1bbd53536d
verify(P0X): ship + audit — coverage gate met, all 26 packages pass (REQ-062, REQ-068)
...
P0X — Final ship + audit phase for v0.9 execution.
Coverage gate (REQ-062):
- All 13 new packages >=70%: paths 100%, ns 89.6%, spec/schema 98.5%,
emitter 94.2%, sshpush 93.0%, scheduler 89.5%, runtime 92.7%,
storage 97.6%, stepca 96.6%, cluster 100%, emit 100%, config 89.8%,
certpaths 100%.
- internal/cli 81.9% (>=70% target from REQ-062 v0.8 follow-up).
- Lowest coverage 70.4% (internal/security with the flock tests).
Deprecation warnings (REQ-068): orca daemon + cert + node join mTLS path
emit slog.Warn deprecation banners; --no-deprecation-warnings flag gated.
Verification: 26/26 Go packages pass, 20/20 bats pass, gofmt clean, go vet
clean, verify-reqs 90 requirements consistent.
---ci---
project: orca
phase: P0X
milestone: v0.9
status: execute
---/ci---
2026-08-05 18:51:30 +00:00
28192a7fa4
verify(P10): 4-layer PASS — REQ-076
...
---ci---
project: orca
phase: P10
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:48:46 +00:00
9991e3d561
feat(P10): lead rules + step-ca integration (REQ-076)
...
P10 — step-ca cluster CA (D-101) + lead eligibility (R-003).
step-ca (internal/stepca/stepca.go, REQ-076):
- Client wraps step CLI via SSH on the lead (no Go step-ca client lib).
- Init: step ca init --name --dns --address --provisioner orca-admin. Root
mirrored to paths.CACertPath() (cluster/ca.crt, v0.9 location).
- IssueServerCert: 90-day (2160h) server cert with SANs. IssueSVID: 24h
SVID with SPIFFE ID as URI SAN, provisioner orca-admin. RenewServerCert.
Fingerprint. 96.6% coverage.
Lead rules (internal/cluster/lead.go, R-003):
- IsLeadEligible: linux=true, proxmox=false, unknown=false.
- ValidateLeadRotation: refuses proxmox nodes with R-003 message, refuses
unregistered nodes. 100% coverage.
26 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
---ci---
project: orca
phase: P10
milestone: v0.9
status: execute
---/ci---
2026-08-05 18:48:46 +00:00
0e1f7f97b3
verify(P09): 4-layer PASS — REQ-081; gates C-02, C-14 cleared
...
---ci---
project: orca
phase: P09
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:38:49 +00:00
675feabf0c
feat(P09): Syncthing storage replication + conflict resolution (REQ-081; gates C-02, C-14)
...
P09 — Storage replication via per-namespace Syncthing (R-005).
C-02 spike (.ciagent/C02_SYNCTHING_FEASIBILITY_v0.9.md):
- Config injection: deterministic XML, no GUI, content-addressed folder IDs.
- Conflict policy: flock-style lock + source-wins migration + gc-conflicts.
- Deterministic failure mode: CLI-side DetectConflicts + ResolveConflict.
- Auto-decision: C-02 SATISFIED.
C-14 forced-divergence test (internal/storage/conflict_test.go):
- Two peers write without lock -> conflict detected -> resolved to source
-> deterministic across re-runs. Unknown source -> nil (no silent winner).
- C-14 SATISFIED.
Replication (internal/storage/replication.go, REQ-081):
- FolderID = sha256(ns+masterKeyFP)[:32] (content-addressed).
- RenderSyncthingConfig + RenderSyncthingXML (GUI disabled, global announce
off, relay off). DetectConflicts (sorted, deterministic). ResolveConflict
(source-peer-wins). 97.6% coverage.
Emitter (internal/emitter/syncthing.go):
- SyncthingEmitter renders one config.xml per replicated volume at
/etc/syncthing/orca-<ns>-<volume>.xml. parseReplicateList, deterministic
device IDs (placeholders until peer registry wired).
24 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
---ci---
project: orca
phase: P09
milestone: v0.9
status: execute
---/ci---
2026-08-05 18:38:49 +00:00
3a76a32964
verify(P07a/b/c): 4-layer PASS — REQ-078; gate C-01 cleared
...
---ci---
project: orca
phase: P07a/b/c
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:31:25 +00:00
872ffcaf25
feat(P07a/b/c): runtime abstraction — 5 backends (process/podman/wasm/pve-vm/pve-ct), C-01 satisfied (REQ-078)
...
P07a/b/c — Runtime abstraction interface + 5 implementations.
Runtime interface (internal/runtime/runtime.go, REQ-078):
- Runtime interface { Prepare, Start, Stop, Status }. Alloc struct carries
Runtime field (changeable on migration per R-004). Registry keyed by
runtime.one_of. DefaultRegistry(transport) registers all 5.
Process (internal/runtime/process.go):
- ProcessRuntime wraps os/exec (LOCAL testing only; production uses systemd
emitter). SIGTERM grace 10s then SIGKILL.
Podman (internal/runtime/podman.go):
- PodmanRuntime via sshpush.Transport. podman pull/run/stop/rm/inspect.
Wasm (internal/runtime/wasm.go, gate C-01 SATISFIED):
- WasmRuntime uses wasmtime CLI (apt-installed on peer) via SSH exec. NO CGO
— does NOT import bytecodealliance/wasmtime-go. CGO_ENABLED=0 build
passes. D-002 cross-compile story preserved. D-187 recorded.
PVE (internal/runtime/pve.go):
- PveVMRuntime (qm create/start/stop/status) + PveCTRuntime (pct
create/start/stop/status) via sshpush.Transport. VMID = hash(alloc.ID)%99999.
C-01 evaluation: internal/runtime/C01_WASMTIME_CGO_EVAL.md. Auto-decision
(full autonomy): wasmtime remains primary; CLI-via-SSH avoids CGO entirely.
D-187 in PROJECT.md.
23 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
92.7% coverage on internal/runtime.
---ci---
project: orca
phase: P07a/b/c
milestone: v0.9
status: execute
---/ci---
2026-08-05 18:31:25 +00:00
2c53ad6213
verify(P06): 4-layer PASS — task groups
...
---ci---
project: orca
phase: P06
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:20:05 +00:00
c3819dde12
feat(P06): task groups — multi-process services, multiple systemd units per alloc
...
P06 — Task groups (PRD §9.1: multiple systemd units per alloc).
Parser (internal/jobspec/markdown.go):
- TaskGroupTask type (Name, Runtime, Env, Command). Tasks []TaskGroupTask on
WorkloadSpec. Parses tasks: frontmatter block (array of task objects).
Tasks without their own runtime inherit the top-level Runtime as default.
Backward compat: no tasks -> single-process (existing runtime block).
Systemd emitter (internal/emitter/systemd.go):
- Task group renders one systemd unit per task (orca-v1-alloc-<id>-<task>
.service) plus a grouping target unit (orca-v1-alloc-<id>.target). Each
per-task unit carries PartOf=<target> and WantedBy=multi-user.target.
Single-process case unchanged (backward compat).
Schema (internal/spec/schema/schema.go):
- TaskGroup validation: unique task names, resolvable command (own or
inherited). JobValidator/ServiceValidator/DaemonSetValidator all accept
task groups.
Tests: 9 task-group tests in schema_test.go, lifecycle + target-unit tests
in systemd_test.go, parser tests in markdown_test.go. 22 packages pass.
Fix: 3 Service task-group test fixtures missing Count:1 (ServiceValidator
requires count>=1; a task-group Service still has >=1 replica).
---ci---
project: orca
phase: P06
milestone: v0.9
status: execute
---/ci---
2026-08-05 18:20:05 +00:00
fb85898569
verify(P05): 4-layer PASS — REQ-083
...
---ci---
project: orca
phase: P05
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:02:51 +00:00
c10779873b
feat(P05): CLI-side scheduler + CEL constraints + affinity (REQ-083)
...
P05 — Scheduler moves from daemon-side to CLI-side (R-001) with runtime-awareness.
Scheduler (internal/scheduler/scheduler.go, REQ-083):
- Pure Schedule(nodes, req) -> []Placement. Job=1 best-fit, Service=count
replicas (anti-affinity default, colocation permitted), DaemonSet=1 per
matching node. Score(node, req) = (FreeCPU*1000 + FreeMem); fits checks
runtime compat (wasm->wasmtime, pve-vm/ct->proxmox), constraints (CEL AND),
capacity. Affinity scoring (target + weight, anti-affinity for spreading).
CEL evaluator (internal/scheduler/cel.go):
- Hand-rolled recursive-descent (no CEL dep in go.mod). Subset: node.* attrs,
literals, ==/!=/>=/<=/></>, in/not in, and/or/not, parens. Anything outside
subset returns error (no silent wrong answer). Schedule treats eval errors
as non-fit (node skipped).
23 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
89.5% coverage on internal/scheduler.
---ci---
project: orca
phase: P05
milestone: v0.9
status: execute
---/ci---
2026-08-05 18:02:51 +00:00
ea00158fa5
verify(P03/P04/P08): 4-layer PASS
...
---ci---
project: orca
phase: P03/P04/P08
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:55:11 +00:00
ae6eb5a27b
feat(P03,P04,P08): update stanza + lifecycle hooks + socket plumbing
...
P03 — Update stanza (rolling/canary/blue-green):
- internal/spec/schema/update.go: UpdateValidator (strategy enum, max_parallel
1..count, duration parsing, canary int/% forms, auto_promote). 98.2% cov.
- internal/emitter/update.go: RenderUpdatePlan computes the step sequence
(rolling batches, canary 1+promote+rest, blue-green all+cutover). Pure plan,
no execution (v0.10-P10 is transactional). 73.7-100% cov.
P04 — Lifecycle hooks (systemd ExecStop semantics):
- Extended internal/emitter/systemd.go: post_start -> ExecStartPost=,
pre_stop -> ExecStop=. Order: ExecStart -> ExecStartPost -> ExecStop ->
socket lines. 8 lifecycle tests. 100% cov on systemd.go.
P08 — Socket plumbing (R-007):
- internal/emitter/socket.go: SocketEmitter renders RuntimeDirectory=orca/
alloc-<id> per port (mode 0750, orca:orca). ExecStartPre TCP-bind marker
when service.bind=127.0.0.1. SocketPath(allocID,portName) helper. 100% cov.
- Alloc-id is spec.Name placeholder; real id assigned by scheduler at submit.
22 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
---ci---
project: orca
phase: P03/P04/P08
milestone: v0.9
status: execute
---/ci---
2026-08-05 17:55:11 +00:00
19542dd8c9
verify(P02): 4-layer PASS — REQ-077; gate C-10 cleared
...
---ci---
project: orca
phase: P02
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:48:04 +00:00
436641782c
feat(P02): Service block + Traefik emitter + atomic reload (REQ-077, gate C-10)
...
P02 — Traefik dynamic config generation + atomic reload protocol.
Parser (internal/jobspec/markdown.go):
- Extended WorkloadSpec with Health, Constraints, Affinity, Lifecycle
fields. Parsed restart/update/service/health/lifecycle/affinity/
constraints blocks. HealthBlock, AffinityRule, LifecycleBlock types.
Schema (internal/spec/schema/schema.go):
- ServiceValidator: restart.mode enum (service/on-failure/never),
update.strategy enum (rolling/canary/blue-green), health required,
service.bind IP validation (R-007 loopback opt-in). 98.5% coverage.
Traefik emitter (internal/emitter/traefik.go, REQ-077):
- TraefikEmitter renders /etc/traefik/dynamic/orca-<name>.yaml with
http.routers, http.services (servers = R-007 socket paths), TLS
(certResolver=orca, trust domain), healthCheck. RenderDrain sets
weight:0 per backend. RegisterTraefik wires process/podman/wasm.
Atomic reload (internal/emitter/traefik_atomic.go, gate C-10):
- WriteTraefikDynamic: write to path.tmp via WriteFileIdempotent, then
mv -f path.tmp path (atomic POSIX rename, Traefik fsnotify observes
IN_MOVED_TO). Traefik holds-last-good on malformed config. C-10 PASS.
22 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
Coverage: emitter 96.5%, jobspec 88.8%, schema 98.5%, sshpush 93.0%.
---ci---
project: orca
phase: P02
milestone: v0.9
status: execute
---/ci---
2026-08-05 17:48:04 +00:00
075d2f6459
verify(P01): 4-layer verification PASS — REQ-073
...
---ci---
project: orca
phase: P01
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:35:11 +00:00
e92b18197c
feat(P01): SSH-push transport layer — connection pool, retry, fan-out, idempotent writes (REQ-073)
...
P01 — Load-bearing replacement for v0.8 mTLS transport (R-001).
Transport (internal/sshpush/transport.go, REQ-073):
- Transport struct with sync.Map connection pool (reuse *ssh.Client per peer).
- Exec with context timeout (10s default) + retry (100ms x2 cap 5s max 5
attempts, +/-25% jitter — same backoff as v0.8 transport/retry.go).
- ReadFile, WriteFile (atomic heredoc + mv), Close.
- sshDialer + sshSession seams for testability. TOFU host-key verification
reuses proxmox.TOFUHostKeyCallback. security.Flock for known_hosts.
Fan-out (internal/sshpush/fanout.go):
- ExecAll, WriteAll with errgroup + SetLimit semaphore (default 8 per I-B-001).
Per-peer errors collected, don't cancel the group.
Idempotency (internal/sshpush/idempotency.go, C-18):
- WriteFileIdempotent: SHA-256 compare via ssh sha256sum; skip if content
matches (written=false). Content-addressed idempotency replaces the v0.8
X-Orca-Idempotency-Key header (C-18 capability map).
Tests: in-process fake SSH server (ssh.NewServerConn NoClientAuth ed25519)
for e2e + interface seams for pure-logic. 93.0% coverage. 20 packages pass.
---ci---
project: orca
phase: P01
milestone: v0.9
status: execute
---/ci---
2026-08-05 17:35:11 +00:00
d379d19deb
verify(P0c): 4-layer verification PASS — REQ-074
...
---ci---
project: orca
phase: P0c
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:17:02 +00:00
60b0357eb6
feat(P0c): Job/Service/DaemonSet schemas + emitter interface + systemd stub (REQ-074)
...
P0c — Kind-specific schema validators + Layer 4 emitter interface.
Schemas (internal/spec/schema/schema.go, REQ-074):
- Validator interface with JobValidator, ServiceValidator, DaemonSetValidator.
JobValidator: count=1, no service block, optional schedule/timeout.
ServiceValidator: ports required, count>=1, restart+update+runtime required.
DaemonSetValidator: schedule mode required, no ports (D-175), no count.
ValidatorFor(kind) dispatcher. 96.2% coverage.
Emitter interface (internal/emitter/emitter.go, REQ-074, I-B-002):
- File{Path,Content,Mode}, Emitter interface { Render(spec,node) []File },
Registry keyed by kind:runtime, Register + Render lookup. 100% coverage.
Systemd stub (internal/emitter/systemd.go):
- SystemdEmitter for process runtime. Renders minimal [Service] unit at
/etc/systemd/system/orca-v1-alloc-<name>.service (orca-v1- prefix per
dual-write window REQ-090 — no overlap with v0.8 daemon's orca-<job>).
Flock test fix: TestFlock_concurrentBlocks rewritten to use non-blocking
tryFlockEx (LOCK_NB) instead of a leaked blocking goroutine. Eliminates
the temp-dir cleanup race.
20 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
---ci---
project: orca
phase: P0c
milestone: v0.9
status: execute
---/ci---
2026-08-05 17:17:02 +00:00
af2fa59172
verify(P0b): 4-layer verification PASS — REQ-064,067
...
---ci---
project: orca
phase: P0b
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:02:33 +00:00
667f20a7b3
feat(P0b): Markdown jobspec parser + dispatcher + fuzz harness (REQ-064,067)
...
P0b — Canonical Markdown+frontmatter jobspec parser (R-013/R-014).
Parser (internal/jobspec/markdown.go, REQ-064):
- WorkloadSpec/RuntimeBlock/PortSpec/VolumeSpec types. ParseMarkdown
hand-rolled YAML frontmatter (no yaml.v3 dep). Kind validation (Job/
Service/DaemonSet per R-012). BOM-stripped frontmatter, byte-exact body
preservation (R-015) via the fuzz harness.
Dispatcher (internal/jobspec/dispatch.go, REQ-064):
- ParseFile/Dispatch routes on extension: .md->Markdown, .yaml/.yml->
Markdown-with-empty-body, .hcl->ParseHCL adapter. HCL adapter converts
Spec{Job,Tasks} to *WorkloadSpec (Kind=Job, Runtime.one_of=process).
Backward compat preserved (REQ-090) — orca job run old-spec.hcl works.
- Legacy Parse renamed ParseHCLLegacy, marked // Deprecated per R-013.
Fuzz harness (internal/jobspec/markdown_fuzz_test.go, REQ-067, R-015):
- FuzzParseMarkdownRoundTrip with 10 seed corpus entries (CRLF, BOM,
no-frontmatter, only-closing-separator, code-fence ---, trailing
whitespace, empty body, etc). Asserts byte-exact body round-trip.
Tests: markdown_test.go (19 tests), dispatch_test.go (17 tests), fuzz
(10 seeds). jobspec package 89.2% coverage. cli 81.8% (no regression).
18 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
---ci---
project: orca
phase: P0b
milestone: v0.9
status: execute
---/ci---
2026-08-05 17:02:33 +00:00
fef03c5b56
verify(P0a2): 4-layer verification PASS — REQ-082
...
---ci---
project: orca
phase: P0a2
milestone: v0.9
status: verify
---/ci---
2026-08-05 16:49:12 +00:00
7bb31d4c09
feat(P0a2): namespace CRUD + inheritance engine (REQ-082)
...
P0a2 — Namespace inheritance resolver + orca ns CLI subcommands.
Resolver (REQ-082, internal/ns/resolve.go):
- Pure Resolve() function: DFS post-order chain assembly (most-specific
first, _defaults implicit last D-185). Child-wins-scalar env merge, de-duped
union constraints. Cycle detection with readable cycle path. Missing-parent
+ missing-_defaults + misordering (['_defaults','x']) rejection. Opt-out
impossible (D-187). 89.6% coverage.
Parser (internal/ns/parse.go):
- ParseNSMd: hand-rolled YAML frontmatter (no yaml.v3 dep). Validates
kind:Namespace + name, parses parents flow-array, inherits_env/secrets.
- ParseNSMdDir: walks root/*/ns.md, skips cluster/, requires _defaults.
CLI (internal/cli/ns.go, D-176):
- orca ns list/create/delete/inspect/validate. Inspect + validate use the
resolver. Create refuses _defaults/cluster; delete refuses _defaults +
non-empty namespaces. JSON output support. 85.2% coverage.
- Registered on rootCmd.
Tests: resolve_test.go (11 tests), parse_test.go (14 tests), ns_test.go
(21 tests). 18 packages pass, 20 bats pass, gofmt clean, verify-reqs 90
consistent.
---ci---
project: orca
phase: P0a2
milestone: v0.9
status: execute
---/ci---
2026-08-05 16:49:12 +00:00
7b5193674e
docs(P0a1): ship — v0.8.2 tagged, released, merged
...
---ci---
project: orca
phase: P0a1
milestone: v0.9
status: complete
---/ci---
2026-08-05 16:38:46 +00:00
f6de82d712
verify(P0a1): 4-layer verification PASS — REQ-063,069,070; gate C-07
...
---ci---
project: orca
phase: P0a1
milestone: v0.9
status: verify
---/ci---
2026-08-05 16:38:36 +00:00
437aab39b4
feat(P0a1): multi-namespace path resolver + config demotion + known_hosts flock + CA migration spec (v0.9 P0a1)
...
P0a1 — Re-architecture Foundation (path resolver + config demotion).
Path resolver (REQ-070, R-002):
- internal/paths/paths.go: 23 functions for the multi-namespace layout
(Root/ClusterDir/NamespaceDir/NS*/DefaultNamespace/CA/MasterKey/CacheDB/
Txn/Peers/KnownHosts/SSH/Server/Config). Honors $ORCA_HOME. 100% coverage.
- internal/certpaths/certpaths.go: refactored as thin shim delegating to
paths, preserving the v0.8 flat-layout API for backward compat during
the dual-write window (REQ-090). Package doc explains the v0.10-P14
migration plan. certpaths deleted after v0.10-P14. 100% coverage.
Config demotion (REQ-069, R-014):
- internal/config/markdown.go: minimal hand-rolled YAML frontmatter parser
(no new dep — yaml.v3 not in go.mod). Returns same *Config struct as HCL.
- internal/config/config.go: renamed Load body to LoadHCL (// Deprecated
per R-013), added dispatcher Load() routing on extension (.hcl->HCL,
.md->Markdown, .yaml->Markdown). Signature preserved so root.go unchanged.
- dispatch_test.go + markdown_test.go: 89.8% coverage on config package.
Known_hosts flock (REQ-063, deferred P1 from REVIEW_v0.8 A2):
- internal/security/flock.go: stdlib syscall.Flock advisory lock helper.
- internal/proxmox/bootstrap.go: TOFUHostKeyCallback capture + ResetHostKey
both acquire the flock before read-modify-write on known_hosts. Prevents
concurrent writers under v0.9 parallel SSH fan-out. 3 flock tests.
CA migration spec (grill C-07):
- .ciagent/CA_MIGRATION_SPEC_v0.9.md: Option A (preserve trust root,
RECOMMENDED) vs Option B (forced re-bootstrap). Pre-flight checks,
migration steps, rollback, post-migration invariants, spike plan.
Verification: build pass, 17/17 Go packages pass, 20/20 bats pass, gofmt
clean, go vet clean, verify-reqs 90 consistent. Coverage: paths 100%,
certpaths 100%, config 89.8%, emit covered.
---ci---
project: orca
phase: P0a1
milestone: v0.9
status: execute
---/ci---
2026-08-05 16:38:26 +00:00
e5d2711d71
docs(P00): ship P00 — v0.8.1 tagged, released, merged to milestone/v0.9-rearchitecture
...
---ci---
project: orca
phase: P00
milestone: v0.9
status: complete
---/ci---
2026-08-05 16:27:17 +00:00
dd81eedcd9
verify(P00): 4-layer verification PASS — REQ-068, REQ-072, REQ-089, C-06/C-15..C-18
...
---ci---
project: orca
phase: P00
milestone: v0.9
status: verify
---/ci---
2026-08-05 16:26:47 +00:00
fc94326b0e
feat(P00): deprecation sweep + bash tooling gate + render contract + doc banners (v0.9 P00)
...
P00 — Re-architecture Foundation (deprecation/migration/test-infra/persona/docs).
Deprecation sweep (REQ-068, REQ-072, REQ-089):
- Add // Deprecated: doc comments to internal/daemon (R-001), internal/transport
(REQ-073), internal/security/ca.go+csr.go (D-101/REQ-076), internal/engine/
dispatcher.go+peer.go (CLI-side scheduler), internal/cli/daemon.go.
- orca daemon emits slog.Warn deprecation banner on every run (ungated); fires
R-001 + v0.10-P05 drain-and-stop + v0.10-P14 deletion.
- orca cert and orca node join (mTLS path) emit deprecation warnings; proxmox
SSH path (the v0.9 replacement) does not warn.
- Add --no-deprecation-warnings global flag on root command (PersistentPreRunE)
for orca upgrade migrations.
- 12 new daemon/cert/node deprecation tests in internal/cli/daemon_test.go
(cli coverage 81.9%, warnDeprecated 100%).
- Add DEPRECATED banners to v0.8 sections of ARCHITECTURE.md (verified the
v0.9 supersession section + Supersession Table from prior turn are present).
Bash tooling gate (grill C-06, C-15, C-16, C-17, C-18):
- scripts/tests/test_helper.bash + example_test.bash — bats framework + helpers.
- scripts/lib/orca-log.sh — slog-compatible JSON logging to syslog (C-17).
- scripts/orca-verify-render.sh — render-contract validator skeleton (C-16).
- scripts/tests/orca-log_test.bash + orca-verify-render_test.bash — 20 bats
tests total (happy + failure paths per C-15).
- .shellcheckrc — project shellcheck config.
- Makefile: test-bash + lint-bash targets (graceful skip if tools missing);
wired into test + lint targets.
- internal/emit/contract.go + contract_test.go — versioned JSON render
contract (orca.emit/v1) between Go emitters and bash appliers (C-16).
- .ciagent/BASH_CAPABILITY_MAP_v0.9.md — maps shipped internal/transport
capabilities to bash-side equivalents or accepted drops (C-18).
- D-186 recorded in PROJECT.md: bash exempt from Go coverage gate; compensating
control is bats + shellcheck + shfmt (C-06).
verify-reqs: 90 requirements consistent. Build/test/lint/fmt all green.
20 bats tests pass. Go tests pass. No v0.8 code deleted — only marked deprecated
(deletion deferred to v0.10-P14 per REQ-090 dual-write window).
---ci---
project: orca
phase: P00
milestone: v0.9
status: execute
---/ci---
2026-08-05 16:26:26 +00:00
40b5e781ce
docs(P00): resolve C-04 — relabel v1.0→v0.10 milestone, keep all 40 phases, v1.0 UAT-gated
...
Operator decision (resolves grill C-04 + escalation E-03): keep 2 milestones
(v0.9 + v0.10), keep all phases (40 total, exceeds 35 soft limit), v1.0 is
UAT-gated and cut as a separate tag (v1.0.0) after v0.10 completion per
operator sign-off — not a separate milestone.
Relabels all v1.0 milestone references to v0.10 across ROADMAP, REQUIREMENTS,
GRILL_v0.9, IDEATION_v0.9, PRD_v0.9, PROJECT. Phase content unchanged; only
the milestone label moves. Historical grill narrative (the original PRD §23
counts and the E-03 auto-split reasoning) preserved verbatim for audit
integrity. C-04 and E-03 marked RESOLVED in GRILL_v0.9.md.
Milestone structure:
- v0.9: Re-architecture Foundation & Workloads (13 phases P00..P0X)
- v0.10: Production Hardening (19 phases P00..P16, milestone tag v0.10.0)
- v1.0: UAT-gated production-ready cut (separate v1.0.0 tag, not a milestone)
verify-reqs: 90 requirements consistent.
---ci---
project: orca
phase: 0
milestone: v0.9
status: complete
gate: C-04 resolved
---/ci---
2026-08-05 16:08:33 +00:00
7315916fbc
docs(P00): ship phase 0 — v0.8.0 tagged, released, merged to milestone/v0.9-rearchitecture
...
---ci---
project: orca
phase: 0
milestone: v0.9
status: complete
---/ci---
2026-08-05 16:02:56 +00:00
e9f1073954
docs(P00): grill v0.9 re-architecture — REPLAN 0.74 overridden, 19 binding conditions adopted
...
Runs the 9-axis adversarial grill on the v0.9/v1.0 re-architecture. Overall
verdict REPLAN (0.74) on 3 axes (Scope, Migration, Re-architecture
Justification). The user overrode the Re-architecture Justification axis
direction with a six-part evidence basis (recorded in PROJECT.md). The
remaining mechanics are adopted: 19 binding conditions (C-01..C-19) as
phase gates, 10 phase challenges (PC-01..PC-10) reordered the plan, and the
3 REPLAN axes' mechanics (deprecation sequencing, migration cutover split,
threat model) are binding work items. C-03 (check-in PRD) resolved. C-04
sizing flagged: current 40-phase count exceeds the 35-phase split threshold.
---ci---
project: orca
phase: 0
milestone: v0.9
status: grill
---/ci---
2026-08-05 16:01:52 +00:00
3c0ac65dc6
docs(P00): plan v0.9 — reordered 13-phase v0.9 + 19-phase v1.0 plan with grill gates
...
Records the reordered phase plan (already committed to ROADMAP.md in the
specify stage). v0.9 = 13 phases (P00 deprecation/migration/test-infra
pre-phase + P0a1 path-resolver + P0a2 namespace-CRUD + P0b parser +
P0c schemas+emitter + P01-P10 workloads + P0X ship). v1.0 = 19 phases
(P00 cache + P01 metrics + P01.5 SPIFFE spike + P02 ACL + P03 secrets +
P04 backup + P05 drain + P06 history + P07 recovery + P08 integration +
P09 collector + P10 transactional + P11 lint + P12 verify + P13 ns +
P14a/b/c migration split + P15 README + P15.5 threat-model + P16 final).
All 19 grill binding conditions (C-01..C-19) adopted as phase gates.
Note: C-04 sizing must run before P00 execution; current count is 40
phases across v0.9+v1.0, which exceeds the 35-phase split threshold —
C-04 may require splitting into v0.9 + v0.10 + v1.0.
---ci---
project: orca
phase: 0
milestone: v0.9
status: plan
---/ci---
2026-08-05 16:01:41 +00:00
8631a698ce
docs(P00): ideate v0.9 — 30 ideas (REQ-061..090), 3 tiers, 7 phase-reorder flags
...
Generates 30 ideation ideas across mechanical (12), backend-enriched (12),
and cross-cutting (6) tiers, all accepted at >=0.60 confidence. Mapped to
REQ-061..REQ-090. Highest-impact: I-C-001 (migration ordering, 0.88) and
I-C-006 (dual-write window, 0.86) reshape v0.9 execution strategy. Highest
blast radius: I-M-010 (path resolver, 0.84) touches every adaptable package.
Most under-specified by PRD: I-B-003 (lead applier execution model, 0.78).
Seven phase-reordering flags against PRD section 23: add v0.9-P00 deprecation
pre-phase, split P0a into P0a1/P0a2, design SSH-push before P01, fold emitter
into P0c, add txn-design spike in P0.9-P00, bootstrap test infra in P00,
fold persona reactivation + doc banners into P00.
---ci---
project: orca
phase: 0
milestone: v0.9
status: ideate
---/ci---
2026-08-05 16:01:28 +00:00
642a79f604
docs(P00): research v0.9 re-architecture — codebase audit + prior-context review
...
Reconciles the PRD against the shipped v0.8 codebase. Audit confirms the
PRD's R-series and D-068+ describe a re-architecture (not a continuation):
6 foundational axes contradict the shipped code (daemon, transport, CA,
identity, config format, namespace model) and 8 subsystems are net-new.
Prior planning corpus (IDEATION/GRILL/RESEARCH v0.2-v0.8) confirmed no
v0.9/v1.0 plan existed; step-ca was explicitly rejected (AD-010); SPIFFE
was rejected (PROJECT.md:94). The re-architecture is the first direction
change in the project's history.
---ci---
project: orca
phase: 0
milestone: v0.9
status: research
---/ci---
2026-08-05 16:01:17 +00:00
e008c53966
docs(P00): specify v0.9 re-architecture milestone — PRD adopted, REQ-061..090, supersession table
...
Adopts the v0.9/v1.0 PRD (.ciagent/PRD_v0.9.md) that supersedes the shipped
v0.1-v0.8 architecture. The re-architecture is justified by a six-part
evidence basis recorded in the PROJECT.md Supersession Table:
operational daemon failure, external step-ca mandate, multi-tenancy
requirement, WASM workload requirement, SSH-push deployment target,
and vision correction.
Appends 30 net-new requirements (REQ-061..REQ-090) to REQUIREMENTS.md,
the v0.9 (13 phases) + v1.0 (19 phases) reordered plan to ROADMAP.md,
the AD-series supersession table to PROJECT.md + ARCHITECTURE.md, and
reactivates security-engineer + network-engineer + devops-engineer
personas (implements grill C-05).
---ci---
project: orca
phase: 0
milestone: v0.9
status: specify
---/ci---
2026-08-05 16:01:06 +00:00
8b19c9ab68
docs(milestone): complete coverage-trust-hardening — v0.8 milestone release
...
Mark REQ-057..060 Complete in REQUIREMENTS.md, mark v0.8 COMPLETE in
ROADMAP.md, advance config.json phase to 4.
P0 (v0.7.0): pre-execution — specify/clarify/research/plan/grill.
P1 (v0.7.1): coverage round 2 — 9 packages hit tiered floor.
P2 (v0.7.2): SSH trust hardening — --host-key-fingerprint + key-reset
+ v0.6 TOFU ship-defect bugfix + doctor parity.
P3 (v0.7.3): requirements-hygiene gate — make verify-reqs + CI hook.
P4 (v0.7.4): final review + audit + milestone release (this commit).
Review: PASS-WITH-FOLLOWUPS (0 P0, 3 P1+ deferred to v0.9).
Audit: PASS (1 P1 stale-branch-hygiene, pre-existing, post-ship cleanup).
GRILL: 4/4 binding conditions satisfied.
---ci---
project: orca
phase: 4
milestone: v0.8
status: complete
requirements:
covered: [REQ-057, REQ-058, REQ-059, REQ-060]
partial: []
---/ci---
2026-08-04 12:25:58 +00:00
70c5718505
verify(P03): 4-layer verification PASS — REQ-060
...
---ci---
project: orca
phase: 3
milestone: v0.8
status: verify
requirements:
covered: [REQ-060]
partial: []
---/ci---
2026-08-04 12:18:48 +00:00
46bd07c792
docs(P03): synthetic drift verification — verify-reqs passes + fails-on-drift (T03.5, REQ-060)
...
T03.5 synthetic drift verification (REQ-060 acceptance criterion):
1. make verify-reqs on current repo → exit 0 (60 requirements consistent)
2. flipped REQ-053 (v0.7 P1) row to Pending → make verify-reqs exit 1
diff: REQ-053: status=Pending, expected=Complete (direction=forward)
3. reverted scratch edit → make verify-reqs exit 0
Gate passes on the real repo and correctly fails on synthetic forward
drift (ROADMAP v0.7 COMPLETE but REQUIREMENTS REQ-053 Pending). The
reverse-direction assertion is exercised by the golden-file tests
(T03.2). REQ-060 acceptance criterion met.
---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
2026-08-04 12:17:00 +00:00
b6d514ee21
chore(ci): verify-reqs in validate pipeline (T03.4, REQ-060)
...
---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
2026-08-04 12:16:14 +00:00
7bd8e47241
chore(makefile): verify-reqs target (T03.3, REQ-060)
...
---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
2026-08-04 12:15:58 +00:00
016039d1a3
test(cmd/verify-reqs): golden-file tests (T03.2, REQ-060)
...
---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
2026-08-04 12:15:33 +00:00
fc2b020423
feat(cmd/verify-reqs): requirements-hygiene gate (T03.1, REQ-060)
...
---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
2026-08-04 12:11:40 +00:00
f4192be5d1
verify(P02): 4-layer verification PASS — REQ-058, REQ-059 + TOFU bugfix
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: verify
requirements:
covered: [REQ-058, REQ-059]
partial: []
---/ci---
2026-08-04 12:07:56 +00:00
11da458883
test(cli): --host-key-fingerprint non-proxmox validation (T02.11, REQ-058)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 12:04:28 +00:00
d66b3b9a0a
test(proxmox,cli): end-to-end trust-surface integration tests (T02.10, REQ-058, REQ-059)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 12:04:24 +00:00
2dcb14377a
fix(doctor): TOFU capture-fix parity with bootstrap — v0.6 ship-defect (T02.9)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 11:56:45 +00:00
13e6762f0f
feat(cli): orca node key-reset <node> — local known_hosts reset (T02.8, REQ-059)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 11:51:47 +00:00
325a5662f4
feat(proxmox): populate Result.HostKeyFingerprint (T02.7, REQ-058)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 11:48:00 +00:00
8b0cbe10ae
fix(proxmox): TOFU capture bug — v0.6 ship-defect first-connect join always failed (T02.6)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 11:46:38 +00:00
Jon Chery