Implement planned topic: 0035-dns-resolver-config

[skill-temporal-developer-updater]

Validation Report — 0035-dns-resolver-config

Scope: the single commit on draft/0035-dns-resolver-config adds a DNS Resolver Configuration section to references/python/advanced-features.md (lines 117–148, 33 added lines). No other files change.

Topic class: Python SDK configuration topic — not a third-party integration. Check 5 skipped.

---

Go / no-go

Check	Result
Check 1 — citation audit	PASS (11/11 resolve cleanly, 100 %)
Check 2 — reverse-grep audit	PASS (0 unexplained misses)
Check 3 — regression on known bugs	PASS (0 hits, universal + topic-specific)
Check 4 — independent re-verification	PASS (10/10 sampled claims match, 100 %)
Check 5 — integration-layout audit	N/A (not an integration topic)
Check 6 — tone & scope audit	PASS (no workaround disclosures; no other findings)

Overall verdict: GO.

---

Check 1 findings

None. All eleven inline citations resolve to the cited file at the cited line range, and the cited text substantively supports the authored claim. Audit detail:

#	Cite	Authored claim	Verification
1	sdk-python/temporalio/service.py:136	DnsLoadBalancingConfig class exists	Line 136 defines class DnsLoadBalancingConfig:
2	sdk-python/temporalio/service.py:139-140	"Core periodically re-resolves the target host and round-robins requests across the resolved addresses"	Lines 139–142 docstring: "Core periodically re-resolves the target host's DNS records and round-robins requests across the resolved addresses"
3	docs/cloud/high-availability/ha-connectivity.mdx:25-31	Cloud HA failover via CNAME rewrite + OS resolver TTL re-resolution	Lines 25–31 describe DNS expressed as CNAME, Temporal Cloud rewriting target on failover, 15s TTL
4	sdk-python/temporalio/service.py:145	resolution_interval_millis: int = 30000	Exact match at line 145
5	sdk-python/temporalio/service.py:147,158	DnsLoadBalancingConfig.default pre-built instance with 30s interval	Line 147 declares default: ClassVar[DnsLoadBalancingConfig]; line 158 assigns DnsLoadBalancingConfig.default = DnsLoadBalancingConfig() (no-arg → 30000 ms)
6	sdk-python/temporalio/client.py:143	Client.connect kwarg signature	Exact match: `dns_load_balancing_config: DnsLoadBalancingConfig
7	sdk-python/temporalio/client.py:199-203	Quoted docstring	Verbatim match modulo RST … → markdown … rendering
8	sdk-python/temporalio/service.py:141-142	"silently disabled when proxy is set"	Line 141–142 docstring: "DNS load balancing is silently disabled when an HTTP CONNECT proxy is configured"
9	sdk-python/temporalio/bridge/src/client.rs:249-254	Rust bridge disables DNS LB when proxy is set	Lines 249–254 contain the if has_proxy { … None } else { … } branch that suppresses DNS LB
10	sdk-python/temporalio/client.py:9786	CloudOperationsClient.connect kwarg	Exact match: `dns_load_balancing_config: DnsLoadBalancingConfig
11	sdk-python/temporalio/client.py:9823-9826	Quoted CloudOperationsClient docstring	Verbatim match modulo RST … → markdown … rendering

Style note (non-finding): citation #3 is the only cite in the new section that uses an inline parenthetical ((docs/…)) rather than the <!-- … --> HTML-comment style used for the other ten. Both forms are resolvable and grep-friendly, but the inconsistency could be normalized in a follow-up edit. Not flagged as a finding because no convention is documented in SKILL.md mandating one form, and no other file in references/ uses <!-- docs/… --> either.

Check 2 findings

None. Every factual token in the new section appears in the source-of-truth tree:

• DnsLoadBalancingConfig, HttpConnectProxyConfig, Client, CloudOperationsClient — present in /tmp/sdk-python/temporalio/.
• resolution_interval_millis, dns_load_balancing_config, http_connect_proxy_config, target_host — present in service.py / client.py.
• Numeric 30000 matches service.py:145. Numeric 5000 is illustrative-example only.
• CNAME appears 11× in ha-connectivity.mdx.
• Both verbatim docstring quotes match the cited lines byte-for-byte (modulo RST→markdown backtick rendering).

Check 3 findings

None. Regression-pattern grep is clean for both the universal table (no --profile, no TEMPORAL_TLS_CLIENT_*, no tcld service-account, no --output text/jsonl, no saas-api.tmprl.cloud:7233) and the topic-specific table:

• The section explicitly distinguishes DNS LB from Temporal Cloud HA failover (lines 121: "It is not the mechanism that makes Temporal Cloud HA failover work").
• Field unit suffix is _millis — not the wrong-unit _seconds.
• Proxy + DNS LB precedence is described as "silently disabled — there is no error and no precedence flag" — not as "raises" / "takes precedence".
• Default for Client.connect is documented as 30 s / 30 000 ms; default for CloudOperationsClient.connect is documented as "disabled" — both faithful to source.

Check 4 findings

None. All 10 sampled claims match my independent reading of the source:

Claim (paraphrased)	Independent re-derivation	Match?
DnsLoadBalancingConfig re-resolves target host and round-robins	service.py docstring lines 139–140	✓
Useful when target resolves to multiple A/AAAA records	Plausible use-case framing, supported implicitly by docstring	✓
Not the mechanism for Cloud HA failover; failover is CNAME rewrite + TTL	ha-connectivity.mdx lines 25–31	✓
Only field is resolution_interval_millis: int = 30000; "milliseconds"	service.py:145 + adjacent field-docstring	✓
DnsLoadBalancingConfig.default is a pre-built instance	service.py:147,158	✓
Client.connect kwarg signature exact	client.py:143	✓
Quoted docstring — Client.connect	client.py:199–203	✓ verbatim
Pass None to disable	derives from "Can be set to None to disable"	✓
Proxy + DNS LB are mutually exclusive; silently disabled; no error, no precedence flag	service.py:141–142 + bridge/client.rs:249–254	✓
CloudOperationsClient.connect accepts same kwarg; documented default differs ("disabled")	client.py:9786 + 9823–9826	✓

Low-severity observation (not a finding against the skill): the Python docstring at client.py:199–203 says "Default is to re-resolve DNS every 30s" even though the kwarg default value is literally None, and None is passed straight through to the Rust bridge without substitution. The actual effective default therefore depends on whether Core supplies its own default when handed a missing DnsLoadBalancingConfig. The skill faithfully quotes the docstring as-is and does not editorialize, which is the correct approach — if the SDK docstring is ambiguous, that's an upstream-SDK doc question, not a skill-validation finding.

Low-severity observation: the Rust bridge emits a warn!("Disabling DNS load balancing because http_connect_proxy_config is set") log (client.rs:250) when both are configured. The skill's wording "silently disabled — there is no error and no precedence flag" mirrors the docstring's official "silently disabled" terminology, and the additional clarifiers "no error" / "no precedence flag" are both correct. Not flagged.

Check 5 findings

Skipped — not a third-party integration topic.

Check 6 findings

None.

• Workaround / escape-hatch disclosure (pattern 1): none. The proxy + DNS LB section ends with "If you need both, you cannot have both; choose the one your network requires." — a clean hard-constraint statement, not a workaround.
• In-the-weeds rationale (pattern 2): the "not the mechanism for Cloud HA failover" clarification is a meaningful disambiguation that prevents an agent from reaching for this API to solve a different problem. Useful, not noise.
• Multi-sentence bullets that should be one (pattern 3): the bullet at line 139 quoting the Client.connect docstring is long but every clause is load-bearing (signature + docstring + use of None). Acceptable.
• Public Preview without admonition (pattern 4): N/A. Neither the cited SDK source nor ha-connectivity.mdx marks DNS LB as Public Preview. (CloudOperationsClient carries an .. warning:: This client and the API are experimental in its own docstring, but the skill's cross-reference is narrowly to its DNS-LB-kwarg default, not to the API itself, so no admonition is owed here.)

---

Statistics

• Added lines under validation: 33
• Distinct factual claims: 11
• Citation count: 11 (10 <!-- HTML-comment cites + 1 parenthetical docs cite)
• Citation pass rate: 11 / 11 = 100 %
• Reverse-grep token classes scanned: 4 (Python identifiers, field/kwarg names, numeric literals, verbatim quotes)
• Unexplained grep misses: 0
• Regression-pattern hits: 0 (universal) + 0 (topic-specific)
• Sample size (Check 4): 10 of 11 claims; effectively the entire population
• Sample match rate: 10 / 10 = 100 %
• Check 6 findings: 0

---

Verdict

GO. The diff is tight, fully grounded, and free of fabrication patterns. The single style observation (inline-parenthetical vs. HTML-comment citation form for the one docs cite) is not severe enough to warrant a follow-up commit on its own. Merge as-is.