2cbfb5d561
feat(P08): master key seal-to-OIDC + Shamir 3-of-5 (REQ-147, D-241, C-35)
...
---ci---
project: orca
phase: 8
milestone: v0.12
status: execute
---/ci---
internal/seal/seal.go: AES-256-GCM sealing with HKDF-SHA256 key
derivation from OIDC subject. Seal/Unseal (OIDC mode), SealWithCA/
UnsealWithCA (mTLS-only offline path), SaveSealed/LoadSealed (0600),
VerifySealedKey.
internal/seal/shamir.go: GF(256) Shamir secret sharing. ShamirSplit
(5 shards, threshold 3), ShamirCombine (Lagrange interpolation).
UnsealWithShamir for IdP-lost recovery (C-35).
9 tests: seal/unseal round-trip, wrong-sub fails, Shamir 3-of-5
recovery (multiple subsets), 2-shards fails, CA mode, mode mismatch,
shard encoding, verification. All pass. Full build + vet green.
2026-08-07 11:14:01 +00:00
20523ac045
fix(P07): remove all password/token paths (REQ-146, R-021, C-34) -- BREAKING
...
---ci---
project: orca
phase: 7
milestone: v0.12
status: execute
---/ci---
R-021 invariant: no passwords, no Orca-issued tokens, no CA-key
passphrases anywhere in the system.
Removed:
- proxmox/bootstrap.go: ssh.Password auth -> ssh.PublicKeys (key-based).
--password/ removed from node join; replaced
with --ssh-key (default: orca SSH key). Pre-staged key required.
- stepca/stepca.go: --password-file /dev/stdin removed from Init and
issueCert. Provisioner changed to 'orca-oidc' (OIDC provisioner).
- identity/spiffe.go: --password-file removed from MintSVID. Provisioner
changed to 'orca-oidc'.
Tests: all proxmox, stepca, identity, cli tests updated + pass. 3 new
password-rejection regression tests. Fake SSH server gains
PublicKeyCallback. go vet clean. Full build green.
2026-08-07 11:12:18 +00:00
1fb82f09b2
fix(P06): ACL rewrite to OIDC claims (REQ-145, REQ-122, F1)
...
---ci---
project: orca
phase: 6
milestone: v0.12
status: execute
---/ci---
Add KindOidc to ACL: OIDCClaims struct, OidcIdentity, OidcGroupIdentity,
CheckOidc (checks user sub + group: prefix entries). KindToken now
always denies (R-021: no Orca-issued tokens). Existing acl.json entries
with KindToken are inert (P07 removes, P22 migrates). acl.json file
mode tightened to 0600. Deny-by-default enforced. 4 new OIDC ACL tests
+ deprecation test. Existing tests migrated to KindOidc. All pass.
2026-08-07 11:03:42 +00:00
691463ff74
docs(checkpoint): P04+P05 shipped (OIDC client + WebAuthn connector)
...
---ci---
project: orca
phase: 5
milestone: v0.12
status: complete
---/ci---
2026-08-07 11:02:18 +00:00
c726a6a9e2
feat(P05): WebAuthn connector for Dex (REQ-148, D-240, C-38)
...
---ci---
project: orca
phase: 5
milestone: v0.12
status: execute
---/ci---
internal/webauthn/store.go: SQLite credential store (0600, public
keys only). Put/Get/List/Delete/UpdateSignCount.
internal/webauthn/connector.go: WebAuthn ceremony handler for the
bundled Dex. BeginRegistration/FinishRegistration/BeginLogin/FinishLogin
at /orca/webauthn/{register,login}. go-webauthn library for crypto.
RP ID = cluster Traefik domain (C-38). Public-key credentials only
(private key never leaves authenticator; R-021 invariant holds).
9 tests pass (4 store + 5 connector). go vet clean. Full build green.
2026-08-07 11:02:07 +00:00
5429da1f87
feat(P04): OIDC client + auth CLI (REQ-144, D-239, D-242, D-246)
...
---ci---
project: orca
phase: 4
milestone: v0.12
status: execute
---/ci---
internal/identity/oidc.go: OIDC client (provider discovery, JWKS,
auth-code+PKCE+local-loopback redirect flow, device-code headless
fallback, token verification, credentials store at ~/.orca/credentials.json
0600, refresh). VerifyIDTokenStatic for SSH-push applier.
internal/cli/auth.go: orca auth login/logout/status/init-idp commands.
Dependencies: github.com/coreos/go-oidc/v3, github.com/go-webauthn/webauthn
(pre-added for P05).
Bundled Dex deploy (init-idp) stubs to P05 (WebAuthn connector ships
the full systemd unit + Traefik route).
9 tests pass (5 identity + 4 CLI). go vet clean. Full build green.
2026-08-07 10:59:55 +00:00
7177ac7538
docs(checkpoint): wave A complete (P01-P03 shipped v0.11.1-v0.11.3)
...
---ci---
project: orca
phase: 3
milestone: v0.12
status: complete
---/ci---
2026-08-07 10:56:34 +00:00
dfacfea377
fix(P03): txn apply path allowlist (REQ-121, F5)
...
---ci---
project: orca
phase: 3
milestone: v0.12
status: execute
---/ci---
apply.sh python heredoc now validates every path in desired-state.json
against a prefix allowlist (/etc/orca/, /etc/traefik/orca*,
/etc/systemd/system/orca-*, /etc/nftables.d/orca*, /etc/syncthing/orca*).
Rejects with exit 7 on mismatch. Also rejects .. traversal and relative
paths. HMAC-signed manifest unchanged. 8 regression tests including
/etc/orca/../../shadow traversal attempt.
2026-08-07 10:56:25 +00:00
5d115fc4b7
fix(P02): namespace path traversal (REQ-120, F4)
...
---ci---
project: orca
phase: 2
milestone: v0.12
status: execute
---/ci---
Add ns.ValidateName rejecting .., /, \, leading -, null bytes,
control chars, spaces, >128 chars, and reserved 'cluster'. Wire into
ns create/delete/inspect/validate/inherit/set-constraint + --parent
flag. Fuzz test + 14 traversal regression tests. No namespace dir can
escape ORCA_HOME.
2026-08-07 10:55:18 +00:00
ce2441f312
fix(P01): command injection in podman/wasm runtimes (REQ-119, F3)
...
---ci---
project: orca
phase: 1
milestone: v0.12
status: execute
---/ci---
shellQuote the jobspec-supplied command string (cmdStr) before
interpolating into SSH exec in podman.go (Start) and wasm.go (Start).
Previously cmdStr was interpolated unquoted, allowing a malicious
jobspec command with shell metacharacters (; | $() backticks newline
> <) to inject commands on the peer.
Fixes:
- internal/runtime/runtime.go: add shellQuote helper (mirrors
internal/sshpush.shellQuote; duplicated to avoid import cycle).
- internal/runtime/podman.go: Start quotes name + cmdStr; Stop/rm/
inspect quote name (defense-in-depth).
- internal/runtime/wasm.go: Start uses env 'ORCA_ALLOC_ID=<id>' (so
the UUID-style alloc ID is safely assigned) and shellQuote(cmdStr).
Tests: 21 new injection regression tests (10 podman + 9 wasm + 2 image)
covering ; && | $() backticks newline $IFS > < (). All pass. Existing
runtime tests still pass. go vet + gofmt clean.
2026-08-07 10:49:08 +00:00
cf0df0f157
docs(P00): v0.12 security-hardening phase 0 (specify/clarify/research/ideate/plan/grill)
...
---ci---
project: orca
phase: 0
milestone: v0.12
status: specify
---/ci---
Threat-model review of entire surface incl OS (25 findings F1..F25).
Adopts R-021 (no Orca credentials: human=OIDC, machine=mTLS/SPIFFE).
Bundled Dex + WebAuthn (passkeys) as default password-free authenticator.
Master key seal-to-OIDC + Shamir 3-of-5 recovery.
30 net-new requirements (REQ-119..REQ-148). 29 phases. Binding conditions C-29..C-38.
2026-08-07 10:45:07 +00:00
da1f93ea77
docs(milestone): complete v0.11 — Production Hardening (24 phases shipped)
...
Mark all v0.11 REQs (REQ-099..118 + deferred REQ-061/065/066/075/079/080/084/086/087) as Complete in REQUIREMENTS.md. Mark all v0.11 phases as [x] and the milestone as COMPLETE in ROADMAP.md. Update checkpoint to phase 16/complete/milestone_complete=true.
v0.11 shipped 24 phases (P00..P16 including P10a/P10b split per C-24):
- P00: CLI cache (R-008)
- P01: Metrics endpoint
- P01.5: SPIFFE SVID spike (C-08 PASSED)
- P02: ACL (SPIFFE + token)
- P03: Secrets (AES-256-GCM, REQ-080)
- P04: Backup/restore (signed tarball)
- P05: Drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)
- P06: Alloc history (REQ-071) + logs --all-nodes (REQ-117)
- P07: Recovery (orca restore)
- P08: Integration tests (REQ-087) + drift stubs
- P09: Collector + aggregator (C-11/C-12/C-14) + drift aggregation (REQ-107)
- P10a: Transactional plane (REQ-075/079, C-09, C-23)
- P10b: Drift detection (R-018/R-019/R-020, REQ-103..113)
- P11: Job lint (REQ-084)
- P12: Job verify (dry-run txn)
- P13: ns subcommands + deprecation warnings (REQ-068)
- P14a: v0.8→v1.0 migration (REQ-066, C-07) + upgrade (REQ-115, C-25, C-27)
- P14b: Daemon cutover + rotate-lead (REQ-114)
- P14c: Mixed-version tolerance + no-orca-on-server (REQ-065, REQ-086, C-13)
- P15: README quickstart (REQ-089, Q5=A framing)
- P15.5: Threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118)
- P16: Final review + ship + audit (this phase)
Tags: v0.10.0 (P0) → v0.10.22 (P16 = v0.11.0 milestone release).
Total: 118 REQs (98 prior + 20 new), all Complete.
---ci---
project: orca
phase: 16
milestone: v0.11
status: complete
requirements:
covered: [99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,61,65,66,75,79,80,84,86,87]
partial: []
gates:
cleared: [C-23,C-24,C-25,C-27,C-28,C-08,C-09,C-11,C-12,C-14,C-19]
---/ci---
2026-08-07 08:36:29 +00:00
8d1cdceb5c
feat(P15.5): threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118)
...
Sub-wave 1: internal/emitter/nft.go (nftables emitter, DNAT :443→127.0.0.1:8443, rate-limit, SYN-flood filter); Traefik static config 127.0.0.1:8443 binding (D-220); orca doctor nft; orca nft CLI (show/diff/doctor/country-block/rate-limit).
Sub-wave 2: docs/threat-model.md (R-017 trust boundary, R-020 deadlock, D-234 secret exclusion, orca user blast radius, step-ca SPOF); orca doctor mTLS (chain verification + live handshake probe, C5).
---ci---
project: orca
phase: 15.5
milestone: v0.11
status: execute
---/ci---
2026-08-07 08:35:06 +00:00
cc57ae4c23
docs(P15): README quickstart refresh (REQ-089) — Nomad-inspired framing, honest trade-offs
...
Subcommand table expanded to all 22 v0.11 commands (incl. drift, nft,
migrate, rotate-lead, upgrade, logs --all-nodes, doctor no-orca-on-server,
txn, collector, cluster). Honest trade-offs table (K8s wins: ecosystem/
talent/scale; Orca wins: no-daemon/OS-native/mTLS/offline/WASM/Proxmox).
Install example pinned to latest tag. Documentation + Examples sections.
---ci---
project: orca
phase: 15
milestone: v0.11
status: execute
---/ci---
2026-08-07 08:24:34 +00:00
c5048822e5
feat(P14b,P14c): daemon cutover + rotate-lead (REQ-114) + mixed-version tolerance (REQ-065, REQ-086, C-13)
...
P14b: orca cluster cutover (stop v0.8 daemon, adopt running allocs);
orca cluster rotate-lead --to (R-003 enforcement, CA+master key copy,
SSH key rotation). P14c: orca doctor no-orca-on-server (R-001
enforcement); orca cluster compat-check (mixed-version tolerance).
---ci---
project: orca
phase: 14b
milestone: v0.11
status: execute
---/ci---
2026-08-07 08:18:12 +00:00
9a28dc907b
feat(P14a): v0.8→v1.0 data migration (REQ-066, C-07) + orca upgrade (REQ-115, C-25, C-27)
...
internal/migration/migrate.go: Migratev08tov11 (flat→multi-ns, schema
migration, CA import to step-ca, config.hcl preserve). internal/cli/
upgrade.go: orca upgrade --to (thin wrapper, R-017 binding cutover
with C-25 post-verify+rollback, C-27 orca user creation, --import-ca,
--dry-run). Tests: detect/migrate/dry-run/idempotent, cutover verify/
rollback, user creation.
---ci---
project: orca
phase: 14a
milestone: v0.11
status: execute
---/ci---
2026-08-07 08:00:10 +00:00
97b88a703c
feat(P13): ns subcommands (inherit, set-constraint) + deprecation warnings (REQ-068)
...
orca ns inherit <name> --parent (cycle detection), ns set-constraint
<key>=value>. Deprecation warnings on orca cert ca-init/gen/renew
(step-ca replaces) and .hcl jobspec (R-013). --no-deprecation-warnings
suppresses all.
---ci---
project: orca
phase: 13
milestone: v0.11
status: execute
---/ci---
2026-08-07 07:47:28 +00:00
020aa01623
feat(P11,P12): orca job lint (REQ-084) + orca job verify (dry-run txn)
...
P11: orca job lint <spec.md> — schema/CEL/body/migration/best-practice
checks; --explain, --format json; exit 0/1 by errors found.
P12: orca job verify <spec.md> — dry-run txn (render + stage + verify
without apply); reports planned allocs/files/units; no side effects;
--namespace, --json.
---ci---
project: orca
phase: 11
milestone: v0.11
status: execute
---/ci---
2026-08-07 07:29:44 +00:00
03f3585f16
feat(P10b): drift detection (R-018/R-019/R-020, REQ-103..113)
...
internal/drift/drift.go: Detector (Watch via iter.Seq2, Aggregate,
Remediate with cooldown-on-success, Acknowledge), Config with tiered
cadence (critical 5s + Path units, standard 30s, default 60s).
internal/cli/drift.go: orca drift {show,watch,acknowledge,remediate,
config}. internal/emitter/drift_path.go: systemd Path+service unit
emitter (User=orca, ProtectSystem=strict). scripts/orca-drift-notify.sh
(sha256 event JSON), orca-remediate.sh (cooldown-on-success, transient
retry). Pre-flight gate (R-020, --force + per-ns scoping). orca
system user (REQ-111), NFS detection (D-233), orca job restart for
EnvironmentFile drift (D-235).
---ci---
project: orca
phase: 10b
milestone: v0.11
status: execute
---/ci---
2026-08-07 07:17:41 +00:00
635e07e7a5
feat(P10a): transactional plane (REQ-075, REQ-079; C-09, C-23)
...
internal/txn/txn.go: Bundle (desired-state + apply/verify/rollback
scripts + signed manifest), RenderBundle (content-addressed txn-id),
Stage (SCP to lead), Apply (idempotent + rollback on failure).
scripts/orca-pull.sh: C-09 failure contract (idempotent, bounded
retry, deterministic, structured syslog) + C-23 (cluster-wide vs
ns-scoped --force distinction). internal/cli/txn.go: orca txn
apply/list/show/rollback CLI.
---ci---
project: orca
phase: 10a
milestone: v0.11
status: execute
---/ci---
2026-08-07 06:28:34 +00:00
5cbe3020d3
feat(P09): collector + aggregator (C-11/C-12/C-14) + drift aggregation (REQ-107)
...
scripts/orca-aggregate.sh: 10s aggregator, cluster.json merge +
drift-events rsync + remediation trigger (P10b stub). scripts/orca-
watchdog.sh: C-11 starvation detection. internal/cli/collector.go:
orca collector start/stop/status. Tests: CLI + bats.
---ci---
project: orca
phase: 09
milestone: v0.11
status: execute
---/ci---
2026-08-07 06:14:16 +00:00
5f92196625
test(P08): integration test harness + drift-detection stubs (REQ-087)
...
tests/integration/harness.go: temp ORCA_HOME + mock peers + helpers.
tests/integration/scenarios_test.go: ns-create/job-submit/drain/backup/
secrets/acl/metrics scenarios. drift_scenarios_test.go: 4 stubs (auto-
remediation, NFS, cooldown, secret exclusion) skip until P10b.
scripts/tests/orca-commands_test.bash: bats for new CLI commands.
---ci---
project: orca
phase: 08
milestone: v0.11
status: execute
---/ci---
2026-08-07 06:04:06 +00:00
f530c9a3f7
feat(P07): recovery (orca restore) — verified restore + alloc protection
...
Extend restore with --dry-run (extract to temp, report, no write),
running-alloc protection (refuse without --force; stop+restart with
--force), post-restore verification (master key, namespaces, DBs),
audit log entry.
---ci---
project: orca
phase: 07
milestone: v0.11
status: execute
---/ci---
2026-08-07 05:47:01 +00:00
c8cf2e41e5
feat(P06): alloc history (REQ-071) + logs --all-nodes (REQ-117)
...
internal/store/alloc_history.go: AllocHistoryRepo (Record/List/Evict)
in orca_cache.db with 7-day TTL eviction goroutine. internal/cli/logs.go:
orca logs --all-nodes --since 5m with iter.Seq streaming, SSH fanout,
journalctl JSON parsing, signal.NotifyContext cancellation, --json output.
---ci---
project: orca
phase: 06
milestone: v0.11
status: execute
---/ci---
2026-08-07 05:36:30 +00:00
41bcf0a6bf
feat(P05): drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)
...
orca node drain <host>: marks draining, stops allocs via SSH, marks
drained. orca daemon drain-and-stop: stops v0.8 daemons on peers.
orca job migrate <name> --to <node>: drain+reschedule composite
(C3=a, not live-migrate). Node states: draining, drained.
---ci---
project: orca
phase: 05
milestone: v0.11
status: execute
---/ci---
2026-08-07 05:17:01 +00:00
f61ef2aa9e
feat(P04): backup/restore — signed tarball (HMAC-SHA256)
...
internal/backup/backup.go: Backup (tar.gz + HMAC-SHA256 signature,
excludes /run/orca + sockets + WAL/SHM), VerifySignature, Restore
(signature verify + extract + Force flag). internal/cli/backup.go:
orca backup --out + orca restore --in --force. Tests: round-trip,
signature mismatch, exclusion, force-refuse, force-overwrite.
---ci---
project: orca
phase: 04
milestone: v0.11
status: execute
---/ci---
2026-08-07 04:55:27 +00:00
2e6436608f
feat(P03): secrets subsystem (REQ-080) — AES-256-GCM + HKDF-SHA256 per-ns
...
internal/secrets/secrets.go: master key (0600), HKDF-SHA256 per-ns
derivation, AES-256-GCM per-line with AAD=line-number (anti-swap),
EncryptEnvFile/DecryptEnvFile, LoadCredential= map generation.
internal/cli/secrets.go: orca secrets set/get/list/rotate/delete.
Tests: round-trip, nonce uniqueness, AAD anti-swap, 0600 enforcement.
---ci---
project: orca
phase: 03
milestone: v0.11
status: execute
---/ci---
2026-08-07 04:47:33 +00:00
33c2b4a78b
feat(P02): ACL — SPIFFE + token identities, deny-by-default
...
internal/acl/acl.go: Identity, Permission, ACLEntry, ACL with
Grant/Revoke/Check/List; SpiffeNamespace extraction; deny-by-default.
internal/cli/acl.go: orca acl grant/revoke/list/check CLI;
state at cluster/acl.json. Tests: grant/revoke/deny/ns-isolation/concurrent.
---ci---
project: orca
phase: 02
milestone: v0.11
status: execute
---/ci---
2026-08-07 04:38:00 +00:00
734c9fa0fa
feat(P01.5): SPIFFE SVID minting spike (REQ-076, gate C-08) — PASSES
...
internal/identity/spiffe.go: SpiffeURI format + MintSVID via step CLI;
internal/identity/spiffe_test.go: mock-transport tests with self-signed
SPIFFE URI SAN cert. Spike passes: step CLI supports --san with URI SANs.
Fallback to mTLS identity NOT needed.
---ci---
project: orca
phase: 01.5
milestone: v0.11
status: execute
---/ci---
2026-08-07 04:30:43 +00:00
cc53c1a3e4
feat(P01): metrics endpoint — hand-rolled Prometheus text exposition
...
internal/transport/metrics.go: Metrics struct with counters/gauges,
WritePrometheus text exposition; internal/cli/metrics.go: orca metrics
HTTP server on :9100 serving /metrics + /healthz. No client_golang dep.
---ci---
project: orca
phase: 01
milestone: v0.11
status: execute
---/ci---
2026-08-07 04:24:57 +00:00
249518c807
docs(checkpoint): P00 shipped v0.10.1 — next P01
...
---ci---\nproject: orca\nphase: 01\nmilestone: v0.11\nstatus: execute\n---/ci---
2026-08-07 04:20:33 +00:00
b6d4db1a96
feat(P00): CLI cache layer (R-008) — orca_cache SQLite + cache CLI
...
internal/cache/ package with per-class TTLs (Get/Set/Invalidate);
wired into node/job/ns list read paths; orca cache show/invalidate CLI.
Tests: hit/miss/invalidate/TTL-expiry + bench <1ms hit.
---ci---
project: orca
phase: 00
milestone: v0.11
status: execute
---/ci---
2026-08-07 04:17:25 +00:00
2f7b2da05a
docs(checkpoint): v0.11 phase 0 complete — shipped v0.10.0
...
---ci---
project: orca
phase: 0
milestone: v0.11
status: complete
---/ci---
2026-08-07 03:48:46 +00:00
9b984ad720
fix(release.sh): define REPO variable for tea CLI --repo flag
...
release.sh used $REPO in the tea releases create command (line 133) but never defined it, causing 'unbound variable' under set -u. Define REPO from GITEA_OWNER/GITEA_REPO env vars (same pattern as the verify_asset function at line 147). This is the v0.8.x zero-asset root cause's sibling bug — tea releases create failed silently on REPO unbound, but the script's error handling surfaced it.
---ci---
project: orca
phase: 0
milestone: v0.11
status: ship
---/ci---
2026-08-07 03:48:27 +00:00
715fcb54b3
fix(verify-reqs): update 9 deferred REQ phase cells from v0.10 to v0.11
...
REQ-061, 065, 066, 075, 079, 080, 084, 086, 087 were assigned v0.10 Pxx phases in v0.9 planning but v0.10 became a docs milestone; these execution REQs are now v0.11. Phase cells updated to reference v0.11 Pxx phases so verify-reqs passes (forward drift: milestone COMPLETE in ROADMAP must have REQ Complete; these were Pending with a COMPLETE milestone reference).
---ci---
project: orca
phase: 0
milestone: v0.11
status: grill
---/ci---
2026-08-07 03:43:52 +00:00
e45611b416
docs(P00): grill v0.11 — 6 binding conditions (C-23..C-28), P10 split into P10a/P10b
...
GRILL stage: adversarial review across 6 forcing questions. Verdict: PROCEED-WITH-CONDITIONS.
- C-23: orca-pull.sh distinguishes cluster-wide vs ns-scoped txns (gate P10a)
- C-24: split P10 into P10a (txn plane) + P10b (drift detection); phase count 23->24; tags shift by 1
- C-25: orca upgrade post-cutover verification + rollback (gate P14a)
- C-26: per-phase LoC soft ceiling ~800 (no gate, recorded)
- C-27: orca upgrade creates orca system user on existing peers (gate P14a)
- C-28: P15.5 two sub-waves (ingress+doctor nft, then threat model+doctor mTLS) (gate P15.5)
ROADMAP updated: 24 phases, tags v0.10.0..v0.10.22.
---ci---
project: orca
phase: 0
milestone: v0.11
status: grill
---/ci---
2026-08-07 03:40:55 +00:00
5b99bbd2e8
docs(P00): create v0.11 phase plan (8 waves, 23 phases, 20 new REQs)
...
PLAN stage: 8-wave structure covering 23 phases. Wave 0 (P00 cache), Wave 1 (P01/P01.5/P02 observability+identity), Wave 2 (P03/P15.5 security+ingress hybrid+doctor mTLS), Wave 3 (P04/P06 backup+alloc history+logs), Wave 4 (P05/P07 drain+migrate+recovery), Wave 5 (P10/P11/P12 txn plane+drift+lint+verify), Wave 6 (P09/P13 aggregator+ns), Wave 7 (P14a/b/c migration+upgrade+rotate-lead), Wave 8 (P08/P15/P16 integration+docs+ship). P10 is the largest phase; grill may split into P10a/P10b.
---ci---
project: orca
phase: 0
milestone: v0.11
status: plan
---/ci---
2026-08-07 03:39:27 +00:00
a70eb0d83d
docs(P00): research findings + persona assessment for v0.11
...
RESEARCH stage: consolidate 5 research docs (ingress hybrid, drift detection, platform-engineer playbook, strategic positioning, systemd Path unit impl) + codebase verification into RESEARCH_v0.11.md. Update PERSONAS.md: data-engineer reactivated for P14a, docs-engineer phase-specific for P15, devops-engineer owns drift-detection bash scripts + integration tests.
---ci---
project: orca
phase: 0
milestone: v0.11
status: research
---/ci---
2026-08-07 03:38:17 +00:00
6f7a5122cc
docs(clarify): resolve C1-C5 for v0.11 phase 0
...
CLARIFY stage: 5 clarifications resolved per locked decisions + synthesis.
C1: hybrid default for fresh init, migrate existing via orca upgrade
C2: thin wrapper upgrade (v0.11); full rolling upgrade defers to v1.x
C3: drain+reschedule migrate (v0.11); live-migrate defers to v1.x
C4: remediation cooldown on success only; transient failures retry next tick
C5: doctor mTLS = chain verification + live handshake probe
---ci---
project: orca
phase: 0
milestone: v0.11
status: clarify
---/ci---
2026-08-07 03:37:40 +00:00
1cc965e23b
docs(specify): adopt R-017..R-020, D-215..D-237, REQ-099..REQ-118 for v0.11
...
SPECIFY stage: adopt 5 research docs into authoritative ciagent files.
- PRD_v0.11.md: new file extending R-series 16->20 (R-017 ingress hybrid, R-018/R-019/R-020 drift detection)
- PROJECT.md: append D-215..D-237 (23 new decisions, no collisions with D-001..D-206)
- REQUIREMENTS.md: append REQ-099..REQ-118 (20 net-new; ingress 099-102, drift 103-113, CLI 114-118)
- ROADMAP.md: update v0.11 section (fold ingress into P15.5 per Q3=A, expand P09/P10, add CLI REQs to P05/P06/P14a/P14b per Q2=C)
---ci---
project: orca
phase: 0
milestone: v0.11
status: specify
---/ci---
2026-08-07 03:37:24 +00:00
a412f832fd
docs(init): v0.11 phase 0 specify — validate specification
...
Bump config.json milestone to v0.11, phase 0. Initialize checkpoint at specify stage. Adopt 5 research docs (ingress hybrid, drift detection, platform-engineer playbook, strategic positioning, systemd Path unit impl) with locked decisions Q1=A (adopt R-017..R-020), Q2=C (add all 5 CLI commands), Q3=A (fold ingress into P15.5), Q4=A (--force + per-ns scoping), Q5=A (Nomad-inspired framing).
---ci---
project: orca
phase: 0
milestone: v0.11
status: specify
---/ci---
2026-08-07 03:35:46 +00:00
a20cdb294c
docs(debug): update checkpoint to v0.9.6 (post-hoc fix)
...
---ci---
project: orca
phase: 99
milestone: v0.10
status: complete
---/ci---
2026-08-05 21:24:08 +00:00
4c2e59cf3f
fix(P06): workloadToTaskSpecs command split + runnable examples
...
Root cause: orca job run <example>.md failed with fork/exec: no such
file or directory on every example. Two compounding problems:
1. workloadToTaskSpecs (internal/cli/job.go:340) passed the entire
runtime.command string (e.g. "/usr/bin/httpd -f /etc/orca/web-app/
httpd.conf") as a single binary path to exec.Command, which then
looked for a file literally named "/usr/bin/httpd -f ..." and
failed. The v0.9 markdown parser stores command: as a raw string;
the legacy HCL path had separate command+args fields. Fix: add
splitCommand helper that splits on strings.Fields into binary+args,
with /bin/true fallback for empty commands.
2. The example commands referenced binaries that don't exist on a bare
Linux machine (/usr/bin/httpd, postgres, api-server, fluent-bit).
Fix: rewrite the 5 example runtime.command values to use /bin/sleep
3600 (long-running services) or /bin/echo (one-shot job) so they
run out-of-the-box. Each file has a Production substitution note
showing the real binary to use in deployment.
Verified: orca job run examples/full-stack/worker.md now succeeds
(exit 0). All 4 services (web-app, api, log-shipper, postgres) start
correctly (task started, pid assigned). 12 new unit tests pass
(splitCommand: 7 cases, workloadToTaskSpecs: 5 cases). All 5 example
jobspecs still parse + validate (gate C-20). make lint clean.
---ci---
project: orca
phase: 6
milestone: v0.10
status: execute
decisions:
- id: D-195
decision: split command string via strings.Fields in workloadToTaskSpecs
rationale: exec.Command expects binary path + args as separate elements;
the v0.9 markdown parser stores command: as a single string with no
args field (unlike legacy HCL). strings.Fields is dep-free and handles
multiple spaces/tabs. Shell quoting (single/double quotes inside the
command) is not handled — examples avoid sh -c with quoted strings.
confidence: 0.95
alternatives: [shellquote.Split from mvdan/sh (adds dependency)]
lessons:
- The v0.9 markdown jobspec path needs the same command+args split that
the legacy HCL path had via separate command/args fields. The parser
stores command: as a raw string; the CLI must split it before passing
to exec.Command.
- Example jobspecs should use /bin/sleep and /bin/echo (binaries that
exist on every Linux machine) so they run out-of-the-box. Descriptive
production commands belong in a comment block, not in runtime.command.
---/ci---
2026-08-05 21:23:32 +00:00
8839781539
docs(milestone): complete v0.10 — checkpoint cleared, branches deleted
...
---ci---
project: orca
phase: 99
milestone: v0.10
status: complete
requirements:
covered: [REQ-091,REQ-092,REQ-093,REQ-094,REQ-095,REQ-096,REQ-097,REQ-098]
partial: []
---/ci---
2026-08-05 21:03:28 +00:00
f0b9910bf1
docs(milestone): complete v0.10 — docs & install hardening
...
Milestone v0.10 — Docs & Install Hardening — COMPLETE.
6 tagged phases (v0.9.0..v0.9.5). 8 REQs (091-098) all Complete:
- REQ-091: docs/cli.md (CLI reference)
- REQ-092: docs/jobspec.md (jobspec reference)
- REQ-093: docs/ingress.md (ingress guide)
- REQ-094: examples/full-stack/ (5 jobspecs + rendered + walkthrough)
- REQ-095: README.md refresh (22 commands, current install, docs/examples)
- REQ-096: docs/namespace.md v0.9 multi-namespace layout
- REQ-097: release.sh cross-build amd64 + asset verification (C-21)
- REQ-098: install.sh fallback walk + --check dry-run
3 binding conditions cleared (C-20, C-21, C-22).
7 decisions (D-188..D-194). 31 files changed, 2654 insertions.
Root cause of v0.4.5 install fixed: v0.8.x releases shipped with zero
binary assets; release.sh now cross-builds amd64 + verifies the asset
post-create; install.sh walks back through releases if the latest lacks
an asset. v0.9.1 is the first correctly-asseted release.
---ci---
project: orca
phase: 5
milestone: v0.10
status: complete
requirements:
covered: [REQ-091,REQ-092,REQ-093,REQ-094,REQ-095,REQ-096,REQ-097,REQ-098]
partial: []
---/ci---
2026-08-05 21:02:31 +00:00
94711e05f1
verify(P04): 4-layer PASS — REQ-095, REQ-096
...
---ci---
project: orca
phase: 4
milestone: v0.10
status: verify
---/ci---
2026-08-05 21:00:54 +00:00
e9686f4ab0
docs(P04): README refresh + namespace.md v0.9 layout update
...
P04 — README and namespace.md refresh (REQ-095, REQ-096).
README.md (REQ-095):
- Status line updated (v0.9 complete, v0.10 in progress).
- Install --version example updated to v0.9.1 (current).
- Added --check dry-run example.
- Update-in-place example updated to v0.8.15 -> v0.9.1.
- Subcommand table expanded to all 22 commands with Since column and
deprecation markers (daemon, cert, status marked deprecated).
- Development section complete (verify-reqs, security-scan, test-race,
changelog, release).
- New Documentation section linking all 7 docs/*.md.
- New Examples section linking examples/full-stack/.
docs/namespace.md (REQ-096):
- Replaced v0.8 flat path table with v0.9 multi-namespace layout
(cluster/, _defaults/, per-ns db/jobs/alloc/ns.md, orca_cache.db).
- Full path reference table from internal/paths/paths.go.
- Namespace root resolution (ORCA_HOME/--system/~/.orca).
- orca ns subcommand cross-link to docs/cli.md.
- Namespace inheritance (_defaults implicit root, D-159/D-185/D-187).
- v0.8 flat layout flagged deprecated with callout box.
All README links verified to resolve. make verify-reqs: 98 consistent.
---ci---
project: orca
phase: 4
milestone: v0.10
status: execute
---/ci---
2026-08-05 21:00:46 +00:00
76967b5145
verify(P03): 4-layer PASS — REQ-094; gate C-20 cleared
...
---ci---
project: orca
phase: 3
milestone: v0.10
status: verify
---/ci---
2026-08-05 20:59:41 +00:00
2c26a6d54f
docs(P03): full-stack examples — 5 jobspecs + rendered artifacts + walkthrough
...
P03 — full-stack example with ingress configured (REQ-094; gate C-20).
examples/full-stack/:
- web-app.md: kind Service, process runtime, 3 replicas, Unix socket
(default R-007), rolling update, constraints (node.role==web),
affinity (zone==a weight 80), lifecycle hooks (post_start/pre_stop).
- api.md: kind Service, process runtime, 2 replicas, TCP opt-in
(service.bind: 127.0.0.1, R-007), canary update with manual promote,
constraints (node.role==api, node.cpus>=2), env vars.
- worker.md: kind Job, process runtime, one-shot, timeout 300s, env
vars, lifecycle hooks (register/drain).
- log-shipper.md: kind Service (DaemonSet workaround — parser gap),
process runtime, constraints (node.role==logs), env vars. Notes the
v0.9 parser gap (schedule: block not wired) in a callout.
- postgres.md: kind Service, process runtime, 1 replica, blue-green
update, volumes with replication (replicate:peer-b,peer-c via
Syncthing), constraints (node.role==db, node.cpus>=4, node.memory>=8192).
- rendered/: Traefik dynamic YAML (web-app, api) + systemd units
(web-app, api, log-shipper) showing what Orca generates on target nodes.
- README.md: end-to-end walkthrough (init -> node join -> capacity set
-> ns create -> job run -> list --watch -> inspect rendered -> verify
ingress -> drain/rollback). Cross-links to docs/ingress.md.
- examples_test.go: Go test that parses + validates all 5 jobspecs
against the current parser and schema validators (gate C-20).
All 5 jobspecs pass jobspec.ParseFile + schema.ValidatorFor(kind).
---ci---
project: orca
phase: 3
milestone: v0.10
status: execute
---/ci---
2026-08-05 20:59:33 +00:00
4e019ab51e
verify(P02): 4-layer PASS — REQ-091, REQ-092, REQ-093; gate C-22 cleared
...
---ci---
project: orca
phase: 2
milestone: v0.10
status: verify
---/ci---
2026-08-05 20:57:16 +00:00
Jon Chery