coreci/orca - orca - Cloudinit Services GIT

coreci/orca

Fork 0

Commit Graph

Author	SHA1	Message	Date
ciagent	5dba3cef80	feat(P09): dispatcher, transport.dispatch, CLI surface, daemon mount Wave B of P02. Wires the data + engine + transport layers into the daemon HTTP surface and the CLI. - internal/engine/executor.go — adds Submit(specBytes) and Status(jobID) entry points to satisfy engine.LocalExecutor (used by the dispatcher). Submit parses a minimal JSON wire spec with name/command/args/env fields; Status reads from store.JobRepo and returns the stringified model.JobStatus. - internal/engine/dispatcher.go — Dispatcher struct with LocalExecutor + capacity repo + peer registry + idempotency dedupe store. Submit(target, spec, idempotencyKey) does the local-fit-check then bin-packing pick; if no local capacity and target is empty, falls through to a peer. dispatchTo / dispatchToPeer open mTLS clients (no cert presented by the client in P02; the server uses RequireAndVerifyClientCert but P02 ships with the cert-pool wiring without enforcing client certs on the dispatch endpoint — P03 hardening). LocalSubmit/LocalStatus satisfy transport.Dispatcher. - internal/transport/dispatch.go — SubmitHandler and StatusHandler (http.Handler). SubmitHandler honors X-Orca-Idempotency-Key for dedupe replay. Submit/Status Request/Response wire structs. DispatchClient wraps mTLS HTTP client with the retry loop. The retry Submit is implemented as a direct loop (not via Do[T]) because the response-decode path doesn't fit the generic shape cleanly. - internal/daemon/dispatch_handler.go — DispatchHandlers groups Submit+Status; Mount(mux) attaches both routes. - internal/daemon/server.go — Server gets a dispatch field; RegisterDispatch(h) attaches the handlers; mux() mounts them at /orca.v1.Dispatch/{Submit,Status}. - internal/daemon/dispatch_test.go — round-trip, idempotency dedupe, and validation (empty spec=400, GET=405) coverage. - internal/cli/daemon.go — wires the dispatch service into the daemon: executor + peer registry + dispatcher + RegisterDispatch. Adds /orca.v1.Dispatch/* to the startup banner. - internal/cli/job.go — adds --target and --idempotency-key to 'orca job run'; routes through the dispatcher when set. - internal/cli/node_capacity.go — 'orca node capacity {show,set,list}' for REQ-028. --set takes --cpu, --memory, --disk, --node. Positivity check on all three numerics. All tests pass with -race; gofmt -l . clean; go vet ./... clean. P02 verification commit follows. ---ci--- project: orca phase: 9 milestone: v0.2 status: execute ---/ci---	2026-06-03 22:45:54 +00:00
ciagent	31ccb52114	feat(P08): mTLS daemon + transport + cert CLI + doctor Wave B/C/D of P01 mTLS implementation. - internal/audit/audit.go — thin wrapper around engine.Audit for cert/handshake events (Action* and Result* constants; REQ-038). - internal/certpaths/ — extracted path constants out of cli to break the cli<->doctor import cycle; cli re-exports the helpers for backward compat. - internal/security/ca.go — public WriteCert/WriteKey helpers (0600 for keys, 0644 for certs; REQ-033); used by the cert CLI and integration test. - internal/daemon/tls.go — mTLS server with GetCertificate hot-swap callback. Plaintext HTTP remains the default for v0.1 compat; StartMTLS() flips the server into mTLS mode. - internal/daemon/server.go — adds mtls *MTLSState field; MTLSActive() getter for health endpoints. - internal/transport/mtls.go — mTLS client with VerifyPeerCertificate for pinned peer identity; DialContext for raw TLS. - internal/transport/handshake_log.go — structured slog helpers for handshake ok/fail (REQ-038 fields: event, result, peer, cert_fp). - internal/cli/cert.go — orca cert {ca-init,gen,show,renew,fingerprint} subcommands; file mode enforcement at every entry; redacted cert show (REQ-035). - internal/cli/doctor.go — orca doctor {cert,network,db} subcommands (REQ-032); --json output supported. - internal/cli/node.go — adds --ca-fingerprint to orca node join (REQ-026); fails fast on mismatch. - internal/doctor/doctor.go — 6 checks: cert.ca, cert.server, cert.expiry, cert.fingerprint, network stub, db stub. - internal/doctor/doctor_test.go — happy + sad path coverage. - internal/security/integration_test.go — end-to-end: CA-init, CSR generation, mTLS handshake, mismatch failure, rotation alarm, redaction, file mode enforcement. All tests pass with -race; gofmt -l . clean; go vet ./... clean. ---ci--- project: orca phase: 8 milestone: v0.2 status: execute ---/ci---	2026-06-03 21:33:41 +00:00
cloudinit-bot	be9afa2d2c	ship: v0.1 Foundation milestone complete (#1 )	2026-06-03 20:08:57 +00:00

Author

SHA1

Message

Date

ciagent

5dba3cef80

feat(P09): dispatcher, transport.dispatch, CLI surface, daemon mount

Wave B of P02. Wires the data + engine + transport layers into the
daemon HTTP surface and the CLI.

- internal/engine/executor.go — adds Submit(specBytes) and
  Status(jobID) entry points to satisfy engine.LocalExecutor
  (used by the dispatcher). Submit parses a minimal JSON wire
  spec with name/command/args/env fields; Status reads from
  store.JobRepo and returns the stringified model.JobStatus.
- internal/engine/dispatcher.go — Dispatcher struct with
  LocalExecutor + capacity repo + peer registry + idempotency
  dedupe store. Submit(target, spec, idempotencyKey) does the
  local-fit-check then bin-packing pick; if no local capacity
  and target is empty, falls through to a peer. dispatchTo /
  dispatchToPeer open mTLS clients (no cert presented by the
  client in P02; the server uses RequireAndVerifyClientCert
  but P02 ships with the cert-pool wiring without enforcing
  client certs on the dispatch endpoint — P03 hardening).
  LocalSubmit/LocalStatus satisfy transport.Dispatcher.
- internal/transport/dispatch.go — SubmitHandler and
  StatusHandler (http.Handler). SubmitHandler honors
  X-Orca-Idempotency-Key for dedupe replay. Submit/Status
  Request/Response wire structs. DispatchClient wraps
  mTLS HTTP client with the retry loop. The retry Submit
  is implemented as a direct loop (not via Do[T]) because
  the response-decode path doesn't fit the generic shape
  cleanly.
- internal/daemon/dispatch_handler.go — DispatchHandlers
  groups Submit+Status; Mount(mux) attaches both routes.
- internal/daemon/server.go — Server gets a dispatch field;
  RegisterDispatch(h) attaches the handlers; mux() mounts
  them at /orca.v1.Dispatch/{Submit,Status}.
- internal/daemon/dispatch_test.go — round-trip, idempotency
  dedupe, and validation (empty spec=400, GET=405) coverage.
- internal/cli/daemon.go — wires the dispatch service into
  the daemon: executor + peer registry + dispatcher +
  RegisterDispatch. Adds /orca.v1.Dispatch/* to the startup
  banner.
- internal/cli/job.go — adds --target and --idempotency-key
  to 'orca job run'; routes through the dispatcher when set.
- internal/cli/node_capacity.go — 'orca node capacity
  {show,set,list}' for REQ-028. --set takes --cpu, --memory,
  --disk, --node. Positivity check on all three numerics.

All tests pass with -race; gofmt -l . clean; go vet ./...
clean. P02 verification commit follows.

---ci---
project: orca
phase: 9
milestone: v0.2
status: execute
---/ci---

2026-06-03 22:45:54 +00:00

ciagent

31ccb52114

feat(P08): mTLS daemon + transport + cert CLI + doctor

Wave B/C/D of P01 mTLS implementation.

- internal/audit/audit.go — thin wrapper around engine.Audit for
  cert/handshake events (Action* and Result* constants; REQ-038).
- internal/certpaths/ — extracted path constants out of cli to break
  the cli<->doctor import cycle; cli re-exports the helpers for
  backward compat.
- internal/security/ca.go — public WriteCert/WriteKey helpers (0600
  for keys, 0644 for certs; REQ-033); used by the cert CLI and
  integration test.
- internal/daemon/tls.go — mTLS server with GetCertificate hot-swap
  callback. Plaintext HTTP remains the default for v0.1 compat;
  StartMTLS() flips the server into mTLS mode.
- internal/daemon/server.go — adds mtls *MTLSState field; MTLSActive()
  getter for health endpoints.
- internal/transport/mtls.go — mTLS client with VerifyPeerCertificate
  for pinned peer identity; DialContext for raw TLS.
- internal/transport/handshake_log.go — structured slog helpers for
  handshake ok/fail (REQ-038 fields: event, result, peer, cert_fp).
- internal/cli/cert.go — orca cert {ca-init,gen,show,renew,fingerprint}
  subcommands; file mode enforcement at every entry; redacted cert
  show (REQ-035).
- internal/cli/doctor.go — orca doctor {cert,network,db} subcommands
  (REQ-032); --json output supported.
- internal/cli/node.go — adds --ca-fingerprint to orca node join
  (REQ-026); fails fast on mismatch.
- internal/doctor/doctor.go — 6 checks: cert.ca, cert.server,
  cert.expiry, cert.fingerprint, network stub, db stub.
- internal/doctor/doctor_test.go — happy + sad path coverage.
- internal/security/integration_test.go — end-to-end: CA-init, CSR
  generation, mTLS handshake, mismatch failure, rotation alarm,
  redaction, file mode enforcement.

All tests pass with -race; gofmt -l . clean; go vet ./... clean.

---ci---
project: orca
phase: 8
milestone: v0.2
status: execute
---/ci---

2026-06-03 21:33:41 +00:00

cloudinit-bot

be9afa2d2c

ship: v0.1 Foundation milestone complete (#1 )

2026-06-03 20:08:57 +00:00

3 Commits