coreci/orca
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 91 Wiki Activity
178 Commits 3 Branches 148 Tags
41bcf0a6bf0aee53eb2dd069da14a3bdb88368dc
Commit Graph

54 Commits

Author SHA1 Message Date
Jon Chery 41bcf0a6bf feat(P05): drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116) 
orca node drain <host>: marks draining, stops allocs via SSH, marks
drained. orca daemon drain-and-stop: stops v0.8 daemons on peers.
orca job migrate <name> --to <node>: drain+reschedule composite
(C3=a, not live-migrate). Node states: draining, drained.

---ci---
project: orca
phase: 05
milestone: v0.11
status: execute
---/ci---
 2026-08-07 05:17:01 +00:00
Jon Chery f61ef2aa9e feat(P04): backup/restore — signed tarball (HMAC-SHA256) 
internal/backup/backup.go: Backup (tar.gz + HMAC-SHA256 signature,
excludes /run/orca + sockets + WAL/SHM), VerifySignature, Restore
(signature verify + extract + Force flag). internal/cli/backup.go:
orca backup --out + orca restore --in --force. Tests: round-trip,
signature mismatch, exclusion, force-refuse, force-overwrite.

---ci---
project: orca
phase: 04
milestone: v0.11
status: execute
---/ci---
 2026-08-07 04:55:27 +00:00
Jon Chery 2e6436608f feat(P03): secrets subsystem (REQ-080) — AES-256-GCM + HKDF-SHA256 per-ns 
internal/secrets/secrets.go: master key (0600), HKDF-SHA256 per-ns
derivation, AES-256-GCM per-line with AAD=line-number (anti-swap),
EncryptEnvFile/DecryptEnvFile, LoadCredential= map generation.
internal/cli/secrets.go: orca secrets set/get/list/rotate/delete.
Tests: round-trip, nonce uniqueness, AAD anti-swap, 0600 enforcement.

---ci---
project: orca
phase: 03
milestone: v0.11
status: execute
---/ci---
 2026-08-07 04:47:33 +00:00
Jon Chery 33c2b4a78b feat(P02): ACL — SPIFFE + token identities, deny-by-default 
internal/acl/acl.go: Identity, Permission, ACLEntry, ACL with
Grant/Revoke/Check/List; SpiffeNamespace extraction; deny-by-default.
internal/cli/acl.go: orca acl grant/revoke/list/check CLI;
state at cluster/acl.json. Tests: grant/revoke/deny/ns-isolation/concurrent.

---ci---
project: orca
phase: 02
milestone: v0.11
status: execute
---/ci---
 2026-08-07 04:38:00 +00:00
Jon Chery 734c9fa0fa feat(P01.5): SPIFFE SVID minting spike (REQ-076, gate C-08) — PASSES 
internal/identity/spiffe.go: SpiffeURI format + MintSVID via step CLI;
internal/identity/spiffe_test.go: mock-transport tests with self-signed
SPIFFE URI SAN cert. Spike passes: step CLI supports --san with URI SANs.
Fallback to mTLS identity NOT needed.

---ci---
project: orca
phase: 01.5
milestone: v0.11
status: execute
---/ci---
 2026-08-07 04:30:43 +00:00
Jon Chery cc53c1a3e4 feat(P01): metrics endpoint — hand-rolled Prometheus text exposition 
internal/transport/metrics.go: Metrics struct with counters/gauges,
WritePrometheus text exposition; internal/cli/metrics.go: orca metrics
HTTP server on :9100 serving /metrics + /healthz. No client_golang dep.

---ci---
project: orca
phase: 01
milestone: v0.11
status: execute
---/ci---
 2026-08-07 04:24:57 +00:00
Jon Chery b6d4db1a96 feat(P00): CLI cache layer (R-008) — orca_cache SQLite + cache CLI 
internal/cache/ package with per-class TTLs (Get/Set/Invalidate);
wired into node/job/ns list read paths; orca cache show/invalidate CLI.
Tests: hit/miss/invalidate/TTL-expiry + bench <1ms hit.

---ci---
project: orca
phase: 00
milestone: v0.11
status: execute
---/ci---
 2026-08-07 04:17:25 +00:00
Jon Chery 4c2e59cf3f fix(P06): workloadToTaskSpecs command split + runnable examples 
Root cause: orca job run <example>.md failed with fork/exec: no such
file or directory on every example. Two compounding problems:

1. workloadToTaskSpecs (internal/cli/job.go:340) passed the entire
   runtime.command string (e.g. "/usr/bin/httpd -f /etc/orca/web-app/
   httpd.conf") as a single binary path to exec.Command, which then
   looked for a file literally named "/usr/bin/httpd -f ..." and
   failed. The v0.9 markdown parser stores command: as a raw string;
   the legacy HCL path had separate command+args fields. Fix: add
   splitCommand helper that splits on strings.Fields into binary+args,
   with /bin/true fallback for empty commands.

2. The example commands referenced binaries that don't exist on a bare
   Linux machine (/usr/bin/httpd, postgres, api-server, fluent-bit).
   Fix: rewrite the 5 example runtime.command values to use /bin/sleep
   3600 (long-running services) or /bin/echo (one-shot job) so they
   run out-of-the-box. Each file has a Production substitution note
   showing the real binary to use in deployment.

Verified: orca job run examples/full-stack/worker.md now succeeds
(exit 0). All 4 services (web-app, api, log-shipper, postgres) start
correctly (task started, pid assigned). 12 new unit tests pass
(splitCommand: 7 cases, workloadToTaskSpecs: 5 cases). All 5 example
jobspecs still parse + validate (gate C-20). make lint clean.

---ci---
project: orca
phase: 6
milestone: v0.10
status: execute
decisions:
  - id: D-195
    decision: split command string via strings.Fields in workloadToTaskSpecs
    rationale: exec.Command expects binary path + args as separate elements;
      the v0.9 markdown parser stores command: as a single string with no
      args field (unlike legacy HCL). strings.Fields is dep-free and handles
      multiple spaces/tabs. Shell quoting (single/double quotes inside the
      command) is not handled — examples avoid sh -c with quoted strings.
    confidence: 0.95
    alternatives: [shellquote.Split from mvdan/sh (adds dependency)]
lessons:
  - The v0.9 markdown jobspec path needs the same command+args split that
    the legacy HCL path had via separate command/args fields. The parser
    stores command: as a raw string; the CLI must split it before passing
    to exec.Command.
  - Example jobspecs should use /bin/sleep and /bin/echo (binaries that
    exist on every Linux machine) so they run out-of-the-box. Descriptive
    production commands belong in a comment block, not in runtime.command.
---/ci---
 2026-08-05 21:23:32 +00:00
Jon Chery c51eba5e84 fix(P99): P0 heredoc command injection + ROADMAP/REQUIREMENTS reconciliation 
P0 fix (final review T1): internal/sshpush/idempotency.go heredoc
command injection via fixed EOF delimiter. Replaced with per-write random
delimiter verified absent from content (strings.Contains check). Fake SSH
server updated to parse the delimiter dynamically from the command. This
prevents command injection via crafted file content in multi-tenant
namespaces.

ROADMAP reconciliation (final review T2.1): updated v0.9 phase list to
reflect actual execution — 14 tagged phases (P03/P04/P08 combined,
P07a/b/c combined), tags v0.8.1..v0.8.14. Milestone marked COMPLETE.
Phase checkboxes marked [x] with actual REQs covered.

REQUIREMENTS reconciliation: 21 v0.9-scoped REQs marked Complete
(062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082,
083,085,088,089,090). 9 v0.10-deferred REQs (061,065,066,075,079,
080,084,086,087) Phase columns fixed to reference only v0.10 (not v0.9/v0.8)
so verify-reqs doesn't flag them as belonging to completed milestones.

Final review: P0 fixed. P1 warnings logged for post-hoc v0.10: fuzz in CI,
podman command quoting, scheduler O(n^2), ProcessRuntime stdout leak,
host-key verification path gap. 12/19 grill gates cleared; 7 deferred to
v0.10 (C-08,C-09,C-11,C-12,C-13,C-19).

26 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.

---ci---
project: orca
phase: 99
milestone: v0.9
status: execute
---/ci---
 2026-08-05 19:02:54 +00:00
Jon Chery 9991e3d561 feat(P10): lead rules + step-ca integration (REQ-076) 
P10 — step-ca cluster CA (D-101) + lead eligibility (R-003).

step-ca (internal/stepca/stepca.go, REQ-076):
- Client wraps step CLI via SSH on the lead (no Go step-ca client lib).
- Init: step ca init --name --dns --address --provisioner orca-admin. Root
  mirrored to paths.CACertPath() (cluster/ca.crt, v0.9 location).
- IssueServerCert: 90-day (2160h) server cert with SANs. IssueSVID: 24h
  SVID with SPIFFE ID as URI SAN, provisioner orca-admin. RenewServerCert.
  Fingerprint. 96.6% coverage.

Lead rules (internal/cluster/lead.go, R-003):
- IsLeadEligible: linux=true, proxmox=false, unknown=false.
- ValidateLeadRotation: refuses proxmox nodes with R-003 message, refuses
  unregistered nodes. 100% coverage.

26 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.

---ci---
project: orca
phase: P10
milestone: v0.9
status: execute
---/ci---
 2026-08-05 18:48:46 +00:00
Jon Chery 675feabf0c feat(P09): Syncthing storage replication + conflict resolution (REQ-081; gates C-02, C-14) 
P09 — Storage replication via per-namespace Syncthing (R-005).

C-02 spike (.ciagent/C02_SYNCTHING_FEASIBILITY_v0.9.md):
- Config injection: deterministic XML, no GUI, content-addressed folder IDs.
- Conflict policy: flock-style lock + source-wins migration + gc-conflicts.
- Deterministic failure mode: CLI-side DetectConflicts + ResolveConflict.
- Auto-decision: C-02 SATISFIED.

C-14 forced-divergence test (internal/storage/conflict_test.go):
- Two peers write without lock -> conflict detected -> resolved to source
  -> deterministic across re-runs. Unknown source -> nil (no silent winner).
- C-14 SATISFIED.

Replication (internal/storage/replication.go, REQ-081):
- FolderID = sha256(ns+masterKeyFP)[:32] (content-addressed).
- RenderSyncthingConfig + RenderSyncthingXML (GUI disabled, global announce
  off, relay off). DetectConflicts (sorted, deterministic). ResolveConflict
  (source-peer-wins). 97.6% coverage.

Emitter (internal/emitter/syncthing.go):
- SyncthingEmitter renders one config.xml per replicated volume at
  /etc/syncthing/orca-<ns>-<volume>.xml. parseReplicateList, deterministic
  device IDs (placeholders until peer registry wired).

24 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.

---ci---
project: orca
phase: P09
milestone: v0.9
status: execute
---/ci---
 2026-08-05 18:38:49 +00:00
Jon Chery 872ffcaf25 feat(P07a/b/c): runtime abstraction — 5 backends (process/podman/wasm/pve-vm/pve-ct), C-01 satisfied (REQ-078) 
P07a/b/c — Runtime abstraction interface + 5 implementations.

Runtime interface (internal/runtime/runtime.go, REQ-078):
- Runtime interface { Prepare, Start, Stop, Status }. Alloc struct carries
  Runtime field (changeable on migration per R-004). Registry keyed by
  runtime.one_of. DefaultRegistry(transport) registers all 5.

Process (internal/runtime/process.go):
- ProcessRuntime wraps os/exec (LOCAL testing only; production uses systemd
  emitter). SIGTERM grace 10s then SIGKILL.

Podman (internal/runtime/podman.go):
- PodmanRuntime via sshpush.Transport. podman pull/run/stop/rm/inspect.

Wasm (internal/runtime/wasm.go, gate C-01 SATISFIED):
- WasmRuntime uses wasmtime CLI (apt-installed on peer) via SSH exec. NO CGO
  — does NOT import bytecodealliance/wasmtime-go. CGO_ENABLED=0 build
  passes. D-002 cross-compile story preserved. D-187 recorded.

PVE (internal/runtime/pve.go):
- PveVMRuntime (qm create/start/stop/status) + PveCTRuntime (pct
  create/start/stop/status) via sshpush.Transport. VMID = hash(alloc.ID)%99999.

C-01 evaluation: internal/runtime/C01_WASMTIME_CGO_EVAL.md. Auto-decision
(full autonomy): wasmtime remains primary; CLI-via-SSH avoids CGO entirely.
D-187 in PROJECT.md.

23 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
92.7% coverage on internal/runtime.

---ci---
project: orca
phase: P07a/b/c
milestone: v0.9
status: execute
---/ci---
 2026-08-05 18:31:25 +00:00
Jon Chery c3819dde12 feat(P06): task groups — multi-process services, multiple systemd units per alloc 
P06 — Task groups (PRD §9.1: multiple systemd units per alloc).

Parser (internal/jobspec/markdown.go):
- TaskGroupTask type (Name, Runtime, Env, Command). Tasks []TaskGroupTask on
  WorkloadSpec. Parses tasks: frontmatter block (array of task objects).
  Tasks without their own runtime inherit the top-level Runtime as default.
  Backward compat: no tasks -> single-process (existing runtime block).

Systemd emitter (internal/emitter/systemd.go):
- Task group renders one systemd unit per task (orca-v1-alloc-<id>-<task>
  .service) plus a grouping target unit (orca-v1-alloc-<id>.target). Each
  per-task unit carries PartOf=<target> and WantedBy=multi-user.target.
  Single-process case unchanged (backward compat).

Schema (internal/spec/schema/schema.go):
- TaskGroup validation: unique task names, resolvable command (own or
  inherited). JobValidator/ServiceValidator/DaemonSetValidator all accept
  task groups.

Tests: 9 task-group tests in schema_test.go, lifecycle + target-unit tests
in systemd_test.go, parser tests in markdown_test.go. 22 packages pass.

Fix: 3 Service task-group test fixtures missing Count:1 (ServiceValidator
requires count>=1; a task-group Service still has >=1 replica).

---ci---
project: orca
phase: P06
milestone: v0.9
status: execute
---/ci---
 2026-08-05 18:20:05 +00:00
Jon Chery c10779873b feat(P05): CLI-side scheduler + CEL constraints + affinity (REQ-083) 
P05 — Scheduler moves from daemon-side to CLI-side (R-001) with runtime-awareness.

Scheduler (internal/scheduler/scheduler.go, REQ-083):
- Pure Schedule(nodes, req) -> []Placement. Job=1 best-fit, Service=count
  replicas (anti-affinity default, colocation permitted), DaemonSet=1 per
  matching node. Score(node, req) = (FreeCPU*1000 + FreeMem); fits checks
  runtime compat (wasm->wasmtime, pve-vm/ct->proxmox), constraints (CEL AND),
  capacity. Affinity scoring (target + weight, anti-affinity for spreading).

CEL evaluator (internal/scheduler/cel.go):
- Hand-rolled recursive-descent (no CEL dep in go.mod). Subset: node.* attrs,
  literals, ==/!=/>=/<=/></>, in/not in, and/or/not, parens. Anything outside
  subset returns error (no silent wrong answer). Schedule treats eval errors
  as non-fit (node skipped).

23 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
89.5% coverage on internal/scheduler.

---ci---
project: orca
phase: P05
milestone: v0.9
status: execute
---/ci---
 2026-08-05 18:02:51 +00:00
Jon Chery ae6eb5a27b feat(P03,P04,P08): update stanza + lifecycle hooks + socket plumbing 
P03 — Update stanza (rolling/canary/blue-green):
- internal/spec/schema/update.go: UpdateValidator (strategy enum, max_parallel
  1..count, duration parsing, canary int/% forms, auto_promote). 98.2% cov.
- internal/emitter/update.go: RenderUpdatePlan computes the step sequence
  (rolling batches, canary 1+promote+rest, blue-green all+cutover). Pure plan,
  no execution (v0.10-P10 is transactional). 73.7-100% cov.

P04 — Lifecycle hooks (systemd ExecStop semantics):
- Extended internal/emitter/systemd.go: post_start -> ExecStartPost=,
  pre_stop -> ExecStop=. Order: ExecStart -> ExecStartPost -> ExecStop ->
  socket lines. 8 lifecycle tests. 100% cov on systemd.go.

P08 — Socket plumbing (R-007):
- internal/emitter/socket.go: SocketEmitter renders RuntimeDirectory=orca/
  alloc-<id> per port (mode 0750, orca:orca). ExecStartPre TCP-bind marker
  when service.bind=127.0.0.1. SocketPath(allocID,portName) helper. 100% cov.
- Alloc-id is spec.Name placeholder; real id assigned by scheduler at submit.

22 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.

---ci---
project: orca
phase: P03/P04/P08
milestone: v0.9
status: execute
---/ci---
 2026-08-05 17:55:11 +00:00
Jon Chery 436641782c feat(P02): Service block + Traefik emitter + atomic reload (REQ-077, gate C-10) 
P02 — Traefik dynamic config generation + atomic reload protocol.

Parser (internal/jobspec/markdown.go):
- Extended WorkloadSpec with Health, Constraints, Affinity, Lifecycle
  fields. Parsed restart/update/service/health/lifecycle/affinity/
  constraints blocks. HealthBlock, AffinityRule, LifecycleBlock types.

Schema (internal/spec/schema/schema.go):
- ServiceValidator: restart.mode enum (service/on-failure/never),
  update.strategy enum (rolling/canary/blue-green), health required,
  service.bind IP validation (R-007 loopback opt-in). 98.5% coverage.

Traefik emitter (internal/emitter/traefik.go, REQ-077):
- TraefikEmitter renders /etc/traefik/dynamic/orca-<name>.yaml with
  http.routers, http.services (servers = R-007 socket paths), TLS
  (certResolver=orca, trust domain), healthCheck. RenderDrain sets
  weight:0 per backend. RegisterTraefik wires process/podman/wasm.

Atomic reload (internal/emitter/traefik_atomic.go, gate C-10):
- WriteTraefikDynamic: write to path.tmp via WriteFileIdempotent, then
  mv -f path.tmp path (atomic POSIX rename, Traefik fsnotify observes
  IN_MOVED_TO). Traefik holds-last-good on malformed config. C-10 PASS.

22 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.
Coverage: emitter 96.5%, jobspec 88.8%, schema 98.5%, sshpush 93.0%.

---ci---
project: orca
phase: P02
milestone: v0.9
status: execute
---/ci---
 2026-08-05 17:48:04 +00:00
Jon Chery e92b18197c feat(P01): SSH-push transport layer — connection pool, retry, fan-out, idempotent writes (REQ-073) 
P01 — Load-bearing replacement for v0.8 mTLS transport (R-001).

Transport (internal/sshpush/transport.go, REQ-073):
- Transport struct with sync.Map connection pool (reuse *ssh.Client per peer).
- Exec with context timeout (10s default) + retry (100ms x2 cap 5s max 5
  attempts, +/-25% jitter — same backoff as v0.8 transport/retry.go).
- ReadFile, WriteFile (atomic heredoc + mv), Close.
- sshDialer + sshSession seams for testability. TOFU host-key verification
  reuses proxmox.TOFUHostKeyCallback. security.Flock for known_hosts.

Fan-out (internal/sshpush/fanout.go):
- ExecAll, WriteAll with errgroup + SetLimit semaphore (default 8 per I-B-001).
  Per-peer errors collected, don't cancel the group.

Idempotency (internal/sshpush/idempotency.go, C-18):
- WriteFileIdempotent: SHA-256 compare via ssh sha256sum; skip if content
  matches (written=false). Content-addressed idempotency replaces the v0.8
  X-Orca-Idempotency-Key header (C-18 capability map).

Tests: in-process fake SSH server (ssh.NewServerConn NoClientAuth ed25519)
for e2e + interface seams for pure-logic. 93.0% coverage. 20 packages pass.

---ci---
project: orca
phase: P01
milestone: v0.9
status: execute
---/ci---
 2026-08-05 17:35:11 +00:00
Jon Chery 60b0357eb6 feat(P0c): Job/Service/DaemonSet schemas + emitter interface + systemd stub (REQ-074) 
P0c — Kind-specific schema validators + Layer 4 emitter interface.

Schemas (internal/spec/schema/schema.go, REQ-074):
- Validator interface with JobValidator, ServiceValidator, DaemonSetValidator.
  JobValidator: count=1, no service block, optional schedule/timeout.
  ServiceValidator: ports required, count>=1, restart+update+runtime required.
  DaemonSetValidator: schedule mode required, no ports (D-175), no count.
  ValidatorFor(kind) dispatcher. 96.2% coverage.

Emitter interface (internal/emitter/emitter.go, REQ-074, I-B-002):
- File{Path,Content,Mode}, Emitter interface { Render(spec,node) []File },
  Registry keyed by kind:runtime, Register + Render lookup. 100% coverage.

Systemd stub (internal/emitter/systemd.go):
- SystemdEmitter for process runtime. Renders minimal [Service] unit at
  /etc/systemd/system/orca-v1-alloc-<name>.service (orca-v1- prefix per
  dual-write window REQ-090 — no overlap with v0.8 daemon's orca-<job>).

Flock test fix: TestFlock_concurrentBlocks rewritten to use non-blocking
tryFlockEx (LOCK_NB) instead of a leaked blocking goroutine. Eliminates
the temp-dir cleanup race.

20 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.

---ci---
project: orca
phase: P0c
milestone: v0.9
status: execute
---/ci---
 2026-08-05 17:17:02 +00:00
Jon Chery 667f20a7b3 feat(P0b): Markdown jobspec parser + dispatcher + fuzz harness (REQ-064,067) 
P0b — Canonical Markdown+frontmatter jobspec parser (R-013/R-014).

Parser (internal/jobspec/markdown.go, REQ-064):
- WorkloadSpec/RuntimeBlock/PortSpec/VolumeSpec types. ParseMarkdown
  hand-rolled YAML frontmatter (no yaml.v3 dep). Kind validation (Job/
  Service/DaemonSet per R-012). BOM-stripped frontmatter, byte-exact body
  preservation (R-015) via the fuzz harness.

Dispatcher (internal/jobspec/dispatch.go, REQ-064):
- ParseFile/Dispatch routes on extension: .md->Markdown, .yaml/.yml->
  Markdown-with-empty-body, .hcl->ParseHCL adapter. HCL adapter converts
  Spec{Job,Tasks} to *WorkloadSpec (Kind=Job, Runtime.one_of=process).
  Backward compat preserved (REQ-090) — orca job run old-spec.hcl works.
- Legacy Parse renamed ParseHCLLegacy, marked // Deprecated per R-013.

Fuzz harness (internal/jobspec/markdown_fuzz_test.go, REQ-067, R-015):
- FuzzParseMarkdownRoundTrip with 10 seed corpus entries (CRLF, BOM,
  no-frontmatter, only-closing-separator, code-fence ---, trailing
  whitespace, empty body, etc). Asserts byte-exact body round-trip.

Tests: markdown_test.go (19 tests), dispatch_test.go (17 tests), fuzz
(10 seeds). jobspec package 89.2% coverage. cli 81.8% (no regression).

18 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.

---ci---
project: orca
phase: P0b
milestone: v0.9
status: execute
---/ci---
 2026-08-05 17:02:33 +00:00
Jon Chery 7bb31d4c09 feat(P0a2): namespace CRUD + inheritance engine (REQ-082) 
P0a2 — Namespace inheritance resolver + orca ns CLI subcommands.

Resolver (REQ-082, internal/ns/resolve.go):
- Pure Resolve() function: DFS post-order chain assembly (most-specific
  first, _defaults implicit last D-185). Child-wins-scalar env merge, de-duped
  union constraints. Cycle detection with readable cycle path. Missing-parent
  + missing-_defaults + misordering (['_defaults','x']) rejection. Opt-out
  impossible (D-187). 89.6% coverage.

Parser (internal/ns/parse.go):
- ParseNSMd: hand-rolled YAML frontmatter (no yaml.v3 dep). Validates
  kind:Namespace + name, parses parents flow-array, inherits_env/secrets.
- ParseNSMdDir: walks root/*/ns.md, skips cluster/, requires _defaults.

CLI (internal/cli/ns.go, D-176):
- orca ns list/create/delete/inspect/validate. Inspect + validate use the
  resolver. Create refuses _defaults/cluster; delete refuses _defaults +
  non-empty namespaces. JSON output support. 85.2% coverage.
- Registered on rootCmd.

Tests: resolve_test.go (11 tests), parse_test.go (14 tests), ns_test.go
(21 tests). 18 packages pass, 20 bats pass, gofmt clean, verify-reqs 90
consistent.

---ci---
project: orca
phase: P0a2
milestone: v0.9
status: execute
---/ci---
 2026-08-05 16:49:12 +00:00
Jon Chery 437aab39b4 feat(P0a1): multi-namespace path resolver + config demotion + known_hosts flock + CA migration spec (v0.9 P0a1) 
P0a1 — Re-architecture Foundation (path resolver + config demotion).

Path resolver (REQ-070, R-002):
- internal/paths/paths.go: 23 functions for the multi-namespace layout
  (Root/ClusterDir/NamespaceDir/NS*/DefaultNamespace/CA/MasterKey/CacheDB/
  Txn/Peers/KnownHosts/SSH/Server/Config). Honors $ORCA_HOME. 100% coverage.
- internal/certpaths/certpaths.go: refactored as thin shim delegating to
  paths, preserving the v0.8 flat-layout API for backward compat during
  the dual-write window (REQ-090). Package doc explains the v0.10-P14
  migration plan. certpaths deleted after v0.10-P14. 100% coverage.

Config demotion (REQ-069, R-014):
- internal/config/markdown.go: minimal hand-rolled YAML frontmatter parser
  (no new dep — yaml.v3 not in go.mod). Returns same *Config struct as HCL.
- internal/config/config.go: renamed Load body to LoadHCL (// Deprecated
  per R-013), added dispatcher Load() routing on extension (.hcl->HCL,
  .md->Markdown, .yaml->Markdown). Signature preserved so root.go unchanged.
- dispatch_test.go + markdown_test.go: 89.8% coverage on config package.

Known_hosts flock (REQ-063, deferred P1 from REVIEW_v0.8 A2):
- internal/security/flock.go: stdlib syscall.Flock advisory lock helper.
- internal/proxmox/bootstrap.go: TOFUHostKeyCallback capture + ResetHostKey
  both acquire the flock before read-modify-write on known_hosts. Prevents
  concurrent writers under v0.9 parallel SSH fan-out. 3 flock tests.

CA migration spec (grill C-07):
- .ciagent/CA_MIGRATION_SPEC_v0.9.md: Option A (preserve trust root,
  RECOMMENDED) vs Option B (forced re-bootstrap). Pre-flight checks,
  migration steps, rollback, post-migration invariants, spike plan.

Verification: build pass, 17/17 Go packages pass, 20/20 bats pass, gofmt
clean, go vet clean, verify-reqs 90 consistent. Coverage: paths 100%,
certpaths 100%, config 89.8%, emit covered.

---ci---
project: orca
phase: P0a1
milestone: v0.9
status: execute
---/ci---
 2026-08-05 16:38:26 +00:00
Jon Chery fc94326b0e feat(P00): deprecation sweep + bash tooling gate + render contract + doc banners (v0.9 P00) 
P00 — Re-architecture Foundation (deprecation/migration/test-infra/persona/docs).

Deprecation sweep (REQ-068, REQ-072, REQ-089):
- Add // Deprecated: doc comments to internal/daemon (R-001), internal/transport
  (REQ-073), internal/security/ca.go+csr.go (D-101/REQ-076), internal/engine/
  dispatcher.go+peer.go (CLI-side scheduler), internal/cli/daemon.go.
- orca daemon emits slog.Warn deprecation banner on every run (ungated); fires
  R-001 + v0.10-P05 drain-and-stop + v0.10-P14 deletion.
- orca cert and orca node join (mTLS path) emit deprecation warnings; proxmox
  SSH path (the v0.9 replacement) does not warn.
- Add --no-deprecation-warnings global flag on root command (PersistentPreRunE)
  for orca upgrade migrations.
- 12 new daemon/cert/node deprecation tests in internal/cli/daemon_test.go
  (cli coverage 81.9%, warnDeprecated 100%).
- Add DEPRECATED banners to v0.8 sections of ARCHITECTURE.md (verified the
  v0.9 supersession section + Supersession Table from prior turn are present).

Bash tooling gate (grill C-06, C-15, C-16, C-17, C-18):
- scripts/tests/test_helper.bash + example_test.bash — bats framework + helpers.
- scripts/lib/orca-log.sh — slog-compatible JSON logging to syslog (C-17).
- scripts/orca-verify-render.sh — render-contract validator skeleton (C-16).
- scripts/tests/orca-log_test.bash + orca-verify-render_test.bash — 20 bats
  tests total (happy + failure paths per C-15).
- .shellcheckrc — project shellcheck config.
- Makefile: test-bash + lint-bash targets (graceful skip if tools missing);
  wired into test + lint targets.
- internal/emit/contract.go + contract_test.go — versioned JSON render
  contract (orca.emit/v1) between Go emitters and bash appliers (C-16).
- .ciagent/BASH_CAPABILITY_MAP_v0.9.md — maps shipped internal/transport
  capabilities to bash-side equivalents or accepted drops (C-18).
- D-186 recorded in PROJECT.md: bash exempt from Go coverage gate; compensating
  control is bats + shellcheck + shfmt (C-06).

verify-reqs: 90 requirements consistent. Build/test/lint/fmt all green.
20 bats tests pass. Go tests pass. No v0.8 code deleted — only marked deprecated
(deletion deferred to v0.10-P14 per REQ-090 dual-write window).

---ci---
project: orca
phase: P00
milestone: v0.9
status: execute
---/ci---
 2026-08-05 16:26:26 +00:00
Jon Chery 11da458883 test(cli): --host-key-fingerprint non-proxmox validation (T02.11, REQ-058) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 12:04:28 +00:00
Jon Chery d66b3b9a0a test(proxmox,cli): end-to-end trust-surface integration tests (T02.10, REQ-058, REQ-059) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 12:04:24 +00:00
Jon Chery 2dcb14377a fix(doctor): TOFU capture-fix parity with bootstrap — v0.6 ship-defect (T02.9) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:56:45 +00:00
Jon Chery 13e6762f0f feat(cli): orca node key-reset <node> — local known_hosts reset (T02.8, REQ-059) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:51:47 +00:00
Jon Chery 325a5662f4 feat(proxmox): populate Result.HostKeyFingerprint (T02.7, REQ-058) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:48:00 +00:00
Jon Chery 8b0cbe10ae fix(proxmox): TOFU capture bug — v0.6 ship-defect first-connect join always failed (T02.6) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:46:38 +00:00
Jon Chery bd17e6e114 feat(proxmox): pinnedHostKeyCallback for --host-key-fingerprint (T02.5, REQ-058) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:45:53 +00:00
Jon Chery 7cb12c52ce feat(proxmox): HostKeyFingerprint field on Options (T02.4, REQ-058) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:38:39 +00:00
Jon Chery 08481d35ce feat(cli): --host-key-fingerprint flag on node join (T02.3, REQ-058) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:37:01 +00:00
Jon Chery 00869c6f5b refactor(security): export WriteAtomic (T02.2, REQ-059) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:36:42 +00:00
Jon Chery aa3462826b feat(security): SSHFingerprintSHA256 helper (T02.1, REQ-058) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:35:59 +00:00
Jon Chery 6408342a7f test(cli): coverage uplift to ≥70% excl daemon.go (T01.6, REQ-057) 
Add table-driven rootCmd.Execute() tests for the node, job, cert,
doctor, audit, status, version, and node-capacity subcommand families.
Each test runs against a temp ORCA_HOME and asserts stdout/stderr/exit
via the existing initTestEnv/resetRootFlags/discardWriter helpers
(RESEARCH §1.2). extend resetRootFlags to also reset the per-command
flag-bound globals so tests don't leak state between runs.

daemon.go is excluded from the ≥70% target (documented in node_test.go):
the daemon command starts a long-running mTLS server whose lifecycle is
covered by internal/daemon/server_test.go; only its --pprof flag
registration is verified here (daemon_test.go).

Coverage: go test -cover ./internal/cli → 76.2% overall (78.7% by
-func), which includes daemon.go's untested RunE; the non-daemon files
exceed 70% comfortably. go test -race PASS.

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:43:38 +00:00
Jon Chery 9727edf4df test(certpaths): first tests, ≥50% toe-hold (T01.10, REQ-057) 
---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:13:43 +00:00
Jon Chery e45232f395 test(jobspec): coverage uplift to ≥70% + golden HCL fixtures (T01.8, REQ-057) 
---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:12:59 +00:00
Jon Chery 82f3bcacfd test(store): coverage uplift to ≥70% + missing cert_repo_test.go (T01.7, REQ-057) 
---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:12:12 +00:00
Jon Chery 7a834357ec test(proxmox): coverage uplift to ≥70% (T01.5, REQ-057) 
Extend bootstrap_test.go with FullFlow_IdempotentReRun (two
sequential bootstraps on the same fake SSH server — verifies the
idempotent no-op path end-to-end), FullFlow_NoPasswordInLogs
(asserts the SSH password never appears in slog output, D-031),
FullFlow_ValidateSudoersFails (forceSudoersInvalid flag →
wrapped 'validate sudoers' error), FullFlow_CreateLinuxUserFails
(ProxmoxUser=root exercises the /root home branch in deployPubKey),
DefaultSSHDialer_DialContext_ConnectionRefused (covers the real
defaultSSHDialer.DialContext concrete path), and
SSHSessionRunner_CombinedOutput_NewSessionError (closed-client →
'new session' error branch). Add forceSudoersInvalid knob +
funcDialer helper to ssh_session_test.go.

Coverage: 83.2% → 87.1%. go test -race PASS. No production code
changed (T01.1 sessionRunner seam already in place).

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:05:12 +00:00
Jon Chery 40906a0697 test(engine): coverage uplift to ≥70% (T01.4, REQ-057) 
Add registry_test.go (NEW) covering NodeRegistry Join/Leave/Forget/
List/Get (success + not-found + duplicate), NewNodeRegistry nil-
logger, Audit Record success/error (sqlite-backed via openTestDB
pattern) + NewAudit nil-logger. Extend scheduler_test.go with
MemLocalNode/Capacity (happy + nil), JobSpecScore nil/over-capacity/
fits, JobSpecFits nil, PickNode empty. Extend dispatcher_test.go
with Submit error paths: bad spec, explicit target no-registry,
target peer-not-found, peer-pick missing CA, no peer registry, nil
capacity fallthrough, all-peers-fail PickNode.

Coverage: 65.1% → 88.9%. go test -race PASS. No production code
changed; T01.2 peerDispatcher seam NOT needed (error-path tests
via stubbed LocalExecutor + PeerRegistry reached 89% without it;
httptest.NewTLSServer was not required either since dispatchToPeer
CA-missing and PickNode-fail branches cover the remote path).

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:05:09 +00:00
Jon Chery 16e4f8a1f2 test(transport): coverage uplift to ≥70% (T01.3, REQ-057) 
Add retry_test.go (NEW) covering DefaultRetryPolicy, first-attempt
success, idempotent-verb retry, idempotency-key retry, MaxAttempts
exhaustion, zero-MaxAttempts defaulting, transient+non-idempotent+
no-key bail, ctx-cancel mid-backoff, exponential backoff growth +
cap, and contains() substring helper. Extend idempotency_test.go
with Sweep, empty-key Put/Get, and empty-key WithIdempotencyKey.
Extend handshake_log_test.go with LogHandshakeFromCert happy path
(real x509 cert → fingerprint) and FingerprintOfCert round-trip.

Coverage: 84.6% → 93.0%. go test -race PASS. No production code
changed; no new seams (httptest already covered DispatchClient).

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:05:03 +00:00
Jon Chery 2786de166d refactor(proxmox): extract sessionRunner seam for testability (T01.1, REQ-057) 
---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 00:51:15 +00:00
Jon Chery d7d6961261 fix(P05): final review fixes — PERSONAS.md body, config --addr precedence, migration 0007 dedup 
Audit fix: PERSONAS.md body roster updated for v0.7 (was stale v0.6
content). Review P1-004: daemon --addr now uses cmd.Flags().Changed()
to detect explicit flag, so config listen_addr only applies when --addr
was not explicitly passed (correct flag>env>file>default precedence).
Review P1-001: migration 0007 now dedups existing duplicate serial_hex
rows before creating the UNIQUE index (backward-compat with v0.6 DBs
that accumulated duplicates before the constraint existed).

---ci---
project: orca
phase: 5
milestone: v0.7
status: execute
requirements:
  covered: [REQ-053, REQ-054, REQ-055, REQ-056]
  partial: []
---/ci---
 2026-08-04 00:28:48 +00:00
Jon Chery 0b58286ca2 feat(P04): --pprof opt-in on orca daemon (REQ-056, I-308) 
Separate *http.Server + *http.ServeMux (AD-024), default disabled.
Operator opts in via --pprof <addr>. WARN logged on startup. All pprof
handlers explicitly registered on dedicated mux (no DefaultServeMux
side-effect). I-308 deferred since v0.2 now implemented. 6 new tests.

---ci---
project: orca
phase: 4
milestone: v0.7
status: verify
requirements:
  covered: [REQ-056]
  partial: []
---/ci---
 2026-08-04 00:22:17 +00:00
Jon Chery d9d0beda3b test(P03): coverage uplift — engine/transport/proxmox/audit ≥50% + dispatch.go EOF fix (REQ-055) 
94 new tests across 4 packages. Coverage: engine 8.3%→65.1%, transport
26.3%→84.6%, proxmox 5.1%→82.7%, audit 0%→100%. Bug fix: dispatch.go
bytesReadCloser.Read returned fmt.Errorf("EOF") instead of io.EOF —
broke HTTP request body transmission (latent since v0.2 P02).

---ci---
project: orca
phase: 3
milestone: v0.7
status: verify
requirements:
  covered: [REQ-055]
  partial: []
---/ci---
 2026-08-04 00:18:58 +00:00
Jon Chery cd07e435d9 feat(P02): HCL config file parsing — internal/config package (REQ-054) 
New internal/config package: Config struct (HCL tags), Load(paths...),
MergeOverrides(flags, env) with flag>env>file>default precedence (D-039).
No package-level state (AD-023). --config persistent flag on root command;
daemon uses cfg.ListenAddr when flag at default. 11 config tests + 2 cli tests.

---ci---
project: orca
phase: 2
milestone: v0.7
status: verify
requirements:
  covered: [REQ-054]
  partial: []
---/ci---
 2026-08-04 00:09:33 +00:00
Jon Chery 04d9dccd41 fix(P01): register orca cert command tree + cert_repo tests (REQ-053) 
The `orca cert` command (ca-init, gen, show, renew, fingerprint) was
fully implemented in internal/cli/cert.go but never registered on
rootCmd — unreachable from the CLI. Added init() registration (AD-022).
Added cert_test.go (regression) + cert_smoke_test.go (e2e). Added
cert_repo_test.go (11 tests) + migration 0007 (UNIQUE serial_hex, I-107).

---ci---
project: orca
phase: 1
milestone: v0.7
status: verify
requirements:
  covered: [REQ-053]
  partial: []
---/ci---
 2026-08-04 00:05:10 +00:00
Jon Chery f66472fd37 feat(P03): doctor os + doctor proxmox + audit logging 
Extends orca doctor with two new checks (REQ-052):
- doctor os: re-runs OS detection from /etc/os-release, compares to
  stored localhost node's os field. Drift = WARN (re-run orca init);
  match = PASS; missing localhost node = FAIL.
- doctor proxmox: iterates kind=proxmox nodes, SSH-probes each with
  `pveversion` (3s timeout per node, clones Network() pattern).
  Zero proxmox nodes = WARN; reachable = PASS; unreachable = FAIL.

Changes:
- internal/osdetect: new shared package (Detect + ParseID) extracted
  from internal/cli to avoid import cycle (cli + doctor both need it)
- internal/cli/osdetect.go: thin wrapper delegating to osdetect package
- internal/doctor/doctor.go: OS() and Proxmox() checks; All() extended;
  probeProxmoxPVEVersion uses orca SSH key + knownhosts TOFU
- internal/cli/doctor.go: doctor os + doctor proxmox subcommands (--json)
- internal/doctor/doctor_test.go: 5 new tests (OS match/drift/missing,
  proxmox no-nodes/unreachable)

E2E: orca init -> orca doctor shows 6 PASS / 1 WARN (proxmox=none) /
1 FAIL (network=daemon not running). doctor os --json valid.

---ci---
project: orca
phase: 3
milestone: v0.6
status: execute
---/ci---
 2026-08-03 19:59:51 +00:00
Jon Chery 797bc2f412 feat(P02): Proxmox SSH join + OrcaOperator role + sudoers 
orca node join --type proxmox bootstraps a remote Proxmox VE 8/9 host
via SSH (REQ-050, REQ-051). The password is used only for initial auth;
subsequent access uses the deployed orca SSH key (D-031).

Changes:
- go.mod: add golang.org/x/crypto v0.54.0 (ssh + ssh/knownhosts + ed25519)
  bump x/sys to v0.47.0, add x/term (indirect)
- internal/certpaths: SSHKeyPath, SSHPubPath, KnownHostsPath (D-037)
- internal/security/sshkey.go: GenerateOrLoadSSHKey (Ed25519, PKCS8 PEM,
  0600/0644 modes, idempotent load per D-036)
- internal/proxmox/bootstrap.go: BootstrapProxmox SSH dance:
  1. Generate/load SSH key
  2. SSH dial (password + knownhosts.New TOFU per D-035)
  3. Deploy pubkey to ~orca/.ssh/authorized_keys (idempotent)
  4. useradd -m orca (idempotent)
  5. pveum role add OrcaOperator --privs 'VM.Audit Datastore.AllocateSpace SDN.Use'
  6. pveum user add orca@pam (AD-019: PAM realm, not @pve)
  7. pveum acl modify / -user orca@pam -role OrcaOperator
  8. Write /etc/sudoers.d/orca (AD-020: NOEXEC on pct/qm, no NOEXEC on
     apt-get/dpkg, pvesh EXCLUDED — API execute bypasses NOEXEC)
  9. visudo -cf validation (abort on failure)
  All steps idempotent; audit-logged.
- internal/cli/node.go: --type/--host/--ssh-user/--password/--ssh-port/
  --proxmox-user/--proxmox-role flags; joinProxmox() wires to
  proxmox.BootstrapProxmox + registers node with kind=proxmox, os=pve.
  Password zeroed after use (D-031).
- tests: sshkey generate/load round-trip, idempotency, file modes;
  proxmox sudoers content (NOEXEC/NOPASSWD/pvesh-excluded),
  privilege set, validation; node join flag wiring

---ci---
project: orca
phase: 2
milestone: v0.6
status: execute
---/ci---
 2026-08-03 19:55:14 +00:00
Jon Chery 56fcf8b399 feat(P01): orca init full bootstrap + schema 0006 
orca init transforms from a bare mkdir into a full single-node cluster
bootstrap. After `orca init`, `orca doctor` passes with zero FAILs
on the bootstrap checks (CA, cert, db, localhost node).

Changes:
- migration 0006: nodes.kind + nodes.os nullable columns (REQ-049)
- model.Node: Kind + OS fields + NodeKind constants (localhost|linux|proxmox)
- NodeRepo: extended Insert/Get/List/Watch/scanNode for kind/os columns
  (NULL -> "" mapping); added GetByName + UpdateLastSeenAndOS helpers
- internal/cli/osdetect.go: detectOS() from /etc/os-release ID= field
  (D-032); fallback to /usr/lib/os-release then "linux"
- internal/cli/init.go: full bootstrap sequence (REQ-047, REQ-048):
  1. MkdirAll namespace dir
  2. store.Open (runs migrations 0001..0006)
  3. security.CAInit (idempotent fast-path)
  4. server cert gen if absent (D-036: skip if present)
  5. detectOS from /etc/os-release
  6. localhost node upsert (insert if new, refresh last_seen+os if exists)
  Idempotent re-run: no duplicate node, no cert regen, id/joined_at preserved
- --json output: full bootstrap summary (namespace, db, ca_fp, cert_fp,
  os, node_id, steps array)
- tests: init idempotency, osdetect parsing (ubuntu/debian/alpine/pve),
  kind/os round-trip, NULL->"" mapping, GetByName, UpdateLastSeenAndOS

E2E smoke test: orca init -> 5 PASS / 0 WARN / 1 FAIL (network=daemon
not running, expected); orca node list shows localhost node (os=ubuntu).

---ci---
project: orca
phase: 1
milestone: v0.6
status: execute
---/ci---
 2026-08-03 19:47:59 +00:00
Jon Chery 4bfc246be4 feat(P01): unified namespace root via ORCA_HOME + --system flag 
REQ-041: ORCA_HOME is now the single namespace root for all components
  (db, certs, init, daemon). store.Open("") and init command both
  route through certpaths.Dir()/DBPath() instead of hardcoding ~/.orca.
  Backward compatible: empty ORCA_HOME -> ~/.orca.

REQ-042: --system persistent flag on rootCmd sets ORCA_HOME=/root/.orca
  via PersistentPreRunE. Errors on conflict with pre-set ORCA_HOME.

Tests: 7 new tests in namespace_test.go (default, ORCA_HOME override,
  --system sets root, conflict detection, init --json, flag registered).
  Full suite passes (no regressions).

Docs: docs/namespace.md covers default, ORCA_HOME, --system, ORCA_DB,
  resolution order, and path layout tables.

---ci---
project: orca
phase: 1
milestone: v0.5
status: verify
---/ci---
 2026-08-03 18:05:01 +00:00