# Phase 1 Verification — Orca v0.6 P01

**Phase**: P01 — `orca init` Full Bootstrap + Schema 0006
**REQ Coverage**: REQ-047, REQ-048, REQ-049
**Verification date**: 2026-08-03
**Result**: ✅ PASS (all 4 layers)

## Structural Verification

- ✅ `go build ./...` — PASS (no compile errors)
- ✅ `go vet ./...` — PASS (no vet warnings)
- ✅ `gofmt -l .` — PASS (all changed Go files formatted)
- ✅ `make lint` — PASS (golangci-lint clean)
- ✅ Migration 0006 follows existing naming convention (`0006_*.sql`)
- ✅ `model.Node` struct follows existing field/tag conventions
- ✅ `NodeRepo` methods follow existing error-wrapping + `scanner` pattern

## Behavioral Verification

### REQ-047: `orca init` auto-provisions CA + server cert + DB + localhost node
- ✅ `TestInit_FullBootstrap`: init creates namespace dir, CA (ca.crt 0644 + ca.key 0600), server cert, DB (migrations 0001..0006), localhost node
- ✅ `TestInit_IdempotentReRun`: re-running init does NOT regenerate CA/server cert (D-036), does NOT duplicate localhost node, refreshes last_seen, preserves id + joined_at
- ✅ E2E smoke test: `orca init` → CA provisioned (fp shown), server cert provisioned (fp shown), DB initialized, localhost node registered

### REQ-048: `orca init` registers localhost node with auto-detected OS
- ✅ `TestInit_FullBootstrap`: localhost node has `kind=localhost`, non-empty `os`, `address=localhost:8443`
- ✅ `TestParseOSReleaseID_*` (10 tests): ubuntu, debian, alpine, pve, quoted/unquoted values, missing ID, empty content, comments, unknown ID returned verbatim
- ✅ `TestDetectOS_*` (3 tests): reads /etc/os-release, falls back to /usr/lib/os-release, falls back to "linux"
- ✅ E2E smoke test: `OS detected: ubuntu` (this host is Ubuntu 24.04)

### REQ-049: Node schema extension (kind + os columns, migration 0006)
- ✅ `TestMigrationVersion`: version = "0006_node_kind_os.sql"
- ✅ `TestNodeRepo_KindOS_RoundTrip`: insert with kind/os → get returns them correctly
- ✅ `TestNodeRepo_NullKindOS_EmptyString`: NULL columns → `""` in Go struct (no nil-deref)
- ✅ `TestNodeRepo_GetByName`: found by name, ErrNotFound for missing
- ✅ `TestNodeRepo_UpdateLastSeenAndOS`: refreshes last_seen + os, preserves id + joined_at (D-036)
- ✅ Existing node tests still pass (backward compatible)
- ✅ `TestDBCheck_IntegrityOK`: doctor db check reports migration 0006

## Security Verification

- ✅ CA key file mode 0600 enforced (`TestInit_FullBootstrap` checks mode)
- ✅ CA cert + server cert mode 0644 enforced (via `security.WriteCert`/`writeAtomic`)
- ✅ No secrets in logs (init output shows fingerprint prefixes, not full keys)
- ✅ `--json` output excludes private key material (only fingerprints)
- ✅ No new external dependencies (P1 is pure Go stdlib + existing deps)

## Quality Verification

- ✅ `go test -race -count=1 ./internal/store/... ./internal/cli/... ./internal/model/... ./internal/doctor/...` — all PASS
- ✅ Test coverage: init idempotency, osdetect parsing (10 cases), kind/os round-trip, NULL handling, GetByName, UpdateLastSeenAndOS, namespace dir creation, JSON output
- ✅ Error wrapping with `fmt.Errorf("...: %w", err)` (REQ-018 convention)
- ✅ `context.Context` propagation in all new I/O (REQ-017)
- ✅ No goroutine leaks (init is synchronous; no new goroutines)
- ✅ D-036 idempotency verified: 2× init run, no duplicate node, no cert regen

## Must-Have Checklist

- [x] `internal/store/migrations/0006_node_kind_os.sql`
- [x] `internal/model/node.go` — Kind + OS fields + NodeKind constants
- [x] `internal/store/node_repo.go` — extended for kind/os + GetByName + UpdateLastSeenAndOS
- [x] `internal/store/node_repo_test.go` — new tests for kind/os + helpers
- [x] `internal/cli/osdetect.go` — detectOS() from /etc/os-release
- [x] `internal/cli/osdetect_test.go` — 13 parsing + detection tests
- [x] `internal/cli/init.go` — full bootstrap sequence
- [x] `internal/cli/init_test.go` — idempotency + bootstrap tests
- [x] `internal/cli/namespace_test.go` — updated for new JSON format
- [x] `internal/doctor/doctor_test.go` — updated for migration 0006
- [x] `internal/store/migrate_test.go` — updated for migration 0006

## Escalations

None. All 4 verification layers pass cleanly.