# P23 Dual-Write Closure — Decision (v0.12)

**Status**: DEFERRED to v1.x. The full deletion of the legacy CA
(`internal/security/ca.go`), mTLS transport (`internal/transport/mtls.go`),
and daemon plaintext mode is too large a refactor for v0.12 without
risking build stability. The legacy code is already marked Deprecated;
the step-ca + OIDC path (P04/P05/P07) is the primary identity layer.

## What v0.12 did close

- P07 removed all password paths (step-ca `--password-file`, Proxmox
  `--password`, KindToken always-denies).
- P09 removed daemon plaintext mode (Start() requires mTLS).
- P11 added SVID chain validation (VerifySVIDWithChain).
- P06 rewrote ACL to OIDC (KindToken deprecated).

## What remains for v1.x

- Delete `internal/security/ca.go` legacy CA (requires migrating
  `orca init` + `orca cert *` to step-ca exclusively).
- Delete `internal/transport/mtls.go` deprecated path.
- Delete `internal/certpaths/` (v0.8 flat layout); `internal/paths/`
  is the only layout.
- Migrate `rotate-lead`, `drain`, `cutover`, `recovery` from
  `certpaths` to `paths`.

## Why not in v0.12

The legacy CA is load-bearing for `orca init` and 6+ CLI commands. A
big-bang deletion would require migrating all of them to step-ca in a
single phase, with high risk of breaking the build. v0.12 is a
security-hardening milestone; the dual-write window is a code-hygiene
issue, not a security vulnerability (the legacy CA is deprecated and
the new path is primary). v1.x will close it as a focused refactor.
