feat: add SKIP_AUDIT modifier

[GZTimeWalker]

Problem

A provider's RecordAuditor can reject records that the provider's API actually accepts and serves. When that happens the whole zone becomes unmanageable, even though every record in it is fine, because the audit fails before any diffing takes place.

Concrete case: ALIDNS's labelConstraint (added in #4787) decodes punycode A-labels and rejects non-Chinese IDNs. A zone that already contains such a record — for example xn--628h.play, which the ALIDNS API stores and serves as the ASCII label xn--628h — can no longer be previewed or pushed.

Solution

Add an opt-in, per-record SKIP_AUDIT modifier. It tags the record with skip_audit metadata, and providers.AuditRecords() omits tagged records before calling the provider's auditor. Every provider gets the escape hatch without changing any of its audit checks.

D("example.com", REG_NONE, DnsProvider(DNS_ALIDNS),
    TXT("xn--628h.play", "...", TTL(86400), SKIP_AUDIT),
);

Notes

• No provider audit is modified; the behavior is unchanged unless a record opts in.
• Scope is per-record.
• Tagging is metadata-only. Metadata is not part of ComparableV3, and ALIDNS diffs with diff2.ByRecord(..., nil), so the extra key does not affect diffing.
• If every record is tagged, the auditor is simply called with an empty set.

Changes

• pkg/js/helpers.js — add the SKIP_AUDIT record modifier (var SKIP_AUDIT = { skip_audit: "true" };).
• pkg/providers/providers.go — AuditRecords() filters records whose metadata["skip_audit"] == "true".

[GZTimeWalker]

Maybe a more complete allowed set in the ALIDNS audit would be a better fix than an opt-out, since the API already accepts this record.

[Copilot]

Copilot review overview

🟡 Changes recommended

The new metadata flag causes persistent differences in ClouDNS and GCore comparisons.

Review effort: Balanced
Findings: 2

Open (2)

• Exclude skip_audit from ClouDNS and GCore comparisons · New
• Add regression tests for AuditRecords skip_audit filtering · New

What changed in this PR

Adds an opt-in, per-record escape hatch for provider audits that reject otherwise accepted DNS records.

Changes:

• Adds the SKIP_AUDIT JavaScript modifier.
• Filters tagged records before invoking provider auditors, including when all records are skipped.

File	Description
pkg/​providers/​providers.go	Excludes tagged records from provider audits.
pkg/​js/​helpers.js	Defines and illustrates SKIP_AUDIT.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.