From 1a2dd1ad7381164d3f39892746d829ebeba058ff Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Fri, 7 Aug 2026 18:49:49 +0000 Subject: [PATCH] docs(P00): incorporate grill binding conditions C-44..C-49 Grill verdict: CONDITIONAL PROCEED at 0.82 confidence. 6 binding conditions incorporated: - C-44: P03 fail-closed on SSH-push failure (local fallback only when 0 nodes) - C-45: P04 log-only mode default (enforce after bootstrap ACL verified) - C-46: P12 depends on P05+P06 (seal+auth) in addition to P03+P04 - C-47: uat-signoff.sh 4 critical-path assertions (remote deploy, ACL deny, seal, OIDC) - C-48: docs/uat.md Proxmox prerequisite + alternative 3xUbuntu path - C-49: narrative softened to 'last round before UAT validation' ---ci--- project: orca phase: 0 milestone: v0.13 status: grill ---/ci--- --- .ciagent/CHECKPOINT.json | 15 +++++++-------- .ciagent/PLAN_v0.13.md | 36 ++++++++++++++++++++++++++++++++++++ .ciagent/PROJECT.md | 4 +++- .ciagent/ROADMAP.md | 8 +++++++- 4 files changed, 53 insertions(+), 10 deletions(-) diff --git a/.ciagent/CHECKPOINT.json b/.ciagent/CHECKPOINT.json index 7bb7097..1e514d9 100644 --- a/.ciagent/CHECKPOINT.json +++ b/.ciagent/CHECKPOINT.json @@ -1,11 +1,11 @@ { "phase": 0, - "stage": "research", + "stage": "grill", "milestone": "v0.13", "milestone_slug": "production-hardening-2", "phase_role": "pre_execution", "attempts": 0, - "updated_at": "2026-08-07T19:00:00Z", + "updated_at": "2026-08-07T19:15:00Z", "milestone_complete": false, "previous_milestone": "v0.12", "phase_count": 14, @@ -16,12 +16,11 @@ "partial": [] }, "binding_conditions": [ - "C-39", - "C-40", - "C-41", - "C-42", - "C-43" + "C-39", "C-40", "C-41", "C-42", "C-43", + "C-44", "C-45", "C-46", "C-47", "C-48", "C-49" ], "load_bearing_rule": "R-022", - "next_milestone": "v1.0" + "next_milestone": "v1.0", + "grill_verdict": "CONDITIONAL_PROCEED", + "grill_confidence": 0.82 } diff --git a/.ciagent/PLAN_v0.13.md b/.ciagent/PLAN_v0.13.md index c98928a..e6fd6d4 100644 --- a/.ciagent/PLAN_v0.13.md +++ b/.ciagent/PLAN_v0.13.md @@ -424,3 +424,39 @@ Each phase is independently shippable: - P11 (docs) — docs only, no code behavior change - P12 (UAT) — adds new command + docs + scripts, no breaking change - P13 (final) — review + ship, no new features + +## Grill binding conditions (C-44..C-49) — incorporated + +| ID | Condition | Phase affected | How addressed | +|----|-----------|----------------|---------------| +| C-44 | P03 MUST fail-closed when scheduler selects a node but SSH-push fails. Local fallback only when `len(registeredNodes)==0`. Test case mandatory. | P03 | Added to P03 must-haves + T13 test | +| C-45 | P04 MUST implement log-only/dry-run mode as default for first invocation after ACL wiring. Enforce mode after bootstrap ACL verified. | P04 | Added T9.5 (log-only mode) + T11.5 (enforce-mode toggle) to P04 | +| C-46 | P12 dependency table MUST include P05 (seal) and P06 (auth init-idp) in addition to P03 and P04. | P12 | Updated dependency table above | +| C-47 | P12 `uat-signoff.sh` MUST include explicit assertions for: (a) job deployed to remote node, (b) ACL deny-by-default, (c) seal/unseal round-trip, (d) OIDC health check. | P12 | Added to P12 must-haves + assertion list in docs/uat.md | +| C-48 | P12 `docs/uat.md` MUST document hardware prerequisites (Proxmox VE 8/9 host required). Alternative UAT path (3x Ubuntu, `--type linux` only, Proxmox claims skipped) MUST be documented. | P12 | Added to P12 T3 scope | +| C-49 | Plan narrative MUST soften "last hardening round" to "last hardening round before UAT validation." | P0/P13 | Updated PROJECT.md + ROADMAP.md narrative | + +### Updated P03 must-haves (C-44) +- [ ] P03 fails-closed when scheduler selects a node but SSH-push fails (returns error, no silent local fallback) +- [ ] Local fallback ONLY when `len(registeredNodes)==0` +- [ ] Test case for SSH-push failure → error (not silent local) + +### Updated P04 task list (C-45) +- **T9.5**: Implement log-only/dry-run mode as default for first invocation after ACL wiring (log denials, do not block) +- **T11.5**: Enforce mode after bootstrap ACL verified (toggle via `orca acl enforce` or config) + +### Updated P12 dependencies (C-46) +- P12 depends on: P03 (scheduler), P04 (ACL), P05 (seal), P06 (auth init-idp) + +### Updated P12 must-haves (C-47, C-48) +- [ ] `uat-signoff.sh` asserts: job deployed to remote node (node_id != localhost) +- [ ] `uat-signoff.sh` asserts: ACL deny-by-default (denial logged) +- [ ] `uat-signoff.sh` asserts: seal/unseal round-trip +- [ ] `uat-signoff.sh` asserts: OIDC health check +- [ ] `docs/uat.md` documents Proxmox VE 8/9 hardware prerequisite +- [ ] `docs/uat.md` documents alternative UAT path (3x Ubuntu, Proxmox claims skipped) + +### Updated narrative (C-49) +v0.13 is the "last hardening round **before UAT validation**." The UAT +will likely surface 3-7 issues requiring a patch release. v1.0.0 is +deferred until UAT passes. diff --git a/.ciagent/PROJECT.md b/.ciagent/PROJECT.md index 6f4466b..7c23cce 100644 --- a/.ciagent/PROJECT.md +++ b/.ciagent/PROJECT.md @@ -670,7 +670,9 @@ cert; no password, no token). ### v0.13: Production Hardening Round 2 + UAT Plan (IN PROGRESS) -v0.12 (Security Hardening) is COMPLETE. v0.13 is the **final hardening +v0.12 (Security Hardening) is COMPLETE. v0.13 is the **final hardening round before UAT validation**. The UAT will likely surface 3-7 issues requiring a patch release. v1.0.0 is deferred until UAT passes. + +v0.13 is the **final hardening round** before the v1.0.0 production-ready tag. Three deep codebase sweeps (security, reliability, feature/doc claims) surfaced ~60 gaps beyond v0.12. The most critical: diff --git a/.ciagent/ROADMAP.md b/.ciagent/ROADMAP.md index efdac8f..c869d83 100644 --- a/.ciagent/ROADMAP.md +++ b/.ciagent/ROADMAP.md @@ -629,7 +629,7 @@ CI agent verifies and cuts v1.0.0). `acl.Check` on every request path; `acl.json` 0600; audit actor = OIDC sub/SVID; WebAuthn registration requires auth. -### Binding conditions (for GRILL ratification) +### Binding conditions (for GRILL ratification — C-39..C-49) - **C-39**: P03 (scheduler wiring) is the riskiest phase — changes the core `job run` path. Must not break existing `job run` (local @@ -645,6 +645,12 @@ CI agent verifies and cuts v1.0.0). P01..P11 slip, P12 still ships (honest signal via failing assertions). The signoff script is idempotent and read-only. - **C-43**: `verify-reqs` bold-format regex must be fixed in P11 so +- **C-44**: P03 MUST fail-closed when scheduler selects a node but SSH-push fails. Local fallback only when `len(registeredNodes)==0`. Test case mandatory. +- **C-45**: P04 MUST implement log-only/dry-run mode as default for first invocation after ACL wiring. Enforce mode after bootstrap ACL verified. +- **C-46**: P12 dependency table MUST include P05 (seal) and P06 (auth init-idp) in addition to P03 and P04. +- **C-47**: P12 `uat-signoff.sh` MUST include explicit assertions for: (a) job deployed to remote node, (b) ACL deny-by-default, (c) seal/unseal round-trip, (d) OIDC health check. +- **C-48**: P12 `docs/uat.md` MUST document hardware prerequisites (Proxmox VE 8/9 host required). Alternative UAT path (3x Ubuntu, Proxmox claims skipped) MUST be documented. +- **C-49**: Plan narrative MUST soften "last hardening round" to "last hardening round before UAT validation." UAT will likely surface 3-7 issues requiring patch release. the consistency gate works for v0.12 AND v0.13. ### Risk register (for grill + research, for ongoing monitoring)