coreci/orca
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 91 Wiki Activity
104 Commits 3 Branches 148 Tags
8631a698cee36c36b36f2995b22295ab1917edb6
Commit Graph

104 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jon Chery 8631a698ce docs(P00): ideate v0.9 — 30 ideas (REQ-061..090), 3 tiers, 7 phase-reorder flags 
Generates 30 ideation ideas across mechanical (12), backend-enriched (12),
and cross-cutting (6) tiers, all accepted at >=0.60 confidence. Mapped to
REQ-061..REQ-090. Highest-impact: I-C-001 (migration ordering, 0.88) and
I-C-006 (dual-write window, 0.86) reshape v0.9 execution strategy. Highest
blast radius: I-M-010 (path resolver, 0.84) touches every adaptable package.
Most under-specified by PRD: I-B-003 (lead applier execution model, 0.78).
Seven phase-reordering flags against PRD section 23: add v0.9-P00 deprecation
pre-phase, split P0a into P0a1/P0a2, design SSH-push before P01, fold emitter
into P0c, add txn-design spike in P0.9-P00, bootstrap test infra in P00,
fold persona reactivation + doc banners into P00.

---ci---
project: orca
phase: 0
milestone: v0.9
status: ideate
---/ci---
 2026-08-05 16:01:28 +00:00
Jon Chery 642a79f604 docs(P00): research v0.9 re-architecture — codebase audit + prior-context review 
Reconciles the PRD against the shipped v0.8 codebase. Audit confirms the
PRD's R-series and D-068+ describe a re-architecture (not a continuation):
6 foundational axes contradict the shipped code (daemon, transport, CA,
identity, config format, namespace model) and 8 subsystems are net-new.
Prior planning corpus (IDEATION/GRILL/RESEARCH v0.2-v0.8) confirmed no
v0.9/v1.0 plan existed; step-ca was explicitly rejected (AD-010); SPIFFE
was rejected (PROJECT.md:94). The re-architecture is the first direction
change in the project's history.

---ci---
project: orca
phase: 0
milestone: v0.9
status: research
---/ci---
 2026-08-05 16:01:17 +00:00
Jon Chery e008c53966 docs(P00): specify v0.9 re-architecture milestone — PRD adopted, REQ-061..090, supersession table 
Adopts the v0.9/v1.0 PRD (.ciagent/PRD_v0.9.md) that supersedes the shipped
v0.1-v0.8 architecture. The re-architecture is justified by a six-part
evidence basis recorded in the PROJECT.md Supersession Table:
operational daemon failure, external step-ca mandate, multi-tenancy
requirement, WASM workload requirement, SSH-push deployment target,
and vision correction.

Appends 30 net-new requirements (REQ-061..REQ-090) to REQUIREMENTS.md,
the v0.9 (13 phases) + v1.0 (19 phases) reordered plan to ROADMAP.md,
the AD-series supersession table to PROJECT.md + ARCHITECTURE.md, and
reactivates security-engineer + network-engineer + devops-engineer
personas (implements grill C-05).

---ci---
project: orca
phase: 0
milestone: v0.9
status: specify
---/ci---
 2026-08-05 16:01:06 +00:00
Jon Chery 8b19c9ab68 docs(milestone): complete coverage-trust-hardening — v0.8 milestone release 
Mark REQ-057..060 Complete in REQUIREMENTS.md, mark v0.8 COMPLETE in
ROADMAP.md, advance config.json phase to 4.

P0 (v0.7.0): pre-execution — specify/clarify/research/plan/grill.
P1 (v0.7.1): coverage round 2 — 9 packages hit tiered floor.
P2 (v0.7.2): SSH trust hardening — --host-key-fingerprint + key-reset
             + v0.6 TOFU ship-defect bugfix + doctor parity.
P3 (v0.7.3): requirements-hygiene gate — make verify-reqs + CI hook.
P4 (v0.7.4): final review + audit + milestone release (this commit).

Review: PASS-WITH-FOLLOWUPS (0 P0, 3 P1+ deferred to v0.9).
Audit: PASS (1 P1 stale-branch-hygiene, pre-existing, post-ship cleanup).
GRILL: 4/4 binding conditions satisfied.

---ci---
project: orca
phase: 4
milestone: v0.8
status: complete
requirements:
  covered: [REQ-057, REQ-058, REQ-059, REQ-060]
  partial: []
---/ci---
v0.7.4 		2026-08-04 12:25:58 +00:00
Jon Chery 70c5718505 verify(P03): 4-layer verification PASS — REQ-060 
---ci---
project: orca
phase: 3
milestone: v0.8
status: verify
requirements:
  covered: [REQ-060]
  partial: []
---/ci---
v0.7.3 		2026-08-04 12:18:48 +00:00
Jon Chery 46bd07c792 docs(P03): synthetic drift verification — verify-reqs passes + fails-on-drift (T03.5, REQ-060) 
T03.5 synthetic drift verification (REQ-060 acceptance criterion):
1. make verify-reqs on current repo → exit 0 (60 requirements consistent)
2. flipped REQ-053 (v0.7 P1) row to Pending → make verify-reqs exit 1
   diff: REQ-053: status=Pending, expected=Complete (direction=forward)
3. reverted scratch edit → make verify-reqs exit 0

Gate passes on the real repo and correctly fails on synthetic forward
drift (ROADMAP v0.7 COMPLETE but REQUIREMENTS REQ-053 Pending). The
reverse-direction assertion is exercised by the golden-file tests
(T03.2). REQ-060 acceptance criterion met.

---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
 2026-08-04 12:17:00 +00:00
Jon Chery b6d514ee21 chore(ci): verify-reqs in validate pipeline (T03.4, REQ-060) 
---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
 2026-08-04 12:16:14 +00:00
Jon Chery 7bd8e47241 chore(makefile): verify-reqs target (T03.3, REQ-060) 
---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
 2026-08-04 12:15:58 +00:00
Jon Chery 016039d1a3 test(cmd/verify-reqs): golden-file tests (T03.2, REQ-060) 
---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
 2026-08-04 12:15:33 +00:00
Jon Chery fc2b020423 feat(cmd/verify-reqs): requirements-hygiene gate (T03.1, REQ-060) 
---ci---
project: orca
phase: 3
milestone: v0.8
status: execute
---/ci---
 2026-08-04 12:11:40 +00:00
Jon Chery f4192be5d1 verify(P02): 4-layer verification PASS — REQ-058, REQ-059 + TOFU bugfix 
---ci---
project: orca
phase: 2
milestone: v0.8
status: verify
requirements:
  covered: [REQ-058, REQ-059]
  partial: []
---/ci---
v0.7.2 		2026-08-04 12:07:56 +00:00
Jon Chery 11da458883 test(cli): --host-key-fingerprint non-proxmox validation (T02.11, REQ-058) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 12:04:28 +00:00
Jon Chery d66b3b9a0a test(proxmox,cli): end-to-end trust-surface integration tests (T02.10, REQ-058, REQ-059) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 12:04:24 +00:00
Jon Chery 2dcb14377a fix(doctor): TOFU capture-fix parity with bootstrap — v0.6 ship-defect (T02.9) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:56:45 +00:00
Jon Chery 13e6762f0f feat(cli): orca node key-reset <node> — local known_hosts reset (T02.8, REQ-059) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:51:47 +00:00
Jon Chery 325a5662f4 feat(proxmox): populate Result.HostKeyFingerprint (T02.7, REQ-058) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:48:00 +00:00
Jon Chery 8b0cbe10ae fix(proxmox): TOFU capture bug — v0.6 ship-defect first-connect join always failed (T02.6) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:46:38 +00:00
Jon Chery bd17e6e114 feat(proxmox): pinnedHostKeyCallback for --host-key-fingerprint (T02.5, REQ-058) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:45:53 +00:00
Jon Chery 7cb12c52ce feat(proxmox): HostKeyFingerprint field on Options (T02.4, REQ-058) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:38:39 +00:00
Jon Chery 08481d35ce feat(cli): --host-key-fingerprint flag on node join (T02.3, REQ-058) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:37:01 +00:00
Jon Chery 00869c6f5b refactor(security): export WriteAtomic (T02.2, REQ-059) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:36:42 +00:00
Jon Chery aa3462826b feat(security): SSHFingerprintSHA256 helper (T02.1, REQ-058) 
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
 2026-08-04 11:35:59 +00:00
Jon Chery dea358d40b verify(P01): 4-layer verification PASS — REQ-057 covered 
---ci---
project: orca
phase: 1
milestone: v0.8
status: verify
requirements:
  covered: [REQ-057]
  partial: []
---/ci---
v0.7.1 		2026-08-04 01:51:26 +00:00
Jon Chery 367a338a72 test(P01): coverage-gate verification — all 9 packages hit tiered floor (T01.12, REQ-057) 
>=70%: engine 88.9%, proxmox 87.1%, cli 76.2%, transport 93.0%,
       store 84.7%, jobspec 90.5%
>=50%: audit 100.0%, certpaths 100.0%, cmd/orca 80.0%
go test -race ./... PASS. GRILL escape valve NOT needed.

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
requirements:
  covered: [REQ-057]
  partial: []
---/ci---
 2026-08-04 01:49:15 +00:00
Jon Chery 2ce6622055 test(cmd/orca): smoke test ≥50% toe-hold, main→run refactor (T01.11, REQ-057) 
Refactor main() into run() int (main calls os.Exit(run())) so the test
can exercise the CLI directly without os.Exit terminating the test
process. Add main_test.go with two cases: run() success path (version
command → exit 0) and run() error path (job run with missing spec →
exit 1, stderr contains "error:"). Low-effort toe-hold per RESEARCH
§1.1/§1.4 — do not over-invest in glue-code coverage.

Coverage: go test -cover ./cmd/orca → 80.0% (was 0%, target ≥50%).
go test -race PASS.

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:43:57 +00:00
Jon Chery 6408342a7f test(cli): coverage uplift to ≥70% excl daemon.go (T01.6, REQ-057) 
Add table-driven rootCmd.Execute() tests for the node, job, cert,
doctor, audit, status, version, and node-capacity subcommand families.
Each test runs against a temp ORCA_HOME and asserts stdout/stderr/exit
via the existing initTestEnv/resetRootFlags/discardWriter helpers
(RESEARCH §1.2). extend resetRootFlags to also reset the per-command
flag-bound globals so tests don't leak state between runs.

daemon.go is excluded from the ≥70% target (documented in node_test.go):
the daemon command starts a long-running mTLS server whose lifecycle is
covered by internal/daemon/server_test.go; only its --pprof flag
registration is verified here (daemon_test.go).

Coverage: go test -cover ./internal/cli → 76.2% overall (78.7% by
-func), which includes daemon.go's untested RunE; the non-daemon files
exceed 70% comfortably. go test -race PASS.

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:43:38 +00:00
Jon Chery 2d47cd9135 test(audit): first tests, ≥50% toe-hold (T01.9, REQ-057) 
internal/audit/audit_test.go was added in d9d0bed (Wave 1 P03 uplift)
and already achieves 100.0% coverage — well above the ≥50% toe-hold
target. This empty commit records T01.9 acceptance for the Wave 2
task ledger; no code change was required.

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:13:46 +00:00
Jon Chery 9727edf4df test(certpaths): first tests, ≥50% toe-hold (T01.10, REQ-057) 
---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:13:43 +00:00
Jon Chery e45232f395 test(jobspec): coverage uplift to ≥70% + golden HCL fixtures (T01.8, REQ-057) 
---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:12:59 +00:00
Jon Chery 82f3bcacfd test(store): coverage uplift to ≥70% + missing cert_repo_test.go (T01.7, REQ-057) 
---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:12:12 +00:00
Jon Chery 7a834357ec test(proxmox): coverage uplift to ≥70% (T01.5, REQ-057) 
Extend bootstrap_test.go with FullFlow_IdempotentReRun (two
sequential bootstraps on the same fake SSH server — verifies the
idempotent no-op path end-to-end), FullFlow_NoPasswordInLogs
(asserts the SSH password never appears in slog output, D-031),
FullFlow_ValidateSudoersFails (forceSudoersInvalid flag →
wrapped 'validate sudoers' error), FullFlow_CreateLinuxUserFails
(ProxmoxUser=root exercises the /root home branch in deployPubKey),
DefaultSSHDialer_DialContext_ConnectionRefused (covers the real
defaultSSHDialer.DialContext concrete path), and
SSHSessionRunner_CombinedOutput_NewSessionError (closed-client →
'new session' error branch). Add forceSudoersInvalid knob +
funcDialer helper to ssh_session_test.go.

Coverage: 83.2% → 87.1%. go test -race PASS. No production code
changed (T01.1 sessionRunner seam already in place).

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:05:12 +00:00
Jon Chery 40906a0697 test(engine): coverage uplift to ≥70% (T01.4, REQ-057) 
Add registry_test.go (NEW) covering NodeRegistry Join/Leave/Forget/
List/Get (success + not-found + duplicate), NewNodeRegistry nil-
logger, Audit Record success/error (sqlite-backed via openTestDB
pattern) + NewAudit nil-logger. Extend scheduler_test.go with
MemLocalNode/Capacity (happy + nil), JobSpecScore nil/over-capacity/
fits, JobSpecFits nil, PickNode empty. Extend dispatcher_test.go
with Submit error paths: bad spec, explicit target no-registry,
target peer-not-found, peer-pick missing CA, no peer registry, nil
capacity fallthrough, all-peers-fail PickNode.

Coverage: 65.1% → 88.9%. go test -race PASS. No production code
changed; T01.2 peerDispatcher seam NOT needed (error-path tests
via stubbed LocalExecutor + PeerRegistry reached 89% without it;
httptest.NewTLSServer was not required either since dispatchToPeer
CA-missing and PickNode-fail branches cover the remote path).

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:05:09 +00:00
Jon Chery 16e4f8a1f2 test(transport): coverage uplift to ≥70% (T01.3, REQ-057) 
Add retry_test.go (NEW) covering DefaultRetryPolicy, first-attempt
success, idempotent-verb retry, idempotency-key retry, MaxAttempts
exhaustion, zero-MaxAttempts defaulting, transient+non-idempotent+
no-key bail, ctx-cancel mid-backoff, exponential backoff growth +
cap, and contains() substring helper. Extend idempotency_test.go
with Sweep, empty-key Put/Get, and empty-key WithIdempotencyKey.
Extend handshake_log_test.go with LogHandshakeFromCert happy path
(real x509 cert → fingerprint) and FingerprintOfCert round-trip.

Coverage: 84.6% → 93.0%. go test -race PASS. No production code
changed; no new seams (httptest already covered DispatchClient).

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 01:05:03 +00:00
Jon Chery 2786de166d refactor(proxmox): extract sessionRunner seam for testability (T01.1, REQ-057) 
---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
 2026-08-04 00:51:15 +00:00
Jon Chery 97a10353da docs(P00): grill v0.8 plan — PROCEED-WITH-CONDITION (4 binding fixes applied) 
GRILL_v0.8.md (30KB): 9-axis adversarial review, overall verdict
PROCEED-WITH-CONDITION (confidence 0.78). 7 PROCEED + 4
PROCEED-WITH-CONDITION + 0 REPLAN findings.

4 binding plan changes applied to PLAN_v0.8.md:
  #1 T02.6 relabeled as v0.6 ship-defect bugfix (not v0.8 feature);
     P04 audit must record ship-defect closure
  #2 T02.9 doctor proxmox parity — P02 not complete until both
     bootstrap + doctor callbacks use capture-fix wrapper
  #3 T01.6 cli coverage escape valve — ship at 65% if 70% not reached
     after Wave 2 (RESEARCH §1.4 flags 55-65% realistic); do not block
     P02/P03 on the last 5%
  #4 T03.1 verify-reqs regex substring-tolerant (matches v0.2 header
     variant) + reverse-direction assertion (REQUIREMENTS Complete ↔
     ROADMAP COMPLETE); scope note: doc-vs-doc drift only

T02.10 case 7 added (known_hosts pre-populated v0.6→v0.8 migration
path). No escalations; all axes resolved at confidence ≥ 0.60.

---ci---
project: orca
phase: 0
milestone: v0.8
status: grill
---/ci---
v0.7.0 		2026-08-04 00:49:07 +00:00
Jon Chery a288eb93ea docs(P00): create v0.8 phase plans — 4 exec phases + final review 
PLAN_v0.8.md (33KB): 4 execution phases, 37 tasks (36 must-haves),
3-wave ordering per phase, persona-assigned (lead/backend/data),
REQ-057..060 mapped.

P01 coverage round 2 (12 tasks): proxmox sessionRunner seam + 9 pkg
tests, tiered floor ≥70%/≥50% per D-047.
P02 SSH trust (11 tasks): --host-key-fingerprint pre-pin + key-reset +
TOFU capture bugfix + HostKeyFingerprint population.
P03 verify-reqs gate (5 tasks): cmd/verify-reqs Go program + make
target + .coreci.yml hook.
P04 final review + ship + audit (9 tasks).

Zero new direct deps. ROADMAP reconciled to 4-phase structure (P04 =
final review, no separate P05).

---ci---
project: orca
phase: 0
milestone: v0.8
status: plan
---/ci---
 2026-08-04 00:49:07 +00:00
Jon Chery 285ffee863 docs(P00): v0.8 research findings + persona assessment 
RESEARCH_v0.8.md (35KB): per-package coverage strategy for 9 pkgs,
SSH trust research (uncovered latent TOFU capture bug + unpopulated
HostKeyFingerprint field), verify-reqs Go program approach, 4 ADs,
10 pitfalls. PERSONAS.md updated for v0.8 (3-persona roster retained,
connectrpc removed from backend frameworks per AD-014, territory globs
aligned to actual file structure).

Key findings flagged for PLAN:
- proxmox needs sessionRunner seam (~10 LOC) or stalls at ~55%
- cert_repo_test.go missing (v0.7 P01 leftover) blocks store 70%
- TOFU known_hosts capture broken + HostKeyFingerprint never populated
  (bootstrap.go:195-198) — P02 fixes both
- verify-reqs = Go program at cmd/verify-reqs (~80 LOC, stdlib only)

---ci---
project: orca
phase: 0
milestone: v0.8
status: research
---/ci---
 2026-08-04 00:49:07 +00:00
Jon Chery a0b3b7439d docs(P00): clarify v0.8 ambiguities (5 decisions, full autonomy) 
D-043 P02 chore vs feat (chore — trust-surface hardening, no new capability)
D-044 --host-key-fingerprint placement (node join root, validated on --type proxmox)
D-045 fingerprint format (OpenSSH SHA256:base64)
D-046 key-reset scope (local known_hosts only, not remote authorized_keys)
D-047 coverage tiered floor (70% for retested, 50% for zero-test packages)

---ci---
project: orca
phase: 0
milestone: v0.8
status: clarify
---/ci---
 2026-08-04 00:49:05 +00:00
Jon Chery a052bf20f1 docs(init): validate v0.8 specification — coverage & trust hardening 
---ci---
project: orca
phase: 0
milestone: v0.8
status: specify
---/ci---
 2026-08-04 00:49:05 +00:00
Jon Chery 7bb533c2fb docs(milestone): complete hardening-completion 
v0.7 milestone complete. All 4 execution phases + final review shipped.
REQ-053..056 all complete. Tags v0.6.0..v0.6.5 on v0.6.x patch line.
Merged milestone/v0.7-hardening-completion → main.

---ci---
project: orca
phase: 5
milestone: v0.7
status: complete
requirements:
  covered: [REQ-053, REQ-054, REQ-055, REQ-056]
  partial: []
---/ci---
 2026-08-04 00:29:51 +00:00
Jon Chery d7d6961261 fix(P05): final review fixes — PERSONAS.md body, config --addr precedence, migration 0007 dedup 
Audit fix: PERSONAS.md body roster updated for v0.7 (was stale v0.6
content). Review P1-004: daemon --addr now uses cmd.Flags().Changed()
to detect explicit flag, so config listen_addr only applies when --addr
was not explicitly passed (correct flag>env>file>default precedence).
Review P1-001: migration 0007 now dedups existing duplicate serial_hex
rows before creating the UNIQUE index (backward-compat with v0.6 DBs
that accumulated duplicates before the constraint existed).

---ci---
project: orca
phase: 5
milestone: v0.7
status: execute
requirements:
  covered: [REQ-053, REQ-054, REQ-055, REQ-056]
  partial: []
---/ci---
v0.6.5 		2026-08-04 00:28:48 +00:00
Jon Chery afcd15cde4 docs(P04): complete pprof-daemon phase — shipped v0.6.4 
REQ-056 complete. I-308 (deferred since v0.2) implemented. Tag + merge +
Gitea release succeeded.

---ci---
project: orca
phase: 4
milestone: v0.7
status: complete
requirements:
  covered: [REQ-056]
  partial: []
---/ci---
 2026-08-04 00:22:39 +00:00
Jon Chery 0b58286ca2 feat(P04): --pprof opt-in on orca daemon (REQ-056, I-308) 
Separate *http.Server + *http.ServeMux (AD-024), default disabled.
Operator opts in via --pprof <addr>. WARN logged on startup. All pprof
handlers explicitly registered on dedicated mux (no DefaultServeMux
side-effect). I-308 deferred since v0.2 now implemented. 6 new tests.

---ci---
project: orca
phase: 4
milestone: v0.7
status: verify
requirements:
  covered: [REQ-056]
  partial: []
---/ci---
v0.6.4 		2026-08-04 00:22:17 +00:00
Jon Chery f8b135e7a8 docs(P03): complete coverage-uplift phase — shipped v0.6.3 
REQ-055 complete. All 4 target packages ≥ 50% (engine 65.1%, transport
84.6%, proxmox 82.7%, audit 100%). Latent dispatch.go EOF bug fixed.

---ci---
project: orca
phase: 3
milestone: v0.7
status: complete
requirements:
  covered: [REQ-055]
  partial: []
---/ci---
 2026-08-04 00:19:20 +00:00
Jon Chery d9d0beda3b test(P03): coverage uplift — engine/transport/proxmox/audit ≥50% + dispatch.go EOF fix (REQ-055) 
94 new tests across 4 packages. Coverage: engine 8.3%→65.1%, transport
26.3%→84.6%, proxmox 5.1%→82.7%, audit 0%→100%. Bug fix: dispatch.go
bytesReadCloser.Read returned fmt.Errorf("EOF") instead of io.EOF —
broke HTTP request body transmission (latent since v0.2 P02).

---ci---
project: orca
phase: 3
milestone: v0.7
status: verify
requirements:
  covered: [REQ-055]
  partial: []
---/ci---
v0.6.3 		2026-08-04 00:18:58 +00:00
Jon Chery 007d3a12e8 docs(P02): complete config-parser phase — shipped v0.6.2 
REQ-054 complete. Tag + merge + Gitea release succeeded.

---ci---
project: orca
phase: 2
milestone: v0.7
status: complete
requirements:
  covered: [REQ-054]
  partial: []
---/ci---
 2026-08-04 00:09:56 +00:00
Jon Chery cd07e435d9 feat(P02): HCL config file parsing — internal/config package (REQ-054) 
New internal/config package: Config struct (HCL tags), Load(paths...),
MergeOverrides(flags, env) with flag>env>file>default precedence (D-039).
No package-level state (AD-023). --config persistent flag on root command;
daemon uses cfg.ListenAddr when flag at default. 11 config tests + 2 cli tests.

---ci---
project: orca
phase: 2
milestone: v0.7
status: verify
requirements:
  covered: [REQ-054]
  partial: []
---/ci---
v0.6.2 		2026-08-04 00:09:33 +00:00
Jon Chery 27f2abf8fb docs(P01): complete cert-register phase — shipped v0.6.1 
REQ-053 complete. Tag + merge + Gitea release succeeded.

---ci---
project: orca
phase: 1
milestone: v0.7
status: complete
requirements:
  covered: [REQ-053]
  partial: []
---/ci---
 2026-08-04 00:05:45 +00:00
Jon Chery 04d9dccd41 fix(P01): register orca cert command tree + cert_repo tests (REQ-053) 
The `orca cert` command (ca-init, gen, show, renew, fingerprint) was
fully implemented in internal/cli/cert.go but never registered on
rootCmd — unreachable from the CLI. Added init() registration (AD-022).
Added cert_test.go (regression) + cert_smoke_test.go (e2e). Added
cert_repo_test.go (11 tests) + migration 0007 (UNIQUE serial_hex, I-107).

---ci---
project: orca
phase: 1
milestone: v0.7
status: verify
requirements:
  covered: [REQ-053]
  partial: []
---/ci---
v0.6.1 		2026-08-04 00:05:10 +00:00
Jon Chery c100892ad9 docs(P00): complete v0.7 pre-execution phase — shipped v0.6.0 
Tag + merge + Gitea release #399 all succeeded. Phase 0 complete.

---ci---
project: orca
phase: 0
milestone: v0.7
status: complete
---/ci---
 2026-08-03 23:54:37 +00:00