diff --git a/.ciagent/CHECKPOINT.json b/.ciagent/CHECKPOINT.json
index 18d4551..d5164c6 100644
--- a/.ciagent/CHECKPOINT.json
+++ b/.ciagent/CHECKPOINT.json
@@ -1,11 +1,11 @@
 {
-  "phase": 0,
+  "phase": 1,
   "stage": "complete",
   "milestone": "v0.7",
   "milestone_slug": "hardening-completion",
-  "phase_role": "pre_execution",
+  "phase_role": "execution",
   "attempts": 0,
-  "updated_at": "2026-08-03T23:55:00Z",
+  "updated_at": "2026-08-04T00:05:00Z",
   "milestone_complete": false,
   "next_milestone": null
 }
\ No newline at end of file
diff --git a/.ciagent/REQUIREMENTS.md b/.ciagent/REQUIREMENTS.md
index a465f34..cccfd3b 100644
--- a/.ciagent/REQUIREMENTS.md
+++ b/.ciagent/REQUIREMENTS.md
@@ -127,7 +127,7 @@ REQ-047..052 all complete.
 
 | ID | Requirement | Priority | Phase | Status |
 |----|-------------|----------|-------|--------|
-| REQ-053 | `orca cert` command tree registered on root command (`cert ca-init`, `cert gen`, `cert show`, `cert renew`, `cert fingerprint`) — code exists in `internal/cli/cert.go` but is never AddCommand'd; unreachable today | High | **v0.7 P1** | Pending |
+| REQ-053 | `orca cert` command tree registered on root command (`cert ca-init`, `cert gen`, `cert show`, `cert renew`, `cert fingerprint`) — code exists in `internal/cli/cert.go` but is never AddCommand'd; unreachable today | High | **v0.7 P1** | **Complete** (P1 shipped v0.6.1) |
 | REQ-054 | HCL config file parsing: `internal/config` package loads `~/.orca/config.hcl` / `/etc/orca/orca.hcl` (keys: db_path, listen_addr, ca_path, server_cert_path, server_key_path, node_capacity); merge precedence flag > env > file > default; `--config` flag on root command | High | **v0.7 P2** | Pending |
 | REQ-055 | Test coverage uplift: every package ≥ 50% — adds tests for `internal/engine` (executor, dispatcher, peer), `internal/transport` (mtls, dispatch, handshake_log), `internal/proxmox` (bootstrap SSH path), `internal/audit` | Medium | **v0.7 P3** | Pending |
 | REQ-056 | `--pprof <addr>` opt-in flag on `orca daemon` (default disabled); `net/http/pprof` mounted on a separate mux, never on the mTLS daemon listener | Low | **v0.7 P4** | Pending |
diff --git a/.ciagent/ROADMAP.md b/.ciagent/ROADMAP.md
index 2bc7d55..b9bebfa 100644
--- a/.ciagent/ROADMAP.md
+++ b/.ciagent/ROADMAP.md
@@ -120,7 +120,7 @@ an unreachable command tree, a missing config file layer, low test
 coverage in core packages, and the long-deferred pprof endpoint.
 
 - [x] Phase 0: Pre-execution (specify → clarify → research → ideate → plan) — tag `v0.6.0` (shipped)
-- [ ] Phase 1: Register `orca cert` command tree + cert_repo tests (REQ-053) — tag `v0.6.1`
+- [x] Phase 1: Register `orca cert` command tree + cert_repo tests (REQ-053) — tag `v0.6.1` (shipped)
 - [ ] Phase 2: HCL config file parsing — `internal/config` package (REQ-054) — tag `v0.6.2`
 - [ ] Phase 3: Test coverage uplift — engine/transport/proxmox/audit ≥ 50% (REQ-055) — tag `v0.6.3`
 - [ ] Phase 4: `--pprof` opt-in on `orca daemon` (REQ-056) — tag `v0.6.4`