verify(P01): 4-layer verification PASS — REQ-057 covered

---ci---
project: orca
phase: 1
milestone: v0.8
status: verify
requirements:
  covered: [REQ-057]
  partial: []
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,22 +1,11 @@
 {
   "phase": 1,
-  "stage": "execute",
+  "stage": "verify",
   "milestone": "v0.8",
   "milestone_slug": "coverage-trust-hardening",
   "phase_role": "execution",
   "attempts": 0,
-  "updated_at": "2026-08-04T00:55:00Z",
+  "updated_at": "2026-08-04T00:58:00Z",
   "milestone_complete": false,
-  "next_milestone": null,
-  "coverage": {
-    "internal/engine": "88.9%",
-    "internal/proxmox": "87.1%",
-    "internal/cli": "76.2%",
-    "internal/transport": "93.0%",
-    "internal/store": "84.7%",
-    "internal/jobspec": "90.5%",
-    "internal/audit": "100.0%",
-    "internal/certpaths": "100.0%",
-    "cmd/orca": "80.0%"
-  }
+  "next_milestone": null
 }

.ciagent/PHASE1_VERIFICATION_v0.8.md

@@ -0,0 +1,55 @@
+# Phase 1 Verification — v0.8 Coverage & Trust Hardening
+
+**Phase**: P01 — Coverage uplift round 2
+**Milestone**: v0.8
+**REQ**: REQ-057
+**Date**: 2026-08-04
+**Result**: ✅ PASS (all 4 layers)
+
+## Layer 1 — Structural ✅
+
+- `go build ./...` PASS (no compile errors)
+- `go vet ./...` PASS (no warnings)
+- No TODOs/FIXMEs/stubs in production code (the 3 pre-existing placeholders in `internal/cli/job.go:78`, `internal/engine/scheduler.go:115`, `internal/security/tls_config.go:90` are unchanged from v0.7 and out of scope for P01)
+- All test files resolve imports correctly
+- The proxmox `sessionRunner` seam (T01.1) is backward compatible — `BootstrapProxmox` callers unchanged
+
+## Layer 2 — Behavioral ✅
+
+- `go test ./...` PASS (all 14 packages)
+- `go test -race ./...` PASS (cli 98s, engine 47s, store 88s, transport 22s, all others fast)
+- Coverage targets met (T01.12):
+  - ≥70% floor: engine 88.9%, proxmox 87.1%, cli 76.2%, transport 93.0%, store 84.7%, jobspec 90.5%
+  - ≥50% floor: audit 100.0%, certpaths 100.0%, cmd/orca 80.0%
+- GRILL condition #3 escape valve NOT needed (cli hit 76.2%, above 70%)
+- T01.2 (conditional `peerDispatcher` seam) NOT added — engine reached 88.9% via httptest + stubs
+- REQ-057 covered: all 9 target packages hit their tiered floor
+
+## Layer 3 — Security ✅
+
+- P01 is a test-only phase (the only production change is T01.1's `sessionRunner` interface extraction + T01.11's `main()→run()` refactor)
+- No new input paths, no new network surfaces, no new crypto
+- The `sessionRunner` seam does not leak test concerns into production (default `sshSessionRunner` wraps the real SSH session; the seam is only injectable via the package-level var pattern matching `sshDialer`)
+- `cmd/orca/main.go` refactor: `run() int` returns exit code; `main()` calls `os.Exit(run())` — no security impact (same behavior, testable)
+- No secrets in test code (all test DBs use `:memory:` or temp dirs; no real credentials)
+
+## Layer 4 — Quality ✅
+
+- Tests follow existing conventions (table-driven, `t.Run` subtests, `t.Helper()` in setup funcs)
+- Reuse of existing helpers: `openTestDB`, `withFastWatch`, `initTestEnv`, `resetRootFlags`, `discardWriter`, `stubDispatcher` pattern
+- No flaky tests detected (all pass on repeated runs with `-race`)
+- Test file naming follows `*_test.go` convention
+- No over-testing: daemon.go excluded from cli coverage (covered by `internal/daemon/server_test.go`)
+- P0 issues: none. P1+ issues: none flagged.
+
+## Requirement Coverage
+
+| REQ | Status | Evidence |
+|-----|--------|----------|
+| REQ-057 | ✅ Complete | All 9 packages hit tiered floor; `go test -cover` confirms; `go test -race` PASS |
+
+## Lessons
+
+- The `sessionRunner` seam pattern (package-level var + default init in entry func) is the canonical way to add testability to orca's SSH-dependent packages. Future SSH-adjacent packages should follow it.
+- `httptest.NewTLSServer` sufficed for engine 70% without needing the conditional `peerDispatcher` seam — the plan's "only if needed" guard worked as intended.
+- The cli package's 84s test time is dominated by `--watch` integration tests with real poll intervals. Future coverage work should consider reducing the `withFastWatch` interval further or extracting the watch logic for unit-level testing.