How I run real server work with AI, without losing control.

How I run real server work with @xai @grok @bot @cursorai, without losing control.

My setup is simple. Grok Bot writes the orders, Cursor with Grok 4.7 executes them on my servers, and I approve and test at the end.

Every order follows the same strict structure:

• One order at a time, nothing runs in parallel

• A host naming lock, so no server ever gets mixed up

• A hard ban on touching the production system

• A read-only analysis before any change

• Backup and rollback before the first edit

• A full test matrix, with my own test as the last step

• A fixed report format with PASS / OPEN UNTIL / FAIL

• No patching a failed order: a FAIL gets a new order with a new number

Below is a neutral example (example.com, IPs masked): a shop moving to a new server with zero downtime.

Grok Bot plans and checks, Cursor builds, and I decide.

#GrokBot #Cursor #Grok #AI #DevOps #Automation

[100][CURSOR/GROK 4.7][MOVE SHOP.EXAMPLE.COM 1:1 TO NEW SERVER][PRIORITY 1]

SHOP.EXAMPLE.COM MOVES 1:1 TO THE NEW SERVER. SAME LOOK, SAME FUNCTIONS, ZERO DOWNTIME. THE OLD SERVER STAYS UNCHANGED AS THE WAY BACK.

APPROVED BY THE OWNER (EXPLICITLY, INCLUDING DNS CHANGES IN ZONE EXAMPLE.COM).

EXECUTE IMMEDIATELY.

DO NOT ask for approval again.

=======================================================

0. ORDER SEQUENCE (BINDING)

=======================================================

Previously accepted (PASS): 097, 098, 099.

Next: 101 (old server cleanup), only after 100 is PASS.

Only ONE order runs at a time. NOTHING in parallel. No order gets paused.

Violation = 100 automatically FAIL. Do NOT ask for a second approval.

=======================================================

0. HOST NAMING LOCK

======================================================

OLD SERVER: old.example.com IP xxx.xxx.xxx.10

NEW SERVER: new.example.com IP xxx.xxx.xxx.20

ach server is named in the report ONLY with exactly this name and this IP.

Swapped or invented host names = entire report FAIL.

=======================================================

0a. PRODUCTION SYSTEM (ABSOLUTE BAN)

=======================================================

prod.example.net is the revenue-generating production system and is NOT part of this order.

ABSOLUTELY NOTHING is touched there: no DNS, no SPF, no MX, no code, no config,

no database, no service restart, no login, no access, no tests.

The DNS zone example.net is NOT opened.

=======================================================

0b. TARGET SYSTEMS (BINDING)

=======================================================

SOURCE: shop.example.com on old.example.com (READ ONLY, stays fully working)

TARGET: new.example.com (xxx.xxx.xxx.20)

DNS SCOPE: ONLY zone example.com

UNCHANGED:

• prod.example.net (see 0a)

• all other vhosts, mailboxes, certificates and services on both servers

• all other DNS zones

• content, prices, products, layout and functions of the shop (pure move, no changes)

NO deletions on old.example.com. That follows in order 101.

=======================================================

1. SITUATION

=======================================================

shop.example.com runs on old.example.com. The server is being replaced.

The shop is connected to an order system (orders.example.com) and partner tracking (partner.example.com).

Goal of 100: the shop runs 1:1 on new.example.com, with zero downtime and all connections working.

=====================================================

2. BINDING INSTRUCTIONS

=====================================================

PART A: SECURE THE CURRENT STATE (BEFORE ANY CHANGE)

1. Export all DNS records of zone example.com (A, AAAA, CNAME, MX, TXT/SPF, DKIM, DMARC, CAA, NS, TTL)

to /root/backups/a100-/dns/.

2. Full backup of the source: docroot, vhost, PHP version and modules, cron jobs, database dump,

config, certificate state. Stored on source AND target under /root/backups/a100-/.

3. Reference state: HTTP status and SHA256 of the HTML of home page, categories, 3 product pages, cart,

checkout (without submitting), legal pages, contact; redirects (http/https, www/non-www);

screenshots at 390/768/1440 px.

4. Record all connections (order system, partner tracking, mail sending, payment methods, cron jobs,

external services). Secrets stay ON THE SERVERS ONLY, NEVER in the report.

PART B: BUILD ON NEW.EXAMPLE.COM

1. Copy docroot, database and config 1:1. Report any version differences.

2. vhosts shop.example.com and www.shop.example.com with identical redirect behavior.

3. All connections work from the new location exactly as before. If IP allow lists are needed:

ONLY add xxx.xxx.xxx.20, remove nothing, report file and line.

4. Mail sending with valid SPF/DKIM/DMARC (verify, never weaken).

5. Create cron jobs 1:1, disable them on the source ONLY AFTER the DNS switch (do not delete).

PART C: PRE-CHECK AND DNS SWITCH (ZERO DOWNTIME)

1. Use curl --resolve against xxx.xxx.xxx.20 to prove: all pages from A.3 return the same status,

the same redirects and the same HTML (explain dynamic values in the report).

2. Issue SSL beforehand via DNS-01, so no certificate error can occur.

3. Resync the database right before the switch. Report row counts before and after.

4. Lower TTL to 300 first, then switch A/AAAA of shop and www.shop.

5. After the switch, re-check everything from A.3 via public DNS. Any difference or outage:

IMMEDIATELY restore DNS to the saved state and report FAIL.

6. Do NOT change MX.

=======================================================

3. ANALYSIS (MANDATORY, BEFORE ANY CHANGE, READ ONLY)

=======================================================

A) Source stack (web, PHP, DB), docroot, database name and size

B) Target stack and compatibility

C) Existing vhosts on the target (list), so nothing gets overwritten

D) Current DNS (Part A.1)

E) All connections with file and line

F) Backup paths and rollback plan (DNS back, source cron jobs active again, database state)

=======================================================

4. TEST MATRIX

=======================================================

No real payments. Test orders only with a test account in test mode; test data removed afterwards (0 rows).

No sessions for real customer accounts.

) Current DNS and backup secured (paths)

B) Pre-check --resolve: all pages identical

C) After switch: all pages identical, http/https, www/non-www, valid certificate

D) No period without a reachable shop (timestamps)

E) Database: row counts source = target at switch time

F) Test order appears in the order system, removed afterwards

G) Partner link counts the click and assigns the test order, removed afterwards

H) Shop mail: SPF, DKIM, DMARC pass (test only to test@example.com)

I) Cron jobs run only on the target

J) Screenshots source vs. target at 390/768/1440 px: identical

K) Other vhosts, mail, certificates, DNS zones unchanged

L) No new server log errors

M) prod.example.net: nothing changed, no access

N) OWNER TEST (only after READY FOR OWNER TEST: YES): the owner clicks through home page, category,

product, cart and checkout, and checks the order system and partner tracking.

=======================================================

5. REPORT

=======================================================

ORDER: 100

EXECUTOR: CURSOR/GROK 4.7

PREVIOUS ORDERS COMPLETED (097, 098, 099): PASS/FAIL

ORDER SEQUENCE RESPECTED (nothing parallel, nothing paused): YES / FAIL if NO

OLD SERVER: old.example.com / xxx.xxx.xxx.10

NEW SERVER: new.example.com / xxx.xxx.xxx.20

HOST NAMES CORRECT: YES / FAIL if NO

PROD.EXAMPLE.NET TOUCHED: NO / FAIL if YES

STACK SOURCE / TARGET: [exact]

DNS BEFORE (export path): [exact]

BACKUP (paths): [exact]

CONNECTIONS FOUND: [list, no secrets]

IP ALLOW CHANGES (file/line) or NONE: [exact]

PRE-CHECK --resolve: PASS/FAIL

SSL (method, expiry, renewal): PASS/FAIL

DB RESYNC (time, row counts before/after): [exact]

DNS SWITCH (time, TTL): [exact]

AFTER SWITCH ALL PAGES: PASS/FAIL

DOWNTIME: NONE / [exact] (FAIL if >0)

TEST ORDER: PASS/FAIL

PARTNER TRACKING: PASS/FAIL

MAIL SPF / DKIM / DMARC: PASS/FAIL

CRON JOBS (target active / source disabled): [exact]

SCREENSHOTS 1:1: PASS/FAIL

MX UNCHANGED: PASS/FAIL

OTHER VHOSTS / MAIL / CERTS / ZONES UNCHANGED: PASS/FAIL

NEW SERVER LOG ERRORS: NONE / [list]

TEST DATA REMOVED (0 rows): PASS/FAIL

REAL ACCOUNTS TOUCHED: NO / FAIL if YES

READY FOR OWNER TEST: YES/NO

N (OWNER TEST): open/PASS

ROLLBACK (paths, DNS restore, cron restore): [exact]

SECRETS EXPOSED: NO / FAIL if YES

OPEN BLOCKERS: [list or NONE]

OVERALL: PASS / OPEN UNTIL N / FAIL

Note: if all technical items are PASS and only N is open, OVERALL reads "OPEN UNTIL N", not FAIL.

=======================================================

6. ABSOLUTE ACCEPTANCE RULE

=======================================================

100 IS ONLY PASS IF:

• the shop on new.example.com looks and works exactly as before

• there was no outage and no certificate error at any time

• no orders, customers or data were lost

• the source still exists unchanged as the way back

• MX, other vhosts, certificates and DNS zones are unchanged

• prod.example.net is provably untouched

• backup and rollback exist and the report contains no secrets

• the owner has confirmed test N

On FAIL: no amendments. Submit the report; the owner issues a new order with a new number.

Do NOT accept as PASS:

• DNS switched without a prior --resolve proof

• deletions on the old server

• changes to content, layout, prices or functions

• cron jobs running twice

• MX changed

• any change to prod.example.net

AUTHORIZED BY OWNER. EXECUTE IMMEDIATELY. DO NOT ASK FOR APPROVAL AGAIN.