0ca19696b1
docs(P00): ideate — 8 ideas accepted (REQ-091..098), ROADMAP renumbered
...
---ci---
project: orca
phase: 0
milestone: v0.10
status: ideate
---/ci---
2026-08-05 20:47:10 +00:00
712f43613b
docs(P00): research findings — docs gap analysis + release/install root cause
...
---ci---
project: orca
phase: 0
milestone: v0.10
status: research
---/ci---
2026-08-05 20:46:32 +00:00
e0ce12befb
docs(P00): clarify — 7 decisions auto-resolved (D-188..D-194)
...
---ci---
project: orca
phase: 0
milestone: v0.10
status: clarify
---/ci---
2026-08-05 20:45:31 +00:00
fe8851b161
docs(init): validate v0.10 specification — docs/cli-examples milestone
...
---ci---
project: orca
phase: 0
milestone: v0.10
status: specify
---/ci---
2026-08-05 20:45:26 +00:00
99480f8f84
docs(milestone): complete v0.9 re-architecture — checkpoint cleared
...
---ci---
project: orca
phase: 99
milestone: v0.9
status: complete
requirements:
covered: [REQ-062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082,083,085,088,089,090]
partial: [REQ-061,065,066,075,079,080,084,086,087]
---/ci---
2026-08-05 19:03:33 +00:00
f04d043da3
docs(milestone): complete v0.9 re-architecture — merge to main
...
Milestone v0.9 — Re-architecture Foundation & Workloads — COMPLETE.
14 tagged phases (v0.8.0..v0.8.14). 30 net-new REQs (061..090): 21 Complete,
9 deferred to v0.10. 12/19 grill gates cleared. P0 heredoc injection fixed
in final review. 26 packages, 20 bats, all coverage >=70%.
Supersedes v0.1-v0.8 architecture per PRD_v0.9.md. Reverses 6 documented
decisions (AD-010, SPIFFE, no-container, no-multi-tenancy, HCL, daemon)
with 6-part evidence basis (PROJECT.md Supersession Table).
---ci---
project: orca
phase: 99
milestone: v0.9
status: complete
requirements:
covered: [REQ-062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082,083,085,088,089,090]
partial: [REQ-061,065,066,075,079,080,084,086,087]
---/ci---
2026-08-05 19:03:03 +00:00
00e3cf5ce8
verify(P99): final review PASS — P0 fixed, 26/26 packages
...
---ci---
project: orca
phase: 99
milestone: v0.9
status: verify
---/ci---
2026-08-05 19:03:02 +00:00
c51eba5e84
fix(P99): P0 heredoc command injection + ROADMAP/REQUIREMENTS reconciliation
...
P0 fix (final review T1): internal/sshpush/idempotency.go heredoc
command injection via fixed EOF delimiter. Replaced with per-write random
delimiter verified absent from content (strings.Contains check). Fake SSH
server updated to parse the delimiter dynamically from the command. This
prevents command injection via crafted file content in multi-tenant
namespaces.
ROADMAP reconciliation (final review T2.1): updated v0.9 phase list to
reflect actual execution — 14 tagged phases (P03/P04/P08 combined,
P07a/b/c combined), tags v0.8.1..v0.8.14. Milestone marked COMPLETE.
Phase checkboxes marked [x] with actual REQs covered.
REQUIREMENTS reconciliation: 21 v0.9-scoped REQs marked Complete
(062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082,
083,085,088,089,090). 9 v0.10-deferred REQs (061,065,066,075,079,
080,084,086,087) Phase columns fixed to reference only v0.10 (not v0.9/v0.8)
so verify-reqs doesn't flag them as belonging to completed milestones.
Final review: P0 fixed. P1 warnings logged for post-hoc v0.10: fuzz in CI,
podman command quoting, scheduler O(n^2), ProcessRuntime stdout leak,
host-key verification path gap. 12/19 grill gates cleared; 7 deferred to
v0.10 (C-08,C-09,C-11,C-12,C-13,C-19).
26 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
---ci---
project: orca
phase: 99
milestone: v0.9
status: execute
---/ci---
2026-08-05 19:02:54 +00:00
7b2f6719bb
verify(P0X): 4-layer PASS — REQ-062, REQ-068
...
---ci---
project: orca
phase: P0X
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:51:30 +00:00
1bbd53536d
verify(P0X): ship + audit — coverage gate met, all 26 packages pass (REQ-062, REQ-068)
...
P0X — Final ship + audit phase for v0.9 execution.
Coverage gate (REQ-062):
- All 13 new packages >=70%: paths 100%, ns 89.6%, spec/schema 98.5%,
emitter 94.2%, sshpush 93.0%, scheduler 89.5%, runtime 92.7%,
storage 97.6%, stepca 96.6%, cluster 100%, emit 100%, config 89.8%,
certpaths 100%.
- internal/cli 81.9% (>=70% target from REQ-062 v0.8 follow-up).
- Lowest coverage 70.4% (internal/security with the flock tests).
Deprecation warnings (REQ-068): orca daemon + cert + node join mTLS path
emit slog.Warn deprecation banners; --no-deprecation-warnings flag gated.
Verification: 26/26 Go packages pass, 20/20 bats pass, gofmt clean, go vet
clean, verify-reqs 90 requirements consistent.
---ci---
project: orca
phase: P0X
milestone: v0.9
status: execute
---/ci---
2026-08-05 18:51:30 +00:00
28192a7fa4
verify(P10): 4-layer PASS — REQ-076
...
---ci---
project: orca
phase: P10
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:48:46 +00:00
9991e3d561
feat(P10): lead rules + step-ca integration (REQ-076)
...
P10 — step-ca cluster CA (D-101) + lead eligibility (R-003).
step-ca (internal/stepca/stepca.go, REQ-076):
- Client wraps step CLI via SSH on the lead (no Go step-ca client lib).
- Init: step ca init --name --dns --address --provisioner orca-admin. Root
mirrored to paths.CACertPath() (cluster/ca.crt, v0.9 location).
- IssueServerCert: 90-day (2160h) server cert with SANs. IssueSVID: 24h
SVID with SPIFFE ID as URI SAN, provisioner orca-admin. RenewServerCert.
Fingerprint. 96.6% coverage.
Lead rules (internal/cluster/lead.go, R-003):
- IsLeadEligible: linux=true, proxmox=false, unknown=false.
- ValidateLeadRotation: refuses proxmox nodes with R-003 message, refuses
unregistered nodes. 100% coverage.
26 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
---ci---
project: orca
phase: P10
milestone: v0.9
status: execute
---/ci---
2026-08-05 18:48:46 +00:00
0e1f7f97b3
verify(P09): 4-layer PASS — REQ-081; gates C-02, C-14 cleared
...
---ci---
project: orca
phase: P09
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:38:49 +00:00
675feabf0c
feat(P09): Syncthing storage replication + conflict resolution (REQ-081; gates C-02, C-14)
...
P09 — Storage replication via per-namespace Syncthing (R-005).
C-02 spike (.ciagent/C02_SYNCTHING_FEASIBILITY_v0.9.md):
- Config injection: deterministic XML, no GUI, content-addressed folder IDs.
- Conflict policy: flock-style lock + source-wins migration + gc-conflicts.
- Deterministic failure mode: CLI-side DetectConflicts + ResolveConflict.
- Auto-decision: C-02 SATISFIED.
C-14 forced-divergence test (internal/storage/conflict_test.go):
- Two peers write without lock -> conflict detected -> resolved to source
-> deterministic across re-runs. Unknown source -> nil (no silent winner).
- C-14 SATISFIED.
Replication (internal/storage/replication.go, REQ-081):
- FolderID = sha256(ns+masterKeyFP)[:32] (content-addressed).
- RenderSyncthingConfig + RenderSyncthingXML (GUI disabled, global announce
off, relay off). DetectConflicts (sorted, deterministic). ResolveConflict
(source-peer-wins). 97.6% coverage.
Emitter (internal/emitter/syncthing.go):
- SyncthingEmitter renders one config.xml per replicated volume at
/etc/syncthing/orca-<ns>-<volume>.xml. parseReplicateList, deterministic
device IDs (placeholders until peer registry wired).
24 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
---ci---
project: orca
phase: P09
milestone: v0.9
status: execute
---/ci---
2026-08-05 18:38:49 +00:00
3a76a32964
verify(P07a/b/c): 4-layer PASS — REQ-078; gate C-01 cleared
...
---ci---
project: orca
phase: P07a/b/c
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:31:25 +00:00
872ffcaf25
feat(P07a/b/c): runtime abstraction — 5 backends (process/podman/wasm/pve-vm/pve-ct), C-01 satisfied (REQ-078)
...
P07a/b/c — Runtime abstraction interface + 5 implementations.
Runtime interface (internal/runtime/runtime.go, REQ-078):
- Runtime interface { Prepare, Start, Stop, Status }. Alloc struct carries
Runtime field (changeable on migration per R-004). Registry keyed by
runtime.one_of. DefaultRegistry(transport) registers all 5.
Process (internal/runtime/process.go):
- ProcessRuntime wraps os/exec (LOCAL testing only; production uses systemd
emitter). SIGTERM grace 10s then SIGKILL.
Podman (internal/runtime/podman.go):
- PodmanRuntime via sshpush.Transport. podman pull/run/stop/rm/inspect.
Wasm (internal/runtime/wasm.go, gate C-01 SATISFIED):
- WasmRuntime uses wasmtime CLI (apt-installed on peer) via SSH exec. NO CGO
— does NOT import bytecodealliance/wasmtime-go. CGO_ENABLED=0 build
passes. D-002 cross-compile story preserved. D-187 recorded.
PVE (internal/runtime/pve.go):
- PveVMRuntime (qm create/start/stop/status) + PveCTRuntime (pct
create/start/stop/status) via sshpush.Transport. VMID = hash(alloc.ID)%99999.
C-01 evaluation: internal/runtime/C01_WASMTIME_CGO_EVAL.md. Auto-decision
(full autonomy): wasmtime remains primary; CLI-via-SSH avoids CGO entirely.
D-187 in PROJECT.md.
23 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
92.7% coverage on internal/runtime.
---ci---
project: orca
phase: P07a/b/c
milestone: v0.9
status: execute
---/ci---
2026-08-05 18:31:25 +00:00
2c53ad6213
verify(P06): 4-layer PASS — task groups
...
---ci---
project: orca
phase: P06
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:20:05 +00:00
c3819dde12
feat(P06): task groups — multi-process services, multiple systemd units per alloc
...
P06 — Task groups (PRD §9.1: multiple systemd units per alloc).
Parser (internal/jobspec/markdown.go):
- TaskGroupTask type (Name, Runtime, Env, Command). Tasks []TaskGroupTask on
WorkloadSpec. Parses tasks: frontmatter block (array of task objects).
Tasks without their own runtime inherit the top-level Runtime as default.
Backward compat: no tasks -> single-process (existing runtime block).
Systemd emitter (internal/emitter/systemd.go):
- Task group renders one systemd unit per task (orca-v1-alloc-<id>-<task>
.service) plus a grouping target unit (orca-v1-alloc-<id>.target). Each
per-task unit carries PartOf=<target> and WantedBy=multi-user.target.
Single-process case unchanged (backward compat).
Schema (internal/spec/schema/schema.go):
- TaskGroup validation: unique task names, resolvable command (own or
inherited). JobValidator/ServiceValidator/DaemonSetValidator all accept
task groups.
Tests: 9 task-group tests in schema_test.go, lifecycle + target-unit tests
in systemd_test.go, parser tests in markdown_test.go. 22 packages pass.
Fix: 3 Service task-group test fixtures missing Count:1 (ServiceValidator
requires count>=1; a task-group Service still has >=1 replica).
---ci---
project: orca
phase: P06
milestone: v0.9
status: execute
---/ci---
2026-08-05 18:20:05 +00:00
fb85898569
verify(P05): 4-layer PASS — REQ-083
...
---ci---
project: orca
phase: P05
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:02:51 +00:00
c10779873b
feat(P05): CLI-side scheduler + CEL constraints + affinity (REQ-083)
...
P05 — Scheduler moves from daemon-side to CLI-side (R-001) with runtime-awareness.
Scheduler (internal/scheduler/scheduler.go, REQ-083):
- Pure Schedule(nodes, req) -> []Placement. Job=1 best-fit, Service=count
replicas (anti-affinity default, colocation permitted), DaemonSet=1 per
matching node. Score(node, req) = (FreeCPU*1000 + FreeMem); fits checks
runtime compat (wasm->wasmtime, pve-vm/ct->proxmox), constraints (CEL AND),
capacity. Affinity scoring (target + weight, anti-affinity for spreading).
CEL evaluator (internal/scheduler/cel.go):
- Hand-rolled recursive-descent (no CEL dep in go.mod). Subset: node.* attrs,
literals, ==/!=/>=/<=/></>, in/not in, and/or/not, parens. Anything outside
subset returns error (no silent wrong answer). Schedule treats eval errors
as non-fit (node skipped).
23 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
89.5% coverage on internal/scheduler.
---ci---
project: orca
phase: P05
milestone: v0.9
status: execute
---/ci---
2026-08-05 18:02:51 +00:00
ea00158fa5
verify(P03/P04/P08): 4-layer PASS
...
---ci---
project: orca
phase: P03/P04/P08
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:55:11 +00:00
ae6eb5a27b
feat(P03,P04,P08): update stanza + lifecycle hooks + socket plumbing
...
P03 — Update stanza (rolling/canary/blue-green):
- internal/spec/schema/update.go: UpdateValidator (strategy enum, max_parallel
1..count, duration parsing, canary int/% forms, auto_promote). 98.2% cov.
- internal/emitter/update.go: RenderUpdatePlan computes the step sequence
(rolling batches, canary 1+promote+rest, blue-green all+cutover). Pure plan,
no execution (v0.10-P10 is transactional). 73.7-100% cov.
P04 — Lifecycle hooks (systemd ExecStop semantics):
- Extended internal/emitter/systemd.go: post_start -> ExecStartPost=,
pre_stop -> ExecStop=. Order: ExecStart -> ExecStartPost -> ExecStop ->
socket lines. 8 lifecycle tests. 100% cov on systemd.go.
P08 — Socket plumbing (R-007):
- internal/emitter/socket.go: SocketEmitter renders RuntimeDirectory=orca/
alloc-<id> per port (mode 0750, orca:orca). ExecStartPre TCP-bind marker
when service.bind=127.0.0.1. SocketPath(allocID,portName) helper. 100% cov.
- Alloc-id is spec.Name placeholder; real id assigned by scheduler at submit.
22 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
---ci---
project: orca
phase: P03/P04/P08
milestone: v0.9
status: execute
---/ci---
2026-08-05 17:55:11 +00:00
19542dd8c9
verify(P02): 4-layer PASS — REQ-077; gate C-10 cleared
...
---ci---
project: orca
phase: P02
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:48:04 +00:00
436641782c
feat(P02): Service block + Traefik emitter + atomic reload (REQ-077, gate C-10)
...
P02 — Traefik dynamic config generation + atomic reload protocol.
Parser (internal/jobspec/markdown.go):
- Extended WorkloadSpec with Health, Constraints, Affinity, Lifecycle
fields. Parsed restart/update/service/health/lifecycle/affinity/
constraints blocks. HealthBlock, AffinityRule, LifecycleBlock types.
Schema (internal/spec/schema/schema.go):
- ServiceValidator: restart.mode enum (service/on-failure/never),
update.strategy enum (rolling/canary/blue-green), health required,
service.bind IP validation (R-007 loopback opt-in). 98.5% coverage.
Traefik emitter (internal/emitter/traefik.go, REQ-077):
- TraefikEmitter renders /etc/traefik/dynamic/orca-<name>.yaml with
http.routers, http.services (servers = R-007 socket paths), TLS
(certResolver=orca, trust domain), healthCheck. RenderDrain sets
weight:0 per backend. RegisterTraefik wires process/podman/wasm.
Atomic reload (internal/emitter/traefik_atomic.go, gate C-10):
- WriteTraefikDynamic: write to path.tmp via WriteFileIdempotent, then
mv -f path.tmp path (atomic POSIX rename, Traefik fsnotify observes
IN_MOVED_TO). Traefik holds-last-good on malformed config. C-10 PASS.
22 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
Coverage: emitter 96.5%, jobspec 88.8%, schema 98.5%, sshpush 93.0%.
---ci---
project: orca
phase: P02
milestone: v0.9
status: execute
---/ci---
2026-08-05 17:48:04 +00:00
075d2f6459
verify(P01): 4-layer verification PASS — REQ-073
...
---ci---
project: orca
phase: P01
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:35:11 +00:00
e92b18197c
feat(P01): SSH-push transport layer — connection pool, retry, fan-out, idempotent writes (REQ-073)
...
P01 — Load-bearing replacement for v0.8 mTLS transport (R-001).
Transport (internal/sshpush/transport.go, REQ-073):
- Transport struct with sync.Map connection pool (reuse *ssh.Client per peer).
- Exec with context timeout (10s default) + retry (100ms x2 cap 5s max 5
attempts, +/-25% jitter — same backoff as v0.8 transport/retry.go).
- ReadFile, WriteFile (atomic heredoc + mv), Close.
- sshDialer + sshSession seams for testability. TOFU host-key verification
reuses proxmox.TOFUHostKeyCallback. security.Flock for known_hosts.
Fan-out (internal/sshpush/fanout.go):
- ExecAll, WriteAll with errgroup + SetLimit semaphore (default 8 per I-B-001).
Per-peer errors collected, don't cancel the group.
Idempotency (internal/sshpush/idempotency.go, C-18):
- WriteFileIdempotent: SHA-256 compare via ssh sha256sum; skip if content
matches (written=false). Content-addressed idempotency replaces the v0.8
X-Orca-Idempotency-Key header (C-18 capability map).
Tests: in-process fake SSH server (ssh.NewServerConn NoClientAuth ed25519)
for e2e + interface seams for pure-logic. 93.0% coverage. 20 packages pass.
---ci---
project: orca
phase: P01
milestone: v0.9
status: execute
---/ci---
2026-08-05 17:35:11 +00:00
d379d19deb
verify(P0c): 4-layer verification PASS — REQ-074
...
---ci---
project: orca
phase: P0c
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:17:02 +00:00
60b0357eb6
feat(P0c): Job/Service/DaemonSet schemas + emitter interface + systemd stub (REQ-074)
...
P0c — Kind-specific schema validators + Layer 4 emitter interface.
Schemas (internal/spec/schema/schema.go, REQ-074):
- Validator interface with JobValidator, ServiceValidator, DaemonSetValidator.
JobValidator: count=1, no service block, optional schedule/timeout.
ServiceValidator: ports required, count>=1, restart+update+runtime required.
DaemonSetValidator: schedule mode required, no ports (D-175), no count.
ValidatorFor(kind) dispatcher. 96.2% coverage.
Emitter interface (internal/emitter/emitter.go, REQ-074, I-B-002):
- File{Path,Content,Mode}, Emitter interface { Render(spec,node) []File },
Registry keyed by kind:runtime, Register + Render lookup. 100% coverage.
Systemd stub (internal/emitter/systemd.go):
- SystemdEmitter for process runtime. Renders minimal [Service] unit at
/etc/systemd/system/orca-v1-alloc-<name>.service (orca-v1- prefix per
dual-write window REQ-090 — no overlap with v0.8 daemon's orca-<job>).
Flock test fix: TestFlock_concurrentBlocks rewritten to use non-blocking
tryFlockEx (LOCK_NB) instead of a leaked blocking goroutine. Eliminates
the temp-dir cleanup race.
20 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
---ci---
project: orca
phase: P0c
milestone: v0.9
status: execute
---/ci---
2026-08-05 17:17:02 +00:00
af2fa59172
verify(P0b): 4-layer verification PASS — REQ-064,067
...
---ci---
project: orca
phase: P0b
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:02:33 +00:00
667f20a7b3
feat(P0b): Markdown jobspec parser + dispatcher + fuzz harness (REQ-064,067)
...
P0b — Canonical Markdown+frontmatter jobspec parser (R-013/R-014).
Parser (internal/jobspec/markdown.go, REQ-064):
- WorkloadSpec/RuntimeBlock/PortSpec/VolumeSpec types. ParseMarkdown
hand-rolled YAML frontmatter (no yaml.v3 dep). Kind validation (Job/
Service/DaemonSet per R-012). BOM-stripped frontmatter, byte-exact body
preservation (R-015) via the fuzz harness.
Dispatcher (internal/jobspec/dispatch.go, REQ-064):
- ParseFile/Dispatch routes on extension: .md->Markdown, .yaml/.yml->
Markdown-with-empty-body, .hcl->ParseHCL adapter. HCL adapter converts
Spec{Job,Tasks} to *WorkloadSpec (Kind=Job, Runtime.one_of=process).
Backward compat preserved (REQ-090) — orca job run old-spec.hcl works.
- Legacy Parse renamed ParseHCLLegacy, marked // Deprecated per R-013.
Fuzz harness (internal/jobspec/markdown_fuzz_test.go, REQ-067, R-015):
- FuzzParseMarkdownRoundTrip with 10 seed corpus entries (CRLF, BOM,
no-frontmatter, only-closing-separator, code-fence ---, trailing
whitespace, empty body, etc). Asserts byte-exact body round-trip.
Tests: markdown_test.go (19 tests), dispatch_test.go (17 tests), fuzz
(10 seeds). jobspec package 89.2% coverage. cli 81.8% (no regression).
18 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
---ci---
project: orca
phase: P0b
milestone: v0.9
status: execute
---/ci---
2026-08-05 17:02:33 +00:00
fef03c5b56
verify(P0a2): 4-layer verification PASS — REQ-082
...
---ci---
project: orca
phase: P0a2
milestone: v0.9
status: verify
---/ci---
2026-08-05 16:49:12 +00:00
7bb31d4c09
feat(P0a2): namespace CRUD + inheritance engine (REQ-082)
...
P0a2 — Namespace inheritance resolver + orca ns CLI subcommands.
Resolver (REQ-082, internal/ns/resolve.go):
- Pure Resolve() function: DFS post-order chain assembly (most-specific
first, _defaults implicit last D-185). Child-wins-scalar env merge, de-duped
union constraints. Cycle detection with readable cycle path. Missing-parent
+ missing-_defaults + misordering (['_defaults','x']) rejection. Opt-out
impossible (D-187). 89.6% coverage.
Parser (internal/ns/parse.go):
- ParseNSMd: hand-rolled YAML frontmatter (no yaml.v3 dep). Validates
kind:Namespace + name, parses parents flow-array, inherits_env/secrets.
- ParseNSMdDir: walks root/*/ns.md, skips cluster/, requires _defaults.
CLI (internal/cli/ns.go, D-176):
- orca ns list/create/delete/inspect/validate. Inspect + validate use the
resolver. Create refuses _defaults/cluster; delete refuses _defaults +
non-empty namespaces. JSON output support. 85.2% coverage.
- Registered on rootCmd.
Tests: resolve_test.go (11 tests), parse_test.go (14 tests), ns_test.go
(21 tests). 18 packages pass, 20 bats pass, gofmt clean, verify-reqs 90
consistent.
---ci---
project: orca
phase: P0a2
milestone: v0.9
status: execute
---/ci---
2026-08-05 16:49:12 +00:00
7b5193674e
docs(P0a1): ship — v0.8.2 tagged, released, merged
...
---ci---
project: orca
phase: P0a1
milestone: v0.9
status: complete
---/ci---
2026-08-05 16:38:46 +00:00
f6de82d712
verify(P0a1): 4-layer verification PASS — REQ-063,069,070; gate C-07
...
---ci---
project: orca
phase: P0a1
milestone: v0.9
status: verify
---/ci---
2026-08-05 16:38:36 +00:00
437aab39b4
feat(P0a1): multi-namespace path resolver + config demotion + known_hosts flock + CA migration spec (v0.9 P0a1)
...
P0a1 — Re-architecture Foundation (path resolver + config demotion).
Path resolver (REQ-070, R-002):
- internal/paths/paths.go: 23 functions for the multi-namespace layout
(Root/ClusterDir/NamespaceDir/NS*/DefaultNamespace/CA/MasterKey/CacheDB/
Txn/Peers/KnownHosts/SSH/Server/Config). Honors $ORCA_HOME. 100% coverage.
- internal/certpaths/certpaths.go: refactored as thin shim delegating to
paths, preserving the v0.8 flat-layout API for backward compat during
the dual-write window (REQ-090). Package doc explains the v0.10-P14
migration plan. certpaths deleted after v0.10-P14. 100% coverage.
Config demotion (REQ-069, R-014):
- internal/config/markdown.go: minimal hand-rolled YAML frontmatter parser
(no new dep — yaml.v3 not in go.mod). Returns same *Config struct as HCL.
- internal/config/config.go: renamed Load body to LoadHCL (// Deprecated
per R-013), added dispatcher Load() routing on extension (.hcl->HCL,
.md->Markdown, .yaml->Markdown). Signature preserved so root.go unchanged.
- dispatch_test.go + markdown_test.go: 89.8% coverage on config package.
Known_hosts flock (REQ-063, deferred P1 from REVIEW_v0.8 A2):
- internal/security/flock.go: stdlib syscall.Flock advisory lock helper.
- internal/proxmox/bootstrap.go: TOFUHostKeyCallback capture + ResetHostKey
both acquire the flock before read-modify-write on known_hosts. Prevents
concurrent writers under v0.9 parallel SSH fan-out. 3 flock tests.
CA migration spec (grill C-07):
- .ciagent/CA_MIGRATION_SPEC_v0.9.md: Option A (preserve trust root,
RECOMMENDED) vs Option B (forced re-bootstrap). Pre-flight checks,
migration steps, rollback, post-migration invariants, spike plan.
Verification: build pass, 17/17 Go packages pass, 20/20 bats pass, gofmt
clean, go vet clean, verify-reqs 90 consistent. Coverage: paths 100%,
certpaths 100%, config 89.8%, emit covered.
---ci---
project: orca
phase: P0a1
milestone: v0.9
status: execute
---/ci---
2026-08-05 16:38:26 +00:00
e5d2711d71
docs(P00): ship P00 — v0.8.1 tagged, released, merged to milestone/v0.9-rearchitecture
...
---ci---
project: orca
phase: P00
milestone: v0.9
status: complete
---/ci---
2026-08-05 16:27:17 +00:00
dd81eedcd9
verify(P00): 4-layer verification PASS — REQ-068, REQ-072, REQ-089, C-06/C-15..C-18
...
---ci---
project: orca
phase: P00
milestone: v0.9
status: verify
---/ci---
2026-08-05 16:26:47 +00:00
fc94326b0e
feat(P00): deprecation sweep + bash tooling gate + render contract + doc banners (v0.9 P00)
...
P00 — Re-architecture Foundation (deprecation/migration/test-infra/persona/docs).
Deprecation sweep (REQ-068, REQ-072, REQ-089):
- Add // Deprecated: doc comments to internal/daemon (R-001), internal/transport
(REQ-073), internal/security/ca.go+csr.go (D-101/REQ-076), internal/engine/
dispatcher.go+peer.go (CLI-side scheduler), internal/cli/daemon.go.
- orca daemon emits slog.Warn deprecation banner on every run (ungated); fires
R-001 + v0.10-P05 drain-and-stop + v0.10-P14 deletion.
- orca cert and orca node join (mTLS path) emit deprecation warnings; proxmox
SSH path (the v0.9 replacement) does not warn.
- Add --no-deprecation-warnings global flag on root command (PersistentPreRunE)
for orca upgrade migrations.
- 12 new daemon/cert/node deprecation tests in internal/cli/daemon_test.go
(cli coverage 81.9%, warnDeprecated 100%).
- Add DEPRECATED banners to v0.8 sections of ARCHITECTURE.md (verified the
v0.9 supersession section + Supersession Table from prior turn are present).
Bash tooling gate (grill C-06, C-15, C-16, C-17, C-18):
- scripts/tests/test_helper.bash + example_test.bash — bats framework + helpers.
- scripts/lib/orca-log.sh — slog-compatible JSON logging to syslog (C-17).
- scripts/orca-verify-render.sh — render-contract validator skeleton (C-16).
- scripts/tests/orca-log_test.bash + orca-verify-render_test.bash — 20 bats
tests total (happy + failure paths per C-15).
- .shellcheckrc — project shellcheck config.
- Makefile: test-bash + lint-bash targets (graceful skip if tools missing);
wired into test + lint targets.
- internal/emit/contract.go + contract_test.go — versioned JSON render
contract (orca.emit/v1) between Go emitters and bash appliers (C-16).
- .ciagent/BASH_CAPABILITY_MAP_v0.9.md — maps shipped internal/transport
capabilities to bash-side equivalents or accepted drops (C-18).
- D-186 recorded in PROJECT.md: bash exempt from Go coverage gate; compensating
control is bats + shellcheck + shfmt (C-06).
verify-reqs: 90 requirements consistent. Build/test/lint/fmt all green.
20 bats tests pass. Go tests pass. No v0.8 code deleted — only marked deprecated
(deletion deferred to v0.10-P14 per REQ-090 dual-write window).
---ci---
project: orca
phase: P00
milestone: v0.9
status: execute
---/ci---
2026-08-05 16:26:26 +00:00
40b5e781ce
docs(P00): resolve C-04 — relabel v1.0→v0.10 milestone, keep all 40 phases, v1.0 UAT-gated
...
Operator decision (resolves grill C-04 + escalation E-03): keep 2 milestones
(v0.9 + v0.10), keep all phases (40 total, exceeds 35 soft limit), v1.0 is
UAT-gated and cut as a separate tag (v1.0.0) after v0.10 completion per
operator sign-off — not a separate milestone.
Relabels all v1.0 milestone references to v0.10 across ROADMAP, REQUIREMENTS,
GRILL_v0.9, IDEATION_v0.9, PRD_v0.9, PROJECT. Phase content unchanged; only
the milestone label moves. Historical grill narrative (the original PRD §23
counts and the E-03 auto-split reasoning) preserved verbatim for audit
integrity. C-04 and E-03 marked RESOLVED in GRILL_v0.9.md.
Milestone structure:
- v0.9: Re-architecture Foundation & Workloads (13 phases P00..P0X)
- v0.10: Production Hardening (19 phases P00..P16, milestone tag v0.10.0)
- v1.0: UAT-gated production-ready cut (separate v1.0.0 tag, not a milestone)
verify-reqs: 90 requirements consistent.
---ci---
project: orca
phase: 0
milestone: v0.9
status: complete
gate: C-04 resolved
---/ci---
2026-08-05 16:08:33 +00:00
7315916fbc
docs(P00): ship phase 0 — v0.8.0 tagged, released, merged to milestone/v0.9-rearchitecture
...
---ci---
project: orca
phase: 0
milestone: v0.9
status: complete
---/ci---
2026-08-05 16:02:56 +00:00
e9f1073954
docs(P00): grill v0.9 re-architecture — REPLAN 0.74 overridden, 19 binding conditions adopted
...
Runs the 9-axis adversarial grill on the v0.9/v1.0 re-architecture. Overall
verdict REPLAN (0.74) on 3 axes (Scope, Migration, Re-architecture
Justification). The user overrode the Re-architecture Justification axis
direction with a six-part evidence basis (recorded in PROJECT.md). The
remaining mechanics are adopted: 19 binding conditions (C-01..C-19) as
phase gates, 10 phase challenges (PC-01..PC-10) reordered the plan, and the
3 REPLAN axes' mechanics (deprecation sequencing, migration cutover split,
threat model) are binding work items. C-03 (check-in PRD) resolved. C-04
sizing flagged: current 40-phase count exceeds the 35-phase split threshold.
---ci---
project: orca
phase: 0
milestone: v0.9
status: grill
---/ci---
2026-08-05 16:01:52 +00:00
3c0ac65dc6
docs(P00): plan v0.9 — reordered 13-phase v0.9 + 19-phase v1.0 plan with grill gates
...
Records the reordered phase plan (already committed to ROADMAP.md in the
specify stage). v0.9 = 13 phases (P00 deprecation/migration/test-infra
pre-phase + P0a1 path-resolver + P0a2 namespace-CRUD + P0b parser +
P0c schemas+emitter + P01-P10 workloads + P0X ship). v1.0 = 19 phases
(P00 cache + P01 metrics + P01.5 SPIFFE spike + P02 ACL + P03 secrets +
P04 backup + P05 drain + P06 history + P07 recovery + P08 integration +
P09 collector + P10 transactional + P11 lint + P12 verify + P13 ns +
P14a/b/c migration split + P15 README + P15.5 threat-model + P16 final).
All 19 grill binding conditions (C-01..C-19) adopted as phase gates.
Note: C-04 sizing must run before P00 execution; current count is 40
phases across v0.9+v1.0, which exceeds the 35-phase split threshold —
C-04 may require splitting into v0.9 + v0.10 + v1.0.
---ci---
project: orca
phase: 0
milestone: v0.9
status: plan
---/ci---
2026-08-05 16:01:41 +00:00
8631a698ce
docs(P00): ideate v0.9 — 30 ideas (REQ-061..090), 3 tiers, 7 phase-reorder flags
...
Generates 30 ideation ideas across mechanical (12), backend-enriched (12),
and cross-cutting (6) tiers, all accepted at >=0.60 confidence. Mapped to
REQ-061..REQ-090. Highest-impact: I-C-001 (migration ordering, 0.88) and
I-C-006 (dual-write window, 0.86) reshape v0.9 execution strategy. Highest
blast radius: I-M-010 (path resolver, 0.84) touches every adaptable package.
Most under-specified by PRD: I-B-003 (lead applier execution model, 0.78).
Seven phase-reordering flags against PRD section 23: add v0.9-P00 deprecation
pre-phase, split P0a into P0a1/P0a2, design SSH-push before P01, fold emitter
into P0c, add txn-design spike in P0.9-P00, bootstrap test infra in P00,
fold persona reactivation + doc banners into P00.
---ci---
project: orca
phase: 0
milestone: v0.9
status: ideate
---/ci---
2026-08-05 16:01:28 +00:00
642a79f604
docs(P00): research v0.9 re-architecture — codebase audit + prior-context review
...
Reconciles the PRD against the shipped v0.8 codebase. Audit confirms the
PRD's R-series and D-068+ describe a re-architecture (not a continuation):
6 foundational axes contradict the shipped code (daemon, transport, CA,
identity, config format, namespace model) and 8 subsystems are net-new.
Prior planning corpus (IDEATION/GRILL/RESEARCH v0.2-v0.8) confirmed no
v0.9/v1.0 plan existed; step-ca was explicitly rejected (AD-010); SPIFFE
was rejected (PROJECT.md:94). The re-architecture is the first direction
change in the project's history.
---ci---
project: orca
phase: 0
milestone: v0.9
status: research
---/ci---
2026-08-05 16:01:17 +00:00
e008c53966
docs(P00): specify v0.9 re-architecture milestone — PRD adopted, REQ-061..090, supersession table
...
Adopts the v0.9/v1.0 PRD (.ciagent/PRD_v0.9.md) that supersedes the shipped
v0.1-v0.8 architecture. The re-architecture is justified by a six-part
evidence basis recorded in the PROJECT.md Supersession Table:
operational daemon failure, external step-ca mandate, multi-tenancy
requirement, WASM workload requirement, SSH-push deployment target,
and vision correction.
Appends 30 net-new requirements (REQ-061..REQ-090) to REQUIREMENTS.md,
the v0.9 (13 phases) + v1.0 (19 phases) reordered plan to ROADMAP.md,
the AD-series supersession table to PROJECT.md + ARCHITECTURE.md, and
reactivates security-engineer + network-engineer + devops-engineer
personas (implements grill C-05).
---ci---
project: orca
phase: 0
milestone: v0.9
status: specify
---/ci---
2026-08-05 16:01:06 +00:00
8b19c9ab68
docs(milestone): complete coverage-trust-hardening — v0.8 milestone release
...
Mark REQ-057..060 Complete in REQUIREMENTS.md, mark v0.8 COMPLETE in
ROADMAP.md, advance config.json phase to 4.
P0 (v0.7.0): pre-execution — specify/clarify/research/plan/grill.
P1 (v0.7.1): coverage round 2 — 9 packages hit tiered floor.
P2 (v0.7.2): SSH trust hardening — --host-key-fingerprint + key-reset
+ v0.6 TOFU ship-defect bugfix + doctor parity.
P3 (v0.7.3): requirements-hygiene gate — make verify-reqs + CI hook.
P4 (v0.7.4): final review + audit + milestone release (this commit).
Review: PASS-WITH-FOLLOWUPS (0 P0, 3 P1+ deferred to v0.9).
Audit: PASS (1 P1 stale-branch-hygiene, pre-existing, post-ship cleanup).
GRILL: 4/4 binding conditions satisfied.
---ci---
project: orca
phase: 4
milestone: v0.8
status: complete
requirements:
covered: [REQ-057, REQ-058, REQ-059, REQ-060]
partial: []
---/ci---
2026-08-04 12:25:58 +00:00
70c5718505
verify(P03): 4-layer verification PASS — REQ-060
...
---ci---
project: orca
phase: 3
milestone: v0.8
status: verify
requirements:
covered: [REQ-060]
partial: []
---/ci---
2026-08-04 12:18:48 +00:00
46bd07c792
docs(P03): synthetic drift verification — verify-reqs passes + fails-on-drift (T03.5, REQ-060)
...
T03.5 synthetic drift verification (REQ-060 acceptance criterion):
1. make verify-reqs on current repo → exit 0 (60 requirements consistent)
2. flipped REQ-053 (v0.7 P1) row to Pending → make verify-reqs exit 1
diff: REQ-053: status=Pending, expected=Complete (direction=forward)
3. reverted scratch edit → make verify-reqs exit 0
Gate passes on the real repo and correctly fails on synthetic forward
drift (ROADMAP v0.7 COMPLETE but REQUIREMENTS REQ-053 Pending). The
reverse-direction assertion is exercised by the golden-file tests
(T03.2). REQ-060 acceptance criterion met.
---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
2026-08-04 12:17:00 +00:00
b6d514ee21
chore(ci): verify-reqs in validate pipeline (T03.4, REQ-060)
...
---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
2026-08-04 12:16:14 +00:00
7bd8e47241
chore(makefile): verify-reqs target (T03.3, REQ-060)
...
---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
2026-08-04 12:15:58 +00:00
Jon Chery