# Ideation v0.12: Security Hardening (Zero-Trust Identity)

**Status**: 30 ideas accepted (0 skipped, 0 modified). All from Tier 1
(mechanical analysis of the threat-model review) and Tier 2
(backend-enriched prioritization). The `--ideate` flag was passed;
ideation ran between RESEARCH and PLAN per run.md Step 3.

## Tier 1 — Mechanical analysis

### 2.1 Git-native pattern mining

The v0.11 milestone shipped 24 phases with a threat model in P15.5
(gate C-19). The threat model identified residual risks but did not
close them -- it documented them for v1.x. The v0.12 ideation ingests
that threat model as the primary signal source.

**Repeated lessons** (from v0.8..v0.11 `---ci---` blocks):
- "Deprecated but still load-bearing" appears 6 times across v0.8..v0.11
  (legacy CA, mTLS transport, daemon, certpaths, step-ca password
  provisioner, `hmacSHA256` dead code). The dual-write window is the
  single largest attack-surface expander. -> **F16 / REQ-138**.
- "TOFU by default, pre-pin optional" appears 4 times (v0.6 SSH join,
  v0.8 host-key-fingerprint, v0.11 drift scripts). TOFU is a
  first-connect MITM risk. -> **F15 / REQ-139** (known_hosts tightening).
- "File modes checked at write, not at read" appears 3 times (v0.2
  cert modes, v0.5 namespace dirs, v0.11 master key). -> **F13 /
  REQ-130**.

**Low-confidence decisions** (confidence < 0.85 in `---ci---` blocks):
- D-007 (mTLS for v0.1, tokens deferred) -- 0.80. v0.12 closes the
  token gap via OIDC (no Orca-issued tokens; the IdP issues them).
- D-028 (repo visibility flip for public releases) -- 0.85. v0.12
  adds install.sh checksum verification (F14) as defense-in-depth.

**Escalation types**:
- `release_pending` (v0.8..v0.11 ship fallbacks) -- not security-relevant.
- `human_validation` (v0.11 C-19 threat model) -- v0.12 is the
  comprehensive closure of those documented risks.

**Compound solutions** (generalized patterns):
- The "shellQuote + regression test" pattern from v0.8 SSH trust
  hardening (REQ-058) generalizes to all SSH-exec interpolation sites
  (podman, wasm, aggregate.sh). -> **F3 / REQ-119**.
- The "atomic temp + chmod + fsync + rename" pattern from
  `WriteAtomic` (ca.go) generalizes to migration `copyFile` and
  backup restore. -> **F19 / REQ-137**.

**Partial requirements**: none (v0.11 shipped all REQs complete).

### 2.2 Coverage gap analysis

All v0.11 REQs are Complete. The v0.12 requirements are net-new from
the threat model -- no pending/in_progress REQs to close.

### 2.3 Verification layer inversion

- **Structural**: `internal/security/ca.go` (legacy CA) documented as
  deprecated but still compiled and load-bearing. -> F16.
- **Behavioral**: `internal/runtime/podman.go`, `wasm.go` have no
  command-injection regression tests. -> F3.
- **Security**: No STRIDE analysis for the OIDC/WebAuthn data flow
  (new in v0.12). -> addressed by REQ-142 (docs).
- **Quality**: `classifyDialErr` substring matching is a known code
  smell flagged in v0.9 research. -> F25.

### 2.4 Architectural drift detection

- `internal/acl/` exists but is not wired into any enforcement point
  (documented as "future" since v0.9). -> F1.
- `internal/identity/spiffe.go` `VerifySVID` skips chain validation
  (documented as "trust is implicit via SSH channel" in v0.11 P01.5
  spike result). -> F9.
- `internal/emitter/nft.go` ships SYN-flood + rate-limit but no
  conntrack/default-deny (the v0.11 emitter met the REQ but not
  defense-in-depth best practice). -> F21.

### 2.5 Spec-driven improvement

- R-021 ("no Orca credentials") is the new spec invariant. Every
  existing password/token surface is a spec violation under R-021.
  -> F1, F12, F17, REQ-144..148.
- The v0.11 PRD's deferred-v1.x list included "master.key
  passphrase-less 0600 (consider OS keyring in v1.x)." v0.12 closes
  this via seal-to-OIDC (no passphrase, no OS keyring dependency --
  OIDC is the unwrap mechanism).

## Tier 2 — Backend-enriched analysis

### 2.6 Prioritization

Ranked by (1) severity, (2) OS-surface exposure (per user instruction
"includes the operating system itself"), (3) ease of addressing:

1. **F3 command injection** (Critical, OS-touching, shellQuote is a
   well-understood fix) -> P01.
2. **F4 path traversal** (Critical, OS-touching, validateNamespaceName
   is trivial) -> P02.
3. **F5 txn arbitrary paths** (Critical, OS-touching, prefix allowlist)
   -> P03.
4. **F1 ACL unenforced** (Critical, foundational for OIDC authz) ->
   P06 (after P04/P05 identity).
5. **F6 daemon no auth** (High, OS-touching) -> P09.
6. **F2 audit not tamper-evident** (Critical, integrity) -> P10.
7. **F9 SVID no chain** (High, identity) -> P11.
8. **F7 backup symlink** (High, OS-touching) -> P12.
9. **F10 step-ca /tmp** (High, OS-touching) -> P13.
10. **F12 master key rotation** (High, crypto) -> P14.
11. **F11 aggregate.sh JSON injection** (High, OS-touching) -> P16.
12. **F14 install.sh no checksum** (High, OS-touching) -> P17.
13. **F21 nftables** (Medium, OS-touching) -> P18.
14. **F22 sudoers** (Medium, OS-touching) -> P19.
15. **F23 system user** (Medium, OS-touching) -> P20.
16. **F8 SQLite** (High, OS-touching) -> P21.
17. **F19 migration** (Medium, OS-touching) -> P22.
18. **F16 dual-write closure** (Medium, surface reduction) -> P23.
19. **F15/F25 transport** (Medium/Low) -> P24.
20. **F18 drift auth** (Medium) -> P25.
21. **Integration tests** (gate) -> P26.
22. **Docs** (gate) -> P27.
23. **Final review** (gate) -> P28.

The zero-trust identity work (P04 OIDC+Dex, P05 WebAuthn, P07 password
removal, P08 master key seal) is wave B because it's the architectural
foundation -- P06 (ACL) and P09 (daemon auth) depend on it.

### 2.7 Novel improvement suggestions

- **WebAuthn as the bundled password-free authenticator** (operator
  decision D-240). This is beyond pattern matching -- it's the
  strongest available authentication primitive and directly satisfies
  R-021. The `go-webauthn` library is mature; the custom Dex connector
  is ~300 LoC.
- **Shamir 3-of-5 master key recovery** (operator decision D-241).
  Standard threshold cryptography; no backdoor; documented residual
  risk.
- **Bundled Dex** (operator decision D-239). Zero-trust out of the
  box without external setup; BYO override preserves flexibility.

### 2.8 Chaos engineering ideation

- **What if the OIDC provider is unavailable?** -> `orca cluster
  unseal` fails; cluster runs on in-memory master key until shutdown
  (no new secrets operations). Shamir recovery if permanent. Doc'd.
- **What if a peer's drift event is forged?** -> REQ-140 (per-peer
  HMAC).
- **What if the master key is compromised?** -> REQ-129 (rotation,
  re-seal to OIDC). All historical secrets still compromised (no
  forward secrecy) -- documented residual risk.
- **What if install.sh is MITM'd?** -> REQ-132 (checksum+GPG).
- **What if the Gitea token leaks again?** -> C-32 (human-gate
  rotation before final ship); history scrub best-effort.

## Tier 3 — Cross-project pattern transfer

Single-project mode (only `orca` in `active_projects`). No
cross-project mining.

## Step 3 — Merge and deduplicate

30 ideas, all unique by `relatedReq` (REQ-119..REQ-148). No
duplicates. Sorted by severity then wave order (see Tier 2.6).

## Step 4 — Interactive validation

Under `autonomy.level=full` + `workflow.no_hitl=true`, all 30 ideas
are auto-accepted. The operator pre-approved the scope in the planning
conversation (comprehensive coverage including OS surface, bundled
Dex, WebAuthn, Shamir). 0 skipped, 0 modified.

## Step 5 — Long-term document updates

- `REQUIREMENTS.md`: REQ-119..REQ-148 added (done).
- `ROADMAP.md`: v0.12 milestone section added (next).
- `ARCHITECTURE.md`: zero-trust identity model + OIDC data-flow to be
  added in P27 (docs phase) -- not in Phase 0 to avoid scope creep.
- `PROJECT.md`: v0.12 scope summary + D-238..D-247 added (done).

## Step 6 — Ask-after-validation kickoff

The run workflow continues to PLAN -> GRILL -> ship Phase 0 ->
execute P01..P27 -> final P28. No separate kickoff needed (the
`--ideate` flag is consumed; ideas are already in REQUIREMENTS.md +
ROADMAP.md).
