coreci/orca
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 91 Wiki Activity
208 Commits 3 Branches 148 Tags
0d5ff663b4964fd0d97bb2be49e11ebe09947ddc
Commit Graph

130 Commits

Author SHA1 Message Date
Jon Chery a627d0ee6d docs(checkpoint): P09+P10 shipped (daemon auth + audit tamper-evidence) 
---ci---
project: orca
phase: 10
milestone: v0.12
status: complete
---/ci---
 2026-08-07 11:18:52 +00:00
Jon Chery 691463ff74 docs(checkpoint): P04+P05 shipped (OIDC client + WebAuthn connector) 
---ci---
project: orca
phase: 5
milestone: v0.12
status: complete
---/ci---
 2026-08-07 11:02:18 +00:00
Jon Chery 7177ac7538 docs(checkpoint): wave A complete (P01-P03 shipped v0.11.1-v0.11.3) 
---ci---
project: orca
phase: 3
milestone: v0.12
status: complete
---/ci---
 2026-08-07 10:56:34 +00:00
Jon Chery cf0df0f157 docs(P00): v0.12 security-hardening phase 0 (specify/clarify/research/ideate/plan/grill) 
---ci---
project: orca
phase: 0
milestone: v0.12
status: specify
---/ci---

Threat-model review of entire surface incl OS (25 findings F1..F25).
Adopts R-021 (no Orca credentials: human=OIDC, machine=mTLS/SPIFFE).
Bundled Dex + WebAuthn (passkeys) as default password-free authenticator.
Master key seal-to-OIDC + Shamir 3-of-5 recovery.
30 net-new requirements (REQ-119..REQ-148). 29 phases. Binding conditions C-29..C-38.
 2026-08-07 10:45:07 +00:00
Jon Chery da1f93ea77 docs(milestone): complete v0.11 — Production Hardening (24 phases shipped) 
Mark all v0.11 REQs (REQ-099..118 + deferred REQ-061/065/066/075/079/080/084/086/087) as Complete in REQUIREMENTS.md. Mark all v0.11 phases as [x] and the milestone as COMPLETE in ROADMAP.md. Update checkpoint to phase 16/complete/milestone_complete=true.

v0.11 shipped 24 phases (P00..P16 including P10a/P10b split per C-24):
- P00: CLI cache (R-008)
- P01: Metrics endpoint
- P01.5: SPIFFE SVID spike (C-08 PASSED)
- P02: ACL (SPIFFE + token)
- P03: Secrets (AES-256-GCM, REQ-080)
- P04: Backup/restore (signed tarball)
- P05: Drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)
- P06: Alloc history (REQ-071) + logs --all-nodes (REQ-117)
- P07: Recovery (orca restore)
- P08: Integration tests (REQ-087) + drift stubs
- P09: Collector + aggregator (C-11/C-12/C-14) + drift aggregation (REQ-107)
- P10a: Transactional plane (REQ-075/079, C-09, C-23)
- P10b: Drift detection (R-018/R-019/R-020, REQ-103..113)
- P11: Job lint (REQ-084)
- P12: Job verify (dry-run txn)
- P13: ns subcommands + deprecation warnings (REQ-068)
- P14a: v0.8→v1.0 migration (REQ-066, C-07) + upgrade (REQ-115, C-25, C-27)
- P14b: Daemon cutover + rotate-lead (REQ-114)
- P14c: Mixed-version tolerance + no-orca-on-server (REQ-065, REQ-086, C-13)
- P15: README quickstart (REQ-089, Q5=A framing)
- P15.5: Threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118)
- P16: Final review + ship + audit (this phase)

Tags: v0.10.0 (P0) → v0.10.22 (P16 = v0.11.0 milestone release).
Total: 118 REQs (98 prior + 20 new), all Complete.

---ci---
project: orca
phase: 16
milestone: v0.11
status: complete
requirements:
  covered: [99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,61,65,66,75,79,80,84,86,87]
  partial: []
gates:
  cleared: [C-23,C-24,C-25,C-27,C-28,C-08,C-09,C-11,C-12,C-14,C-19]
---/ci---
 2026-08-07 08:36:29 +00:00
Jon Chery 734c9fa0fa feat(P01.5): SPIFFE SVID minting spike (REQ-076, gate C-08) — PASSES 
internal/identity/spiffe.go: SpiffeURI format + MintSVID via step CLI;
internal/identity/spiffe_test.go: mock-transport tests with self-signed
SPIFFE URI SAN cert. Spike passes: step CLI supports --san with URI SANs.
Fallback to mTLS identity NOT needed.

---ci---
project: orca
phase: 01.5
milestone: v0.11
status: execute
---/ci---
 2026-08-07 04:30:43 +00:00
Jon Chery 249518c807 docs(checkpoint): P00 shipped v0.10.1 — next P01 
---ci---\nproject: orca\nphase: 01\nmilestone: v0.11\nstatus: execute\n---/ci---
 2026-08-07 04:20:33 +00:00
Jon Chery 2f7b2da05a docs(checkpoint): v0.11 phase 0 complete — shipped v0.10.0 
---ci---
project: orca
phase: 0
milestone: v0.11
status: complete
---/ci---
 2026-08-07 03:48:46 +00:00
Jon Chery 715fcb54b3 fix(verify-reqs): update 9 deferred REQ phase cells from v0.10 to v0.11 
REQ-061, 065, 066, 075, 079, 080, 084, 086, 087 were assigned v0.10 Pxx phases in v0.9 planning but v0.10 became a docs milestone; these execution REQs are now v0.11. Phase cells updated to reference v0.11 Pxx phases so verify-reqs passes (forward drift: milestone COMPLETE in ROADMAP must have REQ Complete; these were Pending with a COMPLETE milestone reference).

---ci---
project: orca
phase: 0
milestone: v0.11
status: grill
---/ci---
 2026-08-07 03:43:52 +00:00
Jon Chery e45611b416 docs(P00): grill v0.11 — 6 binding conditions (C-23..C-28), P10 split into P10a/P10b 
GRILL stage: adversarial review across 6 forcing questions. Verdict: PROCEED-WITH-CONDITIONS.
- C-23: orca-pull.sh distinguishes cluster-wide vs ns-scoped txns (gate P10a)
- C-24: split P10 into P10a (txn plane) + P10b (drift detection); phase count 23->24; tags shift by 1
- C-25: orca upgrade post-cutover verification + rollback (gate P14a)
- C-26: per-phase LoC soft ceiling ~800 (no gate, recorded)
- C-27: orca upgrade creates orca system user on existing peers (gate P14a)
- C-28: P15.5 two sub-waves (ingress+doctor nft, then threat model+doctor mTLS) (gate P15.5)
ROADMAP updated: 24 phases, tags v0.10.0..v0.10.22.

---ci---
project: orca
phase: 0
milestone: v0.11
status: grill
---/ci---
 2026-08-07 03:40:55 +00:00
Jon Chery 5b99bbd2e8 docs(P00): create v0.11 phase plan (8 waves, 23 phases, 20 new REQs) 
PLAN stage: 8-wave structure covering 23 phases. Wave 0 (P00 cache), Wave 1 (P01/P01.5/P02 observability+identity), Wave 2 (P03/P15.5 security+ingress hybrid+doctor mTLS), Wave 3 (P04/P06 backup+alloc history+logs), Wave 4 (P05/P07 drain+migrate+recovery), Wave 5 (P10/P11/P12 txn plane+drift+lint+verify), Wave 6 (P09/P13 aggregator+ns), Wave 7 (P14a/b/c migration+upgrade+rotate-lead), Wave 8 (P08/P15/P16 integration+docs+ship). P10 is the largest phase; grill may split into P10a/P10b.

---ci---
project: orca
phase: 0
milestone: v0.11
status: plan
---/ci---
 2026-08-07 03:39:27 +00:00
Jon Chery a70eb0d83d docs(P00): research findings + persona assessment for v0.11 
RESEARCH stage: consolidate 5 research docs (ingress hybrid, drift detection, platform-engineer playbook, strategic positioning, systemd Path unit impl) + codebase verification into RESEARCH_v0.11.md. Update PERSONAS.md: data-engineer reactivated for P14a, docs-engineer phase-specific for P15, devops-engineer owns drift-detection bash scripts + integration tests.

---ci---
project: orca
phase: 0
milestone: v0.11
status: research
---/ci---
 2026-08-07 03:38:17 +00:00
Jon Chery 6f7a5122cc docs(clarify): resolve C1-C5 for v0.11 phase 0 
CLARIFY stage: 5 clarifications resolved per locked decisions + synthesis.
C1: hybrid default for fresh init, migrate existing via orca upgrade
C2: thin wrapper upgrade (v0.11); full rolling upgrade defers to v1.x
C3: drain+reschedule migrate (v0.11); live-migrate defers to v1.x
C4: remediation cooldown on success only; transient failures retry next tick
C5: doctor mTLS = chain verification + live handshake probe

---ci---
project: orca
phase: 0
milestone: v0.11
status: clarify
---/ci---
 2026-08-07 03:37:40 +00:00
Jon Chery 1cc965e23b docs(specify): adopt R-017..R-020, D-215..D-237, REQ-099..REQ-118 for v0.11 
SPECIFY stage: adopt 5 research docs into authoritative ciagent files.
- PRD_v0.11.md: new file extending R-series 16->20 (R-017 ingress hybrid, R-018/R-019/R-020 drift detection)
- PROJECT.md: append D-215..D-237 (23 new decisions, no collisions with D-001..D-206)
- REQUIREMENTS.md: append REQ-099..REQ-118 (20 net-new; ingress 099-102, drift 103-113, CLI 114-118)
- ROADMAP.md: update v0.11 section (fold ingress into P15.5 per Q3=A, expand P09/P10, add CLI REQs to P05/P06/P14a/P14b per Q2=C)

---ci---
project: orca
phase: 0
milestone: v0.11
status: specify
---/ci---
 2026-08-07 03:37:24 +00:00
Jon Chery a412f832fd docs(init): v0.11 phase 0 specify — validate specification 
Bump config.json milestone to v0.11, phase 0. Initialize checkpoint at specify stage. Adopt 5 research docs (ingress hybrid, drift detection, platform-engineer playbook, strategic positioning, systemd Path unit impl) with locked decisions Q1=A (adopt R-017..R-020), Q2=C (add all 5 CLI commands), Q3=A (fold ingress into P15.5), Q4=A (--force + per-ns scoping), Q5=A (Nomad-inspired framing).

---ci---
project: orca
phase: 0
milestone: v0.11
status: specify
---/ci---
 2026-08-07 03:35:46 +00:00
Jon Chery a20cdb294c docs(debug): update checkpoint to v0.9.6 (post-hoc fix) 
---ci---
project: orca
phase: 99
milestone: v0.10
status: complete
---/ci---
 2026-08-05 21:24:08 +00:00
Jon Chery 8839781539 docs(milestone): complete v0.10 — checkpoint cleared, branches deleted 
---ci---
project: orca
phase: 99
milestone: v0.10
status: complete
requirements:
  covered: [REQ-091,REQ-092,REQ-093,REQ-094,REQ-095,REQ-096,REQ-097,REQ-098]
  partial: []
---/ci---
 2026-08-05 21:03:28 +00:00
Jon Chery f0b9910bf1 docs(milestone): complete v0.10 — docs & install hardening 
Milestone v0.10 — Docs & Install Hardening — COMPLETE.

6 tagged phases (v0.9.0..v0.9.5). 8 REQs (091-098) all Complete:
- REQ-091: docs/cli.md (CLI reference)
- REQ-092: docs/jobspec.md (jobspec reference)
- REQ-093: docs/ingress.md (ingress guide)
- REQ-094: examples/full-stack/ (5 jobspecs + rendered + walkthrough)
- REQ-095: README.md refresh (22 commands, current install, docs/examples)
- REQ-096: docs/namespace.md v0.9 multi-namespace layout
- REQ-097: release.sh cross-build amd64 + asset verification (C-21)
- REQ-098: install.sh fallback walk + --check dry-run

3 binding conditions cleared (C-20, C-21, C-22).
7 decisions (D-188..D-194). 31 files changed, 2654 insertions.

Root cause of v0.4.5 install fixed: v0.8.x releases shipped with zero
binary assets; release.sh now cross-builds amd64 + verifies the asset
post-create; install.sh walks back through releases if the latest lacks
an asset. v0.9.1 is the first correctly-asseted release.

---ci---
project: orca
phase: 5
milestone: v0.10
status: complete
requirements:
  covered: [REQ-091,REQ-092,REQ-093,REQ-094,REQ-095,REQ-096,REQ-097,REQ-098]
  partial: []
---/ci---
 2026-08-05 21:02:31 +00:00
Jon Chery 94711e05f1 verify(P04): 4-layer PASS — REQ-095, REQ-096 
---ci---
project: orca
phase: 4
milestone: v0.10
status: verify
---/ci---
 2026-08-05 21:00:54 +00:00
Jon Chery e9686f4ab0 docs(P04): README refresh + namespace.md v0.9 layout update 
P04 — README and namespace.md refresh (REQ-095, REQ-096).

README.md (REQ-095):
- Status line updated (v0.9 complete, v0.10 in progress).
- Install --version example updated to v0.9.1 (current).
- Added --check dry-run example.
- Update-in-place example updated to v0.8.15 -> v0.9.1.
- Subcommand table expanded to all 22 commands with Since column and
  deprecation markers (daemon, cert, status marked deprecated).
- Development section complete (verify-reqs, security-scan, test-race,
  changelog, release).
- New Documentation section linking all 7 docs/*.md.
- New Examples section linking examples/full-stack/.

docs/namespace.md (REQ-096):
- Replaced v0.8 flat path table with v0.9 multi-namespace layout
  (cluster/, _defaults/, per-ns db/jobs/alloc/ns.md, orca_cache.db).
- Full path reference table from internal/paths/paths.go.
- Namespace root resolution (ORCA_HOME/--system/~/.orca).
- orca ns subcommand cross-link to docs/cli.md.
- Namespace inheritance (_defaults implicit root, D-159/D-185/D-187).
- v0.8 flat layout flagged deprecated with callout box.

All README links verified to resolve. make verify-reqs: 98 consistent.

---ci---
project: orca
phase: 4
milestone: v0.10
status: execute
---/ci---
 2026-08-05 21:00:46 +00:00
Jon Chery 76967b5145 verify(P03): 4-layer PASS — REQ-094; gate C-20 cleared 
---ci---
project: orca
phase: 3
milestone: v0.10
status: verify
---/ci---
 2026-08-05 20:59:41 +00:00
Jon Chery 2c26a6d54f docs(P03): full-stack examples — 5 jobspecs + rendered artifacts + walkthrough 
P03 — full-stack example with ingress configured (REQ-094; gate C-20).

examples/full-stack/:
- web-app.md: kind Service, process runtime, 3 replicas, Unix socket
  (default R-007), rolling update, constraints (node.role==web),
  affinity (zone==a weight 80), lifecycle hooks (post_start/pre_stop).
- api.md: kind Service, process runtime, 2 replicas, TCP opt-in
  (service.bind: 127.0.0.1, R-007), canary update with manual promote,
  constraints (node.role==api, node.cpus>=2), env vars.
- worker.md: kind Job, process runtime, one-shot, timeout 300s, env
  vars, lifecycle hooks (register/drain).
- log-shipper.md: kind Service (DaemonSet workaround — parser gap),
  process runtime, constraints (node.role==logs), env vars. Notes the
  v0.9 parser gap (schedule: block not wired) in a callout.
- postgres.md: kind Service, process runtime, 1 replica, blue-green
  update, volumes with replication (replicate:peer-b,peer-c via
  Syncthing), constraints (node.role==db, node.cpus>=4, node.memory>=8192).
- rendered/: Traefik dynamic YAML (web-app, api) + systemd units
  (web-app, api, log-shipper) showing what Orca generates on target nodes.
- README.md: end-to-end walkthrough (init -> node join -> capacity set
  -> ns create -> job run -> list --watch -> inspect rendered -> verify
  ingress -> drain/rollback). Cross-links to docs/ingress.md.
- examples_test.go: Go test that parses + validates all 5 jobspecs
  against the current parser and schema validators (gate C-20).

All 5 jobspecs pass jobspec.ParseFile + schema.ValidatorFor(kind).

---ci---
project: orca
phase: 3
milestone: v0.10
status: execute
---/ci---
 2026-08-05 20:59:33 +00:00
Jon Chery 4e019ab51e verify(P02): 4-layer PASS — REQ-091, REQ-092, REQ-093; gate C-22 cleared 
---ci---
project: orca
phase: 2
milestone: v0.10
status: verify
---/ci---
 2026-08-05 20:57:16 +00:00
Jon Chery 289e5cf6e1 docs(P02): CLI reference + jobspec reference + ingress guide 
P02 — operator-facing documentation (REQ-091, REQ-092, REQ-093; gate C-22).

docs/cli.md (REQ-091):
- Full CLI command/flag reference: every command/subcommand with synopsis,
  flag tables (name/type/default/description), one-line examples.
- Global flags (--json, --system, --config, --no-deprecation-warnings).
- Output modes (text/json/watch), env vars, exit codes.
- Deprecated surface callout boxes (daemon, cert, node-join-mTLS, HCL
  jobspec) pointing to v0.11 removal.

docs/jobspec.md (REQ-092):
- Markdown frontmatter schema reference: all top-level keys, block
  reference (runtime/ports/env-secrets/volumes/restart/update/service/
  health/lifecycle/constraints/affinity/tasks), kinds matrix
  (Job/Service/DaemonSet required vs allowed), CEL subset grammar, body
  byte-exact preservation (R-015), deprecated HCL callout.

docs/ingress.md (REQ-093):
- Traefik ingress reference: service->Traefik mapping (D-175), R-007
  socket-vs-TCP-bind semantics, generated YAML shape (routers/services/
  healthCheck), atomic reload (C-10), drain (weight:0), TLS (certResolver,
  trust domain, step-ca), worked-example pointer to examples/full-stack/,
  v0.11 forward limitations.

All factual claims grounded in live codebase (gate C-22). Cross-links
verified to resolve.

---ci---
project: orca
phase: 2
milestone: v0.10
status: execute
---/ci---
 2026-08-05 20:57:05 +00:00
Jon Chery cfec794bb7 verify(P01): 4-layer PASS — REQ-097, REQ-098; gate C-21 cleared 
---ci---
project: orca
phase: 1
milestone: v0.10
status: verify
---/ci---
 2026-08-05 20:52:43 +00:00
Jon Chery eadd28fac0 fix(P01): release.sh cross-build amd64 + asset verification; install.sh fallback walk + --check 
P01 — release/install pipeline fix (REQ-097, REQ-098; gate C-21).

release.sh (REQ-097):
- Cross-build linux-amd64 regardless of host arch (GOOS=linux GOARCH=amd64
  go build, CGO_ENABLED=0). D-193: the host-arch build produced the wrong
  tarball when cut from arm64 — root cause of the v0.8.x asset-less
  releases.
- Hardcode tarball name to orca-${VERSION}-linux-amd64.tar.gz (not
  host-arch-dependent).
- Post-create asset verification (C-21): after tea releases create, query
  the Gitea API and assert the tarball appears in attachments. Retry once
  via tea release edit if missing. Fail loudly if still missing. This
  catches the tea CLI bug where create exits 0 without attaching the asset.

install.sh (REQ-098):
- Asset fallback walk: if the resolved release (latest or --version) lacks
  the matching tarball, query /releases?limit=50, extract all
  browser_download_urls from the list response (assets are inline), find
  the newest release with a matching orca-*-linux-amd64.tar.gz asset, print
  a WARNING, and use that release. Fixes the v0.4.5 install incident where
  v0.8.15 had no asset and install.sh errored out with no fallback.
- --check dry-run mode (D-194): prints version + asset URL + install path
  + current version without writing anything.

Tests (scripts/tests/):
- install_test.bash: 5 tests (--help, --check happy path, --check fallback
  walk, unknown arg rejection, --system root check).
- release_test.bash: 5 tests (script exists, syntax valid, cross-build
  command present, amd64 tarball name hardcoded, asset verification present).

All 30 bats tests pass. make lint clean (no new warnings).

---ci---
project: orca
phase: 1
milestone: v0.10
status: execute
---/ci---
 2026-08-05 20:52:25 +00:00
Jon Chery 3b6241e5c9 docs(P00): ship complete — v0.9.0 tagged, release created, phase branch deleted 2026-08-05 20:48:32 +00:00
Jon Chery 152a7fc375 docs(P00): grill PASS (0.82) — 3 binding conditions, 3 phase challenges 
---ci---
project: orca
phase: 0
milestone: v0.10
status: grill
---/ci---
 2026-08-05 20:47:50 +00:00
Jon Chery 7007aa6179 docs(P00): create phase plans — 5 phases, 4 waves, 18 tasks 
---ci---
project: orca
phase: 0
milestone: v0.10
status: plan
---/ci---
 2026-08-05 20:47:39 +00:00
Jon Chery 0ca19696b1 docs(P00): ideate — 8 ideas accepted (REQ-091..098), ROADMAP renumbered 
---ci---
project: orca
phase: 0
milestone: v0.10
status: ideate
---/ci---
 2026-08-05 20:47:10 +00:00
Jon Chery 712f43613b docs(P00): research findings — docs gap analysis + release/install root cause 
---ci---
project: orca
phase: 0
milestone: v0.10
status: research
---/ci---
 2026-08-05 20:46:32 +00:00
Jon Chery e0ce12befb docs(P00): clarify — 7 decisions auto-resolved (D-188..D-194) 
---ci---
project: orca
phase: 0
milestone: v0.10
status: clarify
---/ci---
 2026-08-05 20:45:31 +00:00
Jon Chery fe8851b161 docs(init): validate v0.10 specification — docs/cli-examples milestone 
---ci---
project: orca
phase: 0
milestone: v0.10
status: specify
---/ci---
 2026-08-05 20:45:26 +00:00
Jon Chery 99480f8f84 docs(milestone): complete v0.9 re-architecture — checkpoint cleared 
---ci---
project: orca
phase: 99
milestone: v0.9
status: complete
requirements:
  covered: [REQ-062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082,083,085,088,089,090]
  partial: [REQ-061,065,066,075,079,080,084,086,087]
---/ci---
 2026-08-05 19:03:33 +00:00
Jon Chery 00e3cf5ce8 verify(P99): final review PASS — P0 fixed, 26/26 packages 
---ci---
project: orca
phase: 99
milestone: v0.9
status: verify
---/ci---
 2026-08-05 19:03:02 +00:00
Jon Chery c51eba5e84 fix(P99): P0 heredoc command injection + ROADMAP/REQUIREMENTS reconciliation 
P0 fix (final review T1): internal/sshpush/idempotency.go heredoc
command injection via fixed EOF delimiter. Replaced with per-write random
delimiter verified absent from content (strings.Contains check). Fake SSH
server updated to parse the delimiter dynamically from the command. This
prevents command injection via crafted file content in multi-tenant
namespaces.

ROADMAP reconciliation (final review T2.1): updated v0.9 phase list to
reflect actual execution — 14 tagged phases (P03/P04/P08 combined,
P07a/b/c combined), tags v0.8.1..v0.8.14. Milestone marked COMPLETE.
Phase checkboxes marked [x] with actual REQs covered.

REQUIREMENTS reconciliation: 21 v0.9-scoped REQs marked Complete
(062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082,
083,085,088,089,090). 9 v0.10-deferred REQs (061,065,066,075,079,
080,084,086,087) Phase columns fixed to reference only v0.10 (not v0.9/v0.8)
so verify-reqs doesn't flag them as belonging to completed milestones.

Final review: P0 fixed. P1 warnings logged for post-hoc v0.10: fuzz in CI,
podman command quoting, scheduler O(n^2), ProcessRuntime stdout leak,
host-key verification path gap. 12/19 grill gates cleared; 7 deferred to
v0.10 (C-08,C-09,C-11,C-12,C-13,C-19).

26 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.

---ci---
project: orca
phase: 99
milestone: v0.9
status: execute
---/ci---
 2026-08-05 19:02:54 +00:00
Jon Chery 7b2f6719bb verify(P0X): 4-layer PASS — REQ-062, REQ-068 
---ci---
project: orca
phase: P0X
milestone: v0.9
status: verify
---/ci---
 2026-08-05 18:51:30 +00:00
Jon Chery 28192a7fa4 verify(P10): 4-layer PASS — REQ-076 
---ci---
project: orca
phase: P10
milestone: v0.9
status: verify
---/ci---
 2026-08-05 18:48:46 +00:00
Jon Chery 0e1f7f97b3 verify(P09): 4-layer PASS — REQ-081; gates C-02, C-14 cleared 
---ci---
project: orca
phase: P09
milestone: v0.9
status: verify
---/ci---
 2026-08-05 18:38:49 +00:00
Jon Chery 675feabf0c feat(P09): Syncthing storage replication + conflict resolution (REQ-081; gates C-02, C-14) 
P09 — Storage replication via per-namespace Syncthing (R-005).

C-02 spike (.ciagent/C02_SYNCTHING_FEASIBILITY_v0.9.md):
- Config injection: deterministic XML, no GUI, content-addressed folder IDs.
- Conflict policy: flock-style lock + source-wins migration + gc-conflicts.
- Deterministic failure mode: CLI-side DetectConflicts + ResolveConflict.
- Auto-decision: C-02 SATISFIED.

C-14 forced-divergence test (internal/storage/conflict_test.go):
- Two peers write without lock -> conflict detected -> resolved to source
  -> deterministic across re-runs. Unknown source -> nil (no silent winner).
- C-14 SATISFIED.

Replication (internal/storage/replication.go, REQ-081):
- FolderID = sha256(ns+masterKeyFP)[:32] (content-addressed).
- RenderSyncthingConfig + RenderSyncthingXML (GUI disabled, global announce
  off, relay off). DetectConflicts (sorted, deterministic). ResolveConflict
  (source-peer-wins). 97.6% coverage.

Emitter (internal/emitter/syncthing.go):
- SyncthingEmitter renders one config.xml per replicated volume at
  /etc/syncthing/orca-<ns>-<volume>.xml. parseReplicateList, deterministic
  device IDs (placeholders until peer registry wired).

24 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.

---ci---
project: orca
phase: P09
milestone: v0.9
status: execute
---/ci---
 2026-08-05 18:38:49 +00:00
Jon Chery 3a76a32964 verify(P07a/b/c): 4-layer PASS — REQ-078; gate C-01 cleared 
---ci---
project: orca
phase: P07a/b/c
milestone: v0.9
status: verify
---/ci---
 2026-08-05 18:31:25 +00:00
Jon Chery 872ffcaf25 feat(P07a/b/c): runtime abstraction — 5 backends (process/podman/wasm/pve-vm/pve-ct), C-01 satisfied (REQ-078) 
P07a/b/c — Runtime abstraction interface + 5 implementations.

Runtime interface (internal/runtime/runtime.go, REQ-078):
- Runtime interface { Prepare, Start, Stop, Status }. Alloc struct carries
  Runtime field (changeable on migration per R-004). Registry keyed by
  runtime.one_of. DefaultRegistry(transport) registers all 5.

Process (internal/runtime/process.go):
- ProcessRuntime wraps os/exec (LOCAL testing only; production uses systemd
  emitter). SIGTERM grace 10s then SIGKILL.

Podman (internal/runtime/podman.go):
- PodmanRuntime via sshpush.Transport. podman pull/run/stop/rm/inspect.

Wasm (internal/runtime/wasm.go, gate C-01 SATISFIED):
- WasmRuntime uses wasmtime CLI (apt-installed on peer) via SSH exec. NO CGO
  — does NOT import bytecodealliance/wasmtime-go. CGO_ENABLED=0 build
  passes. D-002 cross-compile story preserved. D-187 recorded.

PVE (internal/runtime/pve.go):
- PveVMRuntime (qm create/start/stop/status) + PveCTRuntime (pct
  create/start/stop/status) via sshpush.Transport. VMID = hash(alloc.ID)%99999.

C-01 evaluation: internal/runtime/C01_WASMTIME_CGO_EVAL.md. Auto-decision
(full autonomy): wasmtime remains primary; CLI-via-SSH avoids CGO entirely.
D-187 in PROJECT.md.

23 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
92.7% coverage on internal/runtime.

---ci---
project: orca
phase: P07a/b/c
milestone: v0.9
status: execute
---/ci---
 2026-08-05 18:31:25 +00:00
Jon Chery 2c53ad6213 verify(P06): 4-layer PASS — task groups 
---ci---
project: orca
phase: P06
milestone: v0.9
status: verify
---/ci---
 2026-08-05 18:20:05 +00:00
Jon Chery fb85898569 verify(P05): 4-layer PASS — REQ-083 
---ci---
project: orca
phase: P05
milestone: v0.9
status: verify
---/ci---
 2026-08-05 18:02:51 +00:00
Jon Chery ea00158fa5 verify(P03/P04/P08): 4-layer PASS 
---ci---
project: orca
phase: P03/P04/P08
milestone: v0.9
status: verify
---/ci---
 2026-08-05 17:55:11 +00:00
Jon Chery 19542dd8c9 verify(P02): 4-layer PASS — REQ-077; gate C-10 cleared 
---ci---
project: orca
phase: P02
milestone: v0.9
status: verify
---/ci---
 2026-08-05 17:48:04 +00:00
Jon Chery 075d2f6459 verify(P01): 4-layer verification PASS — REQ-073 
---ci---
project: orca
phase: P01
milestone: v0.9
status: verify
---/ci---
 2026-08-05 17:35:11 +00:00
Jon Chery d379d19deb verify(P0c): 4-layer verification PASS — REQ-074 
---ci---
project: orca
phase: P0c
milestone: v0.9
status: verify
---/ci---
 2026-08-05 17:17:02 +00:00
Jon Chery af2fa59172 verify(P0b): 4-layer verification PASS — REQ-064,067 
---ci---
project: orca
phase: P0b
milestone: v0.9
status: verify
---/ci---
 2026-08-05 17:02:33 +00:00
Jon Chery fef03c5b56 verify(P0a2): 4-layer verification PASS — REQ-082 
---ci---
project: orca
phase: P0a2
milestone: v0.9
status: verify
---/ci---
 2026-08-05 16:49:12 +00:00