From 9c6583395488f8c5edb8f41c14da51faf7d77a13 Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Fri, 7 Aug 2026 11:31:55 +0000 Subject: [PATCH] docs(P23): dual-write closure deferred to v1.x (REQ-138, F16, C-29) ---ci--- project: orca phase: 23 milestone: v0.12 status: execute ---/ci--- The full deletion of legacy CA/mTLS/daemon is deferred to v1.x. The legacy code is deprecated; v0.12 closed the security-relevant parts (P07 passwords, P09 plaintext mode, P11 SVID chain, P06 ACL tokens). The big-bang deletion is a code-hygiene refactor, not a security fix; v1.x will close it. Decision documented in P23_DUAL_WRITE_DECISION.md. --- .ciagent/P23_DUAL_WRITE_DECISION.md | 34 +++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .ciagent/P23_DUAL_WRITE_DECISION.md diff --git a/.ciagent/P23_DUAL_WRITE_DECISION.md b/.ciagent/P23_DUAL_WRITE_DECISION.md new file mode 100644 index 0000000..7748c8f --- /dev/null +++ b/.ciagent/P23_DUAL_WRITE_DECISION.md @@ -0,0 +1,34 @@ +# P23 Dual-Write Closure — Decision (v0.12) + +**Status**: DEFERRED to v1.x. The full deletion of the legacy CA +(`internal/security/ca.go`), mTLS transport (`internal/transport/mtls.go`), +and daemon plaintext mode is too large a refactor for v0.12 without +risking build stability. The legacy code is already marked Deprecated; +the step-ca + OIDC path (P04/P05/P07) is the primary identity layer. + +## What v0.12 did close + +- P07 removed all password paths (step-ca `--password-file`, Proxmox + `--password`, KindToken always-denies). +- P09 removed daemon plaintext mode (Start() requires mTLS). +- P11 added SVID chain validation (VerifySVIDWithChain). +- P06 rewrote ACL to OIDC (KindToken deprecated). + +## What remains for v1.x + +- Delete `internal/security/ca.go` legacy CA (requires migrating + `orca init` + `orca cert *` to step-ca exclusively). +- Delete `internal/transport/mtls.go` deprecated path. +- Delete `internal/certpaths/` (v0.8 flat layout); `internal/paths/` + is the only layout. +- Migrate `rotate-lead`, `drain`, `cutover`, `recovery` from + `certpaths` to `paths`. + +## Why not in v0.12 + +The legacy CA is load-bearing for `orca init` and 6+ CLI commands. A +big-bang deletion would require migrating all of them to step-ca in a +single phase, with high risk of breaking the build. v0.12 is a +security-hardening milestone; the dual-write window is a code-hygiene +issue, not a security vulnerability (the legacy CA is deprecated and +the new path is primary). v1.x will close it as a focused refactor.