertEqual(verizon.verify_count, 0)
 
 
+    def test_apply_flag_invokes_verified_executor(self):
+        config = SimpleNamespace(
+            target_ip="192.168.1.101",
+            include_disabled=False,
+            domain_matching=False,
+            domain=None,
+        )
+        adapter = object()
+        reconciliation = SimpleNamespace(
+            observations=(),
+            desired=(),
+            plans=(),
+            failures=(),
+        )
+        execution = SimpleNamespace(
+            applied=(),
+            skipped=(),
+        )
+
+        with tempfile.TemporaryDirectory() as directory:
+            state_path = Path(directory) / "state.sqlite3"
+            stdout = io.StringIO()
+
+            with patch(
+                "dns_sync.cli.AppConfig.from_env",
+                return_value=config,
+            ), patch(
+                "dns_sync.cli._configured_adapters",
+                return_value=[adapter],
+            ), patch(
+                "dns_sync.cli.discover_reconcile_plan",
+                return_value=reconciliation,
+            ), patch(
+                "dns_sync.cli.execute_endpoint_plans",
+                return_value=execution,
+            ) as execute, redirect_stdout(stdout):
+                result = run_reconcile(
+                    SimpleNamespace(
+                        state_db=str(state_path),
+                        include_disabled=False,
+                        apply=True,
+                    )
+                )
+
+        self.assertEqual(result, 0)
+        execute.assert_called_once()
+        self.assertIn(
+            "Generic reconciliation mode: APPLY",
+            stdout.getvalue(),
+        )
+        self.assertIn(
+            "APPLY COMPLETE: 0 action(s) applied and verified",
+            stdout.getvalue(),
+        )
+
+
 if __name__ == "__main__":
     unittest.main()