Wave B of P03. Adds Go-level tests that verify the security
configuration files have the expected shape. We don't run
gosec/govulncheck/gitleaks here (they're external binaries
installed by .coreci.yml ); instead, the tests
catch configuration drift by asserting the right tokens
are present in the config files.
- internal/security/security_scan_test.go — covers the
shape of .gitleaks.toml (cert PEM allowlist present),
.gitleaks-baseline.json (valid JSON, skip entries with
Commit/File), .golangci.yml (gosec/govet/ineffassign/
misspell enabled), scripts/security_scan.sh
(executable, references all three tools + GOFLAGS), and
.coreci.yml (gosec/govulncheck/gitleaks stages present,
GOFLAGS env, go test -race wired).
- internal/security/security_gosec_g101_test.go — meta-
tests: the .coreci.yml pipeline installs
gosec and runs it; GOFLAGS=-mod=mod is set for offline
mode (REQ-027). The fixture file in testdata/ carries
a literal G101 pattern that any future CI run will flag
if the allowlist is misconfigured.
- internal/security/testdata/hardcoded_creds.go — the
G101 fixture. The value is intentionally a sentinel
prefix (GOSEC_G101_FIXTURE_VALUE_*) that does not match
real-secret patterns; gitleaks allowlist for the path
keeps it from being a false positive on the secret
scanner while still triggering gosec's G101 rule.
All builds clean; tests pass with -race; gofmt -l . clean.
---ci---
project: orca
phase: 10
milestone: v0.2
status: execute
---/ci---
Wave B of P02. Wires the data + engine + transport layers into the
daemon HTTP surface and the CLI.
- internal/engine/executor.go — adds Submit(specBytes) and
Status(jobID) entry points to satisfy engine.LocalExecutor
(used by the dispatcher). Submit parses a minimal JSON wire
spec with name/command/args/env fields; Status reads from
store.JobRepo and returns the stringified model.JobStatus.
- internal/engine/dispatcher.go — Dispatcher struct with
LocalExecutor + capacity repo + peer registry + idempotency
dedupe store. Submit(target, spec, idempotencyKey) does the
local-fit-check then bin-packing pick; if no local capacity
and target is empty, falls through to a peer. dispatchTo /
dispatchToPeer open mTLS clients (no cert presented by the
client in P02; the server uses RequireAndVerifyClientCert
but P02 ships with the cert-pool wiring without enforcing
client certs on the dispatch endpoint — P03 hardening).
LocalSubmit/LocalStatus satisfy transport.Dispatcher.
- internal/transport/dispatch.go — SubmitHandler and
StatusHandler (http.Handler). SubmitHandler honors
X-Orca-Idempotency-Key for dedupe replay. Submit/Status
Request/Response wire structs. DispatchClient wraps
mTLS HTTP client with the retry loop. The retry Submit
is implemented as a direct loop (not via Do[T]) because
the response-decode path doesn't fit the generic shape
cleanly.
- internal/daemon/dispatch_handler.go — DispatchHandlers
groups Submit+Status; Mount(mux) attaches both routes.
- internal/daemon/server.go — Server gets a dispatch field;
RegisterDispatch(h) attaches the handlers; mux() mounts
them at /orca.v1.Dispatch/{Submit,Status}.
- internal/daemon/dispatch_test.go — round-trip, idempotency
dedupe, and validation (empty spec=400, GET=405) coverage.
- internal/cli/daemon.go — wires the dispatch service into
the daemon: executor + peer registry + dispatcher +
RegisterDispatch. Adds /orca.v1.Dispatch/* to the startup
banner.
- internal/cli/job.go — adds --target and --idempotency-key
to 'orca job run'; routes through the dispatcher when set.
- internal/cli/node_capacity.go — 'orca node capacity
{show,set,list}' for REQ-028. --set takes --cpu, --memory,
--disk, --node. Positivity check on all three numerics.
All tests pass with -race; gofmt -l . clean; go vet ./...
clean. P02 verification commit follows.
---ci---
project: orca
phase: 9
milestone: v0.2
status: execute
---/ci---
Jon Chery
cloudinit-bot