7bb533c2fb
docs(milestone): complete hardening-completion
...
v0.7 milestone complete. All 4 execution phases + final review shipped.
REQ-053..056 all complete. Tags v0.6.0..v0.6.5 on v0.6.x patch line.
Merged milestone/v0.7-hardening-completion → main.
---ci---
project: orca
phase: 5
milestone: v0.7
status: complete
requirements:
covered: [REQ-053, REQ-054, REQ-055, REQ-056]
partial: []
---/ci---
2026-08-04 00:29:51 +00:00
d7d6961261
fix(P05): final review fixes — PERSONAS.md body, config --addr precedence, migration 0007 dedup
...
Audit fix: PERSONAS.md body roster updated for v0.7 (was stale v0.6
content). Review P1-004: daemon --addr now uses cmd.Flags().Changed()
to detect explicit flag, so config listen_addr only applies when --addr
was not explicitly passed (correct flag>env>file>default precedence).
Review P1-001: migration 0007 now dedups existing duplicate serial_hex
rows before creating the UNIQUE index (backward-compat with v0.6 DBs
that accumulated duplicates before the constraint existed).
---ci---
project: orca
phase: 5
milestone: v0.7
status: execute
requirements:
covered: [REQ-053, REQ-054, REQ-055, REQ-056]
partial: []
---/ci---
2026-08-04 00:28:48 +00:00
afcd15cde4
docs(P04): complete pprof-daemon phase — shipped v0.6.4
...
REQ-056 complete. I-308 (deferred since v0.2) implemented. Tag + merge +
Gitea release succeeded.
---ci---
project: orca
phase: 4
milestone: v0.7
status: complete
requirements:
covered: [REQ-056]
partial: []
---/ci---
2026-08-04 00:22:39 +00:00
0b58286ca2
feat(P04): --pprof opt-in on orca daemon (REQ-056, I-308)
...
Separate *http.Server + *http.ServeMux (AD-024), default disabled.
Operator opts in via --pprof <addr>. WARN logged on startup. All pprof
handlers explicitly registered on dedicated mux (no DefaultServeMux
side-effect). I-308 deferred since v0.2 now implemented. 6 new tests.
---ci---
project: orca
phase: 4
milestone: v0.7
status: verify
requirements:
covered: [REQ-056]
partial: []
---/ci---
2026-08-04 00:22:17 +00:00
f8b135e7a8
docs(P03): complete coverage-uplift phase — shipped v0.6.3
...
REQ-055 complete. All 4 target packages ≥ 50% (engine 65.1%, transport
84.6%, proxmox 82.7%, audit 100%). Latent dispatch.go EOF bug fixed.
---ci---
project: orca
phase: 3
milestone: v0.7
status: complete
requirements:
covered: [REQ-055]
partial: []
---/ci---
2026-08-04 00:19:20 +00:00
d9d0beda3b
test(P03): coverage uplift — engine/transport/proxmox/audit ≥50% + dispatch.go EOF fix (REQ-055)
...
94 new tests across 4 packages. Coverage: engine 8.3%→65.1%, transport
26.3%→84.6%, proxmox 5.1%→82.7%, audit 0%→100%. Bug fix: dispatch.go
bytesReadCloser.Read returned fmt.Errorf("EOF") instead of io.EOF —
broke HTTP request body transmission (latent since v0.2 P02).
---ci---
project: orca
phase: 3
milestone: v0.7
status: verify
requirements:
covered: [REQ-055]
partial: []
---/ci---
2026-08-04 00:18:58 +00:00
007d3a12e8
docs(P02): complete config-parser phase — shipped v0.6.2
...
REQ-054 complete. Tag + merge + Gitea release succeeded.
---ci---
project: orca
phase: 2
milestone: v0.7
status: complete
requirements:
covered: [REQ-054]
partial: []
---/ci---
2026-08-04 00:09:56 +00:00
cd07e435d9
feat(P02): HCL config file parsing — internal/config package (REQ-054)
...
New internal/config package: Config struct (HCL tags), Load(paths...),
MergeOverrides(flags, env) with flag>env>file>default precedence (D-039).
No package-level state (AD-023). --config persistent flag on root command;
daemon uses cfg.ListenAddr when flag at default. 11 config tests + 2 cli tests.
---ci---
project: orca
phase: 2
milestone: v0.7
status: verify
requirements:
covered: [REQ-054]
partial: []
---/ci---
2026-08-04 00:09:33 +00:00
27f2abf8fb
docs(P01): complete cert-register phase — shipped v0.6.1
...
REQ-053 complete. Tag + merge + Gitea release succeeded.
---ci---
project: orca
phase: 1
milestone: v0.7
status: complete
requirements:
covered: [REQ-053]
partial: []
---/ci---
2026-08-04 00:05:45 +00:00
04d9dccd41
fix(P01): register orca cert command tree + cert_repo tests (REQ-053)
...
The `orca cert` command (ca-init, gen, show, renew, fingerprint) was
fully implemented in internal/cli/cert.go but never registered on
rootCmd — unreachable from the CLI. Added init() registration (AD-022).
Added cert_test.go (regression) + cert_smoke_test.go (e2e). Added
cert_repo_test.go (11 tests) + migration 0007 (UNIQUE serial_hex, I-107).
---ci---
project: orca
phase: 1
milestone: v0.7
status: verify
requirements:
covered: [REQ-053]
partial: []
---/ci---
2026-08-04 00:05:10 +00:00
c100892ad9
docs(P00): complete v0.7 pre-execution phase — shipped v0.6.0
...
Tag + merge + Gitea release #399 all succeeded. Phase 0 complete.
---ci---
project: orca
phase: 0
milestone: v0.7
status: complete
---/ci---
2026-08-03 23:54:37 +00:00
561bf61317
docs(P00): correct v0.7 tag line to v0.6.x per branch-strategy.md
...
Tags run on the previous minor's patch line. v0.7 milestone → v0.6.x
tags (v0.6.0 P0 … v0.6.5 P05 milestone release). Prior commits
incorrectly referenced v0.5.x (the v0.6 milestone's line).
---ci---
project: orca
phase: 0
milestone: v0.7
status: plan
---/ci---
2026-08-03 23:52:19 +00:00
f7902dddda
docs(P00): create v0.7 phase plans — 4 exec phases + final review
...
Vertical-slice plans: P01 cert registration + cert_repo tests (REQ-053),
P02 HCL config parser (REQ-054), P03 coverage uplift engine/transport/
proxmox/audit ≥50% (REQ-055), P04 pprof opt-in (REQ-056), P05 final.
NFR milestone, tags v0.5.5..v0.5.10.
---ci---
project: orca
phase: 0
milestone: v0.7
status: plan
---/ci---
2026-08-03 20:30:23 +00:00
f022ef5395
docs(P00): v0.7 ideation results — 13 accepted, 0 skipped
...
3-tier ideation: 5 mechanical (cert unreachable, cert_repo no test,
engine/transport/audit low coverage) + 5 backend (config parser, pprof,
precedence test, separate mux, CI gate) + 3 cross-project (version --json
verify, init() registration, zero new deps). All >=0.60, auto-accepted.
---ci---
project: orca
phase: 0
milestone: v0.7
status: ideate
decisions:
- id: D-043
decision: "Accepted 13 ideation recommendations (REQ-053..056 + 9 refinements)"
rationale: "All >=0.60 confidence; full autonomy auto-accept. Scope confirmed: cert registration, config parser, coverage uplift, pprof."
confidence: 0.92
requirements:
covered: [REQ-053, REQ-054, REQ-055, REQ-056]
---/ci---
2026-08-03 20:29:37 +00:00
7c4b603811
docs(P00): v0.7 research findings + persona assessment
...
Codebase audit: cert command unreachable, no config parser, low coverage
(engine 8.3%, transport 26.3%, proxmox 5.1%, audit 0%), pprof deferred.
5 architectural decisions (AD-022..AD-026). Zero new deps.
---ci---
project: orca
phase: 0
milestone: v0.7
status: research
---/ci---
2026-08-03 20:29:07 +00:00
fc034218e3
docs(P00): clarify v0.7 ambiguities (5 decisions, full autonomy)
...
D-038 HCL config (reuse jobspec dep) | D-039 flag>env>file>default
D-040 pprof opt-in operator addr | D-041 cert registration order
D-042 50% coverage floor, 70% new-code floor
---ci---
project: orca
phase: 0
milestone: v0.7
status: clarify
---/ci---
2026-08-03 20:28:21 +00:00
bd4a34daa2
docs(init): validate v0.7 specification — hardening & completion
...
---ci---
project: orca
phase: 0
milestone: v0.7
status: specify
---/ci---
2026-08-03 20:28:05 +00:00
55d4d699a3
docs(milestone): complete node-bootstrap-proxmox
...
Milestone v0.6 complete. All 6 requirements (REQ-047..052) shipped
across 3 execution phases + final review. Tags v0.5.0..v0.5.4.
---ci---
project: orca
phase: 4
milestone: v0.6
status: complete
requirements:
covered: [REQ-047, REQ-048, REQ-049, REQ-050, REQ-051, REQ-052]
partial: []
---/ci---
2026-08-03 20:02:44 +00:00
7cfc4b7027
docs(P03): verification report — all 4 layers PASS
...
---ci---
project: orca
phase: 3
milestone: v0.6
status: verify
---/ci---
2026-08-03 20:00:12 +00:00
f66472fd37
feat(P03): doctor os + doctor proxmox + audit logging
...
Extends orca doctor with two new checks (REQ-052):
- doctor os: re-runs OS detection from /etc/os-release, compares to
stored localhost node's os field. Drift = WARN (re-run orca init);
match = PASS; missing localhost node = FAIL.
- doctor proxmox: iterates kind=proxmox nodes, SSH-probes each with
`pveversion` (3s timeout per node, clones Network() pattern).
Zero proxmox nodes = WARN; reachable = PASS; unreachable = FAIL.
Changes:
- internal/osdetect: new shared package (Detect + ParseID) extracted
from internal/cli to avoid import cycle (cli + doctor both need it)
- internal/cli/osdetect.go: thin wrapper delegating to osdetect package
- internal/doctor/doctor.go: OS() and Proxmox() checks; All() extended;
probeProxmoxPVEVersion uses orca SSH key + knownhosts TOFU
- internal/cli/doctor.go: doctor os + doctor proxmox subcommands (--json)
- internal/doctor/doctor_test.go: 5 new tests (OS match/drift/missing,
proxmox no-nodes/unreachable)
E2E: orca init -> orca doctor shows 6 PASS / 1 WARN (proxmox=none) /
1 FAIL (network=daemon not running). doctor os --json valid.
---ci---
project: orca
phase: 3
milestone: v0.6
status: execute
---/ci---
2026-08-03 19:59:51 +00:00
82dd01f620
docs(P02): verification report — all 4 layers PASS
...
---ci---
project: orca
phase: 2
milestone: v0.6
status: verify
---/ci---
2026-08-03 19:56:05 +00:00
797bc2f412
feat(P02): Proxmox SSH join + OrcaOperator role + sudoers
...
orca node join --type proxmox bootstraps a remote Proxmox VE 8/9 host
via SSH (REQ-050, REQ-051). The password is used only for initial auth;
subsequent access uses the deployed orca SSH key (D-031).
Changes:
- go.mod: add golang.org/x/crypto v0.54.0 (ssh + ssh/knownhosts + ed25519)
bump x/sys to v0.47.0, add x/term (indirect)
- internal/certpaths: SSHKeyPath, SSHPubPath, KnownHostsPath (D-037)
- internal/security/sshkey.go: GenerateOrLoadSSHKey (Ed25519, PKCS8 PEM,
0600/0644 modes, idempotent load per D-036)
- internal/proxmox/bootstrap.go: BootstrapProxmox SSH dance:
1. Generate/load SSH key
2. SSH dial (password + knownhosts.New TOFU per D-035)
3. Deploy pubkey to ~orca/.ssh/authorized_keys (idempotent)
4. useradd -m orca (idempotent)
5. pveum role add OrcaOperator --privs 'VM.Audit Datastore.AllocateSpace SDN.Use'
6. pveum user add orca@pam (AD-019: PAM realm, not @pve)
7. pveum acl modify / -user orca@pam -role OrcaOperator
8. Write /etc/sudoers.d/orca (AD-020: NOEXEC on pct/qm, no NOEXEC on
apt-get/dpkg, pvesh EXCLUDED — API execute bypasses NOEXEC)
9. visudo -cf validation (abort on failure)
All steps idempotent; audit-logged.
- internal/cli/node.go: --type/--host/--ssh-user/--password/--ssh-port/
--proxmox-user/--proxmox-role flags; joinProxmox() wires to
proxmox.BootstrapProxmox + registers node with kind=proxmox, os=pve.
Password zeroed after use (D-031).
- tests: sshkey generate/load round-trip, idempotency, file modes;
proxmox sudoers content (NOEXEC/NOPASSWD/pvesh-excluded),
privilege set, validation; node join flag wiring
---ci---
project: orca
phase: 2
milestone: v0.6
status: execute
---/ci---
2026-08-03 19:55:14 +00:00
e4edd9aeda
docs(P01): verification report — all 4 layers PASS
...
---ci---
project: orca
phase: 1
milestone: v0.6
status: verify
---/ci---
2026-08-03 19:48:56 +00:00
56fcf8b399
feat(P01): orca init full bootstrap + schema 0006
...
orca init transforms from a bare mkdir into a full single-node cluster
bootstrap. After `orca init`, `orca doctor` passes with zero FAILs
on the bootstrap checks (CA, cert, db, localhost node).
Changes:
- migration 0006: nodes.kind + nodes.os nullable columns (REQ-049)
- model.Node: Kind + OS fields + NodeKind constants (localhost|linux|proxmox)
- NodeRepo: extended Insert/Get/List/Watch/scanNode for kind/os columns
(NULL -> "" mapping); added GetByName + UpdateLastSeenAndOS helpers
- internal/cli/osdetect.go: detectOS() from /etc/os-release ID= field
(D-032); fallback to /usr/lib/os-release then "linux"
- internal/cli/init.go: full bootstrap sequence (REQ-047, REQ-048):
1. MkdirAll namespace dir
2. store.Open (runs migrations 0001..0006)
3. security.CAInit (idempotent fast-path)
4. server cert gen if absent (D-036: skip if present)
5. detectOS from /etc/os-release
6. localhost node upsert (insert if new, refresh last_seen+os if exists)
Idempotent re-run: no duplicate node, no cert regen, id/joined_at preserved
- --json output: full bootstrap summary (namespace, db, ca_fp, cert_fp,
os, node_id, steps array)
- tests: init idempotency, osdetect parsing (ubuntu/debian/alpine/pve),
kind/os round-trip, NULL->"" mapping, GetByName, UpdateLastSeenAndOS
E2E smoke test: orca init -> 5 PASS / 0 WARN / 1 FAIL (network=daemon
not running, expected); orca node list shows localhost node (os=ubuntu).
---ci---
project: orca
phase: 1
milestone: v0.6
status: execute
---/ci---
2026-08-03 19:47:59 +00:00
77dcb32054
docs(P00): create phase plans
...
3 execution phases + final review (PLAN_v0.6.md):
- P01 (Wave 1): orca init full bootstrap + schema 0006 (REQ-047/048/049)
- data-engineer: migration 0006, Node.Kind/OS, NodeRepo extension
- backend-engineer: init.go full bootstrap orchestration
- cli-engineer: osdetect.go, init output UX
- P02 (Wave 1, depends on P01): Proxmox SSH join (REQ-050/051)
- security-engineer: sshkey.go (Ed25519), TOFU, sudoers, PVE role
- backend-engineer: proxmox/bootstrap.go SSH session sequence
- cli-engineer: --type/--host/--password flag wiring
- P03 (Wave 2, depends on P01+P02): doctor extensions (REQ-052)
- backend-engineer: doctor OS() + Proxmox() checks
- cli-engineer: doctor os/proxmox subcommands
- security-engineer: audit logging of bootstrap/join actions
- P04 (Wave 3): final review + ship + audit (milestone release v0.5.4)
Wave ordering: P01 -\u003e P02 -\u003e P03 -\u003e P04 (sequential, parallelization off).
Tags: v0.5.0 (P0) .. v0.5.4 (P4 final = milestone release).
---ci---
project: orca
phase: 0
milestone: v0.6
status: plan
---/ci---
2026-08-03 19:40:21 +00:00
d9978693f4
docs(P00): research findings
...
Research domains (delegated to ci-researcher x2, codebase-grounded):
- golang.org/x/crypto/ssh v0.54.0: API surface, Ed25519 keygen, TOFU
via knownhosts.New, file upload via session heredoc (no SFTP dep)
- /etc/os-release: confirmed ID= values (ubuntu/debian/alpine/pve),
parsing approach, fallback strategy
- Proxmox VE 8/9: pveum syntax (space-separated --privs), orca@pam
realm (not @pve), OrcaOperator role, sudoers with NOEXEC on pct/qm,
pvesh excluded (API execute bypasses NOEXEC)
- Codebase: 12 files to modify/create, 6 reuse opportunities, 12 pitfalls
Persona roster updated: data-engineer + security-engineer reactivated,
devops-engineer deactivated. ARCHITECTURE.md addendum with AD-017..021.
---ci---
project: orca
phase: 0
milestone: v0.6
status: research
---/ci---
2026-08-03 19:39:14 +00:00
563e4bb452
docs(P00): clarify v0.6 ambiguities (8 decisions, full autonomy)
...
D-030..D-034 operator-confirmed in plan mode (SSH library, password
handling, OS detection, Proxmox role granularity, node kind/os schema).
D-035..D-037 auto-resolved at full autonomy within clarify_budget
(SSH host-key TOFU, init idempotency semantics, SSH keypair location
+ Ed25519 algorithm).
---ci---
project: orca
phase: 0
milestone: v0.6
status: clarify
---/ci---
2026-08-03 19:33:26 +00:00
fd2c57afeb
docs(init): validate v0.6 specification
...
---ci---
project: orca
phase: 0
milestone: v0.6
status: specify
---/ci---
2026-08-03 19:32:53 +00:00
df8d5f5c80
docs(milestone): v0.5 checkpoint — milestone complete
...
Checkpoint cleared for next milestone. v0.5 Distribution is complete:
P0-P4 shipped (v0.4.1..v0.4.5), 6/6 requirements covered, merged to main.
---ci---
project: orca
phase: 4
milestone: v0.5
status: complete
---/ci---
2026-08-03 18:57:16 +00:00
2a711dfa6d
docs(milestone): complete v0.5-distribution
...
All 6 requirements complete:
- REQ-041: unified ORCA_HOME namespace root (P1, v0.4.2)
- REQ-042: --system flag for /root/.orca (P1, v0.4.2)
- REQ-043: install.sh 1-liner from public Gitea (P2, v0.4.3)
- REQ-044: in-place update preserves state (P2, v0.4.3)
- REQ-045: repo + releases publicly accessible (P0, v0.4.1)
- REQ-046: docker image on Gitea container registry (P3, v0.4.4)
E2e verified: unauth releases API (200), fresh install, update-in-place,
ORCA_HOME namespace, --system, docker pull + run.
---ci---
project: orca
phase: 4
milestone: v0.5
status: complete
requirements:
covered: [REQ-041, REQ-042, REQ-043, REQ-044, REQ-045, REQ-046]
partial: []
---/ci---
2026-08-03 18:55:50 +00:00
bc57e17163
ship(P03): v0.4.4 released — docker image pushed to Gitea registry
...
REQ-046 satisfied: anonymous docker pull + run verified.
Image: git.cloudinit.dev/coreci/orca:v0.4.4 + :latest
---ci---
project: orca
phase: 3
milestone: v0.5
status: complete
---/ci---
2026-08-03 18:54:01 +00:00
de8fdc0fe4
feat(P03): docker release — multi-stage Dockerfile + Gitea container registry publish
...
REQ-046: Docker image published to Gitea container registry per release.
Dockerfile: multi-stage (golang:1.25 -> distroless/static-debian12:nonroot).
CGO_ENABLED=0, ORCA_HOME=/var/lib/orca, ENTRYPOINT [/orca].
Image size: ~28MB. Runs as nonroot.
.coreci.yml: new container-publish step in release pipeline (docker:24-cli,
builds + tags + login + push + logout).
scripts/release.sh: docker build + push after Gitea release. Graceful
skip if docker absent or GITEA_TOKEN unset. Env-overridable registry.
.dockerignore: excludes .git, bin/, .env, .ciagent/, testdata/, *.tar.gz.
docs/docker.md: pull, run, state persistence (volume mount), local build,
manual publish guide.
Verified: docker build + run version/init with volume persistence.
---ci---
project: orca
phase: 3
milestone: v0.5
status: verify
---/ci---
2026-08-03 18:52:36 +00:00
647e535489
ship(P02): v0.4.3 released — install.sh + in-place update complete
...
---ci---
project: orca
phase: 2
milestone: v0.5
status: complete
---/ci---
2026-08-03 18:50:08 +00:00
85963dc320
feat(P02): install.sh 1-liner + in-place update + README quickstart
...
REQ-043: install.sh pulls release binary from public Gitea URL.
User-level default (~/.local/bin/orca), --system for system-level
(/usr/local/bin/orca). Defaults to latest release; --version pins.
Env-overridable GITEA_URL/OWNER/REPO for testability.
REQ-044: in-place update detects existing binary, reads version via
'orca version --json', prints update message, overwrites binary,
preserves namespace dir (config/db/certs). Idempotent re-install.
REQ-016 (completion): README quickstart now documents the 1-liner
install + --system variant + update-in-place pattern.
Tests: 8/8 pass in scripts/install_test.sh (real public Gitea releases,
no mock server; timeout-guarded to prevent hangs).
Docs: docs/install.md covers user/system install, version pinning,
in-place update, uninstall, troubleshooting.
---ci---
project: orca
phase: 2
milestone: v0.5
status: verify
---/ci---
2026-08-03 18:49:50 +00:00
2ff8318556
ship(P01): v0.4.2 released — namespace unification complete
...
---ci---
project: orca
phase: 1
milestone: v0.5
status: complete
---/ci---
2026-08-03 18:05:23 +00:00
4bfc246be4
feat(P01): unified namespace root via ORCA_HOME + --system flag
...
REQ-041: ORCA_HOME is now the single namespace root for all components
(db, certs, init, daemon). store.Open("") and init command both
route through certpaths.Dir()/DBPath() instead of hardcoding ~/.orca.
Backward compatible: empty ORCA_HOME -> ~/.orca.
REQ-042: --system persistent flag on rootCmd sets ORCA_HOME=/root/.orca
via PersistentPreRunE. Errors on conflict with pre-set ORCA_HOME.
Tests: 7 new tests in namespace_test.go (default, ORCA_HOME override,
--system sets root, conflict detection, init --json, flag registered).
Full suite passes (no regressions).
Docs: docs/namespace.md covers default, ORCA_HOME, --system, ORCA_DB,
resolution order, and path layout tables.
---ci---
project: orca
phase: 1
milestone: v0.5
status: verify
---/ci---
2026-08-03 18:05:01 +00:00
e32cb0bbfc
ship(P00): v0.4.1 release — v0.5 pre-execution complete
...
REQ-045 satisfied: repo + org visibility flipped to public.
Unauth access verified (HTTP 200 on releases API + asset download).
---ci---
project: orca
phase: 0
milestone: v0.5
status: complete
---/ci---
2026-08-03 18:02:16 +00:00
2d1c2de585
docs(P00): create phase plans
...
4-phase plan for v0.5 Distribution:
P1: namespace unification (ORCA_HOME + --system) - REQ-041/042
P2: install.sh + in-place update - REQ-043/044/016
P3: docker release (Dockerfile + Gitea registry) - REQ-046
P4: final review + ship + audit (milestone release v0.4.5=v0.5.0)
Tags: v0.4.1..v0.4.5 on the v0.4.x patch line
---ci---
project: orca
phase: 0
milestone: v0.5
status: plan
---/ci---
2026-08-03 18:01:16 +00:00
3b8a2c4e75
docs(P00): research findings
...
R-001: Gitea container registry (OCI, docker login/push, anon pull when public)
R-002: tea repos edit --private false (visibility flip for REQ-045)
R-003: Gitea releases API (Authorization: token header, asset download URLs)
R-004: ORCA_HOME propagation audit (3 sites: certpaths/store/init)
R-005: distroless static-debian12 base (CGO-free, modernc/sqlite)
R-006: install.sh curl|sh conventions + in-place update pattern
Pitfalls P-001..P-003 (docker-in-CI, public-history leak, CGO_ENABLED=0)
PERSONAS.md: devops-engineer reactivated, data/security/network deactivated for v0.5
---ci---
project: orca
phase: 0
milestone: v0.5
status: research
---/ci---
2026-08-03 18:00:26 +00:00
0f71cf3f36
docs(P00): clarify v0.5 ambiguities (5 decisions, full autonomy)
...
D-025: /root/.orca system-level path (mirror of ~/.orca)
D-026: unify on ORCA_HOME as single namespace root + --system flag
D-027: Gitea built-in container registry for docker images
D-028: flip repo visibility to public via tea repos edit
D-029: install.sh defaults to latest release, optional --version pin
---ci---
project: orca
phase: 0
milestone: v0.5
status: clarify
---/ci---
2026-08-03 17:59:07 +00:00
a22c41164f
docs(init): validate v0.5 specification
...
---ci---
project: orca
phase: 0
milestone: v0.5
status: specify
---/ci---
2026-08-03 17:58:32 +00:00
c814afa773
docs(audit): fix ROADMAP stale checkbox + v0.2 milestone status
...
---ci---
project: orca
phase: 3
milestone: v0.3
status: audit
---/ci---
Audit fixes:
- Phase 11 checkbox: [ ] → [x] (completed in v0.3 P01, shipped v0.3.1)
- v0.2 milestone status: 'pending merge to main' → 'COMPLETE (merged via v0.3)'
- v0.2 milestone tag: 'pending' → 'v0.4.0 shipped'
2026-08-03 17:45:02 +00:00
dbdf679040
docs(milestone): v0.3 checkpoint — milestone complete
...
---ci---
project: orca
phase: 3
milestone: v0.3
status: complete
---/ci---
Milestone v0.3 complete. Checkpoint cleared for next milestone.
2026-08-01 20:07:06 +00:00
df58bc25a3
docs(milestone): complete scheduling-streaming (v0.3)
...
---ci---
project: orca
phase: 3
milestone: v0.3
status: complete
requirements:
covered: [REQ-022, REQ-030, REQ-032]
partial: []
---/ci---
v0.3 milestone merged to main. Includes all v0.2 work (P08-P10) that
was previously on the milestone branch but not yet merged to main, plus
the v0.3 completion work (iter.Seq streaming + doctor network/db).
v0.2 phases included: P08 (mTLS), P09 (scheduling), P10 (security scan).
v0.3 phases: P0 (pre-execution), P1 (iter.Seq streaming), P2 (doctor),
P3 (final review+ship).
Total: 40 requirements, all complete. No new go.mod dependencies.
Full test suite passes under -race. gofmt + go vet clean.
2026-08-01 20:06:47 +00:00
f503404dda
docs(audit): fix .ciagent/ file discipline findings from v0.2 P01 audit
...
CIAgent audit (.ciagent/AUDIT_v0.2_P01.md) surfaced 3 .ciagent/ file
discipline issues. This commit addresses all 3:
1. config.json: re-add the 'workflow' top-level block. It was added in
d10f89dbe9afa2f1c55ca
2026-06-03 22:19:45 +00:00
f31bed2dc3
ship(P08): mTLS merged into v0.2 milestone
...
- Fast-forward merge of phase/08-mtls into milestone/v0.2-networking-observability-security
- Annotated tag v0.2.1 created at this commit
- Gitea release v0.2.1 published with orca-v0.2.1-linux-amd64.tar.gz
- P01 ships internal-CA mTLS, orca cert {ca-init,gen,show,renew,fingerprint},
orca doctor, orca node join --ca-fingerprint, file mode enforcement
(0600/0644), rotation alarm at 30d, cert show redaction, AEAD-only
TLS 1.3 cipher allowlist, structured mTLS handshake log fields.
- REQ coverage: REQ-011, REQ-023, REQ-025, REQ-026, REQ-032,
REQ-033, REQ-034, REQ-035, REQ-036, REQ-038.
---ci---
project: orca
phase: 8
milestone: v0.2
plan: 01
status: ship
version: v0.2.1
requirements:
covered: [REQ-011, REQ-023, REQ-025, REQ-026, REQ-032, REQ-033, REQ-034, REQ-035, REQ-036, REQ-038]
partial: []
---/ci---
2026-06-03 21:39:36 +00:00
31ccb52114
feat(P08): mTLS daemon + transport + cert CLI + doctor
...
Wave B/C/D of P01 mTLS implementation.
- internal/audit/audit.go — thin wrapper around engine.Audit for
cert/handshake events (Action* and Result* constants; REQ-038).
- internal/certpaths/ — extracted path constants out of cli to break
the cli<->doctor import cycle; cli re-exports the helpers for
backward compat.
- internal/security/ca.go — public WriteCert/WriteKey helpers (0600
for keys, 0644 for certs; REQ-033); used by the cert CLI and
integration test.
- internal/daemon/tls.go — mTLS server with GetCertificate hot-swap
callback. Plaintext HTTP remains the default for v0.1 compat;
StartMTLS() flips the server into mTLS mode.
- internal/daemon/server.go — adds mtls *MTLSState field; MTLSActive()
getter for health endpoints.
- internal/transport/mtls.go — mTLS client with VerifyPeerCertificate
for pinned peer identity; DialContext for raw TLS.
- internal/transport/handshake_log.go — structured slog helpers for
handshake ok/fail (REQ-038 fields: event, result, peer, cert_fp).
- internal/cli/cert.go — orca cert {ca-init,gen,show,renew,fingerprint}
subcommands; file mode enforcement at every entry; redacted cert
show (REQ-035).
- internal/cli/doctor.go — orca doctor {cert,network,db} subcommands
(REQ-032); --json output supported.
- internal/cli/node.go — adds --ca-fingerprint to orca node join
(REQ-026); fails fast on mismatch.
- internal/doctor/doctor.go — 6 checks: cert.ca, cert.server,
cert.expiry, cert.fingerprint, network stub, db stub.
- internal/doctor/doctor_test.go — happy + sad path coverage.
- internal/security/integration_test.go — end-to-end: CA-init, CSR
generation, mTLS handshake, mismatch failure, rotation alarm,
redaction, file mode enforcement.
All tests pass with -race; gofmt -l . clean; go vet ./... clean.
---ci---
project: orca
phase: 8
milestone: v0.2
status: execute
---/ci---
2026-06-03 21:33:41 +00:00
181cc769e6
feat(P08): CA, CSR, fingerprint, rotation, redact, TLS config + cert repo
...
Internal CA with CSR join, mTLS 1.3 config builders, rotation alarm,
PEM redaction, and cert inventory schema (REQ-033/034/035/036).
- internal/security/ca.go: CAInit/LoadCA/SignCSR, file mode enforcement
(ca.crt 0644, ca.key 0600) per REQ-033
- internal/security/csr.go: GenerateCSR with DNS + IP SANs (REQ-036)
- internal/security/fingerprint.go: SHA-256 hex of cert DER
- internal/security/rotation.go: 30d pre-expiry alarm, history pruning
- internal/security/redact.go: PEM private key block stripping (REQ-035)
- internal/security/tls_config.go: TLS 1.3 with AEAD allowlist
- internal/security/certgen_test.go: round-trip + mode + rotation + redact
- internal/store/migrations/0004_certs.sql: cert inventory table
- internal/store/cert_repo.go: CRUD + PruneOlderThan (REQ-025)
---ci---
project: orca
phase: 8
milestone: v0.2
status: execute
---/ci---
2026-06-03 21:18:50 +00:00
bed5a2e8e5
docs(P00): create 4 v0.2 phase plans
...
v0.2 PLAN stage. Translates the IDEATE output (commit 1ee82fc
2026-06-03 21:09:15 +00:00
1ee82fc2e2
docs(P00): ideation - 34 ideas accepted
...
v0.2 IDEATE stage. 29 new ideas generated (10 Tier 1 mechanical + 11
Tier 2 backend-enriched + 8 Tier 3 cross-project) plus 6 research-stage
candidates (REQ-cand-A..F from commit 08d321f
2026-06-03 21:03:59 +00:00
Jon Chery