docs(init): validate v0.8 specification — coverage & trust hardening

---ci---
project: orca
phase: 0
milestone: v0.8
status: specify
---/ci---

.ciagent/ROADMAP.md

@@ -132,3 +132,55 @@ NFR-milestone progressive-patch rule). Per-phase tags: `v0.6.0`…`v0.6.5`.
 Tags run on the previous minor's patch line (v0.6.x) per
 branch-strategy.md. The milestone branch label uses the milestone
 number (`milestone/v0.7-hardening-completion`); no separate minor tag.
+
+## Milestone v0.8: Coverage & Trust Hardening
+
+Scope: continue the v0.7 hardening theme. v0.7 P03's ≥ 50% floor left
+six packages still under 50% (engine 8.3%, proxmox 5.1%, cli 27.6%,
+transport 26.3%, store 46.7%, jobspec 47.6%) and three packages with
+no tests at all (`internal/audit`, `internal/certpaths`, `cmd/orca`).
+v0.8 also closes the two SSH-trust "future enhancement" hooks deferred
+in v0.6 (D-035 `--host-key-fingerprint` pre-pin, RESEARCH_v0.6 §80
+`orca node key-reset`) and adds a requirements-hygiene gate to prevent
+the stale-REQ-status drift seen after v0.7 ship.
+
+- [ ] Phase 0: Pre-execution (specify → clarify → research → plan → grill) — tag `v0.7.0`
+- [ ] Phase 1: Test coverage uplift round 2 — 6 packages to ≥ 70%, 3 zero-test packages to first tests (REQ-057) — tag `v0.7.1`
+- [ ] Phase 2: SSH trust hardening — `--host-key-fingerprint` pre-pin + `orca node key-reset` (REQ-058, REQ-059) — tag `v0.7.2`
+- [ ] Phase 3: Requirements-hygiene gate — `make verify-reqs` + verify assertion (REQ-060) — tag `v0.7.3`
+- [ ] Phase 4: Final review + ship + audit (milestone release) — tag `v0.7.4`
+
+**Milestone type**: NFR (P01 test, P02 chore/feat on trust surface —
+classified in CLARIFY D-043, P03 chore, P04 docs/review). Final phase
+patch IS the milestone release per NFR-milestone progressive-patch
+rule. Per-phase tags: `v0.7.0`…`v0.7.4`. Tags run on the previous
+minor's patch line (v0.7.x) per branch-strategy.md. The milestone
+branch label uses the milestone number
+(`milestone/v0.8-coverage-trust-hardening`); no separate minor tag.
+
+### Per-phase REQ coverage
+
+- **P01 — Coverage uplift round 2**
+  - REQ-057 (raise `internal/engine`, `internal/proxmox`,
+    `internal/cli`, `internal/transport`, `internal/store`,
+    `internal/jobspec` to ≥ 70%; add first tests for `internal/audit`,
+    `internal/certpaths`, `cmd/orca`)
+
+- **P02 — SSH trust hardening**
+  - REQ-058 (`--host-key-fingerprint <sha256>` pre-pin flag on
+    `orca node join --type proxmox`; fail fast on mismatch; supersedes
+    TOFU for pre-pinned deployments)
+  - REQ-059 (`orca node key-reset <node>` clears persisted SSH host
+    key so next `doctor proxmox`/dispatch re-pins via TOFU or
+    `--host-key-fingerprint`)
+
+- **P03 — Requirements-hygiene gate**
+  - REQ-060 (`make verify-reqs` target + verify-stage assertion:
+    every REQ `Complete` in ROADMAP.md has matching `Complete` row in
+    REQUIREMENTS.md; enforced in CI `validate` pipeline)
+
+### v0.8 is a continuation milestone, not a direction change
+
+The vision ("minimalist, offline-first, CLI-first orchestration
+engine") is unchanged. v0.8 closes the coverage debt left by v0.7's
+50% floor and the trust-surface gaps explicitly deferred in v0.6.