ADR-002: Central DNS — central.fintail.net now → central.fin.app in Phase 4

Status: accepted (2026-05-15) Date decided: 2026-05-15 Decided by: Rob Garcia, with Claude Code session 01 Supersedes: None Superseded by: None (yet — Phase 4 cutover ADR will reference this)

Context

Phase 1 §3.6 of the demarcation runbook required DNS for the Central Cloudflare Worker. The handoff plan called for central.fin.app, but fin.app was not yet a registered + Cloudflare-zoned domain at decision time. The existing Nathel deployment uses api.fintail.net (root-level subdomain on the existing fintail.net Cloudflare zone).

Three options considered:

Option	DNS	Pros	Cons
A	central.fintail.net	Existing CF zone — instant DNS, no registrar work	Drifts from handoff plan (which said central.fin.app)
B	central.fin.app	Brand-clean; matches strategic plan	Requires fin.app registration + CF zone add (1-3 days for nameserver propagation)
C	central-api.fintail.net	Full symmetry with api.fintail.net (Nathel)	api/ prefix loses meaning when serving full apps

Decision

Option A (central.fintail.net) for now; migrate to central.fin.app in Phase 4 production cutover when both Central and Nathel rebrand to *.fin.app together.

Env	DNS today	DNS Phase 4+
Central prod	central.fintail.net	central.fin.app
Central staging	staging-central.fintail.net	staging-central.fin.app
Nathel prod	api.fintail.net (existing)	TBD (api.nathel.fin.app or nathel.fin.app/api)
Nathel staging	staging-api.fintail.net (existing)	TBD

Consequences

Positive

• Phase 1 unblocked immediately — no domain registrar wait
• Sibling pattern to Nathel — api.fintail.net (Nathel) and central.fintail.net (Central) are visually distinct + same zone
• Root subdomain pattern matches the eventual *.fin.app — no path-shape refactor needed at cutover
• Cloudflare Pages, Worker routes, Access policies all configured against the same zone — operational consistency

Negative

• Phase 4 cutover doc must explicitly cover the rename — DNS swap, Worker route updates, all central.fintail.net references in code and docs need search-and-replace
• Partner conversations during this period reference central.fintail.net — potentially confusing if “central.fin.app” is the brand we want partners to remember. Mitigated by treating the URL as internal-only until Phase 4.

Neutral

• DNS records added today (AAAA 100:: proxied) are easily removable when the cutover happens

Implementation notes

• Added 2 AAAA records to fintail.net zone (central and staging-central), both 100:: IPv6 placeholder, both proxied (orange cloud)
• Wrangler routes activated in wrangler.fin-central.jsonc:
  • env.staging.route.pattern = "staging-central.fintail.net/*"
  • env.production.route.pattern = "central.fintail.net/*"
• /health verified returning role: central, role_verified: true end-to-end

Related

• Parent runbook: Phase 1 Demarcation Provisioning §3.6
• Verification: Phase 1 Verification Record §2.6
• Operator handoff: Phase 1 §3 Operator Steps §7
• Phase 4 cutover plan: TBD (will reference this ADR)