# Phase 4 Verification Report — v0.7: --pprof Opt-in on orca daemon

**Phase**: 4  
**Branch**: `phase/04-pprof-daemon`  
**REQ Coverage**: REQ-056  
**Milestone**: v0.7 (Hardening & Completion)

## Structural Verification

### Files Created
- `internal/daemon/pprof.go` — `StartPprof(addr, log) (*http.Server, error)`: dedicated mux + server, disabled by default, WARN log
- `internal/daemon/pprof_test.go` — 5 tests (disabled, enabled, shutdown, mux isolation, full server lifecycle)
- `internal/cli/daemon_test.go` — `TestDaemonPprofFlag` (flag registration + default)

### Files Modified
- `internal/daemon/server.go` — `PprofAddr` in Options, `pprofServer` field, `NewServer` starts pprof, `Shutdown` stops both
- `internal/cli/daemon.go` — `--pprof` flag, `PprofAddr` in daemon.Options, conditional startup output line

## Behavioral Verification

### Test Results
```
go test ./...               → all PASS (exit 0)
go test -race ./internal/daemon/... ./internal/cli/... → all PASS
go vet ./...                → clean
make build                  → clean
```

### CLI Verification
```
./bin/orca daemon --help → shows --pprof string flag (default "")
```

### Live Smoke Test
- `--pprof 127.0.0.1:16060` → WARN logged, `/debug/pprof/` returns 200, `/debug/pprof/cmdline` 200, `/debug/pprof/heap` 200
- `/healthz` on pprof listener → 404 (mux isolation confirmed, AD-024)
- Clean shutdown stops both servers

## Security Verification

- pprof on a **separate** `*http.Server` + `*http.ServeMux`, never on the mTLS daemon listener (AD-024) — verified by `TestStartPprof_MuxIsolated` (`/healthz` returns 404 on pprof mux)
- Default **disabled** — no pprof listener unless `--pprof` is explicitly set
- WARN log on startup: "unauthenticated, operator-only — do not expose publicly"
- No `import _ "net/http/pprof"` side-effect registration on `DefaultServeMux` — all handlers explicitly registered on the dedicated mux

## Quality Verification

- No new dependencies (stdlib `net/http`, `net/http/pprof`, `log/slog`, `time` only)
- No comments added (per project convention)
- `go.mod` unchanged
- Test style matches existing `server_test.go`

## Must-Haves Checklist

- [x] `internal/daemon/pprof.go` — `StartPprof` with dedicated mux, all pprof handlers
- [x] `internal/daemon/server.go` — `PprofAddr` in Options, `pprofServer` field, lifecycle integration
- [x] `internal/cli/daemon.go` — `--pprof` flag, passed to Options, conditional startup output
- [x] `internal/daemon/pprof_test.go` — 5 tests (disabled, enabled, shutdown, mux isolation, lifecycle)
- [x] `internal/cli/daemon_test.go` — flag registration test
- [x] AD-024: pprof mux separate from mTLS daemon mux (verified by test)

## Verdict

**PASS** — all 4 verification layers pass. REQ-056 is fully covered. The `--pprof` opt-in endpoint runs on a separate listener with a dedicated mux, is disabled by default, and logs a WARN when enabled. I-308 (deferred since v0.2) is now implemented.