Chorus

Managing DNS is high-stakes and unforgiving — one fat-fingered record can take a service down, and in a shared org it’s far too easy to touch another team’s data. The brief was a management surface where the right record is found and safely changed in seconds, without fear.

1. 01

   Designed a deliberately calm, guardrailed interface — private-by-default records, with publishing to the public directory gated as a separate, intentional action.

2. 02

   Implemented unix-style per-resource permissions (a 9-bit mode plus owner) over org-scoped CRUD, so access is precise and predictable.

3. 03

   Built a deterministic record linter that flags dangerous configurations before they ship — a safety net rather than an AI black box.

4. 04

   Emitted signed outbound webhooks on every mutation and kept a stable wire-contract identity so downstream services never break.

Chorus grew out of an earlier internal “DNS Portal.” Rather than a visual redesign fork, the evolution lived in decisions and ADRs: a formal design system with explicit do/don’t rules and anti-references, theming split into two orthogonal axes (light/dark independent from selectable color themes), a full migration onto the shadcn/Radix component vocabulary, and an auth-stack move to Supabase sessions. Notably, the product was rebranded to Chorus while the underlying wire-contract identity — package names, webhook headers, secret prefixes — was deliberately left untouched so integrations stayed rock-solid.