docs(P00): ideation - 34 ideas accepted

v0.2 IDEATE stage. 29 new ideas generated (10 Tier 1 mechanical + 11
Tier 2 backend-enriched + 8 Tier 3 cross-project) plus 6 research-stage
candidates (REQ-cand-A..F from commit 08d321f) = 35 considered. Under
full autonomy, all 35 with confidence >= 0.60 are auto-accepted; 1
explicitly deferred to v0.3 (I-308 pprof). 34 accepted into v0.2.

Resulting net-new REQs (REQ-025..REQ-040) span P01-P04:
- P01 (mTLS): REQ-025 (cert rotation history), REQ-026 (CA fingerprint
  pinning), REQ-032 (orca doctor), REQ-033 (file mode enforcement),
  REQ-034 (rotation alarm), REQ-035 (cert show redaction), REQ-036
  (SAN validation), REQ-038 (mTLS failure log fields)
- P02 (multi-node): REQ-028 (NodeCapacity HCL schema, P02 enabler),
  REQ-037 (X-Orca-Idempotency-Key)
- P03 (security CI): REQ-027 (govulncheck offline mode -- changes P03
  scope: CI must not call vuln.go.dev), REQ-029 (gitleaks baseline for
  pre-existing .env leak), REQ-039 (.gitleaks.toml stopwords),
  REQ-040 (.golangci.yml)
- P04 (iter.Seq): REQ-030 (--watch --json mode)
- Cross-cutting: REQ-031 (go test -race)

Total v0.2 REQs: 20 (4 carried from v0.1 + 16 net-new).

ARCHITECTURE.md: added `internal/doctor/` component (§5) with
orca doctor {cert,network,db} subcommands; ASCII diagram updated.
ROADMAP.md: per-phase REQ coverage matrix added; P03 scope change
documented (govulncheck offline mode).
PROJECT.md: unchanged (vision is stable).

---ci---
project: orca
phase: 0
milestone: v0.2
status: ideate
---/ci---

.ciagent/REQUIREMENTS.md

@@ -37,6 +37,44 @@
 
 ## Milestone v0.2: Networking, Observability, Security Hardening
 
-**Status: In Progress** — SPECIFY stage committed. 4 phases (P01–P04) covering mTLS, multi-node scheduling, security scanning, and streaming I/O.
+**Status: In Progress** — IDEATE stage complete on `main`. 4 phases (P01–P04) covering mTLS, multi-node scheduling, security scanning, and streaming I/O.
 
-Pending v0.2 REQs (carried over from v0.1 deferral): REQ-011, REQ-014, REQ-022, REQ-023. New v0.2 REQs will be added by the IDEATE stage.
+### v0.2 requirements (carried over from v0.1 deferral)
+
+| ID | Requirement | Priority | Phase | Source |
+|----|-------------|----------|-------|--------|
+| REQ-011 | mTLS for inter-node communication | Medium | P01 | v0.1 deferral |
+| REQ-014 | `gosec` + `govulncheck` in CI pipeline | High | P03 | v0.1 deferral |
+| REQ-022 | `iter.Seq` for streaming job lists (Go 1.25+) | Low | P04 | v0.1 deferral |
+| REQ-023 | Self-signed mTLS cert generation | Medium | P01 (paired with REQ-011) | v0.1 deferral |
+
+### v0.2 requirements (added by IDEATE stage, commit pending)
+
+| ID | Requirement | Priority | Phase | Source idea |
+|----|-------------|----------|-------|-------------|
+| REQ-025 | Bounded cert rotation history: retain last N=3 server certs per node for rollback | Medium | P01 | I-201 (REQ-cand-A) |
+| REQ-026 | Trusted-CA fingerprint pinned in config; daemon refuses to start on mismatch | High | P01 | I-202 (REQ-cand-B) |
+| REQ-027 | `govulncheck` runs in offline mode in CI (no `vuln.go.dev` calls; pre-mirrored DB or `-format json` + `jq` gate) | High | P03 | I-101 (REQ-cand-C) |
+| REQ-028 | HCL/YAML schema for `NodeCapacity` declaration (`orca node join` flag and/or `~/.orca/node.hcl`) | High | P02 | I-203 (REQ-cand-D) |
+| REQ-029 | `gitleaks` baseline file committed to repo to suppress pre-existing `.env` SHA-1 leak in git history | Medium | P03 | I-102 (REQ-cand-E) |
+| REQ-030 | `--watch` output format mode: table (default) vs streaming one-line JSON per event | Low | P04 | I-204 (REQ-cand-F) |
+| REQ-031 | `go test -race` enabled in CI for all v0.2 packages | High | P01–P04 (cross-cutting) | I-103 |
+| REQ-032 | `orca doctor` subcommand for diagnostics (CA/cert health, db integrity, peer reachability) | Medium | P01 (initial) | I-301 |
+| REQ-033 | Cert file mode enforcement: 0600 for keys, 0644 for certs (refuses to start on violation) | High | P01 | I-104 |
+| REQ-034 | Cert proactive rotation alarm: structured slog WARN 30 days before `not_after` | Medium | P01 | I-205 |
+| REQ-035 | `orca cert show` redacts private key material from default and `--json` output | High | P01 | I-105 |
+| REQ-036 | Server cert SAN validation: SAN entries (DNS + IP) populated at sign-time; refuses to sign a CSR without them | High | P01 | I-106 |
+| REQ-037 | `X-Orca-Idempotency-Key` header on cross-node POST; dispatcher retries only when header is present | Medium | P02 | I-206 |
+| REQ-038 | Structured slog fields for mTLS failures: `event=mtls.handshake`, `peer`, `cert_fp`, `err` | Medium | P01 | I-302 |
+| REQ-039 | `.gitleaks.toml` extended with stopwords for test data paths and CA cert PEM blocks | Medium | P03 | I-303 |
+| REQ-040 | `.golangci.yml` unified lint config superseding per-tool invocations | Low | P03 | I-304 |
+
+### v0.2 totals
+
+- 4 carried over from v0.1 (REQ-011, REQ-014, REQ-022, REQ-023)
+- 16 net-new from IDEATE (REQ-025..REQ-040)
+- **20 total v0.2 requirements**
+
+### v0.2 deferred to v0.3
+
+- pprof endpoint on `orca daemon` (idea I-308, 0.70 confidence): deferred to keep v0.2 lean; revisit in v0.3 once P02's dispatcher is stable.