docs(init): validate v0.7 specification — hardening & completion

---ci---
project: orca
phase: 0
milestone: v0.7
status: specify
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,11 +1,11 @@
 {
-  "phase": 4,
+  "phase": 0,
-  "stage": "complete",
+  "stage": "specify",
-  "milestone": "v0.6",
+  "milestone": "v0.7",
-  "milestone_slug": "node-bootstrap-proxmox",
+  "milestone_slug": "hardening-completion",
-  "phase_role": "final",
+  "phase_role": "pre_execution",
   "attempts": 0,
-  "updated_at": "2026-08-03T20:05:00Z",
+  "updated_at": "2026-08-03T20:30:00Z",
-  "milestone_complete": true,
+  "milestone_complete": false,
   "next_milestone": null
 }

.ciagent/PROJECT.md

@@ -275,3 +275,46 @@ auto-resolved at full autonomy within the `clarify_budget`:
   ExecStartPre or a config-management runbook.
 - **D-037 Ed25519**: `golang.org/x/crypto/ssh` + `golang.org/x/crypto/ed25519`
   are in the same module; no additional direct dep beyond D-030.
+
+## v0.7 Scope Summary — Hardening & Completion
+
+v0.7 is a 4-execution-phase **NFR milestone** that closes out gaps
+surfaced by the v0.7 IDEATE stage: an unreachable command tree, a
+missing config file layer, low test coverage in core packages, and the
+long-deferred pprof endpoint. The engine functionality from v0.1–v0.6
+is unchanged; this milestone is purely about **correctness, coverage,
+and operability**:
+
+- **P01 — Register `orca cert` command tree + cert_repo tests.** The
+  `internal/cli/cert.go` command (`cert ca-init`, `cert gen`, `cert
+  show`, `cert renew`, `cert fingerprint`) is fully implemented but
+  never wired into `rootCmd`. This phase adds the missing
+  `rootCmd.AddCommand(newCertCmd(...))` and adds the missing
+  `internal/store/cert_repo_test.go`. Covers REQ-053.
+- **P02 — HCL config file parsing (`config.hcl`).** D-009 specified
+  `~/.orca/config.hcl` and `/etc/orca/orca.hcl` as config locations,
+  but no HCL config-file parser exists — the CLI relies entirely on
+  flags and env vars. This phase adds a minimal `internal/config`
+  package that loads `config.hcl` (keys: `db_path`, `listen_addr`,
+  `ca_path`, `server_cert_path`, `server_key_path`, `node_capacity`),
+  merges with env/flag overrides (flag > env > file > default), and
+  surfaces it via `--config` flag on the root command. Covers
+  REQ-054.
+- **P03 — Test coverage uplift.** Adds tests for the lowest-coverage
+  packages: `internal/engine` (executor, dispatcher, peer — currently
+  8.3%), `internal/transport` (mtls, dispatch, handshake_log —
+  currently 26.3%), `internal/proxmox` (bootstrap SSH path —
+  currently 5.1%), and `internal/audit` (no tests). Target: every
+  package ≥ 50% coverage. Covers REQ-055.
+- **P04 — `--pprof` opt-in on `orca daemon`.** Adds the long-deferred
+  I-308 pprof endpoint behind an opt-in `--pprof <addr>` flag (default
+  disabled). `net/http/pprof` mounted on a separate mux so it never
+  touches the mTLS daemon listener. Covers REQ-056.
+- **P05 — Final review + ship + audit.** Milestone release.
+
+The vision ("minimalist, offline-first, CLI-first orchestration
+engine") is unchanged. v0.7 is a hardening milestone, not a direction
+change. Milestone type: NFR (all phases are fix/test/chore); the final
+phase's progressive patch IS the deliverable per `run.md` versioning
+logic. Tags run on the v0.5.x patch line: `v0.5.5` (P0) … `v0.5.9` (P05
+= milestone release).

.ciagent/REQUIREMENTS.md

@@ -122,3 +122,12 @@ REQ-047..052 all complete.
 - **P2** (v0.5.2): Proxmox SSH join + OrcaOperator role + sudoers (REQ-050/051).
 - **P3** (v0.5.3): `doctor os` + `doctor proxmox` + audit logging (REQ-052).
 - **P4** (v0.5.4): final review + audit + milestone release.
+
+## v0.7 Requirements — Hardening & Completion
+
+| ID | Requirement | Priority | Phase | Status |
+|----|-------------|----------|-------|--------|
+| REQ-053 | `orca cert` command tree registered on root command (`cert ca-init`, `cert gen`, `cert show`, `cert renew`, `cert fingerprint`) — code exists in `internal/cli/cert.go` but is never AddCommand'd; unreachable today | High | **v0.7 P1** | Pending |
+| REQ-054 | HCL config file parsing: `internal/config` package loads `~/.orca/config.hcl` / `/etc/orca/orca.hcl` (keys: db_path, listen_addr, ca_path, server_cert_path, server_key_path, node_capacity); merge precedence flag > env > file > default; `--config` flag on root command | High | **v0.7 P2** | Pending |
+| REQ-055 | Test coverage uplift: every package ≥ 50% — adds tests for `internal/engine` (executor, dispatcher, peer), `internal/transport` (mtls, dispatch, handshake_log), `internal/proxmox` (bootstrap SSH path), `internal/audit` | Medium | **v0.7 P3** | Pending |
+| REQ-056 | `--pprof <addr>` opt-in flag on `orca daemon` (default disabled); `net/http/pprof` mounted on a separate mux, never on the mTLS daemon listener | Low | **v0.7 P4** | Pending |

.ciagent/ROADMAP.md

@@ -112,3 +112,23 @@ Tags run on the previous minor's patch line (v0.5.x) per
 branch-strategy.md. The milestone branch label uses the milestone
 number (`milestone/v0.6-node-bootstrap-proxmox`); no separate minor
 tag is created.
+
+## Milestone v0.7: Hardening & Completion
+
+Scope: NFR milestone closing gaps surfaced by the v0.7 IDEATE stage —
+an unreachable command tree, a missing config file layer, low test
+coverage in core packages, and the long-deferred pprof endpoint.
+
+- [ ] Phase 0: Pre-execution (specify → clarify → research → ideate → plan) — tag `v0.5.5`
+- [ ] Phase 1: Register `orca cert` command tree + cert_repo tests (REQ-053) — tag `v0.5.6`
+- [ ] Phase 2: HCL config file parsing — `internal/config` package (REQ-054) — tag `v0.5.7`
+- [ ] Phase 3: Test coverage uplift — engine/transport/proxmox/audit ≥ 50% (REQ-055) — tag `v0.5.8`
+- [ ] Phase 4: `--pprof` opt-in on `orca daemon` (REQ-056) — tag `v0.5.9`
+- [ ] Phase 5: Final review + ship + audit (milestone release) — tag `v0.5.10`
+
+**Milestone type**: NFR (all phases are fix/test/chore; no `feat` phases).
+**Milestone tag**: `v0.5.10` (final phase patch = milestone release per
+NFR-milestone progressive-patch rule). Per-phase tags: `v0.5.5`…`v0.5.10`.
+Tags run on the previous minor's patch line (v0.5.x) per
+branch-strategy.md. The milestone branch label uses the milestone
+number (`milestone/v0.7-hardening-completion`); no separate minor tag.

.ciagent/config.json

@@ -5,9 +5,9 @@
       "slug": "orca",
       "name": "Orca",
       "description": "Offline/CLI-first orchestration engine (Orca) — Nomad-inspired, far simpler than Kubernetes",
-      "milestone": "v0.6",
+      "milestone": "v0.7",
       "phase": 0,
-      "milestone_type": "feature",
+      "milestone_type": "nfr",
       "default_branch": "main",
       "tech_stack": {
         "language": "go",