# PRD v0.11 Extension: Production Hardening

**Status**: This file EXTENDS (does not supersede) `PRD_v0.9.md`. The
16 load-bearing rules R-001…R-016 remain in effect; this file adds
R-017…R-020, adopted per operator decision Q1=A (2026-08-07) after
ingestion of 5 research documents covering ingress hardening, drift
detection, platform-engineer positioning, strategic framing, and the
systemd Path unit implementation.

## New load-bearing rules (R-017…R-020)

| ID | Rule |
|---|---|
| R-017 | Cluster ingress default is the hybrid: Traefik binds on `127.0.0.1:8443` (and `127.0.0.1:8080` for HTTP). Public `:443` / `:80` traffic is DNAT'd via nftables to Traefik. Cross-node cluster mesh stays on the cluster-internal private IP. Operators can opt out with `orca cluster config --public-binding=...`. Workloads can opt in to pure iptables with `service { ingress: native }`. In all cases, mTLS termination is unchanged: Traefik holds the certs. |
| R-018 | Default drift detection cadence is 60s. Operators can tune per-path: critical_paths (5s default, systemd Path units enabled), standard_paths (30s default), file_watch_paths (systemd Path units, event-driven, R-001-clean). |
| R-019 | Drift detector is a BACKSTOP. Primary failure detection is: systemd (`Type=notify`) for process state, Traefik health checks for routing state, step-ca cert notifications for cert expiry, Syncthing completion events for replication state. Drift detector exists to catch config divergence, not workload failures. |
| R-020 | Hard gate: applier refuses new txns if pre-flight consistency check fails. Drift must be resolved before new state is committed. Auto-remediation is enabled by default for critical config paths but disabled for systemd unit files (require operator approval). Override: `--force` flag + per-namespace scoping (a drifted peer in ns-A does not block ns-B). |

## Relationship to R-001…R-016

R-017…R-020 are *extensions*, not reversals. They are compatible with:
- R-001 (no Orca binary on servers) — systemd Path units are OS-native; nftables is OS-native; no Orca daemon introduced.
- R-006 (mTLS by default; Traefik load-bearing) — R-017 preserves Traefik as the mTLS termination point; only the binding address changes.
- R-007 (sockets by default) — unchanged; R-017 is about the public-ingress edge, not inter-workload sockets.
- R-010 (transactional control plane) — R-018/R-019/R-020 refine the txn plane's drift-detection contract (C-09).

## New D-series (D-215…D-237)

D-215…D-226 (ingress hybrid, doc 1) and D-227…D-237 (drift detection, doc 5)
are recorded in `PROJECT.md` § v0.11 Clarified Decisions. No collisions with
existing D-series (ends at D-206).

## Milestone scope

v0.11 "Production Hardening" — 23 phases (P00…P16). Research adds scope to
P09 (drift-event aggregation), P10 (drift detection + transactional plane),
and P15.5 (ingress hybrid + threat model). Five net-new CLI commands
(`orca cluster rotate-lead`, `orca upgrade`, `orca job migrate`,
`orca logs --all-nodes`, `orca doctor mTLS`) are folded into existing
phases per operator decision Q2=C. No new phases added (Q3=A folds ingress
into P15.5).
