# Grok — invoke subagents for remaining host moves

Updated October 16, 2026. Paste-ready. Copying this prompt does not dispatch Grok and does not authorize mail, payments, or a new DNS change by itself.

## Change note

Several sites may move at once only when each site is on a different domain. Never run two DNS changes on the same domain at the same time. Check each site on its own. If that site fails, restore only its recorded website record.

Do not change DNS until the publisher taps yes in Grok's chat. Listing records and confirming the server is reachable is allowed before that yes.

The note that Grok cannot log in to Hetzner is stale. It came from yesterday, when the air-gold key needed its passphrase. `registercall.com` and `thevillager.today` are already serving from `2.29.20.177`. If login stalls, keep air-gold awake with that key unlocked. Do not treat the stale note as proof the server is down.

You are the parent. Spawn one subagent per remaining project listener. Do not do the remaining 20 deploys inside this context. If this runtime has no subagent or task tool, stop and say so. Do not fake the fan-out.

Read https://satcom.conews.press/codex and call read-only MCP `satcom_host_moves` at https://satcom.conews.press/mcp before assigning work. Skip every `[x]` hostname. Do not repeat a completed DNS change.

## Parent owns

- The live website record read, the DNS write, and the public HTTPS check.
- Rollback of that one record if the title, one route, or one asset fails.
- Mail, MX, TXT, SPF, DKIM, DMARC, and `_vercel` records. Do not change them.
- Secrets. Never print them. If a public 200 depends on a Vercel value with `decrypted: false`, mark that listener blocked and do not change its DNS.

## One subagent per remaining listener

Assign only rows marked `[ ]` on different domains. `subscribe.thevillager.today` now has website A `2.29.20.177` in Vercel DNS. Do not change that zone's nameservers or mail. Finish its public HTTPS check before marking it done. Rollback is deleting that A record.

Each subagent returns only:

- project, port, hostnames
- production commit and whether the build serves every assigned hostname
- env names required for a public 200, and whether any required value is unreadable
- whether the apex carries mail
- local HTTPS result, or the blocker
- the exact website record to change and its rollback value

Subagents do not change DNS, mail, Stripe, subscriber data, or unrelated zones. They do not delete the Vercel project. They do not edit `default_redirect_503.yaml`. They do not reuse ports `4173`, `4174`, or `4184`. Next free port is `4185`.

## Stop rules

Stop after each listener. A matching homepage shell is not proof. A bundled certificate that fails one hostname fails the whole bundle, so request one certificate per hostname. If web and mail share an apex and cannot be separated, stop that zone.

Then return a table: done, underway, blocked, and not started. Do not claim a host moved until public HTTPS, the title, one route, and one asset are observed.