 Jon Chery
|
0358efe95b
|
fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)
- SQLite busy_timeout(5000) + SetMaxOpenConns(1) on all 4 DSNs
- secrets file flock (concurrent set on same ns no longer loses data)
- upgrade lock file (refuse concurrent orca upgrade)
- backup lock file (refuse concurrent backup)
- cache invalidation by writes (read-after-write consistency)
- Executor.Run mutex scope fix (hold only for DB inserts)
- ns create/inherit/set-constraint atomic writeNSMdAtomic
- writeCurrentLead + rotateSSHKeys atomic
- consolidate 3 writeAtomic impls onto security.WriteAtomic
- WebAuthn session stores guarded with sync.Mutex
Tests: concurrent secrets set, upgrade lock rejection, cache
read-after-write, WebAuthn session thread-safety (pass under -race).
---ci---
project: orca
phase: 7
milestone: v0.13
status: complete
requirements:
covered: [156]
---/ci---
|
2026-08-10 12:27:05 +00:00 |
|
|
Jon Chery
|
5d115fc4b7
|
fix(P02): namespace path traversal (REQ-120, F4)
---ci---
project: orca
phase: 2
milestone: v0.12
status: execute
---/ci---
Add ns.ValidateName rejecting .., /, \, leading -, null bytes,
control chars, spaces, >128 chars, and reserved 'cluster'. Wire into
ns create/delete/inspect/validate/inherit/set-constraint + --parent
flag. Fuzz test + 14 traversal regression tests. No namespace dir can
escape ORCA_HOME.
|
2026-08-07 10:55:18 +00:00 |
|
|
Jon Chery
|
97b88a703c
|
feat(P13): ns subcommands (inherit, set-constraint) + deprecation warnings (REQ-068)
orca ns inherit <name> --parent (cycle detection), ns set-constraint
<key>=value>. Deprecation warnings on orca cert ca-init/gen/renew
(step-ca replaces) and .hcl jobspec (R-013). --no-deprecation-warnings
suppresses all.
---ci---
project: orca
phase: 13
milestone: v0.11
status: execute
---/ci---
|
2026-08-07 07:47:28 +00:00 |
|
|
Jon Chery
|
b6d4db1a96
|
feat(P00): CLI cache layer (R-008) — orca_cache SQLite + cache CLI
internal/cache/ package with per-class TTLs (Get/Set/Invalidate);
wired into node/job/ns list read paths; orca cache show/invalidate CLI.
Tests: hit/miss/invalidate/TTL-expiry + bench <1ms hit.
---ci---
project: orca
phase: 00
milestone: v0.11
status: execute
---/ci---
|
2026-08-07 04:17:25 +00:00 |
|
|
Jon Chery
|
7bb31d4c09
|
feat(P0a2): namespace CRUD + inheritance engine (REQ-082)
P0a2 — Namespace inheritance resolver + orca ns CLI subcommands.
Resolver (REQ-082, internal/ns/resolve.go):
- Pure Resolve() function: DFS post-order chain assembly (most-specific
first, _defaults implicit last D-185). Child-wins-scalar env merge, de-duped
union constraints. Cycle detection with readable cycle path. Missing-parent
+ missing-_defaults + misordering (['_defaults','x']) rejection. Opt-out
impossible (D-187). 89.6% coverage.
Parser (internal/ns/parse.go):
- ParseNSMd: hand-rolled YAML frontmatter (no yaml.v3 dep). Validates
kind:Namespace + name, parses parents flow-array, inherits_env/secrets.
- ParseNSMdDir: walks root/*/ns.md, skips cluster/, requires _defaults.
CLI (internal/cli/ns.go, D-176):
- orca ns list/create/delete/inspect/validate. Inspect + validate use the
resolver. Create refuses _defaults/cluster; delete refuses _defaults +
non-empty namespaces. JSON output support. 85.2% coverage.
- Registered on rootCmd.
Tests: resolve_test.go (11 tests), parse_test.go (14 tests), ns_test.go
(21 tests). 18 packages pass, 20 bats pass, gofmt clean, verify-reqs 90
consistent.
---ci---
project: orca
phase: P0a2
milestone: v0.9
status: execute
---/ci---
|
2026-08-05 16:49:12 +00:00 |
|