Wave B of P03. Adds Go-level tests that verify the security
configuration files have the expected shape. We don't run
gosec/govulncheck/gitleaks here (they're external binaries
installed by .coreci.yml ); instead, the tests
catch configuration drift by asserting the right tokens
are present in the config files.
- internal/security/security_scan_test.go — covers the
shape of .gitleaks.toml (cert PEM allowlist present),
.gitleaks-baseline.json (valid JSON, skip entries with
Commit/File), .golangci.yml (gosec/govet/ineffassign/
misspell enabled), scripts/security_scan.sh
(executable, references all three tools + GOFLAGS), and
.coreci.yml (gosec/govulncheck/gitleaks stages present,
GOFLAGS env, go test -race wired).
- internal/security/security_gosec_g101_test.go — meta-
tests: the .coreci.yml pipeline installs
gosec and runs it; GOFLAGS=-mod=mod is set for offline
mode (REQ-027). The fixture file in testdata/ carries
a literal G101 pattern that any future CI run will flag
if the allowlist is misconfigured.
- internal/security/testdata/hardcoded_creds.go — the
G101 fixture. The value is intentionally a sentinel
prefix (GOSEC_G101_FIXTURE_VALUE_*) that does not match
real-secret patterns; gitleaks allowlist for the path
keeps it from being a false positive on the secret
scanner while still triggering gosec's G101 rule.
All builds clean; tests pass with -race; gofmt -l . clean.
---ci---
project: orca
phase: 10
milestone: v0.2
status: execute
---/ci---
Wave A of P03. Wires the three security tools into the
.coreci.yml pipeline and exposes them via a
local make target.
- .gitleaks.toml (REQ-039) — allowlist for cert PEM blocks
(-----BEGIN CERTIFICATE-----), test data paths, and
self-references. Stopwords suppress the false-positive
on cert headers without disabling the real secret
detection for private keys.
- .gitleaks-baseline.json (REQ-029) — suppresses the v0.1
historical .env leak (rotated forward in 00127ce) so
CI doesn't fail on the existing history. The baseline
format matches gitleaks 8.x.
- .golangci.yml (REQ-040) — unified lint config with
gosec, govet, ineffassign, misspell, gocritic. gosec
severity=high so G101 (hardcoded credentials) is a
build-breaker. Excludes _test.go for G404 (math/rand
is fine in tests) and internal/security/testdata/.
- .githooks/pre-commit — gitleaks protect --staged;
commits are still allowed when gitleaks is not on PATH
(gate, not block; CI catches findings via .coreci.yml).
- scripts/security_scan.sh — wrapper that runs all three
tools, exits non-zero on any unsuppressed finding.
Detects missing tools and SKIPs in dev mode (--strict
flips to FAIL on skip). Used by ./scripts/security_scan.sh
─── gosec ─────────────────────────────────────
⚠ gosec: SKIP (not installed)
─── govulncheck ─────────────────────────────────────
⚠ govulncheck: SKIP (not installed)
─── gitleaks ─────────────────────────────────────
⚠ gitleaks: SKIP (not installed)
─── summary ─────────────────────────────────────
0 pass, 0 fail, 3 skip
✓ security-scan PASSED.
- docs/security-scanning.md — operator-facing doc covering
each tool, the offline mode (REQ-027) for govulncheck
via GOFLAGS=-mod=mod, the pre-mirrored DB mechanism
(GOVULNCHECK_DB), and how to add baseline entries.
- .coreci.yml — validate pipeline gains three new stages
in order gosec, govulncheck, gitleaks. Test pipeline
runs with -race (REQ-031). Release pipeline's tea
invocation now passes --repo coreci/orca (P01 audit
fix; was previously missing).
- Makefile — adds test-race and security-scan targets;
help text updated.
- scripts/release.sh — tea releases create now passes
--repo coreci/orca (P01 audit fix; the missing flag
required manual workaround in P01 + P02 ship).
All builds clean; tests pass with -race; gofmt -l . clean;
go vet ./... clean.
---ci---
project: orca
phase: 10
milestone: v0.2
status: execute
---/ci---
Wave B of P02. Wires the data + engine + transport layers into the
daemon HTTP surface and the CLI.
- internal/engine/executor.go — adds Submit(specBytes) and
Status(jobID) entry points to satisfy engine.LocalExecutor
(used by the dispatcher). Submit parses a minimal JSON wire
spec with name/command/args/env fields; Status reads from
store.JobRepo and returns the stringified model.JobStatus.
- internal/engine/dispatcher.go — Dispatcher struct with
LocalExecutor + capacity repo + peer registry + idempotency
dedupe store. Submit(target, spec, idempotencyKey) does the
local-fit-check then bin-packing pick; if no local capacity
and target is empty, falls through to a peer. dispatchTo /
dispatchToPeer open mTLS clients (no cert presented by the
client in P02; the server uses RequireAndVerifyClientCert
but P02 ships with the cert-pool wiring without enforcing
client certs on the dispatch endpoint — P03 hardening).
LocalSubmit/LocalStatus satisfy transport.Dispatcher.
- internal/transport/dispatch.go — SubmitHandler and
StatusHandler (http.Handler). SubmitHandler honors
X-Orca-Idempotency-Key for dedupe replay. Submit/Status
Request/Response wire structs. DispatchClient wraps
mTLS HTTP client with the retry loop. The retry Submit
is implemented as a direct loop (not via Do[T]) because
the response-decode path doesn't fit the generic shape
cleanly.
- internal/daemon/dispatch_handler.go — DispatchHandlers
groups Submit+Status; Mount(mux) attaches both routes.
- internal/daemon/server.go — Server gets a dispatch field;
RegisterDispatch(h) attaches the handlers; mux() mounts
them at /orca.v1.Dispatch/{Submit,Status}.
- internal/daemon/dispatch_test.go — round-trip, idempotency
dedupe, and validation (empty spec=400, GET=405) coverage.
- internal/cli/daemon.go — wires the dispatch service into
the daemon: executor + peer registry + dispatcher +
RegisterDispatch. Adds /orca.v1.Dispatch/* to the startup
banner.
- internal/cli/job.go — adds --target and --idempotency-key
to 'orca job run'; routes through the dispatcher when set.
- internal/cli/node_capacity.go — 'orca node capacity
{show,set,list}' for REQ-028. --set takes --cpu, --memory,
--disk, --node. Positivity check on all three numerics.
All tests pass with -race; gofmt -l . clean; go vet ./...
clean. P02 verification commit follows.
---ci---
project: orca
phase: 9
milestone: v0.2
status: execute
---/ci---
CIAgent audit (.ciagent/AUDIT_v0.2_P01.md) surfaced 3 .ciagent/ file
discipline issues. This commit addresses all 3:
1. config.json: re-add the 'workflow' top-level block. It was added in
d10f89d (v0.1 milestone) and lost from main during the parallel-
history resolution that produced origin/main's be9afa2 PR-#1 merge.
The 4 standing rules (no_hitl, release_flow_per_phase, merge_strategy,
branching) are restored.
2. PROJECT.md: add literal '## What This Is' and '## Key Decisions'
section headers. The v0.1 audit-fix (f1c55ca) added the content
inline but without the explicit headers, so the audit check missed
them. The Key Decisions section summarizes D-011..D-018.
3. REQUIREMENTS.md: consolidate two overlapping REQ tables (the v0.1
status table and the v0.2 traceability table) into a single
canonical table covering all 40 REQs (REQ-001..REQ-040). Each row
has REQ-ID, summary, priority, phase, status. v0.1 REQs show
'Complete'; v0.2 REQs show 'Complete' (P01 shipped) or 'Pending
(P##)'. The v0.1 Milestone Summary and v0.2 Milestone Summary
sections are preserved below the table.
4. AUDIT_v0.2_P01.md: the audit report itself, with reconstruction
state, file discipline table, branch hygiene, commit discipline,
and the 3 findings above (plus non-blocking observations). The
report's verdict: 'v0.2 P01 ship is healthy; 3 issues are
paper-cleanup items addressed in this commit. None block P02
EXECUTE.'
---ci---
project: orca
phase: 0
milestone: v0.2
status: fix
---/ci---
v0.2 RESEARCH stage. Synthesizes the 4-phase v0.2 scope (P01-P04) into
updated static docs. No code changes. Decisions are derived from
CLARIFY D-011..D-018 (already on main) and direct investigation of
go.mod, the codebase, and ecosystem docs (Go 1.25+ iter.Seq, govulncheck,
gosec, gitleaks, step-ca).
Key research conclusions logged here:
- ConnectRPC is NOT in go.mod (.ciagent/config.json lists it in
frameworks but the dependency was never added). v0.2 falls back to
stdlib net/http with h2c for the orca.v1.Dispatch service. Zero new
direct deps. (ARCHITECTURE.md AD-014)
- Roll-our-own CA via crypto/x509 (not step-ca/cfssl/vault-pki) keeps
the binary single, dependency-free, and aligned with offline-first
(no external PKI network calls). (ARCHITECTURE.md AD-010)
- govulncheck default mode requires network access to vuln.go.dev. CI
step must use -format json (always exits 0) + a wrapper that gates
on findings via jq/cat, OR pre-mirror the database. Caller to decide
in PLAN. Logged as REQ candidate for IDEATE.
- gosec exit codes: 0 clean, 1 unsuppressed finding. -no-fail always
returns 0. Baseline JSON via -track-suppressions + exclude=. We
adopt -no-fail on initial run, baseline suppressed findings, then
tighten to fail-on-finding once baseline is empty.
- gitleaks default config covers most cases; we extend .gitleaks.toml
with stopwords for our test data paths and CA cert PEM (which would
otherwise trigger the generic-api-key rule).
- iter.Seq: yield func(V) bool, iter.Pull for pull-style, range over
function types since Go 1.25. Cancellation flows through ctx
(consumer-driven backpressure). Single-use vs multi-use semantics
documented in Go spec; we use multi-use for repo.Watch() since
callers can re-iterate.
- mTLS hot-swap via tls.Config.GetCertificate callback enables cert
rotation without daemon restart. tls.Config is read on every
handshake; reload picks up new server.crt/server.key.
ARCHITECTURE.md changes:
- Added Transport Layer (internal/transport) and Dispatcher
(internal/engine/dispatcher.go) components.
- Added Security Manager (internal/security) component with full cert
lifecycle API.
- Added certs table schema (migration 0004) and Cert Go struct.
- Extended Node with NodeCapacity (CPU/memory) for bin-packing.
- Added v0.2 Component Graph ASCII diagram.
- Added 4 named flows: cert issuance, mTLS handshake, job dispatch,
iter.Seq streaming.
- Added 8 new AD-009..AD-016 decisions and AD-014 notes the
ConnectRPC-not-in-go.mod reality.
PERSONAS.md changes:
- Added network-engineer (custom, NEW in v0.2) for transport/dispatcher.
- security-engineer marked phase_specific: [P01, P02] (off after P02).
- network-engineer marked phase_specific: [P02].
- cli-engineer marked phase_specific: [P04] (--watch is a CLI concern).
- data-engineer.territory extended to include
internal/store/migrations/0004_certs.sql.
- security-engineer.territory extended to TLS-config portion of
internal/transport.
- Frontmatter updated: active_personas, phase_specific, reason.
PROJECT.md changes:
- Moved "Multi-node scheduling" out of "Out of Scope" (it ships in P02).
- Added "External PKI / Let's Encrypt / cert transparency logs" to
Out of Scope (per D-011).
- Added "gRPC framework dependency" to Out of Scope (per AD-014).
- Added v0.2 Scope Summary section (4 phases) with cross-refs to
ARCHITECTURE.md flows.
REQ candidates surfaced for IDEATE stage (not added to REQUIREMENTS.md
in this commit — that's the IDEATE stage's job):
- REQ-cand-A: Bounded cert rotation history (retain last N=3 server
certs per node for rollback; documented in ARCHITECTURE.md certs
table as "retention" implication of the schema).
- REQ-cand-B: Trusted-CA fingerprint pinning (D-012 requires operator
to pass --ca-fingerprint at join; the daemon should refuse to start
if the on-disk CA's fingerprint doesn't match a config-pinned value,
to protect against operator typos).
- REQ-cand-C: govulncheck offline mode (CI must not call vuln.go.dev
by default; either pre-mirror the DB or set GOVULNCHECK_DB env to
a local file).
- REQ-cand-D: HCL/YAML schema for NodeCapacity declaration (where
does the operator declare a node's CPU/RAM? Current v0.1 Node model
has no capacity field. P02 will add this — needs a config file
surface, e.g. ~/.orca/node.hcl or flag on `orca node join`).
- REQ-cand-E: gitleaks baseline for pre-existing secrets in history
(the v0.1 .env leak was rotated forward but git history still has
a SHA-1 leak — gitleaks/git filter-repo remediation may need a
baseline file to avoid the same class of false positive recurring).
- REQ-cand-F: --watch output format mode (iter.Seq stream is
table-style by default; users may want --watch --json one-line-per-
event for piping). P04 scope decision; log for IDEATE.
---ci---
project: orca
phase: 0
milestone: v0.2
status: research
---/ci---
v0.2 CLARIFY stage. Resolves 8 ambiguities introduced by the deferred
v0.2 scope (mTLS, scheduling, scanning, streaming). All decisions taken
under full autonomy (config.json autonomy.level: full) at confidence
>= 0.85, which is above the decision_confidence_threshold of 0.60.
- D-011: Internal CA with CSR join (vs. self-signed per-node or SPIFFE).
- D-012: Operator-mediated CA cert distribution with fingerprint verify
(no automated secret distribution — matches offline-first principle).
- D-013: 90d server certs, 10y CA cert, 30d pre-expiry rotation.
- D-014: Eager mTLS handshake at time.
- D-015: TLS 1.3 minimum, AEAD cipher allowlist (no TLS 1.2 fallback).
- D-016: gosec+govulncheck in pipeline of .coreci.yml;
gitleaks in pre-commit hook (opt-in).
- D-017: iter.Seq for and .
- D-018: Bin-packing by CPU/memory with FIFO within node; ConnectRPC
orca.v1.Dispatch for cross-node.
RESEARCH and IDEATE follow.
---ci---
project: orca
phase: 0
milestone: v0.2
status: clarify
---/ci---
Validates the v0.2 milestone specification against the deferred-v0.2
requirements in ROADMAP.md and the requirement status table. Updates:
- ROADMAP.md: v0.2 marked in-progress with 4 phases (P01 mTLS, P02
multi-node scheduling, P03 gosec+govulncheck, P04 iter.Seq). Adds
target milestone tag (v0.3.0) and per-phase tags (v0.2.1..v0.2.4)
per the feature-milestone promotion rule and the RELEASE_POLICY.md
standing rule on per-phase releases.
- REQUIREMENTS.md: flips REQ-011, REQ-014, REQ-022, REQ-023 from
'Deferred (v0.2)' to 'Pending (v0.2 PXX)'. Adds a v0.2 summary
section.
No code or schema changes. Pure SPECIFY output per run.md Step 3.
CLARIFY and RESEARCH follow.
---ci---
project: orca
phase: 0
milestone: v0.2
status: specify
---/ci---
Final close-out of the v0.1 Foundation milestone after P07 backfill and
the parallel-history resolution. Summary:
- v0.1 Foundation shipped across 6 phases (P00-P06) on milestone/v0.1-initial
with the per-phase tags v0.1.1..v0.1.6 and the milestone tag v0.2.0.
- All 8 Gitea releases published (v0.1.1..v0.1.7, v0.2.0), per the
RELEASE_POLICY.md standing rule 'every phase tag produces a release'.
v0.1.7 is the backfill phase; v0.2.0 is the milestone summary.
- P07 (backfill_releases.sh) verified across 4 layers (structural,
behavioral, security, quality) per ciagent-verify.
- Layer-3 security finding: pre-existing .env secret leak in 0cba1aa
documented in .ciagent/PHASE7_SECURITY_AUDIT.md as P0 for human
remediation (token rotation + history scrub).
- Forward fix applied in P07: .env added to .gitignore (b1b2e3d) and
untracked from the index (00127ce), closing the loop on the leak.
- milestone->main: cherry-picked the 4 P07/security commits onto main
after the parallel PR-#1 merge (be9afa2) was discovered. The cherry-
pick avoided the documented rebase conflicts and produced a clean
linear main at 00127ce. All 4 cherry-picks passed go build, go vet,
and make lint on main.
Coverage: 21/24 requirements complete; 3 deferred to v0.2 (REQ-011 mTLS,
REQ-014 gosec+govulncheck, REQ-022 iter.Seq, REQ-023 mTLS cert gen) —
all paired with multi-node networking or richer I/O scanning, explicitly
out of scope for v0.1 minimalism.
Next milestone: v0.2 — multi-node scheduling, mTLS handshake + cert
generation, gosec+govulncheck in CI, iter.Seq streaming.
---ci---
project: orca
phase: 0
milestone: v0.1
status: complete
version: v0.2.0
requirements:
covered: [REQ-001, REQ-002, REQ-003, REQ-004, REQ-005, REQ-006, REQ-007, REQ-008, REQ-009, REQ-010, REQ-012, REQ-013, REQ-015, REQ-016, REQ-017, REQ-018, REQ-019, REQ-020, REQ-021, REQ-024]
partial: []
---/ci---
The .env file (containing GITEA_TOKEN) was committed in 0cba1aa during
P00 and remained tracked in git history despite the leak. The
.gitignore addition in 477b08c (P07) prevents future re-tracking but
does not untrack a file already in the index.
This commit runs 'git rm --cached .env' to remove the file from the
index while preserving the working-tree copy (which now contains the
rotated token post-P07-verify). The secret remains in git history at
0cba1aa and must be scrubbed by a human (see PHASE7_SECURITY_AUDIT.md
for the full remediation plan, including optional git-filter-repo
history rewrite).
Combined with 477b08c, this commit closes the forward-fix loop:
- .env is now ignored (.gitignore)
- .env is no longer tracked (this commit)
- New tokens in .env will not be committed accidentally
- The historical leak is documented for human remediation
---ci---
project: orca
phase: 7
milestone: v0.1
status: ship
version: v0.1.7
requirements:
covered: [REQ-007]
partial: []
---/ci---
- Fast-forward merge of phase/07-v0.1-backfill into milestone/v0.1-initial
- Annotated tag v0.1.7 created at dc67522
- Gitea release v0.1.7 published with orca-v0.1.7-linux-amd64.tar.gz
- Fix -> typo in release.sh notes block
(unbound variable under set -u; surfaced on first end-to-end run
of release.sh for v0.1.7). Patch is minimal and contained to the
release-notes echo line.
Layer-3 security audit during P07 EXECUTE found that .env (containing
GITEA_TOKEN) was committed in 0cba1aa during P00 and remained in git
history. The pre-P07 .gitignore only excluded .env.local, not .env.
This commit:
1. Adds .env to .gitignore alongside .env.local (forward fix — prevents
future re-tracking).
2. Documents the pre-existing leak in .ciagent/PHASE7_SECURITY_AUDIT.md
with mitigation steps and required human actions (token rotation,
history rewrite, access-log audit, CI secret scanning).
The backfill script itself (commit de69788) does not leak the secret: it
sources .env from disk and never echoes or passes it on the command line.
The leak is upstream of P07 and is documented as P0 for the human to
remediate out-of-band.
---ci---
project: orca
phase: 7
milestone: v0.1
status: execute
version: v0.1.7
requirements:
covered: [REQ-007]
partial: []
---/ci---
The v0.1 milestone COMPLETE commit (d76ff84) was tagged v0.2.0 and the
per-phase tags v0.1.1..v0.1.6 were created, but the standing rule
'every phase tag produces a Gitea release' was only codified in P06
(RELEASE_POLICY.md) and never applied retroactively.
This commit adds scripts/backfill_releases.sh, an idempotent helper that:
- iterates over v0.1.1..v0.1.6 and v0.2.0
- skips tags that already have a release
- builds the orca binary from the milestone branch HEAD (which includes
the post-COMPLETE entry-point fix and workflow-block commits)
- injects the historical version via -ldflags
- packages a per-tag tarball (orca-<tag>-<os>-<arch>.tar.gz)
- creates a Gitea release with the tarball as an asset, and release
notes that include the phase summary and a v0.2.0 milestone recap
After backfill, the v0.1 milestone is fully released end-to-end and the
discipline carries forward into v0.2.
---ci---
project: orca
phase: 7
milestone: v0.1
status: execute
version: v0.1.7
requirements:
covered: [REQ-007]
partial: []
---/ci---
Jon Chery
cloudinit-bot