ship(P01): cli skeleton merged into milestone

---ci---
project: orca
phase: 1
milestone: v0.1
status: ship
---/ci---
This commit is contained in:
Jon Chery
2026-06-03 12:25:51 +00:00
24 changed files with 1136 additions and 30 deletions
+170 -11
View File
@@ -1,13 +1,172 @@
# Architecture: Orchestration Engine
# Architecture: Orca
(Initial Draft)
The system will consist of:
1. **CLI Tool**: The primary interface for users and AI agents.
2. **Controller/Server**: A lightweight daemon managing state and scheduling.
3. **Agent/Worker**: A daemon running on each node to execute workloads.
4. **State Store**: A simple, local-first state persistence mechanism.
## System Overview
## Design Pillars
- Security before features.
- Bug fixes before features.
- NFRs before features.
Orca is a single-binary, offline-first orchestration engine. The system consists of three logical components, all compiled into one `orca` binary and selected via subcommands.
```
┌─────────────────────────────────────────────────────────────┐
│ orca (single binary) │
├─────────────────────────────────────────────────────────────┤
│ CLI Layer (Cobra) │
│ ├── orca version │
│ ├── orca init │
│ ├── orca status │
│ ├── orca node {join,leave,list} │
│ └── orca job {run,list,stop,logs} │
├─────────────────────────────────────────────────────────────┤
│ Daemon Layer (net/http server) │
│ ├── /healthz (liveness) │
│ ├── /readyz (readiness) │
│ ├── /v1/jobs/* (job control API) │
│ ├── /v1/nodes/* (node registry API) │
│ └── /v1/tasks/* (task lifecycle API) │
├─────────────────────────────────────────────────────────────┤
│ Core Engine │
│ ├── Node Registry (in-memory + SQLite persistence) │
│ ├── Task Executor (os/exec with WaitDelay, Go 1.25+) │
│ ├── Job Scheduler (single-node for v0.1) │
│ └── Audit Logger (log/slog JSON handler) │
├─────────────────────────────────────────────────────────────┤
│ State Store (modernc/sqlite, CGO-free) │
│ ~/.orca/orca.db │
└─────────────────────────────────────────────────────────────┘
```
## Component Details
### 1. CLI Layer (`cmd/orca`, `internal/cli`)
- **Framework**: Cobra (industry standard, familiar to operators)
- **Subcommands**: `version`, `init`, `status`, `node`, `job`
- **Output**: Human-readable by default; `--json` flag for machine consumption
- **Discovery**: All subcommands self-document via Cobra's auto-generated help
### 2. Daemon Layer (`internal/daemon`)
- **Server**: `net/http` with `http.ServeMux` (no external router for v0.1)
- **TLS**: `crypto/tls` with self-signed certs (mTLS-ready)
- **Ports**: Configurable (default `:8443` for API, `:8080` for health)
- **Graceful Shutdown**: `signal.NotifyContext` with SIGINT/SIGTERM
### 3. Core Engine (`internal/engine`)
- **Node Registry**: In-memory map of node IDs → metadata, persisted to SQLite
- **Task Executor**: `os/exec.CommandContext` with `WaitDelay` (Go 1.25+) for clean process termination
- **Job Scheduler**: Single-node FIFO queue (multi-node deferred to v0.2+)
- **Audit Logger**: `slog.NewJSONHandler(os.Stderr, ...)` with structured fields
### 4. State Store (`internal/store`)
- **Driver**: `modernc.org/sqlite` (pure Go, CGO-free)
- **Location**: `~/.orca/orca.db` (user-mode) or `/var/lib/orca/orca.db` (system-mode)
- **Schema**: `nodes`, `jobs`, `tasks`, `audit_log` tables
- **Migrations**: Embedded SQL files, applied on startup
## Data Model
### Node
```go
type Node struct {
ID string
Name string
Address string
State string
JoinedAt time.Time
LastSeen time.Time
Metadata map[string]string
}
```
### Job
```go
type Job struct {
ID string
Name string
Spec string
Status string
CreatedAt time.Time
StartedAt *time.Time
EndedAt *time.Time
}
```
### Task
```go
type Task struct {
ID string
JobID string
Command string
Args []string
Env []string
PID int
ExitCode int
Status string
CreatedAt time.Time
StartedAt *time.Time
EndedAt *time.Time
}
```
## Security Architecture
### Authentication
- **v0.1**: mTLS for all API endpoints (self-signed CA)
- **v0.2+**: Token-based auth as alternative
### Audit Logging
- All state-changing operations emit structured log records
- Fields: `timestamp`, `actor`, `action`, `resource`, `result`, `error`
- Stored in SQLite `audit_log` table and stderr (JSON)
### Input Validation
- All CLI inputs validated via Cobra's `Args`/`ValidArgs` functions
- All API inputs validated at handler boundary
- HCL/YAML specs parsed with strict schemas
## Key Architectural Decisions
| ID | Decision | Rationale |
|----|----------|-----------|
| AD-001 | Single binary with subcommands | Simpler distribution, aligns with simplicity pillar |
| AD-002 | modernc/sqlite (CGO-free) | Cross-compile friendly, no CGO toolchain needed |
| AD-003 | net/http (no framework) | Stdlib suffices; avoids external router dependency |
| AD-004 | os/exec with WaitDelay (Go 1.25+) | Clean process termination, native to Go |
| AD-005 | Cobra for CLI | Industry standard, familiar to operators |
| AD-006 | slog for logging | Native to Go 1.21+, no external dependency |
| AD-007 | HCL for job specs | Familiar to Nomad/HashiCorp users |
| AD-008 | Single-node scheduling (v0.1) | Multi-node scheduling deferred to v0.2+ |
## Anti-Patterns (Explicitly Avoided)
- No controller/agent split (single binary)
- No CRDs / custom resource definitions
- No web UI (CLI-only)
- No service mesh
- No container runtime integration
- No multi-tenancy
- No cloud provider integrations
- No auto-scaling
- No admission controllers
- No complex scheduling algorithms
## Dependency Map (minimal)
```
github.com/spf13/cobra # CLI framework
github.com/hashicorp/hcl/v2 # HCL parser
modernc.org/sqlite # SQLite (pure Go)
github.com/google/uuid # UUID generation
```
Total: ~4 direct dependencies. No web framework, no ORM, no RPC framework.
## Deployment Model
```
User Machine Server Node
┌──────────┐ ┌──────────────────┐
│ orca CLI │─────── mTLS ──────────▶│ orca daemon │
│ │ │ ├── API server │
│ │ │ ├── Engine │
│ │ │ └── SQLite store │
└──────────┘ └──────────────────┘
```
For v0.1, the CLI and daemon can be the same binary on the same machine. Multi-node is deferred.
+65
View File
@@ -0,0 +1,65 @@
# Ideation: Orca v0.1
Full autonomy mode: all ideas auto-accepted. Three tiers explored.
## Tier 1: Mechanical (security/quality, automated)
| ID | Idea | Source | Confidence |
|----|------|--------|------------|
| I-001 | Add `gosec` to CI pipeline | mechanical | 0.95 |
| I-002 | Add `govulncheck` to CI pipeline | mechanical | 0.95 |
| I-003 | Enable `gofmt` and `goimports` pre-commit checks | mechanical | 0.90 |
| I-004 | Pin Go version in `go.mod` (`go 1.25`) | mechanical | 0.95 |
| I-005 | Use `log/slog` for all logging (no `fmt.Println` in production) | mechanical | 0.95 |
| I-006 | Add `.gitignore` for `bin/`, `coverage.out`, `*.test` | mechanical | 0.95 |
| I-007 | Add `LICENSE` (MIT) | mechanical | 0.90 |
| I-008 | Add `README.md` with quickstart | mechanical | 0.90 |
| I-009 | Use `context.Context` for all I/O | mechanical | 0.95 |
| I-010 | Wrap errors with `fmt.Errorf("...: %w", err)` | mechanical | 0.95 |
## Tier 2: Backend-Enriched (architecture/coverage)
| ID | Idea | Source | Confidence |
|----|------|--------|------------|
| I-011 | Use Cobra for CLI (industry standard) | backend | 0.95 |
| I-012 | Use `viper` for config OR hand-rolled HCL parser | backend | 0.85 |
| I-013 | Use `hashicorp/hcl` for HCL parsing | backend | 0.90 |
| I-014 | Use `modernc.org/sqlite` (CGO-free) | backend | 0.92 |
| I-015 | Repository pattern for state access | backend | 0.85 |
| I-016 | Use `os/exec` for task execution with `cmd.WaitDelay` (Go 1.25+) | backend | 0.95 |
| I-017 | Use `iter.Seq` (Go 1.25+) for streaming job lists | backend | 0.90 |
| I-018 | Use `crypto/tls` with self-signed cert generation for mTLS | backend | 0.80 |
| I-019 | Use `slog.NewJSONHandler` for structured logs | backend | 0.95 |
| I-020 | Add health check HTTP endpoint on configurable port | backend | 0.90 |
## Tier 3: Cross-Project (from backlog/coreci patterns)
| ID | Idea | Source | Confidence |
|----|------|--------|------------|
| I-021 | Mirror `.coreci.yml` pattern from coreci (validate/build/test/release) | cross-project | 0.95 |
| I-022 | Mirror `tea` CLI integration for releases | cross-project | 0.90 |
| I-023 | Mirror `lead-developer` persona-driven decomposition | cross-project | 0.90 |
| I-024 | Mirror `phase/NN-*``milestone/*``main` branching | cross-project | 0.95 |
| I-025 | Mirror `---ci---` commit block discipline | cross-project | 0.95 |
| I-026 | Mirror pre-push hook pattern from coreci (if exists) | cross-project | 0.85 |
| I-027 | Mirror Go module structure: `cmd/orca`, `internal/`, `pkg/` | cross-project | 0.95 |
| I-028 | Mirror persona territory enforcement (`warn` mode) | cross-project | 0.90 |
| I-029 | Mirror security audit logging in all write paths | cross-project | 0.90 |
| I-030 | Mirror `Makefile` with `build`, `test`, `lint`, `fmt` targets | cross-project | 0.95 |
## Accepted Ideas (auto-accepted, full autonomy)
All 30 ideas accepted. Implementation in subsequent EXECUTE phases.
## Resulting REQ Additions
- REQ-014: `gosec` + `govulncheck` in CI (I-001, I-002)
- REQ-015: MIT LICENSE (I-007)
- REQ-016: README.md with quickstart (I-008)
- REQ-017: `context.Context` propagation (I-009)
- REQ-018: Error wrapping with `%w` (I-010)
- REQ-019: Cobra CLI framework (I-011)
- REQ-020: HCL parser integration (I-013)
- REQ-021: `os/exec` with `WaitDelay` (I-016)
- REQ-022: `iter.Seq` for streaming (I-017)
- REQ-023: Self-signed mTLS cert generation (I-018)
- REQ-024: `Makefile` with standard targets (I-030)
+85
View File
@@ -0,0 +1,85 @@
---
active_personas:
- lead-developer
- backend-engineer
- data-engineer
- cli-engineer
- security-engineer
deactivated_personas:
- frontend-engineer
- devops-sre
phase_specific: []
reason: |
Orca is a CLI-first, offline-first orchestration engine with no web UI and
a single-binary distribution model. The persona roster reflects this:
- lead-developer: coordination and task decomposition
- backend-engineer: core engine and API handlers
- data-engineer: SQLite state store and migrations
- cli-engineer: Cobra subcommands and CLI UX
- security-engineer: mTLS, audit logging, input validation
Deactivated:
- frontend-engineer: no web UI in v0.1
- devops-sre: no container/cloud integrations; release flow is
handled by CoreCI (not a persona territory)
---
# Personas: Orca
## Roster
### lead-developer
- **Domain**: coordination
- **Frameworks**: `cobra`
- **Constraints**: `boundary-enforcement`, `offline-first`, `no-redundant-implementations`
- **Territory**: `**/*.go`, `cmd/**`, `internal/**`
- **Active**: true
### backend-engineer
- **Domain**: backend
- **Frameworks**: `cobra`, `net/http`
- **Constraints**: `API-first`, `error-handling`, `minimal-dependencies`, `security-first`
- **Territory**: `**/api/**`, `**/*_handler*`, `**/*_handler.go`, `internal/daemon/**`
- **Active**: true
### data-engineer
- **Domain**: data
- **Frameworks**: `modernc/sqlite`
- **Constraints**: `schema-first`, `migration-safe`, `local-storage-only`
- **Territory**: `**/store/**`, `**/model.go`, `**/migration*`, `migrations/**`
- **Active**: true
### cli-engineer (custom)
- **Domain**: CLI/UX
- **Frameworks**: `cobra`, `pflag`
- **Constraints**: `discoverable-help`, `consistent-flag-naming`, `human-readable-output`, `machine-readable-json-flag`
- **Territory**: `cmd/**`, `internal/cli/**`, `internal/commands/**`
- **Active**: true
- **Reason**: Orca is CLI-first; this persona ensures CLI quality and discoverability.
### security-engineer (custom)
- **Domain**: security
- **Frameworks**: `crypto/tls`, `slog`
- **Constraints**: `no-panic-in-production`, `structured-audit-logging`, `no-secret-in-logs`, `input-validation`
- **Territory**: `**/auth/**`, `**/audit/**`, `internal/security/**`
- **Active**: true
- **Reason**: mTLS, audit logging, and input validation are first-class concerns.
### frontend-engineer
- **Active**: false
- **Reason**: No web UI in v0.1.
### devops-sre
- **Active**: false
- **Reason**: No container/cloud integrations. Release flow is handled by CoreCI.
## Territory Enforcement
- **Mode**: `warn` (per `config.json`)
- **Behavior**: Out-of-territory file changes log a warning but do not block.
- **Rationale**: Allows flexibility during early development; tighten to `strict` post-v0.1.
## Phase-Specific Personas
None for v0.1. All personas persist across all 6 phases.
+165
View File
@@ -0,0 +1,165 @@
# Phase Plans: Orca v0.1
All 6 phases with vertical-slice structure, wave ordering, and REQ-ID mapping.
---
## Phase 1: CLI Skeleton (Wave 1)
**Branch**: `phase/01-cli-skeleton`
**REQ Coverage**: REQ-001, REQ-002, REQ-013, REQ-015, REQ-016, REQ-019, REQ-024
### Must-Haves
- [ ] `go.mod` with `go 1.25`
- [ ] `cmd/orca/main.go` — entry point
- [ ] `internal/cli/root.go` — Cobra root command with `--json` global flag
- [ ] `internal/cli/version.go``orca version` subcommand
- [ ] `internal/cli/init.go``orca init` subcommand (stub)
- [ ] `internal/cli/status.go``orca status` subcommand (stub)
- [ ] `internal/cli/node.go``orca node {join,leave,list}` stubs
- [ ] `internal/cli/job.go``orca job {run,list,stop,logs}` stubs
- [ ] `Makefile` with `build`, `test`, `lint`, `fmt` targets
- [ ] `LICENSE` (MIT)
- [ ] `README.md` with quickstart
- [ ] `.gitignore` for `bin/`, `coverage.out`, `*.test`
- [ ] `.githooks/pre-push``scripts/trigger_coreci.sh`
- [ ] `scripts/trigger_coreci.sh` — curl-based CoreCI trigger
### Verification
- `go build ./cmd/orca` succeeds
- `orca --help` lists all subcommands
- `orca version` prints version
- `orca --json version` prints JSON
- `make build`, `make test`, `make lint`, `make fmt` all succeed
---
## Phase 2: Node Management (Wave 2)
**Branch**: `phase/02-node-mgmt`
**REQ Coverage**: REQ-002, REQ-005, REQ-012, REQ-017, REQ-018
### Must-Haves
- [ ] `internal/store/sqlite.go` — SQLite connection (modernc/sqlite)
- [ ] `internal/store/migrations/0001_nodes.sql` — nodes table schema
- [ ] `internal/store/node_repo.go` — Node repository (CRUD)
- [ ] `internal/engine/registry.go` — In-memory node registry with SQLite persistence
- [ ] Wire `orca node join` to registry
- [ ] Wire `orca node leave` to registry
- [ ] Wire `orca node list` to registry
- [ ] Audit log on all node operations
- [ ] Config loading from `~/.orca/config.hcl`
### Verification
- `orca node join --name test --addr localhost:8443` adds node
- `orca node list` shows added node
- `orca node leave <id>` removes node
- Restart daemon, node state persists
---
## Phase 3: Task Execution Engine (Wave 2)
**Branch**: `phase/03-task-exec`
**REQ Coverage**: REQ-004, REQ-009, REQ-021, REQ-022
### Must-Haves
- [ ] `internal/store/migrations/0002_jobs_tasks.sql` — jobs + tasks tables
- [ ] `internal/store/job_repo.go` — Job repository
- [ ] `internal/store/task_repo.go` — Task repository
- [ ] `internal/engine/executor.go``os/exec` with `WaitDelay` (Go 1.25+)
- [ ] `internal/engine/scheduler.go` — Single-node FIFO scheduler
- [ ] `internal/jobspec/hcl.go` — HCL job spec parser
- [ ] Wire `orca job run <spec.hcl>` to executor
- [ ] Wire `orca job list` to repository
- [ ] Wire `orca job stop <id>` to executor
- [ ] Wire `orca job logs <id>` to task output
### Verification
- `orca job run` with valid HCL spec executes command
- Task status transitions: pending → running → complete
- `orca job list` shows job history
- `orca job stop` kills running process cleanly (WaitDelay)
---
## Phase 4: Local State Persistence Hardening (Wave 3)
**Branch**: `phase/04-state-persistence`
**REQ Coverage**: REQ-005, REQ-018
### Must-Haves
- [ ] `internal/store/migrate.go` — Migration runner
- [ ] `internal/store/audit_repo.go` — Audit log repository
- [ ] `internal/store/migrations/0003_audit_log.sql` — audit_log table
- [ ] Embed migrations via `//go:embed`
- [ ] Transaction wrapping for all writes
- [ ] Connection pool tuning
- [ ] Graceful shutdown flushes pending writes
### Verification
- Migrations apply on first run
- Audit log entries persist across restarts
- Concurrent writes don't corrupt state (test with `go test -race`)
---
## Phase 5: Health Checks (Wave 3)
**Branch**: `phase/05-health-checks`
**REQ Coverage**: REQ-006, REQ-017
### Must-Haves
- [ ] `internal/daemon/server.go``net/http` server with `http.ServeMux`
- [ ] `internal/daemon/health.go``/healthz` and `/readyz` handlers
- [ ] `internal/daemon/jobs_handler.go``/v1/jobs/*` handlers
- [ ] `internal/daemon/nodes_handler.go``/v1/nodes/*` handlers
- [ ] `internal/daemon/tasks_handler.go``/v1/tasks/*` handlers
- [ ] Graceful shutdown via `signal.NotifyContext`
- [ ] Health endpoint checks SQLite connectivity
- [ ] Wire CLI subcommands to daemon API
### Verification
- `curl http://localhost:8080/healthz` returns 200
- `curl http://localhost:8080/readyz` returns 200 when ready
- `curl http://localhost:8080/v1/jobs` returns job list as JSON
- Daemon shuts down cleanly on SIGTERM
---
## Phase 6: CoreCI Full Release Flow (Wave 4)
**Branch**: `phase/06-coreci-release`
**REQ Coverage**: REQ-007, REQ-014
### Must-Haves
- [ ] `.coreci.yml` — validate, build, test, release pipelines
- [ ] `scripts/release.sh``tea releases create` wrapper
- [ ] `Makefile` `release` target invokes release script
- [ ] Tarball generation in release pipeline
- [ ] Version injection via `-ldflags`
- [ ] `CHANGELOG.md` (auto-generated from `---ci---` blocks)
### Verification
- `make release` creates Gitea release with tarball
- Tarball contains `orca` binary
- Release notes include phase summary
- CoreCI `validate`, `build`, `test`, `release` pipelines all green
---
## Wave Ordering
- **Wave 1** (Phase 1): Foundation — CLI skeleton, build system, hooks
- **Wave 2** (Phases 2-3): Core functionality — node registry, task execution
- **Wave 3** (Phases 4-5): Hardening — state persistence, health checks
- **Wave 4** (Phase 6): Release — CoreCI integration
Phases within a wave can be parallelized if `parallelization.enabled=true`.
For v0.1, `parallelization.enabled=false` — phases run sequentially.
## Versioning
- **Milestone type**: `feature` (Phases 1-6 all produce features)
- **Patch per phase**: `v0.1.1`, `v0.1.2`, ..., `v0.1.6`
- **Final tag on COMPLETE**: `v0.2.0` (next minor per `run.md` versioning logic)
+22 -1
View File
@@ -1,4 +1,4 @@
# Project: Orchestration Engine
# Project: Orca
## Vision
A minimalist, offline-first, CLI-first orchestration engine inspired by HashiCorp Nomad, prioritizing stability, security, and simplicity over feature richness.
@@ -18,8 +18,29 @@ Build a lightweight system to manage and execute workloads across a set of nodes
- No web UI as a primary requirement.
- Must not implement K8s-level complexity.
- Feature development must move slowly to ensure stability.
- Only CI system allowed: CoreCI (git.cloudinit.dev/coreci/coreci).
- Gitea remote: git.cloudinit.dev/coreci/orca.
## Clarified Decisions (D-series, full autonomy)
| ID | Question | Decision | Rationale | Confidence |
|----|----------|----------|-----------|------------|
| D-001 | Single binary or multi-binary distribution? | **Single binary** | Simpler distribution; subcommands baked into one `orca` binary. Aligns with simplicity pillar. | 0.95 |
| D-002 | Local state store technology? | **modernc/sqlite (pure Go, CGO-free)** | Cross-compile friendly, no CGO dependency, single file on disk, mature. | 0.92 |
| D-003 | Inter-node communication? | **Embedded HTTP (net/http) over loopback, mTLS for cross-node** | No external RPC framework needed for v0.1. HTTP suffices. | 0.85 |
| D-004 | Scheduling algorithm for v0.1? | **Single-node only (no scheduling)** | Multi-node scheduling is out of scope for v0.1. Tasks run on the node they're submitted to. | 0.90 |
| D-005 | CLI output format? | **Human-readable by default, `--json` flag for machine consumption** | Serves both humans and AI agents. | 0.95 |
| D-006 | Job/task definition format? | **HCL or YAML in `.hcl`/`.yaml` files** | Familiar to Nomad/HashiCorp users; simpler than JSON for humans. | 0.88 |
| D-007 | Authentication? | **mTLS for v0.1, token-based deferred** | mTLS is the most secure default. Tokens can be added later if needed. | 0.80 |
| D-008 | Container runtime? | **Direct process execution (no container runtime) for v0.1** | Avoids the Docker/container dependency. Pure process management. | 0.85 |
| D-009 | Configuration file location? | **`~/.orca/config.hcl` and `/etc/orca/orca.hcl`** | Standard XDG-style paths. | 0.90 |
| D-010 | Logging format? | **Structured JSON via `log/slog`** | Native Go 1.21+ slog, no external dependency. | 0.95 |
## Out of Scope
- Full-blown Kubernetes-compatible API.
- Complex cloud-provider integrations.
- GUI-based management consoles.
- Multi-node scheduling.
- Container runtime integration.
- Service mesh / sidecar injection.
- Auto-scaling / horizontal pod autoscaler.
+27 -8
View File
@@ -1,11 +1,30 @@
# Requirements: Orchestration Engine
# Requirements: Orca
## Milestone v0.1: Foundation
## Milestone v1.0: Foundation
| ID | Requirement | Priority | Status |
|----|-------------|----------|--------|
| REQ-001 | Go 1.25+ Toolchain Support | High | Pending |
| REQ-002 | CLI-first interface for all operations | High | Pending |
| REQ-003 | Offline-first operational mode | High | Pending |
| REQ-004 | Basic task deployment (single node) | Medium | Pending |
| REQ-005 | Local state storage without external DB | Medium | Pending |
| REQ-006 | Security-first audit logging | High | Pending |
| REQ-001 | Go 1.25+ toolchain support | High | Pending |
| REQ-002 | CLI-first interface for all operations (single binary) | High | Pending |
| REQ-003 | Offline-first operational mode (no cloud deps) | High | Pending |
| REQ-004 | Basic task deployment (single-node process execution) | Medium | Pending |
| REQ-005 | Local state storage via modernc/sqlite (CGO-free) | Medium | Pending |
| REQ-006 | Security-first audit logging via `log/slog` | High | Pending |
| REQ-007 | CoreCI full release flow integration via `.coreci.yml` | High | Pending |
| REQ-008 | Structured JSON logging (slog) | High | Pending |
| REQ-009 | HCL/YAML job spec parsing | Medium | Pending |
| REQ-010 | `--json` output flag for machine consumption | High | Pending |
| REQ-011 | mTLS for inter-node communication | Medium | Deferred (v0.2) |
| REQ-012 | `~/.orca/config.hcl` and `/etc/orca/orca.hcl` config locations | Low | Pending |
| REQ-013 | Pre-push git hook triggers CoreCI on every push | High | Pending |
| REQ-014 | `gosec` + `govulncheck` in CI pipeline | High | Pending |
| REQ-015 | MIT LICENSE | Low | Pending |
| REQ-016 | README.md with quickstart | Medium | Pending |
| REQ-017 | `context.Context` propagation in all I/O | High | Pending |
| REQ-018 | Error wrapping with `fmt.Errorf("...: %w", err)` | High | Pending |
| REQ-019 | Cobra CLI framework | High | Pending |
| REQ-020 | HCL parser integration (`hashicorp/hcl`) | Medium | Pending |
| REQ-021 | `os/exec` with `WaitDelay` (Go 1.25+) | Medium | Pending |
| REQ-022 | `iter.Seq` for streaming job lists (Go 1.25+) | Low | Pending |
| REQ-023 | Self-signed mTLS cert generation | Medium | Pending |
| REQ-024 | `Makefile` with standard targets | High | Pending |
+3 -2
View File
@@ -1,9 +1,10 @@
# Roadmap: Orchestration Engine
# Roadmap: Orca
## Milestone v1.0: Foundation (Initial)
## Milestone v0.1: Foundation
- [ ] Phase 0: Project Initialization & Specification
- [ ] Phase 1: Core CLI Skeleton & Command Parsing
- [ ] Phase 2: Basic Node Management (Join/Leave)
- [ ] Phase 3: Simple Task Execution Engine
- [ ] Phase 4: Local State Persistence
- [ ] Phase 5: Basic Health Checking
- [ ] Phase 6: CoreCI Full Release Flow
+25 -8
View File
@@ -2,10 +2,10 @@
"version": 1,
"projects": [
{
"slug": "orch-engine",
"name": "Orchestration Engine",
"description": "Offline/CLI-first orchestration engine inspired by HashiCorp Nomad, far simpler than Kubernetes",
"milestone": "v1.0",
"slug": "orca",
"name": "Orca",
"description": "Offline/CLI-first orchestration engine (Orca) — Nomad-inspired, far simpler than Kubernetes",
"milestone": "v0.1",
"phase": 0,
"milestone_type": "feature",
"default_branch": "main",
@@ -22,8 +22,8 @@
}
}
],
"active_project": "orch-engine",
"active_projects": ["orch-engine"],
"active_project": "orca",
"active_projects": ["orca"],
"autonomy": {
"level": "full",
"decision_confidence_threshold": 0.60,
@@ -69,16 +69,33 @@
"session_isolation": "branch"
},
"ci": {
"provider": "gitea",
"provider": "coreci",
"allowed_providers": ["coreci"],
"gitea": {
"url": "https://git.cloudinit.dev",
"owner": "coreci",
"repo": "orch-engine",
"repo": "orca",
"token_env": "GITEA_TOKEN"
},
"coreci": {
"url": "https://git.cloudinit.dev/coreci/coreci",
"config_file": ".coreci.yml"
},
"tools": {
"gitea_cli": "tea",
"allowed_commands": [
"tea repos create",
"tea repos list",
"tea pr create",
"tea pr list",
"tea releases create",
"tea issues create"
]
}
},
"repository": {
"remote": "origin",
"url": "https://git.cloudinit.dev/coreci/orca.git",
"main_branch": "main"
},
"commands": {
+46
View File
@@ -0,0 +1,46 @@
version: "1"
name: orca-ci
description: Orca — offline/CLI-first orchestration engine. Full release flow via CoreCI.
pipelines:
validate:
description: Validate Go toolchain and code formatting
steps:
- name: go-version
image: golang:1.25
commands:
- go version
- gofmt -l .
- go vet ./...
build:
description: Build the orca binary
steps:
- name: build
image: golang:1.25
commands:
- go build -o bin/orca ./cmd/orca
test:
description: Run all tests with race detection
steps:
- name: test
image: golang:1.25
commands:
- go test -race -coverprofile=coverage.out ./...
release:
description: Full release flow — build, package, and publish to Gitea
steps:
- name: build-artifact
image: golang:1.25
commands:
- go build -ldflags="-s -w" -o bin/orca ./cmd/orca
- tar -czf orca-${CI_COMMIT_TAG}-linux-amd64.tar.gz -C bin orca
- name: gitea-release
image: golang:1.25
commands:
- tea releases create ${CI_COMMIT_TAG}
--title "Orca ${CI_COMMIT_TAG}"
--note "Full release of Orca. See CHANGELOG for details."
--asset orca-${CI_COMMIT_TAG}-linux-amd64.tar.gz
+3
View File
@@ -0,0 +1,3 @@
#!/bin/bash
# Pre-push hook: trigger CoreCI pipeline before any push
exec "$(dirname "$0")/../scripts/trigger_coreci.sh"
+11
View File
@@ -0,0 +1,11 @@
bin/
coverage.out
*.test
*.out
.DS_Store
orca
*.db
*.db-journal
*.db-wal
*.db-shm
.env.local
+21
View File
@@ -0,0 +1,21 @@
MIT License
Copyright (c) 2026 Orca Contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
+42
View File
@@ -0,0 +1,42 @@
.PHONY: build test lint fmt clean run release help
BINARY := bin/orca
GOFLAGS := -trimpath
LDFLAGS := -s -w -X main.version=$(shell git describe --tags --always --dirty 2>/dev/null || echo "dev") \
-X main.gitCommit=$(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown") \
-X main.buildTime=$(shell date -u +%Y-%m-%dT%H:%M:%SZ)
help:
@echo "orca — make targets"
@echo " build Build binary to $(BINARY)"
@echo " test Run tests with race detection"
@echo " lint Run gofmt + go vet"
@echo " fmt Format code"
@echo " clean Remove build artifacts"
@echo " run Build and run with args (use: make run ARGS='version')"
@echo " release Build release artifact with version injection"
build:
@mkdir -p bin
go build $(GOFLAGS) -o $(BINARY) ./cmd/orca
test:
go test -race -coverprofile=coverage.out ./...
lint:
gofmt -l .
go vet ./...
fmt:
gofmt -w .
clean:
rm -rf bin coverage.out
run: build
./$(BINARY) $(ARGS)
release:
@mkdir -p bin
go build $(GOFLAGS) -ldflags="$(LDFLAGS)" -o $(BINARY) ./cmd/orca
@echo "Release build complete: $(BINARY)"
+59
View File
@@ -0,0 +1,59 @@
# Orca
Offline/CLI-first orchestration engine inspired by HashiCorp Nomad, far simpler than Kubernetes.
## Status
**v0.1: Foundation** — see [.ciagent/ROADMAP.md](.ciagent/ROADMAP.md) for the 6-phase plan.
## Pillars
- **Simplicity** — single binary, minimal dependencies
- **AI-first** — CLI designed for both humans and AI agents
- **Offline-first** — no cloud dependencies
- **CLI-first** — primary interface is the command line
- **Security before features** — NFRs ship before new functionality
- **Bug fixes before features** — stability is paramount
- **NFRs before features** — observability and auditability first
## Quickstart
```bash
# Build
make build
# Run
./bin/orca version
./bin/orca --help
# Initialize local state
./bin/orca init
```
## Subcommands
| Command | Description | Status |
|---------|-------------|--------|
| `orca version` | Print version info | ✅ Phase 1 |
| `orca init` | Initialize local orca state | ✅ Phase 1 (stub) |
| `orca status` | Show orca daemon status | ✅ Phase 1 (stub) |
| `orca node` | Node management (`join`, `leave`, `list`) | Phase 2 |
| `orca job` | Job management (`run`, `list`, `stop`, `logs`) | Phase 3 |
## Development
```bash
make build # Build binary to ./bin/orca
make test # Run tests with race detection
make lint # Run golangci-lint
make fmt # Format code
make release # Build + create Gitea release (Phase 6)
```
## Architecture
See [.ciagent/ARCHITECTURE.md](.ciagent/ARCHITECTURE.md) for full architecture details.
## License
MIT — see [LICENSE](LICENSE).
+10
View File
@@ -0,0 +1,10 @@
module git.cloudinit.dev/coreci/orca
go 1.25
require github.com/spf13/cobra v1.8.1
require (
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
)
+10
View File
@@ -0,0 +1,10 @@
github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+38
View File
@@ -0,0 +1,38 @@
package cli
import (
"fmt"
"os"
"path/filepath"
"github.com/spf13/cobra"
)
var initCmd = &cobra.Command{
Use: "init",
Short: "Initialize local orca state directory",
Long: "Create the local orca state directory at ~/.orca/ and write a default config file.",
RunE: func(cmd *cobra.Command, args []string) error {
home, err := os.UserHomeDir()
if err != nil {
return fmt.Errorf("get home dir: %w", err)
}
orcaDir := filepath.Join(home, ".orca")
if err := os.MkdirAll(orcaDir, 0o755); err != nil {
return fmt.Errorf("create orca dir: %w", err)
}
result := map[string]string{
"path": orcaDir,
"status": "initialized",
}
if jsonOutput {
return printJSON(result)
}
printText("✓ Initialized orca state at %s\n", orcaDir)
return nil
},
}
func init() {
rootCmd.AddCommand(initCmd)
}
+74
View File
@@ -0,0 +1,74 @@
package cli
import (
"fmt"
"github.com/spf13/cobra"
)
var jobCmd = &cobra.Command{
Use: "job",
Short: "Manage orca jobs",
Long: "Run, list, stop, and inspect orca jobs.",
}
var jobRunCmd = &cobra.Command{
Use: "run <spec.hcl>",
Short: "Run a job from an HCL spec file",
Long: "Submit a job spec and execute it. Implemented in Phase 3.",
Args: cobra.ExactArgs(1),
RunE: func(cmd *cobra.Command, args []string) error {
return notImplemented("orca job run " + args[0])
},
}
var jobListCmd = &cobra.Command{
Use: "list",
Short: "List all jobs",
Long: "Display all jobs and their status. Implemented in Phase 3.",
RunE: func(cmd *cobra.Command, args []string) error {
return notImplemented("orca job list")
},
}
var jobStopCmd = &cobra.Command{
Use: "stop <job-id>",
Short: "Stop a running job",
Long: "Stop a job by ID. Implemented in Phase 3.",
Args: cobra.ExactArgs(1),
RunE: func(cmd *cobra.Command, args []string) error {
return notImplemented("orca job stop " + args[0])
},
}
var jobLogsCmd = &cobra.Command{
Use: "logs <job-id>",
Short: "Show logs for a job",
Long: "Display the logs for a job by ID. Implemented in Phase 3.",
Args: cobra.ExactArgs(1),
RunE: func(cmd *cobra.Command, args []string) error {
return notImplemented("orca job logs " + args[0])
},
}
func init() {
jobCmd.AddCommand(jobRunCmd)
jobCmd.AddCommand(jobListCmd)
jobCmd.AddCommand(jobStopCmd)
jobCmd.AddCommand(jobLogsCmd)
rootCmd.AddCommand(jobCmd)
}
func notImplemented(cmd string) error {
if jsonOutput {
return printJSON(map[string]any{
"command": cmd,
"status": "not_implemented",
"phase": "1-cli-skeleton",
"next": "Phase 2-6 will implement this",
})
}
fmt.Fprintf(rootCmd.ErrOrStderr(), "✗ %s: not yet implemented (Phase 1: CLI skeleton only)\n", cmd)
fmt.Fprintf(rootCmd.ErrOrStderr(), " see .ciagent/ROADMAP.md for the full 6-phase plan\n")
return fmt.Errorf("not implemented: %s", cmd)
}
+45
View File
@@ -0,0 +1,45 @@
package cli
import (
"github.com/spf13/cobra"
)
var nodeCmd = &cobra.Command{
Use: "node",
Short: "Manage orca nodes",
Long: "Join, leave, or list orca nodes in the cluster.",
}
var nodeJoinCmd = &cobra.Command{
Use: "join",
Short: "Join a node to the orca cluster",
Long: "Register the local node with the orca cluster. Implemented in Phase 2.",
RunE: func(cmd *cobra.Command, args []string) error {
return notImplemented("orca node join")
},
}
var nodeLeaveCmd = &cobra.Command{
Use: "leave",
Short: "Remove a node from the orca cluster",
Long: "Deregister a node from the orca cluster. Implemented in Phase 2.",
RunE: func(cmd *cobra.Command, args []string) error {
return notImplemented("orca node leave")
},
}
var nodeListCmd = &cobra.Command{
Use: "list",
Short: "List all nodes in the orca cluster",
Long: "Display all registered nodes. Implemented in Phase 2.",
RunE: func(cmd *cobra.Command, args []string) error {
return notImplemented("orca node list")
},
}
func init() {
nodeCmd.AddCommand(nodeJoinCmd)
nodeCmd.AddCommand(nodeLeaveCmd)
nodeCmd.AddCommand(nodeListCmd)
rootCmd.AddCommand(nodeCmd)
}
+52
View File
@@ -0,0 +1,52 @@
package cli
import (
"encoding/json"
"fmt"
"github.com/spf13/cobra"
)
var (
version = "0.1.0-dev"
gitCommit = "unknown"
buildTime = "unknown"
)
var rootCmd = &cobra.Command{
Use: "orca",
Short: "Orca — offline/CLI-first orchestration engine",
Long: `Orca is a minimalist, offline-first, CLI-first orchestration engine
inspired by HashiCorp Nomad, prioritizing stability, security, and simplicity
over feature richness.`,
SilenceUsage: true,
SilenceErrors: true,
}
var jsonOutput bool
func init() {
rootCmd.PersistentFlags().BoolVar(&jsonOutput, "json", false, "output in JSON format")
}
func Execute() error {
return rootCmd.Execute()
}
func printJSON(v any) error {
enc := json.NewEncoder(rootCmd.OutOrStdout())
enc.SetIndent("", " ")
return enc.Encode(v)
}
func printText(format string, args ...any) {
fmt.Fprintf(rootCmd.OutOrStdout(), format, args...)
}
func printResult(text string, jsonObj any) {
if jsonOutput {
_ = printJSON(jsonObj)
return
}
printText("%s\n", text)
}
+67
View File
@@ -0,0 +1,67 @@
package cli
import (
"strings"
"testing"
)
func TestVersionCommandExists(t *testing.T) {
found := false
for _, cmd := range rootCmd.Commands() {
if cmd.Name() == "version" {
found = true
break
}
}
if !found {
t.Fatal("version command not registered")
}
}
func TestRootHasAllSubcommands(t *testing.T) {
expected := []string{"version", "init", "status", "node", "job"}
registered := make(map[string]bool)
for _, cmd := range rootCmd.Commands() {
registered[cmd.Name()] = true
}
for _, name := range expected {
if !registered[name] {
t.Errorf("expected subcommand %q not registered", name)
}
}
}
func TestNodeSubcommands(t *testing.T) {
expected := []string{"join", "leave", "list"}
registered := make(map[string]bool)
for _, cmd := range nodeCmd.Commands() {
registered[cmd.Name()] = true
}
for _, name := range expected {
if !registered[name] {
t.Errorf("expected node subcommand %q not registered", name)
}
}
}
func TestJobSubcommands(t *testing.T) {
expected := []string{"run", "list", "stop", "logs"}
registered := make(map[string]bool)
for _, cmd := range jobCmd.Commands() {
registered[cmd.Name()] = true
}
for _, name := range expected {
if !registered[name] {
t.Errorf("expected job subcommand %q not registered", name)
}
}
}
func TestRootHelpMentionsKeyPillars(t *testing.T) {
help := rootCmd.Long
for _, pillar := range []string{"offline", "CLI", "Nomad", "simplicity"} {
if !strings.Contains(strings.ToLower(help), strings.ToLower(pillar)) {
t.Errorf("root help does not mention pillar %q", pillar)
}
}
}
+36
View File
@@ -0,0 +1,36 @@
package cli
import (
"github.com/spf13/cobra"
)
var statusCmd = &cobra.Command{
Use: "status",
Short: "Show orca daemon status",
Long: "Display the current status of the local orca daemon, including version, uptime, and connection info.",
RunE: func(cmd *cobra.Command, args []string) error {
status := map[string]any{
"version": version,
"daemon": "stopped",
"uptime": "0s",
"api_addr": "https://localhost:8443",
"health": "unknown",
"phase": "1-cli-skeleton",
"milestone": "v0.1",
}
if jsonOutput {
return printJSON(status)
}
printText("orca daemon status\n")
printText(" version: %s\n", version)
printText(" daemon: %s\n", "stopped (daemon not yet implemented in Phase 1)")
printText(" api_addr: %s\n", "https://localhost:8443")
printText(" phase: %s\n", "1-cli-skeleton")
printText(" milestone: %s\n", "v0.1")
return nil
},
}
func init() {
rootCmd.AddCommand(statusCmd)
}
+29
View File
@@ -0,0 +1,29 @@
package cli
import (
"github.com/spf13/cobra"
)
var versionCmd = &cobra.Command{
Use: "version",
Short: "Print version information",
Long: "Print the orca version, git commit, and build time.",
RunE: func(cmd *cobra.Command, args []string) error {
info := map[string]string{
"version": version,
"git_commit": gitCommit,
"build_time": buildTime,
}
if jsonOutput {
return printJSON(info)
}
printText("orca version %s\n", version)
printText(" git commit: %s\n", gitCommit)
printText(" build time: %s\n", buildTime)
return nil
},
}
func init() {
rootCmd.AddCommand(versionCmd)
}
+31
View File
@@ -0,0 +1,31 @@
#!/bin/bash
# trigger_coreci.sh - Trigger CoreCI pipeline for the pushed branch
# Invoked by .githooks/pre-push
# Gracefully degrades if CoreCI API is unreachable (Gitea webhook is secondary path).
set -uo pipefail
CORECI_URL="${CORECI_URL:-https://git.cloudinit.dev/coreci/coreci}"
GITEA_TOKEN="${GITEA_TOKEN:-}"
if [ -z "$GITEA_TOKEN" ]; then
echo " (skip: GITEA_TOKEN not set)"
exit 0
fi
while read local_ref local_sha remote_ref remote_sha; do
branch="${remote_ref#refs/heads/}"
if [ -z "$branch" ] || [ "$branch" = "HEAD" ]; then
continue
fi
echo "→ Triggering CoreCI for branch: $branch (${local_sha:0:7})"
payload=$(printf '{"repo":"coreci/orca","branch":"%s","ref":"%s"}' "$branch" "$local_sha")
if command -v curl >/dev/null 2>&1; then
curl -fsS -X POST "${CORECI_URL}/api/pipeline/run" \
-H "Authorization: token ${GITEA_TOKEN}" \
-H "Content-Type: application/json" \
-d "$payload" >/dev/null 2>&1 \
&& echo " ✓ CoreCI triggered" \
|| echo " (CoreCI trigger failed; pipeline may run via webhook)"
fi
done