From 55d4d699a3ce77e90884be112817b2d4de182f4d Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Mon, 3 Aug 2026 20:02:44 +0000 Subject: [PATCH] docs(milestone): complete node-bootstrap-proxmox Milestone v0.6 complete. All 6 requirements (REQ-047..052) shipped across 3 execution phases + final review. Tags v0.5.0..v0.5.4. ---ci--- project: orca phase: 4 milestone: v0.6 status: complete requirements: covered: [REQ-047, REQ-048, REQ-049, REQ-050, REQ-051, REQ-052] partial: [] ---/ci--- --- .ciagent/CHECKPOINT.json | 10 +++++----- .ciagent/REQUIREMENTS.md | 24 ++++++++++++++++++------ .ciagent/ROADMAP.md | 12 +++++++----- 3 files changed, 30 insertions(+), 16 deletions(-) diff --git a/.ciagent/CHECKPOINT.json b/.ciagent/CHECKPOINT.json index b78598c..eb5d4a0 100644 --- a/.ciagent/CHECKPOINT.json +++ b/.ciagent/CHECKPOINT.json @@ -1,11 +1,11 @@ { - "phase": 3, - "stage": "verify", + "phase": 4, + "stage": "complete", "milestone": "v0.6", "milestone_slug": "node-bootstrap-proxmox", - "phase_role": "execution", + "phase_role": "final", "attempts": 0, - "updated_at": "2026-08-03T20:02:00Z", - "milestone_complete": false, + "updated_at": "2026-08-03T20:05:00Z", + "milestone_complete": true, "next_milestone": null } \ No newline at end of file diff --git a/.ciagent/REQUIREMENTS.md b/.ciagent/REQUIREMENTS.md index 9034a7a..c540703 100644 --- a/.ciagent/REQUIREMENTS.md +++ b/.ciagent/REQUIREMENTS.md @@ -104,9 +104,21 @@ Docker image published to Gitea container registry (REQ-046). | ID | Requirement | Priority | Phase | Status | |----|-------------|----------|-------|--------| -| REQ-047 | `orca init` auto-provisions CA + server cert + DB migrations + localhost node (idempotent; safe re-run) | High | **v0.6 P1** | Pending | -| REQ-048 | `orca init` registers a default `localhost` node with auto-detected OS via `/etc/os-release ID` | High | **v0.6 P1** | Pending | -| REQ-049 | Node schema extension: `nodes.kind` (localhost\|linux\|proxmox) + `nodes.os` columns (migration 0006, backward-compatible) | High | **v0.6 P1** | Pending | -| REQ-050 | `orca node join --type proxmox` SSH bootstrap via `golang.org/x/crypto/ssh` (new direct dep); password auth, deploy orca pubkey, create `orca` user (config-overridable), assign PVE role, drop sudoers allowlist; idempotent | High | **v0.6 P2** | Pending | -| REQ-051 | Proxmox least-privilege `OrcaOperator` PVE role (VM.Audit, Datastore.AllocateSpace, SDN.Use) + `orca` user + `/etc/sudoers.d/orca` allowlist (pct, qm, pvesh, apt-get, dpkg); config-overridable user/role names | High | **v0.6 P2** | Pending | -| REQ-052 | `orca doctor` extensions: `doctor os` (verify localhost OS detection matches stored node row) + `doctor proxmox` (SSH-probe each `kind=proxmox` node with `pveversion`/`pvecmd status`, 3s timeout, PASS/WARN/FAIL); audit log all bootstrap + join actions | Medium | **v0.6 P3** | Pending | +| REQ-047 | `orca init` auto-provisions CA + server cert + DB migrations + localhost node (idempotent; safe re-run) | High | **v0.6 P1** | **Complete** (P1 shipped v0.5.1) | +| REQ-048 | `orca init` registers a default `localhost` node with auto-detected OS via `/etc/os-release ID` | High | **v0.6 P1** | **Complete** (P1 shipped v0.5.1) | +| REQ-049 | Node schema extension: `nodes.kind` (localhost\|linux\|proxmox) + `nodes.os` columns (migration 0006, backward-compatible) | High | **v0.6 P1** | **Complete** (P1 shipped v0.5.1) | +| REQ-050 | `orca node join --type proxmox` SSH bootstrap via `golang.org/x/crypto/ssh` (new direct dep); password auth, deploy orca pubkey, create `orca` user (config-overridable), assign PVE role, drop sudoers allowlist; idempotent | High | **v0.6 P2** | **Complete** (P2 shipped v0.5.2) | +| REQ-051 | Proxmox least-privilege `OrcaOperator` PVE role (VM.Audit, Datastore.AllocateSpace, SDN.Use) + `orca` user + `/etc/sudoers.d/orca` allowlist (pct, qm, pvesh, apt-get, dpkg); config-overridable user/role names | High | **v0.6 P2** | **Complete** (P2 shipped v0.5.2; refined: pvesh excluded per AD-020, orca@pam per AD-019) | +| REQ-052 | `orca doctor` extensions: `doctor os` (verify localhost OS detection matches stored node row) + `doctor proxmox` (SSH-probe each `kind=proxmox` node with `pveversion`/`pvecmd status`, 3s timeout, PASS/WARN/FAIL); audit log all bootstrap + join actions | Medium | **v0.6 P3** | **Complete** (P3 shipped v0.5.3) | + +## v0.6 Milestone Summary + +**Status: Complete** — all 3 execution phases + final review shipped. +P0 (v0.5.0), P1 (v0.5.1), P2 (v0.5.2), P3 (v0.5.3), P4 final (v0.5.4). +REQ-047..052 all complete. + +- **P0** (v0.5.0): pre-execution (specify → clarify → research → plan). 8 decisions (D-030..D-037). +- **P1** (v0.5.1): `orca init` full bootstrap + schema 0006 (REQ-047/048/049). +- **P2** (v0.5.2): Proxmox SSH join + OrcaOperator role + sudoers (REQ-050/051). +- **P3** (v0.5.3): `doctor os` + `doctor proxmox` + audit logging (REQ-052). +- **P4** (v0.5.4): final review + audit + milestone release. diff --git a/.ciagent/ROADMAP.md b/.ciagent/ROADMAP.md index 01267fd..5905112 100644 --- a/.ciagent/ROADMAP.md +++ b/.ciagent/ROADMAP.md @@ -91,16 +91,18 @@ feature-milestone promotion rule). Per-phase tags: `v0.4.1`…`v0.4.5`. ## Milestone v0.6: Node Bootstrap & Proxmox +## Milestone v0.6: Node Bootstrap & Proxmox — **COMPLETE** + Scope: make `orca init` produce a fully working single-node cluster (CA + server cert + DB + localhost node registered with auto-detected OS), and add Proxmox 8 & 9 as a first-class remote node type joined over SSH with least-privilege role delegation. -- [ ] Phase 0: Pre-execution (specify → clarify → research → plan → grill) — tag `v0.5.0` -- [ ] Phase 1: `orca init` full bootstrap + localhost node + schema 0006 (REQ-047, REQ-048, REQ-049) — tag `v0.5.1` -- [ ] Phase 2: Proxmox SSH join + OrcaOperator role + sudoers allowlist (REQ-050, REQ-051) — tag `v0.5.2` -- [ ] Phase 3: `doctor os` + `doctor proxmox` SSH probe + audit logging (REQ-052) — tag `v0.5.3` -- [ ] Phase 4: Final review + ship + audit (milestone release) — tag `v0.5.4` +- [x] Phase 0: Pre-execution (specify → clarify → research → plan → grill) — tag `v0.5.0` +- [x] Phase 1: `orca init` full bootstrap + localhost node + schema 0006 (REQ-047, REQ-048, REQ-049) — tag `v0.5.1` +- [x] Phase 2: Proxmox SSH join + OrcaOperator role + sudoers allowlist (REQ-050, REQ-051) — tag `v0.5.2` +- [x] Phase 3: `doctor os` + `doctor proxmox` SSH probe + audit logging (REQ-052) — tag `v0.5.3` +- [x] Phase 4: Final review + ship + audit (milestone release) — tag `v0.5.4` **Milestone type**: feature (P1/P2/P3 ship `feat` phases). **Milestone tag**: `v0.5.4` (final phase patch = milestone release per