diff --git a/.ciagent/PHASE5_VERIFICATION.md b/.ciagent/PHASE5_VERIFICATION.md
new file mode 100644
index 0000000..8e66937
--- /dev/null
+++ b/.ciagent/PHASE5_VERIFICATION.md
@@ -0,0 +1,64 @@
+# Phase 5 Verification: Health Checks
+
+## 4-Layer Verification Results
+
+| Layer | Command | Result |
+|-------|---------|--------|
+| 1. Build | `go build ./...` | PASS |
+| 2. Vet | `go vet ./...` | PASS |
+| 3. Test | `go test ./...` | PASS (cli, daemon, jobspec, store all green) |
+| 4. Smoke | daemon + curl + SIGTERM | PASS (see below) |
+
+## Layer 4: Smoke Test Output
+
+```
+Daemon PID: 3013449
+--- /healthz ---   status=200
+--- /readyz ---    status=200
+--- /v1/jobs ---   status=200
+--- /v1/nodes ---  status=200
+--- /v1/tasks ---  status=200
+--- SIGTERM ---    exit=0 (graceful shutdown)
+```
+
+Last daemon log lines:
+```
+shutting down...
+{"time":"...","level":"INFO","msg":"daemon shutting down","component":"daemon"}
+```
+
+## REQ Coverage
+
+- **REQ-006** (Security-first audit logging via `log/slog`) — `cli/audit.go` + structured slog in daemon ✓
+- **REQ-017** (`context.Context` propagation in all I/O) — all handlers use `r.Context()` with bounded timeouts ✓
+- **REQ-019** (Cobra CLI framework) — `orca daemon` subcommand via Cobra ✓
+
+## Must-Have Checklist (from PLANS.md)
+
+- [x] `internal/daemon/server.go` — `net/http` server with `http.ServeMux` and lifecycle (MarkReady/Shutdown)
+- [x] `internal/daemon/health.go` — `/healthz` and `/readyz` handlers
+- [x] `internal/daemon/jobs_handler.go` — `/v1/jobs/*` handlers (GET collection, GET item, GET tasks-for-job)
+- [x] `internal/daemon/nodes_handler.go` — `/v1/nodes/*` handlers (GET collection)
+- [x] `internal/daemon/tasks_handler.go` — `/v1/tasks/*` handlers (GET collection with filters)
+- [x] Graceful shutdown via `signal.NotifyContext` in CLI
+- [x] Health endpoint checks SQLite connectivity (PingContext with 2s timeout)
+- [x] CLI subcommand wired to daemon — `internal/cli/daemon.go` orchestrates Server with signal handling
+
+## Security Notes (security-engineer audit)
+
+- All handler errors logged via `slog` with `component: daemon` tag; no request/response bodies logged
+- Input validation on all path/query IDs via `validateID()` (rejects control chars, path traversal)
+- `ReadHeaderTimeout`, `ReadTimeout`, `WriteTimeout`, `IdleTimeout` set on `http.Server`
+- Readiness flag flips to `false` at shutdown start so load balancers stop routing
+- Audit log records all CLI mutations (node join/leave/forget) with actor, action, result
+
+## Test Coverage
+
+```
+ok  	git.cloudinit.dev/coreci/orca/internal/cli	0.005s
+ok  	git.cloudinit.dev/coreci/orca/internal/daemon	6.362s	coverage: 67.5%
+ok  	git.cloudinit.dev/coreci/orca/internal/jobspec	0.004s
+ok  	git.cloudinit.dev/coreci/orca/internal/store	4.881s
+```
+
+Daemon coverage at 67.5% — handler paths, mux routing, validation, and lifecycle all exercised.