 Jon Chery
|
bed5a2e8e5
|
docs(P00): create 4 v0.2 phase plans
v0.2 PLAN stage. Translates the IDEATE output (commit 1ee82fc) into 4
executable, vertical-slice phase plans with wave ordering, REQ
coverage, must-haves, and per-layer verification. The v0.1 section
above is preserved unchanged.
Plan structure mirrors v0.1 (per the v0.1 spec at lines 7-166):
- Phase heading with **Branch** + **REQ Coverage** lines
- ### Must-Haves checkbox list (atomic, file-anchored)
- ### Verification block (build / behavior / smoke)
- End-of-section ## Wave Ordering + ## Versioning
Phase numbering: v0.2 phases are numbered 8-11 (not 1-4) to avoid
colliding with v0.1's phase/01..07 branches. v0.1 already shipped
6 phases plus a P07 backfill; the v0.2 work is therefore the 8th
project phase overall.
Phase 8: mTLS handshake + internal CA with CSR join (Wave 1, branch
phase/08-mtls, REQs: 011, 023, 025, 026, 032, 033, 034, 035, 036,
038). 19 must-haves spanning internal/security (CA, CSR, fingerprint,
TLS config, rotation, redaction), internal/store (certs migration
0004 + cert_repo), internal/daemon (mTLS server bootstrap with
GetCertificate hot-swap), internal/transport (mTLS client + SAN
validation + handshake failure logging), internal/audit,
internal/cli (cert, node_join, doctor), config surface for trusted
CA fingerprint pinning. 11 verification points including a
two-node mTLS handshake integration test.
Phase 9: Multi-node scheduling & job dispatch (Wave 1, branch
phase/09-scheduling, REQs: 004 expansion, 017, 021, 028, 037). 15
must-haves covering internal/transport (dispatch h2c service,
idempotency, retry), internal/engine (dispatcher, scheduler
bin-pack extension, peer registry), internal/store (migration 0005
node_capacity + capacity_repo), HCL schema for NodeCapacity,
internal/cli (node capacity, job run --target), and the daemon
dispatch handler. 9 verification points including a two-node
dispatch integration test, cancellation with goleak, idempotency
dedupe, and deterministic bin-pack scoring.
Phase 10: gosec + govulncheck + gitleaks in CI (Wave 2, branch
phase/10-security-scan, REQs: 014, 027, 029, 031, 039, 040). 12
must-haves centered on .coreci.yml pipeline additions,
scripts/security_scan.sh wrapper, gosec.json baseline, offline
govulncheck (GOFLAGS=-mod=mod + GOVULNDB=offline per ROADMAP.md
P03 scope change), .gitleaks.toml stopwords (REQ-039), gitleaks
baseline (REQ-029), .golangci.yml (REQ-040), pre-commit gitleaks
hook, Makefile test-race and security-scan targets, and
docs/security-scanning.md. 7 verification points including a
network-namespace test that proves govulncheck runs offline.
Phase 11: iter.Seq streaming job/node lists (Wave 2, branch
phase/11-iter-seq, REQs: 022, 030, 032 expansion). 8 must-haves
for internal/store/iter.go (Watch(ctx, query) iter.Seq[T] with
500ms poll + notify hook), internal/cli job_list/node_list --watch
and --watch --json modes, signal.NotifyContext cancellation
wiring, internal/doctor expansion for jobs/nodes/certs streaming
output, plus unit and integration tests. 8 verification points
including NDJSON validation via jq -c and goroutine leak assertion
via goleak.
Wave ordering: P01 and P02 are Wave 1 (sequential because
parallelization.enabled=false; P01 is a hard prerequisite for P02
since dispatch endpoints are mTLS-protected). P03 and P04 are
Wave 2 (sequential; either order is viable but P03 first keeps the
security baseline in place while P04 lands the new CLI surface).
Versioning: per-phase tags v0.2.1 (P01), v0.2.2 (P02), v0.2.3
(P03), v0.2.4 (P04); milestone tag v0.3.0 (next minor per run.md
feature-milestone promotion). Per RELEASE_POLICY.md, every per-
phase tag also produces a Gitea release with tarball asset.
No changes to PROJECT.md, REQUIREMENTS.md, ROADMAP.md,
ARCHITECTURE.md, PERSONAS.md, IDEATION.md, or config.json — this
is a docs-only commit per the PLAN stage contract. No Go code
changes.
---ci---
project: orca
phase: 0
milestone: v0.2
status: plan
---/ci---
|
2026-06-03 21:09:15 +00:00 |
|
cloudinit-bot