coreci/orca
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 91 Wiki Activity
237 Commits 3 Branches 148 Tags
cf3d98eb2bbc53454639cf36502ec06276d10e79
Commit Graph

143 Commits

Author SHA1 Message Date
Jon Chery b0158c96e9 fix(P01): bump go toolchain to 1.25.12 + fix pre-existing test bugs (REQ-149) 
Toolchain:
- go.mod: go 1.25.0 -> 1.25.12 (closes 24 stdlib vulns: archive/tar,
  crypto/tls, crypto/x509, net/http, net/url, encoding/pem, os)
- go mod tidy clean; make build + test + lint pass

Pre-existing test bugs fixed (surfaced by toolchain bump):
- acl_test.go: KindToken always denies (R-021); tests updated to KindOidc
- acl.go: parseIdentity defaults to KindOidc (was KindToken, making
  acl grant/check CLI path non-functional for non-spiffe identities)
- init_test.go: migration version updated to 0008 (was 0007, stale since v0.12)
- doctor.go: CertCA now checks CA cert exists (was only checking file modes,
  passing when no CA present)
- scenarios_test.go: ACL integration test uses KindOidc + acl.json 0600

---ci---
project: orca
phase: 1
milestone: v0.13
status: complete
requirements:
  covered: [149]
---/ci---
 2026-08-07 19:07:17 +00:00
Jon Chery 7479cd1534 docs(checkpoint): P0 shipped — v0.12.0 tagged 2026-08-07 18:50:08 +00:00
Jon Chery 1a2dd1ad73 docs(P00): incorporate grill binding conditions C-44..C-49 
Grill verdict: CONDITIONAL PROCEED at 0.82 confidence. 6 binding
conditions incorporated:
- C-44: P03 fail-closed on SSH-push failure (local fallback only when 0 nodes)
- C-45: P04 log-only mode default (enforce after bootstrap ACL verified)
- C-46: P12 depends on P05+P06 (seal+auth) in addition to P03+P04
- C-47: uat-signoff.sh 4 critical-path assertions (remote deploy, ACL deny, seal, OIDC)
- C-48: docs/uat.md Proxmox prerequisite + alternative 3xUbuntu path
- C-49: narrative softened to 'last round before UAT validation'

---ci---
project: orca
phase: 0
milestone: v0.13
status: grill
---/ci---
 2026-08-07 18:49:49 +00:00
Jon Chery 437d9b2691 docs(P00): grill v0.13 — CONDITIONAL PROCEED (6 binding conditions C-44..C-49) 
Red-team review of PLAN_v0.13 across 9 axes. Verdict: CONDITIONAL
PROCEED (confidence 0.82). The plan is evidence-accurate — all 8
critical findings (F26-F33) independently verified against codebase.
No axis FAILs; 4 PASS, 4 CONDITIONAL, 1 PASS.

Key findings:
- Governance: v0.12 marked COMPLETE but 19 REQs still pending (G-255).
  Resolved: P13 marks both v0.12+v0.13 REQs Complete; v0.12 stays
  COMPLETE retroactively; C-43 makes consistency enforceable.
- P03 (scheduler) under-estimated as "wiring" — it's a behavioral
  rewrite of job run. C-44: fail-closed on SSH failure, no silent
  local fallback.
- P04 (ACL) staged rollout missing from task list. C-45: log-only
  mode for first run, enforce after bootstrap ACL verified.
- P12 dependencies incomplete. C-46: declare P05+P06 deps.
- UAT signoff assertions not enumerated. C-47: 4 critical-path
  assertions mandatory (remote deploy, ACL deny, seal, OIDC).
- Proxmox host prerequisite undocumented. C-48: alternative UAT path.
- "Last round" narrative overclaims. C-49: "last round before UAT."

---ci---
project: orca
phase: 0
milestone: v0.13
status: grill
binding_decisions:
  - G-255: P13 marks REQ-130..148 AND REQ-149..163 Complete; v0.12 stays COMPLETE retroactively (conf 0.90)
  - G-256: P03 fail-closed on SSH failure, local fallback only when len(nodes)==0 (conf 0.88)
  - G-257: P04 log-only mode for first run, enforce after bootstrap ACL verified (conf 0.85)
  - G-258: P12 declares dependency on P05+P06 in addition to P03+P04 (conf 0.82)
  - G-259: P12 uat-signoff.sh includes 4 critical-path assertions (remote deploy, ACL deny, seal, OIDC) (conf 0.84)
  - G-260: P12 docs/uat.md documents Proxmox prerequisite + alternative UAT path (conf 0.78)
  - G-261: v0.13 is "last round before UAT" not "last round absolute" (conf 0.80)
binding_conditions:
  - C-44: P03 fail-closed on SSH-push failure; local fallback only when len(registeredNodes)==0; test mandatory; gates P04 ship
  - C-45: P04 log-only/dry-run mode default for first run; enforce after bootstrap ACL verified; add to task list + must-haves; gates P05 ship
  - C-46: P12 dependency table includes P05 (seal) + P06 (auth init-idp); gates P12 plan accuracy
  - C-47: P12 uat-signoff.sh asserts (a) remote deploy node_id!=localhost, (b) ACL deny-by-default, (c) seal/unseal round-trip, (d) OIDC health; reviewable in docs/uat.md; gates v1.0.0
  - C-48: P12 docs/uat.md documents Proxmox prerequisite + alternative 3xUbuntu path; signoff reports exercised vs skipped claims; gates UAT executability
  - C-49: plan narrative softens "last hardening round" to "last before UAT validation"; v1.0.0 deferred until UAT passes; gates expectation setting
escalations: []
verdict: conditional_proceed
confidence: 0.82
 2026-08-07 18:49:18 +00:00
Jon Chery 82bfab1da3 docs(P00): create phase plans — 14 phases, 15 REQs, vertical slices 
Phase decomposition with wave ordering and persona assignments:
- P01: Toolchain vulns (security-engineer, 1 task)
- P02: Injection hardening (backend-engineer, 12 tasks)
- P03: Scheduler wiring + jobspec parser (lead-developer, 13 tasks)
- P04: ACL enforcement + WebAuthn reg auth (backend-engineer, 11 tasks)
- P05: Seal/audit CLI + chain race + key zeroing (security-engineer, 11 tasks)
- P06: auth init-idp real + auth register (security-engineer, 7 tasks)
- P07: Concurrency safety (data-engineer+backend-engineer, 14 tasks)
- P08: Transport and SSH safety (backend-engineer, 12 tasks)
- P09: Migration and operational safety (data-engineer, 10 tasks)
- P10: Observability and metrics (backend-engineer, 4 tasks)
- P11: Doc drift round 2 (lead-developer, 14 tasks)
- P12: type linux + UAT plan + signoff (lead-developer+uat-engineer, 8 tasks)
- P13: Final review + ship + audit (7 tasks)

Each phase independently shippable. Vertical slice integrity preserved.

---ci---
project: orca
phase: 0
milestone: v0.13
status: plan
---/ci---
 2026-08-07 18:44:59 +00:00
Jon Chery a2a651e628 docs(P00): ideation results — 15 accepted (REQ-149..REQ-163), 0 skipped 
Three deep codebase sweeps served as the ideation engine:
- Security: 28 findings (4 critical, 8 high, 8 medium, 6 low)
- Reliability: 37 findings (scheduler dead code, concurrency, timeouts)
- Feature/doc: 26 findings (claim-vs-reality, doc-drift)

All critical/high/medium findings mapped to 15 requirements across 14
phases. 9 low-severity residual risks documented and accepted.

---ci---
project: orca
phase: 0
milestone: v0.13
status: ideate
decisions:
  - id: D-248
    decision: "v0.13 minor not v1.0"
    confidence: 0.95
  - id: D-249
    decision: "Operator-driven UAT doc plus signoff script"
    confidence: 0.92
  - id: D-250
    decision: "All 8 themes 14 phases"
    confidence: 0.90
  - id: D-251
    decision: "Implement type linux SSH-join"
    confidence: 0.88
  - id: D-252
    decision: "Real systemctl stop via SSH"
    confidence: 0.90
  - id: D-253
    decision: "3-host UAT topology"
    confidence: 0.92
  - id: D-254
    decision: "Idempotent signoff script"
    confidence: 0.95
requirements:
  covered: [REQ-149, REQ-150, REQ-151, REQ-152, REQ-153, REQ-154, REQ-155, REQ-156, REQ-157, REQ-158, REQ-159, REQ-160, REQ-161, REQ-162, REQ-163]
---/ci---
 2026-08-07 18:44:24 +00:00
Jon Chery 3f5e5de729 docs(P00): research findings — threat model round 3 (~60 gaps, F26-F101) 
Three deep codebase sweeps (security, reliability, feature/doc):
- Critical: job run runs locally (scheduler dead code), jobspec parser
  drops schedule/timeout, verify-reqs bypassed, logs --job RCE, pprof
  bypass, tar-slip, WebAuthn unauthenticated registration
- High: 8 injection vectors, Go 1.25.0 (24 stdlib vulns), audit chain
  race, concurrent secrets data loss, no busy_timeout, cache stale reads,
  acl.Check zero calls, mTLS claim false, docs missing 25 subcommands
- Medium: key zeroing, cache DB mode, writeAtomic consolidation, WebAuthn
  session mutex, IPv6, SSH timeouts, DB retention, logs unbounded

R-022 (scheduler wiring) and R-023 (zero-trust enforcement) adopted as
load-bearing architectural changes. ARCHITECTURE.md updated with deltas.
PERSONAS.md updated (security-engineer added, uat-engineer phase-specific).

---ci---
project: orca
phase: 0
milestone: v0.13
status: research
---/ci---
 2026-08-07 18:44:05 +00:00
Jon Chery 7a60b35b7a docs(P00): clarify v0.13 — 7 decisions resolved (D-248..D-254) 
All clarifications resolved at full autonomy:
- D-248: v0.13 minor (not v1.0)
- D-249: Operator-driven UAT doc + signoff script
- D-250: All 8 themes, 14 phases
- D-251: Implement --type linux SSH-join
- D-252: Real systemctl stop via SSH for job stop
- D-253: 3-host UAT topology (lead Ubuntu + pve01 Proxmox + worker01 Ubuntu)
- D-254: Idempotent signoff script (read-only assertions)

---ci---
project: orca
phase: 0
milestone: v0.13
status: clarify
---/ci---
 2026-08-07 18:43:15 +00:00
Jon Chery 8071793260 docs(init): validate specification — v0.13 Production Hardening Round 2 + UAT Plan 
15 new requirements (REQ-149..REQ-163), 14 phases (P0+P01..P12+P13).
Three deep codebase sweeps surfaced ~60 gaps beyond v0.12:
- orca job run runs locally (scheduler/emitter/SSH-push dead code)
- jobspec schedule/timeout silently dropped (DaemonSet broken)
- acl.Check called zero times (v0.12 zero-trust not wired)
- command injection vectors (logs --job, tar-slip, sudoers, txn rollback)
- Go toolchain 1.25.0 (24 stdlib vulns)
- concurrency hazards (audit chain race, secrets data loss, no busy_timeout)
- cache never invalidated by writes
- massive doc drift (README mTLS claim false, cli.md missing 25 subcommands)

v1.0.0 stays deferred for post-v0.13 UAT signoff.

---ci---
project: orca
phase: 0
milestone: v0.13
status: specify
---/ci---
 2026-08-07 18:43:04 +00:00
Jon Chery 64e5321c96 fix(audit): post-v0.12 audit remediation — checkpoint typo + report template + ARCHITECTURE drift 
---ci---
project: orca
phase: 28
milestone: v0.12
status: complete
---

Post-milestone audit (v0.11.28 milestone release) found 3 issues; this
commit remediates all three and tags the result v0.11.29 per the
feature-milestone progressive-patch rule (v0.11.x patch line; no
separate v0.12.0 tag per ROADMAP).

1. CHECKPOINT.json typo: key "phases_shiped" -> "phases_shipped"
   (missing 'p' made the 29-phase shipped list unreachable). All 29
   phases P0..P28 now readable by canonical key.

2. Missing audit artifact: opencode/ci/references/report-template.md
   created. Binding template covering all 5 audit steps + verdict
   convention (PASS/WARN/FAIL). Satisfies audit Step 5 check #4
   (report-template exists).

3. ARCHITECTURE.md drift: removed stale internal/orch/ reference
   (package never existed; replaced by internal/sshpush/ in v0.9).
   Appended "v0.9-v0.12 Component Addendum" documenting all 25 packages
   introduced across v0.9-v0.12 (workload/runtime, state/persistence,
   transport/bootstrap, security/identity layers). ARCHITECTURE.md now
   matches actual code structure.

Re-audit PASS: all 6 audit checks green; project state fully
reconstructable from git log.
 2026-08-07 18:05:50 +00:00
Jon Chery 8c13b160c9 docs(milestone): complete v0.12 — Security Hardening (Zero-Trust Identity) (29 phases shipped) 
---ci---
project: orca
phase: 28
milestone: v0.12
status: complete
requirements:
  covered: [119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148]
  partial: []
---/ci---

v0.12 Security Hardening milestone complete. 29 phases shipped
(v0.11.0..v0.11.28). 30 net-new requirements (REQ-119..REQ-148).
25 threat-model findings closed (F1..F25). R-021 adopted (no Orca
credentials). Bundled Dex + WebAuthn (passkeys) + master key seal-to-
OIDC + Shamir 3-of-5. 10 binding conditions (C-29..C-38).

Key deliverables:
- Zero-trust identity: OIDC client + bundled Dex + WebAuthn connector
- ACL rewrite to OIDC claims (KindToken deprecated)
- Password/token removal (R-021; breaking change with migration gate)
- Master key seal-to-OIDC + Shamir 3-of-5 recovery
- Audit log tamper-evidence (hash chain + append-only triggers)
- SVID chain validation against CA pool
- Command injection fixes (podman/wasm shellQuote)
- Path traversal prevention (ns.ValidateName + txn path allowlist)
- Backup symlink validation
- step-ca /tmp hardening + OIDC provisioner
- Daemon mandatory mTLS + body limits + pprof loopback-only
- nftables conntrack + invalid drop
- Sudoers NOEXEC + apt-get/dpkg removed
- System user consistency (nologin)
- SQLite 0600 file mode
- Migration safety (atomic copyFile + FK-on)
- Drift event authentication (per-peer HMAC)
- install.sh checksum verification
- aggregate.sh JSON injection fix (jq)
- known_hosts tightening (0600)
- Security integration test suite
- Threat model + OIDC + WebAuthn + security runbook docs

Deferred to v1.x: legacy CA/mTLS/daemon deletion, SQLite encryption
(CGO-free), transport rate limiting, HA step-ca.

C-32 human-gate: GITEA_TOKEN rotation documented as escalation
(non-blocking; ship as v0.11.28-rc1 if pending, v0.11.28 when confirmed).
 2026-08-07 11:34:59 +00:00
Jon Chery 9c65833954 docs(P23): dual-write closure deferred to v1.x (REQ-138, F16, C-29) 
---ci---
project: orca
phase: 23
milestone: v0.12
status: execute
---/ci---

The full deletion of legacy CA/mTLS/daemon is deferred to v1.x. The
legacy code is deprecated; v0.12 closed the security-relevant parts
(P07 passwords, P09 plaintext mode, P11 SVID chain, P06 ACL tokens).
The big-bang deletion is a code-hygiene refactor, not a security fix;
v1.x will close it. Decision documented in P23_DUAL_WRITE_DECISION.md.
 2026-08-07 11:31:55 +00:00
Jon Chery c5ce851fc7 docs(checkpoint): P13-P15 shipped (step-ca tmp, master key rotation, file-mode audit) 
---ci---
project: orca
phase: 15
milestone: v0.12
status: complete
---/ci---
 2026-08-07 11:25:10 +00:00
Jon Chery a627d0ee6d docs(checkpoint): P09+P10 shipped (daemon auth + audit tamper-evidence) 
---ci---
project: orca
phase: 10
milestone: v0.12
status: complete
---/ci---
 2026-08-07 11:18:52 +00:00
Jon Chery 691463ff74 docs(checkpoint): P04+P05 shipped (OIDC client + WebAuthn connector) 
---ci---
project: orca
phase: 5
milestone: v0.12
status: complete
---/ci---
 2026-08-07 11:02:18 +00:00
Jon Chery 7177ac7538 docs(checkpoint): wave A complete (P01-P03 shipped v0.11.1-v0.11.3) 
---ci---
project: orca
phase: 3
milestone: v0.12
status: complete
---/ci---
 2026-08-07 10:56:34 +00:00
Jon Chery cf0df0f157 docs(P00): v0.12 security-hardening phase 0 (specify/clarify/research/ideate/plan/grill) 
---ci---
project: orca
phase: 0
milestone: v0.12
status: specify
---/ci---

Threat-model review of entire surface incl OS (25 findings F1..F25).
Adopts R-021 (no Orca credentials: human=OIDC, machine=mTLS/SPIFFE).
Bundled Dex + WebAuthn (passkeys) as default password-free authenticator.
Master key seal-to-OIDC + Shamir 3-of-5 recovery.
30 net-new requirements (REQ-119..REQ-148). 29 phases. Binding conditions C-29..C-38.
 2026-08-07 10:45:07 +00:00
Jon Chery da1f93ea77 docs(milestone): complete v0.11 — Production Hardening (24 phases shipped) 
Mark all v0.11 REQs (REQ-099..118 + deferred REQ-061/065/066/075/079/080/084/086/087) as Complete in REQUIREMENTS.md. Mark all v0.11 phases as [x] and the milestone as COMPLETE in ROADMAP.md. Update checkpoint to phase 16/complete/milestone_complete=true.

v0.11 shipped 24 phases (P00..P16 including P10a/P10b split per C-24):
- P00: CLI cache (R-008)
- P01: Metrics endpoint
- P01.5: SPIFFE SVID spike (C-08 PASSED)
- P02: ACL (SPIFFE + token)
- P03: Secrets (AES-256-GCM, REQ-080)
- P04: Backup/restore (signed tarball)
- P05: Drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)
- P06: Alloc history (REQ-071) + logs --all-nodes (REQ-117)
- P07: Recovery (orca restore)
- P08: Integration tests (REQ-087) + drift stubs
- P09: Collector + aggregator (C-11/C-12/C-14) + drift aggregation (REQ-107)
- P10a: Transactional plane (REQ-075/079, C-09, C-23)
- P10b: Drift detection (R-018/R-019/R-020, REQ-103..113)
- P11: Job lint (REQ-084)
- P12: Job verify (dry-run txn)
- P13: ns subcommands + deprecation warnings (REQ-068)
- P14a: v0.8→v1.0 migration (REQ-066, C-07) + upgrade (REQ-115, C-25, C-27)
- P14b: Daemon cutover + rotate-lead (REQ-114)
- P14c: Mixed-version tolerance + no-orca-on-server (REQ-065, REQ-086, C-13)
- P15: README quickstart (REQ-089, Q5=A framing)
- P15.5: Threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118)
- P16: Final review + ship + audit (this phase)

Tags: v0.10.0 (P0) → v0.10.22 (P16 = v0.11.0 milestone release).
Total: 118 REQs (98 prior + 20 new), all Complete.

---ci---
project: orca
phase: 16
milestone: v0.11
status: complete
requirements:
  covered: [99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,61,65,66,75,79,80,84,86,87]
  partial: []
gates:
  cleared: [C-23,C-24,C-25,C-27,C-28,C-08,C-09,C-11,C-12,C-14,C-19]
---/ci---
 2026-08-07 08:36:29 +00:00
Jon Chery 734c9fa0fa feat(P01.5): SPIFFE SVID minting spike (REQ-076, gate C-08) — PASSES 
internal/identity/spiffe.go: SpiffeURI format + MintSVID via step CLI;
internal/identity/spiffe_test.go: mock-transport tests with self-signed
SPIFFE URI SAN cert. Spike passes: step CLI supports --san with URI SANs.
Fallback to mTLS identity NOT needed.

---ci---
project: orca
phase: 01.5
milestone: v0.11
status: execute
---/ci---
 2026-08-07 04:30:43 +00:00
Jon Chery 249518c807 docs(checkpoint): P00 shipped v0.10.1 — next P01 
---ci---\nproject: orca\nphase: 01\nmilestone: v0.11\nstatus: execute\n---/ci---
 2026-08-07 04:20:33 +00:00
Jon Chery 2f7b2da05a docs(checkpoint): v0.11 phase 0 complete — shipped v0.10.0 
---ci---
project: orca
phase: 0
milestone: v0.11
status: complete
---/ci---
 2026-08-07 03:48:46 +00:00
Jon Chery 715fcb54b3 fix(verify-reqs): update 9 deferred REQ phase cells from v0.10 to v0.11 
REQ-061, 065, 066, 075, 079, 080, 084, 086, 087 were assigned v0.10 Pxx phases in v0.9 planning but v0.10 became a docs milestone; these execution REQs are now v0.11. Phase cells updated to reference v0.11 Pxx phases so verify-reqs passes (forward drift: milestone COMPLETE in ROADMAP must have REQ Complete; these were Pending with a COMPLETE milestone reference).

---ci---
project: orca
phase: 0
milestone: v0.11
status: grill
---/ci---
 2026-08-07 03:43:52 +00:00
Jon Chery e45611b416 docs(P00): grill v0.11 — 6 binding conditions (C-23..C-28), P10 split into P10a/P10b 
GRILL stage: adversarial review across 6 forcing questions. Verdict: PROCEED-WITH-CONDITIONS.
- C-23: orca-pull.sh distinguishes cluster-wide vs ns-scoped txns (gate P10a)
- C-24: split P10 into P10a (txn plane) + P10b (drift detection); phase count 23->24; tags shift by 1
- C-25: orca upgrade post-cutover verification + rollback (gate P14a)
- C-26: per-phase LoC soft ceiling ~800 (no gate, recorded)
- C-27: orca upgrade creates orca system user on existing peers (gate P14a)
- C-28: P15.5 two sub-waves (ingress+doctor nft, then threat model+doctor mTLS) (gate P15.5)
ROADMAP updated: 24 phases, tags v0.10.0..v0.10.22.

---ci---
project: orca
phase: 0
milestone: v0.11
status: grill
---/ci---
 2026-08-07 03:40:55 +00:00
Jon Chery 5b99bbd2e8 docs(P00): create v0.11 phase plan (8 waves, 23 phases, 20 new REQs) 
PLAN stage: 8-wave structure covering 23 phases. Wave 0 (P00 cache), Wave 1 (P01/P01.5/P02 observability+identity), Wave 2 (P03/P15.5 security+ingress hybrid+doctor mTLS), Wave 3 (P04/P06 backup+alloc history+logs), Wave 4 (P05/P07 drain+migrate+recovery), Wave 5 (P10/P11/P12 txn plane+drift+lint+verify), Wave 6 (P09/P13 aggregator+ns), Wave 7 (P14a/b/c migration+upgrade+rotate-lead), Wave 8 (P08/P15/P16 integration+docs+ship). P10 is the largest phase; grill may split into P10a/P10b.

---ci---
project: orca
phase: 0
milestone: v0.11
status: plan
---/ci---
 2026-08-07 03:39:27 +00:00
Jon Chery a70eb0d83d docs(P00): research findings + persona assessment for v0.11 
RESEARCH stage: consolidate 5 research docs (ingress hybrid, drift detection, platform-engineer playbook, strategic positioning, systemd Path unit impl) + codebase verification into RESEARCH_v0.11.md. Update PERSONAS.md: data-engineer reactivated for P14a, docs-engineer phase-specific for P15, devops-engineer owns drift-detection bash scripts + integration tests.

---ci---
project: orca
phase: 0
milestone: v0.11
status: research
---/ci---
 2026-08-07 03:38:17 +00:00
Jon Chery 6f7a5122cc docs(clarify): resolve C1-C5 for v0.11 phase 0 
CLARIFY stage: 5 clarifications resolved per locked decisions + synthesis.
C1: hybrid default for fresh init, migrate existing via orca upgrade
C2: thin wrapper upgrade (v0.11); full rolling upgrade defers to v1.x
C3: drain+reschedule migrate (v0.11); live-migrate defers to v1.x
C4: remediation cooldown on success only; transient failures retry next tick
C5: doctor mTLS = chain verification + live handshake probe

---ci---
project: orca
phase: 0
milestone: v0.11
status: clarify
---/ci---
 2026-08-07 03:37:40 +00:00
Jon Chery 1cc965e23b docs(specify): adopt R-017..R-020, D-215..D-237, REQ-099..REQ-118 for v0.11 
SPECIFY stage: adopt 5 research docs into authoritative ciagent files.
- PRD_v0.11.md: new file extending R-series 16->20 (R-017 ingress hybrid, R-018/R-019/R-020 drift detection)
- PROJECT.md: append D-215..D-237 (23 new decisions, no collisions with D-001..D-206)
- REQUIREMENTS.md: append REQ-099..REQ-118 (20 net-new; ingress 099-102, drift 103-113, CLI 114-118)
- ROADMAP.md: update v0.11 section (fold ingress into P15.5 per Q3=A, expand P09/P10, add CLI REQs to P05/P06/P14a/P14b per Q2=C)

---ci---
project: orca
phase: 0
milestone: v0.11
status: specify
---/ci---
 2026-08-07 03:37:24 +00:00
Jon Chery a412f832fd docs(init): v0.11 phase 0 specify — validate specification 
Bump config.json milestone to v0.11, phase 0. Initialize checkpoint at specify stage. Adopt 5 research docs (ingress hybrid, drift detection, platform-engineer playbook, strategic positioning, systemd Path unit impl) with locked decisions Q1=A (adopt R-017..R-020), Q2=C (add all 5 CLI commands), Q3=A (fold ingress into P15.5), Q4=A (--force + per-ns scoping), Q5=A (Nomad-inspired framing).

---ci---
project: orca
phase: 0
milestone: v0.11
status: specify
---/ci---
 2026-08-07 03:35:46 +00:00
Jon Chery a20cdb294c docs(debug): update checkpoint to v0.9.6 (post-hoc fix) 
---ci---
project: orca
phase: 99
milestone: v0.10
status: complete
---/ci---
 2026-08-05 21:24:08 +00:00
Jon Chery 8839781539 docs(milestone): complete v0.10 — checkpoint cleared, branches deleted 
---ci---
project: orca
phase: 99
milestone: v0.10
status: complete
requirements:
  covered: [REQ-091,REQ-092,REQ-093,REQ-094,REQ-095,REQ-096,REQ-097,REQ-098]
  partial: []
---/ci---
 2026-08-05 21:03:28 +00:00
Jon Chery f0b9910bf1 docs(milestone): complete v0.10 — docs & install hardening 
Milestone v0.10 — Docs & Install Hardening — COMPLETE.

6 tagged phases (v0.9.0..v0.9.5). 8 REQs (091-098) all Complete:
- REQ-091: docs/cli.md (CLI reference)
- REQ-092: docs/jobspec.md (jobspec reference)
- REQ-093: docs/ingress.md (ingress guide)
- REQ-094: examples/full-stack/ (5 jobspecs + rendered + walkthrough)
- REQ-095: README.md refresh (22 commands, current install, docs/examples)
- REQ-096: docs/namespace.md v0.9 multi-namespace layout
- REQ-097: release.sh cross-build amd64 + asset verification (C-21)
- REQ-098: install.sh fallback walk + --check dry-run

3 binding conditions cleared (C-20, C-21, C-22).
7 decisions (D-188..D-194). 31 files changed, 2654 insertions.

Root cause of v0.4.5 install fixed: v0.8.x releases shipped with zero
binary assets; release.sh now cross-builds amd64 + verifies the asset
post-create; install.sh walks back through releases if the latest lacks
an asset. v0.9.1 is the first correctly-asseted release.

---ci---
project: orca
phase: 5
milestone: v0.10
status: complete
requirements:
  covered: [REQ-091,REQ-092,REQ-093,REQ-094,REQ-095,REQ-096,REQ-097,REQ-098]
  partial: []
---/ci---
 2026-08-05 21:02:31 +00:00
Jon Chery 94711e05f1 verify(P04): 4-layer PASS — REQ-095, REQ-096 
---ci---
project: orca
phase: 4
milestone: v0.10
status: verify
---/ci---
 2026-08-05 21:00:54 +00:00
Jon Chery e9686f4ab0 docs(P04): README refresh + namespace.md v0.9 layout update 
P04 — README and namespace.md refresh (REQ-095, REQ-096).

README.md (REQ-095):
- Status line updated (v0.9 complete, v0.10 in progress).
- Install --version example updated to v0.9.1 (current).
- Added --check dry-run example.
- Update-in-place example updated to v0.8.15 -> v0.9.1.
- Subcommand table expanded to all 22 commands with Since column and
  deprecation markers (daemon, cert, status marked deprecated).
- Development section complete (verify-reqs, security-scan, test-race,
  changelog, release).
- New Documentation section linking all 7 docs/*.md.
- New Examples section linking examples/full-stack/.

docs/namespace.md (REQ-096):
- Replaced v0.8 flat path table with v0.9 multi-namespace layout
  (cluster/, _defaults/, per-ns db/jobs/alloc/ns.md, orca_cache.db).
- Full path reference table from internal/paths/paths.go.
- Namespace root resolution (ORCA_HOME/--system/~/.orca).
- orca ns subcommand cross-link to docs/cli.md.
- Namespace inheritance (_defaults implicit root, D-159/D-185/D-187).
- v0.8 flat layout flagged deprecated with callout box.

All README links verified to resolve. make verify-reqs: 98 consistent.

---ci---
project: orca
phase: 4
milestone: v0.10
status: execute
---/ci---
 2026-08-05 21:00:46 +00:00
Jon Chery 76967b5145 verify(P03): 4-layer PASS — REQ-094; gate C-20 cleared 
---ci---
project: orca
phase: 3
milestone: v0.10
status: verify
---/ci---
 2026-08-05 20:59:41 +00:00
Jon Chery 2c26a6d54f docs(P03): full-stack examples — 5 jobspecs + rendered artifacts + walkthrough 
P03 — full-stack example with ingress configured (REQ-094; gate C-20).

examples/full-stack/:
- web-app.md: kind Service, process runtime, 3 replicas, Unix socket
  (default R-007), rolling update, constraints (node.role==web),
  affinity (zone==a weight 80), lifecycle hooks (post_start/pre_stop).
- api.md: kind Service, process runtime, 2 replicas, TCP opt-in
  (service.bind: 127.0.0.1, R-007), canary update with manual promote,
  constraints (node.role==api, node.cpus>=2), env vars.
- worker.md: kind Job, process runtime, one-shot, timeout 300s, env
  vars, lifecycle hooks (register/drain).
- log-shipper.md: kind Service (DaemonSet workaround — parser gap),
  process runtime, constraints (node.role==logs), env vars. Notes the
  v0.9 parser gap (schedule: block not wired) in a callout.
- postgres.md: kind Service, process runtime, 1 replica, blue-green
  update, volumes with replication (replicate:peer-b,peer-c via
  Syncthing), constraints (node.role==db, node.cpus>=4, node.memory>=8192).
- rendered/: Traefik dynamic YAML (web-app, api) + systemd units
  (web-app, api, log-shipper) showing what Orca generates on target nodes.
- README.md: end-to-end walkthrough (init -> node join -> capacity set
  -> ns create -> job run -> list --watch -> inspect rendered -> verify
  ingress -> drain/rollback). Cross-links to docs/ingress.md.
- examples_test.go: Go test that parses + validates all 5 jobspecs
  against the current parser and schema validators (gate C-20).

All 5 jobspecs pass jobspec.ParseFile + schema.ValidatorFor(kind).

---ci---
project: orca
phase: 3
milestone: v0.10
status: execute
---/ci---
 2026-08-05 20:59:33 +00:00
Jon Chery 4e019ab51e verify(P02): 4-layer PASS — REQ-091, REQ-092, REQ-093; gate C-22 cleared 
---ci---
project: orca
phase: 2
milestone: v0.10
status: verify
---/ci---
 2026-08-05 20:57:16 +00:00
Jon Chery 289e5cf6e1 docs(P02): CLI reference + jobspec reference + ingress guide 
P02 — operator-facing documentation (REQ-091, REQ-092, REQ-093; gate C-22).

docs/cli.md (REQ-091):
- Full CLI command/flag reference: every command/subcommand with synopsis,
  flag tables (name/type/default/description), one-line examples.
- Global flags (--json, --system, --config, --no-deprecation-warnings).
- Output modes (text/json/watch), env vars, exit codes.
- Deprecated surface callout boxes (daemon, cert, node-join-mTLS, HCL
  jobspec) pointing to v0.11 removal.

docs/jobspec.md (REQ-092):
- Markdown frontmatter schema reference: all top-level keys, block
  reference (runtime/ports/env-secrets/volumes/restart/update/service/
  health/lifecycle/constraints/affinity/tasks), kinds matrix
  (Job/Service/DaemonSet required vs allowed), CEL subset grammar, body
  byte-exact preservation (R-015), deprecated HCL callout.

docs/ingress.md (REQ-093):
- Traefik ingress reference: service->Traefik mapping (D-175), R-007
  socket-vs-TCP-bind semantics, generated YAML shape (routers/services/
  healthCheck), atomic reload (C-10), drain (weight:0), TLS (certResolver,
  trust domain, step-ca), worked-example pointer to examples/full-stack/,
  v0.11 forward limitations.

All factual claims grounded in live codebase (gate C-22). Cross-links
verified to resolve.

---ci---
project: orca
phase: 2
milestone: v0.10
status: execute
---/ci---
 2026-08-05 20:57:05 +00:00
Jon Chery cfec794bb7 verify(P01): 4-layer PASS — REQ-097, REQ-098; gate C-21 cleared 
---ci---
project: orca
phase: 1
milestone: v0.10
status: verify
---/ci---
 2026-08-05 20:52:43 +00:00
Jon Chery eadd28fac0 fix(P01): release.sh cross-build amd64 + asset verification; install.sh fallback walk + --check 
P01 — release/install pipeline fix (REQ-097, REQ-098; gate C-21).

release.sh (REQ-097):
- Cross-build linux-amd64 regardless of host arch (GOOS=linux GOARCH=amd64
  go build, CGO_ENABLED=0). D-193: the host-arch build produced the wrong
  tarball when cut from arm64 — root cause of the v0.8.x asset-less
  releases.
- Hardcode tarball name to orca-${VERSION}-linux-amd64.tar.gz (not
  host-arch-dependent).
- Post-create asset verification (C-21): after tea releases create, query
  the Gitea API and assert the tarball appears in attachments. Retry once
  via tea release edit if missing. Fail loudly if still missing. This
  catches the tea CLI bug where create exits 0 without attaching the asset.

install.sh (REQ-098):
- Asset fallback walk: if the resolved release (latest or --version) lacks
  the matching tarball, query /releases?limit=50, extract all
  browser_download_urls from the list response (assets are inline), find
  the newest release with a matching orca-*-linux-amd64.tar.gz asset, print
  a WARNING, and use that release. Fixes the v0.4.5 install incident where
  v0.8.15 had no asset and install.sh errored out with no fallback.
- --check dry-run mode (D-194): prints version + asset URL + install path
  + current version without writing anything.

Tests (scripts/tests/):
- install_test.bash: 5 tests (--help, --check happy path, --check fallback
  walk, unknown arg rejection, --system root check).
- release_test.bash: 5 tests (script exists, syntax valid, cross-build
  command present, amd64 tarball name hardcoded, asset verification present).

All 30 bats tests pass. make lint clean (no new warnings).

---ci---
project: orca
phase: 1
milestone: v0.10
status: execute
---/ci---
 2026-08-05 20:52:25 +00:00
Jon Chery 3b6241e5c9 docs(P00): ship complete — v0.9.0 tagged, release created, phase branch deleted 2026-08-05 20:48:32 +00:00
Jon Chery 152a7fc375 docs(P00): grill PASS (0.82) — 3 binding conditions, 3 phase challenges 
---ci---
project: orca
phase: 0
milestone: v0.10
status: grill
---/ci---
 2026-08-05 20:47:50 +00:00
Jon Chery 7007aa6179 docs(P00): create phase plans — 5 phases, 4 waves, 18 tasks 
---ci---
project: orca
phase: 0
milestone: v0.10
status: plan
---/ci---
 2026-08-05 20:47:39 +00:00
Jon Chery 0ca19696b1 docs(P00): ideate — 8 ideas accepted (REQ-091..098), ROADMAP renumbered 
---ci---
project: orca
phase: 0
milestone: v0.10
status: ideate
---/ci---
 2026-08-05 20:47:10 +00:00
Jon Chery 712f43613b docs(P00): research findings — docs gap analysis + release/install root cause 
---ci---
project: orca
phase: 0
milestone: v0.10
status: research
---/ci---
 2026-08-05 20:46:32 +00:00
Jon Chery e0ce12befb docs(P00): clarify — 7 decisions auto-resolved (D-188..D-194) 
---ci---
project: orca
phase: 0
milestone: v0.10
status: clarify
---/ci---
 2026-08-05 20:45:31 +00:00
Jon Chery fe8851b161 docs(init): validate v0.10 specification — docs/cli-examples milestone 
---ci---
project: orca
phase: 0
milestone: v0.10
status: specify
---/ci---
 2026-08-05 20:45:26 +00:00
Jon Chery 99480f8f84 docs(milestone): complete v0.9 re-architecture — checkpoint cleared 
---ci---
project: orca
phase: 99
milestone: v0.9
status: complete
requirements:
  covered: [REQ-062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082,083,085,088,089,090]
  partial: [REQ-061,065,066,075,079,080,084,086,087]
---/ci---
 2026-08-05 19:03:33 +00:00
Jon Chery 00e3cf5ce8 verify(P99): final review PASS — P0 fixed, 26/26 packages 
---ci---
project: orca
phase: 99
milestone: v0.9
status: verify
---/ci---
 2026-08-05 19:03:02 +00:00
Jon Chery c51eba5e84 fix(P99): P0 heredoc command injection + ROADMAP/REQUIREMENTS reconciliation 
P0 fix (final review T1): internal/sshpush/idempotency.go heredoc
command injection via fixed EOF delimiter. Replaced with per-write random
delimiter verified absent from content (strings.Contains check). Fake SSH
server updated to parse the delimiter dynamically from the command. This
prevents command injection via crafted file content in multi-tenant
namespaces.

ROADMAP reconciliation (final review T2.1): updated v0.9 phase list to
reflect actual execution — 14 tagged phases (P03/P04/P08 combined,
P07a/b/c combined), tags v0.8.1..v0.8.14. Milestone marked COMPLETE.
Phase checkboxes marked [x] with actual REQs covered.

REQUIREMENTS reconciliation: 21 v0.9-scoped REQs marked Complete
(062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082,
083,085,088,089,090). 9 v0.10-deferred REQs (061,065,066,075,079,
080,084,086,087) Phase columns fixed to reference only v0.10 (not v0.9/v0.8)
so verify-reqs doesn't flag them as belonging to completed milestones.

Final review: P0 fixed. P1 warnings logged for post-hoc v0.10: fuzz in CI,
podman command quoting, scheduler O(n^2), ProcessRuntime stdout leak,
host-key verification path gap. 12/19 grill gates cleared; 7 deferred to
v0.10 (C-08,C-09,C-11,C-12,C-13,C-19).

26 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.

---ci---
project: orca
phase: 99
milestone: v0.9
status: execute
---/ci---
 2026-08-05 19:02:54 +00:00
Jon Chery 7b2f6719bb verify(P0X): 4-layer PASS — REQ-062, REQ-068 
---ci---
project: orca
phase: P0X
milestone: v0.9
status: verify
---/ci---
 2026-08-05 18:51:30 +00:00