Commit Graph

80 Commits

Author SHA1 Message Date
Jon Chery cfec794bb7 verify(P01): 4-layer PASS — REQ-097, REQ-098; gate C-21 cleared
---ci---
project: orca
phase: 1
milestone: v0.10
status: verify
---/ci---
2026-08-05 20:52:43 +00:00
Jon Chery eadd28fac0 fix(P01): release.sh cross-build amd64 + asset verification; install.sh fallback walk + --check
P01 — release/install pipeline fix (REQ-097, REQ-098; gate C-21).

release.sh (REQ-097):
- Cross-build linux-amd64 regardless of host arch (GOOS=linux GOARCH=amd64
  go build, CGO_ENABLED=0). D-193: the host-arch build produced the wrong
  tarball when cut from arm64 — root cause of the v0.8.x asset-less
  releases.
- Hardcode tarball name to orca-${VERSION}-linux-amd64.tar.gz (not
  host-arch-dependent).
- Post-create asset verification (C-21): after tea releases create, query
  the Gitea API and assert the tarball appears in attachments. Retry once
  via tea release edit if missing. Fail loudly if still missing. This
  catches the tea CLI bug where create exits 0 without attaching the asset.

install.sh (REQ-098):
- Asset fallback walk: if the resolved release (latest or --version) lacks
  the matching tarball, query /releases?limit=50, extract all
  browser_download_urls from the list response (assets are inline), find
  the newest release with a matching orca-*-linux-amd64.tar.gz asset, print
  a WARNING, and use that release. Fixes the v0.4.5 install incident where
  v0.8.15 had no asset and install.sh errored out with no fallback.
- --check dry-run mode (D-194): prints version + asset URL + install path
  + current version without writing anything.

Tests (scripts/tests/):
- install_test.bash: 5 tests (--help, --check happy path, --check fallback
  walk, unknown arg rejection, --system root check).
- release_test.bash: 5 tests (script exists, syntax valid, cross-build
  command present, amd64 tarball name hardcoded, asset verification present).

All 30 bats tests pass. make lint clean (no new warnings).

---ci---
project: orca
phase: 1
milestone: v0.10
status: execute
---/ci---
2026-08-05 20:52:25 +00:00
Jon Chery 3b6241e5c9 docs(P00): ship complete — v0.9.0 tagged, release created, phase branch deleted 2026-08-05 20:48:32 +00:00
Jon Chery 7007aa6179 docs(P00): create phase plans — 5 phases, 4 waves, 18 tasks
---ci---
project: orca
phase: 0
milestone: v0.10
status: plan
---/ci---
2026-08-05 20:47:39 +00:00
Jon Chery 0ca19696b1 docs(P00): ideate — 8 ideas accepted (REQ-091..098), ROADMAP renumbered
---ci---
project: orca
phase: 0
milestone: v0.10
status: ideate
---/ci---
2026-08-05 20:47:10 +00:00
Jon Chery 712f43613b docs(P00): research findings — docs gap analysis + release/install root cause
---ci---
project: orca
phase: 0
milestone: v0.10
status: research
---/ci---
2026-08-05 20:46:32 +00:00
Jon Chery e0ce12befb docs(P00): clarify — 7 decisions auto-resolved (D-188..D-194)
---ci---
project: orca
phase: 0
milestone: v0.10
status: clarify
---/ci---
2026-08-05 20:45:31 +00:00
Jon Chery fe8851b161 docs(init): validate v0.10 specification — docs/cli-examples milestone
---ci---
project: orca
phase: 0
milestone: v0.10
status: specify
---/ci---
2026-08-05 20:45:26 +00:00
Jon Chery 99480f8f84 docs(milestone): complete v0.9 re-architecture — checkpoint cleared
---ci---
project: orca
phase: 99
milestone: v0.9
status: complete
requirements:
  covered: [REQ-062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082,083,085,088,089,090]
  partial: [REQ-061,065,066,075,079,080,084,086,087]
---/ci---
2026-08-05 19:03:33 +00:00
Jon Chery 00e3cf5ce8 verify(P99): final review PASS — P0 fixed, 26/26 packages
---ci---
project: orca
phase: 99
milestone: v0.9
status: verify
---/ci---
2026-08-05 19:03:02 +00:00
Jon Chery 7b2f6719bb verify(P0X): 4-layer PASS — REQ-062, REQ-068
---ci---
project: orca
phase: P0X
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:51:30 +00:00
Jon Chery 28192a7fa4 verify(P10): 4-layer PASS — REQ-076
---ci---
project: orca
phase: P10
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:48:46 +00:00
Jon Chery 0e1f7f97b3 verify(P09): 4-layer PASS — REQ-081; gates C-02, C-14 cleared
---ci---
project: orca
phase: P09
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:38:49 +00:00
Jon Chery 3a76a32964 verify(P07a/b/c): 4-layer PASS — REQ-078; gate C-01 cleared
---ci---
project: orca
phase: P07a/b/c
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:31:25 +00:00
Jon Chery 2c53ad6213 verify(P06): 4-layer PASS — task groups
---ci---
project: orca
phase: P06
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:20:05 +00:00
Jon Chery fb85898569 verify(P05): 4-layer PASS — REQ-083
---ci---
project: orca
phase: P05
milestone: v0.9
status: verify
---/ci---
2026-08-05 18:02:51 +00:00
Jon Chery ea00158fa5 verify(P03/P04/P08): 4-layer PASS
---ci---
project: orca
phase: P03/P04/P08
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:55:11 +00:00
Jon Chery 19542dd8c9 verify(P02): 4-layer PASS — REQ-077; gate C-10 cleared
---ci---
project: orca
phase: P02
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:48:04 +00:00
Jon Chery 075d2f6459 verify(P01): 4-layer verification PASS — REQ-073
---ci---
project: orca
phase: P01
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:35:11 +00:00
Jon Chery d379d19deb verify(P0c): 4-layer verification PASS — REQ-074
---ci---
project: orca
phase: P0c
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:17:02 +00:00
Jon Chery af2fa59172 verify(P0b): 4-layer verification PASS — REQ-064,067
---ci---
project: orca
phase: P0b
milestone: v0.9
status: verify
---/ci---
2026-08-05 17:02:33 +00:00
Jon Chery fef03c5b56 verify(P0a2): 4-layer verification PASS — REQ-082
---ci---
project: orca
phase: P0a2
milestone: v0.9
status: verify
---/ci---
2026-08-05 16:49:12 +00:00
Jon Chery 7b5193674e docs(P0a1): ship — v0.8.2 tagged, released, merged
---ci---
project: orca
phase: P0a1
milestone: v0.9
status: complete
---/ci---
2026-08-05 16:38:46 +00:00
Jon Chery f6de82d712 verify(P0a1): 4-layer verification PASS — REQ-063,069,070; gate C-07
---ci---
project: orca
phase: P0a1
milestone: v0.9
status: verify
---/ci---
2026-08-05 16:38:36 +00:00
Jon Chery e5d2711d71 docs(P00): ship P00 — v0.8.1 tagged, released, merged to milestone/v0.9-rearchitecture
---ci---
project: orca
phase: P00
milestone: v0.9
status: complete
---/ci---
2026-08-05 16:27:17 +00:00
Jon Chery dd81eedcd9 verify(P00): 4-layer verification PASS — REQ-068, REQ-072, REQ-089, C-06/C-15..C-18
---ci---
project: orca
phase: P00
milestone: v0.9
status: verify
---/ci---
2026-08-05 16:26:47 +00:00
Jon Chery 40b5e781ce docs(P00): resolve C-04 — relabel v1.0→v0.10 milestone, keep all 40 phases, v1.0 UAT-gated
Operator decision (resolves grill C-04 + escalation E-03): keep 2 milestones
(v0.9 + v0.10), keep all phases (40 total, exceeds 35 soft limit), v1.0 is
UAT-gated and cut as a separate tag (v1.0.0) after v0.10 completion per
operator sign-off — not a separate milestone.

Relabels all v1.0 milestone references to v0.10 across ROADMAP, REQUIREMENTS,
GRILL_v0.9, IDEATION_v0.9, PRD_v0.9, PROJECT. Phase content unchanged; only
the milestone label moves. Historical grill narrative (the original PRD §23
counts and the E-03 auto-split reasoning) preserved verbatim for audit
integrity. C-04 and E-03 marked RESOLVED in GRILL_v0.9.md.

Milestone structure:
- v0.9: Re-architecture Foundation & Workloads (13 phases P00..P0X)
- v0.10: Production Hardening (19 phases P00..P16, milestone tag v0.10.0)
- v1.0: UAT-gated production-ready cut (separate v1.0.0 tag, not a milestone)

verify-reqs: 90 requirements consistent.

---ci---
project: orca
phase: 0
milestone: v0.9
status: complete
gate: C-04 resolved
---/ci---
2026-08-05 16:08:33 +00:00
Jon Chery 7315916fbc docs(P00): ship phase 0 — v0.8.0 tagged, released, merged to milestone/v0.9-rearchitecture
---ci---
project: orca
phase: 0
milestone: v0.9
status: complete
---/ci---
2026-08-05 16:02:56 +00:00
Jon Chery e9f1073954 docs(P00): grill v0.9 re-architecture — REPLAN 0.74 overridden, 19 binding conditions adopted
Runs the 9-axis adversarial grill on the v0.9/v1.0 re-architecture. Overall
verdict REPLAN (0.74) on 3 axes (Scope, Migration, Re-architecture
Justification). The user overrode the Re-architecture Justification axis
direction with a six-part evidence basis (recorded in PROJECT.md). The
remaining mechanics are adopted: 19 binding conditions (C-01..C-19) as
phase gates, 10 phase challenges (PC-01..PC-10) reordered the plan, and the
3 REPLAN axes' mechanics (deprecation sequencing, migration cutover split,
threat model) are binding work items. C-03 (check-in PRD) resolved. C-04
sizing flagged: current 40-phase count exceeds the 35-phase split threshold.

---ci---
project: orca
phase: 0
milestone: v0.9
status: grill
---/ci---
2026-08-05 16:01:52 +00:00
Jon Chery 3c0ac65dc6 docs(P00): plan v0.9 — reordered 13-phase v0.9 + 19-phase v1.0 plan with grill gates
Records the reordered phase plan (already committed to ROADMAP.md in the
specify stage). v0.9 = 13 phases (P00 deprecation/migration/test-infra
pre-phase + P0a1 path-resolver + P0a2 namespace-CRUD + P0b parser +
P0c schemas+emitter + P01-P10 workloads + P0X ship). v1.0 = 19 phases
(P00 cache + P01 metrics + P01.5 SPIFFE spike + P02 ACL + P03 secrets +
P04 backup + P05 drain + P06 history + P07 recovery + P08 integration +
P09 collector + P10 transactional + P11 lint + P12 verify + P13 ns +
P14a/b/c migration split + P15 README + P15.5 threat-model + P16 final).
All 19 grill binding conditions (C-01..C-19) adopted as phase gates.
Note: C-04 sizing must run before P00 execution; current count is 40
phases across v0.9+v1.0, which exceeds the 35-phase split threshold —
C-04 may require splitting into v0.9 + v0.10 + v1.0.

---ci---
project: orca
phase: 0
milestone: v0.9
status: plan
---/ci---
2026-08-05 16:01:41 +00:00
Jon Chery 8631a698ce docs(P00): ideate v0.9 — 30 ideas (REQ-061..090), 3 tiers, 7 phase-reorder flags
Generates 30 ideation ideas across mechanical (12), backend-enriched (12),
and cross-cutting (6) tiers, all accepted at >=0.60 confidence. Mapped to
REQ-061..REQ-090. Highest-impact: I-C-001 (migration ordering, 0.88) and
I-C-006 (dual-write window, 0.86) reshape v0.9 execution strategy. Highest
blast radius: I-M-010 (path resolver, 0.84) touches every adaptable package.
Most under-specified by PRD: I-B-003 (lead applier execution model, 0.78).
Seven phase-reordering flags against PRD section 23: add v0.9-P00 deprecation
pre-phase, split P0a into P0a1/P0a2, design SSH-push before P01, fold emitter
into P0c, add txn-design spike in P0.9-P00, bootstrap test infra in P00,
fold persona reactivation + doc banners into P00.

---ci---
project: orca
phase: 0
milestone: v0.9
status: ideate
---/ci---
2026-08-05 16:01:28 +00:00
Jon Chery 642a79f604 docs(P00): research v0.9 re-architecture — codebase audit + prior-context review
Reconciles the PRD against the shipped v0.8 codebase. Audit confirms the
PRD's R-series and D-068+ describe a re-architecture (not a continuation):
6 foundational axes contradict the shipped code (daemon, transport, CA,
identity, config format, namespace model) and 8 subsystems are net-new.
Prior planning corpus (IDEATION/GRILL/RESEARCH v0.2-v0.8) confirmed no
v0.9/v1.0 plan existed; step-ca was explicitly rejected (AD-010); SPIFFE
was rejected (PROJECT.md:94). The re-architecture is the first direction
change in the project's history.

---ci---
project: orca
phase: 0
milestone: v0.9
status: research
---/ci---
2026-08-05 16:01:17 +00:00
Jon Chery e008c53966 docs(P00): specify v0.9 re-architecture milestone — PRD adopted, REQ-061..090, supersession table
Adopts the v0.9/v1.0 PRD (.ciagent/PRD_v0.9.md) that supersedes the shipped
v0.1-v0.8 architecture. The re-architecture is justified by a six-part
evidence basis recorded in the PROJECT.md Supersession Table:
operational daemon failure, external step-ca mandate, multi-tenancy
requirement, WASM workload requirement, SSH-push deployment target,
and vision correction.

Appends 30 net-new requirements (REQ-061..REQ-090) to REQUIREMENTS.md,
the v0.9 (13 phases) + v1.0 (19 phases) reordered plan to ROADMAP.md,
the AD-series supersession table to PROJECT.md + ARCHITECTURE.md, and
reactivates security-engineer + network-engineer + devops-engineer
personas (implements grill C-05).

---ci---
project: orca
phase: 0
milestone: v0.9
status: specify
---/ci---
2026-08-05 16:01:06 +00:00
Jon Chery 8b19c9ab68 docs(milestone): complete coverage-trust-hardening — v0.8 milestone release
Mark REQ-057..060 Complete in REQUIREMENTS.md, mark v0.8 COMPLETE in
ROADMAP.md, advance config.json phase to 4.

P0 (v0.7.0): pre-execution — specify/clarify/research/plan/grill.
P1 (v0.7.1): coverage round 2 — 9 packages hit tiered floor.
P2 (v0.7.2): SSH trust hardening — --host-key-fingerprint + key-reset
             + v0.6 TOFU ship-defect bugfix + doctor parity.
P3 (v0.7.3): requirements-hygiene gate — make verify-reqs + CI hook.
P4 (v0.7.4): final review + audit + milestone release (this commit).

Review: PASS-WITH-FOLLOWUPS (0 P0, 3 P1+ deferred to v0.9).
Audit: PASS (1 P1 stale-branch-hygiene, pre-existing, post-ship cleanup).
GRILL: 4/4 binding conditions satisfied.

---ci---
project: orca
phase: 4
milestone: v0.8
status: complete
requirements:
  covered: [REQ-057, REQ-058, REQ-059, REQ-060]
  partial: []
---/ci---
2026-08-04 12:25:58 +00:00
Jon Chery 70c5718505 verify(P03): 4-layer verification PASS — REQ-060
---ci---
project: orca
phase: 3
milestone: v0.8
status: verify
requirements:
  covered: [REQ-060]
  partial: []
---/ci---
2026-08-04 12:18:48 +00:00
Jon Chery f4192be5d1 verify(P02): 4-layer verification PASS — REQ-058, REQ-059 + TOFU bugfix
---ci---
project: orca
phase: 2
milestone: v0.8
status: verify
requirements:
  covered: [REQ-058, REQ-059]
  partial: []
---/ci---
2026-08-04 12:07:56 +00:00
Jon Chery dea358d40b verify(P01): 4-layer verification PASS — REQ-057 covered
---ci---
project: orca
phase: 1
milestone: v0.8
status: verify
requirements:
  covered: [REQ-057]
  partial: []
---/ci---
2026-08-04 01:51:26 +00:00
Jon Chery 367a338a72 test(P01): coverage-gate verification — all 9 packages hit tiered floor (T01.12, REQ-057)
>=70%: engine 88.9%, proxmox 87.1%, cli 76.2%, transport 93.0%,
       store 84.7%, jobspec 90.5%
>=50%: audit 100.0%, certpaths 100.0%, cmd/orca 80.0%
go test -race ./... PASS. GRILL escape valve NOT needed.

---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
requirements:
  covered: [REQ-057]
  partial: []
---/ci---
2026-08-04 01:49:15 +00:00
Jon Chery 97a10353da docs(P00): grill v0.8 plan — PROCEED-WITH-CONDITION (4 binding fixes applied)
GRILL_v0.8.md (30KB): 9-axis adversarial review, overall verdict
PROCEED-WITH-CONDITION (confidence 0.78). 7 PROCEED + 4
PROCEED-WITH-CONDITION + 0 REPLAN findings.

4 binding plan changes applied to PLAN_v0.8.md:
  #1 T02.6 relabeled as v0.6 ship-defect bugfix (not v0.8 feature);
     P04 audit must record ship-defect closure
  #2 T02.9 doctor proxmox parity — P02 not complete until both
     bootstrap + doctor callbacks use capture-fix wrapper
  #3 T01.6 cli coverage escape valve — ship at 65% if 70% not reached
     after Wave 2 (RESEARCH §1.4 flags 55-65% realistic); do not block
     P02/P03 on the last 5%
  #4 T03.1 verify-reqs regex substring-tolerant (matches v0.2 header
     variant) + reverse-direction assertion (REQUIREMENTS Complete ↔
     ROADMAP COMPLETE); scope note: doc-vs-doc drift only

T02.10 case 7 added (known_hosts pre-populated v0.6→v0.8 migration
path). No escalations; all axes resolved at confidence ≥ 0.60.

---ci---
project: orca
phase: 0
milestone: v0.8
status: grill
---/ci---
2026-08-04 00:49:07 +00:00
Jon Chery a288eb93ea docs(P00): create v0.8 phase plans — 4 exec phases + final review
PLAN_v0.8.md (33KB): 4 execution phases, 37 tasks (36 must-haves),
3-wave ordering per phase, persona-assigned (lead/backend/data),
REQ-057..060 mapped.

P01 coverage round 2 (12 tasks): proxmox sessionRunner seam + 9 pkg
tests, tiered floor ≥70%/≥50% per D-047.
P02 SSH trust (11 tasks): --host-key-fingerprint pre-pin + key-reset +
TOFU capture bugfix + HostKeyFingerprint population.
P03 verify-reqs gate (5 tasks): cmd/verify-reqs Go program + make
target + .coreci.yml hook.
P04 final review + ship + audit (9 tasks).

Zero new direct deps. ROADMAP reconciled to 4-phase structure (P04 =
final review, no separate P05).

---ci---
project: orca
phase: 0
milestone: v0.8
status: plan
---/ci---
2026-08-04 00:49:07 +00:00
Jon Chery 285ffee863 docs(P00): v0.8 research findings + persona assessment
RESEARCH_v0.8.md (35KB): per-package coverage strategy for 9 pkgs,
SSH trust research (uncovered latent TOFU capture bug + unpopulated
HostKeyFingerprint field), verify-reqs Go program approach, 4 ADs,
10 pitfalls. PERSONAS.md updated for v0.8 (3-persona roster retained,
connectrpc removed from backend frameworks per AD-014, territory globs
aligned to actual file structure).

Key findings flagged for PLAN:
- proxmox needs sessionRunner seam (~10 LOC) or stalls at ~55%
- cert_repo_test.go missing (v0.7 P01 leftover) blocks store 70%
- TOFU known_hosts capture broken + HostKeyFingerprint never populated
  (bootstrap.go:195-198) — P02 fixes both
- verify-reqs = Go program at cmd/verify-reqs (~80 LOC, stdlib only)

---ci---
project: orca
phase: 0
milestone: v0.8
status: research
---/ci---
2026-08-04 00:49:07 +00:00
Jon Chery a0b3b7439d docs(P00): clarify v0.8 ambiguities (5 decisions, full autonomy)
D-043 P02 chore vs feat (chore — trust-surface hardening, no new capability)
D-044 --host-key-fingerprint placement (node join root, validated on --type proxmox)
D-045 fingerprint format (OpenSSH SHA256:base64)
D-046 key-reset scope (local known_hosts only, not remote authorized_keys)
D-047 coverage tiered floor (70% for retested, 50% for zero-test packages)

---ci---
project: orca
phase: 0
milestone: v0.8
status: clarify
---/ci---
2026-08-04 00:49:05 +00:00
Jon Chery a052bf20f1 docs(init): validate v0.8 specification — coverage & trust hardening
---ci---
project: orca
phase: 0
milestone: v0.8
status: specify
---/ci---
2026-08-04 00:49:05 +00:00
Jon Chery 7bb533c2fb docs(milestone): complete hardening-completion
v0.7 milestone complete. All 4 execution phases + final review shipped.
REQ-053..056 all complete. Tags v0.6.0..v0.6.5 on v0.6.x patch line.
Merged milestone/v0.7-hardening-completion → main.

---ci---
project: orca
phase: 5
milestone: v0.7
status: complete
requirements:
  covered: [REQ-053, REQ-054, REQ-055, REQ-056]
  partial: []
---/ci---
2026-08-04 00:29:51 +00:00
Jon Chery afcd15cde4 docs(P04): complete pprof-daemon phase — shipped v0.6.4
REQ-056 complete. I-308 (deferred since v0.2) implemented. Tag + merge +
Gitea release succeeded.

---ci---
project: orca
phase: 4
milestone: v0.7
status: complete
requirements:
  covered: [REQ-056]
  partial: []
---/ci---
2026-08-04 00:22:39 +00:00
Jon Chery f8b135e7a8 docs(P03): complete coverage-uplift phase — shipped v0.6.3
REQ-055 complete. All 4 target packages ≥ 50% (engine 65.1%, transport
84.6%, proxmox 82.7%, audit 100%). Latent dispatch.go EOF bug fixed.

---ci---
project: orca
phase: 3
milestone: v0.7
status: complete
requirements:
  covered: [REQ-055]
  partial: []
---/ci---
2026-08-04 00:19:20 +00:00
Jon Chery 007d3a12e8 docs(P02): complete config-parser phase — shipped v0.6.2
REQ-054 complete. Tag + merge + Gitea release succeeded.

---ci---
project: orca
phase: 2
milestone: v0.7
status: complete
requirements:
  covered: [REQ-054]
  partial: []
---/ci---
2026-08-04 00:09:56 +00:00
Jon Chery 27f2abf8fb docs(P01): complete cert-register phase — shipped v0.6.1
REQ-053 complete. Tag + merge + Gitea release succeeded.

---ci---
project: orca
phase: 1
milestone: v0.7
status: complete
requirements:
  covered: [REQ-053]
  partial: []
---/ci---
2026-08-04 00:05:45 +00:00
Jon Chery c100892ad9 docs(P00): complete v0.7 pre-execution phase — shipped v0.6.0
Tag + merge + Gitea release #399 all succeeded. Phase 0 complete.

---ci---
project: orca
phase: 0
milestone: v0.7
status: complete
---/ci---
2026-08-03 23:54:37 +00:00
Jon Chery f7902dddda docs(P00): create v0.7 phase plans — 4 exec phases + final review
Vertical-slice plans: P01 cert registration + cert_repo tests (REQ-053),
P02 HCL config parser (REQ-054), P03 coverage uplift engine/transport/
proxmox/audit ≥50% (REQ-055), P04 pprof opt-in (REQ-056), P05 final.
NFR milestone, tags v0.5.5..v0.5.10.

---ci---
project: orca
phase: 0
milestone: v0.7
status: plan
---/ci---
2026-08-03 20:30:23 +00:00