Compare commits
8 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 ciagent
|
ba5ffd76f9 | ||
|
ciagent
|
9b308c79f4 | ||
|
ciagent
|
a7bb00d935 | ||
|
ciagent
|
b4d9409e4d | ||
|
ciagent
|
efdbd2a61d | ||
|
ciagent
|
5755f12053 | ||
|
ciagent
|
5dba3cef80 | ||
|
ciagent
|
fc6a6c07e2 |
@@ -526,115 +526,3 @@ orca CLI orca daemon orca daemon
|
||||
For v0.2, one node must be the CA holder (`orca cert init` was run
|
||||
on it). The CA holder's `ca.crt` is copied to each peer manually by
|
||||
the operator; peers do not auto-fetch it.
|
||||
|
||||
## v0.6 Architecture Addendum — Node Bootstrap & Proxmox
|
||||
|
||||
### `orca init` Full Bootstrap (REQ-047, REQ-048, REQ-049)
|
||||
|
||||
`orca init` transforms from a bare `mkdir` into a full single-node
|
||||
cluster bootstrap. The sequence (idempotent per D-036):
|
||||
|
||||
```
|
||||
orca init
|
||||
1. MkdirAll(certpaths.Dir(), 0o755) # namespace dir
|
||||
2. store.Open(certpaths.DBPath()) # runs migrations 0001..0006
|
||||
3. security.CAInit(dir, "orca-internal-ca") # idempotent fast-path
|
||||
4. if !exists(server.crt):
|
||||
GenerateCSR("localhost", ["localhost","127.0.0.1"])
|
||||
ca.SignCSR(csr) → WriteCert + WriteKey # server cert (skip if present)
|
||||
5. os := detectOS() # /etc/os-release ID=
|
||||
6. node := Node{kind:"localhost", os:os, name:"localhost", addr:"localhost:8443"}
|
||||
if GetByName("localhost") exists:
|
||||
UpdateLastSeenAndOS(id, os) # refresh, keep id/joined_at
|
||||
else:
|
||||
NodeRepo.Insert(node) # first-run insert
|
||||
7. print summary (CA fp, server cert fp, os, node id)
|
||||
```
|
||||
|
||||
After `orca init`, `orca doctor` MUST pass with zero FAILs.
|
||||
|
||||
### Node Schema Extension (REQ-049)
|
||||
|
||||
Migration 0006 adds two nullable columns to `nodes`:
|
||||
|
||||
```sql
|
||||
ALTER TABLE nodes ADD COLUMN kind TEXT; -- localhost | linux | proxmox
|
||||
ALTER TABLE nodes ADD COLUMN os TEXT; -- ubuntu | debian | alpine | pve | linux
|
||||
```
|
||||
|
||||
Existing rows get SQL NULL → mapped to `""` in Go (`sql.NullString`).
|
||||
`Node` struct gains `Kind string` + `OS string` fields (JSON tags
|
||||
`kind,omitempty` / `os,omitempty`). `NodeRepo` extends all
|
||||
INSERT/SELECT/scanNode calls; adds `GetByName(ctx, name)` and
|
||||
`UpdateLastSeenAndOS(ctx, id, os)` helpers.
|
||||
|
||||
### Proxmox SSH Bootstrap (REQ-050, REQ-051)
|
||||
|
||||
```
|
||||
orca node join --type proxmox --host <addr> --user root --password <pw>
|
||||
│ password from --password or $ORCA_PROXMOX_PASSWORD (never persisted, D-031)
|
||||
▼
|
||||
internal/proxmox.BootstrapProxmox(ctx, opts)
|
||||
1. GenerateOrLoadSSHKey(certpaths.Dir()) # Ed25519, ~/.orca/orca_ssh_key{,.pub}
|
||||
2. SSH dial (password auth, knownhosts.New TOFU) # capture host key on first connect
|
||||
3. Deploy pubkey → ~orca/.ssh/authorized_keys # via session heredoc (no SFTP dep)
|
||||
4. useradd -m orca # create Linux system user (config-overridable name)
|
||||
5. pveum role add OrcaOperator --privs "VM.Audit Datastore.AllocateSpace SDN.Use"
|
||||
(idempotent: probe pveum role list first)
|
||||
6. pveum user add orca@pam -comment "Orca automation user"
|
||||
(idempotent: probe pveum user list first)
|
||||
7. pveum acl modify / -user orca@pam -role OrcaOperator
|
||||
(idempotent: modify creates or updates)
|
||||
8. Write /etc/sudoers.d/orca (mode 0440):
|
||||
orca ALL=(root) NOPASSWD: NOEXEC: /usr/bin/pct, /usr/bin/qm
|
||||
orca ALL=(root) NOPASSWD: /usr/bin/apt-get, /usr/bin/dpkg
|
||||
9. visudo -cf /etc/sudoers.d/orca # validate; abort on error
|
||||
10. NodeRepo.Insert(Node{kind:"proxmox", os:"pve", name:host, addr:host})
|
||||
11. Audit log: proxmox.bootstrap_ok (host, user, role, fp)
|
||||
```
|
||||
|
||||
**`pvesh` excluded from sudoers** — `pvesh` can trigger the API
|
||||
`/nodes/{node}/execute` endpoint which spawns shell commands
|
||||
server-side, bypassing sudo's `NOEXEC` tag. API access is via the
|
||||
`OrcaOperator` PVE role + `orca@pam` user (PVE RBAC), not sudo'd `pvesh`.
|
||||
|
||||
### Doctor Extensions (REQ-052)
|
||||
|
||||
- **`doctor os`**: re-runs `detectOS()` from `/etc/os-release`, compares
|
||||
to the stored localhost node's `os` field. Drift = WARN (OS upgraded
|
||||
since init? re-run `orca init` to refresh). Match = PASS.
|
||||
- **`doctor proxmox`**: iterates `kind=proxmox` nodes, SSH-probes each
|
||||
with `pveversion` (3s timeout per peer, clones `doctor.Network()`
|
||||
pattern). PASS = reachable + pveversion exits 0. WARN = zero proxmox
|
||||
nodes (single-node cluster is legitimate). FAIL = any node
|
||||
unreachable or pveversion fails.
|
||||
|
||||
### SSH Key Handling (D-037)
|
||||
|
||||
- **Location**: `~/.orca/orca_ssh_key` (0600) + `~/.orca/orca_ssh_key.pub` (0644)
|
||||
- **Algorithm**: Ed25519 (smaller, faster, more secure than RSA for SSH)
|
||||
- **Generation**: lazy — on first `orca node join --type proxmox`, NOT at `orca init` (localhost doesn't need SSH)
|
||||
- **Format**: PKCS8 PEM (consistent with `ca.key`/`server.key`; `ssh.ParsePrivateKey` accepts it)
|
||||
- **TOFU host keys**: `~/.orca/known_hosts` (OpenSSH format via `knownhosts.New`)
|
||||
|
||||
### Dependency Map (v0.6 addition)
|
||||
|
||||
```
|
||||
golang.org/x/crypto v0.54.0 # SSH (ssh + ssh/knownhosts + ed25519)
|
||||
└─ golang.org/x/sys v0.47.0 # indirect (bumped from v0.42.0)
|
||||
└─ golang.org/x/term v0.45.0 # indirect (pulled by ssh for PTY)
|
||||
```
|
||||
|
||||
Total direct deps: 5 (was 4). One new direct dep (`x/crypto`). Matches
|
||||
D-030 minimal-deps rationale. No SFTP module (file upload via session
|
||||
heredoc).
|
||||
|
||||
### v0.6 Architectural Decisions (AD-017..AD-021)
|
||||
|
||||
| ID | Decision | Rationale |
|
||||
|----|----------|-----------|
|
||||
| AD-017 | `orca init` = full bootstrap (CA + cert + db + localhost node) | Single command produces a working cluster; `orca doctor` passes post-init. Idempotent (D-036). |
|
||||
| AD-018 | Proxmox join via SSH (golang.org/x/crypto/ssh), not PVE REST API | SSH is the universal Proxmox management entry point; REST API would require API token bootstrap (chicken-and-egg). One new direct dep (D-030). |
|
||||
| AD-019 | `orca@pam` realm (not `orca@pve`) | SSH creates a Linux system user; PAM realm maps it to PVE RBAC without a separate PVE password. `@pve` requires interactive password prompt over non-PTY SSH (hangs). |
|
||||
| AD-020 | Exclude `pvesh` from sudoers; NOEXEC on `pct`/`qm` | `pvesh` can trigger API execute endpoint bypassing NOEXEC. `pct`/`qm` are Perl scripts via dynamically-linked perl → NOEXEC effective. `apt-get`/`dpkg` need exec for maintainer scripts → no NOEXEC. |
|
||||
| AD-021 | TOFU host-key via `knownhosts.New` | Avoids deprecated `ssh.InsecureIgnoreHostKey`. Capture-on-first-connect, verify-on-subsequent. Fail closed on mismatch (operator runs key-reset). |
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
{
|
||||
"phase": 1,
|
||||
"stage": "verify",
|
||||
"milestone": "v0.8",
|
||||
"milestone_slug": "coverage-trust-hardening",
|
||||
"phase_role": "execution",
|
||||
"attempts": 0,
|
||||
"updated_at": "2026-08-04T00:58:00Z",
|
||||
"milestone_complete": false,
|
||||
"next_milestone": null
|
||||
}
|
||||
@@ -1,644 +0,0 @@
|
||||
# Grill Report: Orca v0.3 — scheduling-streaming
|
||||
|
||||
**Date:** 2026-08-01
|
||||
**Reviewer:** ci-griller (red-team, adversarial)
|
||||
**Plan under review:** `.ciagent/PLAN_v0.3.md` (commit 89fa172)
|
||||
**Branch:** `phase/00-pre-execution`
|
||||
**Mode:** Full autonomy
|
||||
|
||||
---
|
||||
|
||||
## Methodology
|
||||
|
||||
Every claim in `PLAN_v0.3.md` and `RESEARCH_v0.3.md` was cross-checked against
|
||||
the actual codebase (the 7 source files listed in the task, plus `migrate.go`,
|
||||
`store.go`, `doctor_test.go`, `security/integration_test.go`, `security/ca.go`,
|
||||
`security/csr.go`, `model/node.go`, `model/job.go`, and `cli/doctor.go`).
|
||||
Findings are scored on 9 axes. Binding verdicts are ACCEPT (plan must change),
|
||||
REJECT (concern noted, plan stands), or DEFER (address during execution).
|
||||
|
||||
---
|
||||
|
||||
## Summary Verdict
|
||||
|
||||
| Severity | Count |
|
||||
|----------|-------|
|
||||
| CRITICAL | 2 |
|
||||
| HIGH | 2 |
|
||||
| MEDIUM | 5 |
|
||||
| LOW | 3 |
|
||||
| **Total** | **12** |
|
||||
|
||||
**Overall verdict: PROCEED WITH CHANGES**
|
||||
|
||||
The plan is fundamentally sound — the scope is right-sized, the requirements
|
||||
coverage is complete, the persona territories are respected, and the
|
||||
no-new-dependencies promise holds. However, two CRITICAL findings require plan
|
||||
changes before execution begins. Neither is a scope expansion; both are
|
||||
correctness fixes to the design as written. With the 2 ACCEPT changes applied,
|
||||
this plan is ready to execute.
|
||||
|
||||
---
|
||||
|
||||
## Per-Axis Findings
|
||||
|
||||
### Axis 1 — Feasibility (can each task actually be implemented?)
|
||||
|
||||
#### F-01 [CRITICAL] — Watch yields per-row but CLI table mode requires full-snapshot-per-tick
|
||||
|
||||
**Severity:** CRITICAL
|
||||
**Axis:** Feasibility / Vertical slice integrity
|
||||
**Binding verdict:** ACCEPT (plan must change)
|
||||
|
||||
**Finding:**
|
||||
The plan is internally contradictory about what `Watch` yields.
|
||||
|
||||
- D-028 (RESEARCH:88) says Watch "yields the **full current snapshot** (one
|
||||
element per row)."
|
||||
- Task 01-01-01 (PLAN:30) says Watch "yields one `*model.Job` per row via
|
||||
`scanJob`" — i.e., `iter.Seq[*model.Job]`, one element per row per tick.
|
||||
- Task 01-02-02 (PLAN:42) says the CLI table render "collect the full snapshot
|
||||
from `seq` into a `[]*model.Job`" then compares against the previous
|
||||
snapshot's rendered table.
|
||||
|
||||
These are incompatible. `iter.Seq[*model.Job]` yields individual jobs with **no
|
||||
tick-boundary signal**. The CLI ranging `for job := range seq` receives a flat
|
||||
stream of jobs and cannot know when a tick's snapshot is complete. It cannot
|
||||
collect "the full snapshot" because it cannot detect the end of a tick.
|
||||
|
||||
The JSON mode (01-02-03) can work without tick boundaries (per-element dedup
|
||||
via `map[string][]byte`), but the **table mode cannot**. Table mode needs the
|
||||
complete snapshot to render the table, clear the screen, and compare against the
|
||||
previous frame.
|
||||
|
||||
**Evidence:**
|
||||
- `RESEARCH_v0.3.md:106-142` — implementation yields `yield(j)` per row inside
|
||||
`for rows.Next()`, not `yield(allJobs)` per tick.
|
||||
- `PLAN_v0.3.md:30` — "yields one `*model.Job` per row"
|
||||
- `PLAN_v0.3.md:42` — "collect the full snapshot from `seq` into a `[]*model.Job`"
|
||||
- `PLAN_v0.3.md:44` (01-02-04) — nodeListCmd watch bypasses registry, same
|
||||
per-row yield.
|
||||
- D-028 says "full current snapshot" but the code yields per-row.
|
||||
|
||||
**Required change:**
|
||||
Change the `Watch` element type from `iter.Seq[*model.Job]` to
|
||||
`iter.Seq[[]*model.Job]` (and `iter.Seq[[]*model.Node]` analogously). Each tick
|
||||
yields the **full snapshot as a single slice**. This:
|
||||
|
||||
1. Makes D-028 ("yields the full current snapshot") literally true.
|
||||
2. Makes table mode trivial: `for snapshot := range seq { render(snapshot) }`.
|
||||
3. Makes JSON mode cleaner: per-tick, diff the snapshot against the previous
|
||||
one, emit one JSON line per changed element. This also enables a natural
|
||||
`"delete"` event for elements that disappeared (not possible with per-row
|
||||
yield).
|
||||
4. Simplifies the test contract: `TestWatch_YieldsSnapshots` ranges over
|
||||
`iter.Seq[[]*model.Job]` and each yield is a complete tick — no timing
|
||||
ambiguity about "did I get all rows for this tick?"
|
||||
|
||||
**Impact on plan:**
|
||||
- Tasks 01-01-01, 01-01-02: signature changes to
|
||||
`iter.Seq[[]*model.Job]` / `iter.Seq[[]*model.Node]`. Implementation
|
||||
collects all rows into a slice per tick, then `yield(slice)`.
|
||||
- Task 01-02-02 (table): `for snapshot := range seq { ... }` — direct, no
|
||||
collection needed.
|
||||
- Task 01-02-03 (JSON): per-tick diff against previous snapshot's
|
||||
`map[string][]byte`. Emit `"init"`/`"update"`/`"delete"` events.
|
||||
- Task 01-01-04 (tests): assert each yield is a complete snapshot slice.
|
||||
- D-026, D-028, D-046: update to reflect slice-per-tick semantics.
|
||||
- Must-have criteria for 01-01-01/01-01-02: update signature assertions.
|
||||
|
||||
This is a mechanical change to the plan, not a scope change. The implementation
|
||||
is simpler (no tick-boundary detection needed).
|
||||
|
||||
**Confidence:** 0.92
|
||||
|
||||
---
|
||||
|
||||
#### F-02 [CRITICAL] — First-tick delay: Watch waits a full interval before first yield
|
||||
|
||||
**Severity:** CRITICAL
|
||||
**Axis:** Feasibility / UX correctness
|
||||
**Binding verdict:** ACCEPT (plan must change)
|
||||
|
||||
**Finding:**
|
||||
The Watch implementation (RESEARCH:110-116) has this structure:
|
||||
|
||||
```go
|
||||
ticker := time.NewTicker(1 * time.Second)
|
||||
defer ticker.Stop()
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done(): return
|
||||
case <-ticker.C: // <-- waits 1s BEFORE first query
|
||||
}
|
||||
// query + yield
|
||||
}
|
||||
```
|
||||
|
||||
The `select` waits for the first ticker pulse **before** running the first
|
||||
query. With a 1s default interval, `orca job list --watch` shows **nothing for
|
||||
1 full second**, then the first snapshot appears. For a CLI tool, a 1s blank
|
||||
screen is a poor UX and looks broken. The user expects immediate output, then
|
||||
refreshes every 1s.
|
||||
|
||||
The tests (01-01-04) use `watchInterval=10ms`, so the delay is only 10ms and
|
||||
the test passes — but the test does NOT catch this UX bug because the interval
|
||||
is tiny. In production (1s), the bug is visible.
|
||||
|
||||
**Evidence:**
|
||||
- `RESEARCH_v0.3.md:110-116` — `select` before first query.
|
||||
- `PLAN_v0.3.md:30` — "pull-based inline polling loop on a 1s ticker" — no
|
||||
mention of immediate first yield.
|
||||
- Standard `top`-like tools yield immediately, then tick.
|
||||
|
||||
**Required change:**
|
||||
Add to tasks 01-01-01 and 01-01-02: the polling loop must **query and yield
|
||||
immediately on the first iteration**, then `select` on the ticker for
|
||||
subsequent ticks. Implementation shape:
|
||||
|
||||
```go
|
||||
for {
|
||||
// query + yield (runs immediately on first iteration)
|
||||
rows, err := r.db.QueryContext(ctx, ...)
|
||||
// ... yield snapshot ...
|
||||
select {
|
||||
case <-ctx.Done(): return
|
||||
case <-ticker.C:
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Or equivalently, query once before the loop, then loop with select-first. The
|
||||
must-have criteria should add: "first yield occurs immediately (no
|
||||
`watchInterval` delay before first snapshot)."
|
||||
|
||||
**Impact on plan:**
|
||||
- Tasks 01-01-01, 01-01-02: add "immediate first yield" to description +
|
||||
must-have.
|
||||
- Task 01-01-04 (tests): add assertion that the first snapshot appears within
|
||||
a short deadline (e.g., <50ms) even with `watchInterval=10ms` — proving the
|
||||
first yield is not tick-gated.
|
||||
|
||||
**Confidence:** 0.95
|
||||
|
||||
---
|
||||
|
||||
#### F-03 [HIGH] — P01 and P02 both modify `internal/cli/node.go` (file-disjoint claim is false)
|
||||
|
||||
**Severity:** HIGH
|
||||
**Axis:** Feasibility / Timeline (parallelism)
|
||||
**Binding verdict:** ACCEPT (plan must change)
|
||||
|
||||
**Finding:**
|
||||
D-042 (PLAN:133, RESEARCH:489) claims "P01 and P02 are file-disjoint — no file
|
||||
is modified by both." This is **false**.
|
||||
|
||||
- P01 task 01-02-04 (PLAN:44) modifies `internal/cli/node.go` — adds `--watch`
|
||||
flag + render modes to `nodeListCmd`.
|
||||
- P02 task 02-01-01 (PLAN:76) modifies `internal/cli/node.go` — removes the
|
||||
`dbPath` function and updates `openDB` to call `certpaths.DBPath()`.
|
||||
|
||||
Both phases touch `internal/cli/node.go`. If developed in parallel (as D-042
|
||||
permits), this causes merge conflicts.
|
||||
|
||||
**Evidence:**
|
||||
- `PLAN_v0.3.md:44` — 01-02-04 files: `internal/cli/node.go`
|
||||
- `PLAN_v0.3.md:76` — 02-01-01 files: `internal/cli/node.go` (remove old
|
||||
`dbPath`)
|
||||
- `PLAN_v0.3.md:133` — "P01 and P02 are file-disjoint"
|
||||
- Actual code: `internal/cli/node.go:22-28` defines `dbPath`; `:30-36`
|
||||
defines `openDB` which calls `dbPath()`. `openDB` is used by 14 call sites
|
||||
across `job.go`, `daemon.go`, `node_capacity.go`, `audit.go`, `node.go`.
|
||||
|
||||
**Required change:**
|
||||
Update D-042 and the cross-phase notes (PLAN:131-133) to acknowledge the
|
||||
overlap. Two options (pick one):
|
||||
|
||||
1. **Serialize:** P02 Wave 1 (02-01-01) runs before P01 Wave 2 (01-02-04).
|
||||
P02 Wave 1 is a prerequisite for P01 Wave 2 on the `node.go` file. P01
|
||||
Wave 1 (store layer) and P02 Wave 1 can still run in parallel.
|
||||
2. **Merge the changes:** task 02-01-01 is folded into P01 Wave 2's
|
||||
`node.go` modification (the cli-engineer updates `openDB` to use
|
||||
`certpaths.DBPath()` while also adding `--watch`).
|
||||
|
||||
Recommended: Option 1 (serialize P02 Wave 1 before P01 Wave 2). It preserves
|
||||
the wave structure and persona assignments. Update the cross-phase note to say:
|
||||
"P02 Wave 1 (02-01-01) must complete before P01 Wave 2 (01-02-04) due to shared
|
||||
`internal/cli/node.go` modification. P01 Wave 1 and P02 Wave 1 may run in
|
||||
parallel."
|
||||
|
||||
**Confidence:** 0.90
|
||||
|
||||
---
|
||||
|
||||
#### F-04 [HIGH] — D-037 ServerName = node.Name assumption is fragile and unverified against real join flow
|
||||
|
||||
**Severity:** HIGH
|
||||
**Axis:** Feasibility / Security
|
||||
**Binding verdict:** DEFER (address in execution, with documentation)
|
||||
|
||||
**Finding:**
|
||||
D-037 (RESEARCH:261, confidence 0.80) assumes `serverName = node.Name` for the
|
||||
mTLS health probe. The TLS client's `ServerName` must match a SAN entry on the
|
||||
peer's server cert. But `GenerateCSR(commonName, sans)` (csr.go:24) takes the
|
||||
commonName and SANs as **separate arguments**. The commonName becomes the cert
|
||||
Subject CN, but `ServerName` in `tls.Config` is matched against **SANs**
|
||||
(DNSNames/IPAddresses), not the CN (per Go's `crypto/tls` behavior since Go
|
||||
1.15).
|
||||
|
||||
If a node joined with `--name node-b` but its cert SAN is `localhost` (or an
|
||||
IP), `serverName = "node-b"` will **fail the TLS handshake** with a
|
||||
"certificate is valid for localhost, not node-b" error — even though the peer
|
||||
is perfectly healthy.
|
||||
|
||||
The research (RESEARCH:261) says "confirmed in `integration_test.go:41`
|
||||
`GenerateCSR("test-server", ...)`" — but that test uses `serverName =
|
||||
"localhost"` (integration_test.go:83), which matches the SAN `localhost`, not
|
||||
the commonName `test-server`. The test proves SAN-matching, not CN-matching.
|
||||
|
||||
**Evidence:**
|
||||
- `internal/security/csr.go:24` — `GenerateCSR(commonName, sans)` — CN and
|
||||
SANs are separate.
|
||||
- `internal/security/integration_test.go:41` — `GenerateCSR("test-server",
|
||||
[]string{"localhost", "127.0.0.1"})` — CN is "test-server", SANs are
|
||||
localhost/127.0.0.1.
|
||||
- `internal/security/integration_test.go:83` — `ClientTLSConfig(...,
|
||||
"localhost", ...)` — serverName = "localhost" (a SAN), NOT "test-server"
|
||||
(the CN).
|
||||
- `internal/transport/mtls.go:49-51` — `serverName` is required and set as
|
||||
`tls.Config.ServerName` (matched against SANs).
|
||||
- `PLAN_v0.3.md:88` — 02-02-03: `serverName = n.Name`.
|
||||
|
||||
**Mitigation (DEFER to execution):**
|
||||
1. Document the assumption in the `Network()` check message: "probing
|
||||
<name> at <addr> (assuming cert SAN = node name)".
|
||||
2. If the handshake fails with a SAN mismatch error, the FAIL message should
|
||||
include the cert's actual SANs (parsed from the error) so the operator can
|
||||
diagnose. This is a refinement, not a plan blocker.
|
||||
3. The test 02-02-05(e) uses `Name = "localhost"` which matches the SAN — so
|
||||
the test passes, but it doesn't prove the general case. Add a test comment
|
||||
noting this assumption.
|
||||
|
||||
**Why DEFER not ACCEPT:** The assumption is documented (D-037, 0.80
|
||||
confidence), the failure mode is graceful (FAIL with handshake error, not a
|
||||
crash), and fixing it properly (storing SANs in the nodes table) is a scope
|
||||
expansion beyond v0.3. The plan should note the limitation; execution should
|
||||
add diagnostic context to the error message.
|
||||
|
||||
**Confidence:** 0.78
|
||||
|
||||
---
|
||||
|
||||
#### F-05 [MEDIUM] — `store.Open` runs migrations before integrity_check can run
|
||||
|
||||
**Severity:** MEDIUM
|
||||
**Axis:** Feasibility / Testing
|
||||
**Binding verdict:** REJECT (concern noted, plan stands)
|
||||
|
||||
**Finding:**
|
||||
The DB check (02-02-01) calls `store.Open(path)` which runs `migrate(db)` (store
|
||||
.go:39) before the integrity_check executes. On a truly corrupt DB, `store.Open`
|
||||
fails at `Ping()` or `migrate()` — the integrity_check never runs. The check
|
||||
returns FAIL with the open/migrate error, which is the correct outcome (a DB
|
||||
that can't be opened is broken), but the message says "open <path>: <error>"
|
||||
not "integrity_check failed."
|
||||
|
||||
The plan's `TestDBCheck_Corrupt` (RESEARCH:469) is explicitly called "brittle"
|
||||
and made optional. The plan accepts that integrity_check is somewhat redundant
|
||||
with `store.Open`'s own validation.
|
||||
|
||||
**Evidence:**
|
||||
- `internal/store/store.go:37-41` — `db.Ping()` then `migrate(db)` inside
|
||||
`Open`.
|
||||
- `PLAN_v0.3.md:86` — 02-02-01: `db, err := store.Open(path)`.
|
||||
- `RESEARCH_v0.3.md:455-456` — pitfall table acknowledges this.
|
||||
|
||||
**Why REJECT:** The failure surfaces correctly (FAIL with error message). The
|
||||
integrity_check adds value for the case where the DB opens but has logical
|
||||
corruption (e.g., foreign key violations, orphaned pages) that Ping/migrate
|
||||
don't catch. The plan's approach is acceptable for v0.3. The optional corrupt
|
||||
test is correctly deferred.
|
||||
|
||||
**Confidence:** 0.85
|
||||
|
||||
---
|
||||
|
||||
### Axis 2 — Scope
|
||||
|
||||
#### F-06 [MEDIUM] — No "delete" event in JSON watch mode (with per-row yield)
|
||||
|
||||
**Severity:** MEDIUM
|
||||
**Axis:** Scope / Completeness
|
||||
**Binding verdict:** DEFER (address in execution)
|
||||
|
||||
**Finding:**
|
||||
With the current per-row `iter.Seq[*model.Job]` design (F-01), the JSON watch
|
||||
mode (01-02-03) emits `"init"` and `"update"` events but has no way to emit
|
||||
`"delete"` events — a job that disappears from the snapshot simply stops being
|
||||
yielded, and the CLI has no tick boundary to detect "this ID was in the
|
||||
previous tick but not this one."
|
||||
|
||||
With the F-01 fix (`iter.Seq[[]*model.Job]`, full snapshot per tick), `"delete"`
|
||||
events become trivially possible: diff the previous snapshot's ID set against
|
||||
the current snapshot's ID set. The plan should add `"delete"` event semantics
|
||||
to D-046.
|
||||
|
||||
**Evidence:**
|
||||
- `PLAN_v0.3.md:43` — 01-02-03: only `"init"` and `"update"` events.
|
||||
- `PLAN_v0.3.md:139` — D-046: only `"init"` and `"update"`.
|
||||
- Neither jobs nor nodes are hard-deleted in the current CLI (`node leave` sets
|
||||
state to `left`, doesn't delete the row), so `"delete"` events are not
|
||||
strictly needed for v0.3. But the `NodeRepo.Delete` method exists and could
|
||||
be used by future code.
|
||||
|
||||
**Mitigation (DEFER):** If F-01 is accepted (slice-per-tick), add `"delete"`
|
||||
event to D-046 as a natural extension. If F-01 is not accepted, document the
|
||||
no-delete-event limitation explicitly.
|
||||
|
||||
**Confidence:** 0.70
|
||||
|
||||
---
|
||||
|
||||
### Axis 3 — Testing
|
||||
|
||||
#### F-07 [MEDIUM] — Test timing fragility: 10ms tick + 30ms insert + 80ms cancel
|
||||
|
||||
**Severity:** MEDIUM
|
||||
**Axis:** Testing
|
||||
**Binding verdict:** DEFER (address in execution)
|
||||
|
||||
**Finding:**
|
||||
The store-layer tests (01-01-04) use `watchInterval=10ms` with timing-based
|
||||
assertions: "insert a 2nd job from a goroutine after ~30ms, cancel ctx after
|
||||
~80ms." Under CI load (especially with `-race` overhead), 10ms ticks can be
|
||||
missed or delayed. A 10ms ticker pulse is not guaranteed to fire within 10ms
|
||||
under load — the Go runtime scheduler may delay it. If the 2nd job is inserted
|
||||
at 30ms but the 2nd tick fires at 45ms, the test might see the 2nd job in the
|
||||
3rd tick (at ~55ms) which is still before the 80ms cancel — so it likely
|
||||
passes, but it's fragile.
|
||||
|
||||
**Evidence:**
|
||||
- `PLAN_v0.3.md:33` — 01-01-04: "after ~30ms", "after ~80ms".
|
||||
- `time.NewTicker` does not guarantee exact timing under load.
|
||||
|
||||
**Mitigation (DEFER):** Use more generous margins (e.g., 50ms insert, 200ms
|
||||
cancel) or a synchronization mechanism (e.g., insert the 2nd job, then poll
|
||||
the collected slice with a 500ms timeout). The test hook (`watchInterval`)
|
||||
already enables fast tests; the margins just need to be wider. Execution
|
||||
should validate the tests pass reliably under `-race` in CI before marking
|
||||
Wave 1 complete.
|
||||
|
||||
**Confidence:** 0.75
|
||||
|
||||
---
|
||||
|
||||
#### F-08 [LOW] — `-race` does not detect goroutine leaks; the plan claims it does
|
||||
|
||||
**Severity:** LOW
|
||||
**Axis:** Testing
|
||||
**Binding verdict:** REJECT (concern noted, plan stands)
|
||||
|
||||
**Finding:**
|
||||
The plan (01-01-04 must-have, PLAN:33) says "`-race` reports no leaks/data
|
||||
races." `go test -race` detects **data races**, not **goroutine leaks**.
|
||||
Goroutine leak detection requires `goleak` or explicit goroutine-count
|
||||
assertions. The claim is technically incorrect.
|
||||
|
||||
However, the actual risk is negligible: Watch does not spawn a goroutine
|
||||
(D-032, inline pull loop). `time.NewTicker` spawns an internal goroutine, but
|
||||
`defer ticker.Stop()` terminates it. There is nothing to leak. The
|
||||
`no-goroutine-leak` constraint (data-engineer persona) is satisfied by
|
||||
design, not by testing.
|
||||
|
||||
**Evidence:**
|
||||
- `PLAN_v0.3.md:33` — "`-race` reports no leaks/data races"
|
||||
- `RESEARCH_v0.3.md:92` — D-032: "No goroutine is spawned by Watch."
|
||||
- Go `-race` detector documentation: detects concurrent access, not leaks.
|
||||
|
||||
**Why REJECT:** The claim is imprecise but the risk is zero by design.
|
||||
Execution may optionally add `runtime.NumGoroutine()` before/after assertions
|
||||
for belt-and-suspenders, but it's not required.
|
||||
|
||||
**Confidence:** 0.90
|
||||
|
||||
---
|
||||
|
||||
### Axis 4 — Security
|
||||
|
||||
#### F-09 [MEDIUM] — Doctor network check probes peers using the local server cert as client cert (confirmed valid, but undocumented)
|
||||
|
||||
**Severity:** MEDIUM
|
||||
**Axis:** Security
|
||||
**Binding verdict:** DEFER (document in execution)
|
||||
|
||||
**Finding:**
|
||||
The plan (02-02-03, PLAN:88) uses `certpaths.ServerCertPath()`/`ServerKeyPath()`
|
||||
as the client cert for the mTLS health probe. I verified this is **valid**:
|
||||
`security/ca.go:255` signs server certs with
|
||||
`ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth}`
|
||||
— the server cert has both ServerAuth and ClientAuth EKUs, so it can be
|
||||
presented as a client cert. The daemon's `RequireAndVerifyClientCert`
|
||||
(security/tls_config.go:92) will accept it.
|
||||
|
||||
This is correct and feasible. The finding is that this cross-use (server cert
|
||||
as client cert) is not documented in the plan or the security architecture. A
|
||||
security auditor might flag it as "server cert used for client auth — is this
|
||||
intended?"
|
||||
|
||||
**Evidence:**
|
||||
- `internal/security/ca.go:255` — `ExtKeyUsage: ServerAuth, ClientAuth`.
|
||||
- `internal/security/tls_config.go:92` — `ClientAuth: RequireAndVerifyClientCert`.
|
||||
- `PLAN_v0.3.md:88` — 02-02-03 uses `ServerCertPath()`/`ServerKeyPath()`.
|
||||
- `RESEARCH_v0.3.md:261` — D-037: "presents the local node's client cert."
|
||||
|
||||
**Mitigation (DEFER):** Add a code comment in `probeHealthz` and a note in
|
||||
ARCHITECTURE.md §5 explaining that the local server cert doubles as the client
|
||||
cert for doctor probes (justified by the dual EKU). This is documentation, not
|
||||
a code change.
|
||||
|
||||
**Confidence:** 0.88
|
||||
|
||||
---
|
||||
|
||||
### Axis 5 — Performance
|
||||
|
||||
#### F-10 [LOW] — 1s poll ticker re-runs full List query every second; no concern but worth noting
|
||||
|
||||
**Severity:** LOW
|
||||
**Axis:** Performance
|
||||
**Binding verdict:** REJECT (concern noted, plan stands)
|
||||
|
||||
**Finding:**
|
||||
The 1s ticker (D-019) re-runs `SELECT ... FROM jobs ORDER BY created_at DESC`
|
||||
every second. For a CLI tool run by a human watching a terminal, this is
|
||||
fine — the query is cheap (single table, no joins, indexed by `created_at` if
|
||||
an index exists). For an AI agent tailing `--watch --json` for hours, this is
|
||||
1 query/second × 3600 = 3600 queries/hour. SQLite handles this trivially in
|
||||
WAL mode (store.go:36).
|
||||
|
||||
The cadence is correct for a "top-like" refresh. Faster (e.g., 100ms) would
|
||||
waste CPU; slower (e.g., 5s) would feel sluggish. 1s is the right default.
|
||||
|
||||
**Evidence:**
|
||||
- `PROJECT.md:116` — D-019: "Poll-based, 1s ticker" (confidence 0.90).
|
||||
- `internal/store/store.go:36` — WAL mode enabled.
|
||||
|
||||
**Why REJECT:** The cadence is justified. No change needed.
|
||||
|
||||
**Confidence:** 0.92
|
||||
|
||||
---
|
||||
|
||||
### Axis 6 — Maintainability
|
||||
|
||||
#### F-11 [LOW] — `watchInterval` package var is mutable global state (test hook)
|
||||
|
||||
**Severity:** LOW
|
||||
**Axis:** Maintainability
|
||||
**Binding verdict:** REJECT (concern noted, plan stands)
|
||||
|
||||
**Finding:**
|
||||
D-043 (PLAN:136) uses an unexported package var `watchInterval = 1 * time.Second`
|
||||
in `internal/store`, overridable from `_test.go`. This is mutable global state —
|
||||
if tests run in parallel within the `internal/store` package and one test sets
|
||||
`watchInterval=10ms` while another expects `1s`, they interfere.
|
||||
|
||||
However, Go tests within a single package run **sequentially** by default
|
||||
unless `t.Parallel()` is called. I verified no test in `internal/store` calls
|
||||
`t.Parallel()` (grep found 0 matches). So the global var is safe as long as
|
||||
no Watch test calls `t.Parallel()`. The plan should note this constraint.
|
||||
|
||||
**Evidence:**
|
||||
- `PLAN_v0.3.md:32` — 01-01-03: "unexported package var `watchInterval`"
|
||||
- `PLAN_v0.3.md:136` — D-043.
|
||||
- grep for `t.Parallel()` in `internal/`: 0 matches.
|
||||
|
||||
**Why REJECT:** The approach is pragmatic and safe given sequential test
|
||||
execution. The alternative (a `WatchWithInterval` constructor or an option
|
||||
pattern) would leak test-only API into production, which D-043 explicitly
|
||||
avoids. Execution should add a comment: "do not call t.Parallel() in Watch
|
||||
tests — they share the watchInterval package var."
|
||||
|
||||
**Confidence:** 0.85
|
||||
|
||||
---
|
||||
|
||||
### Axis 7 — Completeness
|
||||
|
||||
#### F-12 [MEDIUM] — Plan does not address `openDB()` being the single chokepoint for dbPath relocation
|
||||
|
||||
**Severity:** MEDIUM
|
||||
**Axis:** Completeness / Feasibility
|
||||
**Binding verdict:** DEFER (clarify in execution)
|
||||
|
||||
**Finding:**
|
||||
Task 02-01-01 (PLAN:76) says "Update `internal/cli/node.go` (and any other
|
||||
`internal/cli` caller of the old unexported `dbPath`) to call
|
||||
`certpaths.DBPath()`." This is imprecise. `dbPath()` is defined in
|
||||
`node.go:22` and called only by `openDB()` in `node.go:31`. `openDB()` is
|
||||
then called by 14 sites across `job.go`, `daemon.go`, `node_capacity.go`,
|
||||
`audit.go`, `node.go`. The correct change is:
|
||||
|
||||
1. Add `certpaths.DBPath()`.
|
||||
2. Change `openDB()` body from `store.Open(dbPath())` to
|
||||
`store.Open(certpaths.DBPath())`.
|
||||
3. Delete the `dbPath()` function from `node.go`.
|
||||
|
||||
No other caller needs changing — they all go through `openDB()`. The plan's
|
||||
"any other `internal/cli` caller" language suggests a broader scan that isn't
|
||||
needed. This is a clarity issue, not a correctness issue.
|
||||
|
||||
**Evidence:**
|
||||
- `internal/cli/node.go:22-28` — `dbPath()` definition.
|
||||
- `internal/cli/node.go:30-36` — `openDB()` calls `dbPath()`.
|
||||
- grep `openDB()`: 14 call sites, all in `internal/cli/`.
|
||||
- grep `dbPath()`: only in `node.go:31` (inside `openDB`).
|
||||
|
||||
**Mitigation (DEFER):** Execution should note that `openDB()` is the single
|
||||
chokepoint — update its body and delete `dbPath()`. No other file needs
|
||||
changes. The plan's must-have ("`internal/cli` no longer defines `dbPath`")
|
||||
is correct.
|
||||
|
||||
**Confidence:** 0.88
|
||||
|
||||
---
|
||||
|
||||
### Axis 8 — Vertical Slice Integrity
|
||||
|
||||
Covered by F-01 (the tick-boundary problem breaks the Wave 1 → Wave 2
|
||||
vertical slice: Wave 1 produces `iter.Seq[*model.Job]` which Wave 2's table
|
||||
mode cannot consume correctly). With F-01's fix (`iter.Seq[[]*model.Job]`),
|
||||
the vertical slice is clean: Wave 1 yields full snapshots, Wave 2 renders
|
||||
them.
|
||||
|
||||
### Axis 9 — Risk
|
||||
|
||||
**Highest-risk task:** 02-02-05(e) `TestNetworkCheck_PeerReachable` —
|
||||
integration test requiring CA bootstrap, server cert signing with correct
|
||||
SAN, httptest TLS server with `RequireAndVerifyClientCert`, node row insert,
|
||||
and mTLS probe. Has the most moving parts and the most assumptions (D-037
|
||||
ServerName, dual-EKU client cert, httptest HTTP/1.1 vs h2c quirks per
|
||||
integration_test.go:100-126). If D-037 is wrong in production (not in test,
|
||||
since the test uses `Name = "localhost"` matching the SAN), the network check
|
||||
fails for real deployments but the test passes — a false-positive.
|
||||
|
||||
**What could go catastrophically wrong:** The F-01 tick-boundary issue, if
|
||||
not caught, would cause `orca job list --watch` (table mode) to either hang
|
||||
(trying to collect a "full snapshot" that never completes) or render
|
||||
incomplete tables (rendering after each row instead of after a full tick).
|
||||
This is a user-visible broken feature shipped as "complete."
|
||||
|
||||
---
|
||||
|
||||
## Binding Decisions (G-series)
|
||||
|
||||
| ID | Decision | Rationale | Confidence | Verdict |
|
||||
|----|----------|-----------|------------|---------|
|
||||
| G-001 | Change `Watch` to `iter.Seq[[]*model.Job]` / `iter.Seq[[]*model.Node]` (full snapshot per tick) | F-01: per-row yield has no tick boundary; table mode needs full snapshot. Slice-per-tick makes D-028 literally true and simplifies both render modes. | 0.92 | ACCEPT |
|
||||
| G-002 | Watch must yield immediately on first iteration, then tick | F-02: current design waits 1s before first output. Unacceptable UX. | 0.95 | ACCEPT |
|
||||
| G-003 | P02 Wave 1 (02-01-01) must complete before P01 Wave 2 (01-02-04) — shared `internal/cli/node.go` | F-03: D-042 file-disjoint claim is false for `node.go`. | 0.90 | ACCEPT |
|
||||
| G-004 | D-037 ServerName = node.Name assumption is deferred; execution must add diagnostic context to handshake-fail errors | F-04: assumption is documented (0.80), failure is graceful, proper fix is out of v0.3 scope. | 0.78 | DEFER |
|
||||
| G-005 | `store.Open` runs migrations before integrity_check — acceptable | F-05: failure surfaces correctly as FAIL. | 0.85 | REJECT |
|
||||
| G-006 | Add `"delete"` event to JSON watch mode if G-001 is accepted | F-06: slice-per-tick makes delete events trivial. | 0.70 | DEFER |
|
||||
| G-007 | Widen test timing margins (10ms tick → generous insert/cancel margins) | F-07: 10ms ticker under CI load is fragile. | 0.75 | DEFER |
|
||||
| G-008 | `-race` does not detect goroutine leaks — claim is imprecise but risk is zero by design | F-08: no goroutine spawned. | 0.90 | REJECT |
|
||||
| G-009 | Document dual-EKU (server cert as client cert) in `probeHealthz` + ARCHITECTURE.md | F-09: valid but undocumented. | 0.88 | DEFER |
|
||||
| G-010 | 1s poll ticker cadence is correct | F-10: justified by D-019. | 0.92 | REJECT |
|
||||
| G-011 | `watchInterval` package var is safe (no `t.Parallel` in store tests) | F-11: pragmatic, avoids leaking test API. | 0.85 | REJECT |
|
||||
| G-012 | `openDB()` is the single chokepoint for dbPath relocation — clarify in execution | F-12: plan is imprecise but correct. | 0.88 | DEFER |
|
||||
|
||||
---
|
||||
|
||||
## Escalations
|
||||
|
||||
None. All 12 findings are resolved with confidence ≥ 0.60 (either ACCEPT,
|
||||
REJECT, or DEFER). No axis requires human escalation.
|
||||
|
||||
---
|
||||
|
||||
## Overall Verdict
|
||||
|
||||
**PROCEED WITH CHANGES**
|
||||
|
||||
The plan is approved for execution **after** the 3 ACCEPT binding verdicts
|
||||
(G-001, G-002, G-003) are applied to `PLAN_v0.3.md`:
|
||||
|
||||
1. **G-001:** Change `Watch` element type to `iter.Seq[[]*model.Job]` /
|
||||
`iter.Seq[[]*model.Node]` (full snapshot per tick). Update tasks
|
||||
01-01-01, 01-01-02, 01-02-02, 01-02-03, 01-02-04, 01-01-04, and decisions
|
||||
D-026, D-028, D-046.
|
||||
2. **G-002:** Add "immediate first yield" to tasks 01-01-01, 01-01-02 and
|
||||
must-have criteria + test assertion in 01-01-04.
|
||||
3. **G-003:** Update D-042 and cross-phase notes: P02 Wave 1 (02-01-01)
|
||||
precedes P01 Wave 2 (01-02-04) due to shared `internal/cli/node.go`.
|
||||
|
||||
The 5 DEFER items (G-004, G-006, G-007, G-009, G-012) are execution-time
|
||||
refinements that do not block the plan.
|
||||
|
||||
The scope is right-sized (21 tasks across 5 waves, 2 execution phases + 1
|
||||
review phase). No requirements gaps exist between REQ-022/030/032 and the plan
|
||||
tasks. The no-new-dependencies promise holds. The persona territories are
|
||||
respected. The test strategy is adequate (with the timing-margin note in
|
||||
G-007). The plan does not violate the minimalist pillar.
|
||||
|
||||
**Confidence in verdict:** 0.88
|
||||
@@ -1,592 +0,0 @@
|
||||
# Grill Report: Orca v0.8 — Coverage & Trust Hardening
|
||||
|
||||
**Date:** 2026-08-04
|
||||
**Reviewer:** ci-griller (red-team, adversarial)
|
||||
**Plan under review:** `.ciagent/PLAN_v0.8.md` (commit 4780e4d)
|
||||
**Branch:** `phase/00-specify` (milestone `milestone/v0.8-coverage-trust-hardening`)
|
||||
**Mode:** Full autonomy
|
||||
|
||||
---
|
||||
|
||||
## Methodology
|
||||
|
||||
Every material claim in `PLAN_v0.8.md` and `RESEARCH_v0.8.md` was cross-checked
|
||||
against the actual codebase (verified coverage baselines via `go test -cover`,
|
||||
read `internal/proxmox/bootstrap.go:75-234`, `internal/security/ca.go`,
|
||||
`internal/doctor/doctor.go`, `.ciagent/ROADMAP.md`, `.ciagent/REQUIREMENTS.md`,
|
||||
PERSONAS, ARCHITECTURE) AND the `golang.org/x/crypto` v0.54.0 source for
|
||||
`knownhosts.New` / `checkAddr` behavior. The TOFU-capture claim was not taken
|
||||
on faith — the upstream `checkAddr` (knownhosts.go:370-385) was read directly.
|
||||
|
||||
Findings are scored on the 9 axes. Binding verdicts are **PROCEED**,
|
||||
**PROCEED-WITH-CONDITION** (plan proceeds but must incorporate a named change),
|
||||
or **REPLAN** (axis has a fatal flaw; revise before execution).
|
||||
|
||||
---
|
||||
|
||||
## Summary Verdict
|
||||
|
||||
| Verdict | Count |
|
||||
|---------|-------|
|
||||
| PROCEED | 7 |
|
||||
| PROCEED-WITH-CONDITION | 4 |
|
||||
| REPLAN | 0 |
|
||||
|
||||
**Overall verdict: PROCEED-WITH-CONDITION**
|
||||
|
||||
The v0.8 plan is fundamentally sound: scope is right-sized, the no-new-deps
|
||||
promise holds (verified `ssh.FingerprintSHA256` + `knownhosts.Line` are in the
|
||||
existing `golang.org/x/crypto` v0.54.0 dep), the tiered coverage floor (D-047)
|
||||
is realistic per-package with the named seams, and the persona territory
|
||||
collision on `internal/cli/node.go` is explicitly adjudicated in PERSONAS.md
|
||||
(backend owns implementation, lead owns `_test.go`). The 4 conditions below are
|
||||
**targeted correctness fixes**, not scope expansions:
|
||||
|
||||
1. **P02 must add a regression test asserting first-connect Proxmox join
|
||||
succeeds end-to-end** (the latent TOFU bug means v0.6's first-connect has
|
||||
been broken since ship; the fix in T02.6 is correct but must be proven by a
|
||||
test that would have failed pre-fix).
|
||||
2. **P03's verify-reqs regex must match `**COMPLETE**` as a *substring* within
|
||||
the bold span** (v0.2's header `**COMPLETE (merged to main via v0.3)**` is
|
||||
not matched by the current `\*\*COMPLETE\*\*` literal — a silent blind spot).
|
||||
3. **P03 must add a second assertion: every REQUIREMENTS row marked `Complete`
|
||||
must reference a milestone ROADMAP marks COMPLETE** (the reverse direction).
|
||||
The v0.7 `cert_repo_test.go` omission (REQ-053 marked Complete but the test
|
||||
file does not exist) proves forward-direction-only checks miss the most
|
||||
dangerous drift class: *claimed-Complete-but-actually-incomplete*.
|
||||
4. **P02 T02.6's TOFU fix must be reviewed against `doctor proxmox`'s callback
|
||||
(T02.9) as a paired change, not a follow-on** — they share the exact
|
||||
`knownhosts.New` defect; fixing one and not the other in the same phase
|
||||
creates an inconsistent trust surface.
|
||||
|
||||
With these 4 conditions applied, this plan is ready to execute. No REPLAN.
|
||||
|
||||
---
|
||||
|
||||
## Per-Axis Findings
|
||||
|
||||
### Axis 1 — Business Case
|
||||
|
||||
#### A1-F1 — Is v0.8 the right next milestone, or polish-for-polish's-sake?
|
||||
|
||||
**Evidence:**
|
||||
- v0.7 P03 (REQ-055) shipped a ≥50% coverage floor; v0.8 re-baselines six
|
||||
packages still under 50% (engine 8.3%, proxmox 5.1%, cli 27.6%, transport
|
||||
26.3%, store 47.2%, jobspec 47.6%) — **verified identical via `go test
|
||||
-cover`**.
|
||||
- RESEARCH §2.1 surfaces a **latent v0.6 defect**: `knownhosts.New` returns
|
||||
`KeyError{Want:[]}` on first connect and does NOT auto-write. Verified
|
||||
directly in `golang.org/x/crypto@v0.54.0/ssh/knownhosts/knownhosts.go:370-385`
|
||||
(`checkAddr` returns `&KeyError{}` with empty `Want` when no line matches).
|
||||
`bootstrap.go:140-142` treats this as a dial failure. **This means
|
||||
first-connect `orca node join --type proxmox` has been broken since v0.6
|
||||
shipped** (the v0.6 RESEARCH §A.5 claim that `knownhosts.New` "handles both
|
||||
capture and verify" was wrong).
|
||||
- `bootstrap.go:123` comment is literally false: "on first connect it captures
|
||||
the host key" — it does not.
|
||||
|
||||
**Confidence:** 0.90 that v0.8 is the right next milestone.
|
||||
**Verdict:** **PROCEED**. v0.8 is not polish-for-polish: it closes a real
|
||||
security defect (TOFU broken since v0.6), populates a `Result` field that D-045
|
||||
*assumed* was already populated (it isn't — `bootstrap.go:195-198`), and lifts
|
||||
coverage off floors that v0.7 explicitly under-shot. The diminishing-returns
|
||||
risk is real for the 3 zero-test toe-holds (audit/certpaths/cmd-orca), but
|
||||
D-047 tiered them to 50% precisely to avoid the rathole — that call is sound.
|
||||
|
||||
---
|
||||
|
||||
### Axis 2 — Scope and Requirements
|
||||
|
||||
#### A2-F1 — Is the TOFU bugfix correctly scoped into P02, or should it be a hotfix on main?
|
||||
|
||||
**Evidence:**
|
||||
- The TOFU capture bug (RESEARCH §2.1, PLAN T02.6) is a v0.6 latent defect,
|
||||
not a v0.8 feature. First-connect Proxmox join is broken **today on main**.
|
||||
- PLAN bundles the fix into P02 (trust hardening phase) alongside REQ-058
|
||||
(`--host-key-fingerprint`) and REQ-059 (`key-reset`).
|
||||
- ROADMAP tags run on the v0.7.x patch line: `v0.7.0` (P0) … `v0.7.4` (P04).
|
||||
P02 ships as `v0.7.2` — i.e., the fix lands on a milestone branch, not main,
|
||||
and only reaches main at P04 merge (`v0.7.4`).
|
||||
|
||||
**Confidence:** 0.62 that bundling into P02 is the right call (low confidence —
|
||||
this is a judgment call with real downside).
|
||||
**Verdict:** **PROCEED-WITH-CONDITION.** The fix is correctly designed (T02.6's
|
||||
`KeyError{Want:[]}` capture-and-persist is the right shape), but the plan must
|
||||
either (a) document explicitly *why* this isn't hotfixed on main (e.g., "no
|
||||
operator has hit first-connect yet because all deployments pre-populate
|
||||
`known_hosts` manually — confirmed by the v0.6 ship audit"), OR (b) flag the
|
||||
bug in the P04 audit as a v0.6 ship-defect with a post-mortem note. **The plan
|
||||
currently treats T02.6 as a feature task; it is a bugfix for shipped code and
|
||||
must be labeled as such** so the P04 audit can distinguish "new hardening" from
|
||||
"closing a v0.6 gap." Blast radius if T02.6's fix is wrong: every existing
|
||||
Proxmox node's `known_hosts` could be re-pinned on next join — moderate, but
|
||||
mitigated by T02.10 case 3/4/5 integration tests.
|
||||
|
||||
**Condition:** Add a note to T02.6 in PLAN marking it as a **v0.6 ship-defect
|
||||
bugfix** (not a v0.8 feature), and ensure P04 audit (T04.2) records it as such.
|
||||
|
||||
#### A2-F2 — Are the 3 zero-test packages worth a 50% toe-hold, or scope creep?
|
||||
|
||||
**Evidence:**
|
||||
- `cmd/orca` is 15 LOC of glue (`main()` → `cli.Execute()`). 50% coverage = ~7
|
||||
lines. RESEARCH §1.1, §5 pitfall #6 explicitly flags the effort:coverage
|
||||
ratio as poor.
|
||||
- `internal/certpaths` is 64 LOC of pure path-join functions. 50% is trivial.
|
||||
- `internal/audit` is 125 LOC, 4 exported funcs. 50% is trivial.
|
||||
- D-047 explicitly tiered these to 50% to avoid a coverage rathole; v0.9 can
|
||||
raise the floor.
|
||||
|
||||
**Confidence:** 0.85.
|
||||
**Verdict:** **PROCEED.** The tiered floor is the right call. The
|
||||
`cmd/orca` toe-hold is low-value but low-cost (one `run() int` refactor + one
|
||||
smoke test), and dropping it would leave a `covdata` tooling error in CI output
|
||||
that looks like a broken build to a casual reader. Keeping it at 50% is
|
||||
defensible.
|
||||
|
||||
#### A2-F3 — Scope size: 4 REQs, 37 tasks — too lean, too fat, or right?
|
||||
|
||||
**Evidence:**
|
||||
- 37 tasks, 36 must-haves, 4 phases each shipping a patch. Comparable to v0.7
|
||||
(5 phases, similar task density).
|
||||
- P01 is the heaviest (12 tasks, 9 packages) — the risk concentration is here.
|
||||
|
||||
**Confidence:** 0.80.
|
||||
**Verdict:** **PROCEED.** Right-sized for an NFR milestone. P01 density is the
|
||||
watch item (see Axis 5).
|
||||
|
||||
---
|
||||
|
||||
### Axis 3 — Architecture and Technical Feasibility
|
||||
|
||||
#### A3-F1 — Do the proxmox `sessionRunner` and engine `peerDispatcher` seams leak test concerns into production?
|
||||
|
||||
**Evidence:**
|
||||
- T01.1 `sessionRunner` (`internal/proxmox/bootstrap.go`): 1 interface,
|
||||
~10 LOC, `CombinedOutput(cmd) ([]byte, error)`. Default impl wraps
|
||||
`*ssh.Client.NewSession().CombinedOutput(...)`. Backward compatible —
|
||||
existing callers unchanged. This is the **same pattern as the existing
|
||||
`sshDialer` seam** (`bootstrap.go:201-213`), which shipped in v0.6 without
|
||||
concern. The seam is a standard testability extraction, not a test concern
|
||||
leak.
|
||||
- T01.2 `peerDispatcher` (`internal/engine/dispatcher.go`): **conditional** —
|
||||
only added if T01.4 cannot hit 70% via `httptest.NewTLSServer` alone. Plan
|
||||
explicitly prefers `httptest.NewTLSServer` (RESEARCH §1.3 gap #2, §5 pitfall
|
||||
#8). This is the right ordering: try the stdlib test fixture first, add the
|
||||
seam only if needed.
|
||||
|
||||
**Confidence:** 0.88.
|
||||
**Verdict:** **PROCEED.** Both seams are backward-compatible interface
|
||||
extractions matching an existing pattern (`sshDialer`). No test-concern leak.
|
||||
The conditional-gate on T01.2 is correctly conservative.
|
||||
|
||||
#### A3-F2 — Does P02's trust work stay within the existing security boundary?
|
||||
|
||||
**Evidence:**
|
||||
- P02 touches `internal/proxmox/bootstrap.go` (pinned callback, TOFU fix),
|
||||
`internal/cli/node.go` (flag + subcommand), `internal/security/sshkey.go`
|
||||
(fingerprint helper), `internal/doctor/doctor.go` (T02.9 TOFU fix). All
|
||||
within the existing SSH trust surface established in v0.6.
|
||||
- No new crypto, no new CA, no new X.509. `ssh.FingerprintSHA256` is in the
|
||||
existing `golang.org/x/crypto` v0.54.0 dep (verified: not a new direct dep).
|
||||
- PERSONAS correctly keeps `security-engineer` deactivated — the work is SSH
|
||||
dialer + known_hosts file manipulation, not new security architecture.
|
||||
|
||||
**Confidence:** 0.90.
|
||||
**Verdict:** **PROCEED.** Boundary is respected.
|
||||
|
||||
#### A3-F3 — T02.9 (doctor proxmox TOFU fix) is a paired change with T02.6, not a follow-on
|
||||
|
||||
**Evidence:**
|
||||
- `internal/doctor/doctor.go:412` uses the **exact same** `knownhosts.New(...)`
|
||||
callback pattern as `bootstrap.go:125`. Both share the latent defect.
|
||||
- T02.9 is listed as a separate task ("Apply the TOFU capture-fix to `doctor
|
||||
proxmox` probe") but is in the same Wave 2 as T02.6. If T02.6 lands and T02.9
|
||||
doesn't (e.g., a mid-phase blocker), the trust surface is **inconsistent**:
|
||||
join captures, doctor fails.
|
||||
|
||||
**Confidence:** 0.75.
|
||||
**Verdict:** **PROCEED-WITH-CONDITION.** T02.6 and T02.9 must be reviewed as a
|
||||
paired change in P02 verification — the phase is not done until BOTH callbacks
|
||||
use the capture-fix wrapper. Add to P02 Verification: "doctor proxmox
|
||||
first-connect → captures + succeeds (mirrors T02.10 case 3 for bootstrap)."
|
||||
|
||||
**Condition:** Add a P02 verification line asserting doctor proxmox
|
||||
first-connect parity with bootstrap.
|
||||
|
||||
---
|
||||
|
||||
### Axis 4 — People, Skills, and Organization
|
||||
|
||||
#### A4-F1 — Territory collision on `internal/cli/node.go`
|
||||
|
||||
**Evidence:**
|
||||
- PERSONAS.md line 62: lead-developer territory = `internal/cli/**`.
|
||||
- PERSONAS.md line 70: backend-engineer territory = `internal/cli/node.go`.
|
||||
- PERSONAS.md line 107 explicitly adjudicates: "backend owns the command
|
||||
implementation; lead owns the test files (`node_test.go`)."
|
||||
- Territory mode is `warn` (not `block`) — collisions log but don't fail.
|
||||
|
||||
**Confidence:** 0.82.
|
||||
**Verdict:** **PROCEED.** The collision is **explicitly adjudicated** in
|
||||
PERSONAS.md with a clean boundary (impl vs test files). This is the right
|
||||
answer. The `warn` mode means a backend commit touching `node_test.go` (or a
|
||||
lead commit touching `node.go` impl) would log — acceptable for a 3-persona
|
||||
team. No replan.
|
||||
|
||||
#### A4-F2 — Key-person dependency: is the 3-persona roster sufficient?
|
||||
|
||||
**Evidence:**
|
||||
- 3 active personas, all retained from v0.7. No phase-specific personas.
|
||||
- backend-engineer owns 60%+ of P02 (the security-critical phase). If
|
||||
backend-engineer is unavailable, P02 stalls entirely.
|
||||
|
||||
**Confidence:** 0.70.
|
||||
**Verdict:** **PROCEED.** Key-person risk is real but inherent to a 3-persona
|
||||
NFR milestone. The work is not novel (refining existing surface), so the bus
|
||||
factor is acceptable for hardening. Flagged, not blocking.
|
||||
|
||||
---
|
||||
|
||||
### Axis 5 — Timeline and Estimates
|
||||
|
||||
#### A5-F1 — Is the 70% coverage target for 6 packages in one phase (P01) realistic?
|
||||
|
||||
**Evidence:**
|
||||
- RESEARCH §1.1 + §1.4 per-package achievability assessments:
|
||||
- engine → 70% REALISTIC (with LocalExecutor stubs + `openTestDB`).
|
||||
- proxmox → 70% REALISTIC **but requires the `sessionRunner` seam (T01.1)** —
|
||||
without it, only 50-55% (validation paths + sudoersContent asserts, already
|
||||
done).
|
||||
- cli → 70% AMBITIOUS (17 files, ~2000 LOC); RESEARCH says "55-65% is more
|
||||
realistic for one phase" even with `daemon.go` excluded.
|
||||
- transport → 70% REALISTIC (`httptest.NewTLSServer` is standard).
|
||||
- store → 70% REALISTIC (cert_repo_test.go gap is the main lift).
|
||||
- jobspec → 70% REALISTIC (easiest of the six).
|
||||
- **`internal/cli` is the swing package.** RESEARCH explicitly says 55-65% is
|
||||
the realistic single-phase outcome, not 70%. The plan sets the floor at 70%
|
||||
"excluding daemon.go" — but even excluding daemon.go, RESEARCH's own evidence
|
||||
says 70% is a stretch.
|
||||
|
||||
**Confidence:** 0.65 (split: 5 of 6 packages at 0.85, cli at 0.45).
|
||||
**Verdict:** **PROCEED-WITH-CONDITION.** The plan must add an explicit fallback
|
||||
for `internal/cli`: if T01.6 hits ≥65% (excluding daemon.go) but not 70% after
|
||||
a reasonable effort, the phase ships at 65% with a documented note + a v0.9
|
||||
follow-up to lift to 70%. **Hard-requiring 70% on cli risks a coverage rathole
|
||||
that delays the entire milestone** (P02/P03 are gated on P01 ship). The other 5
|
||||
packages at 70% is realistic.
|
||||
|
||||
**Condition:** Add to T01.6 acceptance criterion: "If ≥65% (excluding
|
||||
daemon.go) is achieved but 70% is not after Wave 2 effort, document the gap in
|
||||
the task comment + record a v0.9 follow-up; ship at 65%. Do NOT block P02/P03
|
||||
on the last 5% of cli coverage." (This mirrors RESEARCH §1.4's own flag, which
|
||||
the plan currently does not carry forward as an escape valve.)
|
||||
|
||||
---
|
||||
|
||||
### Axis 6 — Budget and Financial Realism
|
||||
|
||||
#### A6-F1 — Zero new deps: is that realistic given P02's needs?
|
||||
|
||||
**Evidence:**
|
||||
- `ssh.FingerprintSHA256`: verified in `golang.org/x/crypto/ssh` (direct dep
|
||||
since v0.6 D-030).
|
||||
- `knownhosts.Line` / `Normalize` / `KeyError`: same `golang.org/x/crypto`
|
||||
module (already imported in `bootstrap.go:32` and `doctor.go:29`).
|
||||
- `verify-reqs`: stdlib only (`regexp`, `os`, `fmt`).
|
||||
- `go.mod` unchanged by v0.8 (PLAN line 62).
|
||||
|
||||
**Confidence:** 0.95.
|
||||
**Verdict:** **PROCEED.** Zero-new-deps is verified and realistic.
|
||||
|
||||
---
|
||||
|
||||
### Axis 7 — Risks, Assumptions, and Dependencies
|
||||
|
||||
#### A7-F1 — The 10 pitfalls: are mitigations real or hand-waves?
|
||||
|
||||
**Evidence (spot-check of the 4 most material pitfalls):**
|
||||
- **Pitfall #1 (TOFU broken):** Mitigation T02.6 is **concrete and correct** —
|
||||
wrap `knownhosts.New`, capture on `KeyError{Want:[]}` via `knownhosts.Line` +
|
||||
`security.WriteAtomic`, return nil. Verified against x/crypto v0.54.0
|
||||
`checkAddr` semantics. **Real mitigation.**
|
||||
- **Pitfall #2 (Result.HostKeyFingerprint never populated):** T02.7 adds
|
||||
`ssh.FingerprintSHA256(hostKey)`. 1-line once host key is available. **Real.**
|
||||
- **Pitfall #3 (no sessionRunner seam):** T01.1 adds it, ~10 LOC. **Real.**
|
||||
- **Pitfall #10 (writeAtomic unexported):** T02.2 exports it. Verified
|
||||
`ca.go:305` — `func writeAtomic(...)` is indeed unexported. **Real.**
|
||||
|
||||
**Confidence:** 0.88.
|
||||
**Verdict:** **PROCEED.** Mitigations are concrete, not hand-waves.
|
||||
|
||||
#### A7-F2 — TOFI bugfix blast radius if P02's fix is wrong
|
||||
|
||||
**Evidence:**
|
||||
- T02.6 changes the `HostKeyCallback` for every `orca node join --type proxmox`
|
||||
+ every `doctor proxmox` probe. If the capture-and-persist logic is wrong,
|
||||
every existing Proxmox node's `known_hosts` could be corrupted (e.g.,
|
||||
duplicate entries, wrong-format lines, partial writes on crash).
|
||||
- Mitigations: T02.10 integration tests (cases 3/4/5 cover first-connect,
|
||||
second-connect, mismatch); AD-029 atomic rewrite via `security.WriteAtomic`.
|
||||
- **Gap:** no test for "known_hosts already has an entry, join re-connects" —
|
||||
i.e., the idempotent re-run path after the fix. T02.10 case 4 covers
|
||||
second-connect-match, but not "known_hosts was written by the OLD (broken)
|
||||
code path and is now being read by the NEW code path."
|
||||
|
||||
**Confidence:** 0.70.
|
||||
**Verdict:** **PROCEED-WITH-CONDITION.** T02.10 must add a case for
|
||||
"known_hosts pre-populated in the expected format (e.g., from a manual
|
||||
`ssh-keyscan` or a prior v0.6 deployment that somehow succeeded) →
|
||||
second-connect matches + succeeds." This covers the migration path from
|
||||
v0.6's (broken) state to v0.8's fixed state.
|
||||
|
||||
**Condition:** Add T02.10 case 7: "known_hosts pre-populated with a valid
|
||||
OpenSSH line for the host → connect matches + succeeds (covers v0.6→v0.8
|
||||
migration)."
|
||||
|
||||
---
|
||||
|
||||
### Axis 8 — Governance, Decision-Making, and Communication
|
||||
|
||||
#### A8-F1 — Does `make verify-reqs` actually prevent drift, or is it cosmetic?
|
||||
|
||||
**Evidence:**
|
||||
- T03.1 regex (PLAN line 216):
|
||||
- ROADMAP milestone-complete: `^##\s*Milestone\s+v0\.\d+:.*—\s*\*\*COMPLETE\*\*`
|
||||
- REQUIREMENTS row: `^\|\s*(REQ-\d+)\s*\|.*?\|\s*\*\*(Complete|Pending)\*\*\s*\|`
|
||||
- **ROADMAP v0.2 header (line 23):** `## Milestone v0.2: Networking,
|
||||
Observability, Security Hardening — **COMPLETE (merged to main via v0.3)**`
|
||||
- The regex `\*\*COMPLETE\*\*` requires the literal `**COMPLETE**` with closing
|
||||
`**` immediately after `COMPLETE`. v0.2's header has `**COMPLETE (merged to
|
||||
main via v0.3)**` — the `**` closes after the parenthetical, NOT after
|
||||
`COMPLETE`. **The regex does NOT match v0.2 as complete.**
|
||||
- **Consequence:** all v0.2 REQs (REQ-011, 014, 023, 025-040) are **silently
|
||||
exempted** from the check. A stale v0.2 REQ-035 row (marked Pending) would
|
||||
NOT fail the gate.
|
||||
- **ROADMAP v0.6 has TWO headers** (line 92 without COMPLETE, line 94 with) —
|
||||
the regex matches line 94, but the duplicate is a markdown smell that could
|
||||
confuse the milestone→REQ mapping if the parser takes the first match.
|
||||
|
||||
**Confidence:** 0.92 (high — the regex mismatch is verifiable).
|
||||
**Verdict:** **PROCEED-WITH-CONDITION.** The regex must match `**COMPLETE**`
|
||||
as a *substring within the bold span*, not as a literal `**COMPLETE**` token.
|
||||
Change to `—\s*\*\*[^*]*COMPLETE[^*]*\*\*` (matches `**COMPLETE**`,
|
||||
`**COMPLETE (merged to main via v0.3)**`, and any future variant). Add a
|
||||
golden-file test case (T03.2) with the v0.2-style parenthetical header to
|
||||
prevent regression.
|
||||
|
||||
**Condition:** T03.1 regex changed to substring-match COMPLETE within the bold
|
||||
span; T03.2 adds a golden fixture with `**COMPLETE (merged to main via v0.3)**`.
|
||||
|
||||
#### A8-F2 — Is the single-direction check (ROADMAP→REQUIREMENTS) enough?
|
||||
|
||||
**Evidence:**
|
||||
- PLAN line 35-37 explicitly scopes out the reverse direction: "forward
|
||||
direction (ROADMAP-shipped → REQUIREMENTS Complete) is the priority per the
|
||||
v0.7 drift that motivated REQ-060."
|
||||
- **But the v0.7 drift had TWO symptoms:**
|
||||
1. ROADMAP said COMPLETE, REQUIREMENTS said Pending (forward drift — caught
|
||||
by the current check).
|
||||
2. **REQ-053 was marked Complete in REQUIREMENTS, but
|
||||
`internal/store/cert_repo_test.go` was never written** — verified: only
|
||||
`cert_repo.go` exists in `internal/store/`. The "Complete" status was
|
||||
false. **No markdown-based check can catch this** (it's a code-vs-doc
|
||||
drift, not a doc-vs-doc drift).
|
||||
- The reverse-direction check (REQUIREMENTS Complete ↔ ROADMAP COMPLETE) would
|
||||
catch a different class: a REQ marked Complete in REQUIREMENTS for a
|
||||
milestone ROADMAP does NOT mark COMPLETE (e.g., premature marking). This is
|
||||
a cheaper class of drift but still real.
|
||||
|
||||
**Confidence:** 0.78.
|
||||
**Verdict:** **PROCEED-WITH-CONDITION.** Add the reverse-direction assertion
|
||||
to T03.1 (it's ~10 LOC on top of the existing parser — same maps, just diff
|
||||
both ways). Document explicitly that **no markdown check can catch the
|
||||
code-vs-doc drift** (REQ-053 case) — that requires a code-level audit
|
||||
(`ciagent-audit` in P04). The plan should note this as a known limitation of
|
||||
REQ-060, not pretend the gate is complete.
|
||||
|
||||
**Condition:** T03.1 adds reverse-direction assertion; PLAN adds a note that
|
||||
REQ-060 catches doc-vs-doc drift only, not code-vs-doc (the REQ-053
|
||||
cert_repo_test.go case).
|
||||
|
||||
#### A8-F3 — Is there a "stop the project" trigger?
|
||||
|
||||
**Evidence:** P04 (T04.1-T04.9) is the final review + ship. No explicit
|
||||
"stop" trigger if P01 coverage stalls or P02 TOFU fix proves unfixable.
|
||||
|
||||
**Confidence:** 0.60.
|
||||
**Verdict:** **PROCEED.** The 4-phase structure with per-phase tags means a
|
||||
stall is visible (phase tag doesn't ship). Acceptable for an NFR milestone.
|
||||
|
||||
---
|
||||
|
||||
### Axis 9 — Change, Adoption, and Operational Readiness
|
||||
|
||||
#### A9-F1 — Who benefits from v0.8? Is there operator pull for `--host-key-fingerprint`?
|
||||
|
||||
**Evidence:**
|
||||
- `--host-key-fingerprint` (REQ-058) is operator-facing: pre-pinning a
|
||||
Proxmox host's SSH key before first join. This is the standard
|
||||
high-security-deployment pattern (the v0.6 D-035 caveat explicitly promised
|
||||
it as a "future enhancement").
|
||||
- `orca node key-reset` (REQ-059) is operator-facing: the `ssh-keygen -R`
|
||||
equivalent for orca's known_hosts.
|
||||
- The TOFU bugfix (T02.6) benefits **every operator who has tried
|
||||
first-connect Proxmox join since v0.6** — i.e., it fixes a feature that was
|
||||
advertised as working but wasn't.
|
||||
- Coverage uplift (REQ-057) is developer-facing (no operator pull).
|
||||
- verify-reqs (REQ-060) is internal-governance (no operator pull).
|
||||
|
||||
**Confidence:** 0.82.
|
||||
**Verdict:** **PROCEED.** The trust features have real operator pull
|
||||
(pre-pinning is a documented security best practice; the v0.6 caveat promised
|
||||
it). The coverage + hygiene work is internal-debt paydown — justified by the
|
||||
v0.7 under-shot, not by operator demand. The mix is appropriate for an NFR
|
||||
milestone.
|
||||
|
||||
#### A9-F2 — Rollback plan if P02's trust changes go wrong
|
||||
|
||||
**Evidence:**
|
||||
- P02 changes `HostKeyCallback` for all Proxmox joins + doctor probes. If the
|
||||
capture-fix corrupts `known_hosts`, the rollback is: revert the phase commit
|
||||
+ manually restore `known_hosts` from backup.
|
||||
- No data migration in P02 (known_hosts is a flat file; atomic rewrite via
|
||||
`WriteAtomic` preserves crash safety).
|
||||
- `key-reset` (T02.8) is local-only (D-046) — no remote side effects to
|
||||
reverse.
|
||||
|
||||
**Confidence:** 0.80.
|
||||
**Verdict:** **PROCEED.** Rollback is straightforward (revert + file restore).
|
||||
The atomic-rewrite requirement (AD-029) is the right mitigation.
|
||||
|
||||
---
|
||||
|
||||
## Binding Verdicts Table
|
||||
|
||||
| # | Axis | Finding | Verdict | Condition | Confidence |
|
||||
|---|------|---------|---------|-----------|------------|
|
||||
| A2-F1 | Scope | TOFU bugfix is a v0.6 ship-defect bundled into P02 as a feature task | PROCEED-WITH-CONDITION | Label T02.6 as a v0.6 bugfix in PLAN; P04 audit records it as a ship-defect closure | 0.62 |
|
||||
| A2-F2 | Scope | 3 zero-test packages at 50% toe-hold | PROCEED | — | 0.85 |
|
||||
| A2-F3 | Scope | 37 tasks / 4 phases size | PROCEED | — | 0.80 |
|
||||
| A1-F1 | Business | v0.8 is the right next milestone (not polish) | PROCEED | — | 0.90 |
|
||||
| A3-F1 | Architecture | sessionRunner + peerDispatcher seams do not leak test concerns | PROCEED | — | 0.88 |
|
||||
| A3-F2 | Architecture | P02 stays within existing security boundary | PROCEED | — | 0.90 |
|
||||
| A3-F3 | Architecture | T02.6 + T02.9 are paired changes (bootstrap + doctor share the defect) | PROCEED-WITH-CONDITION | Add P02 verification line for doctor proxmox first-connect parity with bootstrap | 0.75 |
|
||||
| A4-F1 | People | internal/cli/node.go territory collision adjudicated | PROCEED | — | 0.82 |
|
||||
| A4-F2 | People | Key-person risk on backend-engineer in P02 | PROCEED | — | 0.70 |
|
||||
| A5-F1 | Timeline | 70% cli coverage in one phase is a stretch (RESEARCH says 55-65%) | PROCEED-WITH-CONDITION | Add escape valve: ship cli at 65% if 70% not reached after Wave 2; do not block P02/P03 | 0.65 |
|
||||
| A6-F1 | Budget | Zero new deps verified | PROCEED | — | 0.95 |
|
||||
| A7-F1 | Risks | 10 pitfalls mitigations are concrete | PROCEED | — | 0.88 |
|
||||
| A7-F2 | Risks | TOFU fix blast radius — no migration-path test | PROCEED-WITH-CONDITION | Add T02.10 case 7: known_hosts pre-populated → second-connect matches (v0.6→v0.8 migration) | 0.70 |
|
||||
| A8-F1 | Governance | verify-reqs regex does not match v0.2's `**COMPLETE (merged...)**` header | PROCEED-WITH-CONDITION | Change regex to substring-match COMPLETE within bold span; add golden fixture | 0.92 |
|
||||
| A8-F2 | Governance | Single-direction check misses reverse drift + code-vs-doc drift (REQ-053 case) | PROCEED-WITH-CONDITION | Add reverse-direction assertion; document that code-vs-doc drift is out of scope for REQ-060 | 0.78 |
|
||||
| A8-F3 | Governance | No explicit "stop" trigger | PROCEED | — | 0.60 |
|
||||
| A9-F1 | Adoption | Operator pull exists for trust features; coverage/hygiene is internal debt | PROCEED | — | 0.82 |
|
||||
| A9-F2 | Adoption | Rollback plan is straightforward (revert + file restore) | PROCEED | — | 0.80 |
|
||||
|
||||
---
|
||||
|
||||
## Required Plan Changes (4 conditions)
|
||||
|
||||
1. **T02.6 labeling (A2-F1):** Add a note to T02.6 in `PLAN_v0.8.md` marking
|
||||
it as a **v0.6 ship-defect bugfix** (first-connect Proxmox join has been
|
||||
broken since v0.6 shipped due to `knownhosts.New` returning
|
||||
`KeyError{Want:[]}` with no capture-and-persist). P04 audit (T04.2) must
|
||||
record it as a ship-defect closure, not a v0.8 feature.
|
||||
|
||||
2. **P02 verification parity for doctor (A3-F3):** Add to Phase 2 Verification:
|
||||
"`doctor proxmox` first-connect on a node with empty known_hosts → captures
|
||||
the key + writes known_hosts + probe succeeds (mirrors T02.10 case 3 for
|
||||
bootstrap). T02.6 and T02.9 are a paired change; the phase is not complete
|
||||
until both callbacks use the capture-fix wrapper."
|
||||
|
||||
3. **T01.6 cli coverage escape valve (A5-F1):** Add to T01.6 acceptance
|
||||
criterion: "If ≥65% (excluding `daemon.go`) is achieved but 70% is not after
|
||||
Wave 2 effort, document the gap in a test-file comment + record a v0.9
|
||||
follow-up; ship P01 at 65% for cli. Do NOT block P02/P03 on the last 5% of
|
||||
cli coverage." (Carries forward RESEARCH §1.4's own flag as an explicit
|
||||
escape valve.)
|
||||
|
||||
4. **verify-reqs regex + reverse direction (A8-F1 + A8-F2):**
|
||||
- Change T03.1 ROADMAP-complete regex from
|
||||
`^##\s*Milestone\s+v0\.\d+:.*—\s*\*\*COMPLETE\*\*` to
|
||||
`^##\s*Milestone\s+v0\.\d+:.*—\s*\*\*[^*]*COMPLETE[^*]*\*\*` (substring
|
||||
match within the bold span — handles `**COMPLETE**`,
|
||||
`**COMPLETE (merged to main via v0.3)**`, and future variants).
|
||||
- Add T03.2 golden fixture: a ROADMAP with
|
||||
`**COMPLETE (merged to main via v0.3)**` → assert the milestone is
|
||||
detected as complete.
|
||||
- Add reverse-direction assertion to T03.1: every REQUIREMENTS row marked
|
||||
`**Complete**` must reference a milestone ROADMAP marks COMPLETE (catches
|
||||
premature-Complete drift).
|
||||
- Add a PLAN note: "REQ-060 catches doc-vs-doc drift only. Code-vs-doc
|
||||
drift (e.g., REQ-053 marked Complete but `cert_repo_test.go` missing —
|
||||
verified missing in v0.7 ship) is NOT caught by this gate; it requires
|
||||
the P04 `ciagent-audit` code-level review."
|
||||
|
||||
Additionally (lower-priority, from A7-F2):
|
||||
|
||||
5. **T02.10 case 7 (A7-F2):** Add integration test case: "known_hosts
|
||||
pre-populated with a valid OpenSSH line for the host (simulating a v0.6
|
||||
deployment or manual `ssh-keyscan`) → connect matches + succeeds. Covers
|
||||
the v0.6→v0.8 migration path."
|
||||
|
||||
---
|
||||
|
||||
## Escalations
|
||||
|
||||
None. All 9 axes resolved at confidence ≥ 0.60. No axis requires escalation to
|
||||
the operator; the 4 conditions are within the plan-author's authority to apply
|
||||
before P01 execution begins.
|
||||
|
||||
---
|
||||
|
||||
## What the Plan Is NOT Doing (and should it?)
|
||||
|
||||
- **Not lifting the 3 zero-test packages to 70%.** Correct per D-047 — deferred
|
||||
to v0.9. Not a gap.
|
||||
- **Not adding a `peerDispatcher` seam unless needed.** Correct — conditional
|
||||
on T01.4's 70% via `httptest.NewTLSServer`. Not a gap.
|
||||
- **Not pre-populating `known_hosts` from a remote keyscan API.** Correct —
|
||||
TOFU + manual `--host-key-fingerprint` cover the v0.8 surface. Not a gap.
|
||||
- **Not catching code-vs-doc drift in verify-reqs.** **Known limitation** —
|
||||
REQ-060 is a markdown-vs-markdown check. The REQ-053
|
||||
`cert_repo_test.go`-missing case proves this class of drift is real. P04
|
||||
`ciagent-audit` is the backstop. Documented in condition #4.
|
||||
|
||||
---
|
||||
|
||||
## Simplest 80%-of-the-value version
|
||||
|
||||
If forced to cut v0.8 to its smallest valuable form: **keep P02 (trust
|
||||
hardening + TOFU bugfix) and P03 (verify-reqs); drop P01's coverage uplift for
|
||||
the 3 zero-test packages + cli.** The TOFU bugfix alone (T02.6 + T02.9) fixes a
|
||||
shipped security defect — that's the highest-value work. The verify-reqs gate
|
||||
prevents the v0.7 drift from recurring. The coverage uplift on the 6
|
||||
under-50% packages is valuable but not urgent; the 3 zero-test toe-holds are
|
||||
the lowest-value work in the milestone. **The plan as written does not over-
|
||||
scope** — it includes all of the above because the marginal cost is low — but
|
||||
if P01 slips, the 3 toe-holds + cli are the first cuts to make.
|
||||
|
||||
---
|
||||
|
||||
## What Would Have to Be True for v0.8 to Succeed in the Next 90 Days
|
||||
|
||||
1. The `sessionRunner` seam (T01.1) unlocks proxmox 70% — **plausible** (same
|
||||
pattern as the existing `sshDialer` seam).
|
||||
2. `httptest.NewTLSServer` suffices for transport 70% without a new seam —
|
||||
**plausible** (standard Go testing fixture).
|
||||
3. The TOFU capture-fix (T02.6) is correct — **plausible** (verified against
|
||||
x/crypto v0.54.0 semantics; integration tests T02.10 cover the cases).
|
||||
4. `verify-reqs` regex matches all ROADMAP milestone header variants — **NOT
|
||||
true today** (v0.2 header mismatch — condition #4 fixes this).
|
||||
5. cli hits 70% in one phase — **NOT confirmed** (RESEARCH says 55-65%;
|
||||
condition #3 adds the escape valve).
|
||||
|
||||
(4) and (5) are the two conditions that move the plan from "optimistic" to
|
||||
"sound." Both are addressed by the 4 required changes.
|
||||
|
||||
---
|
||||
|
||||
**End of grill report.** Apply the 4 conditions to `PLAN_v0.8.md` before P01
|
||||
execution. No REPLAN; no escalations. Overall verdict: **PROCEED-WITH-
|
||||
CONDITION** (confidence 0.78).
|
||||
@@ -1,123 +0,0 @@
|
||||
# Ideation: Orca v0.7 — Hardening & Completion
|
||||
|
||||
Full autonomy mode: all ideas with confidence >= 0.60 are auto-accepted.
|
||||
The RESEARCH stage (commit `7c4b603`) surfaced 5 codebase gaps which are
|
||||
assessed below alongside 8 additional ideas generated by the 3-tier
|
||||
ideation process.
|
||||
|
||||
Total generated: 13 ideas (5 Tier 1 + 5 Tier 2 + 3 Tier 3) plus 5
|
||||
inherited research findings = 18 considered. 13 accepted (all >= 0.60),
|
||||
0 skipped, 0 deferred. 4 of the accepted ideas are implementation
|
||||
refinements with no new REQ; 4 map to the v0.7 REQs (REQ-053..056)
|
||||
already declared in SPECIFY; the research findings confirmed the v0.7
|
||||
scope.
|
||||
|
||||
## Tier 1: Mechanical Analysis (git + filesystem)
|
||||
|
||||
### 1.1 Git-Native Pattern Mining
|
||||
|
||||
- `git log --all --grep="lessons:"` — 1 lesson found (orch-engine P00
|
||||
config.json schema reference). No repeated lessons in orca's own
|
||||
history → no systemic process gap.
|
||||
- `git log --all --grep="escalation:"` — 0 escalations. The pipeline
|
||||
has run clean across v0.1–v0.6.
|
||||
- `git log --all --grep="compound:"` — 0 compound learnings.
|
||||
- Low-confidence decisions (confidence < 0.7): none in `---ci---`
|
||||
blocks. The lowest-confidence v0.7 decision is D-040 (pprof) at 0.85,
|
||||
above threshold.
|
||||
|
||||
### 1.2 Coverage Gap Analysis
|
||||
|
||||
| ID | Idea | Source | Confidence | Status | Maps to |
|
||||
|----|------|--------|------------|--------|---------|
|
||||
| I-401 | `orca cert` command tree is unreachable — `NewCommand` in `internal/cli/cert.go` is never AddCommand'd to `rootCmd` | research §1.1 + `grep -rn "rootCmd.AddCommand"` (cert absent) | 0.98 | Accepted | REQ-053 |
|
||||
| I-402 | `internal/store/cert_repo.go` has no test file — every other repo has one | research §1.2 + `ls internal/store/*_test.go` | 0.95 | Accepted | REQ-053 (P01 companion) |
|
||||
| I-403 | `internal/engine` coverage 8.3% — only `scheduler_test.go` exists; executor, dispatcher, peer untested | research §1.3 + `go test -cover` | 0.90 | Accepted | REQ-055 |
|
||||
| I-404 | `internal/transport` coverage 26.3% — only `idempotency_test.go`; mtls, dispatch, handshake_log untested | research §1.3 | 0.90 | Accepted | REQ-055 |
|
||||
| I-405 | `internal/audit` has no test files — Emit, EmitWithErr, LogHandshake* untested | research §1.3 + `ls internal/audit/*_test.go` | 0.88 | Accepted | REQ-055 |
|
||||
|
||||
### 1.3 Verification Layer Inversion (missing items)
|
||||
|
||||
- **Structural**: `internal/cli/cert.go` defines a command that is
|
||||
never wired in — a "documented but unreachable" component (I-401).
|
||||
- **Behavioral**: 4 packages below 50% coverage (I-403/404/405 + proxmox).
|
||||
- **Security**: no STRIDE gap — v0.7 adds no new trust boundary (pprof
|
||||
is operator-only, addr-gated; cert registration exposes existing
|
||||
security code).
|
||||
- **Quality**: no unresolved P1/P2 findings from v0.6 final review.
|
||||
|
||||
## Tier 2: Backend-Enriched Analysis
|
||||
|
||||
| ID | Idea | Source | Confidence | Status | Maps to |
|
||||
|----|------|--------|------------|--------|---------|
|
||||
| I-406 | HCL config file parser — `internal/config` package reusing `hclsimple.Decode` pattern from jobspec; D-009 promised it, never built | research §1.4 + D-009 | 0.92 | Accepted | REQ-054 |
|
||||
| I-407 | `--pprof <addr>` opt-in on `orca daemon` — I-308 deferred since v0.2; stdlib only, separate mux | research §1.5 + I-308 | 0.82 | Accepted | REQ-056 |
|
||||
| I-408 | Config precedence flag>env>file>default — table-driven test covering all 4 layers | backend-enriched (D-039) | 0.90 | Accepted | (refinement of REQ-054; no new REQ) |
|
||||
| I-409 | pprof on separate `*http.Server` + `*http.ServeMux`, never on mTLS daemon listener | backend-enriched (AD-024) | 0.90 | Accepted | (refinement of REQ-056; no new REQ) |
|
||||
| I-410 | CI coverage gate: `go test -cover ./internal/engine ./internal/transport ./internal/proxmox ./internal/audit` assert each ≥ 50% | backend-enriched (AD-025) | 0.85 | Accepted | (refinement of REQ-055; no new REQ) |
|
||||
|
||||
## Tier 3: Cross-Project Pattern Transfer
|
||||
|
||||
| ID | Idea | Source | Confidence | Status | Maps to |
|
||||
|----|------|--------|------------|--------|---------|
|
||||
| I-411 | `orca version --json` already outputs structured `{version, commit, go_version, build_time}` (I-307 accepted v0.2) — verify still works, no new REQ | cross-project (carry-forward from v0.2 I-307) | 0.80 | Accepted (verification only) | (no new REQ; confirm in P03) |
|
||||
| I-412 | `orca cert` registration via `init()` co-located in `cert.go` — matches the self-registering pattern in `daemon.go`/`audit.go` | cross-project (orca's own convention) | 0.88 | Accepted | (refinement of REQ-053; no new REQ) |
|
||||
| I-413 | No new direct dependencies in v0.7 — `net/http/pprof` (stdlib), `hashicorp/hcl/v2` (already direct) | cross-project (minimal-deps ethos) | 0.95 | Accepted | (constraint; no new REQ) |
|
||||
|
||||
## Research-stage findings (assessed)
|
||||
|
||||
| Finding | Verdict | Maps to |
|
||||
|---------|---------|---------|
|
||||
| cert command unreachable (§1.1) | **Accepted** (I-401) | REQ-053 (P01) |
|
||||
| cert_repo has no test (§1.2) | **Accepted** (I-402) | REQ-053 (P01) |
|
||||
| low coverage: engine/transport/proxmox/audit (§1.3) | **Accepted** (I-403/404/405) | REQ-055 (P03) |
|
||||
| no HCL config parser (§1.4) | **Accepted** (I-406) | REQ-054 (P02) |
|
||||
| pprof deferred since v0.2 (§1.5) | **Accepted** (I-407) | REQ-056 (P04) |
|
||||
|
||||
All 5 findings map to the v0.7 REQs declared in SPECIFY. The IDEATE
|
||||
stage confirms the scope and adds 8 implementation refinements
|
||||
(I-408..I-413) that inform the PLAN stage.
|
||||
|
||||
## Dropped ideas (confidence < 0.60)
|
||||
|
||||
None. The lowest-confidence accepted idea is I-407 (pprof) at 0.82.
|
||||
|
||||
## Accepted Ideas (auto-accepted, full autonomy)
|
||||
|
||||
13 ideas accepted (5 Tier 1 + 5 Tier 2 + 3 Tier 3). 4 map to net-new
|
||||
REQs (REQ-053..056, already declared in SPECIFY); 9 are implementation
|
||||
refinements recorded for the PLAN stage's benefit.
|
||||
|
||||
## Resulting REQ additions
|
||||
|
||||
| New REQ | Title | Phase | Source ideas |
|
||||
|---------|-------|-------|--------------|
|
||||
| REQ-053 | `orca cert` command tree registered + cert_repo tests | P01 | I-401, I-402, I-412 |
|
||||
| REQ-054 | HCL config file parsing (`internal/config`) | P02 | I-406, I-408 |
|
||||
| REQ-055 | Test coverage uplift — engine/transport/proxmox/audit ≥ 50% | P03 | I-403, I-404, I-405, I-410 |
|
||||
| REQ-056 | `--pprof <addr>` opt-in on `orca daemon` | P04 | I-407, I-409 |
|
||||
|
||||
**Total net-new REQs**: 4 (REQ-053..056). All declared in SPECIFY;
|
||||
IDEATE confirms mapping and adds implementation refinements.
|
||||
|
||||
## Deferred (recorded but not v0.7)
|
||||
|
||||
None. I-308 (pprof) is no longer deferred — it is REQ-056 in P04.
|
||||
|
||||
## Followup notes for PLAN stage
|
||||
|
||||
- **P01** is the highest-impact, lowest-effort phase: a 1-line
|
||||
`rootCmd.AddCommand` + a regression test + cert_repo_test.go. The
|
||||
smoke test should run `cert ca-init` + `cert gen` + `cert show` +
|
||||
`cert fingerprint` against a temp `ORCA_HOME` to catch any latent
|
||||
bugs in the never-exercised cert subcommands.
|
||||
- **P02** config package must be a pure function (`Load(paths) ->
|
||||
*Config`) with no package-level state. The `--config` flag on root
|
||||
command loads the file and passes the merged `*Config` down via
|
||||
cobra's `cmd.SetContext` or a struct field on the command.
|
||||
- **P03** coverage: target the interface seams (SSH dialer, peer
|
||||
client) for mocks; use `httptest.NewTLSServer` for transport. Any
|
||||
races uncovered by `-race` get fixed in P03, not deferred.
|
||||
- **P04** pprof: keep the daemon's mTLS listener untouched; start a
|
||||
second `http.Server` only when `--pprof` is non-empty. Log a WARN
|
||||
that the endpoint is unauthenticated.
|
||||
+89
-182
@@ -1,219 +1,126 @@
|
||||
---
|
||||
active:
|
||||
- lead-developer
|
||||
- backend-engineer
|
||||
- data-engineer
|
||||
deactivated:
|
||||
- cli-engineer
|
||||
- security-engineer
|
||||
- devops-engineer
|
||||
- network-engineer
|
||||
- frontend-engineer
|
||||
phase_specific: []
|
||||
reason: |
|
||||
Orca v0.8 is an NFR coverage & trust-hardening milestone. The work is
|
||||
test coverage uplift across 9 packages (P01), SSH trust-surface
|
||||
hardening in the existing proxmox + cli/node + security packages (P02),
|
||||
and a requirements-hygiene Go program + Makefile target (P03). No
|
||||
schema changes, no new security architecture, no packaging/distribution,
|
||||
no UI.
|
||||
|
||||
Roster changes vs v0.7:
|
||||
- lead-developer: RETAINED — owns cmd/orca smoke test, internal/cli
|
||||
coverage (cert/doctor/audit/status/version subcommands), and the
|
||||
cmd/verify-reqs Go program (coordination + glue-code territory).
|
||||
- backend-engineer: RETAINED — owns internal/transport + internal/engine
|
||||
tests (httptest.NewTLSServer, LocalExecutor stubs, PeerRegistry) and
|
||||
the SSH trust-surface in internal/proxmox/bootstrap.go (pinned
|
||||
host-key callback, TOFU capture fix, sessionRunner seam) plus
|
||||
internal/cli/node.go (--host-key-fingerprint flag, key-reset
|
||||
subcommand). Frameworks updated: connectrpc REMOVED (not in go.mod
|
||||
per AD-014), golang.org/x/crypto/ssh ADDED (direct dep since v0.6).
|
||||
- data-engineer: RETAINED — owns internal/store tests (cert_repo_test.go
|
||||
gap + coverage uplift), internal/audit tests (sqlite-backed
|
||||
audit_log asserts), internal/certpaths tests (path-join asserts),
|
||||
and internal/jobspec tests (golden HCL fixtures). Frameworks
|
||||
updated: modernc/sqlite + iter (matches actual go.mod).
|
||||
- security-engineer: remains DEACTIVATED — v0.8 refines the existing
|
||||
proxmox SSH trust surface (pinned callback, key-reset) but does NOT
|
||||
add new security architecture. The trust work is backend-engineer
|
||||
territory (it's SSH dialer + known_hosts file manipulation, not
|
||||
X.509/CA/crypto code).
|
||||
- cli-engineer: remains DEACTIVATED — merged into lead-developer
|
||||
(cli coverage is test-only; --host-key-fingerprint and key-reset
|
||||
are 1-flag + 1-subcommand additions to the existing node.go).
|
||||
- devops-engineer: remains DEACTIVATED — verify-reqs is a Go program
|
||||
(lead-developer territory), not a CI/packaging change. The
|
||||
.coreci.yml edit is a 3-line validate-pipeline hook.
|
||||
- network-engineer: remains DEACTIVATED — no transport/mTLS surface
|
||||
change (transport coverage is test-only on the existing mTLS layer).
|
||||
- frontend-engineer: remains DEACTIVATED — no web UI (unchanged
|
||||
from v0.1 onward).
|
||||
---
|
||||
|
||||
# Personas: Orca
|
||||
|
||||
## v0.8 persona assessment
|
||||
|
||||
### lead-developer
|
||||
- **Domain**: coordination
|
||||
- **Frameworks**: `cobra`, `net/http/httptest`, `testing`
|
||||
- **Constraints**: `boundary-enforcement`, `offline-first`, `no-redundant-implementations`, `coverage-floor-70`
|
||||
- **Territory**: `cmd/**`, `internal/cli/**`, `cmd/verify-reqs/**`, `Makefile`, `.coreci.yml`, `.ciagent/**`
|
||||
- **Active**: true
|
||||
- **Reason**: Owns P01 coverage for `cmd/orca` (smoke test of `main()`/`cli.Execute()`), `internal/cli` coverage for the non-node, non-daemon subcommands (`cert *`, `doctor *`, `audit list`, `status`, `version`), and the P03 `cmd/verify-reqs/main.go` Go program + `make verify-reqs` Makefile target + `.coreci.yml` validate-pipeline hook. Added `coverage-floor-70` constraint (D-047 tiered floor: 70% for the 6 under-50% packages, 50% for the 3 zero-test packages). Added `testing` + `net/http/httptest` to frameworks (test-only phase).
|
||||
|
||||
### backend-engineer
|
||||
- **Domain**: backend
|
||||
- **Frameworks**: `cobra`, `net/http`, `net/http/httptest`, `golang.org/x/crypto/ssh`, `golang.org/x/crypto/ssh/knownhosts`, `testing`
|
||||
- **Constraints**: `API-first`, `error-handling`, `minimal-dependencies`, `security-first`, `tofu-host-key-pinning`, `pinned-host-key-fail-closed`, `atomic-file-rewrite`, `coverage-floor-70`
|
||||
- **Territory**: `internal/transport/**`, `internal/engine/**`, `internal/proxmox/**`, `internal/cli/node.go`, `internal/daemon/**` (tests only)
|
||||
- **Active**: true
|
||||
- **Reason**: Owns P01 coverage for `internal/transport` (httptest.NewTLSServer for mTLS + stubDispatcher for DispatchClient) and `internal/engine` (LocalExecutor stubs + PeerRegistry in-memory tests). Owns P02 SSH trust hardening: `--host-key-fingerprint` pinned callback in `internal/proxmox/bootstrap.go` (D-045 OpenSSH SHA256:base64 format, AD-027/AD-028), the TOFU capture-fix (knownhosts.New returns KeyError{Want:[]} on first connect — must capture-and-persist via knownhosts.Line, AD-029 atomic rewrite), the `sessionRunner` seam refactor (P01 enabler for proxmox coverage), and `internal/cli/node.go` `--host-key-fingerprint` flag + `key-reset` subcommand (D-046 local known_hosts only). Frameworks updated: `connectrpc` REMOVED (not in go.mod per AD-014 — config.json still lists it but it's a stale entry), `golang.org/x/crypto/ssh` + `knownhosts` ADDED (direct dep since v0.6 D-030). Added `pinned-host-key-fail-closed` + `atomic-file-rewrite` + `coverage-floor-70` constraints.
|
||||
|
||||
### data-engineer
|
||||
- **Domain**: data
|
||||
- **Frameworks**: `modernc/sqlite`, `iter`, `hashicorp/hcl/v2`, `testing`
|
||||
- **Constraints**: `schema-first`, `migration-safe`, `local-storage-only`, `no-goroutine-leak`, `nullable-column-handling`, `coverage-floor-70`
|
||||
- **Territory**: `internal/store/**`, `internal/audit/**`, `internal/certpaths/**`, `internal/jobspec/**`, `internal/model/**`, `internal/store/migrations/**`
|
||||
- **Active**: true
|
||||
- **Reason**: Owns P01 coverage for `internal/store` (including the missing `cert_repo_test.go` — a v0.7 P01 leftover; Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + N=3 rotation history per REQ-025), `internal/audit` (sqlite-backed audit_log row asserts via `engine.Audit` + `store.AuditRepo`, slog capture via test handler), `internal/certpaths` (path-join asserts with temp dir + ORCA_HOME/ORCA_DB env), and `internal/jobspec` (golden-file HCL fixtures in a new `testdata/` dir + error-path table for Parse/Validate/ParseFile). Frameworks updated: `iter` + `hashicorp/hcl/v2` added (matches actual go.mod — jobspec uses hclsimple; store Watch uses iter.Seq). Added `coverage-floor-70` constraint.
|
||||
|
||||
### cli-engineer
|
||||
- **Active**: false (v0.8)
|
||||
- **Reason**: Deactivated — merged into lead-developer. The cli coverage work is test-only; `--host-key-fingerprint` and `key-reset` are a 1-flag and 1-subcommand addition to the existing `internal/cli/node.go`, not a new CLI subsystem.
|
||||
|
||||
### security-engineer
|
||||
- **Active**: false (v0.8)
|
||||
- **Reason**: Deactivated — v0.8 refines the existing proxmox SSH trust surface (pinned host-key callback, key-reset known_hosts rewrite) but does NOT add new security architecture (no new CA, no new X.509, no new crypto). The trust work is backend-engineer territory (SSH dialer + known_hosts file manipulation). The `internal/security/sshkey.go` is unchanged in v0.8. Was active in v0.6 (SSH keygen + sudoers), deactivated in v0.7, remains deactivated in v0.8.
|
||||
|
||||
### devops-engineer
|
||||
- **Active**: false (v0.8)
|
||||
- **Reason**: Deactivated — `verify-reqs` is a Go program (`cmd/verify-reqs/main.go`), not a CI/packaging change. The `.coreci.yml` edit is a 3-line validate-pipeline hook (lead-developer territory). No install.sh, Dockerfile, or release-pipeline surface in v0.8.
|
||||
|
||||
### network-engineer
|
||||
- **Active**: false (v0.8)
|
||||
- **Reason**: Deactivated — no transport/mTLS surface change. `internal/transport` coverage is test-only on the existing mTLS layer (httptest.NewTLSServer, no new TLS config). The SSH trust work is point-to-point bootstrap, not the mTLS mesh network-engineer owns.
|
||||
|
||||
### frontend-engineer
|
||||
- **Active**: false (v0.8)
|
||||
- **Reason**: No web UI in Orca (unchanged from v0.1 onward).
|
||||
|
||||
## Territory Enforcement
|
||||
|
||||
- **Mode**: `warn` (per `config.json`)
|
||||
- **Behavior**: Out-of-territory file changes log a warning but do not block.
|
||||
- **Key overlaps in v0.8** (lead-developer adjudicates):
|
||||
- `internal/cli/node.go` — backend-engineer (`--host-key-fingerprint` flag + `key-reset` subcommand + proxmox pass-through) vs lead-developer (cli coverage tests). Boundary: backend owns the command implementation; lead owns the test files (`node_test.go`).
|
||||
- `internal/proxmox/bootstrap.go` — backend-engineer (pinned callback, TOFU fix, sessionRunner seam) vs data-engineer (no overlap — proxmox has no store/audit code). Clean boundary.
|
||||
- `cmd/verify-reqs/main.go` — lead-developer (Go program + Makefile + .coreci.yml) vs data-engineer (no overlap — verify-reqs parses markdown, not DB). Clean boundary.
|
||||
- `internal/store/cert_repo_test.go` — data-engineer (test file) vs backend-engineer (no overlap — cert_repo is data territory). Clean boundary.
|
||||
|
||||
## v0.8 vs v0.7 Persona Diff
|
||||
|
||||
| Change | Rationale |
|
||||
|--------|-----------|
|
||||
| `lead-developer` retained | Owns cmd/orca smoke test, internal/cli coverage (non-node subcommands), cmd/verify-reqs Go program. |
|
||||
| `backend-engineer` retained | Owns internal/transport + internal/engine tests + SSH trust-surface in proxmox + cli/node. Frameworks corrected: connectrpc removed (not in go.mod), x/crypto/ssh added. |
|
||||
| `data-engineer` retained | Owns internal/store (cert_repo gap) + internal/audit + internal/certpaths + internal/jobspec tests. Frameworks corrected: iter + hcl/v2 added. |
|
||||
| `security-engineer` remains deactivated | v0.8 refines existing SSH trust surface, no new security architecture. |
|
||||
| `cli-engineer` remains deactivated | Merged into lead-developer (test-only + 1 flag + 1 subcommand). |
|
||||
| `devops-engineer` remains deactivated | verify-reqs is a Go program, not CI/packaging. |
|
||||
| `network-engineer` remains deactivated | No transport/mTLS surface change (test-only). |
|
||||
| `frontend-engineer` remains deactivated | No web UI. |
|
||||
|
||||
---
|
||||
|
||||
## v0.7 baseline (preserved for traceability)
|
||||
|
||||
---
|
||||
active_personas:
|
||||
- lead-developer
|
||||
- backend-engineer
|
||||
- data-engineer
|
||||
deactivated_personas:
|
||||
- cli-engineer
|
||||
- security-engineer
|
||||
- devops-engineer
|
||||
- network-engineer
|
||||
deactivated_personas:
|
||||
- frontend-engineer
|
||||
phase_specific: []
|
||||
- devops-sre
|
||||
phase_specific:
|
||||
- security-engineer
|
||||
- network-engineer
|
||||
- cli-engineer
|
||||
reason: |
|
||||
Orca v0.7 is an NFR hardening & completion milestone. The work is CLI
|
||||
registration (cert command), a new internal/config package, test
|
||||
coverage uplift across engine/transport/proxmox/audit, and an opt-in
|
||||
pprof endpoint on the daemon. No schema changes, no new security
|
||||
surface, no packaging/distribution, no UI.
|
||||
Orca is a CLI-first, offline-first orchestration engine with no web UI and
|
||||
a single-binary distribution model. The persona roster reflects this:
|
||||
|
||||
Roster changes vs v0.6:
|
||||
- data-engineer: RETAINED — owns cert_repo tests + store coverage.
|
||||
- security-engineer: DEACTIVATED — v0.7 adds no new security surface
|
||||
(pprof is operator-only, addr-gated; cert registration exposes
|
||||
existing security code, does not add new).
|
||||
- cli-engineer: DEACTIVATED — merged into lead-developer for v0.7
|
||||
(the cert registration is a 1-line AddCommand; config --config flag
|
||||
is root-command wiring, not a new CLI subsystem).
|
||||
- devops-engineer: DEACTIVATED — no packaging/distribution in v0.7.
|
||||
- lead-developer: coordination and task decomposition
|
||||
- backend-engineer: core engine and API handlers
|
||||
- data-engineer: SQLite state store and migrations
|
||||
- cli-engineer: Cobra subcommands and CLI UX
|
||||
- security-engineer: mTLS, cert lifecycle, audit logging, input validation
|
||||
- network-engineer: transport layer, dispatcher, peer-to-peer resilience
|
||||
|
||||
Deactivated:
|
||||
- frontend-engineer: no web UI in v0.1
|
||||
- devops-sre: no container/cloud integrations; release flow is
|
||||
handled by CoreCI (not a persona territory)
|
||||
|
||||
Phase-specific (v0.2):
|
||||
- security-engineer: P01 (mTLS/CA) + P02 (peer transport hardening)
|
||||
- network-engineer: P02 only (multi-node scheduling & dispatch)
|
||||
- cli-engineer: P04 only (--watch flag is a CLI concern)
|
||||
---
|
||||
|
||||
### lead-developer (v0.7)
|
||||
# Personas: Orca
|
||||
|
||||
## Roster
|
||||
|
||||
### lead-developer
|
||||
- **Domain**: coordination
|
||||
- **Frameworks**: `cobra`
|
||||
- **Constraints**: `boundary-enforcement`, `offline-first`, `no-redundant-implementations`
|
||||
- **Territory**: `**/*.go`, `cmd/**`, `internal/**`
|
||||
- **Active**: true
|
||||
- **Reason**: Coordination across P01/P02/P03. SSH/bootstrap touches security + cli + store + doctor — territory overlaps need adjudication (proxmox package boundary, doctor Proxmox check scaffolding).
|
||||
|
||||
### backend-engineer (v0.7)
|
||||
### backend-engineer
|
||||
- **Domain**: backend
|
||||
- **Frameworks**: `cobra`, `net/http`, `golang.org/x/crypto/ssh`
|
||||
- **Constraints**: `API-first`, `error-handling`, `minimal-dependencies`, `security-first`, `idempotent-bootstrap`
|
||||
- **Territory**: `**/api/**`, `**/*_handler*`, `**/*_handler.go`, `internal/daemon/**`, `internal/proxmox/**`, `internal/cli/init.go`
|
||||
- **Frameworks**: `cobra`, `net/http`
|
||||
- **Constraints**: `API-first`, `error-handling`, `minimal-dependencies`, `security-first`
|
||||
- **Territory**: `**/api/**`, `**/*_handler*`, `**/*_handler.go`, `internal/daemon/**`
|
||||
- **Active**: true
|
||||
- **Reason**: Owns the `orca init` full-bootstrap orchestration (CA + cert + db + localhost node, idempotent) and the `internal/proxmox/bootstrap.go` SSH session sequence (dial, deploy pubkey, useradd, pveum, sudoers, visudo validate). Added `idempotent-bootstrap` constraint (D-036 — re-run must be skip-and-refresh) and `golang.org/x/crypto/ssh` to frameworks.
|
||||
|
||||
### data-engineer (v0.7)
|
||||
### data-engineer
|
||||
- **Domain**: data
|
||||
- **Frameworks**: `modernc/sqlite`, `iter`
|
||||
- **Constraints**: `schema-first`, `migration-safe`, `local-storage-only`, `no-goroutine-leak`, `nullable-column-handling`
|
||||
- **Territory**: `**/store/**`, `**/model.go`, `**/migration*`, `migrations/**`, `internal/store/migrations/**`, `internal/model/node.go`
|
||||
- **Frameworks**: `modernc/sqlite`
|
||||
- **Constraints**: `schema-first`, `migration-safe`, `local-storage-only`
|
||||
- **Territory**: `**/store/**`, `**/model.go`, `**/migration*`, `migrations/**`, `internal/store/migrations/0004_certs.sql`
|
||||
- **Active**: true
|
||||
- **Reason**: Reactivated for v0.6. Owns migration `0006_node_kind_os.sql` (REQ-049 — nullable `kind`/`os` columns, backward-compatible) and `NodeRepo` schema extension (Insert/Get/List/Watch/scanNode column additions + new `GetByName`/`UpdateLastSeenAndOS` helpers). Added `nullable-column-handling` constraint (NULL → `""` in Go struct, not nil-deref).
|
||||
|
||||
### cli-engineer (v0.7)
|
||||
### cli-engineer (custom)
|
||||
- **Domain**: CLI/UX
|
||||
- **Frameworks**: `cobra`, `pflag`
|
||||
- **Constraints**: `discoverable-help`, `consistent-flag-naming`, `human-readable-output`, `machine-readable-json-flag`, `signal-handling`, `password-flag-redaction`
|
||||
- **Constraints**: `discoverable-help`, `consistent-flag-naming`, `human-readable-output`, `machine-readable-json-flag`
|
||||
- **Territory**: `cmd/**`, `internal/cli/**`, `internal/commands/**`
|
||||
- **Active**: true
|
||||
- **Reason**: Owns `orca init` multi-step bootstrap output UX (progress lines per step), `orca node join --type/--host/--user/--password/--proxmox-user/--proxmox-role` flag wiring, and `doctor os`/`doctor proxmox` subcommand wiring. Added `password-flag-redaction` constraint (D-031 — `--password` never echoed, prefer `$ORCA_PROXMOX_PASSWORD`, zero after use).
|
||||
- **Reason**: Orca is CLI-first; this persona ensures CLI quality and discoverability.
|
||||
|
||||
### security-engineer (v0.7)
|
||||
### security-engineer (custom)
|
||||
- **Domain**: security
|
||||
- **Frameworks**: `crypto/tls`, `crypto/x509`, `crypto/ed25519`, `golang.org/x/crypto/ssh`, `slog`
|
||||
- **Constraints**: `no-panic-in-production`, `structured-audit-logging`, `no-secret-in-logs`, `input-validation`, `least-privilege`, `tofu-host-key-pinning`, `noexec-sudoers`
|
||||
- **Territory**: `**/auth/**`, `**/audit/**`, `internal/security/**`, `internal/transport/**` (TLS config only), `internal/proxmox/**` (SSH + sudoers + PVE role)
|
||||
- **Frameworks**: `crypto/tls`, `crypto/x509`, `slog`
|
||||
- **Constraints**: `no-panic-in-production`, `structured-audit-logging`, `no-secret-in-logs`, `input-validation`, `least-privilege`
|
||||
- **Territory**: `**/auth/**`, `**/audit/**`, `internal/security/**`, `internal/transport/**` (TLS config only)
|
||||
- **Active**: true
|
||||
- **Reason**: Reactivated for v0.6. Owns `internal/security/sshkey.go` (Ed25519 keygen, 0600/0644 mode enforcement per REQ-033 spirit), TOFU host-key pinning via `knownhosts.New`, sudoers least-privilege design (NOEXEC on pct/qm, exclude pvesh, no NOEXEC on apt-get/dpkg), password redaction (D-031), and audit logging of all bootstrap/join actions (REQ-052). Added `tofu-host-key-pinning` and `noexec-sudoers` constraints. Co-owns `internal/proxmox/**` with backend-engineer (security owns SSH auth + sudoers content; backend owns the session orchestration).
|
||||
- **Reason**: mTLS, audit logging, and input validation are first-class concerns.
|
||||
- **Phase scope**: P01 (mTLS + internal CA), P02 (transport hardening for peer handshakes). Deactivates after P02 ships — P03/P04 have lighter security needs.
|
||||
|
||||
### devops-engineer (v0.7)
|
||||
- **Active**: false (v0.6)
|
||||
- **Reason**: Deactivated — v0.6 has no install.sh, Dockerfile, .coreci.yml, or release-pipeline surface. The Proxmox SSH bootstrap is backend + security work, not devops. Was active in v0.5 (distribution milestone).
|
||||
### network-engineer (custom, NEW in v0.2)
|
||||
- **Domain**: networking
|
||||
- **Frameworks**: `net/http`, `crypto/tls` (via `internal/security`), `iter`
|
||||
- **Constraints**: `connection-resilience`, `retry-with-backoff`, `graceful-disconnect`, `context-propagation`
|
||||
- **Territory**: `**/transport/**`, `**/engine/dispatcher*`, `**/engine/peer*`, `internal/engine/dispatcher.go`, `internal/transport/**`
|
||||
- **Active**: true
|
||||
- **Reason**: v0.2 introduces cross-node dispatch and peer-to-peer transport. This persona owns the transport layer, dispatcher, and peer lifecycle concerns that are distinct from the API-handler territory of `backend-engineer`.
|
||||
- **Phase scope**: P02 only. Deactivates after P02 ships.
|
||||
|
||||
### network-engineer (v0.7)
|
||||
- **Active**: false (v0.6)
|
||||
- **Reason**: v0.6 has no transport/mTLS surface. SSH is point-to-point bootstrap, not the mTLS mesh network-engineer owns.
|
||||
### frontend-engineer
|
||||
- **Active**: false
|
||||
- **Reason**: No web UI in v0.1.
|
||||
|
||||
### frontend-engineer (v0.7)
|
||||
- **Active**: false (v0.6)
|
||||
- **Reason**: No web UI in Orca (unchanged from v0.1 onward).
|
||||
### devops-sre
|
||||
- **Active**: false
|
||||
- **Reason**: No container/cloud integrations. Release flow is handled by CoreCI.
|
||||
|
||||
### v0.6 vs v0.5 Persona Diff (v0.7 baseline reference)
|
||||
## Territory Enforcement
|
||||
|
||||
| Change | Rationale |
|
||||
|--------|-----------|
|
||||
| `data-engineer` reactivated | Owns migration 0006 + NodeRepo schema extension (kind/os columns). |
|
||||
| `security-engineer` reactivated | Owns SSH keygen, TOFU host-key, sudoers, PVE role — first-class security surface. |
|
||||
| `devops-engineer` deactivated | v0.6 has no packaging/distribution surface. |
|
||||
| `network-engineer` remains deactivated | No transport/mTLS surface. |
|
||||
| `frontend-engineer` remains deactivated | No web UI. |
|
||||
- **Mode**: `warn` (per `config.json`)
|
||||
- **Behavior**: Out-of-territory file changes log a warning but do not block.
|
||||
- **Rationale**: Allows flexibility during early development; tighten to `strict` post-v0.1.
|
||||
|
||||
## Phase-Specific Personas (v0.2)
|
||||
|
||||
| Persona | Active in | Reason |
|
||||
|---------|-----------|--------|
|
||||
| `security-engineer` | P01, P02 | mTLS/CA in P01, transport hardening in P02. Lighter security needs in P03 (CI scanning) and P04 (streaming UX). |
|
||||
| `network-engineer` | P02 | Multi-node dispatch is a P02 concern only. P01 builds the transport primitives but P02 wires them into cross-node scheduling. |
|
||||
| `cli-engineer` | P04 | The `--watch` flag is a CLI surface; P01-P03 don't add new CLI commands. |
|
||||
|
||||
In full-autonomy mode, all personas are auto-accepted and the phase-scope
|
||||
assignments are applied automatically when a phase is committed.
|
||||
|
||||
## Migration from v0.1
|
||||
|
||||
- `backend-engineer` territory unchanged: `internal/daemon/**` still owns HTTP
|
||||
handlers. The new `internal/transport/**` package is shared with
|
||||
`network-engineer` but `transport` owns the *connection lifecycle* (dial,
|
||||
retry, close) while `daemon` owns the *request handlers*.
|
||||
- `data-engineer` territory expanded to include the new
|
||||
`internal/store/migrations/0004_certs.sql` migration in P01.
|
||||
- `security-engineer` territory extended from `internal/security/**` to
|
||||
include the TLS-config portion of `internal/transport/**` (the
|
||||
`NewServerTLSConfig` / `NewClientTLSConfig` helpers).
|
||||
- `cli-engineer` territory unchanged; the new `orca cert` subcommands in P01
|
||||
fall under the existing `internal/cli/**` glob.
|
||||
|
||||
@@ -1,74 +0,0 @@
|
||||
# Phase 1 Verification: Namespace Unification (v0.5 P1)
|
||||
|
||||
**Phase**: 1 (namespace unification)
|
||||
**Milestone**: v0.5 Distribution
|
||||
**Requirements covered**: REQ-041, REQ-042
|
||||
**Date**: 2026-08-03
|
||||
|
||||
## Structural Layer
|
||||
|
||||
- `gofmt -l .` → clean (no files need formatting).
|
||||
- `go vet ./...` → clean (no warnings).
|
||||
- `go build ./...` → succeeds.
|
||||
- New files: `internal/cli/namespace_test.go`, `docs/namespace.md`.
|
||||
- Modified files: `internal/cli/root.go`, `internal/cli/init.go`, `internal/store/store.go`.
|
||||
|
||||
## Behavioral Layer
|
||||
|
||||
### Unit tests (new)
|
||||
- `TestNamespaceDefaultsToUserHome` ✓ — empty `ORCA_HOME` → `~/.orca`.
|
||||
- `TestNamespaceHonorsORCAHOME` ✓ — `ORCA_HOME=/tmp/x` → `Dir()=/tmp/x`, `DBPath()=/tmp/x/orca.db`.
|
||||
- `TestInitHonorsORCAHOME` ✓ — `init` creates `$ORCA_HOME` dir.
|
||||
- `TestSystemFlagSetsORCAHOME` ✓ — `--system` sets `ORCA_HOME=/root/.orca`.
|
||||
- `TestSystemFlagConflictsWithORCAHOME` ✓ — `--system` + `ORCA_HOME=/custom` → error.
|
||||
- `TestInitJSONOutput` ✓ — `init --json` returns `{"path":"...","status":"initialized"}`.
|
||||
- `TestSystemFlagIsPersistent` ✓ — `--system` registered as persistent flag on `rootCmd`.
|
||||
|
||||
### Unit tests (regression — all pass)
|
||||
- `internal/cli/` (9.8s) ✓
|
||||
- `internal/store/` ✓
|
||||
- `internal/doctor/` ✓
|
||||
- `internal/daemon/` ✓
|
||||
- `internal/security/` ✓
|
||||
- `internal/engine/` ✓
|
||||
- `internal/jobspec/` ✓
|
||||
- `internal/transport/` ✓
|
||||
|
||||
### Manual e2e
|
||||
- `ORCA_HOME=/tmp/orca-test-user ./bin/orca init` → creates `/tmp/orca-test-user` ✓
|
||||
- `./bin/orca --system init` → creates `/root/.orca` ✓
|
||||
- `ORCA_HOME=/custom ./bin/orca --system init` → error "conflicts with ORCA_HOME" ✓
|
||||
- `./bin/orca version --json` → `{"version":"v0.4.1",...}` ✓
|
||||
|
||||
## Security Layer
|
||||
|
||||
- No new secret handling. The namespace unification moves path resolution
|
||||
but does not change cert/key file modes (0600/0644 per REQ-033 unchanged).
|
||||
- `--system` flag does not escalate privileges — it only changes the
|
||||
namespace root path. Running as non-root with `--system` will fail at
|
||||
`os.MkdirAll("/root/.orca")` with a permission error (expected).
|
||||
- No new network surface.
|
||||
|
||||
## Quality Layer
|
||||
|
||||
- **Backward compatibility**: empty `ORCA_HOME` + no `--system` → `~/.orca`
|
||||
(identical to pre-v0.5 behavior). All existing tests pass unmodified.
|
||||
- **Single source of truth**: `certpaths.Dir()` is the only namespace root
|
||||
resolver. `store.Open("")` and `init` both route through it.
|
||||
- **No redundant implementations**: the `--system` flag maps to `ORCA_HOME`
|
||||
rather than introducing a parallel path mechanism.
|
||||
- **Documentation**: `docs/namespace.md` covers default, `ORCA_HOME`, and
|
||||
`--system` with examples and resolution order.
|
||||
|
||||
## Must-Haves Checklist
|
||||
|
||||
- [x] `go test ./...` passes (including new namespace_test.go).
|
||||
- [x] `ORCA_HOME=/tmp/x orca init` creates `/tmp/x` (not `~/.orca`).
|
||||
- [x] `orca --system init` creates `/root/.orca` (when run as root).
|
||||
- [x] Empty `ORCA_HOME` + no `--system` → `~/.orca` (backward compat).
|
||||
- [x] `orca version --json` works (needed by install.sh in P2).
|
||||
|
||||
## Verdict
|
||||
|
||||
**PASS** — all 4 verification layers pass. REQ-041 and REQ-042 are
|
||||
satisfied. Ready to ship as `v0.4.2`.
|
||||
@@ -1,73 +0,0 @@
|
||||
# Phase 1 Verification — Orca v0.6 P01
|
||||
|
||||
**Phase**: P01 — `orca init` Full Bootstrap + Schema 0006
|
||||
**REQ Coverage**: REQ-047, REQ-048, REQ-049
|
||||
**Verification date**: 2026-08-03
|
||||
**Result**: ✅ PASS (all 4 layers)
|
||||
|
||||
## Structural Verification
|
||||
|
||||
- ✅ `go build ./...` — PASS (no compile errors)
|
||||
- ✅ `go vet ./...` — PASS (no vet warnings)
|
||||
- ✅ `gofmt -l .` — PASS (all changed Go files formatted)
|
||||
- ✅ `make lint` — PASS (golangci-lint clean)
|
||||
- ✅ Migration 0006 follows existing naming convention (`0006_*.sql`)
|
||||
- ✅ `model.Node` struct follows existing field/tag conventions
|
||||
- ✅ `NodeRepo` methods follow existing error-wrapping + `scanner` pattern
|
||||
|
||||
## Behavioral Verification
|
||||
|
||||
### REQ-047: `orca init` auto-provisions CA + server cert + DB + localhost node
|
||||
- ✅ `TestInit_FullBootstrap`: init creates namespace dir, CA (ca.crt 0644 + ca.key 0600), server cert, DB (migrations 0001..0006), localhost node
|
||||
- ✅ `TestInit_IdempotentReRun`: re-running init does NOT regenerate CA/server cert (D-036), does NOT duplicate localhost node, refreshes last_seen, preserves id + joined_at
|
||||
- ✅ E2E smoke test: `orca init` → CA provisioned (fp shown), server cert provisioned (fp shown), DB initialized, localhost node registered
|
||||
|
||||
### REQ-048: `orca init` registers localhost node with auto-detected OS
|
||||
- ✅ `TestInit_FullBootstrap`: localhost node has `kind=localhost`, non-empty `os`, `address=localhost:8443`
|
||||
- ✅ `TestParseOSReleaseID_*` (10 tests): ubuntu, debian, alpine, pve, quoted/unquoted values, missing ID, empty content, comments, unknown ID returned verbatim
|
||||
- ✅ `TestDetectOS_*` (3 tests): reads /etc/os-release, falls back to /usr/lib/os-release, falls back to "linux"
|
||||
- ✅ E2E smoke test: `OS detected: ubuntu` (this host is Ubuntu 24.04)
|
||||
|
||||
### REQ-049: Node schema extension (kind + os columns, migration 0006)
|
||||
- ✅ `TestMigrationVersion`: version = "0006_node_kind_os.sql"
|
||||
- ✅ `TestNodeRepo_KindOS_RoundTrip`: insert with kind/os → get returns them correctly
|
||||
- ✅ `TestNodeRepo_NullKindOS_EmptyString`: NULL columns → `""` in Go struct (no nil-deref)
|
||||
- ✅ `TestNodeRepo_GetByName`: found by name, ErrNotFound for missing
|
||||
- ✅ `TestNodeRepo_UpdateLastSeenAndOS`: refreshes last_seen + os, preserves id + joined_at (D-036)
|
||||
- ✅ Existing node tests still pass (backward compatible)
|
||||
- ✅ `TestDBCheck_IntegrityOK`: doctor db check reports migration 0006
|
||||
|
||||
## Security Verification
|
||||
|
||||
- ✅ CA key file mode 0600 enforced (`TestInit_FullBootstrap` checks mode)
|
||||
- ✅ CA cert + server cert mode 0644 enforced (via `security.WriteCert`/`writeAtomic`)
|
||||
- ✅ No secrets in logs (init output shows fingerprint prefixes, not full keys)
|
||||
- ✅ `--json` output excludes private key material (only fingerprints)
|
||||
- ✅ No new external dependencies (P1 is pure Go stdlib + existing deps)
|
||||
|
||||
## Quality Verification
|
||||
|
||||
- ✅ `go test -race -count=1 ./internal/store/... ./internal/cli/... ./internal/model/... ./internal/doctor/...` — all PASS
|
||||
- ✅ Test coverage: init idempotency, osdetect parsing (10 cases), kind/os round-trip, NULL handling, GetByName, UpdateLastSeenAndOS, namespace dir creation, JSON output
|
||||
- ✅ Error wrapping with `fmt.Errorf("...: %w", err)` (REQ-018 convention)
|
||||
- ✅ `context.Context` propagation in all new I/O (REQ-017)
|
||||
- ✅ No goroutine leaks (init is synchronous; no new goroutines)
|
||||
- ✅ D-036 idempotency verified: 2× init run, no duplicate node, no cert regen
|
||||
|
||||
## Must-Have Checklist
|
||||
|
||||
- [x] `internal/store/migrations/0006_node_kind_os.sql`
|
||||
- [x] `internal/model/node.go` — Kind + OS fields + NodeKind constants
|
||||
- [x] `internal/store/node_repo.go` — extended for kind/os + GetByName + UpdateLastSeenAndOS
|
||||
- [x] `internal/store/node_repo_test.go` — new tests for kind/os + helpers
|
||||
- [x] `internal/cli/osdetect.go` — detectOS() from /etc/os-release
|
||||
- [x] `internal/cli/osdetect_test.go` — 13 parsing + detection tests
|
||||
- [x] `internal/cli/init.go` — full bootstrap sequence
|
||||
- [x] `internal/cli/init_test.go` — idempotency + bootstrap tests
|
||||
- [x] `internal/cli/namespace_test.go` — updated for new JSON format
|
||||
- [x] `internal/doctor/doctor_test.go` — updated for migration 0006
|
||||
- [x] `internal/store/migrate_test.go` — updated for migration 0006
|
||||
|
||||
## Escalations
|
||||
|
||||
None. All 4 verification layers pass cleanly.
|
||||
@@ -1,67 +0,0 @@
|
||||
# Phase 1 Verification Report — v0.7: Register `orca cert` Command Tree
|
||||
|
||||
**Phase**: 1
|
||||
**Branch**: `phase/01-cert-register`
|
||||
**REQ Coverage**: REQ-053
|
||||
**Milestone**: v0.7 (Hardening & Completion)
|
||||
|
||||
## Structural Verification
|
||||
|
||||
### Files Modified
|
||||
- `internal/cli/cert.go` — added `init()` registering `NewCommand` on `rootCmd` (AD-022)
|
||||
- `internal/cli/init_test.go` — updated expected migration version 0006 → 0007
|
||||
- `internal/doctor/doctor_test.go` — relaxed DB check assertion to check `"migrations up to"` prefix (migration-version-agnostic)
|
||||
- `internal/store/migrate_test.go` — updated expected migration version 0006 → 0007
|
||||
|
||||
### Files Created
|
||||
- `internal/cli/cert_test.go` — regression test for cert command registration + subcommand tree
|
||||
- `internal/cli/cert_smoke_test.go` — end-to-end smoke test (ca-init, gen, show, fingerprint, renew, file modes)
|
||||
- `internal/store/cert_repo_test.go` — 11 tests covering Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + error paths
|
||||
- `internal/store/migrations/0007_certs_serial_unique.sql` — UNIQUE index on `certs.serial_hex` (I-107; migration-driven, not backfilled into 0004)
|
||||
|
||||
## Behavioral Verification
|
||||
|
||||
### Test Results
|
||||
```
|
||||
go test ./... → all PASS (exit 0)
|
||||
go test -race ./... → all PASS (exit 0)
|
||||
go vet ./... → clean
|
||||
make build → clean (v0.6.0)
|
||||
```
|
||||
|
||||
### Coverage (store package)
|
||||
- Store total: 60.5% (up from 46.9%)
|
||||
- `cert_repo.go`: Insert 91.7%, Get 100%, LatestForKind 100%, PruneOlderThan 85.7%, Delete 85.7%, List/ListByNode 81.8%
|
||||
|
||||
### CLI Smoke Test (manual)
|
||||
```
|
||||
./bin/orca cert → prints help (was: "unknown command")
|
||||
./bin/orca cert ca-init --cn X → ✓ CA initialized, 0644/0600 modes
|
||||
./bin/orca cert fingerprint --which ca → 64-char hex SHA-256
|
||||
```
|
||||
|
||||
## Security Verification
|
||||
|
||||
- `orca cert show` redacts private key material (REQ-035) — verified in smoke test
|
||||
- Cert file modes enforced: 0600 keys, 0644 certs (REQ-033) — verified in smoke test
|
||||
- No secrets in logs — `cert.ca_init`/`cert.issued`/`cert.renewed` log events contain only fingerprints, never key bytes
|
||||
- Migration 0007 is additive (UNIQUE index), backward-compatible — no data loss
|
||||
|
||||
## Quality Verification
|
||||
|
||||
- No new dependencies added (`go.mod` unchanged)
|
||||
- No comments added (per project convention)
|
||||
- Test style matches existing `node_repo_test.go` / `root_test.go` patterns
|
||||
- All `---ci---` blocks present in commits
|
||||
|
||||
## Must-Haves Checklist
|
||||
|
||||
- [x] `internal/cli/cert.go` — `init()` with `rootCmd.AddCommand(NewCommand(slog.Default()))`
|
||||
- [x] `internal/cli/cert_test.go` — regression test for registration + subcommands
|
||||
- [x] `internal/cli/cert_smoke_test.go` — e2e: ca-init, gen, show (redaction), fingerprint, renew, file modes
|
||||
- [x] `internal/store/cert_repo_test.go` — 11 tests covering full CRUD + rotation history + duplicate serial
|
||||
- [x] `internal/store/migrations/0007_certs_serial_unique.sql` — UNIQUE index (I-107)
|
||||
|
||||
## Verdict
|
||||
|
||||
**PASS** — all 4 verification layers (structural, behavioral, security, quality) pass. REQ-053 is fully covered. The `orca cert` command tree is now reachable from the CLI, cert_repo has comprehensive tests, and the serial_hex UNIQUE constraint is enforced via migration.
|
||||
@@ -1,55 +0,0 @@
|
||||
# Phase 1 Verification — v0.8 Coverage & Trust Hardening
|
||||
|
||||
**Phase**: P01 — Coverage uplift round 2
|
||||
**Milestone**: v0.8
|
||||
**REQ**: REQ-057
|
||||
**Date**: 2026-08-04
|
||||
**Result**: ✅ PASS (all 4 layers)
|
||||
|
||||
## Layer 1 — Structural ✅
|
||||
|
||||
- `go build ./...` PASS (no compile errors)
|
||||
- `go vet ./...` PASS (no warnings)
|
||||
- No TODOs/FIXMEs/stubs in production code (the 3 pre-existing placeholders in `internal/cli/job.go:78`, `internal/engine/scheduler.go:115`, `internal/security/tls_config.go:90` are unchanged from v0.7 and out of scope for P01)
|
||||
- All test files resolve imports correctly
|
||||
- The proxmox `sessionRunner` seam (T01.1) is backward compatible — `BootstrapProxmox` callers unchanged
|
||||
|
||||
## Layer 2 — Behavioral ✅
|
||||
|
||||
- `go test ./...` PASS (all 14 packages)
|
||||
- `go test -race ./...` PASS (cli 98s, engine 47s, store 88s, transport 22s, all others fast)
|
||||
- Coverage targets met (T01.12):
|
||||
- ≥70% floor: engine 88.9%, proxmox 87.1%, cli 76.2%, transport 93.0%, store 84.7%, jobspec 90.5%
|
||||
- ≥50% floor: audit 100.0%, certpaths 100.0%, cmd/orca 80.0%
|
||||
- GRILL condition #3 escape valve NOT needed (cli hit 76.2%, above 70%)
|
||||
- T01.2 (conditional `peerDispatcher` seam) NOT added — engine reached 88.9% via httptest + stubs
|
||||
- REQ-057 covered: all 9 target packages hit their tiered floor
|
||||
|
||||
## Layer 3 — Security ✅
|
||||
|
||||
- P01 is a test-only phase (the only production change is T01.1's `sessionRunner` interface extraction + T01.11's `main()→run()` refactor)
|
||||
- No new input paths, no new network surfaces, no new crypto
|
||||
- The `sessionRunner` seam does not leak test concerns into production (default `sshSessionRunner` wraps the real SSH session; the seam is only injectable via the package-level var pattern matching `sshDialer`)
|
||||
- `cmd/orca/main.go` refactor: `run() int` returns exit code; `main()` calls `os.Exit(run())` — no security impact (same behavior, testable)
|
||||
- No secrets in test code (all test DBs use `:memory:` or temp dirs; no real credentials)
|
||||
|
||||
## Layer 4 — Quality ✅
|
||||
|
||||
- Tests follow existing conventions (table-driven, `t.Run` subtests, `t.Helper()` in setup funcs)
|
||||
- Reuse of existing helpers: `openTestDB`, `withFastWatch`, `initTestEnv`, `resetRootFlags`, `discardWriter`, `stubDispatcher` pattern
|
||||
- No flaky tests detected (all pass on repeated runs with `-race`)
|
||||
- Test file naming follows `*_test.go` convention
|
||||
- No over-testing: daemon.go excluded from cli coverage (covered by `internal/daemon/server_test.go`)
|
||||
- P0 issues: none. P1+ issues: none flagged.
|
||||
|
||||
## Requirement Coverage
|
||||
|
||||
| REQ | Status | Evidence |
|
||||
|-----|--------|----------|
|
||||
| REQ-057 | ✅ Complete | All 9 packages hit tiered floor; `go test -cover` confirms; `go test -race` PASS |
|
||||
|
||||
## Lessons
|
||||
|
||||
- The `sessionRunner` seam pattern (package-level var + default init in entry func) is the canonical way to add testability to orca's SSH-dependent packages. Future SSH-adjacent packages should follow it.
|
||||
- `httptest.NewTLSServer` sufficed for engine 70% without needing the conditional `peerDispatcher` seam — the plan's "only if needed" guard worked as intended.
|
||||
- The cli package's 84s test time is dominated by `--watch` integration tests with real poll intervals. Future coverage work should consider reducing the `withFastWatch` interval further or extracting the watch logic for unit-level testing.
|
||||
@@ -1,85 +0,0 @@
|
||||
# Phase 2 Verification: install.sh + In-Place Update (v0.5 P2)
|
||||
|
||||
**Phase**: 2 (install.sh + in-place update)
|
||||
**Milestone**: v0.5 Distribution
|
||||
**Requirements covered**: REQ-043, REQ-044, REQ-016 (completion)
|
||||
**Date**: 2026-08-03
|
||||
|
||||
## Structural Layer
|
||||
|
||||
- `gofmt -l .` → clean.
|
||||
- `go vet ./...` → clean.
|
||||
- `go build ./...` → succeeds.
|
||||
- New files: `scripts/install.sh`, `scripts/install_test.sh`, `docs/install.md`.
|
||||
- Modified files: `README.md`.
|
||||
- `install.sh` is executable (`chmod +x`).
|
||||
|
||||
## Behavioral Layer
|
||||
|
||||
### install_test.sh — 8/8 tests pass
|
||||
|
||||
Run via `timeout 120 bash scripts/install_test.sh`:
|
||||
|
||||
1. **Test 1: user-level install (v0.4.1)** ✓
|
||||
- Binary at `~/.local/bin/orca` ✓
|
||||
- `orca version --json` returns `v0.4.1` ✓
|
||||
2. **Test 2: in-place update (v0.4.1 → v0.4.2) preserves namespace** ✓
|
||||
- "updated orca from v0.4.1 to v0.4.2" message printed ✓
|
||||
- `~/.orca/orca.db` content preserved ("preserve-me") ✓
|
||||
- Binary version updated to `v0.4.2` ✓
|
||||
3. **Test 3: idempotent re-install (v0.4.2 → v0.4.2)** ✓
|
||||
- "reinstalled orca v0.4.2" message printed ✓
|
||||
4. **Test 4: --system install (root)** ✓
|
||||
- Binary at `/usr/local/bin/orca` ✓
|
||||
- Reports `namespace root: /root/.orca` ✓
|
||||
5. **Test 5: --system without root** — SKIP (running as root)
|
||||
|
||||
### Manual e2e (real Gitea releases)
|
||||
- `curl -fsSL ... | bash` downloads v0.4.2 tarball, extracts, installs ✓
|
||||
- Re-run updates binary; namespace dir untouched ✓
|
||||
- `--version v0.4.1` pins to v0.4.1 ✓
|
||||
|
||||
### Regression — Go tests
|
||||
- `internal/cli/` ✓ (cached, no regressions from P1)
|
||||
- `internal/store/` ✓
|
||||
- `internal/doctor/` ✓
|
||||
|
||||
## Security Layer
|
||||
|
||||
- `install.sh` does not `eval` remote content — it downloads a tarball
|
||||
and extracts it with `tar -xzf`.
|
||||
- No secrets in the script. `GITEA_TOKEN` is not required (public repo,
|
||||
anonymous download per REQ-045).
|
||||
- `.env` is not referenced by install.sh.
|
||||
- The script uses `set -euo pipefail` for fail-fast safety.
|
||||
- `curl -fsSL` fails on HTTP errors (no silent 404 downloads).
|
||||
|
||||
## Quality Layer
|
||||
|
||||
- **1-liner install**: `curl -fsSL <url> | bash` works (verified).
|
||||
- **--system flag**: installs to `/usr/local/bin`, namespace `/root/.orca`,
|
||||
requires root (errors otherwise).
|
||||
- **--version pinning**: `--version vX.Y.Z` queries the specific release tag.
|
||||
- **In-place update (REQ-044)**: detects existing binary, reads version via
|
||||
`orca version --json`, prints update message, overwrites binary, preserves
|
||||
namespace dir. Idempotent.
|
||||
- **Env-overridable**: `GITEA_URL`, `GITEA_OWNER`, `GITEA_REPO` honor
|
||||
pre-set env vars (`${VAR:-default}`) for testability.
|
||||
- **Timeout-guarded**: test harness uses `timeout 30` per test + `timeout 120`
|
||||
overall + `trap 'kill 0' EXIT` to prevent orphaned processes.
|
||||
- **Documentation**: `docs/install.md` covers user/system install, version
|
||||
pinning, in-place update, uninstall, and troubleshooting. README quickstart
|
||||
updated with the 1-liner (REQ-016 completion).
|
||||
|
||||
## Must-Haves Checklist
|
||||
|
||||
- [x] `bash scripts/install_test.sh` passes (8/8).
|
||||
- [x] `curl -fsSL <url> | bash` works on a fresh system.
|
||||
- [x] `curl -fsSL <url> | bash -s -- --system` installs to `/usr/local/bin` (as root).
|
||||
- [x] Re-running updates the binary; `~/.orca/orca.db` preserved.
|
||||
- [x] README quickstart documents the 1-liner + `--system` variant.
|
||||
|
||||
## Verdict
|
||||
|
||||
**PASS** — all 4 verification layers pass. REQ-043, REQ-044, and REQ-016
|
||||
(completion) are satisfied. Ready to ship as `v0.4.3`.
|
||||
@@ -1,86 +0,0 @@
|
||||
# Phase 2 Verification — Orca v0.6 P02
|
||||
|
||||
**Phase**: P02 — Proxmox SSH Join
|
||||
**REQ Coverage**: REQ-050, REQ-051
|
||||
**Verification date**: 2026-08-03
|
||||
**Result**: ✅ PASS (all 4 layers; integration test against real PVE deferred — unit tests cover all logic)
|
||||
|
||||
## Structural Verification
|
||||
|
||||
- ✅ `go build ./...` — PASS
|
||||
- ✅ `go vet ./...` — PASS
|
||||
- ✅ `gofmt -l .` — PASS (all Go files formatted)
|
||||
- ✅ `make lint` — PASS
|
||||
- ✅ `golang.org/x/crypto v0.54.0` added as direct dep (D-030); transitive: x/sys v0.47.0, x/term v0.45.0
|
||||
- ✅ `internal/proxmox` new package follows existing package layout conventions
|
||||
- ✅ `internal/security/sshkey.go` follows the CAInit pattern (idempotent fast-path, writeAtomic, mode enforcement)
|
||||
|
||||
## Behavioral Verification
|
||||
|
||||
### REQ-050: Proxmox SSH bootstrap via golang.org/x/crypto/ssh
|
||||
- ✅ `TestGenerateOrLoadSSHKey_Generates`: Ed25519 keygen, 0600/0644 modes, ssh-ed25519 pub format, ssh.ParsePrivateKey round-trip
|
||||
- ✅ `TestGenerateOrLoadSSHKey_IdempotentLoad`: second call loads existing (D-036)
|
||||
- ✅ `TestGenerateOrLoadSSHKey_CreatesDir`: nested dir creation
|
||||
- ✅ `TestBootstrapProxmox_Validation`: missing host → error, missing password → error
|
||||
- ✅ `TestDefaultOptions`: DefaultProxmoxUser=orca, DefaultProxmoxRole=OrcaOperator, DefaultSSHPort=22
|
||||
- ✅ CLI `--type proxmox --host ... --password ...` flag wiring verified via `orca node join --help`
|
||||
- ✅ Password from `--password` flag OR `$ORCA_PROXMOX_PASSWORD` env var (D-031)
|
||||
- ✅ TOFU host-key via `knownhosts.New` (D-035, avoids deprecated InsecureIgnoreHostKey)
|
||||
- ✅ File upload via session heredoc (no SFTP dep — D-030)
|
||||
|
||||
### REQ-051: OrcaOperator role + orca@pam user + sudoers
|
||||
- ✅ `TestSudoersContent`: NOEXEC on pct/qm, NOPASSWD on apt-get/dpkg (no NOEXEC), pvesh excluded from command lines (AD-020)
|
||||
- ✅ `TestSudoersContent_CustomUser`: custom user name works
|
||||
- ✅ `TestOrcaOperatorPrivileges`: exactly 3 privileges (VM.Audit, Datastore.AllocateSpace, SDN.Use) space-separated (D-033)
|
||||
- ✅ `orca@pam` realm (AD-019 — not @pve)
|
||||
- ✅ `pveum` commands use `--privs` (space-separated), probe-then-add idempotency pattern
|
||||
- ✅ `visudo -cf` validation step aborts bootstrap on syntax error
|
||||
- ✅ Node registered with kind=proxmox, os=pve
|
||||
|
||||
## Security Verification
|
||||
|
||||
- ✅ SSH private key mode 0600 enforced (TestGenerateOrLoadSSHKey_Generates)
|
||||
- ✅ SSH public key mode 0644 enforced
|
||||
- ✅ Password never persisted (D-031) — used only for SSH auth, zeroed after use
|
||||
- ✅ Password from env var preferred over flag (reduces ps/proc exposure)
|
||||
- ✅ pvesh excluded from sudoers (AD-020 — API execute bypasses NOEXEC)
|
||||
- ✅ NOEXEC on pct/qm (blocks shell escapes via dynamically-linked perl)
|
||||
- ✅ TOFU host-key pinning (D-035) — capture on first connect, verify on subsequent, fail closed on mismatch
|
||||
- ✅ No secrets in logs (audit log entries contain host, user, role — never password)
|
||||
- ✅ sudoers file mode 0440 enforced (sudo requirement)
|
||||
|
||||
## Quality Verification
|
||||
|
||||
- ✅ `go test -race -count=1 ./internal/proxmox/... ./internal/security/... ./internal/cli/...` — all PASS
|
||||
- ✅ Test coverage: sshkey (4 tests), proxmox (5 tests), sudoers content (2 tests), privileges (1 test), validation (1 test), defaults (1 test)
|
||||
- ✅ Error wrapping with `fmt.Errorf("...: %w", err)` (REQ-018)
|
||||
- ✅ `context.Context` propagation (REQ-017)
|
||||
- ✅ Idempotency: all bootstrap steps probe-before-add (D-036)
|
||||
- ✅ New direct dep: 1 (golang.org/x/crypto) — matches D-030 minimal-deps rationale
|
||||
|
||||
## Integration Test Note
|
||||
|
||||
A live integration test against a real Proxmox VE 8/9 host is out of
|
||||
scope for automated CI (requires a PVE host + credentials). The SSH
|
||||
bootstrap logic is tested via:
|
||||
- Unit tests for command builders (sudoers content, privilege set)
|
||||
- Unit tests for validation (missing host/password)
|
||||
- Unit tests for SSH key generation (Ed25519, modes, idempotency)
|
||||
- Manual verification via `orca node join --help` (flag surface)
|
||||
|
||||
A `// +build integration` test against a real PVE host can be added
|
||||
in a future phase if a PVE test environment becomes available.
|
||||
|
||||
## Must-Have Checklist
|
||||
|
||||
- [x] `go.mod` / `go.sum` — golang.org/x/crypto v0.54.0
|
||||
- [x] `internal/certpaths/certpaths.go` — SSHKeyPath, SSHPubPath, KnownHostsPath
|
||||
- [x] `internal/security/sshkey.go` — GenerateOrLoadSSHKey (Ed25519)
|
||||
- [x] `internal/proxmox/bootstrap.go` — BootstrapProxmox full SSH dance
|
||||
- [x] `internal/cli/node.go` — --type/--host/--password flag wiring + joinProxmox
|
||||
- [x] `internal/security/sshkey_test.go` — 4 tests
|
||||
- [x] `internal/proxmox/bootstrap_test.go` — 5 tests
|
||||
|
||||
## Escalations
|
||||
|
||||
None.
|
||||
@@ -1,68 +0,0 @@
|
||||
# Phase 2 Verification Report — v0.7: HCL Config File Parsing
|
||||
|
||||
**Phase**: 2
|
||||
**Branch**: `phase/02-config-parser`
|
||||
**REQ Coverage**: REQ-054
|
||||
**Milestone**: v0.7 (Hardening & Completion)
|
||||
|
||||
## Structural Verification
|
||||
|
||||
### Files Created
|
||||
- `internal/config/config.go` — `Config` struct (HCL tags), `CapacityConfig`, `Flags`, `Environ`, `Load(paths...)`, `(*Config).MergeOverrides(flags, env)`
|
||||
- `internal/config/config_test.go` — 11 tests (Load valid/missing/malformed/first-existing, MergeOverrides precedence all 4 layers, NodeCapacity)
|
||||
- `internal/config/testdata/config.hcl` — example fixture
|
||||
|
||||
### Files Modified
|
||||
- `internal/cli/root.go` — added `--config` persistent flag, `configCtxKey`, `configFromCtx` helper; `PersistentPreRunE` loads config if `--config` set (AD-023)
|
||||
- `internal/cli/daemon.go` — daemon uses `cfg.ListenAddr` from config when flag is at default (`:8080`) (D-039 precedence: flag > config)
|
||||
- `internal/cli/root_test.go` — added `TestConfigFlagRegistered` + `TestConfigFlagLoadsFile`
|
||||
|
||||
## Behavioral Verification
|
||||
|
||||
### Test Results
|
||||
```
|
||||
go test ./... → all PASS (exit 0)
|
||||
go test -race ./internal/config/... ./internal/cli/... → all PASS
|
||||
go vet ./... → clean
|
||||
make build → clean (v0.6.1)
|
||||
```
|
||||
|
||||
### API Surface
|
||||
```go
|
||||
func Load(paths ...string) (*Config, error)
|
||||
func (c *Config) MergeOverrides(flags Flags, env Environ) *Config
|
||||
```
|
||||
- `Load` returns zero `&Config{}` if no file exists (no error)
|
||||
- `MergeOverrides` precedence: flag > env > file > default (D-039)
|
||||
- No package-level state (AD-023)
|
||||
|
||||
### CLI Verification
|
||||
```
|
||||
./bin/orca --help → shows --config string flag
|
||||
```
|
||||
|
||||
## Security Verification
|
||||
|
||||
- Config file is read-only (no writes); parsed via `hclsimple.Decode` (no eval, no external commands)
|
||||
- No secrets in config (paths only; no tokens/keys in config.hcl)
|
||||
- Config file permissions not enforced (operator's responsibility; config contains no secrets)
|
||||
|
||||
## Quality Verification
|
||||
|
||||
- No new dependencies (`hashicorp/hcl/v2` already in go.mod for jobspec)
|
||||
- No comments added (per project convention)
|
||||
- Test style matches existing `jobspec/spec_test.go` + `cli/root_test.go`
|
||||
- `go.mod` unchanged
|
||||
|
||||
## Must-Haves Checklist
|
||||
|
||||
- [x] `internal/config/config.go` — Config struct + Load + MergeOverrides
|
||||
- [x] `internal/config/config_test.go` — 11 tests (all 4 precedence layers)
|
||||
- [x] `internal/config/testdata/config.hcl` — example fixture
|
||||
- [x] `internal/cli/root.go` — `--config` persistent flag + context wiring
|
||||
- [x] `internal/cli/daemon.go` — uses `cfg.ListenAddr` (flag still wins)
|
||||
- [x] `internal/cli/root_test.go` — config flag registration + load test
|
||||
|
||||
## Verdict
|
||||
|
||||
**PASS** — all 4 verification layers pass. REQ-054 is fully covered. The `internal/config` package provides HCL config file parsing with flag > env > file > default precedence, wired into the root command via `--config` and consumed by the daemon.
|
||||
@@ -1,75 +0,0 @@
|
||||
# Phase 3 Verification: Docker Release (v0.5 P3)
|
||||
|
||||
**Phase**: 3 (docker release)
|
||||
**Milestone**: v0.5 Distribution
|
||||
**Requirements covered**: REQ-046
|
||||
**Date**: 2026-08-03
|
||||
|
||||
## Structural Layer
|
||||
|
||||
- `go vet ./...` → clean.
|
||||
- `go build ./...` → succeeds.
|
||||
- New files: `Dockerfile`, `.dockerignore`, `docs/docker.md`.
|
||||
- Modified files: `.coreci.yml` (container-publish step), `scripts/release.sh` (docker publish).
|
||||
- `.dockerignore` excludes `.git`, `bin/`, `.env`, `.ciagent/`, `testdata/`, `*.tar.gz`.
|
||||
|
||||
## Behavioral Layer
|
||||
|
||||
### Docker build
|
||||
- `docker build --build-arg VERSION=v0.4.4-test ... -t orca-test:v0.4.4 .` → succeeds.
|
||||
- Multi-stage build: `golang:1.25` (builder) → `gcr.io/distroless/static-debian12:nonroot` (runtime).
|
||||
- `CGO_ENABLED=0` guarantees static binary (modernc/sqlite is pure Go).
|
||||
|
||||
### Docker run
|
||||
- `docker run --rm orca-test:v0.4.4 version` → `orca version v0.4.4-test` ✓
|
||||
- `docker run --rm orca-test:v0.4.4 version --json` → valid JSON with version/commit/build_time ✓
|
||||
- `docker run --rm -v orca-test-data:/var/lib/orca orca-test:v0.4.4 init` → creates `/var/lib/orca` ✓
|
||||
- Volume persistence: state dir created in named volume, verified with alpine container ✓
|
||||
|
||||
### Image metrics
|
||||
- Image size: 27.9MB (distroless static + Go binary).
|
||||
- Runs as `nonroot` user (distroless default).
|
||||
- `ENV ORCA_HOME=/var/lib/orca` set for volume-mountable state.
|
||||
|
||||
### .coreci.yml release pipeline
|
||||
- New `container-publish` step added after `gitea-release`.
|
||||
- Uses `docker:24-cli` image with `GITEA_TOKEN` as registry credential.
|
||||
- Builds, tags (`<version>` + `latest`), logs in, pushes, logs out.
|
||||
|
||||
### scripts/release.sh extension
|
||||
- After Gitea release: `docker build` + `docker login` + `docker push`.
|
||||
- Skips gracefully if `docker` not on PATH (local dev without docker).
|
||||
- Skips push if `GITEA_TOKEN` not set (builds locally only).
|
||||
- Env-overridable: `CONTAINER_REGISTRY`, `CONTAINER_OWNER`, `CONTAINER_IMAGE`.
|
||||
|
||||
### Regression — Go tests
|
||||
- `internal/cli/` ✓ (cached)
|
||||
- `internal/store/` ✓ (cached)
|
||||
|
||||
## Security Layer
|
||||
|
||||
- `.dockerignore` excludes `.env`, `.gitleaks-baseline.json`, `bin/` — no secrets in image.
|
||||
- Image runs as `nonroot` (distroless default) — least privilege.
|
||||
- `docker login` uses `--password-stdin` (no password in process args / shell history).
|
||||
- `docker logout` after push — no credential leakage.
|
||||
- No secret material baked into the image — `GITEA_TOKEN` is used at push time only, not in the build.
|
||||
|
||||
## Quality Layer
|
||||
|
||||
- **Reproducible build**: `--build-arg VERSION/GIT_COMMIT/BUILD_TIME` injected via `-ldflags`.
|
||||
- **Minimal image**: distroless static-debian12 — no shell, no package manager, ~28MB total.
|
||||
- **Graceful degradation**: `release.sh` skips docker publish when docker is absent.
|
||||
- **CI integration**: `.coreci.yml` container-publish step uses `docker:24-cli` (has docker CLI).
|
||||
- **Documentation**: `docs/docker.md` covers pull, run, state persistence, local build, manual publish.
|
||||
|
||||
## Must-Haves Checklist
|
||||
|
||||
- [x] `docker build -t orca-test .` succeeds locally.
|
||||
- [x] `docker run --rm orca-test version` prints the version.
|
||||
- [x] `scripts/release.sh vX.Y.Z` publishes both the Gitea release AND the container image.
|
||||
- [x] `.coreci.yml` release pipeline includes the container-publish step.
|
||||
|
||||
## Verdict
|
||||
|
||||
**PASS** — all 4 verification layers pass. REQ-046 is satisfied. Ready
|
||||
to ship as `v0.4.4`.
|
||||
@@ -1,62 +0,0 @@
|
||||
# Phase 3 Verification — Orca v0.6 P03
|
||||
|
||||
**Phase**: P03 — Doctor Extensions + Audit Logging
|
||||
**REQ Coverage**: REQ-052
|
||||
**Verification date**: 2026-08-03
|
||||
**Result**: ✅ PASS (all 4 layers)
|
||||
|
||||
## Structural Verification
|
||||
|
||||
- ✅ `go build ./...` — PASS
|
||||
- ✅ `go vet ./...` — PASS
|
||||
- ✅ `gofmt -l .` — PASS
|
||||
- ✅ `make lint` — PASS
|
||||
- ✅ `internal/osdetect` new shared package (extracted from cli to avoid import cycle)
|
||||
- ✅ `doctor.OS()` and `doctor.Proxmox()` follow existing check pattern (Check struct, Result, Run func)
|
||||
- ✅ `doctor.All()` extended with OS + Proxmox in logical order
|
||||
|
||||
## Behavioral Verification
|
||||
|
||||
### REQ-052: doctor os + doctor proxmox + audit logging
|
||||
- ✅ `TestOSCheck_MissingLocalhostNode`: no localhost node → FAIL with clear message
|
||||
- ✅ `TestOSCheck_Match`: stored os matches detected → PASS
|
||||
- ✅ `TestOSCheck_Drift`: stored os differs from detected → WARN ("OS drift: init=debian, now=ubuntu")
|
||||
- ✅ `TestProxmoxCheck_NoProxmoxNodes`: zero proxmox nodes → WARN ("no proxmox nodes registered")
|
||||
- ✅ `TestProxmoxCheck_UnreachableNode`: unreachable proxmox node → FAIL with node name
|
||||
- ✅ E2E: `orca doctor os` → PASS (os=ubuntu matches)
|
||||
- ✅ E2E: `orca doctor proxmox` → WARN (no proxmox nodes)
|
||||
- ✅ E2E: `orca doctor os --json` → valid JSON
|
||||
- ✅ E2E: `orca doctor` (full) → 6 PASS / 1 WARN / 1 FAIL (network=daemon not running, expected)
|
||||
- ✅ osdetect package: 11 tests (ubuntu/debian/alpine/pve parsing, quoted/unquoted, missing ID, comments, fallback)
|
||||
- ✅ Audit logging: proxmox.BootstrapProxmox emits `proxmox.bootstrap_ok` (P02); doctor checks are read-only
|
||||
|
||||
## Security Verification
|
||||
|
||||
- ✅ Doctor checks are strictly read-only (no state changes)
|
||||
- ✅ SSH probe uses orca SSH key (not password) — no password in doctor flow
|
||||
- ✅ TOFU host-key verification via knownhosts.New (D-035)
|
||||
- ✅ 3s timeout per proxmox probe (D-038 bounded-probe-timeout pattern)
|
||||
- ✅ No secrets in doctor output (fingerprints only, never private keys)
|
||||
|
||||
## Quality Verification
|
||||
|
||||
- ✅ `go test -race -count=1 ./...` — all PASS (13 packages)
|
||||
- ✅ Test coverage: osdetect (11 tests), doctor OS (3 tests), doctor Proxmox (2 tests)
|
||||
- ✅ Error wrapping with `fmt.Errorf("...: %w", err)` (REQ-018)
|
||||
- ✅ `context.Context` propagation (REQ-017)
|
||||
- ✅ No goroutine leaks (netDialer cleans up on ctx cancellation)
|
||||
- ✅ D-036: doctor os handles pre-0006 rows (empty os field → WARN)
|
||||
|
||||
## Must-Have Checklist
|
||||
|
||||
- [x] `internal/osdetect/osdetect.go` — Detect + ParseID (shared package)
|
||||
- [x] `internal/osdetect/osdetect_test.go` — 11 tests
|
||||
- [x] `internal/cli/osdetect.go` — thin wrapper
|
||||
- [x] `internal/cli/osdetect_test.go` — delegation test
|
||||
- [x] `internal/doctor/doctor.go` — OS() + Proxmox() checks, All() extended
|
||||
- [x] `internal/doctor/doctor_test.go` — 5 new tests
|
||||
- [x] `internal/cli/doctor.go` — doctor os + doctor proxmox subcommands
|
||||
|
||||
## Escalations
|
||||
|
||||
None.
|
||||
@@ -1,76 +0,0 @@
|
||||
# Phase 3 Verification Report — v0.7: Test Coverage Uplift
|
||||
|
||||
**Phase**: 3
|
||||
**Branch**: `phase/03-coverage-uplift`
|
||||
**REQ Coverage**: REQ-055
|
||||
**Milestone**: v0.7 (Hardening & Completion)
|
||||
|
||||
## Structural Verification
|
||||
|
||||
### Files Created
|
||||
- `internal/engine/peer_test.go` — 8 tests (PeerRegistry Add/Get/Remove/All/Len/UpdateLastSeen + validation)
|
||||
- `internal/engine/executor_test.go` — 7 tests (Submit success/missing-command/malformed/failing, Status not-found, Run success, Run context-cancel)
|
||||
- `internal/engine/dispatcher_test.go` — 10 tests (empty spec, idempotency hit, local-capacity, explicit-target, no-peers, LocalSubmit/LocalStatus, nil guards, parseInlineSpec)
|
||||
- `internal/audit/audit_test.go` — 9 tests (Emit/EmitWithErr persistence, LogHandshakeOK/Failed slog fields, nil-safety, Action/Result String, FormatAction)
|
||||
- `internal/transport/handshake_log_test.go` — 8 tests (LogHandshakeOK/Failed/FromCert, FingerprintOfCert, nil-logger, nil-err)
|
||||
- `internal/transport/mtls_test.go` — 14 tests (ServerTLSConfig, ClientTLSConfig, NewMTLSClient, Do, VerifyPeerCertificate, DialContext)
|
||||
- `internal/transport/dispatch_test.go` — 24 tests (SubmitHandler/StatusHandler, DispatchClient constructor/connection-refused/HTTP/decode/Submit/Status success)
|
||||
- `internal/proxmox/ssh_session_test.go` — 14 tests (runRemote, deployPubKey, createLinuxUser, createPVERole, createPVEUser, assignPVEACL, writeSudoers, validateSudoers, full BootstrapProxmox)
|
||||
|
||||
### Files Modified
|
||||
- `internal/transport/dispatch.go` — **bug fix**: `bytesReadCloser.Read` returned `fmt.Errorf("EOF")` instead of `io.EOF`, breaking HTTP request body transmission. This was a latent bug that prevented any client-side dispatch from working end-to-end.
|
||||
- `internal/proxmox/bootstrap_test.go` — extended with 10 new tests (mockSSHDialer, SSH auth failure, dial-addr/port/user propagation, SSH key generation, known_hosts, nil/custom logger, cancelled context, deployPubKey edge cases)
|
||||
|
||||
## Behavioral Verification
|
||||
|
||||
### Test Results
|
||||
```
|
||||
go test ./... → all PASS (exit 0)
|
||||
go test -race ./... → all PASS (exit 0)
|
||||
go vet ./... → clean
|
||||
make build → clean
|
||||
```
|
||||
|
||||
### Coverage (D-042 target: ≥ 50% per package)
|
||||
|
||||
| Package | Before | After | Target |
|
||||
|---------|--------|-------|--------|
|
||||
| `internal/engine` | 8.3% | **65.1%** | 50% ✓ |
|
||||
| `internal/transport` | 26.3% | **84.6%** | 50% ✓ |
|
||||
| `internal/proxmox` | 5.1% | **82.7%** | 50% ✓ |
|
||||
| `internal/audit` | 0% | **100.0%** | 50% ✓ |
|
||||
|
||||
All 4 packages exceed the 50% floor (AD-025).
|
||||
|
||||
### Total new tests: 94 (37 engine+audit + 57 transport+proxmox)
|
||||
|
||||
## Security Verification
|
||||
|
||||
- The `dispatch.go` bug fix (`io.EOF` vs `fmt.Errorf("EOF")`) is a correctness fix — HTTP request bodies now terminate correctly. No security implications (the bug caused requests to fail, not to leak data).
|
||||
- No new dependencies added.
|
||||
- Test fixtures use temp dirs (`t.TempDir()`) — no persistent state.
|
||||
- No secrets in test code (SSH keys are test-generated Ed25519 pairs).
|
||||
|
||||
## Quality Verification
|
||||
|
||||
- No comments added (per project convention).
|
||||
- Test style matches existing patterns (`scheduler_test.go`, `node_repo_test.go`, `certgen_test.go`).
|
||||
- `go.mod` unchanged.
|
||||
- Bug fix in `dispatch.go` is minimal (1 line: `return fmt.Errorf("EOF")` → `return io.EOF` + `io` import).
|
||||
|
||||
## Must-Haves Checklist
|
||||
|
||||
- [x] `internal/engine/executor_test.go` — 7 tests
|
||||
- [x] `internal/engine/dispatcher_test.go` — 10 tests
|
||||
- [x] `internal/engine/peer_test.go` — 8 tests
|
||||
- [x] `internal/transport/mtls_test.go` — 14 tests
|
||||
- [x] `internal/transport/dispatch_test.go` — 24 tests
|
||||
- [x] `internal/transport/handshake_log_test.go` — 8 tests
|
||||
- [x] `internal/audit/audit_test.go` — 9 tests
|
||||
- [x] `internal/proxmox/ssh_session_test.go` — 14 tests + extended `bootstrap_test.go` (+10 tests)
|
||||
- [x] Bug fix: `dispatch.go` bytesReadCloser EOF (latent bug, root-caused during P03)
|
||||
- [x] All 4 target packages ≥ 50% coverage
|
||||
|
||||
## Verdict
|
||||
|
||||
**PASS** — all 4 verification layers pass. REQ-055 is fully covered. All 4 target packages exceed the 50% coverage floor (engine 65.1%, transport 84.6%, proxmox 82.7%, audit 100%). A latent bug in `dispatch.go` (non-`io.EOF` return) was found and fixed during coverage uplift.
|
||||
@@ -1,64 +0,0 @@
|
||||
# Phase 4 Verification Report — v0.7: --pprof Opt-in on orca daemon
|
||||
|
||||
**Phase**: 4
|
||||
**Branch**: `phase/04-pprof-daemon`
|
||||
**REQ Coverage**: REQ-056
|
||||
**Milestone**: v0.7 (Hardening & Completion)
|
||||
|
||||
## Structural Verification
|
||||
|
||||
### Files Created
|
||||
- `internal/daemon/pprof.go` — `StartPprof(addr, log) (*http.Server, error)`: dedicated mux + server, disabled by default, WARN log
|
||||
- `internal/daemon/pprof_test.go` — 5 tests (disabled, enabled, shutdown, mux isolation, full server lifecycle)
|
||||
- `internal/cli/daemon_test.go` — `TestDaemonPprofFlag` (flag registration + default)
|
||||
|
||||
### Files Modified
|
||||
- `internal/daemon/server.go` — `PprofAddr` in Options, `pprofServer` field, `NewServer` starts pprof, `Shutdown` stops both
|
||||
- `internal/cli/daemon.go` — `--pprof` flag, `PprofAddr` in daemon.Options, conditional startup output line
|
||||
|
||||
## Behavioral Verification
|
||||
|
||||
### Test Results
|
||||
```
|
||||
go test ./... → all PASS (exit 0)
|
||||
go test -race ./internal/daemon/... ./internal/cli/... → all PASS
|
||||
go vet ./... → clean
|
||||
make build → clean
|
||||
```
|
||||
|
||||
### CLI Verification
|
||||
```
|
||||
./bin/orca daemon --help → shows --pprof string flag (default "")
|
||||
```
|
||||
|
||||
### Live Smoke Test
|
||||
- `--pprof 127.0.0.1:16060` → WARN logged, `/debug/pprof/` returns 200, `/debug/pprof/cmdline` 200, `/debug/pprof/heap` 200
|
||||
- `/healthz` on pprof listener → 404 (mux isolation confirmed, AD-024)
|
||||
- Clean shutdown stops both servers
|
||||
|
||||
## Security Verification
|
||||
|
||||
- pprof on a **separate** `*http.Server` + `*http.ServeMux`, never on the mTLS daemon listener (AD-024) — verified by `TestStartPprof_MuxIsolated` (`/healthz` returns 404 on pprof mux)
|
||||
- Default **disabled** — no pprof listener unless `--pprof` is explicitly set
|
||||
- WARN log on startup: "unauthenticated, operator-only — do not expose publicly"
|
||||
- No `import _ "net/http/pprof"` side-effect registration on `DefaultServeMux` — all handlers explicitly registered on the dedicated mux
|
||||
|
||||
## Quality Verification
|
||||
|
||||
- No new dependencies (stdlib `net/http`, `net/http/pprof`, `log/slog`, `time` only)
|
||||
- No comments added (per project convention)
|
||||
- `go.mod` unchanged
|
||||
- Test style matches existing `server_test.go`
|
||||
|
||||
## Must-Haves Checklist
|
||||
|
||||
- [x] `internal/daemon/pprof.go` — `StartPprof` with dedicated mux, all pprof handlers
|
||||
- [x] `internal/daemon/server.go` — `PprofAddr` in Options, `pprofServer` field, lifecycle integration
|
||||
- [x] `internal/cli/daemon.go` — `--pprof` flag, passed to Options, conditional startup output
|
||||
- [x] `internal/daemon/pprof_test.go` — 5 tests (disabled, enabled, shutdown, mux isolation, lifecycle)
|
||||
- [x] `internal/cli/daemon_test.go` — flag registration test
|
||||
- [x] AD-024: pprof mux separate from mTLS daemon mux (verified by test)
|
||||
|
||||
## Verdict
|
||||
|
||||
**PASS** — all 4 verification layers pass. REQ-056 is fully covered. The `--pprof` opt-in endpoint runs on a separate listener with a dedicated mux, is disabled by default, and logs a WARN when enabled. I-308 (deferred since v0.2) is now implemented.
|
||||
@@ -1,159 +0,0 @@
|
||||
# Plan: Orca v0.3 — scheduling-streaming
|
||||
|
||||
Milestone v0.3 (scheduling-streaming) — completion milestone closing the two
|
||||
work items deferred from v0.2 (iter.Seq streaming + doctor network/db). Two
|
||||
execution phases (P01, P02) followed by one final phase (P03 review + ship).
|
||||
|
||||
Branch: `phase/00-pre-execution` (cut from `milestone/v0.3-scheduling-streaming`).
|
||||
Go toolchain: `go1.25.0` (`iter` package + range-over-func are stable stdlib).
|
||||
No new `go.mod` dependencies (D-041). Source of implementation guidance:
|
||||
`.ciagent/RESEARCH_v0.3.md` (D-025..D-042).
|
||||
|
||||
---
|
||||
|
||||
## Phase P01: iter.Seq streaming for `--watch` flags
|
||||
|
||||
**Goal:** Add pull-based `iter.Seq` streaming to `orca job list` and `orca node list` behind a `--watch` flag, with table refresh (default) or streaming one-line JSON per event (`--watch --json`).
|
||||
|
||||
**Requirements:** REQ-022 (`iter.Seq` for streaming job lists, Go 1.25+), REQ-030 (`--watch` output format: table default vs streaming one-line JSON per event)
|
||||
|
||||
**Milestone:** v0.3
|
||||
**Phase tag:** v0.3.1
|
||||
**Key decisions:** D-019 (1s poll ticker), D-025 (iter.Seq on store repos), D-026 (`*model.Job`/`*model.Node` element type), D-028 (poll re-runs List, yields full snapshot), D-030 (per-event JSON streaming), D-031 (signal.NotifyContext replaces 5s timeout on watch path), D-032 (inline pull loop, no goroutine).
|
||||
|
||||
### Wave 1: Store layer iter.Seq + unit tests (vertical slice)
|
||||
|
||||
Wave 1 is independently testable: the two `Watch` methods + the migration-version-less store layer compile and run in isolation. No CLI or doctor code is touched. Running `go test ./internal/store/...` after this wave passes and exercises the `iter.Seq` contracts (yield, ctx cancellation, consumer break, no goroutine leak).
|
||||
|
||||
| Task ID | Description | Persona | Files | Must-have | Deps |
|
||||
|---------|-------------|---------|-------|-----------|------|
|
||||
| 01-01-01 | Add `JobRepo.Watch(ctx) iter.Seq[[]*model.Job]` — pull-based inline polling loop on a 1s ticker; re-runs the List `SELECT ... FROM jobs ORDER BY created_at DESC` each tick, collects ALL rows into a `[]*model.Job` slice via `scanJob`, then yields the **full snapshot as a single slice** (`yield(snapshot)`). **Immediate first yield** before the first ticker wait (G-002): the loop queries+yields on the first iteration, then `select`s on the ticker for subsequent ticks. `defer ticker.Stop()` + `rows.Close()` on every exit path (ctx.Done, yield==false, scan error). No goroutine spawned (D-032). Transient query errors are logged via `slog.Default().Warn` and the loop continues to the next tick (D-034 lite). Imports: add `"iter"` (`"time"` already present). | data-engineer | `internal/store/job_task_repo.go` | `go build ./internal/store/...` succeeds; `Watch` method exists with signature `func (r *JobRepo) Watch(ctx context.Context) iter.Seq[[]*model.Job]`; code path closes rows on ctx.Done and on `yield==false`; first yield is immediate (no `watchInterval` delay before first snapshot — G-002). | - |
|
||||
| 01-01-02 | Add `NodeRepo.Watch(ctx) iter.Seq[[]*model.Node]` — analogous to 01-01-01 but against the nodes query `SELECT id, name, address, state, joined_at, last_seen, metadata FROM nodes ORDER BY joined_at ASC`, reusing `scanNode`. Yields the full snapshot as a `[]*model.Node` slice per tick. Same inline-pull / no-goroutine / rows-close-on-all-paths / immediate-first-yield contract (G-001, G-002). | data-engineer | `internal/store/node_repo.go` | `go build ./internal/store/...` succeeds; `Watch` method exists with signature `func (r *NodeRepo) Watch(ctx context.Context) iter.Seq[[]*model.Node]`; immediate first yield. | - |
|
||||
| 01-01-03 | Add an unexported test hook for the poll interval so unit tests are deterministic (D-035). Preferred shape: an unexported package var `watchInterval = 1 * time.Second` in `internal/store` that `Watch` reads instead of a literal, overridable from `_test.go` via `watchInterval = 10 * time.Millisecond`. Both `JobRepo.Watch` and `NodeRepo.Watch` reference this var. | data-engineer | `internal/store/job_task_repo.go`, `internal/store/node_repo.go` (optionally a tiny `internal/store/watch_test_helper_test.go` if a shared helper reads cleaner) | `Watch` uses the `watchInterval` var, not a literal `1 * time.Second`; tests can set it to a small value. | 01-01-01, 01-01-02 |
|
||||
| 01-01-04 | Write store-layer unit tests for `Watch`. New/append: `internal/store/job_task_repo_test.go` and `internal/store/node_repo_test.go` (mirror). Tests: (a) `TestJobRepoWatch_YieldsSnapshots` — insert 1 job, set `watchInterval=10ms`, range over seq collecting `[]*model.Job` snapshots into a slice, insert a 2nd job from a goroutine after ~30ms, cancel ctx after ~80ms, assert at least one snapshot contains both jobs and the first snapshot contains only the first job (G-001: each yield is a complete tick snapshot). (b) `TestJobRepoWatch_ImmediateFirstYield` (G-002) — assert the first snapshot appears within <50ms even with `watchInterval=10ms` (proving first yield is not tick-gated). (c) `TestJobRepoWatch_StopsOnConsumerBreak` — range and `break` after first yield; assert the range returns (no hang) within a short deadline. (d) `TestJobRepoWatch_StopsOnCtxCancel` — cancel ctx; assert the range loop exits within ~50ms. (e) Mirror all four for `NodeRepo.Watch`. Run `go test -race ./internal/store/...`. | data-engineer | `internal/store/job_task_repo_test.go`, `internal/store/node_repo_test.go` | `go test -race ./internal/store/...` passes; all 8 Watch tests pass; `-race` reports no leaks/data races; immediate-first-yield assertion holds (G-002). | 01-01-03 |
|
||||
|
||||
### Wave 2: CLI `--watch` flag + integration
|
||||
|
||||
Wave 2 depends on Wave 1's `Watch` methods. It wires the `--watch` flag into both list commands, implements the two output modes, and adds CLI-level smoke tests. After this wave `orca job list --watch` and `orca node list --watch` are runnable end-to-end.
|
||||
|
||||
| Task ID | Description | Persona | Files | Must-have | Deps |
|
||||
|---------|-------------|---------|-------|-----------|------|
|
||||
| 01-02-01 | Add `--watch` flag to `jobListCmd` in `internal/cli/job.go`. Register `jobListCmd.Flags().BoolVar(&jobWatch, "watch", false, "stream jobs until Ctrl-C")` (package var `jobWatch bool`). In `RunE`, branch: if `!jobWatch` keep the existing 5s-timeout `List` path unchanged; if `jobWatch`, build `ctx, cancel := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM); defer cancel()` (drop the 5s timeout — D-031), then `seq := store.NewJobRepo(db).Watch(ctx)`. Imports: `os/signal`, `syscall`, `iter`. The branch structure is added in this task; the actual rendering (table vs JSON) is filled by 01-02-02 + 01-02-03. | cli-engineer | `internal/cli/job.go` | `go build ./internal/cli/...` succeeds; `orca job list --help` shows `--watch` flag; non-watch path behavior unchanged (existing tests pass); watch path compiles (rendering may be a placeholder `for range seq {}` at this step). | 01-01-01 |
|
||||
| 01-02-02 | Implement the **table** watch render in `jobListCmd` (D-029, G-001). Each yielded value is a complete `[]*model.Job` snapshot. Maintain the previous snapshot's rendered-table string (or a hash of it). On each tick, if the new rendered table differs from the previous, emit `"\033[2J\033[H"` (clear screen + home) then the table header + rows (reuse the existing table-rendering code path). Unchanged snapshots produce no output (avoids flicker). | cli-engineer | `internal/cli/job.go` | `orca job list --watch` on a temp DB: inserting a job causes a cleared-screen re-render showing the new job; no output when the snapshot is unchanged. | 01-02-01 |
|
||||
| 01-02-03 | Implement the **`--watch --json`** render in `jobListCmd` (D-030, G-001). Each yielded value is a complete `[]*model.Job` snapshot. Maintain `map[string][]byte` of last-seen compact-JSON bytes per job ID. Per tick: diff the current snapshot against the map — for each job in the snapshot, marshal compact JSON; if it differs from stored bytes (or ID unseen), print `{"event":"init","job":{...}}\n` (first sighting) or `{"event":"update","job":{...}}\n` (subsequent change). For IDs in the map but NOT in the current snapshot, print `{"event":"delete","job":{...}}\n` (G-006 DEFER: delete event now natural with snapshot-per-tick). One line per changed element per tick — matches REQ-030. | cli-engineer | `internal/cli/job.go` | `orca job list --watch --json` on a temp DB: inserting/changing a job prints one JSON line per changed job; first tick prints `"init"` lines for existing jobs; deleting a job prints `"delete"`; unchanged jobs on a tick produce no line. | 01-02-01 |
|
||||
| 01-02-04 | Add `--watch` flag + both render modes to `nodeListCmd` in `internal/cli/node.go`, mirroring 01-02-01..01-02-03. Package var `nodeWatch bool`; flag `--watch`. For the watch path bypass `engine.NodeRegistry` and call `store.NewNodeRepo(db).Watch(ctx)` directly (D-025 — keeps iter boundary in store; registry adds no value for a read-only stream). Same `signal.NotifyContext` cancellation. Table + JSON renders analogous to job (element type `[]*model.Node` snapshot per tick, event wrapper `{"event":"...","node":{...}}`). **Note (G-003):** This task modifies `internal/cli/node.go`, which P02 task 02-01-01 also modifies (removing old `dbPath`). Task 02-01-01 MUST complete first to avoid merge conflicts. | cli-engineer | `internal/cli/node.go` | `orca node list --watch` and `orca node list --watch --json` behave as specified; non-watch path unchanged. | 01-01-02, 01-02-03, 02-01-01 |
|
||||
| 01-02-05 | Add CLI-level watch tests. New files (or append if present): `internal/cli/job_test.go`, `internal/cli/node_test.go`. Smoke-level (store layer is the thorough test home): `TestJobListWatch_JSONStreaming` — temp DB, insert a job, run `jobListCmd.RunE` with `--watch --json` in a goroutine under a cancellable ctx, insert a 2nd job, capture stdout for ~200ms, assert ≥2 JSON lines appear, then cancel ctx and assert the command returns promptly. `TestJobListWatch_TableRefresh` — assert the clear-screen escape `\033[2J\033[H` appears in output on change. Mirror for nodes. Keep deterministic: small `watchInterval` via the test hook, short timeouts. Run `go test -race ./internal/cli/...`. | cli-engineer | `internal/cli/job_test.go`, `internal/cli/node_test.go` | `go test -race ./...` passes (whole repo); the 4 CLI watch smoke tests pass; no goroutine leaks under `-race`. | 01-02-02, 01-02-03, 01-02-04 |
|
||||
|
||||
### Test strategy (P01)
|
||||
|
||||
- **Store layer (thorough, deterministic):** `internal/store/job_task_repo_test.go` + `internal/store/node_repo_test.go` — three tests per repo (snapshots over time, consumer-break stops, ctx-cancel stops). Uses the `watchInterval` test hook (10ms) for speed. Runs under `go test -race ./internal/store/...`. This is where the `iter.Seq` contract is verified rigorously.
|
||||
- **CLI layer (smoke):** `internal/cli/job_test.go` + `internal/cli/node_test.go` — verify the flag is wired, JSON streaming emits one line per changed element, table mode emits the clear-screen escape on change, and the command exits promptly on ctx cancellation. Kept intentionally lightweight; deterministic via the shared `watchInterval` hook + short timeouts.
|
||||
- **Non-watch regression:** existing `job list` / `node list` tests must still pass unchanged (the 5s-timeout path is untouched).
|
||||
- **Race:** `go test -race ./...` is the gate (REQ-031 already enforces `-race` in CI).
|
||||
|
||||
### Vertical slice integrity (P01)
|
||||
|
||||
- **Wave 1** produces a runnable, testable artifact: `go build ./internal/store/...` + `go test -race ./internal/store/...`. No CLI or doctor code is modified. The `iter.Seq` contract (pull, cancel, no-leak) is fully verified at this layer.
|
||||
- **Wave 2** builds on Wave 1's `Watch` methods to deliver the user-facing `--watch` flag end-to-end. After Wave 2 an operator can demo `orca job list --watch` and `orca node list --watch --json`.
|
||||
|
||||
---
|
||||
|
||||
## Phase P02: `orca doctor` network + db full implementation
|
||||
|
||||
**Goal:** Replace the `NetworkStub` and `DBStub` placeholders with real diagnostics — peer reachability via mTLS `/healthz` probe and SQLite `PRAGMA integrity_check` + migration version — completing REQ-032.
|
||||
|
||||
**Requirements:** REQ-032 (completion: network reachability + db integrity)
|
||||
**Milestone:** v0.3
|
||||
**Phase tag:** v0.3.2
|
||||
**Key decisions:** D-027 (closure-capture handles in check constructors), D-033 (`store.MigrationVersion`), D-034 (db check opens its own `*sql.DB`), D-035 (`PRAGMA integrity_check` + migration version), D-036 (peers from `nodes` table, not in-memory registry), D-037 (`ServerName = node.Name`), D-038 (zero peers → WARN, any fail → FAIL, 3s per-probe timeout), D-039 (`dbPath` → `certpaths.DBPath()`), D-040 (delete stubs, no shims).
|
||||
|
||||
### Wave 1: Shared infra + store migration-version query (vertical slice)
|
||||
|
||||
Wave 1 breaks the would-be `doctor → cli` import cycle (D-039) and adds the public `store.MigrationVersion` query. Both are independently testable: `go test ./internal/store/... ./internal/certpaths/...` passes after this wave, and the foundation for both the db and network checks is in place.
|
||||
|
||||
| Task ID | Description | Persona | Files | Must-have | Deps |
|
||||
|---------|-------------|---------|-------|-----------|------|
|
||||
| 02-01-01 | Move `dbPath()` (the `ORCA_DB`-env-honoring path resolver) from `internal/cli` to `internal/certpaths` as `DBPath()` (D-039). `certpaths` already owns the `ORCA_HOME`-honoring `Dir()`. Add `func DBPath() string` to `internal/certpaths/certpaths.go`: honors `ORCA_DB` env override, else `filepath.Join(Dir(), "orca.db")`. Update `internal/cli/node.go` (and any other `internal/cli` caller of the old unexported `dbPath`) to call `certpaths.DBPath()`; remove the old `dbPath` from `internal/cli`. Territory note: this crosses cli-engineer territory — lead-developer adjudicates (D-039). | lead-developer | `internal/certpaths/certpaths.go`, `internal/cli/node.go` (remove old `dbPath`), any other `internal/cli/*` caller | `go build ./...` succeeds (no import cycle); `certpaths.DBPath()` exists and honors `ORCA_DB`/`ORCA_HOME`; `internal/cli` no longer defines `dbPath`; existing CLI tests pass. | - |
|
||||
| 02-01-02 | Add `store.MigrationVersion(ctx, db) (string, error)` to `internal/store/migrate.go` (D-033). SQL: `SELECT name FROM schema_migrations ORDER BY name DESC LIMIT 1`. Returns `("", nil)` on `sql.ErrNoRows` (empty/fresh db). Wraps other errors with `fmt.Errorf("query migration version: %w", err)`. Add `"context"` import if missing (likely already imported). | data-engineer | `internal/store/migrate.go` | `go build ./internal/store/...` succeeds; function is exported; `sql.ErrNoRows` maps to `("", nil)`. | - |
|
||||
| 02-01-03 | Test `MigrationVersion`. New/append `internal/store/migrate_test.go`: `TestMigrationVersion` — open a fresh test db via `store.Open` (which runs `migrate`), call `MigrationVersion`, assert it returns `0005_node_capacity.sql` (the highest current migration). Then manually `db.Exec("DELETE FROM schema_migrations")`, call again, assert `("", nil)`. Run `go test -race ./internal/store/...`. | data-engineer | `internal/store/migrate_test.go` | `go test -race ./internal/store/...` passes; both assertions (highest version, empty → `""`) hold. | 02-01-02 |
|
||||
|
||||
### Wave 2: doctor DB check + network check + CLI wiring + tests
|
||||
|
||||
Wave 2 depends on Wave 1 (`certpaths.DBPath` + `store.MigrationVersion`). It replaces both stubs with real checks, updates `All()` and the CLI subcommands, rewrites the broken stub test, and adds per-check tests. After this wave `orca doctor`, `orca doctor network`, and `orca doctor db` are fully functional.
|
||||
|
||||
| Task ID | Description | Persona | Files | Must-have | Deps |
|
||||
|---------|-------------|---------|-------|-----------|------|
|
||||
| 02-02-01 | Replace `DBStub()` with `DB()` in `internal/doctor/doctor.go` (D-027, D-034, D-035). The `Check.Run` closure: `path := certpaths.DBPath()`; `db, err := store.Open(path)` (defer `db.Close()`); `PRAGMA integrity_check` via `db.QueryRowContext(ctx, "PRAGMA integrity_check").Scan(&integrity)`; FAIL if not `"ok"` (first line of message); then `store.MigrationVersion(ctx, db)` — WARN if `""` (fresh/never-migrated), else PASS with `"... migrations up to <ver>"`. New imports: `strings`, `internal/store`, `internal/certpaths`. | data-engineer | `internal/doctor/doctor.go` | `go build ./internal/doctor/...` succeeds; `doctor.DB()` returns a `Check` with `Name=="db"`; `DBStub` still present (removed in 02-02-04 lockstep). | 02-01-01, 02-01-02 |
|
||||
| 02-02-02 | Add `probeHealthz(ctx, caPath, certPath, keyPath, serverName, addr) error` helper in `internal/doctor/doctor.go` (network-engineer territory — connection lifecycle). Builds an mTLS client via `transport.NewMTLSClient(caPath, serverName, certPath, keyPath)` (D-037: `serverName = node.Name`), `http.NewRequestWithContext(ctx, GET, "https://"+addr+"/healthz", nil)`, `client.Do(req)`, defer `resp.Body.Close()`, FAIL if status != 200. New imports: `net/http`, `time`, `internal/transport`. | network-engineer | `internal/doctor/doctor.go` | `go build ./internal/doctor/...` succeeds; `probeHealthz` exists with the specified signature; reuses `transport.NewMTLSClient` (no new TLS code — security-engineer territory respected). | 02-01-01 |
|
||||
| 02-02-03 | Replace `NetworkStub()` with `Network()` in `internal/doctor/doctor.go` (D-036, D-037, D-038). The `Check.Run` closure: `path := certpaths.DBPath()`; `db, err := store.Open(path)` (defer close); `nodes, err := store.NewNodeRepo(db).List(ctx)`; filter `state != model.NodeStateLeft` into `live`; if `len(live)==0` → `ResultWarn` ("no peers registered; network check skipped (single-node?)"). Else per-peer: `probeCtx, cancel := context.WithTimeout(ctx, 3*time.Second)`; `probeHealthz(...)`; collect PASS/FAIL lines; aggregate — FAIL if any peer failed, PASS if all OK. `serverName = n.Name`, `caPath = certpaths.CACertPath()`, `certPath/keyPath = certpaths.ServerCertPath()/ServerKeyPath()`. New imports: `internal/model`. | network-engineer | `internal/doctor/doctor.go` | `go build ./internal/doctor/...` succeeds; `doctor.Network()` returns a `Check` with `Name=="network"`; zero-peer → WARN; per-probe 3s timeout enforced. | 02-02-02 |
|
||||
| 02-02-04 | Update `All()` in `internal/doctor/doctor.go` to use `Network()` and `DB()` instead of the stubs (D-040). **Delete** `NetworkStub` and `DBStub` (no backward-compat shims — internal only). Update `internal/cli/doctor.go`: `doctorNetworkCmd.RunE` calls `doctor.Network()` (was `NetworkStub()`); `doctorDBCmd.RunE` calls `doctor.DB()` (was `DBStub()`). Ensure per-subcommand render honors `jsonOutput` (minor enhancement, in scope). | cli-engineer | `internal/doctor/doctor.go`, `internal/cli/doctor.go` | `go build ./...` succeeds; `grep -r "NetworkStub\|DBStub" internal/` returns nothing; `orca doctor`, `orca doctor network`, `orca doctor db` run without referencing stubs. | 02-02-01, 02-02-03 |
|
||||
| 02-02-05 | Rewrite + add doctor tests in `internal/doctor/doctor_test.go`. (a) Rewrite `TestRunAllChecksWithNoCA` — set `ORCA_HOME` to a temp dir with no CA. Assert per-check by name: `cert.ca` FAIL, `cert.server` FAIL, `cert.expiry` FAIL, `cert.fingerprint` FAIL, `db` PASS (store.Open runs migrations → version 0005), `network` WARN (no peers). Remove the stale "expects WARN (stubs)" comment. (b) `TestDBCheck_IntegrityOK` — fresh db via `store.Open` in temp, run `doctor.DB().Run(ctx)`, expect PASS, message contains "0005". (c) `TestNetworkCheck_NoPeers` — fresh db, no nodes, run `doctor.Network().Run(ctx)`, expect WARN. (d) `TestNetworkCheck_PeerUnreachable` — insert a node with `Address = "127.0.0.1:1"` (nothing listening), run, expect FAIL with the peer name in the message. (e) `TestNetworkCheck_PeerReachable` (integration) — bootstrap a CA via `security.CAInit`-equivalent, generate+sign a server cert with SAN `localhost`, start an `httptest.NewUnstartedServer` with TLS + `ClientAuth=RequireAndVerifyClientCert` (mirror `security/integration_test.go` pattern), insert a node row with `Address = ts.Listener.Addr().String()` and `Name = "localhost"`, set `ORCA_HOME`, run `doctor.Network().Run(ctx)`, expect PASS. Run `go test -race ./internal/doctor/...`. | network-engineer (network tests), data-engineer (db test), cli-engineer (All() rewrite test) | `internal/doctor/doctor_test.go` | `go test -race ./internal/doctor/...` passes; all 5 test cases pass; the stale stub assertion is gone. | 02-02-04 |
|
||||
|
||||
### Test strategy (P02)
|
||||
|
||||
- **Store layer:** `internal/store/migrate_test.go` — `MigrationVersion` returns highest applied migration (`0005_node_capacity.sql`) and `""` on empty. (`-race`.)
|
||||
- **Doctor db check:** `TestDBCheck_IntegrityOK` — fresh db → PASS with version in message. (Optional brittle `TestDBCheck_Corrupt` may be added if a reliable corruption method is found; otherwise rely on the integrity-string parsing logic via the PASS/FAIL branch coverage.)
|
||||
- **Doctor network check:** `TestNetworkCheck_NoPeers` (WARN), `TestNetworkCheck_PeerUnreachable` (FAIL, peer name in message), `TestNetworkCheck_PeerReachable` (integration: real mTLS `httptest` server → PASS). The reachable test reuses the proven `TestEndToEndMTLS` pattern from `security/integration_test.go`.
|
||||
- **Doctor `All()` regression:** rewritten `TestRunAllChecksWithNoCA` asserts per-check results (certs FAIL, db PASS, network WARN) — no more global "hasWarn" stub assertion.
|
||||
- **Race:** `go test -race ./...` is the gate.
|
||||
|
||||
### Vertical slice integrity (P02)
|
||||
|
||||
- **Wave 1** produces a runnable, testable artifact: `certpaths.DBPath()` (cycle broken) + `store.MigrationVersion` (tested). `go test -race ./internal/store/... ./internal/certpaths/...` passes. No doctor code depends on the stubs being changed yet.
|
||||
- **Wave 2** builds on Wave 1 to deliver the real `DB()` and `Network()` checks, wires the CLI, and replaces the stub tests. After Wave 2 an operator can demo `orca doctor` showing real PASS/WARN/FAIL for db and network.
|
||||
|
||||
---
|
||||
|
||||
## Phase P03 (final): review + ship + audit
|
||||
|
||||
**Goal:** Review the v0.3 milestone for completeness against REQ-022/030/032, audit the codebase for leftover stubs/dead code, run the full CI gate (`go test -race ./...`, `gosec`, `govulncheck`, `gitleaks`), tag the milestone release, and ship.
|
||||
|
||||
**Requirements:** REQ-022 (verify complete), REQ-030 (verify complete), REQ-032 (verify complete)
|
||||
**Milestone:** v0.3
|
||||
**Phase tag:** v0.3.3 (= milestone release; target milestone tag `v0.4.0` per ROADMAP next-minor rule)
|
||||
|
||||
### Wave 1: Review + audit + ship (single wave)
|
||||
|
||||
| Task ID | Description | Persona | Files | Must-have | Deps |
|
||||
|---------|-------------|---------|-------|-----------|------|
|
||||
| 03-01-01 | Verify REQ coverage: confirm REQ-022 (iter.Seq streaming job lists), REQ-030 (--watch table/JSON modes), REQ-032 (doctor network + db) are fully implemented. Update `REQUIREMENTS.md` status for REQ-022/030/032 from Pending/Partial → **Complete**. Cross-check against the plan's must-have criteria. | lead-developer | `.ciagent/REQUIREMENTS.md` | All three REQs marked Complete with phase references; no remaining "stub" or "Pending" status for v0.3 scope. | P01, P02 complete |
|
||||
| 03-01-02 | Codebase audit: `grep -r "NetworkStub\|DBStub" internal/` returns nothing; `grep -r "TODO\|FIXME" internal/` reviewed (no v0.3 leftovers); confirm no `dbPath` duplication remains in `internal/cli`; confirm `iter` import is used (no unused imports); run `go vet ./...`. | lead-developer | (read-only audit; edits only if cleanup needed) | `go vet ./...` clean; no stub references; no leftover TODOs for v0.3 scope. | 03-01-01 |
|
||||
| 03-01-03 | Full CI gate: `go build ./...`, `go test -race ./...`, `gosec` (vs baseline JSON), `govulncheck ./...` (offline mode per REQ-027), `gitleaks` (vs baseline per REQ-029). Fix any new findings. | lead-developer | (fixes if needed) | All gates green; no new gosec findings beyond baseline; govulncheck exit 0; gitleaks clean vs baseline. | 03-01-02 |
|
||||
| 03-01-04 | Tag + ship: per `.ciagent/RELEASE_POLICY.md`, tag `v0.3.3` (phase tag) and the milestone tag (next-minor per ROADMAP). Produce Gitea release. Update `ROADMAP.md` v0.3 section to mark P01/P02/P03 complete. | lead-developer | `.ciagent/ROADMAP.md` | `v0.3.3` tag exists; Gitea release published; ROADMAP v0.3 checkboxes updated. | 03-01-03 |
|
||||
|
||||
### Test strategy (P03)
|
||||
|
||||
- No new tests; this phase is review + audit + release.
|
||||
- The gate is the existing test suite + security scans all passing under CI.
|
||||
|
||||
---
|
||||
|
||||
## Cross-phase notes
|
||||
|
||||
- **Phase ordering / parallelism (D-042, revised by G-003):** P01 Wave 1 and P02 Wave 1 may run in parallel (file-disjoint: store repos vs certpaths+migrate). **P02 Wave 1 (02-01-01) MUST complete before P01 Wave 2 (01-02-04)** because both modify `internal/cli/node.go` (P01 adds `--watch`, P02 removes old `dbPath`). P01 Wave 2 tasks 01-02-01..01-02-03 (job.go only) are not blocked by P02. Recommended order: P01 W1 + P02 W1 in parallel → P02 W1 02-01-01 completes → P01 W2 (job.go tasks) + P02 W2 in parallel → P01 W2 01-02-04 (node.go) after 02-01-01. P03 is strictly sequential after both phases complete.
|
||||
- **No new dependencies (D-041):** `iter` (P01) and the mTLS health probe (P02) use stdlib + existing internal packages only. The 4 direct `go.mod` deps (cobra, hcl/v2, modernc/sqlite, uuid) are unchanged.
|
||||
- **Decisions logged during planning (new, this plan):**
|
||||
- **D-043** — `watchInterval` test hook: an unexported package var in `internal/store` (default `1 * time.Second`) referenced by both `Watch` methods, overridable from `_test.go`. Avoids a public `WatchWithInterval` constructor that would leak test-only API into production. Confidence 0.90.
|
||||
- **D-044** — P01 Wave 1 / Wave 2 split: Wave 1 = store-layer `Watch` methods + tests (data-engineer only, fully isolated); Wave 2 = CLI `--watch` flag + renders + CLI tests (cli-engineer). This keeps the `iter.Seq` contract verifiable without the CLI and matches persona territories. Confidence 0.93.
|
||||
- **D-045** — P02 Wave 1 / Wave 2 split: Wave 1 = `certpaths.DBPath()` relocation + `store.MigrationVersion` + tests (breaks the import cycle, data-engineer + lead-developer); Wave 2 = real `DB()`/`Network()` checks + CLI wiring + doctor tests. Wave 1 is the unblock for both checks. Confidence 0.91.
|
||||
- **D-046** — `--watch --json` event wrapper shape: `{"event":"update","job":{...}}` / `{"event":"init","job":{...}}` (and `node` analog). `"init"` on first sighting of an ID, `"update"` on subsequent change. Unchanged IDs on a tick emit nothing. Confidence 0.80 (matches D-030's per-event interpretation of REQ-030).
|
||||
|
||||
## Grill amendments (binding ACCEPT verdicts applied)
|
||||
|
||||
Three binding changes from `.ciagent/GRILL_v0.3.md` have been applied to this plan:
|
||||
|
||||
- **G-001 [CRITICAL]** — `Watch` element type changed from `iter.Seq[*model.Job]` (per-row) to `iter.Seq[[]*model.Job]` (full snapshot per tick). Each tick yields the complete snapshot as a single slice. This makes table render mode correct (clear-screen + re-render needs full snapshot) and enables natural `"delete"` events in JSON mode. Applied to tasks 01-01-01, 01-01-02, 01-02-02, 01-02-03, 01-02-04, 01-01-04.
|
||||
- **G-002 [CRITICAL]** — `Watch` must yield immediately on the first iteration, then `select` on the ticker for subsequent ticks. Prevents a 1s blank-screen UX bug in production (tests with 10ms interval missed this). Applied to tasks 01-01-01, 01-01-02; new test `TestWatch_ImmediateFirstYield` added to 01-01-04.
|
||||
- **G-003 [HIGH]** — D-042's "file-disjoint" claim corrected: both P01 (01-02-04) and P02 (02-01-01) modify `internal/cli/node.go`. P02 Wave 1 task 02-01-01 is now a dependency of P01 Wave 2 task 01-02-04. Cross-phase ordering updated.
|
||||
|
||||
DEFER items (G-004, G-006, G-007, G-009, G-012) are noted in the grill report and will be addressed during execution.
|
||||
|
||||
## Summary
|
||||
|
||||
- **Phases:** 3 (P01, P02 execution; P03 final review/ship)
|
||||
- **Waves:** P01 = 2 waves (4 + 5 tasks); P02 = 2 waves (3 + 5 tasks); P03 = 1 wave (4 tasks). Total = 5 waves.
|
||||
- **Tasks:** P01 = 9, P02 = 8, P03 = 4. Total = 21 tasks.
|
||||
- **Grill amendments:** G-001 (snapshot-per-tick), G-002 (immediate first yield), G-003 (serialize P02 W1 → P01 W2 on node.go). 3 ACCEPT verdicts applied.
|
||||
- **New planning decisions:** D-043 (watchInterval test hook), D-044 (P01 wave split), D-045 (P02 wave split), D-046 (JSON event wrapper shape).
|
||||
- **Requirements closed:** REQ-022, REQ-030 (P01); REQ-032 (P02, completion).
|
||||
- **No new go.mod dependencies.** No source code written in this plan — implementation begins at P01 Wave 1.
|
||||
@@ -1,175 +0,0 @@
|
||||
---
|
||||
milestone: v0.5
|
||||
milestone_slug: distribution
|
||||
type: feature
|
||||
phase_count: 4
|
||||
---
|
||||
|
||||
# Plan: Orca v0.5 — Distribution
|
||||
|
||||
Vertical-slice plan for the v0.5 Distribution milestone. Each phase is a
|
||||
vertical slice that ships independently as a patch on the v0.4.x line.
|
||||
The final phase (P4) is the milestone release (promoted to v0.5.0).
|
||||
|
||||
## Requirement → Phase Mapping
|
||||
|
||||
| REQ | Phase | Priority |
|
||||
|-----|-------|----------|
|
||||
| REQ-045 (public releases) | P0 ship (operational) | High |
|
||||
| REQ-041 (ORCA_HOME unified namespace) | P1 | High |
|
||||
| REQ-042 (--system flag) | P1 | High |
|
||||
| REQ-043 (install.sh 1-liner) | P2 | High |
|
||||
| REQ-044 (in-place update) | P2 | High |
|
||||
| REQ-046 (docker release) | P3 | Medium |
|
||||
| REQ-016 (README quickstart) | P2 | Medium (completion) |
|
||||
|
||||
## Phase 1 — Namespace Unification (REQ-041, REQ-042)
|
||||
|
||||
**Goal**: Single `ORCA_HOME` env var as namespace root for all
|
||||
on-disk state; `--system` flag selects `/root/.orca`.
|
||||
|
||||
**Persona**: backend-engineer (store/certpaths routing) + cli-engineer
|
||||
(`--system` flag).
|
||||
|
||||
**Wave 1** (single wave — no inter-task dependencies):
|
||||
|
||||
| Task | File(s) | Persona | REQ |
|
||||
|------|---------|---------|-----|
|
||||
| T1.1: Route `store.Open("")` through `certpaths.DBPath()` | `internal/store/store.go` | backend-engineer | REQ-041 |
|
||||
| T1.2: Route `init` command through `certpaths.Dir()` | `internal/cli/init.go` | backend-engineer | REQ-041 |
|
||||
| T1.3: Add `--system` persistent flag on `rootCmd` + `PersistentPreRunE` that sets `ORCA_HOME=/root/.orca` | `internal/cli/root.go` | cli-engineer | REQ-042 |
|
||||
| T1.4: Add `namespace_test.go` covering user-level, `ORCA_HOME` override, `--system` | `internal/cli/namespace_test.go` | cli-engineer | REQ-041/042 |
|
||||
| T1.5: Update `docs/namespace.md` (paths reference) | `docs/namespace.md` | backend-engineer | REQ-041 |
|
||||
|
||||
**Must-haves**:
|
||||
- `go test ./...` passes (including new namespace_test.go).
|
||||
- `ORCA_HOME=/tmp/x orca init` creates `/tmp/x` (not `~/.orca`).
|
||||
- `orca --system init` creates `/root/.orca` (when run as root).
|
||||
- Empty `ORCA_HOME` + no `--system` → `~/.orca` (backward compat).
|
||||
|
||||
**Verification**: 4-layer (structural: gofmt/vet; behavioral: namespace_test
|
||||
+ existing doctor_test; security: no new secret surface; quality: no
|
||||
regression in existing tests).
|
||||
|
||||
**Ship**: tag `v0.4.2`.
|
||||
|
||||
## Phase 2 — install.sh + In-Place Update (REQ-043, REQ-044, REQ-016)
|
||||
|
||||
**Goal**: 1-liner installer from public Gitea releases; idempotent
|
||||
update-in-place; README quickstart.
|
||||
|
||||
**Persona**: devops-engineer.
|
||||
|
||||
**Wave 1**:
|
||||
|
||||
| Task | File(s) | Persona | REQ |
|
||||
|------|---------|---------|-----|
|
||||
| T2.1: Write `scripts/install.sh` (curl 1-liner, user/system, latest/pinned, in-place update) | `scripts/install.sh` | devops-engineer | REQ-043/044 |
|
||||
| T2.2: Write `scripts/install_test.sh` (mocked download, path verification, update-in-place) | `scripts/install_test.sh` | devops-engineer | REQ-043/044 |
|
||||
| T2.3: Update README quickstart with 1-liner install + `--system` variant | `README.md` | devops-engineer | REQ-016 |
|
||||
| T2.4: Write `docs/install.md` (full install reference, troubleshooting, ORCA_HOME) | `docs/install.md` | devops-engineer | REQ-043 |
|
||||
|
||||
**install.sh spec** (per R-006):
|
||||
- Default: user-level. Binary → `~/.local/bin/orca`. Namespace → `~/.orca`.
|
||||
- `--system`: binary → `/usr/local/bin/orca`, namespace → `/root/.orca`. Requires root (uid 0).
|
||||
- `--version vX.Y.Z`: pin version. Default: query `/api/v1/repos/coreci/orca/releases/latest`.
|
||||
- Download `orca-{tag}-linux-{arch}.tar.gz` from the release asset.
|
||||
- In-place update: if `orca` exists at install path, run `orca version --json`,
|
||||
parse `version`, print "updated from X to Y". Overwrite binary. **Never**
|
||||
touch the namespace dir.
|
||||
- Detect arch: `amd64` (x86_64), `arm64` (aarch64).
|
||||
- Idempotent: re-running with same version is a no-op (or reinstalls).
|
||||
|
||||
**Must-haves**:
|
||||
- `bash scripts/install_test.sh` passes (mocked).
|
||||
- `curl -fsSL <url> | bash` works on a fresh system (verified in P4 e2e).
|
||||
- `curl -fsSL <url> | bash -s -- --system` installs to `/usr/local/bin` (as root).
|
||||
- Re-running updates the binary; `~/.orca/orca.db` preserved.
|
||||
|
||||
**Verification**: 4-layer (structural: shellcheck; behavioral:
|
||||
install_test.sh; security: no secret in script, no eval of remote
|
||||
content beyond the script itself; quality: idempotent).
|
||||
|
||||
**Ship**: tag `v0.4.3`.
|
||||
|
||||
## Phase 3 — Docker Release (REQ-046)
|
||||
|
||||
**Goal**: Multi-stage Dockerfile; publish to Gitea container registry
|
||||
per release.
|
||||
|
||||
**Persona**: devops-engineer.
|
||||
|
||||
**Wave 1**:
|
||||
|
||||
| Task | File(s) | Persona | REQ |
|
||||
|------|---------|---------|-----|
|
||||
| T3.1: Write `Dockerfile` (multi-stage: golang:1.25 → distroless/static-debian12) | `Dockerfile` | devops-engineer | REQ-046 |
|
||||
| T3.2: Extend `scripts/release.sh` with docker build + login + push | `scripts/release.sh` | devops-engineer | REQ-046 |
|
||||
| T3.3: Add `container-publish` step to `.coreci.yml` release pipeline | `.coreci.yml` | devops-engineer | REQ-046 |
|
||||
| T3.4: Write `docs/docker.md` (docker run quickstart, volume mounts, ORCA_HOME) | `docs/docker.md` | devops-engineer | REQ-046 |
|
||||
| T3.5: Add `.dockerignore` (exclude .git, bin, .env, *.tar.gz) | `.dockerignore` | devops-engineer | REQ-046 |
|
||||
|
||||
**Dockerfile spec** (per R-005):
|
||||
- Stage 1 (`golang:1.25`): `CGO_ENABLED=0 go build -trimpath -ldflags=... -o /orca ./cmd/orca`.
|
||||
- Stage 2 (`gcr.io/distroless/static-debian12:nonroot`): `COPY --from=builder /orca /orca`, `ENV ORCA_HOME=/var/lib/orca`, `ENTRYPOINT ["/orca"]`.
|
||||
- `ARG VERSION` + `ARG GIT_COMMIT` + `ARG BUILD_TIME` for ldflags injection.
|
||||
- Image runs as `nonroot` user (distroless default) — `ORCA_HOME=/var/lib/orca` must be volume-mounted.
|
||||
|
||||
**release.sh extension**:
|
||||
- After Gitea release: `docker build --build-arg VERSION=$VERSION ... -t git.cloudinit.dev/coreci/orca:$VERSION -t git.cloudinit.dev/coreci/orca:latest .`
|
||||
- `echo "$GITEA_TOKEN" | docker login git.cloudinit.dev -u cloudinit-bot --password-stdin`
|
||||
- `docker push git.cloudinit.dev/coreci/orca:$VERSION` + `docker push git.cloudinit.dev/coreci/orca:latest`
|
||||
- Skip gracefully if `docker` not on PATH (local dev without docker).
|
||||
|
||||
**.coreci.yml extension**:
|
||||
- New step `container-publish` in the `release` pipeline, using an image with docker CLI (e.g., `docker:24-cli` with docker-in-docker service, or a custom image). Per P-001 pitfall.
|
||||
|
||||
**Must-haves**:
|
||||
- `docker build -t orca-test .` succeeds locally.
|
||||
- `docker run --rm orca-test version` prints the version.
|
||||
- `scripts/release.sh vX.Y.Z` publishes both the Gitea release AND the container image.
|
||||
- `.coreci.yml` release pipeline includes the container-publish step.
|
||||
|
||||
**Verification**: 4-layer (structural: Dockerfile lint; behavioral: docker
|
||||
build + run; security: no secret in image, .env excluded; quality:
|
||||
reproducible build via ARGs).
|
||||
|
||||
**Ship**: tag `v0.4.4`.
|
||||
|
||||
## Phase 4 — Final Review + Ship + Audit (Milestone Release)
|
||||
|
||||
**Goal**: Multi-persona review, audit, milestone ship.
|
||||
|
||||
**Tasks**:
|
||||
| Task | Persona | Detail |
|
||||
|------|---------|--------|
|
||||
| T4.1: `ciagent-review` | all | Review P1-P3 changes across personas |
|
||||
| T4.2: `ciagent-audit` | lead-developer | Reconstruction test, file/branch/commit discipline |
|
||||
| T4.3: End-to-end verification | lead-developer | Unauth curl to releases API (REQ-045 ✓), fresh install.sh (REQ-043 ✓), `--system` (REQ-042 ✓), update-in-place (REQ-044 ✓), docker pull+run (REQ-046 ✓) |
|
||||
| T4.4: Milestone ship | lead-developer | Merge phase/04 → milestone/v0.5 → main, tag v0.4.5, create milestone release, build + upload all artifacts |
|
||||
| T4.5: Complete milestone | lead-developer | Update REQUIREMENTS.md (REQ-041..046 complete), ROADMAP.md (v0.5 complete), clear CHECKPOINT.json |
|
||||
|
||||
**Ship**: tag `v0.4.5` (the milestone release, promoted to `v0.5.0`).
|
||||
|
||||
## Wave Ordering Summary
|
||||
|
||||
All 4 phases are single-wave (no inter-phase dependencies within a
|
||||
phase). Phases execute strictly sequentially: P1 → P2 → P3 → P4.
|
||||
|
||||
- **P1** (Wave 1): T1.1..T1.5 — namespace unification.
|
||||
- **P2** (Wave 1): T2.1..T2.4 — install.sh.
|
||||
- **P3** (Wave 1): T3.1..T3.5 — docker.
|
||||
- **P4** (Wave 1): T4.1..T4.5 — review + ship.
|
||||
|
||||
## Versioning
|
||||
|
||||
- P0 ship: `v0.4.1` (first patch on v0.4.x line after v0.4.0 milestone tag).
|
||||
- P1 ship: `v0.4.2`.
|
||||
- P2 ship: `v0.4.3`.
|
||||
- P3 ship: `v0.4.4`.
|
||||
- P4 ship: `v0.4.5` (final phase = milestone release, promoted to `v0.5.0`).
|
||||
|
||||
Tags run on the v0.4.x line (previous minor). The milestone branch label
|
||||
is `milestone/v0.5-distribution`. No separate minor tag — the final
|
||||
phase's patch IS the milestone release per `run.md` versioning logic
|
||||
for feature milestones.
|
||||
@@ -1,236 +0,0 @@
|
||||
# Phase Plans: Orca v0.6 — Node Bootstrap & Proxmox
|
||||
|
||||
All 3 execution phases + final review with vertical-slice structure,
|
||||
wave ordering, and REQ-ID mapping. v0.6 scope: **Node Bootstrap &
|
||||
Proxmox** — `orca init` full bootstrap, Proxmox SSH join, doctor
|
||||
extensions.
|
||||
|
||||
Branching: branches numbered from phase 12 onward (v0.1 used 01-07,
|
||||
v0.2 used 08-11, v0.3 used 00+01-03, v0.5 used 00+01-04). v0.6 uses
|
||||
`phase/01-*`..`phase/04-*` on the `milestone/v0.6-node-bootstrap-proxmox`
|
||||
branch (numbering restarts per milestone per branch-strategy.md).
|
||||
|
||||
---
|
||||
|
||||
## Phase 1: `orca init` Full Bootstrap + Schema 0006 (Wave 1)
|
||||
|
||||
**Branch**: `phase/01-init-bootstrap`
|
||||
**REQ Coverage**: REQ-047, REQ-048, REQ-049
|
||||
**Persona leads**: data-engineer (schema), backend-engineer (init orchestration), cli-engineer (output UX)
|
||||
|
||||
### Must-Haves
|
||||
|
||||
#### data-engineer territory
|
||||
- [ ] `internal/store/migrations/0006_node_kind_os.sql` — `ALTER TABLE nodes ADD COLUMN kind TEXT; ALTER TABLE nodes ADD COLUMN os TEXT;` (nullable, backward-compatible)
|
||||
- [ ] `internal/model/node.go` — add `Kind string `json:"kind,omitempty"`` + `OS string `json:"os,omitempty"`` fields; add `NodeKind` constants (`NodeKindLocalhost`, `NodeKindLinux`, `NodeKindProxmox`)
|
||||
- [ ] `internal/store/node_repo.go` — extend `Insert`/`Get`/`List`/`Watch`/`scanNode` for `kind, os` columns (use `sql.NullString`, map NULL → `""`); add `GetByName(ctx, name) (*Node, error)` and `UpdateLastSeenAndOS(ctx, id, os string) error` helpers
|
||||
- [ ] `internal/store/node_repo_test.go` — extend tests for new columns + helpers; assert NULL → `""` mapping; assert `GetByName` returns `ErrNotFound` for missing; assert `UpdateLastSeenAndOS` refreshes `last_seen` + `os` without changing `id`/`joined_at`
|
||||
|
||||
#### backend-engineer territory
|
||||
- [ ] `internal/cli/init.go` — full bootstrap sequence (replace current 35-line mkdir-only impl):
|
||||
- [ ] MkdirAll(certpaths.Dir(), 0o755) — keep
|
||||
- [ ] store.Open(certpaths.DBPath()) — runs migrations 0001..0006
|
||||
- [ ] security.CAInit(certpaths.Dir(), "orca-internal-ca") — idempotent (existing fast-path)
|
||||
- [ ] if !exists(certpaths.ServerCertPath()): GenerateCSR("localhost", ["localhost","127.0.0.1"]) → ca.SignCSR → WriteCert + WriteKey
|
||||
- [ ] detectOS() from /etc/os-release (see cli-engineer territory)
|
||||
- [ ] localhost node upsert: GetByName("localhost") → if found UpdateLastSeenAndOS; else Insert with kind=localhost, os=<detected>, name="localhost", addr="localhost:8443"
|
||||
- [ ] print summary (CA fp, server cert fp, os, node id, db path)
|
||||
- [ ] `internal/cli/init_test.go` — idempotency test: run init twice, assert no duplicate localhost node, last_seen refreshed, os unchanged; assert CA/cert not regenerated on re-run; assert doctor passes after init
|
||||
|
||||
#### cli-engineer territory
|
||||
- [ ] `internal/cli/osdetect.go` (NEW) — `detectOS() string`: read `/etc/os-release` then fall back to `/usr/lib/os-release`; parse `KEY=VALUE` lines via bufio.Scanner + strings.SplitN; strip surrounding quotes; return `ID` value or `"linux"` fallback. Map ubuntu/debian/alpine → verbatim; unknown values stored verbatim (not masked).
|
||||
- [ ] `internal/cli/osdetect_test.go` — test parsing with sample os-release content (ubuntu, debian, alpine, missing file, missing ID=, unknown ID, quoted values)
|
||||
- [ ] `internal/cli/init.go` output UX — multi-step progress lines: "✓ Namespace dir: ...", "✓ Database initialized: ...", "✓ CA provisioned: ... (fp=...)", "✓ Server cert provisioned: ... (fp=...)", "✓ OS detected: ubuntu", "✓ Localhost node registered: <id>"; `--json` outputs a single JSON summary object
|
||||
|
||||
### Verification
|
||||
|
||||
- `go build ./...` PASS
|
||||
- `go test ./internal/store/... ./internal/cli/... ./internal/model/...` PASS
|
||||
- `go test -race ./...` PASS
|
||||
- `orca init` on a fresh namespace → creates dir, db, CA, server cert, localhost node; `orca doctor` passes with zero FAILs
|
||||
- `orca init` re-run → no duplicate localhost node, last_seen refreshed, CA/cert not regenerated (idempotent, D-036)
|
||||
- `orca init --json` → valid JSON summary
|
||||
- `orca node list` shows the localhost node with kind=localhost, os=<detected>
|
||||
- Migration 0006 applies cleanly on existing dbs (existing rows get NULL kind/os → scanned as `""`)
|
||||
|
||||
---
|
||||
|
||||
## Phase 2: Proxmox SSH Join (Wave 1)
|
||||
|
||||
**Branch**: `phase/02-proxmox-join`
|
||||
**REQ Coverage**: REQ-050, REQ-051
|
||||
**Persona leads**: security-engineer (SSH key, TOFU, sudoers, PVE role), backend-engineer (SSH session orchestration), cli-engineer (flag wiring)
|
||||
**Depends on**: Phase 1 (migration 0006 + Node.Kind/OS fields)
|
||||
|
||||
### Must-Haves
|
||||
|
||||
#### dependency + security-engineer territory
|
||||
- [ ] `go.mod` / `go.sum` — add `golang.org/x/crypto v0.54.0`; bump `golang.org/x/sys` to v0.47.0; add `golang.org/x/term v0.45.0` (indirect). Run `go mod tidy`.
|
||||
- [ ] `internal/certpaths/certpaths.go` — add `SSHKeyPath() → Dir()/orca_ssh_key`, `SSHPubPath() → Dir()/orca_ssh_key.pub`, `KnownHostsPath() → Dir()/known_hosts`
|
||||
- [ ] `internal/security/sshkey.go` (NEW) — `GenerateOrLoadSSHKey(dir string) (keyPEM, pubLine []byte, err error)`:
|
||||
- [ ] If `orca_ssh_key` + `.pub` exist → load + return (idempotent)
|
||||
- [ ] Else: `ed25519.GenerateKey(rand.Reader)` → `x509.MarshalPKCS8PrivateKey` → PEM encode → `writeAtomic(keyPath, 0600, keyPEM)`; `ssh.NewPublicKey(pub)` → `ssh.MarshalAuthorizedKey` → `writeAtomic(pubPath, 0644, pubLine)`
|
||||
- [ ] Return keyPEM (for `ssh.ParsePrivateKey`) + pubLine (authorized_keys line)
|
||||
- [ ] `internal/security/sshkey_test.go` — test generate → load round-trip; test idempotent re-load; test file modes (0600/0644); test `ssh.ParsePrivateKey` accepts the PKCS8 PEM
|
||||
|
||||
#### backend-engineer territory (with security-engineer co-own)
|
||||
- [ ] `internal/proxmox/bootstrap.go` (NEW package) — `BootstrapProxmox(ctx context.Context, opts Options) (*Result, error)`:
|
||||
- **Options**: `Host, SSHUser, Password, ProxmoxUser (default "orca"), ProxmoxRole (default "OrcaOperator"), Port (default 22)`, `Logger *slog.Logger`
|
||||
- **Step 1**: `security.GenerateOrLoadSSHKey(certpaths.Dir())` → keyPEM, pubLine
|
||||
- **Step 2**: Build `ssh.ClientConfig` with `ssh.Password(opts.Password)` auth + `knownhosts.New(certpaths.KnownHostsPath())` HostKeyCallback (TOFU: captures on first connect, verifies on subsequent)
|
||||
- **Step 3**: `ssh.Dial("tcp", host:port, config)` with 10s timeout
|
||||
- **Step 4**: Deploy pubkey — `session.CombinedOutput("mkdir -p ~orca/.ssh && touch ~orca/.ssh/authorized_keys && chmod 0700 ~orca/.ssh && chmod 0600 ~orca/.ssh/authorized_keys && grep -qF '<publine>' ~orca/.ssh/authorized_keys || echo '<publine>' >> ~orca/.ssh/authorized_keys")` (idempotent append)
|
||||
- **Step 5**: Create orca system user — `session.CombinedOutput("id -u orca 2>/dev/null || useradd -m -s /bin/bash orca")` (idempotent)
|
||||
- **Step 6**: Create PVE role — `session.CombinedOutput("pveum role list 2>/dev/null | grep -q '^OrcaOperator' || pveum role add OrcaOperator --privs 'VM.Audit Datastore.AllocateSpace SDN.Use'")` (idempotent; use opts.ProxmoxRole for the name)
|
||||
- [ ] Step 7: Create PVE user — `session.CombinedOutput("pveum user list 2>/dev/null | grep -q 'orca@pam' || pveum user add orca@pam -comment 'Orca automation user'")` (idempotent; use opts.ProxmoxUser)
|
||||
- [ ] Step 8: Assign ACL — `session.CombinedOutput("pveum acl modify / -user orca@pam -role OrcaOperator")` (idempotent)
|
||||
- [ ] Step 9: Write sudoers — resolve binary paths via `command -v pct` etc.; write `/etc/sudoers.d/orca` (mode 0440) with NOEXEC on pct/qm, no NOEXEC on apt-get/dpkg; exclude pvesh (AD-020)
|
||||
- [ ] Step 10: Validate sudoers — `session.CombinedOutput("visudo -cf /etc/sudoers.d/orca")`; abort + cleanup if validation fails
|
||||
- [ ] Step 11: Audit log — `logger.Info("proxmox.bootstrap_ok", slog.String("host", opts.Host), slog.String("user", opts.ProxmoxUser), slog.String("role", opts.ProxmoxRole))`
|
||||
- [ ] **Result**: `Node{Kind: "proxmox", OS: "pve", Name: opts.Host, Address: opts.Host + ":8443"}`
|
||||
- [ ] `internal/proxmox/bootstrap_test.go` — unit tests with a mock SSH server (`httptest`-style or `net.Pipe` + manual SSH handshake) OR test the command-builder functions in isolation (probe commands, sudoers content, idempotency checks). Integration test against a real Proxmox host is out of scope for unit tests (flagged as `// +build integration`).
|
||||
|
||||
#### cli-engineer territory
|
||||
- [ ] `internal/cli/node.go` — extend `nodeJoinCmd`:
|
||||
- [ ] Add `--type` flag (values: `localhost` default, `linux`, `proxmox`)
|
||||
- [ ] Add `--host`, `--ssh-user` (default `root`), `--password`, `--proxmox-user` (default `orca`), `--proxmox-role` (default `OrcaOperator`), `--ssh-port` (default `22`) flags
|
||||
- [ ] When `--type proxmox`: validate `--host` + (`--password` or `$ORCA_PROXMOX_PASSWORD`) are set; call `proxmox.BootstrapProxmox(ctx, opts)`; insert the returned node via `NodeRepo.Insert`; print summary
|
||||
- [ ] When `--type localhost` (default): existing flow (fingerprint check + registry.Join)
|
||||
- [ ] Password from `--password` flag OR `$ORCA_PROXMOX_PASSWORD` env var (prefer env var per D-031; never log the password; zero the byte slice after use)
|
||||
- [ ] `internal/cli/node_test.go` — test flag wiring; test `--type proxmox` validation (missing host/password → error); test env var fallback
|
||||
|
||||
### Verification
|
||||
|
||||
- `go build ./...` PASS
|
||||
- `go test ./internal/proxmox/... ./internal/security/... ./internal/cli/...` PASS
|
||||
- `go test -race ./...` PASS
|
||||
- `go mod tidy` leaves no unused deps; `go.sum` has `golang.org/x/crypto v0.54.0`
|
||||
- `orca node join --type proxmox --host <pve-host> --password <pw>` on a real Proxmox 8/9 host:
|
||||
- Creates orcaOperator role, orca@pam user, ACL, sudoers file
|
||||
- `orca@pam` can `sudo pct list`, `sudo qm list`, `sudo apt-get update` without password
|
||||
- `orca@pam` CANNOT `sudo pvesh` (not in sudoers)
|
||||
- `orca@pam` CANNOT `sudo bash` (not in sudoers)
|
||||
- `visudo -cf /etc/sudoers.d/orca` passes
|
||||
- Re-running the join command is idempotent (no duplicate role/user/ACL/sudoers/key)
|
||||
- `orca node list` shows the proxmox node with kind=proxmox, os=pve
|
||||
- Audit log contains `proxmox.bootstrap_ok` entry with host, user, role
|
||||
- `~/.orca/orca_ssh_key` is 0600, `.pub` is 0644, `known_hosts` contains the PVE host key
|
||||
|
||||
---
|
||||
|
||||
## Phase 3: Doctor Extensions + Audit Logging (Wave 2)
|
||||
|
||||
**Branch**: `phase/03-doctor-extensions`
|
||||
**REQ Coverage**: REQ-052
|
||||
**Persona leads**: cli-engineer (subcommand wiring), backend-engineer (check logic), security-engineer (audit logging)
|
||||
**Depends on**: Phase 1 (localhost node + os field), Phase 2 (proxmox nodes + SSH client)
|
||||
|
||||
### Must-Haves
|
||||
|
||||
#### backend-engineer territory
|
||||
- [ ] `internal/doctor/doctor.go` — add `OS()` check:
|
||||
- Re-run `detectOS()` (from `internal/cli/osdetect.go` — extract to shared package or pass as param)
|
||||
- Load localhost node via `NodeRepo.GetByName("localhost")`
|
||||
- Compare detected OS to stored `node.OS`; drift → WARN ("OS drift: init=ubuntu, now=debian — re-run `orca init` to refresh"); match → PASS
|
||||
- Missing localhost node → FAIL ("no localhost node — run `orca init`")
|
||||
- [ ] `internal/doctor/doctor.go` — add `Proxmox()` check (clone `Network()` pattern):
|
||||
- List nodes from `NodeRepo`, filter `kind == "proxmox"`
|
||||
- Zero proxmox nodes → WARN ("no proxmox nodes registered (single-node?)")
|
||||
- Per node: load orca SSH key, build `ssh.ClientConfig` with `ssh.PublicKeys(signer)` + `knownhosts.New`, dial with 3s timeout, run `pveversion` via session
|
||||
- PASS = reachable + pveversion exits 0; FAIL = unreachable or pveversion fails
|
||||
- Accumulate per-node lines (clone `Network()`'s `lines []string` pattern)
|
||||
- [ ] `internal/doctor/doctor.go` — extend `All()` to include `OS()` and `Proxmox()`
|
||||
- [ ] `internal/doctor/doctor_test.go` — test `OS()` with mock node repo (drift, match, missing); test `Proxmox()` with mock nodes (zero nodes → WARN, reachable → PASS, unreachable → FAIL)
|
||||
|
||||
#### cli-engineer territory
|
||||
- [ ] `internal/cli/doctor.go` — add `doctorOSCmd` + `doctorProxmoxCmd` subcommands wired to `doctor.OS()` / `doctor.Proxmox()`; add to `doctorCmd.AddCommand(...)`
|
||||
- [ ] `internal/cli/doctor.go` — `doctor os` and `doctor proxmox` honor `--json` flag (reuse existing pattern)
|
||||
|
||||
#### security-engineer territory
|
||||
- [ ] `internal/audit/audit.go` (extend) — emit `proxmox.bootstrap_ok`, `proxmox.bootstrap_fail`, `node.os_drift` events with structured slog fields
|
||||
- [ ] Audit log entries for all bootstrap + join actions (REQ-052): `orca init` emits `init.bootstrap_ok` (os, node_id, ca_fp); `orca node join --type proxmox` emits `proxmox.bootstrap_ok` (host, user, role); `doctor os` drift emits `node.os_drift` (init_os, current_os)
|
||||
|
||||
### Verification
|
||||
|
||||
- `go build ./...` PASS
|
||||
- `go test ./internal/doctor/... ./internal/cli/...` PASS
|
||||
- `go test -race ./...` PASS
|
||||
- `orca doctor` (after `orca init`) → all checks PASS (cert, db, os, network=zero peers WARN, proxmox=zero nodes WARN)
|
||||
- `orca doctor os` → PASS (OS matches)
|
||||
- `orca doctor proxmox` (no proxmox nodes) → WARN ("no proxmox nodes registered")
|
||||
- `orca doctor proxmox` (after joining a PVE host) → PASS per node
|
||||
- `orca doctor proxmox` (PVE host down) → FAIL per node with error message
|
||||
- Audit log contains `init.bootstrap_ok` and `proxmox.bootstrap_ok` entries
|
||||
- `--json` output for `doctor os` and `doctor proxmox` is valid JSON
|
||||
|
||||
---
|
||||
|
||||
## Phase 4: Final Review + Ship + Audit (Wave 3)
|
||||
|
||||
**Branch**: `phase/04-final-review-ship`
|
||||
**REQ Coverage**: REQ-047, REQ-048, REQ-049, REQ-050, REQ-051, REQ-052 (all)
|
||||
**Persona leads**: lead-developer (review + audit), all personas (post-hoc review)
|
||||
|
||||
### Must-Haves
|
||||
|
||||
- [ ] **Review** (delegate to `ciagent-review`): multi-persona code review across P01-P03
|
||||
- Auto-apply P0 fixes; flag P1+ for post-hoc review
|
||||
- Review territory discipline (warn mode)
|
||||
- Review test coverage for all 6 REQs
|
||||
- [ ] **Audit** (delegate to `ciagent-audit`):
|
||||
- Reconstruction test: git log matches `.ciagent/` files
|
||||
- Branch hygiene: phase branches merged cleanly to milestone
|
||||
- Commit discipline: all commits have `---ci---` blocks
|
||||
- File discipline: no stale `.ciagent/` files
|
||||
- [ ] **Ship** (delegate to `ciagent-ship`):
|
||||
- Merge `phase/04` → `milestone/v0.6`
|
||||
- Merge `milestone/v0.6` → `main` (rebase-then-fast-forward per config.json)
|
||||
- Tag `v0.5.4` (final phase patch = milestone release per feature-milestone promotion)
|
||||
- Create Gitea release with full milestone summary (all phases, all REQs)
|
||||
- [ ] **Complete milestone**:
|
||||
- Update `.ciagent/REQUIREMENTS.md` — mark REQ-047..052 as Complete
|
||||
- Update `.ciagent/ROADMAP.md` — mark v0.6 as complete
|
||||
- Update `.ciagent/CHECKPOINT.json` — `milestone_complete: true`
|
||||
- Commit: `docs(milestone): complete node-bootstrap-proxmox`
|
||||
|
||||
### Verification
|
||||
|
||||
- `git log --oneline main..milestone/v0.6` shows all phase commits in order
|
||||
- `git tag --list v0.5.*` shows v0.5.0..v0.5.4
|
||||
- `main` branch contains all v0.6 work (fast-forward merge)
|
||||
- `orca init && orca doctor` on a fresh checkout passes end-to-end
|
||||
- Gitea release `v0.5.4` exists with milestone summary
|
||||
|
||||
---
|
||||
|
||||
## Wave Ordering
|
||||
|
||||
- **Wave 1** (Phases 1-2): Schema + init bootstrap (P01) is a hard
|
||||
prerequisite for Proxmox join (P02) — P02 depends on the `Node.Kind`/
|
||||
`OS` fields + migration 0006 from P01. `parallelization.enabled=false`
|
||||
→ sequential.
|
||||
- **Wave 2** (Phase 3): Doctor extensions depend on both P01 (localhost
|
||||
node + os field for `doctor os`) and P02 (proxmox nodes + SSH client
|
||||
for `doctor proxmox`).
|
||||
- **Wave 3** (Phase 4): Final review + ship + audit — covers all
|
||||
execution phases.
|
||||
|
||||
For v0.6, `parallelization.enabled=false` — phases run sequentially.
|
||||
|
||||
## Versioning
|
||||
|
||||
- **Milestone type**: `feature` (P01/P02/P03 ship `feat` phases)
|
||||
- **Patch per phase**: `v0.5.0` (P0), `v0.5.1` (P01), `v0.5.2` (P02), `v0.5.3` (P03), `v0.5.4` (P04 final = milestone release)
|
||||
- Tags run on the previous minor's patch line (v0.5.x) per branch-strategy.md
|
||||
- Milestone branch label: `milestone/v0.6-node-bootstrap-proxmox` (uses milestone number, not tag line)
|
||||
|
||||
## Requirement Coverage Matrix
|
||||
|
||||
| REQ | Phase | Persona lead | Must-haves |
|
||||
|-----|-------|-------------|------------|
|
||||
| REQ-047 | P01 | backend-engineer | init.go full bootstrap (CA + cert + db + localhost node, idempotent) |
|
||||
| REQ-048 | P01 | backend-engineer + cli-engineer | detectOS() from /etc/os-release + localhost node registration |
|
||||
| REQ-049 | P01 | data-engineer | migration 0006 + Node.Kind/OS + NodeRepo schema extension |
|
||||
| REQ-050 | P02 | security-engineer + backend-engineer | proxmox.BootstrapProxmox SSH dance + sshkey.go + certpaths SSH paths |
|
||||
| REQ-051 | P02 | security-engineer | OrcaOperator PVE role + orca@pam user + sudoers NOEXEC design |
|
||||
| REQ-052 | P03 | backend-engineer + security-engineer | doctor OS() + Proxmox() + audit logging of all bootstrap/join actions |
|
||||
@@ -1,250 +0,0 @@
|
||||
# Phase Plans: Orca v0.7 — Hardening & Completion
|
||||
|
||||
All 4 execution phases + final review with vertical-slice structure, wave
|
||||
ordering, and REQ-ID mapping. v0.7 scope: **Hardening & Completion** —
|
||||
register the unreachable `orca cert` command, add HCL config file parsing,
|
||||
uplift test coverage in core packages, and add the long-deferred pprof
|
||||
endpoint.
|
||||
|
||||
Branching: `phase/01-cert-register`..`phase/05-final-review-ship` on the
|
||||
`milestone/v0.7-hardening-completion` branch (numbering restarts per
|
||||
milestone per branch-strategy.md).
|
||||
|
||||
Milestone type: **NFR** (all phases are fix/test/chore; no `feat` phases).
|
||||
Tags run on the v0.6.x patch line: `v0.6.0` (P0) … `v0.6.5` (P05 =
|
||||
milestone release).
|
||||
|
||||
---
|
||||
|
||||
## Phase 1: Register `orca cert` Command Tree + cert_repo Tests (Wave 1)
|
||||
|
||||
**Branch**: `phase/01-cert-register`
|
||||
**REQ Coverage**: REQ-053
|
||||
**Persona leads**: lead-developer (cert registration + smoke test), data-engineer (cert_repo tests)
|
||||
**Source ideas**: I-401, I-402, I-412
|
||||
|
||||
### Must-Haves
|
||||
|
||||
#### lead-developer territory
|
||||
- [ ] `internal/cli/cert.go` — add `init()` that calls `rootCmd.AddCommand(NewCommand(slog.Default()))`. This is the one-line fix that makes the entire `cert ca-init | gen | show | renew | fingerprint` tree reachable. (AD-022)
|
||||
- [ ] `internal/cli/cert_test.go` (NEW) — regression test asserting `rootCmd.Commands()` contains a child whose `Use == "cert"`; assert each subcommand (`ca-init`, `gen`, `show`, `renew`, `fingerprint`) is present on the cert child.
|
||||
- [ ] `internal/cli/cert_smoke_test.go` (NEW) — end-to-end smoke test against a temp `ORCA_HOME`:
|
||||
- [ ] `orca cert ca-init --cn test-ca` → succeeds, `ca.crt` + `ca.key` exist with modes 0644/0600
|
||||
- [ ] `orca cert gen --cn test-server --san localhost --san 127.0.0.1` → succeeds, `server.crt` + `server.key` exist with modes 0644/0600
|
||||
- [ ] `orca cert show` → outputs PEM with no `PRIVATE KEY` blocks (REQ-035 redaction)
|
||||
- [ ] `orca cert fingerprint --which ca` → outputs a 64-char hex SHA-256
|
||||
- [ ] `orca cert fingerprint --which server` → outputs a 64-char hex SHA-256
|
||||
- [ ] `orca cert renew` → succeeds, server cert file mtime updates
|
||||
- [ ] `internal/cli/root_test.go` — extend the existing root test to assert `orca cert` is in the command tree (belt-and-suspenders with cert_test.go)
|
||||
|
||||
#### data-engineer territory
|
||||
- [ ] `internal/store/cert_repo_test.go` (NEW) — table-driven tests for `CertRepo`:
|
||||
- [ ] `Insert` a cert row → `Get` by serial returns matching row
|
||||
- [ ] `Insert` duplicate `serial_hex` → returns error (UNIQUE constraint, I-107)
|
||||
- [ ] `List` returns certs ordered by `issued_at desc`
|
||||
- [ ] Rotation history: Insert 4 certs for the same node → only last N=3 retained (REQ-025); oldest is pruned
|
||||
- [ ] `GetActive` returns the most-recent cert for a node
|
||||
- [ ] `Delete` removes a cert by serial
|
||||
|
||||
### Verification
|
||||
|
||||
- `go build ./...` PASS
|
||||
- `go vet ./...` PASS
|
||||
- `go test ./internal/cli/... ./internal/store/...` PASS
|
||||
- `go test -race ./...` PASS
|
||||
- `./bin/orca cert` → prints help (no longer "unknown command")
|
||||
- `./bin/orca cert ca-init` on a temp `ORCA_HOME` → succeeds
|
||||
- `./bin/orca cert show` → no private key material in output (REQ-035)
|
||||
- cert_repo_test.go covers Insert/Get/List/rotation-prune/duplicate-serial
|
||||
|
||||
---
|
||||
|
||||
## Phase 2: HCL Config File Parsing (Wave 1)
|
||||
|
||||
**Branch**: `phase/02-config-parser`
|
||||
**REQ Coverage**: REQ-054
|
||||
**Persona leads**: backend-engineer (config package), lead-developer (root command --config flag wiring)
|
||||
**Source ideas**: I-406, I-408
|
||||
**Depends on**: Phase 1 (cert registration lands first so the CLI surface is complete before config extends it)
|
||||
|
||||
### Must-Haves
|
||||
|
||||
#### backend-engineer territory
|
||||
- [ ] `internal/config/config.go` (NEW package) — `Config` struct with HCL tags:
|
||||
- [ ] `DBPath string `hcl:"db_path,optional"``
|
||||
- [ ] `ListenAddr string `hcl:"listen_addr,optional"``
|
||||
- [ ] `CAPath string `hcl:"ca_path,optional"``
|
||||
- [ ] `ServerCertPath string `hcl:"server_cert_path,optional"``
|
||||
- [ ] `ServerKeyPath string `hcl:"server_key_path,optional"``
|
||||
- [ ] `NodeCapacity *CapacityConfig `hcl:"node_capacity,block"` (optional block)
|
||||
- [ ] `Load(paths ...string) (*Config, error)` — loads the first existing file from `paths` via `hclsimple.Decode` (reuse the jobspec pattern, `internal/jobspec/spec.go:40`); returns a zero-value `Config` if no file exists (no error)
|
||||
- [ ] `(*Config).MergeOverrides(flags Flags, env Environ) *Config` — applies precedence flag > env > file > default (D-039). Only non-zero flag values override; only set env vars override; file values are the base; missing fields fall back to `certpaths.*` defaults.
|
||||
- [ ] No package-level state (AD-023). `Load` is a pure function.
|
||||
- [ ] `internal/config/config_test.go` (NEW) — table-driven tests:
|
||||
- [ ] Load from a valid HCL file → all fields populated
|
||||
- [ ] Load from a missing file → zero Config, no error
|
||||
- [ ] Load from a malformed HCL file → error
|
||||
- [ ] MergeOverrides: flag wins over env wins over file wins over default (all 4 layers exercised)
|
||||
- [ ] MergeOverrides: empty flag does NOT override a set env value
|
||||
- [ ] MergeOverrides: empty env does NOT override a set file value
|
||||
- [ ] Optional `node_capacity` block parsed correctly
|
||||
|
||||
#### lead-developer territory
|
||||
- [ ] `internal/cli/root.go` — add `--config string` persistent flag (default `""`). In `PersistentPreRunE`, if `--config` is set, call `config.Load(flag)` and stash the `*Config` in `cmd.Context()` via a context key. If `--config` is empty, `config.Load` is not called (zero overhead; existing flag/env behavior unchanged).
|
||||
- [ ] `internal/cli/daemon.go` — in the daemon command, if a `*Config` is present in the context, use `cfg.ListenAddr` as the default addr (flag still overrides per D-039).
|
||||
- [ ] `internal/cli/root_test.go` — extend with `--config <tmpfile>` test: pass a config file, assert the merged values reach the daemon command.
|
||||
- [ ] `testdata/config.hcl` (NEW) — example config file for tests:
|
||||
```hcl
|
||||
db_path = "/tmp/orca/test.db"
|
||||
listen_addr = "127.0.0.1:9999"
|
||||
ca_path = "/tmp/orca/ca.crt"
|
||||
server_cert_path = "/tmp/orca/server.crt"
|
||||
server_key_path = "/tmp/orca/server.key"
|
||||
```
|
||||
|
||||
### Verification
|
||||
|
||||
- `go build ./...` PASS
|
||||
- `go vet ./...` PASS
|
||||
- `go test ./internal/config/... ./internal/cli/...` PASS
|
||||
- `go test -race ./...` PASS
|
||||
- `./bin/orca --config testdata/config.hcl daemon --help` → no error
|
||||
- Precedence test: flag value overrides config file value for the same key
|
||||
- No new direct deps (`hashicorp/hcl/v2` already in go.mod)
|
||||
|
||||
---
|
||||
|
||||
## Phase 3: Test Coverage Uplift (Wave 1)
|
||||
|
||||
**Branch**: `phase/03-coverage-uplift`
|
||||
**REQ Coverage**: REQ-055
|
||||
**Persona leads**: lead-developer (engine/transport/audit tests), data-engineer (store coverage)
|
||||
**Source ideas**: I-403, I-404, I-405, I-410
|
||||
**Depends on**: Phase 1 + Phase 2 (tests build on the now-reachable cert tree + config package)
|
||||
|
||||
### Must-Haves
|
||||
|
||||
#### lead-developer territory — internal/engine
|
||||
- [ ] `internal/engine/executor_test.go` (NEW) — test `Executor.Start`/`Wait` lifecycle:
|
||||
- [ ] Start a command (`/bin/echo hello`) → Wait → exit code 0, stdout captured
|
||||
- [ ] Start a failing command (`/bin/false`) → exit code non-zero
|
||||
- [ ] Cancel via ctx → process killed, `WaitDelay` honored (REQ-021)
|
||||
- [ ] Env propagation: `Env=["FOO=bar"]` → child process sees `FOO=bar`
|
||||
- [ ] `internal/engine/dispatcher_test.go` (NEW) — test `Dispatcher.Submit`/`Dispatch`:
|
||||
- [ ] Submit a job → dispatched to the correct peer (mock peer client)
|
||||
- [ ] Idempotency key present → retry on transient failure (mock returns error twice then succeeds)
|
||||
- [ ] Idempotency key absent → no retry (REQ-037)
|
||||
- [ ] Bounded queue backpressure: fill the channel → Submit blocks (with timeout assertion)
|
||||
- [ ] `internal/engine/peer_test.go` (NEW) — test the peer HTTP client:
|
||||
- [ ] `httptest.NewTLSServer` mock → peer client POSTs a dispatch request
|
||||
- [ ] TLS handshake failure → structured error with `peer` + `err` fields
|
||||
|
||||
#### lead-developer territory — internal/transport
|
||||
- [ ] `internal/transport/mtls_test.go` (NEW) — test mTLS handshake:
|
||||
- [ ] `httptest.NewTLSServer` with a test CA → client with valid cert handshakes OK
|
||||
- [ ] Client with expired cert → handshake fails with `event=mtls.handshake` log assertion
|
||||
- [ ] Client with wrong CA → handshake fails
|
||||
- [ ] `internal/transport/dispatch_test.go` (NEW) — test `Dispatch` RPC:
|
||||
- [ ] Successful dispatch → 200 OK
|
||||
- [ ] Dispatch with `X-Orca-Idempotency-Key` → idempotent
|
||||
- [ ] Dispatch without key → 400 (per REQ-037)
|
||||
- [ ] `internal/transport/handshake_log_test.go` (NEW) — assert `LogHandshakeOK`/`LogHandshakeFailed` emit the correct slog fields (`event`, `peer`, `cert_fp`, `err`)
|
||||
|
||||
#### lead-developer territory — internal/audit
|
||||
- [ ] `internal/audit/audit_test.go` (NEW) — test the `Audit` wrapper:
|
||||
- [ ] `Emit` with `ActionCertIssued` + `ResultSuccess` → `engine.Record` called with correct args (mock `engine.Audit`)
|
||||
- [ ] `EmitWithErr` → `engine.Record` called with `result=failure` + err in metadata
|
||||
- [ ] `LogHandshakeOK` → slog output contains `event=mtls.handshake`, `result=ok`, `peer`, `cert_fp`
|
||||
- [ ] `LogHandshakeFailed` → slog output contains `result=failed` + `err`
|
||||
- [ ] Nil-safe: `(*Audit)(nil).Emit(...)` → no panic
|
||||
|
||||
#### data-engineer territory — internal/proxmox
|
||||
- [ ] `internal/proxmox/bootstrap_test.go` — extend the existing test:
|
||||
- [ ] Mock the `sshDialer` interface (already present at `bootstrap.go:211`) → assert the full bootstrap sequence calls the right shell commands in order (user create, role create, role assign, sudoers drop, pubkey deploy)
|
||||
- [ ] Idempotent re-run: mock returns "already exists" for user create → bootstrap succeeds without re-creating
|
||||
- [ ] SSH auth failure → bootstrap returns wrapped error
|
||||
- [ ] Assert no password is logged (D-031)
|
||||
|
||||
#### CI gate (I-410)
|
||||
- [ ] `.coreci.yml` — add a `coverage-gate` step in the `test` pipeline that runs `go test -cover ./internal/engine ./internal/transport ./internal/proxmox ./internal/audit` and fails if any package < 50% (AD-025). Use a small shell snippet + `awk`/`grep` to parse coverage percentages.
|
||||
|
||||
### Verification
|
||||
|
||||
- `go build ./...` PASS
|
||||
- `go test -race ./...` PASS
|
||||
- `go test -cover ./internal/engine` → ≥ 50% (was 8.3%)
|
||||
- `go test -cover ./internal/transport` → ≥ 50% (was 26.3%)
|
||||
- `go test -cover ./internal/proxmox` → ≥ 50% (was 5.1%)
|
||||
- `go test -cover ./internal/audit` → ≥ 50% (was 0%)
|
||||
- CI coverage gate step passes
|
||||
- Any races uncovered by `-race` are fixed in this phase (not deferred)
|
||||
|
||||
---
|
||||
|
||||
## Phase 4: `--pprof` Opt-in on `orca daemon` (Wave 1)
|
||||
|
||||
**Branch**: `phase/04-pprof-daemon`
|
||||
**REQ Coverage**: REQ-056
|
||||
**Persona leads**: lead-developer (daemon flag + pprof server)
|
||||
**Source ideas**: I-407, I-409
|
||||
**Depends on**: Phase 3 (daemon tests exist; pprof adds a new daemon path)
|
||||
|
||||
### Must-Haves
|
||||
|
||||
#### lead-developer territory
|
||||
- [ ] `internal/daemon/pprof.go` (NEW) — `StartPprof(addr string, log *slog.Logger) (*http.Server, error)`:
|
||||
- [ ] Create a dedicated `*http.ServeMux` (NOT `http.DefaultServeMux`)
|
||||
- [ ] `import _ "net/http/pprof"` → register `pprof.Index`, `pprof.Cmdline`, `pprof.Profile`, `pprof.Symbol`, `pprof.Trace`, `pprof.Handler` on the dedicated mux
|
||||
- [ ] Return a `*http.Server` listening on `addr` with the dedicated mux
|
||||
- [ ] Log a WARN: `pprof endpoint exposed unauthenticated on <addr> — operator-only, do not expose publicly`
|
||||
- [ ] Never touch the mTLS daemon listener (AD-024)
|
||||
- [ ] `internal/daemon/server.go` — add a `pprofAddr string` field to `Options` (default `""` = disabled). In `Start`, if `pprofAddr != ""`, call `StartPprof` and store the `*http.Server` for `Shutdown`.
|
||||
- [ ] `internal/daemon/pprof_test.go` (NEW) — test:
|
||||
- [ ] `StartPprof("127.0.0.1:0", ...)` → server starts, GET `/debug/pprof/` returns 200
|
||||
- [ ] GET `/debug/pprof/cmdline` returns the cmdline
|
||||
- [ ] `Shutdown` stops the pprof server
|
||||
- [ ] The mTLS daemon server (if running) is unaffected by pprof start/stop
|
||||
- [ ] `internal/cli/daemon.go` — add `--pprof string` flag (default `""` = disabled). Pass it into `daemon.Options.PprofAddr`. Document in `--help`: "enable pprof endpoint on <addr> (e.g. :6060); unauthenticated, operator-only".
|
||||
- [ ] `internal/cli/daemon_test.go` — extend: `--pprof 127.0.0.1:0` → daemon starts with pprof; flag absent → no pprof server.
|
||||
|
||||
### Verification
|
||||
|
||||
- `go build ./...` PASS
|
||||
- `go vet ./...` PASS
|
||||
- `go test -race ./internal/daemon/...` PASS
|
||||
- `./bin/orca daemon --pprof 127.0.0.1:0` (in background) → `curl http://127.0.0.1:<port>/debug/pprof/` returns 200
|
||||
- `./bin/orca daemon` (no `--pprof`) → no pprof listener, `/debug/pprof/` not reachable on the daemon port
|
||||
- pprof mux is separate from the mTLS daemon mux (asserted in test)
|
||||
|
||||
---
|
||||
|
||||
## Phase 5: Final Review + Ship + Audit (Wave 1)
|
||||
|
||||
**Branch**: `phase/05-final-review-ship`
|
||||
**REQ Coverage**: all (REQ-053..056)
|
||||
**Persona leads**: lead-developer (review + audit + ship)
|
||||
|
||||
### Must-Haves
|
||||
|
||||
- [ ] Multi-persona code review across all v0.7 phases (ciagent-review)
|
||||
- [ ] Audit: reconstruction test (git log matches `.ciagent/` files), branch hygiene, commit discipline (ciagent-audit)
|
||||
- [ ] Fix any P0 issues found by review; record P1+ in `.ciagent/` for post-hoc
|
||||
- [ ] Merge `phase/05` → `milestone/v0.7-hardening-completion`
|
||||
- [ ] Merge `milestone/v0.7` → `main` (rebase-then-fast-forward per config)
|
||||
- [ ] Tag `v0.6.5` (final phase patch = milestone release)
|
||||
- [ ] Create Gitea release with full milestone summary (all phases, all REQs)
|
||||
- [ ] Update `.ciagent/REQUIREMENTS.md` — mark REQ-053..056 complete
|
||||
- [ ] Update `.ciagent/ROADMAP.md` — mark v0.7 complete
|
||||
- [ ] Write checkpoint: `{phase: 5, stage: "complete", phase_role: "final", milestone_complete: true}`
|
||||
- [ ] Clear checkpoint (milestone complete; next run starts a new milestone)
|
||||
|
||||
### Verification
|
||||
|
||||
- `make build` PASS
|
||||
- `make test` PASS
|
||||
- `make lint` PASS
|
||||
- `go vet ./...` PASS
|
||||
- `git log` on main shows all v0.7 phase commits
|
||||
- `git tag --list 'v0.6.*'` shows v0.6.0..v0.6.5
|
||||
- REQUIREMENTS.md shows REQ-053..056 as Complete
|
||||
- ROADMAP.md shows v0.7 as COMPLETE
|
||||
@@ -1,347 +0,0 @@
|
||||
# Phase Plans: Orca v0.8 — Coverage & Trust Hardening
|
||||
|
||||
All 4 execution phases + final review with vertical-slice structure, wave
|
||||
ordering, persona assignment, and REQ-ID mapping. v0.8 scope: **Coverage &
|
||||
Trust Hardening** — round-2 test coverage uplift across 9 packages (tiered
|
||||
floor: ≥70% for 6 retested, ≥50% for 3 zero-test per D-047), SSH trust
|
||||
hardening (`--host-key-fingerprint` pre-pin + `orca node key-reset` + latent
|
||||
TOFU capture-fix + `Result.HostKeyFingerprint` population), and a
|
||||
requirements-hygiene gate (`make verify-reqs`).
|
||||
|
||||
Branching: `phase/01-coverage-round2`..`phase/04-final-review-ship` on the
|
||||
`milestone/v0.8-coverage-trust-hardening` branch (numbering restarts per
|
||||
milestone per branch-strategy.md).
|
||||
|
||||
Milestone type: **NFR** (P01 test, P02 chore on the trust surface per D-043,
|
||||
P03 chore, P04 docs/review). Tags run on the v0.7.x patch line: `v0.7.0`
|
||||
(P0) … `v0.7.4` (P04 = milestone release).
|
||||
|
||||
**Vertical-slice integrity**: each phase is independently shippable.
|
||||
- **P01** ships tests-only (no production code changes except the proxmox
|
||||
`sessionRunner` seam, a backward-compatible interface extraction, and the
|
||||
engine `peerDispatcher` seam per RESEARCH §1.3).
|
||||
- **P02** ships the SSH trust features + TOFI bugfix + `Result` population.
|
||||
- **P03** ships the hygiene gate (Go program + Makefile + CI hook).
|
||||
- **P04** is review + ship + audit (no new REQs).
|
||||
|
||||
**Out of scope for v0.8** (candidate for v0.9, noted not added):
|
||||
- Lifting the 3 zero-test packages from 50% → 70% (D-047 explicitly
|
||||
toes-holds them; v0.9 can raise the floor).
|
||||
- A `peerDispatcher` interface seam in engine beyond what P01 needs for 70%
|
||||
coverage (httptest.NewTLSServer suffices; the seam is only added if
|
||||
coverage cannot otherwise hit 70%).
|
||||
- Pre-populating `known_hosts` from a remote keyscan API (TOFU + manual
|
||||
`--host-key-fingerprint` cover the v0.8 trust surface).
|
||||
- `verify-reqs` reverse-direction check (REQUIREMENTS Complete ↔ ROADMAP
|
||||
COMPLETE both ways) — forward direction (ROADMAP-shipped → REQUIREMENTS
|
||||
Complete) is the priority per the v0.7 drift that motivated REQ-060.
|
||||
|
||||
**Carried-forward research findings** (RESEARCH_v0.8.md, must incorporate):
|
||||
- §1.1 per-package coverage strategies + tiered floors (D-047).
|
||||
- §1.3 injected seams: reuse `sshDialer` (proxmox), `LocalExecutor` (engine),
|
||||
`Dispatcher` (transport), `watchInterval` (store), `openTestDB`/`withFastWatch`/`initTestEnv`/`resetRootFlags`/`stubDispatcher` helpers.
|
||||
- §1.4 realism flags: cli excludes `daemon.go`; `cmd/orca` 50% toe-hold only;
|
||||
proxmox needs the `sessionRunner` seam to hit 70%.
|
||||
- §2.1 latent TOFU capture bug (knownhosts.New returns KeyError{Want:[]} on
|
||||
first connect and does NOT auto-write — current BootstrapProxmox treats it
|
||||
as a dial failure).
|
||||
- §2.2 `Result.HostKeyFingerprint` is declared but never populated (always
|
||||
`""`); P02 must add `ssh.FingerprintSHA256` computation.
|
||||
- §2.3 `--host-key-fingerprint` plugs in at `internal/cli/node.go` (flag) +
|
||||
`internal/proxmox/bootstrap.go` (pinned callback).
|
||||
- §2.4 `key-reset` is local-known_hosts-only (D-046), atomic rewrite (AD-029).
|
||||
- §3 verify-reqs is a Go program at `cmd/verify-reqs/main.go` (~80 LOC,
|
||||
stdlib only, AD-030) + `make verify-reqs` + `.coreci.yml` validate hook.
|
||||
- §4 AD-025..AD-030 (renumbered AD-027..AD-030 in research for SSH/trust;
|
||||
AD-025/AD-026 from earlier milestones are stable).
|
||||
- §5 10 pitfalls carried into the risk register at the end of this file.
|
||||
|
||||
**Dependencies (RESEARCH §6)**: v0.8 adds **zero** new direct dependencies.
|
||||
`ssh.FingerprintSHA256`, `knownhosts.Line`/`Normalize`/`KeyError` are in the
|
||||
existing `golang.org/x/crypto` v0.54.0 dep. `verify-reqs` is stdlib-only.
|
||||
`go.mod` is unchanged by v0.8.
|
||||
|
||||
---
|
||||
|
||||
## Phase 1: Coverage Uplift Round 2 (REQ-057)
|
||||
|
||||
**Branch**: `phase/01-coverage-round2`
|
||||
**REQ Coverage**: REQ-057
|
||||
**Tag**: `v0.7.1`
|
||||
**Depends on**: Phase 0 (this plan + clarify + research)
|
||||
**Source research**: RESEARCH_v0.8.md §1 (per-package strategies, helpers, seams)
|
||||
|
||||
### Tiered floor (D-047)
|
||||
|
||||
| Package | Current | Floor | Owner persona |
|
||||
|---------|---------|-------|---------------|
|
||||
| `internal/engine` | 8.3% | ≥ 70% | backend-engineer |
|
||||
| `internal/proxmox` | 5.1% | ≥ 70% | backend-engineer |
|
||||
| `internal/cli` | 27.6% | ≥ 70% (excluding `daemon.go`) | lead-developer |
|
||||
| `internal/transport` | 26.3% | ≥ 70% | backend-engineer |
|
||||
| `internal/store` | 47.2% | ≥ 70% | data-engineer |
|
||||
| `internal/jobspec` | 47.6% | ≥ 70% | data-engineer |
|
||||
| `internal/audit` | 0% (no tests) | ≥ 50% toe-hold | data-engineer |
|
||||
| `internal/certpaths` | 0% (no tests) | ≥ 50% toe-hold | data-engineer |
|
||||
| `cmd/orca` | 0% (no tests) | ≥ 50% toe-hold | lead-developer |
|
||||
|
||||
### Wave 1 — Seams + foundational test helpers (no production logic changes)
|
||||
|
||||
These are backward-compatible interface extractions that unlock the bulk of
|
||||
coverage in Wave 2. They are the only production-code changes in P01; all
|
||||
other P01 tasks add `_test.go` files only.
|
||||
|
||||
| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
|
||||
|---------|-------|------|------|-------|---------------|----------------------|
|
||||
| T01.1 | backend-engineer | 1 | Y | Add `sessionRunner` interface seam to proxmox | `internal/proxmox/bootstrap.go` | Extract a `sessionRunner` interface (`CombinedOutput(cmd string) ([]byte, error)`) ~10 LOC; default impl wraps `*ssh.Client.NewSession().CombinedOutput(...)`; `runRemote`/`deployPubKey`/`createLinuxUser`/`createPVERole`/`createPVEUser`/`assignPVEACL`/`writeSudoers`/`validateSudoers` use the seam. Backward compatible: existing callers unchanged. `go build ./internal/proxmox` PASS. (RESEARCH §1.3 gap #1, §5 pitfall #3) |
|
||||
| T01.2 | backend-engineer | 1 | N | Add `peerDispatcher` seam to engine (only if needed for 70%) | `internal/engine/dispatcher.go` | Extract a `peerDispatcher` interface (`Submit(ctx, spec, key) (*SubmitResponse, error)`) so `dispatchToPeer` is testable without `httptest.NewTLSServer`. **Only add if T01.5 cannot otherwise hit 70% via `httptest.NewTLSServer` alone.** If added, backward compatible. (RESEARCH §1.3 gap #2, §5 pitfall #8) |
|
||||
|
||||
### Wave 2 — Per-package coverage tests (build on Wave 1 seams)
|
||||
|
||||
| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
|
||||
|---------|-------|------|------|-------|---------------|----------------------|
|
||||
| T01.3 | backend-engineer | 2 | Y | `internal/transport` tests → ≥ 70% | `internal/transport/mtls_test.go` (NEW), `internal/transport/dispatch_test.go` (NEW), `internal/transport/handshake_log_test.go` (NEW), `internal/transport/retry_test.go` (NEW, extend) | `httptest.NewTLSServer` with a test CA (reuse `security.CAInit`/`GenerateCSR`/`SignCSR` per RESEARCH §1.2) for mTLS handshake paths; `stubDispatcher` (daemon/dispatch_test.go:24) pattern for Dispatch RPC; capture slog via a test `slog.Handler` for handshake_log. `go test -cover ./internal/transport` → ≥ 70% (was 26.3%). |
|
||||
| T01.4 | backend-engineer | 2 | Y | `internal/engine` tests → ≥ 70% | `internal/engine/executor_test.go` (NEW), `internal/engine/dispatcher_test.go` (NEW), `internal/engine/peer_test.go` (NEW), `internal/engine/scheduler_test.go` (extend), `internal/engine/registry_test.go` (NEW, if registry exists) | `Executor.Start`/`Wait` lifecycle (echo/false/ctx-cancel/Env propagation per REQ-021); `Dispatcher.Submit` with stubbed `LocalExecutor` + (if T01.2 added) stubbed `peerDispatcher` OR `httptest.NewTLSServer`; `PeerRegistry` in-memory Add/Remove/All/Get. Reuse `openTestDB` (node_repo_test.go:12). `go test -cover ./internal/engine` → ≥ 70% (was 8.3%). |
|
||||
| T01.5 | backend-engineer | 2 | Y | `internal/proxmox` tests → ≥ 70% | `internal/proxmox/bootstrap_test.go` (extend) | Swap `sshDialer` (existing seam) for a fake returning a mock `*ssh.Client`; swap `sessionRunner` (T01.1 seam) for a fake that returns canned `CombinedOutput` bytes. Assert full bootstrap sequence calls the right shell commands in order; idempotent re-run ("already exists" → no-op); SSH auth failure → wrapped error; no password logged (D-031). `go test -cover ./internal/proxmox` → ≥ 70% (was 5.1%). |
|
||||
| T01.6 | lead-developer | 2 | Y | `internal/cli` tests → ≥ 70% (excluding daemon.go) with GRILL condition #3 escape valve | `internal/cli/node_test.go` (NEW), `internal/cli/job_test.go` (NEW), `internal/cli/cert_test.go` (NEW), `internal/cli/doctor_test.go` (NEW), `internal/cli/audit_test.go` (NEW), `internal/cli/status_test.go` (NEW), `internal/cli/version_test.go` (NEW), `internal/cli/node_capacity_test.go` (NEW) | Table-driven `rootCmd.Execute()` against temp `ORCA_HOME` per subcommand (reuse `initTestEnv`/`resetRootFlags`/`discardWriter` per RESEARCH §1.2). Mock the proxmox path via `sshDialer` + `sessionRunner` seams. `daemon.go` is excluded — covered by `internal/daemon/server_test.go`. `go test -cover ./internal/cli` → ≥ 70% of non-daemon files (document the exclusion in a test-file comment). **GRILL condition #3 escape valve**: if 70% is not reached after Wave 2 effort and ≥ 65% is achieved (RESEARCH §1.4 flags 55-65% as realistic for one phase), ship cli at 65% and do NOT block P02/P03 on the last 5%; record the shortfall + rationale in the P01 verification commit. |
|
||||
| T01.7 | data-engineer | 2 | Y | `internal/store` tests → ≥ 70% (incl. missing `cert_repo_test.go`) | `internal/store/cert_repo_test.go` (NEW — v0.7 P01 leftover, RESEARCH §1.1), `internal/store/node_repo_test.go` (extend), `internal/store/job_task_repo_test.go` (extend), `internal/store/audit_repo_test.go` (extend), `internal/store/capacity_repo_test.go` (extend) | `cert_repo_test.go`: Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + N=3 rotation history per REQ-025 + duplicate-serial error. Reuse `openTestDB`/`withFastWatch` (RESEARCH §1.2). `go test -cover ./internal/store` → ≥ 70% (was 47.2%). |
|
||||
| T01.8 | data-engineer | 2 | Y | `internal/jobspec` tests → ≥ 70% | `internal/jobspec/spec_test.go` (extend), `internal/jobspec/testdata/*.hcl` (NEW golden fixtures) | Golden-file HCL fixtures (multi-task, env vars, args) + error-path table (missing job, no tasks, missing command, malformed HCL, empty file, nonexistent file for `ParseFile`). `go test -cover ./internal/jobspec` → ≥ 70% (was 47.6%). |
|
||||
| T01.9 | data-engineer | 2 | Y | `internal/audit` first tests → ≥ 50% toe-hold | `internal/audit/audit_test.go` (NEW) | Construct `Audit` with real `engine.Audit` backed by `:memory:` sqlite (via `store.NewAuditRepo` + `engine.NewAudit`); assert rows in `audit_log` table; capture slog via a test `slog.Handler` for `LogHandshakeOK`/`LogHandshakeFailed`. `go test -cover ./internal/audit` → ≥ 50% (was 0%). |
|
||||
| T01.10 | data-engineer | 2 | Y | `internal/certpaths` first tests → ≥ 50% toe-hold | `internal/certpaths/certpaths_test.go` (NEW) | Temp dir + `t.Setenv("ORCA_HOME", dir)` + assert each `*Path()` returns `filepath.Join(dir, <file>)`; test `ORCA_DB` override; test default-to-`~/.orca` fallback. Model on `namespace_test.go` (cli). `go test -cover ./internal/certpaths` → ≥ 50% (was 0%). |
|
||||
| T01.11 | lead-developer | 2 | Y | `cmd/orca` smoke test → ≥ 50% toe-hold | `cmd/orca/main_test.go` (NEW), possibly `cmd/orca/main.go` (refactor `main()` into `run() int` for testability) | Refactor `main()` to `run() int` (returns exit code; `main()` calls `os.Exit(run())`) so the test can call `run()` directly with a forced error path and assert non-zero exit + stderr contains "error:". Low-effort toe-hold — do NOT over-invest (RESEARCH §1.1, §5 pitfall #6). `go test -cover ./cmd/orca` → ≥ 50% (was 0%). |
|
||||
|
||||
### Wave 3 — Coverage gate verification
|
||||
|
||||
| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
|
||||
|---------|-------|------|------|-------|---------------|----------------------|
|
||||
| T01.12 | lead-developer | 3 | Y | Coverage-gate verification (all 9 packages hit tiered floor) | none (verification only) | `go test -cover ./internal/engine ./internal/proxmox ./internal/cli ./internal/transport ./internal/store ./internal/jobspec` → each ≥ 70%; `go test -cover ./internal/audit ./internal/certpaths ./cmd/orca` → each ≥ 50%. `go test -race ./...` PASS. Any races fixed in-phase (not deferred). |
|
||||
|
||||
### Phase 1 Must-Haves (summary)
|
||||
|
||||
All 9 packages hit their tiered floor (D-047): T01.1, T01.3, T01.4, T01.5,
|
||||
T01.6, T01.7, T01.8, T01.9, T01.10, T01.11, T01.12. T01.2 is conditional
|
||||
(only if needed for engine 70%).
|
||||
|
||||
### Phase 1 Verification
|
||||
|
||||
- `go build ./...` PASS
|
||||
- `go vet ./...` PASS
|
||||
- `go test -race ./...` PASS
|
||||
- Per-package coverage hits the tiered floor (T01.12)
|
||||
- The proxmox `sessionRunner` seam is backward compatible (existing
|
||||
`BootstrapProxmox` callers unchanged)
|
||||
- No new direct deps (`go.mod` unchanged)
|
||||
|
||||
---
|
||||
|
||||
## Phase 2: SSH Trust Hardening (REQ-058, REQ-059)
|
||||
|
||||
**Branch**: `phase/02-ssh-trust-hardening`
|
||||
**REQ Coverage**: REQ-058, REQ-059
|
||||
**Tag**: `v0.7.2`
|
||||
**Depends on**: Phase 1 (proxmox `sessionRunner` seam from T01.1 is in place;
|
||||
the trust-surface code is now testable)
|
||||
**Source research**: RESEARCH_v0.8.md §2 (TOFU bug, fingerprint computation,
|
||||
flag wiring, key-reset atomic rewrite) + §4 AD-027..AD-029
|
||||
**Phase type**: chore (trust-surface hardening per D-043 — refines existing
|
||||
`orca node join --type proxmox` flow + existing TOFU `known_hosts` store; no
|
||||
new orchestration capability)
|
||||
|
||||
### Wave 1 — Trust-surface foundations (security helpers + flag declarations)
|
||||
|
||||
| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
|
||||
|---------|-------|------|------|-------|---------------|----------------------|
|
||||
| T02.1 | backend-engineer | 1 | Y | Add `security.SSHFingerprintSHA256` helper (AD-027) | `internal/security/sshkey.go` (extend) OR `internal/security/fingerprint.go` (extend) | Thin wrapper over `ssh.FingerprintSHA256(pubKey ssh.PublicKey) string` returning the canonical `SHA256:base64` string. Do NOT reuse `security.Fingerprint` (X.509 hex — different domain per RESEARCH §2.2). Unit test: known Ed25519 pub key → known `SHA256:` string. |
|
||||
| T02.2 | backend-engineer | 1 | Y | Export `security.WriteAtomic` (AD-029 enabler) | `internal/security/ca.go` | Rename `writeAtomic` → `WriteAtomic` (export) + update existing in-package callers. The `key-reset` atomic known_hosts rewrite (T02.7) needs it. Alternatively copy the ~20-LOC pattern into `proxmox` if export is undesirable — **recommend export** (RESEARCH §5 pitfall #10). `go build ./internal/security` PASS. |
|
||||
| T02.3 | backend-engineer | 1 | Y | Add `--host-key-fingerprint` flag on `orca node join` (D-044) | `internal/cli/node.go` | `nodeJoinCmd.Flags().StringVar(&joinHostKeyFP, "host-key-fingerprint", "", "SSH host key SHA256:base64 fingerprint (pre-pin; supersedes TOFU for --type proxmox)")` in the flag-registration block (node.go:344-354). Add `joinHostKeyFP string` to the var block (node.go:47-60). Validation in `RunE`: if `joinHostKeyFP != ""` and `--type != proxmox`, emit a clear error ("--host-key-fingerprint requires --type proxmox today"). Flag is generic for future SSH-joined kinds (D-044). |
|
||||
| T02.4 | backend-engineer | 1 | Y | Add `HostKeyFingerprint` field to `proxmox.Options` | `internal/proxmox/bootstrap.go` | Add `HostKeyFingerprint string` to the `Options` struct (bootstrap.go:55). Pass-through from `internal/cli/node.go` joinProxmox (node.go:158-166): `HostKeyFingerprint: joinHostKeyFP`. |
|
||||
|
||||
### Wave 2 — Trust features + bugfix (build on Wave 1)
|
||||
|
||||
| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
|
||||
|---------|-------|------|------|-------|---------------|----------------------|
|
||||
| T02.5 | backend-engineer | 2 | Y | Implement `pinnedHostKeyCallback` (REQ-058, AD-028) | `internal/proxmox/bootstrap.go` | `pinnedHostKeyCallback(expectedSHA256Base64 string) (ssh.HostKeyCallback, error)`: validate `SHA256:` prefix up front (reject raw hex with a clear error per D-045); callback receives server's `ssh.PublicKey`, computes `ssh.FingerprintSHA256(key)` (via T02.1 helper or inline), compares full strings to the operator-supplied value; returns `nil` on match, `error` on mismatch (fail closed). In `BootstrapProxmox`: if `opts.HostKeyFingerprint != ""` use `pinnedHostKeyCallback`, else fall back to the TOFU callback (T02.6). Unit test: match → callback returns nil; mismatch → returns error mentioning REQ-058; non-`SHA256:`-prefixed input → constructor returns error. |
|
||||
| T02.6 | backend-engineer | 2 | Y | **BUGFIX (v0.6 ship-defect)**: FIX the latent TOFU capture bug (RESEARCH §2.1, §5 pitfall #1, GRILL condition #1) | `internal/proxmox/bootstrap.go` | Wrap `knownhosts.New(...)` with a custom callback that: on `*knownhosts.KeyError{Want: []}` (host unknown) captures the server-presented `ssh.PublicKey`, writes a line via `knownhosts.Line([]string{knownhosts.Normalize(addr)}, key)` to `certpaths.KnownHostsPath()` using `security.WriteAtomic` (T02.2, AD-029), and returns `nil` (allow the dial to proceed). On `*knownhosts.KeyError{Want: [knownKey]}` (mismatch) returns the error (MITM detection). On `nil` (host present + match) returns `nil`. This fixes the v0.6 latent ship-defect where first-connect Proxmox join always failed (verified against `golang.org/x/crypto@v0.54.0/ssh/knownhosts/knownhosts.go:370-385`). P04 audit must record this as ship-defect closure. Unit test: first-connect captures the key + writes known_hosts; second-connect matches; mismatch-connect fails. |
|
||||
| T02.7 | backend-engineer | 2 | Y | Populate `Result.HostKeyFingerprint` (RESEARCH §2.2, §5 pitfall #2) | `internal/proxmox/bootstrap.go` | In the capture path (T02.6) and the pinned path (T02.5), set `Result.HostKeyFingerprint = ssh.FingerprintSHA256(hostKey)` (via T02.1). The field is currently declared (bootstrap.go:83-85) but always `""`. After T02.7, `orca node join --type proxmox` output includes the real fingerprint. Unit test: `Result.HostKeyFingerprint` is non-empty + `SHA256:`-prefixed after a successful bootstrap. |
|
||||
| T02.8 | backend-engineer | 2 | Y | Implement `orca node key-reset <node>` (REQ-059, D-046, AD-029) | `internal/cli/node.go`, `internal/proxmox/bootstrap.go` (new `ResetHostKey` helper OR inline in cli) | New `nodeKeyResetCmd` (`&cobra.Command{Use: "key-reset <node>", Args: cobra.ExactArgs(1), RunE: ...}`) registered via `nodeCmd.AddCommand(nodeKeyResetCmd)` (node.go:358-360). `RunE`: (1) resolve `<node>` arg via `nodeRegistry()` (node.go:37) → get node row → use `node.Name` (the host address for proxmox nodes) as the `known_hosts` match key; (2) call `proxmox.ResetHostKey(host) error` which reads `certpaths.KnownHostsPath()`, filters lines whose host field (before first whitespace, normalized via `knownhosts.Normalize`) matches, rewrites via `security.WriteAtomic` (T02.2); (3) audit-log `event=node.key_reset` with `actor`+`node`+`host` via `engine.Audit.Record`; (4) print `✓ Host key reset for <node> (next connect will re-pin via TOFU or --host-key-fingerprint)`. **Local only — do NOT revoke remote authorized_keys** (D-046). Unit test: known_hosts with 2 entries for the target host + 1 for another host → after reset, target's 2 lines removed, other host's line intact; audit row inserted. |
|
||||
| T02.9 | backend-engineer | 2 | Y | Apply the TOFU capture-fix to `doctor proxmox` probe (GRILL condition #2 — doctor parity with bootstrap) | `internal/doctor/doctor.go` | The doctor proxmox probe (doctor.go:412-415) uses the same `knownhosts.New(...)` callback pattern as bootstrap. Apply the same capture-fix wrapper (T02.6) so `doctor proxmox` on a first-connect node doesn't fail. **P02 is not complete until both bootstrap (T02.6) and doctor (T02.9) callbacks use the capture-fix wrapper — GRILL condition #2 binding parity check.** (If the doctor probe already relies on a prior `node join` having populated `known_hosts`, the fix is still correct — it makes the doctor robust to a missing entry.) |
|
||||
|
||||
### Wave 3 — End-to-end integration + verification
|
||||
|
||||
| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
|
||||
|---------|-------|------|------|-------|---------------|----------------------|
|
||||
| T02.10 | backend-engineer | 3 | Y | End-to-end trust-surface integration tests | `internal/proxmox/bootstrap_test.go` (extend), `internal/cli/node_test.go` (extend) | (1) `--host-key-fingerprint` with a correct pin → bootstrap succeeds + `Result.HostKeyFingerprint` matches the pin; (2) `--host-key-fingerprint` with a wrong pin → bootstrap fails fast with the REQ-058 mismatch error; (3) no `--host-key-fingerprint` + first connect (empty known_hosts) → TOFU captures the key + writes known_hosts + bootstrap succeeds; (4) no flag + second connect (known_hosts has the key) → matches + succeeds; (5) no flag + mismatch (known_hosts has a different key) → fails with MITM error; (6) `orca node key-reset <node>` → known_hosts entry removed + audit row inserted + next connect re-pins; (7) known_hosts pre-populated (v0.6→v0.8 migration path: existing entry from a prior join) → second-connect matches without re-capture, covering the upgrade path. |
|
||||
| T02.11 | backend-engineer | 3 | Y | `--host-key-fingerprint` non-proxmox type validation test | `internal/cli/node_test.go` (extend) | `orca node join --type linux --host-key-fingerprint SHA256:...` → clear error ("--host-key-fingerprint requires --type proxmox today"). Validates D-044 RunE check from T02.3. |
|
||||
|
||||
### Phase 2 Must-Haves (summary)
|
||||
|
||||
- T02.1, T02.2, T02.3, T02.4 (Wave 1 foundations)
|
||||
- T02.5 (`--host-key-fingerprint` pinned callback — REQ-058)
|
||||
- T02.6 (TOFU capture-fix — latent bug)
|
||||
- T02.7 (`Result.HostKeyFingerprint` populated)
|
||||
- T02.8 (`orca node key-reset` — REQ-059)
|
||||
- T02.9 (doctor proxmox TOFU fix)
|
||||
- T02.10, T02.11 (integration + validation)
|
||||
|
||||
### Phase 2 Verification
|
||||
|
||||
- `go build ./...` PASS
|
||||
- `go vet ./...` PASS
|
||||
- `go test -race ./internal/proxmox/... ./internal/cli/... ./internal/doctor/... ./internal/security/...` PASS
|
||||
- `./bin/orca node join --help` shows `--host-key-fingerprint` flag
|
||||
- `./bin/orca node key-reset --help` shows the key-reset subcommand
|
||||
- Pinned mismatch → fail closed (T02.10 case 2)
|
||||
- TOFU first-connect → captures + succeeds (T02.10 case 3)
|
||||
- `Result.HostKeyFingerprint` is non-empty after bootstrap (T02.7)
|
||||
- `key-reset` removes only the target host's known_hosts lines + audit-logs (T02.8)
|
||||
- No new direct deps
|
||||
|
||||
---
|
||||
|
||||
## Phase 3: Requirements-Hygiene Gate (REQ-060)
|
||||
|
||||
**Branch**: `phase/03-verify-reqs`
|
||||
**REQ Coverage**: REQ-060
|
||||
**Tag**: `v0.7.3`
|
||||
**Depends on**: Phase 2 (P03 is independent of P02 code, but ships after per
|
||||
ROADMAP ordering; the verify-reqs program parses the `.ciagent/` markdown
|
||||
which is stable by P03)
|
||||
**Source research**: RESEARCH_v0.8.md §3 (Makefile, .coreci.yml, parsing
|
||||
approach, AD-030) + §4 AD-030
|
||||
|
||||
### Wave 1 — Go program
|
||||
|
||||
| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
|
||||
|---------|-------|------|------|-------|---------------|----------------------|
|
||||
| T03.1 | lead-developer | 1 | Y | `cmd/verify-reqs/main.go` — Go program (~80 LOC, stdlib only, AD-030, GRILL condition #4 regex + reverse direction) | `cmd/verify-reqs/main.go` (NEW) | Parses `.ciagent/ROADMAP.md` + `.ciagent/REQUIREMENTS.md` using `regexp` (stdlib). **Forward assertion**: for every REQ-ID in REQUIREMENTS.md whose `Phase` column references a milestone that ROADMAP marks COMPLETE (substring-match `COMPLETE` within the bold span — NOT exact `\*\*COMPLETE\*\*` which misses v0.2's `**COMPLETE (merged to main via v0.3)**` header at ROADMAP.md:23), the REQUIREMENTS `Status` must be `Complete`. **Reverse assertion (GRILL condition #4)**: for every REQ-ID in REQUIREMENTS.md marked `Complete`, the corresponding milestone in ROADMAP.md must be marked COMPLETE. Regex: REQUIREMENTS row `^\|\s*(REQ-\d+)\s*\|.*?\|\s*\*\*(Complete\|Pending)\*\*\s*\|`; ROADMAP milestone-complete `^##\s*Milestone\s+v0\.\d+:.*—\s*\*\*COMPLETE[^\*]*\*\*` (substring tolerant); map milestone → REQs via the REQUIREMENTS `Phase` column (e.g. `v0.7 P1` → milestone `v0.7`). Exit 0 on consistency; exit 1 with a diff listing (REQ-ID + current status + expected status + direction) on drift. CLI: `go run ./cmd/verify-reqs .ciagent/ROADMAP.md .ciagent/REQUIREMENTS.md` (args optional; defaults to those paths). **Scope note (GRILL)**: REQ-060 catches doc-vs-doc drift only; code-vs-doc drift (e.g. the REQ-053 `cert_repo_test.go` omission — verified missing) is out of scope for this gate and handled by P04 `ciagent-audit`. |
|
||||
| T03.2 | lead-developer | 1 | Y | `cmd/verify-reqs/main_test.go` — golden-file tests | `cmd/verify-reqs/main_test.go` (NEW), `cmd/verify-reqs/testdata/` (NEW: `roadmap_clean.md`, `requirements_clean.md`, `roadmap_drift.md`, `requirements_drift.md`) | (1) Clean pair (ROADMAP v0.X COMPLETE + REQUIREMENTS REQ-XXX Complete) → exit 0, no diff; (2) Drift pair (ROADMAP v0.X COMPLETE + REQUIREMENTS REQ-XXX Pending) → exit 1 + diff lists the stale REQ; (3) Multiple drifts → all reported; (4) Missing args → uses defaults; (5) Malformed markdown → clear error (not a silent pass). |
|
||||
|
||||
### Wave 2 — Makefile + CI hook
|
||||
|
||||
| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
|
||||
|---------|-------|------|------|-------|---------------|----------------------|
|
||||
| T03.3 | lead-developer | 2 | Y | `make verify-reqs` target | `Makefile` | Add `verify-reqs` target: `go run ./cmd/verify-reqs .ciagent/ROADMAP.md .ciagent/REQUIREMENTS.md`. Add to `.PHONY`. `make verify-reqs` exits 0 on the current repo (REQUIREMENTS was corrected during v0.8 SPECIFY). |
|
||||
| T03.4 | lead-developer | 2 | Y | `.coreci.yml` validate-pipeline hook | `.coreci.yml` | Add a `verify-reqs` step to the `validate` pipeline (after `go-version`, alongside `gosec`/`govulncheck`/`gitleaks` per RESEARCH §3.2): `image: golang:1.25`, `commands: [make verify-reqs]`. Pipeline fails on drift. |
|
||||
|
||||
### Wave 3 — Synthetic drift verification
|
||||
|
||||
| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
|
||||
|---------|-------|------|------|-------|---------------|----------------------|
|
||||
| T03.5 | lead-developer | 3 | Y | Synthetic drift verification (REQ-060 acceptance) | none (verification only; temporarily flip a REQUIREMENTS row to Pending in a scratch commit, run `make verify-reqs`, assert exit 1 + diff, then revert) | (1) `make verify-reqs` on the current repo → exit 0; (2) flip one v0.7 REQ row to `Pending` in a scratch edit → `make verify-reqs` → exit 1 + diff lists that REQ-ID; (3) revert the scratch edit → exit 0. This is the REQ-060 acceptance criterion ("passes on current repo + fails on synthetic drift"). |
|
||||
|
||||
### Phase 3 Must-Haves (summary)
|
||||
|
||||
T03.1, T03.2, T03.3, T03.4, T03.5 — all must complete for the hygiene gate to
|
||||
ship.
|
||||
|
||||
### Phase 3 Verification
|
||||
|
||||
- `go build ./cmd/verify-reqs` PASS
|
||||
- `go test ./cmd/verify-reqs/...` PASS (golden-file tests)
|
||||
- `make verify-reqs` → exit 0 on the current repo
|
||||
- Synthetic drift → `make verify-reqs` exit 1 + diff (T03.5)
|
||||
- `.coreci.yml` validate pipeline includes the `verify-reqs` step
|
||||
- No new direct deps (stdlib only)
|
||||
|
||||
---
|
||||
|
||||
## Phase 4: Final Review + Ship + Audit (no new REQs)
|
||||
|
||||
**Branch**: `phase/04-final-review-ship`
|
||||
**REQ Coverage**: all (REQ-057..060)
|
||||
**Tag**: `v0.7.4` (milestone release)
|
||||
**Depends on**: Phase 1 + Phase 2 + Phase 3
|
||||
**Source**: milestone-release checklist (matches PLAN_v0.7 P05 structure)
|
||||
|
||||
### Wave 1 — Review + audit
|
||||
|
||||
| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
|
||||
|---------|-------|------|------|-------|---------------|----------------------|
|
||||
| T04.1 | lead-developer | 1 | Y | Multi-persona code review across all v0.8 phases | none (review only) | ciagent-review across P01..P03; P0 issues fixed in-phase; P1+ recorded in `.ciagent/` for post-hoc. |
|
||||
| T04.2 | lead-developer | 1 | Y | Audit: reconstruction test + branch hygiene + commit discipline | none (audit only) | ciagent-audit: git log matches `.ciagent/` files; branch hygiene clean; commit discipline enforced. |
|
||||
|
||||
### Wave 2 — Ship
|
||||
|
||||
| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
|
||||
|---------|-------|------|------|-------|---------------|----------------------|
|
||||
| T04.3 | lead-developer | 2 | Y | Merge phase/04 → milestone/v0.8-coverage-trust-hardening | none | Fast-forward merge (or rebase-then-fast-forward per config). |
|
||||
| T04.4 | lead-developer | 2 | Y | Merge milestone/v0.8 → main | none | Rebase-then-fast-forward per config. |
|
||||
| T04.5 | lead-developer | 2 | Y | Tag `v0.7.4` (milestone release) | none | `git tag v0.7.4` on the merged main HEAD. Per-phase tags `v0.7.0`..`v0.7.4` all present. |
|
||||
| T04.6 | lead-developer | 2 | Y | Create Gitea release `v0.7.4` with milestone summary | none | Release notes cover all 4 phases + REQ-057..060 + coverage deltas + trust-surface additions. |
|
||||
|
||||
### Wave 3 — Post-ship bookkeeping
|
||||
|
||||
| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
|
||||
|---------|-------|------|------|-------|---------------|----------------------|
|
||||
| T04.7 | lead-developer | 3 | Y | Update REQUIREMENTS.md — mark REQ-057..060 Complete | `.ciagent/REQUIREMENTS.md` | All 4 v0.8 REQ rows show `**Complete**` with phase + ship tag. `make verify-reqs` still passes (self-consistency). |
|
||||
| T04.8 | lead-developer | 3 | Y | Update ROADMAP.md — mark v0.8 COMPLETE | `.ciagent/ROADMAP.md` | v0.8 milestone section shows `**COMPLETE**`; all phase checkboxes `[x]`. `make verify-reqs` still passes. |
|
||||
| T04.9 | lead-developer | 3 | Y | Write + clear checkpoint | `.ciagent/` checkpoint | `{phase: 4, stage: "complete", phase_role: "final", milestone_complete: true}`; then clear checkpoint (milestone complete; next run starts a new milestone). |
|
||||
|
||||
### Phase 4 Must-Haves (summary)
|
||||
|
||||
All tasks (T04.1..T04.9) are must-haves — the final-review phase has no
|
||||
optional work.
|
||||
|
||||
### Phase 4 Verification
|
||||
|
||||
- `make build` PASS
|
||||
- `make test` PASS
|
||||
- `make lint` PASS
|
||||
- `make verify-reqs` PASS
|
||||
- `go vet ./...` PASS
|
||||
- `git log` on main shows all v0.8 phase commits
|
||||
- `git tag --list 'v0.7.*'` shows v0.7.0..v0.7.4
|
||||
- REQUIREMENTS.md shows REQ-057..060 as Complete
|
||||
- ROADMAP.md shows v0.8 as COMPLETE
|
||||
- Gitea release `v0.7.4` published with milestone summary
|
||||
|
||||
---
|
||||
|
||||
## Phase 5: Final Review (next milestone, not part of v0.8 execution)
|
||||
|
||||
Per the v0.8 ROADMAP, there are 4 execution phases (P01..P04). P04 IS the
|
||||
final review + ship + audit phase. There is no separate P05 in v0.8 (unlike
|
||||
v0.7 which had P05). The orchestrator's next-milestone P0 begins after
|
||||
T04.9 clears the checkpoint.
|
||||
|
||||
---
|
||||
|
||||
## Risk Register (carried forward from RESEARCH_v0.8.md §5)
|
||||
|
||||
| # | Pitfall | Phase(s) affected | Mitigation |
|
||||
|---|---------|-------------------|------------|
|
||||
| 1 | TOFU capture is currently BROKEN: `knownhosts.New` returns `KeyError{Want:[]}` on first connect and does NOT auto-write; current `BootstrapProxmox` treats it as a dial failure. | P02 | T02.6 wraps the callback to capture-and-persist on `KeyError{Want:[]}` via `knownhosts.Line` + `security.WriteAtomic`. This is a v0.6 latent bug that P02 closes. |
|
||||
| 2 | `Result.HostKeyFingerprint` is declared but never populated (always `""`). D-045's rationale references "existing output" that doesn't exist. | P02 | T02.7 adds `ssh.FingerprintSHA256(hostKey)` computation in both the capture and pinned paths. 1-line addition once the host key is available. |
|
||||
| 3 | No `sessionRunner` seam in proxmox — testing the SSH command sequence without a real SSH server is impossible. | P01 | T01.1 adds a 1-interface ~10-LOC `sessionRunner` seam in Wave 1. Unlocks ~40% of proxmox coverage. Backward compatible. |
|
||||
| 4 | `internal/store/cert_repo.go` has NO test — v0.7 P01 REQ-053 was supposed to add `cert_repo_test.go` but it's missing (v0.7 leftover). | P01 | T01.7 adds `cert_repo_test.go` (Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + N=3 rotation). Directly lifts store coverage toward 70%. |
|
||||
| 5 | `internal/cli/daemon.go` starts a long-running mTLS server — testing it in cli requires a lifecycle harness; it's already covered by `internal/daemon/server_test.go`. | P01 | T01.6 excludes `daemon.go` from the cli 70% target; documents the exclusion in a test-file comment. Avoids double-testing. |
|
||||
| 6 | `cmd/orca` 50% toe-hold is low-value (15 LOC of glue; effort:coverage ratio is poor). | P01 | T01.11 keeps it at the 50% toe-hold per D-047; does NOT over-invest. A small `run() int` refactor enables a smoke test. |
|
||||
| 7 | `go: no such tool "covdata"` for zero-test packages — a Go toolchain quirk when a package has no test files; NOT a real 0% number. | P01 | T01.9, T01.10, T01.11 each add a `_test.go` file, which makes coverage computable. Don't treat the tooling error as a measurement. |
|
||||
| 8 | `transport.dispatchToPeer` has no seam — testing the remote-dispatch branch requires a new interface OR `httptest.NewTLSServer`. | P01 | T01.3 uses `httptest.NewTLSServer` (no refactor needed). T01.2 (conditional `peerDispatcher` seam) is only added if engine cannot otherwise hit 70%. |
|
||||
| 9 | `knownhosts.Line` + `knownhosts.Normalize` are the helpers for the TOFU-capture fix and `key-reset` matching. | P02 | T02.6 + T02.8 use `Normalize` to match host strings consistently (handles `host:22` vs `host`). |
|
||||
| 10 | `security.writeAtomic` is unexported (ca.go:305); `key-reset`'s atomic known_hosts rewrite needs it. | P02 | T02.2 exports `WriteAtomic` (recommended) OR copies the ~20-LOC pattern. Export is preferred — it's already used across ca.go + sshkey.go. |
|
||||
|
||||
---
|
||||
|
||||
## REQ-ID → Task mapping (traceability)
|
||||
|
||||
| REQ-ID | Phase | Tasks |
|
||||
|--------|-------|-------|
|
||||
| REQ-057 | P01 | T01.1, T01.2 (conditional), T01.3, T01.4, T01.5, T01.6, T01.7, T01.8, T01.9, T01.10, T01.11, T01.12 |
|
||||
| REQ-058 | P02 | T02.1, T02.3, T02.4, T02.5, T02.7, T02.10, T02.11 |
|
||||
| REQ-059 | P02 | T02.2, T02.8, T02.10 |
|
||||
| REQ-060 | P03 | T03.1, T03.2, T03.3, T03.4, T03.5 |
|
||||
| (latent TOFU bug) | P02 | T02.6, T02.9 (not a REQ — closes a v0.6 gap surfaced by RESEARCH §2.1) |
|
||||
| (milestone release) | P04 | T04.1..T04.9 |
|
||||
|
||||
---
|
||||
|
||||
## Task counts
|
||||
|
||||
| Phase | Tasks | Must-haves | Waves |
|
||||
|-------|-------|------------|-------|
|
||||
| P01 | 12 | 11 (T01.2 conditional) | 3 |
|
||||
| P02 | 11 | 11 | 3 |
|
||||
| P03 | 5 | 5 | 3 |
|
||||
| P04 | 9 | 9 | 3 |
|
||||
| **Total** | **37** | **36** | — |
|
||||
@@ -104,276 +104,3 @@ auto-resolved under full autonomy and are summarized here:
|
||||
(pull-based, ctx cancellation, ctrl-c via `signal.NotifyContext`).
|
||||
- **D-018: Bin-packing by CPU/memory with FIFO within node; JSON-over-HTTP
|
||||
orca.v1.Dispatch for cross-node** (no ConnectRPC dep).
|
||||
|
||||
## v0.3 Clarified Decisions (D-series, full autonomy)
|
||||
|
||||
v0.3 is a lean 2-execution-phase milestone completing the streaming and
|
||||
doctor work deferred from v0.2. The 6 v0.3 decisions (D-019..D-024)
|
||||
were auto-resolved under full autonomy:
|
||||
|
||||
| ID | Question | Decision | Rationale | Confidence |
|
||||
|----|----------|----------|-----------|------------|
|
||||
| D-019 | Watch refresh mechanism? | **Poll-based, 1s ticker** | Simpler than event channel; no daemon coupling for CLI; matches offline-first. | 0.90 |
|
||||
| D-020 | Watch output format (REQ-030)? | **Table by default; `--watch --json` streams one-line JSON per event** | Consistent with D-005 `--json` convention; serves humans + AI agents. | 0.92 |
|
||||
| D-021 | Doctor network check scope? | **Probe configured peer addresses via mTLS `/healthz` handshake; PASS/WARN/FAIL per peer** | Reuses existing transport client; read-only. | 0.85 |
|
||||
| D-022 | Doctor db check scope? | **`PRAGMA integrity_check` + migration version query** | Already specced in ARCHITECTURE.md §5; minimal surface. | 0.95 |
|
||||
| D-023 | iter.Seq cancellation? | **`signal.NotifyContext` on SIGINT/SIGTERM** | Per D-017 + ARCHITECTURE Flow 4. | 0.95 |
|
||||
| D-024 | `--watch` applies to job list only, or node list too? | **Both `orca job list --watch` and `orca node list --watch`** | Per ARCHITECTURE.md CLI layer + D-017. | 0.92 |
|
||||
|
||||
## v0.3 Scope Summary
|
||||
|
||||
v0.3 is a focused 2-execution-phase milestone completing the work
|
||||
deferred from v0.2 that was NOT already shipped in P08-P10. A codebase
|
||||
audit during re-init SPECIFY confirmed that REQ-014, REQ-027, REQ-028,
|
||||
REQ-029, REQ-031, REQ-037, REQ-039, REQ-040 all shipped in P08-P10
|
||||
despite stale REQUIREMENTS.md marking them Pending. The remaining work:
|
||||
|
||||
- **P01 — `iter.Seq` streaming for `--watch` flags.** Go 1.25+
|
||||
range-over-func semantics, pull-based `iter.Seq[Job]` /
|
||||
`iter.Seq[Node]`, `context.Context` cancellation,
|
||||
`signal.NotifyContext` on ctrl-c. Applies to both `orca job list
|
||||
--watch` and `orca node list --watch`. Covers REQ-022, REQ-030.
|
||||
- **P02 — `orca doctor` network + db full implementation.** Replaces
|
||||
the P01 stubs (`NetworkStub`, `DBStub`) with real checks: peer
|
||||
reachability via mTLS `/healthz` probe; SQLite `PRAGMA
|
||||
integrity_check` + migration version. Covers REQ-032 (completion).
|
||||
|
||||
The vision ("minimalist, offline-first, CLI-first orchestration
|
||||
engine") is unchanged. v0.3 is a completion milestone, not a direction
|
||||
change.
|
||||
|
||||
## v0.5 Scope Summary — Distribution
|
||||
|
||||
v0.5 is a 3-execution-phase milestone that makes Orca installable,
|
||||
distributable, and containerized. The engine functionality from
|
||||
v0.1–v0.3 is unchanged; this milestone is purely about **delivery
|
||||
surface**:
|
||||
|
||||
- **P01 — Namespace unification.** A single `ORCA_HOME` environment
|
||||
variable becomes the namespace root for *all* on-disk state (db,
|
||||
certs, init, daemon). A `--system` flag on the root command selects
|
||||
the system-level namespace root `/root/.orca`. Backward compatible:
|
||||
empty `ORCA_HOME` → `~/.orca`. Covers REQ-041, REQ-042.
|
||||
- **P02 — `install.sh` + in-place update.** A 1-liner installer pulls
|
||||
the release binary from the public Gitea release URL, installs at
|
||||
user level by default (`~/.local/bin/orca`) or system level
|
||||
(`/usr/local/bin/orca`) with `--system`. Re-running updates the
|
||||
binary in place while preserving config/db/certs in the namespace
|
||||
dir. Idempotent. Covers REQ-043, REQ-044. Also updates README
|
||||
quickstart (REQ-016 completion).
|
||||
- **P03 — Docker release.** A multi-stage `Dockerfile` builds a
|
||||
distroless image; `scripts/release.sh` and `.coreci.yml` publish the
|
||||
image to the Gitea container registry per release. Covers REQ-046.
|
||||
- **P04 — Final review + ship + audit.** Milestone release.
|
||||
|
||||
The vision ("minimalist, offline-first, CLI-first orchestration
|
||||
engine") is unchanged. v0.5 is a distribution milestone, not a
|
||||
direction change.
|
||||
|
||||
## v0.5 Clarified Decisions (D-series, full autonomy)
|
||||
|
||||
The 5 v0.5 decisions (D-025..D-029) were auto-resolved under full
|
||||
autonomy during the CLARIFY stage:
|
||||
|
||||
| ID | Question | Decision | Rationale | Confidence |
|
||||
|----|----------|----------|-----------|------------|
|
||||
| D-025 | System-level namespace path layout? | **`/root/.orca`** (mirror of user-level `~/.orca`) | Consistent shape with user-level; just a different root. Matches the user's "starts at /root" wording. Single dir keeps it simple. | 0.90 |
|
||||
| D-026 | Namespace override mechanism at runtime? | **Unify on `ORCA_HOME`** as single namespace root for all components (db, certs, init, daemon). Add `--system` flag that sets root to `/root/.orca`. | `ORCA_HOME` already exists for certs; extend to all components. Backward compatible (empty → `~/.orca`). One knob, not many. | 0.92 |
|
||||
| D-027 | Docker registry target? | **Gitea built-in container registry** (`git.cloudinit.dev/coreci/orca`) | Keeps everything in one forge; uses Gitea's native registry. Consistent with REQ-045 (public repo → public image pulls). | 0.88 |
|
||||
| D-028 | How to make releases publicly accessible (REQ-045)? | **Flip repo visibility to public** via `tea repos edit coreci/orca --private=false` during P0 ship | Simplest path to anonymous downloads; enables both install.sh pulls and docker pulls. Pre-existing `.env` leak already suppressed via gitleaks baseline + rotate-forward (commit 00127ce). | 0.85 |
|
||||
| D-029 | install.sh default version? | **Latest release** (query Gitea releases API), optional `--version vX.Y.Z` to pin | Matches typical 1-liner installer UX; users get newest by default, can pin for reproducibility. | 0.92 |
|
||||
|
||||
### v0.5 Operational prerequisite (P0 ship)
|
||||
|
||||
The Gitea repo `coreci/orca` is currently **private** (returns 404
|
||||
unauthenticated). P0 ship flips visibility to public via `tea repos
|
||||
edit coreci/orca --private=false` so that `install.sh` can pull
|
||||
release binaries unauthenticated (REQ-045). This is an operational
|
||||
step performed during the P0 ship, verified by an unauth `curl`
|
||||
against the releases API.
|
||||
|
||||
## v0.6 Scope Summary — Node Bootstrap & Proxmox
|
||||
|
||||
v0.6 is a 3-execution-phase milestone that turns `orca init` from a
|
||||
bare `mkdir` into a full single-node cluster bootstrap, and adds
|
||||
Proxmox 8 & 9 as a first-class remote node type joined over SSH with
|
||||
least-privilege role delegation. The engine functionality from
|
||||
v0.1–v0.5 is unchanged; this milestone is about **bootstrap
|
||||
ergonomics** and **heterogeneous node support**:
|
||||
|
||||
- **P01 — `orca init` full bootstrap.** A single `orca init` call now:
|
||||
(a) creates the namespace dir (`~/.orca` or `/root/.orca` with
|
||||
`--system`); (b) runs all DB migrations including the new 0006
|
||||
(`nodes.kind`, `nodes.os` — backward-compatible nullable columns);
|
||||
(c) bootstraps the internal CA via `security.CAInit` if `ca.crt` is
|
||||
absent; (d) generates the server cert via `security.GenerateCSR` +
|
||||
`ca.SignCSR` if `server.crt` is absent; (e) auto-detects the local
|
||||
OS via `/etc/os-release` `ID=` field (ubuntu/debian/alpine); (f)
|
||||
registers a `localhost` node with `kind=localhost`, `os=<detected>`,
|
||||
`addr=localhost:8443` if no localhost node exists yet. After
|
||||
`orca init`, `orca doctor` MUST pass with zero FAILs. Idempotent:
|
||||
re-running `orca init` is a no-op (or refresh) for already-provisioned
|
||||
artifacts. Covers REQ-047, REQ-048, REQ-049.
|
||||
- **P02 — Proxmox SSH join.** `orca node join --type proxmox --host
|
||||
<addr> --user root --password <pw>` (password via flag or
|
||||
`$ORCA_PROXMOX_PASSWORD`, **never persisted**) bootstraps a remote
|
||||
Proxmox 8/9 host via `golang.org/x/crypto/ssh` (new direct dep).
|
||||
Steps: (1) SSH password-auth; (2) generate or load orca's SSH
|
||||
keypair (`~/.orca/orca_ssh_key` / `.pub`, 0600/0644); (3) deploy
|
||||
pubkey to remote `~orca/.ssh/authorized_keys`; (4) create `orca`
|
||||
user (config-overridable name via `--proxmox-user`, default `orca`);
|
||||
(5) create PVE custom role `OrcaOperator` (config-overridable via
|
||||
`--proxmox-role`) with privileges `VM.Audit`,
|
||||
`Datastore.AllocateSpace`, `SDN.Use`; (6) assign role to `orca`
|
||||
user on `/`; (7) drop `/etc/sudoers.d/orca` allowlist (`pct`, `qm`,
|
||||
`pvesh`, `apt-get`, `dpkg` — no shell-escape commands); (8) record
|
||||
node row `kind=proxmox`, `os=pve`, audit log. Idempotent re-run.
|
||||
Covers REQ-050, REQ-051.
|
||||
- **P03 — `doctor os` + `doctor proxmox`.** Extends `orca doctor`
|
||||
with two new checks: `doctor os` re-runs `/etc/os-release` detection
|
||||
and verifies it matches the stored localhost node row's `os` field
|
||||
(drift = WARN); `doctor proxmox` iterates `kind=proxmox` nodes and
|
||||
SSH-probes each with `pveversion` / `pvecmd status` (3s timeout per
|
||||
peer per D-038 pattern), reporting PASS/WARN/FAIL per node. All
|
||||
bootstrap + join actions emit structured audit-log entries. Covers
|
||||
REQ-052.
|
||||
- **P04 — Final review + ship + audit.** Milestone release.
|
||||
|
||||
The vision ("minimalist, offline-first, CLI-first orchestration
|
||||
engine") is unchanged. v0.6 is a bootstrap-ergonomics + heterogeneous-
|
||||
nodes milestone, not a direction change.
|
||||
|
||||
## v0.6 Clarified Decisions (D-series, full autonomy)
|
||||
|
||||
The 8 v0.6 decisions (D-030..D-037) were resolved during the CLARIFY
|
||||
stage — D-030..D-034 confirmed by the operator in plan mode, D-035..D-037
|
||||
auto-resolved at full autonomy within the `clarify_budget`:
|
||||
|
||||
| ID | Question | Decision | Rationale | Confidence |
|
||||
|----|----------|----------|-----------|------------|
|
||||
| D-030 | SSH library for Proxmox join? | **`golang.org/x/crypto/ssh`** | Stdlib-adjacent, well-maintained, single new direct dep. Matches orca's minimal-deps ethos. Shell-out to `/usr/bin/ssh` would require openssh-client on the orca host and complicate password-auth + idempotent pubkey deploy. | 0.92 (operator-confirmed) |
|
||||
| D-031 | Proxmox join password handling? | **Flag/env only, never persisted** | `--password` flag or `$ORCA_PROXMOX_PASSWORD` is used once to deploy the orca pubkey + create the `orca` user; the password is never written to SQLite. Subsequent orca→Proxmox access uses the deployed SSH key. | 0.95 (operator-confirmed) |
|
||||
| D-032 | Localhost OS auto-detect signal? | **`/etc/os-release` `ID=` field** | Parse `ID=` from `/etc/os-release`; map `ubuntu`/`debian`/`alpine` → node `os`. Falls back to `linux` (unknown) if none match. Simplest reliable signal across the three target distros. | 0.93 (operator-confirmed) |
|
||||
| D-033 | Least-privilege Proxmox role granularity? | **Custom PVE role `OrcaOperator`** with `VM.Audit`, `Datastore.AllocateSpace`, `SDN.Use` + `/etc/sudoers.d/orca` allowlist (`pct`, `qm`, `pvesh`, `apt-get`, `dpkg`) | Config-overridable role + user names. Sufficient for "manage the host, VMs/CTs, storage, packages" without granting root shell. Built-in `PVEAuditor` is too read-only; full `Administrator` is too broad. | 0.88 (operator-confirmed) |
|
||||
| D-034 | Node kind/os schema? | **Add `nodes.kind` + `nodes.os` columns via migration 0006** | Schema-first, queryable, doctor can branch on kind. Nullable with `localhost`/`""` defaults for existing rows (backward-compatible). data-engineer owns the migration. | 0.94 (operator-confirmed) |
|
||||
| D-035 | SSH host-key verification on first Proxmox connect? | **TOFU: pin on first connect, refuse on mismatch thereafter** | First connect uses `ssh.InsecureIgnoreHostKey` to capture the host key; it is then persisted to `~/.orca/known_hosts` (or the nodes metadata) and all subsequent connects require a match. Balances first-run ergonomics against MITM risk on subsequent runs. Switching to pre-pinned keys is a future enhancement. | 0.82 (auto) |
|
||||
| D-036 | `orca init` idempotency semantics for already-provisioned artifacts? | **Skip-and-refresh, never overwrite** | If `ca.crt` exists → load it (no regen). If `server.crt` exists → keep it (no reissue). If a localhost node row exists → update `last_seen` + re-detect `os`, never insert a duplicate. If DB migrations are ahead → no-op. If `~/.orca` exists → MkdirAll is a no-op. Idempotent re-run is a hard requirement (REQ-047). | 0.95 (auto) |
|
||||
| D-037 | orca SSH keypair location + algorithm? | **`~/.orca/orca_ssh_key` (0600) + `~/.orca/orca_ssh_key.pub` (0644), Ed25519** | Ed25519 keys are smaller, faster, and more secure than RSA for SSH auth. Stored in the orca namespace dir alongside ca.crt/server.crt so `ORCA_HOME` relocation works. File modes mirror the cert file-mode discipline (REQ-033 spirit). Generated lazily on first `orca node join --type proxmox`, not at `orca init` (localhost doesn't need SSH). | 0.90 (auto) |
|
||||
|
||||
### v0.6 clarification notes
|
||||
|
||||
- **D-035 TOFU caveat**: TOFU (trust-on-first-use) is the standard SSH
|
||||
UX and matches the operator-mediated model from D-012 (CA cert
|
||||
distribution). The operator is expected to verify the host key
|
||||
fingerprint out-of-band on first connect if the network is
|
||||
untrusted. A future milestone may add `--host-key-fingerprint` pin
|
||||
flag to `orca node join --type proxmox` for pre-pinned deployments.
|
||||
- **D-036 idempotency**: re-running `orca init` on a node that already
|
||||
has a localhost row updates `last_seen` and re-detects `os` (in case
|
||||
the host OS was upgraded) but does NOT change the node `ID` or
|
||||
`joined_at`. This makes `orca init` safe to put in a systemd
|
||||
ExecStartPre or a config-management runbook.
|
||||
- **D-037 Ed25519**: `golang.org/x/crypto/ssh` + `golang.org/x/crypto/ed25519`
|
||||
are in the same module; no additional direct dep beyond D-030.
|
||||
|
||||
## v0.7 Clarified Decisions (D-series, full autonomy)
|
||||
|
||||
The 5 v0.7 decisions (D-038..D-042) were auto-resolved at full autonomy
|
||||
within the `clarify_budget` (10):
|
||||
|
||||
| ID | Question | Decision | Rationale | Confidence |
|
||||
|----|----------|----------|-----------|------------|
|
||||
| D-038 | Config file format — HCL or YAML? | **HCL** | D-009 already specced `config.hcl`. HCL is already a direct dep (hashicorp/hcl/v2 for jobspec). Adding YAML would introduce a second parser dep — violates minimal-deps. Use the existing `hclparse` pkg from jobspec. | 0.93 |
|
||||
| D-039 | Config precedence order (flag vs env vs file vs default)? | **flag > env > file > default** | Standard layered config: the most explicit (flag) wins, then the runtime (env), then the persisted (file), then the built-in default. Matches cobra/viper convention without the viper dep. | 0.92 |
|
||||
| D-040 | pprof security — bind to localhost only, or operator-chosen addr? | **Operator-chosen `--pprof <addr>` (default disabled)** | Default disabled keeps the minimalist posture. Operator picks the addr — localhost for dev, unix socket for prod. Separate mux so it never touches the mTLS daemon listener. No auth (pprof is operator-only, addr is the gate). | 0.85 |
|
||||
| D-041 | cert command registration — where in root command order? | **After `cert` is unreachable today, append after `node` in rootCmd.AddCommand order** | Alphabetical-ish with the existing cluster (audit, daemon, doctor, init, job, node, cert, status, version). No behavior change to existing commands. | 0.88 |
|
||||
| D-042 | Coverage target — 50% floor or higher? | **50% floor per package, 70% target for new packages** | 50% is achievable for the concurrent packages (engine, transport) without heroic mock effort; 70% is the floor for new code in P02/P04. Avoids a "raise coverage everywhere" rathole. | 0.85 |
|
||||
|
||||
## v0.7 Scope Summary — Hardening & Completion
|
||||
|
||||
v0.7 is a 4-execution-phase **NFR milestone** that closes out gaps
|
||||
surfaced by the v0.7 IDEATE stage: an unreachable command tree, a
|
||||
missing config file layer, low test coverage in core packages, and the
|
||||
long-deferred pprof endpoint. The engine functionality from v0.1–v0.6
|
||||
is unchanged; this milestone is purely about **correctness, coverage,
|
||||
and operability**:
|
||||
|
||||
- **P01 — Register `orca cert` command tree + cert_repo tests.** The
|
||||
`internal/cli/cert.go` command (`cert ca-init`, `cert gen`, `cert
|
||||
show`, `cert renew`, `cert fingerprint`) is fully implemented but
|
||||
never wired into `rootCmd`. This phase adds the missing
|
||||
`rootCmd.AddCommand(newCertCmd(...))` and adds the missing
|
||||
`internal/store/cert_repo_test.go`. Covers REQ-053.
|
||||
- **P02 — HCL config file parsing (`config.hcl`).** D-009 specified
|
||||
`~/.orca/config.hcl` and `/etc/orca/orca.hcl` as config locations,
|
||||
but no HCL config-file parser exists — the CLI relies entirely on
|
||||
flags and env vars. This phase adds a minimal `internal/config`
|
||||
package that loads `config.hcl` (keys: `db_path`, `listen_addr`,
|
||||
`ca_path`, `server_cert_path`, `server_key_path`, `node_capacity`),
|
||||
merges with env/flag overrides (flag > env > file > default), and
|
||||
surfaces it via `--config` flag on the root command. Covers
|
||||
REQ-054.
|
||||
- **P03 — Test coverage uplift.** Adds tests for the lowest-coverage
|
||||
packages: `internal/engine` (executor, dispatcher, peer — currently
|
||||
8.3%), `internal/transport` (mtls, dispatch, handshake_log —
|
||||
currently 26.3%), `internal/proxmox` (bootstrap SSH path —
|
||||
currently 5.1%), and `internal/audit` (no tests). Target: every
|
||||
package ≥ 50% coverage. Covers REQ-055.
|
||||
- **P04 — `--pprof` opt-in on `orca daemon`.** Adds the long-deferred
|
||||
I-308 pprof endpoint behind an opt-in `--pprof <addr>` flag (default
|
||||
disabled). `net/http/pprof` mounted on a separate mux so it never
|
||||
touches the mTLS daemon listener. Covers REQ-056.
|
||||
- **P05 — Final review + ship + audit.** Milestone release.
|
||||
|
||||
The vision ("minimalist, offline-first, CLI-first orchestration
|
||||
engine") is unchanged. v0.7 is a hardening milestone, not a direction
|
||||
change. Milestone type: NFR (all phases are fix/test/chore); the final
|
||||
phase's progressive patch IS the deliverable per `run.md` versioning
|
||||
logic. Tags run on the v0.6.x patch line: `v0.6.0` (P0) … `v0.6.5` (P05
|
||||
= milestone release).
|
||||
|
||||
## v0.8 Scope Summary — Coverage & Trust Hardening
|
||||
|
||||
v0.8 is a 3-execution-phase **NFR milestone** that continues the
|
||||
hardening theme opened by v0.7. v0.7 P03 (REQ-055) lifted four
|
||||
packages to ≥ 50%, but a coverage re-baseline after v0.7 ship shows
|
||||
the floor was insufficient: `internal/engine` regressed to 8.3%,
|
||||
`internal/proxmox` to 5.1%, and four more packages sit between 26% and
|
||||
48%. Three packages (`internal/audit`, `internal/certpaths`,
|
||||
`cmd/orca`) still have **no test files at all**. v0.8 also closes the
|
||||
two "future enhancement" hooks explicitly deferred in v0.6 — SSH
|
||||
host-key pre-pinning (D-035 caveat) and `orca node key-reset`
|
||||
(RESEARCH_v0.6 §80) — and adds a requirements-hygiene gate so the
|
||||
stale-REQ-status drift seen in REQUIREMENTS.md after v0.7 ship cannot
|
||||
recur:
|
||||
|
||||
- **P01 — Coverage uplift round 2.** Raise six under-50% packages to
|
||||
≥ 70% and add first tests for the three zero-test packages. Covers
|
||||
REQ-057.
|
||||
- **P02 — SSH trust hardening.** `--host-key-fingerprint` pre-pin flag
|
||||
on `orca node join --type proxmox` + `orca node key-reset <node>`
|
||||
command. Covers REQ-058, REQ-059.
|
||||
- **P03 — Requirements-hygiene gate.** `make verify-reqs` target +
|
||||
verify-stage assertion that ROADMAP `Complete` ↔ REQUIREMENTS
|
||||
`Complete`. Covers REQ-060.
|
||||
- **P04 — Final review + ship + audit.** Milestone release.
|
||||
|
||||
The vision is unchanged. v0.8 is a hardening milestone, not a
|
||||
direction change. Milestone type: NFR (all phases are test/feat-chore
|
||||
on the trust surface — see CLARIFY D-043 for the `feat` vs `chore`
|
||||
classification of P02); the final phase's progressive patch IS the
|
||||
deliverable per `run.md` versioning logic. Tags run on the **v0.7.x**
|
||||
patch line: `v0.7.0` (P0) … `v0.7.4` (P04 = milestone release).
|
||||
|
||||
## v0.8 Clarified Decisions (D-series, full autonomy)
|
||||
|
||||
The 5 v0.8 decisions (D-043..D-047) were auto-resolved at full autonomy
|
||||
within the `clarify_budget` (10):
|
||||
|
||||
| ID | Question | Decision | Rationale | Confidence |
|
||||
|----|----------|----------|-----------|------------|
|
||||
| D-043 | Is P02 (SSH trust hardening) a `feat` phase or a `chore` phase? It adds a new flag + a new subcommand. | **`chore` (trust-surface hardening), not `feat`** | Both `--host-key-fingerprint` and `orca node key-reset` refine the *existing* `orca node join --type proxmox` flow and the existing TOFU `known_hosts` store (D-035). No new orchestration capability, no new node kind, no new API. They close a security gap explicitly deferred in v0.6, not open new surface area. Per `run.md` versioning logic this keeps v0.8 NFR (all phases fix/test/chore/perf/refactor). | 0.84 |
|
||||
| D-044 | Where does `--host-key-fingerprint` live — on `orca node join` or only on `--type proxmox`? | **On `orca node join` (root of the join subcommand), validated when `--type proxmox`** | The flag is generic (any future SSH-joined node kind will use it); gating it to `--type proxmox` only would require re-adding it later. Validation (`flag requires --type proxmox today`) happens in `RunE`, not in the flag declaration, so the flag is declared once on `node join` and the type check emits a clear error for non-proxmox types until other SSH-joined kinds exist. | 0.86 |
|
||||
| D-045 | `--host-key-fingerprint` format — raw hex, `sha256:`-prefixed, or OpenSSH `SHA256:base64`? | **OpenSSH `SHA256:base64` (the format `ssh-keyscan -E sha256 -D -` emits and operators expect)** | Matches the fingerprint format operators already see from `ssh-keyscan` and `orca node join`'s own `Result.HostKeyFingerprint` output. Accept only `SHA256:`-prefixed base64; reject raw hex with a clear error. Internally decode base64 → compare against `ssh.PublicKey` Marshal + sha256. | 0.88 |
|
||||
| D-046 | Does `orca node key-reset <node>` also revoke the orca pubkey on the remote host, or only clear the local `known_hosts` entry? | **Local `known_hosts` entry only** | Revoking the remote authorized_keys entry would orphan a working node (next dispatch would fail auth). `key-reset` is the local "forget this host's key" operation (mirrors `ssh-keygen -R host`); re-establishing trust is a separate `orca node join` re-run. Audit-log the reset with `actor`, `node`, `event=node.key_reset`. | 0.90 |
|
||||
| D-047 | Coverage target for P01 — 70% floor or higher? | **70% floor for the 6 under-50% packages; 50% floor for the 3 zero-test packages (`internal/audit`, `internal/certpaths`, `cmd/orca`) as a first-toe-hold** | 70% across the board for the already-tested packages matches D-042's "70% target for new packages" and is achievable without heroic mock effort. For the zero-test packages, going 0→50% is the realistic single-phase step (0→70% risks a coverage rathole on `cmd/orca` which is glue code); a future milestone can lift them to 70%. | 0.82 |
|
||||
|
||||
+17
-85
@@ -21,7 +21,7 @@ earlier versions of this file.
|
||||
| REQ-011 | mTLS for inter-node communication | Medium | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
|
||||
| REQ-012 | `~/.orca/config.hcl` and `/etc/orca/orca.hcl` config locations | Low | v0.1 P01 | **Complete** (CLI uses `~/.orca/` + `ORCA_DB` env) |
|
||||
| REQ-013 | Pre-push git hook triggers CoreCI on every push | High | v0.1 P01 | **Complete** |
|
||||
| REQ-014 | `gosec` + `govulncheck` in CI pipeline | High | v0.2 P03 | **Complete** (P10 shipped v0.2.3) |
|
||||
| REQ-014 | `gosec` + `govulncheck` in CI pipeline | High | v0.2 P03 | Pending (P03) |
|
||||
| REQ-015 | MIT LICENSE | Low | v0.1 P01 | **Complete** |
|
||||
| REQ-016 | README.md with quickstart | Medium | v0.1 P01 | **Complete** |
|
||||
| REQ-017 | `context.Context` propagation in all I/O | High | v0.1 | **Complete** |
|
||||
@@ -29,31 +29,25 @@ earlier versions of this file.
|
||||
| REQ-019 | Cobra CLI framework | High | v0.1 P01 | **Complete** |
|
||||
| REQ-020 | HCL parser integration (`hashicorp/hcl`) | Medium | v0.1 P03 | **Complete** |
|
||||
| REQ-021 | `os/exec` with `WaitDelay` (Go 1.25+) | Medium | v0.1 P03 | **Complete** |
|
||||
| REQ-022 | `iter.Seq` for streaming job lists (Go 1.25+) | Low | **v0.3 P01** | **Complete** (v0.3 P01 shipped v0.3.1) |
|
||||
| REQ-022 | `iter.Seq` for streaming job lists (Go 1.25+) | Low | v0.2 P04 | Pending (P04) |
|
||||
| REQ-023 | Self-signed mTLS cert generation | Medium | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
|
||||
| REQ-024 | `Makefile` with standard targets | High | v0.1 P01 | **Complete** |
|
||||
| REQ-025 | Bounded cert rotation history: retain last N=3 server certs per node for rollback | Medium | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
|
||||
| REQ-026 | Trusted-CA fingerprint pinned in config; daemon refuses to start on mismatch | High | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
|
||||
| REQ-027 | `govulncheck` runs in offline mode in CI (no `vuln.go.dev` calls; pre-mirrored DB or `-format json` + `jq` gate) | High | v0.2 P03 | **Complete** (P10 shipped v0.2.3) |
|
||||
| REQ-028 | HCL/YAML schema for `NodeCapacity` declaration (`orca node join` flag and/or `~/.orca/node.hcl`) | High | v0.2 P02 | **Complete** (P09 shipped v0.2.2; `orca node capacity` CLI) |
|
||||
| REQ-029 | `gitleaks` baseline file committed to repo to suppress pre-existing `.env` SHA-1 leak in git history | Medium | v0.2 P03 | **Complete** (P10 shipped v0.2.3) |
|
||||
| REQ-030 | `--watch` output format mode: table (default) vs streaming one-line JSON per event | Low | **v0.3 P01** | **Complete** (v0.3 P01 shipped v0.3.1) |
|
||||
| REQ-031 | `go test -race` enabled in CI for all v0.2 packages | High | v0.2 P01–P04 | **Complete** (P10; `.coreci.yml` test pipeline runs `-race`) |
|
||||
| REQ-032 | `orca doctor` subcommand for diagnostics (CA/cert health, db integrity, peer reachability) | Medium | **v0.2 P01 / v0.3 P02** | **Complete** (cert checks P01 v0.2.1; network + db P02 v0.3.2) |
|
||||
| REQ-027 | `govulncheck` runs in offline mode in CI (no `vuln.go.dev` calls; pre-mirrored DB or `-format json` + `jq` gate) | High | v0.2 P03 | Pending (P03) |
|
||||
| REQ-028 | HCL/YAML schema for `NodeCapacity` declaration (`orca node join` flag and/or `~/.orca/node.hcl`) | High | v0.2 P02 | Pending (P02) |
|
||||
| REQ-029 | `gitleaks` baseline file committed to repo to suppress pre-existing `.env` SHA-1 leak in git history | Medium | v0.2 P03 | Pending (P03) |
|
||||
| REQ-030 | `--watch` output format mode: table (default) vs streaming one-line JSON per event | Low | v0.2 P04 | Pending (P04) |
|
||||
| REQ-031 | `go test -race` enabled in CI for all v0.2 packages | High | v0.2 P01–P04 | **Complete** for P01 (cross-cutting, verified P01); P02–P04 ongoing |
|
||||
| REQ-032 | `orca doctor` subcommand for diagnostics (CA/cert health, db integrity, peer reachability) | Medium | **v0.2 P01** | **Complete** for cert checks (P01); network/db are stubs, full impl in P02 |
|
||||
| REQ-033 | Cert file mode enforcement: 0600 for keys, 0644 for certs (refuses to start on violation) | High | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
|
||||
| REQ-034 | Cert proactive rotation alarm: structured slog WARN 30 days before `not_after` | Medium | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
|
||||
| REQ-035 | `orca cert show` redacts private key material from default and `--json` output | High | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
|
||||
| REQ-036 | Server cert SAN validation: SAN entries (DNS + IP) populated at sign-time; refuses to sign a CSR without them | High | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
|
||||
| REQ-037 | `X-Orca-Idempotency-Key` header on cross-node POST; dispatcher retries only when header is present | Medium | v0.2 P02 | **Complete** (P09 shipped v0.2.2; `internal/transport/idempotency.go`) |
|
||||
| REQ-037 | `X-Orca-Idempotency-Key` header on cross-node POST; dispatcher retries only when header is present | Medium | v0.2 P02 | Pending (P02) |
|
||||
| REQ-038 | Structured slog fields for mTLS failures: `event=mtls.handshake`, `peer`, `cert_fp`, `err` | Medium | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
|
||||
| REQ-039 | `.gitleaks.toml` extended with stopwords for test data paths and CA cert PEM blocks | Medium | v0.2 P03 | **Complete** (P10 shipped v0.2.3) |
|
||||
| REQ-040 | `.golangci.yml` unified lint config superseding per-tool invocations | Low | v0.2 P03 | **Complete** (P10 shipped v0.2.3) |
|
||||
| REQ-041 | Unified namespace root via `ORCA_HOME` for all components (db, certs, init, daemon) | High | **v0.5 P1** | **Complete** (P1 shipped v0.4.2) |
|
||||
| REQ-042 | `--system` flag selects system-level namespace root `/root/.orca` | High | **v0.5 P1** | **Complete** (P1 shipped v0.4.2) |
|
||||
| REQ-043 | `install.sh` 1-liner pulling release binary from public Gitea URL; user-level default, `--system` for system-level | High | **v0.5 P2** | **Complete** (P2 shipped v0.4.3) |
|
||||
| REQ-044 | `install.sh` in-place update preserves config/state; idempotent re-run | High | **v0.5 P2** | **Complete** (P2 shipped v0.4.3) |
|
||||
| REQ-045 | Gitea repo + releases publicly accessible (unauthenticated download) | High | **v0.5 P0** | **Complete** (P0 ship: repo + org visibility public) |
|
||||
| REQ-046 | Docker image published to Gitea container registry per release | Medium | **v0.5 P3** | **Complete** (P3 shipped v0.4.4) |
|
||||
| REQ-039 | `.gitleaks.toml` extended with stopwords for test data paths and CA cert PEM blocks | Medium | v0.2 P03 | Pending (P03) |
|
||||
| REQ-040 | `.golangci.yml` unified lint config superseding per-tool invocations | Low | v0.2 P03 | Pending (P03) |
|
||||
|
||||
## v0.1 Milestone Summary
|
||||
|
||||
@@ -68,75 +62,13 @@ Plus REQ-025..REQ-040 (16 net-new) added by v0.2 IDEATE stage.
|
||||
|
||||
## v0.2 Milestone Summary
|
||||
|
||||
**Status: Functionally Complete (pending merge to main)** — P08 (mTLS),
|
||||
P09 (scheduling), P10 (security scan) all shipped to the
|
||||
`milestone/v0.2-networking-observability-security` branch as v0.2.1,
|
||||
v0.2.2, v0.2.3. The milestone branch has NOT been merged to main yet.
|
||||
REQ-022/030 (iter.Seq streaming) and REQ-032 (doctor network/db) were
|
||||
deferred to v0.3.
|
||||
**Status: In Progress** — P01 (mTLS) shipped (v0.2.1). 3 phases remain
|
||||
(P02 multi-node scheduling, P03 gosec+govulncheck+gitleaks, P04 iter.Seq).
|
||||
P01 covered REQ-011, REQ-023, REQ-025, REQ-026, REQ-031, REQ-032 (partial),
|
||||
REQ-033, REQ-034, REQ-035, REQ-036, REQ-038 (10 REQs complete; REQ-032
|
||||
complete for cert checks only).
|
||||
|
||||
## v0.3 Milestone Summary
|
||||
|
||||
**Status: Complete** — P01 (iter.Seq streaming, v0.3.1) and P02 (doctor
|
||||
network+db, v0.3.2) both shipped. REQ-022, REQ-030, REQ-032 all complete.
|
||||
Re-init SPECIFY audit confirmed all other v0.2-deferred REQs (014, 027,
|
||||
028, 029, 031, 037, 039, 040) already shipped in P08-P10.
|
||||
|
||||
## Deferred to v0.4
|
||||
## Deferred to v0.3
|
||||
|
||||
- pprof endpoint on `orca daemon` (idea I-308, 0.70 confidence): deferred
|
||||
to keep v0.2 lean; revisit in v0.3 once P02's dispatcher is stable.
|
||||
|
||||
## v0.5 Milestone Summary
|
||||
|
||||
**Status: Complete** — all 3 execution phases + final review shipped.
|
||||
P0 (v0.4.1), P1 (v0.4.2), P2 (v0.4.3), P3 (v0.4.4), P4 final (v0.4.5).
|
||||
REQ-041..046 all complete. Repo + releases publicly accessible (REQ-045).
|
||||
Docker image published to Gitea container registry (REQ-046).
|
||||
|
||||
- **P0** (v0.4.1): pre-execution + repo visibility flipped to public (REQ-045).
|
||||
- **P1** (v0.4.2): namespace unification — `ORCA_HOME` + `--system` (REQ-041/042).
|
||||
- **P2** (v0.4.3): `install.sh` 1-liner + in-place update (REQ-043/044) + README quickstart (REQ-016).
|
||||
- **P3** (v0.4.4): Docker release — distroless image + Gitea container registry (REQ-046).
|
||||
- **P4** (v0.4.5): final review + audit + milestone release.
|
||||
|
||||
## v0.6 Requirements — Node Bootstrap & Proxmox
|
||||
|
||||
| ID | Requirement | Priority | Phase | Status |
|
||||
|----|-------------|----------|-------|--------|
|
||||
| REQ-047 | `orca init` auto-provisions CA + server cert + DB migrations + localhost node (idempotent; safe re-run) | High | **v0.6 P1** | **Complete** (P1 shipped v0.5.1) |
|
||||
| REQ-048 | `orca init` registers a default `localhost` node with auto-detected OS via `/etc/os-release ID` | High | **v0.6 P1** | **Complete** (P1 shipped v0.5.1) |
|
||||
| REQ-049 | Node schema extension: `nodes.kind` (localhost\|linux\|proxmox) + `nodes.os` columns (migration 0006, backward-compatible) | High | **v0.6 P1** | **Complete** (P1 shipped v0.5.1) |
|
||||
| REQ-050 | `orca node join --type proxmox` SSH bootstrap via `golang.org/x/crypto/ssh` (new direct dep); password auth, deploy orca pubkey, create `orca` user (config-overridable), assign PVE role, drop sudoers allowlist; idempotent | High | **v0.6 P2** | **Complete** (P2 shipped v0.5.2) |
|
||||
| REQ-051 | Proxmox least-privilege `OrcaOperator` PVE role (VM.Audit, Datastore.AllocateSpace, SDN.Use) + `orca` user + `/etc/sudoers.d/orca` allowlist (pct, qm, pvesh, apt-get, dpkg); config-overridable user/role names | High | **v0.6 P2** | **Complete** (P2 shipped v0.5.2; refined: pvesh excluded per AD-020, orca@pam per AD-019) |
|
||||
| REQ-052 | `orca doctor` extensions: `doctor os` (verify localhost OS detection matches stored node row) + `doctor proxmox` (SSH-probe each `kind=proxmox` node with `pveversion`/`pvecmd status`, 3s timeout, PASS/WARN/FAIL); audit log all bootstrap + join actions | Medium | **v0.6 P3** | **Complete** (P3 shipped v0.5.3) |
|
||||
|
||||
## v0.6 Milestone Summary
|
||||
|
||||
**Status: Complete** — all 3 execution phases + final review shipped.
|
||||
P0 (v0.5.0), P1 (v0.5.1), P2 (v0.5.2), P3 (v0.5.3), P4 final (v0.5.4).
|
||||
REQ-047..052 all complete.
|
||||
|
||||
- **P0** (v0.5.0): pre-execution (specify → clarify → research → plan). 8 decisions (D-030..D-037).
|
||||
- **P1** (v0.5.1): `orca init` full bootstrap + schema 0006 (REQ-047/048/049).
|
||||
- **P2** (v0.5.2): Proxmox SSH join + OrcaOperator role + sudoers (REQ-050/051).
|
||||
- **P3** (v0.5.3): `doctor os` + `doctor proxmox` + audit logging (REQ-052).
|
||||
- **P4** (v0.5.4): final review + audit + milestone release.
|
||||
|
||||
## v0.7 Requirements — Hardening & Completion
|
||||
|
||||
| ID | Requirement | Priority | Phase | Status |
|
||||
|----|-------------|----------|-------|--------|
|
||||
| REQ-053 | `orca cert` command tree registered on root command (`cert ca-init`, `cert gen`, `cert show`, `cert renew`, `cert fingerprint`) — code exists in `internal/cli/cert.go` but is never AddCommand'd; unreachable today | High | **v0.7 P1** | **Complete** (P1 shipped v0.6.1) |
|
||||
| REQ-054 | HCL config file parsing: `internal/config` package loads `~/.orca/config.hcl` / `/etc/orca/orca.hcl` (keys: db_path, listen_addr, ca_path, server_cert_path, server_key_path, node_capacity); merge precedence flag > env > file > default; `--config` flag on root command | High | **v0.7 P2** | **Complete** (P2 shipped v0.6.2) |
|
||||
| REQ-055 | Test coverage uplift: every package ≥ 50% — adds tests for `internal/engine` (executor, dispatcher, peer), `internal/transport` (mtls, dispatch, handshake_log), `internal/proxmox` (bootstrap SSH path), `internal/audit` | Medium | **v0.7 P3** | **Complete** (P3 shipped v0.6.3) |
|
||||
| REQ-056 | `--pprof <addr>` opt-in flag on `orca daemon` (default disabled); `net/http/pprof` mounted on a separate mux, never on the mTLS daemon listener | Low | **v0.7 P4** | **Complete** (P4 shipped v0.6.4) |
|
||||
|
||||
## v0.8 Requirements — Coverage & Trust Hardening
|
||||
|
||||
| ID | Requirement | Priority | Phase | Status |
|
||||
|----|-------------|----------|-------|--------|
|
||||
| REQ-057 | Test coverage uplift round 2: raise `internal/engine` (8.3%), `internal/proxmox` (5.1%), `internal/cli` (27.6%), `internal/transport` (26.3%), `internal/store` (46.7%), `internal/jobspec` (47.6%) to ≥ 70%; add first tests for `internal/audit`, `internal/certpaths`, `cmd/orca` (currently 0%) to ≥ 50% (D-047 tiered floor) | High | **v0.8 P1** | Pending |
|
||||
| REQ-058 | `--host-key-fingerprint <SHA256:base64>` pre-pin flag on `orca node join` (validated when `--type proxmox`): when supplied, join fails fast if the SSH host key's OpenSSH SHA-256 fingerprint does not match; supersedes TOFU (D-035) for pre-pinned deployments (D-044, D-045) | Medium | **v0.8 P2** | Pending |
|
||||
| REQ-059 | `orca node key-reset <node>` command: clears the persisted SSH host key entry for the node from `~/.orca/known_hosts` only (local, not remote authorized_keys — D-046); audit-logs `event=node.key_reset`; next `doctor proxmox`/dispatch re-pins via TOFU or `--host-key-fingerprint` | Low | **v0.8 P2** | Pending |
|
||||
| REQ-060 | Requirement-status hygiene sweep: REQUIREMENTS.md v0.7 rows were stale ("Pending" after ship); add a verify-stage assertion that every REQ listed as `Complete` in ROADMAP.md has a matching `Complete` row in REQUIREMENTS.md, enforced by `make verify-reqs` | Medium | **v0.8 P3** | Pending |
|
||||
|
||||
@@ -1,506 +0,0 @@
|
||||
# Research: Orca v0.3 — scheduling-streaming
|
||||
|
||||
Phase: 0 (research) for milestone v0.3 (scheduling-streaming).
|
||||
Branch: `phase/00-pre-execution` (cut from `milestone/v0.3-scheduling-streaming`).
|
||||
Go toolchain: `go1.25.0` (confirmed via `go version`; `go.mod` declares `go 1.25.0`).
|
||||
|
||||
This document provides concrete, file-level implementation guidance for the
|
||||
two v0.3 execution phases:
|
||||
|
||||
- **P01** — `iter.Seq` streaming for `--watch` flags (REQ-022, REQ-030)
|
||||
- **P02** — `orca doctor` network + db full implementation (REQ-032 completion)
|
||||
|
||||
All assumptions are logged as decisions (D-025..D-038) with confidence scores.
|
||||
Full autonomy mode — no items flagged for human validation.
|
||||
|
||||
---
|
||||
|
||||
## Codebase Audit Summary
|
||||
|
||||
### Current state (commit ba5ffd7 + phase docs)
|
||||
|
||||
| Area | File | Key finding |
|
||||
|------|------|-------------|
|
||||
| CLI `job list` | `internal/cli/job.go:112-143` | `jobListCmd.RunE` calls `store.NewJobRepo(db).List(ctx)`, prints a fixed-width table; `--json` via `printJSON(jobs)`. No `--watch` flag exists. |
|
||||
| CLI `node list` | `internal/cli/node.go:155-186` | `nodeListCmd.RunE` calls `registry.List(ctx)` → `repo.List(ctx)`. Table + `--json`. No `--watch` flag. |
|
||||
| CLI root | `internal/cli/root.go` | `jsonOutput` is a package-level `bool` set by `--json` persistent flag. `printJSON` uses `json.NewEncoder` with 2-space indent. |
|
||||
| Job repo | `internal/store/job_task_repo.go` | `JobRepo.List(ctx) ([]*model.Job, error)` — single-shot query, closes rows. `scanJob` helper is reusable. |
|
||||
| Node repo | `internal/store/node_repo.go` | `NodeRepo.List(ctx) ([]*model.Node, error)`. `scanNode` helper is reusable. `scanner` interface defined here (`Scan(dest ...any) error`) — shared by `*sql.Row` and `*sql.Rows`. |
|
||||
| Store open | `internal/store/store.go` | `store.Open(path)` opens with `?_pragma=journal_mode(WAL)&_pragma=foreign_keys(ON)` and runs `migrate(db)`. |
|
||||
| Migrations | `internal/store/migrate.go` | `migrate` is unexported, runs at `Open` time. `schema_migrations` table tracks applied migrations by filename. Migrations are embedded via `//go:embed migrations/*.sql`. No public API to query migration version. |
|
||||
| Migrations on disk | `internal/store/migrations/` | `0001_nodes.sql`, `0002_jobs_tasks.sql`, `0003_audit_log.sql`, `0004_certs.sql`, `0005_node_capacity.sql`. Highest = 0005. |
|
||||
| Doctor | `internal/doctor/doctor.go` | `NetworkStub()` and `DBStub()` return WARN stubs. `All()` aggregates 6 checks. `Run(ctx)` iterates checks. `Check.Run` signature: `func(ctx context.Context) (Result, string)`. `Result` is `PASS|WARN|FAIL`. No DB or transport imports — cert-only. |
|
||||
| Doctor CLI | `internal/cli/doctor.go` | `doctorNetworkCmd`/`doctorDBCmd` call `doctor.NetworkStub()`/`doctor.DBStub()` directly. |
|
||||
| Doctor tests | `internal/doctor/doctor_test.go` | Two tests: `TestRunAllChecksWithNoCA` (expects FAIL + WARN for stubs), `TestRunWithCAAndServerCert` (cert checks PASS). Uses `t.Setenv("ORCA_HOME", dir)`. **The "expects WARN" assertion will break when stubs become real checks** — must be updated in P02. |
|
||||
| Transport mTLS client | `internal/transport/mtls.go` | `NewMTLSClient(caPath, serverName, certPath, keyPath)` builds an `http.Client` with a TLS-1.3-only config from `security.ClientTLSConfig`. `MTLSClient.Do(req)`. `DialContext` for low-level TLS dial. |
|
||||
| Transport dispatch client | `internal/transport/dispatch.go` | `NewDispatchClient(caPath, serverName, peerAddr)` wraps `MTLSClient`. `PeerAddr` is `http://` or `https://`. `Submit`/`Status` POST to `/orca.v1.Dispatch/*`. No `/healthz` GET helper. |
|
||||
| Daemon health | `internal/daemon/health.go` | `handleHealthz` → 200 `{"status":"alive"}`. `handleReadyz` → 200/503 with db ping. Mounted at `mux.HandleFunc("/healthz", ...)` in `server.go:104`. |
|
||||
| Daemon TLS | `internal/daemon/tls.go` | `StartMTLS(state)` sets `httpServer.TLSConfig` with `ClientAuth = RequireAndVerifyClientCert`. The daemon **requires client certs** in mTLS mode. |
|
||||
| Peer registry | `internal/engine/peer.go` | `PeerRegistry` is **in-memory only** (`map[string]*Peer` under `sync.RWMutex`). `NewPeerRegistry()` returns empty. `Peer` has `NodeID, Address, ServerName, CAPath, LastSeen, Capacity`. **Not persisted to SQLite.** |
|
||||
| Peer registry usage | `internal/cli/job.go:70`, `internal/cli/daemon.go:47` | Both create a **fresh empty** `NewPeerRegistry()` per process. No code ever calls `peers.Add(...)`. The registry is currently a structural placeholder. |
|
||||
| Node registry | `internal/engine/registry.go` | `NodeRegistry` wraps `store.NodeRepo` + `Audit`. `List(ctx)` → `repo.List(ctx)`. Persisted to `nodes` table. |
|
||||
| Node model | `internal/model/node.go` | `Node{ID, Name, Address, State, JoinedAt, LastSeen, Metadata}`. **No `ServerName` or `CAPath` field** — `model.Node` differs from `engine.Peer`. |
|
||||
| Cert paths | `internal/certpaths/certpaths.go` | `Dir()` honors `ORCA_HOME`; `CACertPath()`, `ServerCertPath()`, `ServerKeyPath()`. |
|
||||
| Security client TLS | `internal/security/tls_config.go:106` | `ClientTLSConfig(caPath, serverName, certPath, keyPath)` — TLS 1.3 only, AEAD allowlist, `RootCAs` = single CA. Both-or-neither for cert/key. |
|
||||
| Go version | `go.mod` + `go version` | `go 1.25.0` — `iter` package and range-over-func are stable stdlib. |
|
||||
| Deps | `go.mod` | cobra, hcl/v2, modernc/sqlite, uuid. **No new deps needed for v0.3.** `iter` is stdlib. |
|
||||
|
||||
### Critical gap analysis
|
||||
|
||||
1. **`PeerRegistry` is non-persistent and always empty at CLI time.** The
|
||||
doctor network check cannot rely on it — there is no code path that populates
|
||||
it. The `nodes` table IS persisted and has `Address`, but lacks the
|
||||
`ServerName`/`CAPath` needed for an mTLS probe. **Resolution: doctor network
|
||||
reads the `nodes` table via `NodeRepo.List`, and derives `ServerName` +
|
||||
`CAPath` from local config (`certpaths.CACertPath()` + node name/addr).**
|
||||
See D-029.
|
||||
|
||||
2. **`doctor.Run` / `Check.Run` do not plumb a `*sql.DB` or transport client.**
|
||||
The cert checks are filesystem-only. P02 must extend the check constructors
|
||||
to accept a DB handle and (for network) a transport client factory. The
|
||||
`Check.Run` signature (`func(ctx) (Result, string)`) is preserved by
|
||||
closure-capturing the handles in the constructor. See D-027, D-031.
|
||||
|
||||
3. **No public migration-version query.** `migrate()` is unexported and writes
|
||||
to `schema_migrations(name, applied_at)`. P02 adds a public
|
||||
`store.MigrationVersion(ctx, db)` (or method on a repo) that selects the max
|
||||
applied migration name. See D-033.
|
||||
|
||||
4. **Doctor test `TestRunAllChecksWithNoCA` asserts a WARN from stubs.** This
|
||||
will break when stubs become real (the db check will PASS with a fresh test
|
||||
DB, and the network check will WARN/FAIL on zero peers). Must be updated.
|
||||
See D-036.
|
||||
|
||||
---
|
||||
|
||||
## P01: iter.Seq Streaming for `--watch` Flags
|
||||
|
||||
Covers REQ-022 (`iter.Seq` for streaming job lists), REQ-030 (`--watch` output
|
||||
format: table default vs streaming one-line JSON per event).
|
||||
|
||||
### Decisions
|
||||
|
||||
| ID | Decision | Confidence |
|
||||
|----|----------|------------|
|
||||
| **D-025** | `iter.Seq` lives on the store repos, not the engine registry. `JobRepo.Watch(ctx) iter.Seq[*model.Job]` and `NodeRepo.Watch(ctx) iter.Seq[*model.Node]`. Rationale: repos already own the `*sql.DB` and the `scanJob`/`scanNode` helpers; engine.Registry.List just delegates to repo. Keeping Watch in the store layer matches the data-engineer territory and avoids a new engine→store iter dependency. | 0.90 |
|
||||
| **D-026** | Element type is `*model.Job` / `*model.Node` (pointer), matching the existing `[]*model.Job` return of `List`. This keeps `printJSON` and table rendering identical between one-shot and watch paths. | 0.88 |
|
||||
| **D-027** | The `Check.Run` signature in `doctor` is unchanged; P02 captures DB/transport handles in closure at constructor time (`Network(db)`, `DB(db)`). This is the established pattern (cert checks already closure-capture `certpaths`). | 0.92 |
|
||||
| **D-028** | Watch refresh = poll-based 1s ticker (per D-019). No event channel, no daemon coupling. Each tick re-runs the existing `List` query and yields the **full current snapshot** (one element per row). The CLI dedupes by detecting snapshot equality before re-rendering (see D-030). Rationale: simpler than NOTIFY/LISTEN, no daemon dependency, matches offline-first. | 0.90 |
|
||||
| **D-029** | `--watch` output: default = re-print the table on every changed snapshot (clear screen via ANSI `\033[2J\033[H` then table); `--watch --json` = one compact JSON line **per snapshot** (an array on each line, OR one line per element — see D-030). The CLI tracks the previous snapshot's hash to avoid spamming identical frames. | 0.85 |
|
||||
| **D-030** | `--watch --json` emits **one JSON object per element per tick where the element changed**, i.e. streaming one-line JSON per event (per REQ-030 wording). Implementation: on each tick, for each element, if its JSON bytes differ from the previous snapshot's bytes for that ID, print `{"event":"update","job":{...}}\n`. On first tick, print all as `{"event":"init",...}`. This is the most useful for AI agents tailing the stream. Confidence lower because REQ-030 is ambiguous between "array per tick" and "object per event"; the per-event interpretation matches "streaming one-line JSON per event" literally. | 0.72 |
|
||||
| **D-031** | Cancellation: `signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM)` at the CLI command layer, **replacing** the current `context.WithTimeout(cmd.Context(), 5*time.Second)` for the watch path only. The non-watch `list` path keeps its 5s timeout. The `iter.Seq` receives this ctx and stops yielding on `ctx.Done()`. | 0.93 |
|
||||
| **D-032** | The `iter.Seq` implementation **must not leak goroutines**: the polling loop runs **inline in the yield callback's caller goroutine** (the `range` loop), not a separate goroutine. `for range seq { ... }` drives the pull; inside `Watch`, we loop `for { select { <-ticker.C: query+yield each; <-ctx.Done(): return } }` and call `yield(item)` directly. When `yield` returns false (consumer broke the loop), we stop and return. **No goroutine is spawned by Watch.** This is the cleanest Go 1.25 iter pattern and avoids leak surface entirely. | 0.95 |
|
||||
|
||||
### Implementation approach — store layer
|
||||
|
||||
**File: `internal/store/job_task_repo.go`** — add method:
|
||||
|
||||
```go
|
||||
// Watch yields the current snapshot of jobs on a 1-second ticker until
|
||||
// ctx is cancelled or the consumer stops pulling (yield returns false).
|
||||
// It does not spawn a goroutine; the polling loop runs in the caller's
|
||||
// goroutine via the range-over-func pull protocol.
|
||||
//
|
||||
// Each tick re-runs the List query and yields one *model.Job per row.
|
||||
// The caller is responsible for deduping across ticks if desired.
|
||||
func (r *JobRepo) Watch(ctx context.Context) iter.Seq[*model.Job] {
|
||||
return func(yield func(*model.Job) bool) {
|
||||
ticker := time.NewTicker(1 * time.Second)
|
||||
defer ticker.Stop()
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return
|
||||
case <-ticker.C:
|
||||
}
|
||||
// Reuse the existing List query + scanJob helper.
|
||||
rows, err := r.db.QueryContext(ctx,
|
||||
`SELECT id, name, spec, status, exit_code, created_at, started_at, ended_at
|
||||
FROM jobs ORDER BY created_at DESC`)
|
||||
if err != nil {
|
||||
// Surfacing errors from inside iter.Seq is awkward; the
|
||||
// CLI layer cannot receive a returned error. Log via slog
|
||||
// (the repo doesn't hold a logger today — see D-034) and
|
||||
// continue to next tick rather than terminating the
|
||||
// stream. A transient DB blip should not kill the watch.
|
||||
continue
|
||||
}
|
||||
for rows.Next() {
|
||||
j, err := scanJob(rows)
|
||||
if err != nil {
|
||||
rows.Close()
|
||||
return
|
||||
}
|
||||
if !yield(j) {
|
||||
rows.Close()
|
||||
return // consumer stopped
|
||||
}
|
||||
}
|
||||
rows.Close()
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**File: `internal/store/node_repo.go`** — add analogous `Watch`:
|
||||
|
||||
```go
|
||||
func (r *NodeRepo) Watch(ctx context.Context) iter.Seq[*model.Node] {
|
||||
return func(yield func(*model.Node) bool) {
|
||||
ticker := time.NewTicker(1 * time.Second)
|
||||
defer ticker.Stop()
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return
|
||||
case <-ticker.C:
|
||||
}
|
||||
rows, err := r.db.QueryContext(ctx,
|
||||
`SELECT id, name, address, state, joined_at, last_seen, metadata
|
||||
FROM nodes ORDER BY joined_at ASC`)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
for rows.Next() {
|
||||
n, err := scanNode(rows)
|
||||
if err != nil {
|
||||
rows.Close()
|
||||
return
|
||||
}
|
||||
if !yield(n) {
|
||||
rows.Close()
|
||||
return
|
||||
}
|
||||
}
|
||||
rows.Close()
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Imports: add `"iter"` and `"time"` (time already present in both files). The
|
||||
`iter` package is imported only for the return type; `yield` is the callback.
|
||||
|
||||
**Note on the existing `scanner` interface:** `scanJob`/`scanNode` accept the
|
||||
`scanner` interface (`Scan(dest ...any) error`) satisfied by both `*sql.Row`
|
||||
and `*sql.Rows`, so they are directly reusable in `Watch` — no refactor needed.
|
||||
|
||||
### Implementation approach — CLI layer
|
||||
|
||||
**File: `internal/cli/job.go`** — modify `jobListCmd`:
|
||||
|
||||
1. Add a package var `jobWatch bool` and register `jobListCmd.Flags().BoolVar(&jobWatch, "watch", false, "stream jobs until Ctrl-C")`.
|
||||
2. In `RunE`, branch on `jobWatch`:
|
||||
- If `!jobWatch`: keep the existing 5s-timeout `List` path.
|
||||
- If `jobWatch`:
|
||||
- `ctx, cancel := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM); defer cancel()` (drop the 5s timeout).
|
||||
- `seq := store.NewJobRepo(db).Watch(ctx)`
|
||||
- If `jsonOutput`: stream one-line JSON per event (D-030). Maintain a `map[string][]byte` of last-seen JSON per job ID. On each yielded job, marshal compact JSON; if it differs from the stored bytes (or ID unseen), print `{"event":"update","job":{...}}\n` and update the map.
|
||||
- Else (table): on each tick, after collecting the full snapshot, compare against the previous snapshot (by hashing the rendered table string or by comparing the slice of `[]*model.Job` via reflect/cmp). If changed, emit `"\033[2J\033[H"` (clear) then the table header + rows. This gives a "top-like" refresh.
|
||||
|
||||
Because `iter.Seq` does not return an error, the watch path swallows
|
||||
per-tick query errors inside `Watch` (D-034). The CLI relies on `ctx.Done()`
|
||||
for termination.
|
||||
|
||||
**File: `internal/cli/node.go`** — analogous change to `nodeListCmd`:
|
||||
- Add `nodeWatch bool`, register `--watch` flag.
|
||||
- Branch in `RunE`; `seq := store.NewNodeRepo(db).Watch(ctx)` (open a fresh `openDB()` for the watch path; `registry.List` is not used for watch — go straight to the repo to get the iter).
|
||||
|
||||
**Note:** `nodeListCmd` currently goes through `nodeRegistry()` which wraps
|
||||
`NodeRepo` in `engine.NodeRegistry`. For watch, bypass the registry and use
|
||||
`store.NewNodeRepo(db).Watch(ctx)` directly — the registry adds no value for a
|
||||
read-only stream and would require a `Watch` passthrough method. This keeps the
|
||||
iter boundary clean in the store layer (D-025).
|
||||
|
||||
### Pitfalls & mitigations (P01)
|
||||
|
||||
| Pitfall | Mitigation |
|
||||
|---------|------------|
|
||||
| **Goroutine leak** if Watch spawned a goroutine. | It doesn't — the polling loop is inline in the pull callback (D-032). `defer ticker.Stop()` + `rows.Close()` on every exit path. |
|
||||
| **Rows cursor held open across yield** — if `yield` blocks (e.g. slow consumer), the `*sql.Rows` stays open and holds a SQLite read lock. | Yield is called per-row inside the `rows.Next()` loop; the consumer (`range`) is fast (prints to stdout). For safety, close rows immediately after the loop or on `yield==false`. The 1s tick cadence bounds how long a cursor is held. WAL mode (set in `store.Open`) allows concurrent reads, so this does not block writers. |
|
||||
| **No error channel from iter.Seq** — a transient DB error is invisible to the CLI. | Log inside Watch via a package-level slog default (`slog.Default().Warn(...)`) since the repo has no logger field today (D-034: add an optional `logger *slog.Logger` to JobRepo/NodeRepo, defaulting to `slog.Default()` in the constructors — minimal change). Continue to next tick rather than terminating. |
|
||||
| **ctx cancellation mid-query** — `QueryContext` returns an error; `rows.Next()` returns false. | Handled: the `select` on `ctx.Done()` returns before the next tick; an in-flight query is cancelled by the ctx. |
|
||||
| **Rapid re-render flicker** in table mode. | Clear-screen + full re-render on changed snapshot only (hash compare). Unchanged snapshots produce no output. |
|
||||
| **`--watch` + `--json` interleaving with slog stderr.** | slog writes to stderr; CLI output to stdout — no interleaving on stdout. Safe. |
|
||||
| **Test determinism** — ticker is 1s, tests would be slow/flaky. | Provide a test-only constructor `WatchWithInterval(ctx, d time.Duration)` OR make the interval a field on the repo set via an unexported option. Preferred: an unexported `watchInterval` package var defaulting to 1s, overridable from `internal/store` tests. See D-035. |
|
||||
| **Signal handling clobbers root signal handler.** | `signal.NotifyContext` with `os.Interrupt` returns a fresh ctx; the root `cobra.Command` does not install its own SIGINT handler, so no conflict. `defer cancel()` restores default behavior on exit. |
|
||||
|
||||
### Test strategy (P01)
|
||||
|
||||
**`internal/store/job_task_repo_test.go` (new file or appended):**
|
||||
- `TestJobRepoWatch_YieldsSnapshots`: insert 1 job, call `Watch` with a 10ms interval (via test hook), range over `seq` collecting into a slice, insert a 2nd job from a goroutine after 30ms, cancel ctx after 80ms, assert the 2nd job appeared in the collected slice. Use `context.WithTimeout` for cancellation.
|
||||
- `TestJobRepoWatch_StopsOnConsumerBreak`: range over `seq` and `break` after the first yield; assert the function returns (no hang) within a short deadline. This validates the `yield==false` path.
|
||||
- `TestJobRepoWatch_StopsOnCtxCancel`: cancel ctx; assert the range loop exits within 50ms.
|
||||
- `TestNodeRepoWatch_*`: mirror the above for nodes.
|
||||
|
||||
**`internal/cli/job_test.go` (new) / `node_test.go` (new) — if CLI tests exist; otherwise add:**
|
||||
- `TestJobListWatch_JSONStreaming`: spin a temp DB, insert a job, invoke the `jobListCmd.RunE` with `--watch --json` in a goroutine, insert a 2nd job, capture stdout for ~200ms, assert two JSON lines appear. Cancel via ctx.
|
||||
- `TestJobListWatch_TableRefresh`: assert clear-screen escape + table re-render on change.
|
||||
- These CLI tests are harder to make deterministic; prefer testing the store-layer Watch thoroughly and keep CLI watch tests to a smoke-level "produces output, exits on ctx.Done".
|
||||
|
||||
### Dependency check (P01)
|
||||
|
||||
- `iter` — Go 1.25 stdlib (`go.mod` declares `go 1.25.0`). ✅ no new dep.
|
||||
- `time`, `context`, `os/signal`, `syscall`, `encoding/json` — stdlib. ✅
|
||||
- No new go.mod dependencies required.
|
||||
|
||||
---
|
||||
|
||||
## P02: `orca doctor` network + db full implementation
|
||||
|
||||
Covers REQ-032 completion (network + db checks replacing `NetworkStub`/`DBStub`).
|
||||
|
||||
### Decisions
|
||||
|
||||
| ID | Decision | Confidence |
|
||||
|----|----------|------------|
|
||||
| **D-033** | Add a public `store.MigrationVersion(ctx, db) (string, error)` function (in `migrate.go` or a new `internal/store/migrate_query.go`) that returns the **highest applied migration filename** from `schema_migrations`. SQL: `SELECT name FROM schema_migrations ORDER BY name DESC LIMIT 1`. This is the source of truth for "migration version" — it reflects what `migrate()` actually applied. Returns `("", nil)` if no migrations applied (fresh empty table) and `("", sql.ErrNoRows)` is treated as empty. | 0.90 |
|
||||
| **D-034** | The doctor DB check opens its own `*sql.DB` via `store.Open(dbPath())` (reusing the CLI's `dbPath`) inside the check constructor closure, rather than receiving a shared handle. Rationale: doctor should be runnable whether the daemon is up or down; `store.Open` uses WAL so a concurrent daemon is fine. The check `defer db.Close()`. This avoids threading a `*sql.DB` through `doctor.Run`/`All()` and keeps the `Check.Run` signature stable. | 0.86 |
|
||||
| **D-035** | The doctor DB check runs `PRAGMA integrity_check` via `db.QueryRow("PRAGMA integrity_check")`. SQLite returns a single row with a TEXT value: `"ok"` on success, or a multi-line error description on failure. PASS if the value is `"ok"`; FAIL otherwise (with the first line of the message). Plus query the migration version (D-033); WARN if `schema_migrations` is empty (fresh/never-migrated db) — this is suspicious but not corrupt. | 0.92 |
|
||||
| **D-036** | Doctor network check sources peer addresses from the **`nodes` table** (`NodeRepo.List`), NOT from `engine.PeerRegistry` (which is in-memory and always empty at CLI time — see gap #1). For each node with `state != 'left'`, probe `https://<address>/healthz` over mTLS. | 0.88 |
|
||||
| **D-037** | For each peer, the network check builds an mTLS client via `transport.NewMTLSClient(certpaths.CACertPath(), serverName, certpaths.ServerCertPath(), certpaths.ServerKeyPath())`. `serverName` is derived as the node's `Name` (the SAN on a peer's server cert is its node name, per `security.GenerateCSR(nodeName, sans)` — confirmed in `integration_test.go:41` `GenerateCSR("test-server", ...)`. If the SAN uses a different value the probe will fail handshake, which is itself a useful diagnostic). `CAPath` is the local `ca.crt` (all peers share one CA per D-011). This presents the local node's client cert, satisfying the daemon's `RequireAndVerifyClientCert`. | 0.80 |
|
||||
| **D-038** | Network check result semantics: **zero peers registered** → `WARN` ("no peers registered; network check skipped") — not FAIL, because a single-node install legitimately has no peers. **A peer unreachable / handshake failed** → `FAIL` for that peer, aggregated to a single `network` check result that is FAIL if any peer failed, PASS if all peers probed OK, WARN if zero peers. Each peer's per-line outcome is folded into the message string (e.g. `PASS — 2/2 peers reachable; FAIL — peer node-b (host:port): tls handshake error`). | 0.85 |
|
||||
|
||||
### Implementation approach — db check
|
||||
|
||||
**File: `internal/store/migrate.go`** — add:
|
||||
|
||||
```go
|
||||
// MigrationVersion returns the filename of the most recently applied
|
||||
// migration, or "" if no migrations have been applied (empty db or
|
||||
// schema_migrations table missing). Used by `orca doctor db`.
|
||||
func MigrationVersion(ctx context.Context, db *sql.DB) (string, error) {
|
||||
var name string
|
||||
err := db.QueryRowContext(ctx,
|
||||
`SELECT name FROM schema_migrations ORDER BY name DESC LIMIT 1`).Scan(&name)
|
||||
if err == sql.ErrNoRows {
|
||||
return "", nil
|
||||
}
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("query migration version: %w", err)
|
||||
}
|
||||
return name, nil
|
||||
}
|
||||
```
|
||||
|
||||
(Add `"context"` import — already imported in migrate.go.)
|
||||
|
||||
**File: `internal/doctor/doctor.go`** — replace `DBStub()` with `DB()`:
|
||||
|
||||
```go
|
||||
// DB checks SQLite integrity and migration version (REQ-032).
|
||||
// It opens its own *sql.DB so it can run whether or not the daemon is up.
|
||||
func DB() Check {
|
||||
return Check{
|
||||
Name: "db",
|
||||
Description: "SQLite PRAGMA integrity_check + migration version",
|
||||
Run: func(ctx context.Context) (Result, string) {
|
||||
path := dbPath() // dbPath currently lives in internal/cli; see D-039
|
||||
db, err := store.Open(path)
|
||||
if err != nil {
|
||||
return ResultFail, fmt.Sprintf("open %s: %v", path, err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
// 1. integrity_check
|
||||
var integrity string
|
||||
if err := db.QueryRowContext(ctx, "PRAGMA integrity_check").Scan(&integrity); err != nil {
|
||||
return ResultFail, fmt.Sprintf("integrity_check query: %v", err)
|
||||
}
|
||||
if integrity != "ok" {
|
||||
first := strings.SplitN(integrity, "\n", 2)[0]
|
||||
return ResultFail, fmt.Sprintf("integrity_check: %s", first)
|
||||
}
|
||||
|
||||
// 2. migration version
|
||||
ver, err := store.MigrationVersion(ctx, db)
|
||||
if err != nil {
|
||||
return ResultFail, fmt.Sprintf("migration version: %v", err)
|
||||
}
|
||||
if ver == "" {
|
||||
return ResultWarn, "integrity ok; no migrations applied (fresh db?)"
|
||||
}
|
||||
return ResultPass, fmt.Sprintf("integrity ok; migrations up to %s", ver)
|
||||
},
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**D-039 (assumption, confidence 0.78):** `dbPath()` currently lives in
|
||||
`internal/cli/node.go` and is unexported. The `doctor` package cannot import
|
||||
`internal/cli` (would create a cycle: `cli` imports `doctor`). **Resolution:**
|
||||
move `dbPath()` (and the `ORCA_DB` env logic) into `certpaths` (rename the
|
||||
package conceptually, or add a sibling `internal/paths` package) OR duplicate
|
||||
the ~5-line `dbPath` function inside `internal/doctor`. The cleanest is to add
|
||||
`func DBPath() string` to `internal/certpaths/certpaths.go` (it already owns
|
||||
`Dir()` honoring `ORCA_HOME`) and have both `cli` and `doctor` call it.
|
||||
`cli.dbPath` becomes a thin wrapper or is replaced. This is a small refactor
|
||||
within P02's scope. Logged as D-039, confidence 0.78 (territory overlap between
|
||||
cli-engineer and the doctor package; lead-developer adjudicates).
|
||||
|
||||
### Implementation approach — network check
|
||||
|
||||
**File: `internal/doctor/doctor.go`** — replace `NetworkStub()` with `Network()`:
|
||||
|
||||
```go
|
||||
// Network probes each registered peer's /healthz over mTLS (REQ-032).
|
||||
// Peers are sourced from the nodes table. Zero peers => WARN (single-node
|
||||
// install is legitimate). Any peer unreachable => FAIL.
|
||||
func Network() Check {
|
||||
return Check{
|
||||
Name: "network",
|
||||
Description: "peer reachability via mTLS /healthz probe",
|
||||
Run: func(ctx context.Context) (Result, string) {
|
||||
// 1. Load registered nodes (skip 'left').
|
||||
path := certpaths.DBPath() // same resolution as D-039
|
||||
db, err := store.Open(path)
|
||||
if err != nil {
|
||||
return ResultFail, fmt.Sprintf("open db for node list: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
nodes, err := store.NewNodeRepo(db).List(ctx)
|
||||
if err != nil {
|
||||
return ResultFail, fmt.Sprintf("list nodes: %v", err)
|
||||
}
|
||||
// filter out left nodes
|
||||
var live []*model.Node
|
||||
for _, n := range nodes {
|
||||
if n.State != model.NodeStateLeft {
|
||||
live = append(live, n)
|
||||
}
|
||||
}
|
||||
if len(live) == 0 {
|
||||
return ResultWarn, "no peers registered; network check skipped (single-node?)"
|
||||
}
|
||||
|
||||
caPath := certpaths.CACertPath()
|
||||
certPath := certpaths.ServerCertPath()
|
||||
keyPath := certpaths.ServerKeyPath()
|
||||
// Short per-probe timeout so one slow peer doesn't stall doctor.
|
||||
var lines []string
|
||||
overall := ResultPass
|
||||
for _, n := range live {
|
||||
probeCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
|
||||
err := probeHealthz(probeCtx, caPath, certPath, keyPath, n.Name, n.Address)
|
||||
cancel()
|
||||
if err != nil {
|
||||
overall = ResultFail
|
||||
lines = append(lines, fmt.Sprintf("FAIL %s (%s): %v", n.Name, n.Address, err))
|
||||
} else {
|
||||
lines = append(lines, fmt.Sprintf("PASS %s (%s)", n.Name, n.Address))
|
||||
}
|
||||
}
|
||||
if overall == ResultPass {
|
||||
return ResultPass, fmt.Sprintf("%d/%d peers reachable: %s", len(live), len(live), strings.Join(lines, "; "))
|
||||
}
|
||||
return ResultFail, strings.Join(lines, "; ")
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// probeHealthz does a GET https://addr/healthz over mTLS.
|
||||
func probeHealthz(ctx context.Context, caPath, certPath, keyPath, serverName, addr string) error {
|
||||
client, err := transport.NewMTLSClient(caPath, serverName, certPath, keyPath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("build mTLS client: %w", err)
|
||||
}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://"+addr+"/healthz", nil)
|
||||
if err != nil {
|
||||
return fmt.Errorf("build request: %w", err)
|
||||
}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return fmt.Errorf("probe: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return fmt.Errorf("healthz status %d", resp.StatusCode)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
```
|
||||
|
||||
New imports in `doctor.go`: `net/http`, `strings`, `time`, `git.cloudinit.dev/coreci/orca/internal/store`, `git.cloudinit.dev/coreci/orca/internal/transport`, `git.cloudinit.dev/coreci/orca/internal/model`.
|
||||
|
||||
**File: `internal/doctor/doctor.go`** — update `All()`:
|
||||
```go
|
||||
func All() []Check {
|
||||
return []Check{
|
||||
CertCA(), CertServer(), CertExpiry(), CertFingerprint(),
|
||||
Network(), // was NetworkStub()
|
||||
DB(), // was DBStub()
|
||||
}
|
||||
}
|
||||
```
|
||||
Keep `NetworkStub`/`DBStub` exported functions for one release as thin
|
||||
wrappers that call the new ones? **No** — delete them; the CLI doctor.go
|
||||
references them and must be updated in lockstep (they are internal). See D-040.
|
||||
|
||||
**File: `internal/cli/doctor.go`** — update `doctorNetworkCmd` and `doctorDBCmd`:
|
||||
```go
|
||||
doctorNetworkCmd.RunE: c := doctor.Network() // was doctor.NetworkStub()
|
||||
doctorDBCmd.RunE: c := doctor.DB() // was doctor.DBStub()
|
||||
```
|
||||
Also: the per-subcommand render should honor `jsonOutput` (currently it only
|
||||
prints text). Minor enhancement, in scope.
|
||||
|
||||
### Pitfalls & mitigations (P02)
|
||||
|
||||
| Pitfall | Mitigation |
|
||||
|---------|------------|
|
||||
| **`model.Node` has no `ServerName`/`CAPath`** — mTLS needs `ServerName` to match the cert SAN. | Derive `ServerName = node.Name` (D-037). This assumes peer server certs are issued with SAN = node name, which matches `GenerateCSR(nodeName, sans)`. If a deployment uses DNS SANs instead, the probe fails — which is itself a diagnostic. Document this assumption in the check message. |
|
||||
| **No local client cert/key** — doctor can't present a client cert if `server.crt`/`server.key` are missing. | The check should FAIL with a clear message if `certpaths.ServerCertPath()` doesn't exist, BEFORE attempting probes. Reuse `os.Stat`. This also covers the single-node-never-joined case. |
|
||||
| **Daemon down** — peer's `/healthz` unreachable. | Per-probe 3s timeout (D-038). Surfaces as FAIL per peer with the dial/handshake error in the message. Doctor is designed to run with daemon up or down, so this is expected behavior, not a crash. |
|
||||
| **Self-probe** — the local node is likely in the `nodes` table too. Doctor will probe itself over mTLS. This is fine (validates the local daemon's mTLS stack) but requires the local daemon to be running. If the daemon is down, the self-probe fails → FAIL, which is the correct signal. | Document; no special-casing. |
|
||||
| **DB file doesn't exist** — `store.Open` creates the dir + file + runs migrations (so a missing db becomes a fresh empty db). The db check would then PASS with "no migrations applied" WARN. | This is acceptable: `store.Open` is idempotent. If the operator expected an existing db, the WARN surfaces the surprise. Could additionally `os.Stat` the path before `Open` and WARN if it didn't exist pre-open — optional refinement. |
|
||||
| **`PRAGMA integrity_check` can return multiple rows** in rare cases (when there are multiple errors). `QueryRow` only reads the first. | For `integrity_check`, a single row containing `"ok"` or the first error is the documented SQLite behavior for the common case. Use `QueryRow` + `Scan`; if it's not `"ok"`, that's already a FAIL. Acceptable. |
|
||||
| **Doctor test `TestRunAllChecksWithNoCA`** asserts WARN from stubs. | Update the test: with real checks, a no-CA scenario yields FAIL on cert.ca (unchanged) AND FAIL on db (open succeeds, integrity ok, but no migrations if fresh — actually WARN) AND WARN on network (no peers). Rewrite assertions to check each check by name rather than "hasWarn globally". See test strategy. |
|
||||
| **Import cycle:** `doctor` → `cli` (for `dbPath`). | Resolved by D-039: move `dbPath` to `certpaths` (or a new `internal/paths`); both `cli` and `doctor` import it. No cycle. |
|
||||
| **`store.Open` runs migrations on every open** — doctor opening the db to run integrity_check would also (re)migrate. | `migrate()` is idempotent (checks `schema_migrations` per name). Re-opening is safe; no-op if already migrated. Acceptable. |
|
||||
|
||||
### Test strategy (P02)
|
||||
|
||||
**`internal/store/migrate_test.go` (new or appended):**
|
||||
- `TestMigrationVersion`: open a fresh test db (which runs migrate), call `MigrationVersion`, assert it returns `0005_node_capacity.sql` (the highest current migration). Then manually delete all rows from `schema_migrations`, assert returns `""` with nil error.
|
||||
|
||||
**`internal/doctor/doctor_test.go` (update):**
|
||||
- Update `TestRunAllChecksWithNoCA`: set `ORCA_HOME` to temp dir (no CA). Expect: cert.ca FAIL, cert.server FAIL, cert.expiry FAIL, cert.fingerprint FAIL, **db WARN** (fresh db, no migrations — actually `store.Open` runs migrations, so db will PASS with version 0005; adjust: db PASS), **network WARN** (no peers). Rewrite to assert per-check rather than "hasWarn/hasFail globally". Remove the stale "expected WARN (stubs)" comment.
|
||||
- New `TestDBCheck_IntegrityOK`: open a fresh db via `store.Open` in temp, run `doctor.DB().Run(ctx)`, expect PASS and message contains "0005".
|
||||
- New `TestDBCheck_Corrupt`: open db, manually `db.Exec("DROP TABLE jobs")` to introduce inconsistency, run integrity_check — but `integrity_check` mostly detects corruption, not missing tables. More reliable: write garbage to the db file via raw file write, then open — `store.Open` may fail at Ping. Assert FAIL. (This test is brittle; prefer a unit test on the integrity string-parsing logic with a stub.)
|
||||
- New `TestNetworkCheck_NoPeers`: fresh db, no nodes, run `doctor.Network().Run(ctx)`, expect WARN.
|
||||
- New `TestNetworkCheck_PeerReachable`: this is an integration test — bootstrap a CA (`security.CAInit`), generate+sign a server cert with SAN `localhost`, start an `httptest.NewUnstartedServer` with `ts.TLS = serverTLS` and `ClientAuth = RequireAndVerifyClientCert` (mirror `security/integration_test.go:88-108`), generate+sign a client cert, insert a node row with `Address = ts.Listener.Addr().String()` and `Name = "localhost"`, set `ORCA_HOME` to the temp dir holding the CA + client cert, run `doctor.Network().Run(ctx)`, expect PASS. This reuses the proven pattern from `TestEndToEndMTLS`.
|
||||
- New `TestNetworkCheck_PeerUnreachable`: insert a node with `Address = "127.0.0.1:1"` (nothing listening), run, expect FAIL with the peer name in the message.
|
||||
|
||||
### Dependency check (P02)
|
||||
|
||||
- `net/http`, `crypto/tls` (via transport), `strings`, `time`, `context` — stdlib. ✅
|
||||
- `internal/transport`, `internal/store`, `internal/model`, `internal/certpaths` — existing internal packages. ✅
|
||||
- No new go.mod dependencies required.
|
||||
|
||||
---
|
||||
|
||||
## Cross-cutting decisions
|
||||
|
||||
| ID | Decision | Confidence |
|
||||
|----|----------|------------|
|
||||
| **D-039** | Move `dbPath()` (the `ORCA_DB`-honoring path resolver) from `internal/cli` to `internal/certpaths` as `DBPath()`, to break the would-be `doctor→cli` import cycle. Both `cli` and `doctor` then import `certpaths`. `certpaths` already owns the `ORCA_HOME`-honoring `Dir()`. Territory: this is a shared infra concern; `lead-developer` adjudicates. | 0.78 |
|
||||
| **D-040** | Delete `doctor.NetworkStub` and `doctor.DBStub` (no backward-compat shims). They are internal, referenced only by `internal/cli/doctor.go` which is updated in the same phase. Keeping dead stub code violates `no-redundant-implementations`. | 0.95 |
|
||||
| **D-041** | No new go.mod dependencies for v0.3. `iter` (P01) and mTLS health probe (P02) use stdlib + existing internal packages only. The 4 existing direct deps (cobra, hcl, modernc/sqlite, uuid) are unchanged. | 0.97 |
|
||||
| **D-042** | Phase ordering: P01 (iter.Seq) and P02 (doctor) are **independent** — no file is modified by both (P01 touches cli/job.go, cli/node.go, store repos; P02 touches doctor.go, cli/doctor.go, store/migrate.go, certpaths). They can be developed in either order or in parallel. Recommend P01 first only because it's the lower-risk change. | 0.85 |
|
||||
|
||||
---
|
||||
|
||||
## Summary of assumptions logged
|
||||
|
||||
All assumptions below are logged as decisions with confidence scores; none are
|
||||
flagged for human validation (full autonomy). Low-confidence (<0.80) items that
|
||||
warrant normal decision-flow attention:
|
||||
|
||||
- **D-030** (0.72): `--watch --json` emits one JSON object per changed element
|
||||
per tick (vs. one array per tick). REQ-030 wording is ambiguous; this
|
||||
interpretation matches "streaming one-line JSON per event" literally.
|
||||
- **D-037** (0.80): peer `ServerName` = node `Name` (SAN convention).
|
||||
- **D-039** (0.78): `dbPath` relocation to `certpaths` — territory overlap.
|
||||
|
||||
These three are escalated through the normal decision flow (DecisionEngine) per
|
||||
the researcher protocol, NOT flagged for human validation.
|
||||
@@ -1,161 +0,0 @@
|
||||
# Research: Orca v0.5 — Distribution
|
||||
|
||||
Research findings for the v0.5 Distribution milestone (install, namespace,
|
||||
docker, public releases). Conducted during P0 RESEARCH under full autonomy.
|
||||
|
||||
## R-001: Gitea Container Registry
|
||||
|
||||
**Source**: https://docs.gitea.com/usage/packages/container (Gitea 1.27.1 docs)
|
||||
|
||||
**Findings**:
|
||||
- Gitea ships a built-in OCI-compliant container registry.
|
||||
- Image naming convention: `{registry}/{owner}/{image}:{tag}`.
|
||||
For orca: `git.cloudinit.dev/coreci/orca:{tag}`.
|
||||
- Auth: `docker login git.cloudinit.dev` with username + personal access
|
||||
token (or password if no 2FA). The `GITEA_TOKEN` env var already used
|
||||
for release publishing works as the password.
|
||||
- Push: `docker push git.cloudinit.dev/coreci/orca:v0.4.4`.
|
||||
- Pull: anonymous pull works **if the repo is public** (REQ-045 flips
|
||||
this). For private repos, pull requires auth.
|
||||
- Tags are case-insensitive — use lowercase image names.
|
||||
- The registry supports multi-arch manifests via `docker buildx`.
|
||||
|
||||
**Implication for P03**: `scripts/release.sh` must add a `docker build`
|
||||
+ `docker login` + `docker push` step. The `.coreci.yml` release
|
||||
pipeline needs a `container-publish` step. Credential is `GITEA_TOKEN`
|
||||
(reused from the existing release flow — no new secret needed).
|
||||
|
||||
## R-002: `tea repos edit` — Repo Visibility
|
||||
|
||||
**Source**: `tea repos edit --help` (tea 0.14.1 installed locally)
|
||||
|
||||
**Findings**:
|
||||
- Command: `tea repos edit --private false --repo coreci/orca`
|
||||
- The `--private` flag accepts `true`/`false` (string, not bool).
|
||||
- Default login `bot` (cloudinit-bot) is already configured and is the
|
||||
default login. No extra auth needed.
|
||||
- The change is immediate and reversible (re-run with `--private true`).
|
||||
|
||||
**Implication for P0 ship**: Run this as an operational step during the
|
||||
P0 ship. Verify with unauth `curl` against the releases API afterward.
|
||||
|
||||
## R-003: Gitea Releases API — Asset Download URLs
|
||||
|
||||
**Source**: `/api/v1/repos/coreci/orca/releases/latest` (authed probe)
|
||||
|
||||
**Findings**:
|
||||
- Auth header format: `Authorization: token <GITEA_TOKEN>` (NOT basic
|
||||
auth — basic auth returns "invalid username, password or token").
|
||||
- Latest release endpoint: `GET /api/v1/repos/coreci/orca/releases/latest`
|
||||
→ JSON with `tag_name`, `name`, `body`, `assets[]`.
|
||||
- Each asset has `browser_download_url` — the direct download URL.
|
||||
- **Public access**: once the repo is public (R-002), the releases API
|
||||
and asset downloads work **without authentication**. This is what
|
||||
`install.sh` relies on (REQ-043).
|
||||
- Asset naming convention from existing releases:
|
||||
`orca-{version}-linux-amd64.tar.gz` (per `scripts/release.sh`).
|
||||
|
||||
**Implication for P02 install.sh**:
|
||||
1. Query `GET /api/v1/repos/coreci/orca/releases/latest` (unauth, post-R-002).
|
||||
2. Parse `tag_name` for the version.
|
||||
3. Find the asset with `name` matching `orca-{tag}-linux-{arch}.tar.gz`.
|
||||
4. Download `browser_download_url` with `curl -fsSL`.
|
||||
5. Extract and install.
|
||||
|
||||
## R-004: ORCA_HOME Propagation Points (Codebase Audit)
|
||||
|
||||
**Source**: `grep` for `UserHomeDir|os.Getenv("ORCA|\.orca` across `*.go`
|
||||
|
||||
**Findings** — exactly 3 production code sites determine the namespace
|
||||
root today:
|
||||
|
||||
| File | Current behavior | Needs change? |
|
||||
|------|-----------------|----------------|
|
||||
| `internal/certpaths/certpaths.go:21-26` | `Dir()` honors `ORCA_HOME` → `~/.orca` | **No** — this is the single source of truth. Already correct. |
|
||||
| `internal/store/store.go:13-19` | `Open("")` hardcodes `~/.orca/orca.db` (ignores `ORCA_HOME`) | **Yes** — route through `certpaths.DBPath()` instead. |
|
||||
| `internal/cli/init.go:16-22` | Hardcodes `~/.orca` via `os.UserHomeDir()` | **Yes** — route through `certpaths.Dir()`. |
|
||||
|
||||
All other call sites (`node.go:openDB`, `daemon.go`, `job.go`, `doctor.go`,
|
||||
`cert.go`) already go through `certpaths.DBPath()` or `certpaths.Dir()`
|
||||
indirectly. **No other files need changes for REQ-041.**
|
||||
|
||||
**For REQ-042 (`--system`)**: Add a `--system` persistent flag on
|
||||
`rootCmd`. When set, `rootCmd.PersistentPreRunE` sets
|
||||
`os.Setenv("ORCA_HOME", "/root/.orca")` before any subcommand runs.
|
||||
This is the minimal-touch approach — all downstream code already
|
||||
honors `ORCA_HOME`. The flag is a CLI convenience that maps to the
|
||||
env var, not a parallel mechanism.
|
||||
|
||||
**Backward compatibility**: empty `ORCA_HOME` + no `--system` →
|
||||
`~/.orca` (unchanged). Existing tests that `t.Setenv("ORCA_HOME", ...)`
|
||||
continue to work.
|
||||
|
||||
## R-005: Distroless Base Image for CGO-free Go Binaries
|
||||
|
||||
**Source**: Go module audit — `modernc.org/sqlite` (pure Go, CGO-free),
|
||||
`go.mod` has no CGO dependencies.
|
||||
|
||||
**Findings**:
|
||||
- `gcr.io/distroless/static-debian12` is the correct base for static
|
||||
Go binaries with no CGO and no libc dependency. ~2MB image.
|
||||
- orca uses `modernc.org/sqlite` (pure Go) — no CGO, no libc. ✓
|
||||
- Multi-stage Dockerfile:
|
||||
- Stage 1 (`golang:1.25`): build with `-trimpath -ldflags` (same as
|
||||
Makefile), output `bin/orca`.
|
||||
- Stage 2 (`gcr.io/distroless/static-debian12`): `COPY bin/orca /orca`,
|
||||
`ENTRYPOINT ["/orca"]`.
|
||||
- `CGO_ENABLED=0` must be set in the build stage to guarantee a static
|
||||
binary (Go defaults to CGO_ENABLED=1 on platforms with a C compiler).
|
||||
- The image runs as `nonroot` user by default in distroless — but orca
|
||||
writes to `~/.orca` (or `/root/.orca` for `--system`). For the
|
||||
container image, default `ORCA_HOME=/var/lib/orca` and document
|
||||
volume mount at that path.
|
||||
|
||||
**Implication for P03**: Dockerfile is ~15 lines. The `.coreci.yml`
|
||||
release pipeline adds a `docker build --build-arg VERSION=$VERSION -t
|
||||
git.cloudinit.dev/coreci/orca:$VERSION .` step + login + push.
|
||||
|
||||
## R-006: install.sh Conventions (curl|sh pattern)
|
||||
|
||||
**Source**: Common patterns from deno, rustup, homebrew installers.
|
||||
|
||||
**Findings**:
|
||||
- 1-liner: `curl -fsSL <url> | bash` (or `| bash -s -- --system`).
|
||||
- The script must be downloadable from a stable URL. orca's script
|
||||
lives at `scripts/install.sh` in the repo, accessible via
|
||||
`https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh`
|
||||
(once repo is public per R-002).
|
||||
- Args passed via `bash -s -- --system --version v0.4.4`.
|
||||
- In-place update: detect existing binary at install path, read its
|
||||
version via `orca version --json` (parse `version` field), print
|
||||
"updated from X to Y", overwrite binary. **Never** touch the
|
||||
namespace dir (`~/.orca` or `/root/.orca`) — that's user state.
|
||||
- User-level default: `~/.local/bin/orca` (XDG-ish, on PATH on most
|
||||
modern distros). System-level: `/usr/local/bin/orca` (requires root).
|
||||
|
||||
**Implication for P02**: install.sh is ~80-100 lines of bash. Idempotent.
|
||||
Tested via a `scripts/install_test.sh` that mocks the download and
|
||||
verifies path selection + update-in-place.
|
||||
|
||||
## Pitfalls (P-001..P-003)
|
||||
|
||||
- **P-001**: `docker` may not be available in the CoreCI release
|
||||
pipeline container. The `.coreci.yml` release step uses
|
||||
`image: golang:1.25` which does NOT include docker. **Mitigation**:
|
||||
the release pipeline must use a `docker:dind` sidecar or a step image
|
||||
that has the docker CLI. Alternatively, `scripts/release.sh` handles
|
||||
docker publish only when run locally or in a CI step that has docker.
|
||||
The `.coreci.yml` container step must use an image with docker CLI
|
||||
(e.g., `catthehacker/docker:docker-latest` or a custom image).
|
||||
|
||||
- **P-002**: Making the repo public exposes git history including the
|
||||
pre-existing `.env` SHA-1 leak (commit `00127ce` documented the
|
||||
rotate-forward decision; `.gitleaks-baseline.json` suppresses it for
|
||||
scanning). The leak is a **non-secret** (the token was rotated). This
|
||||
is an accepted risk per the existing decision — no new action needed,
|
||||
but document it in the P0 ship commit.
|
||||
|
||||
- **P-003**: `CGO_ENABLED=0` must be explicit in the Dockerfile build
|
||||
stage. Without it, `go build` in `golang:1.25` may produce a
|
||||
dynamically-linked binary that won't run in distroless. Verified:
|
||||
orca has no CGO deps, but `CGO_ENABLED=0` is belt-and-suspenders.
|
||||
@@ -1,250 +0,0 @@
|
||||
# Research: Orca v0.6 — Node Bootstrap & Proxmox
|
||||
|
||||
Findings grounded in codebase analysis (8 key files read) + verified
|
||||
against `golang.org/x/crypto` v0.54.0 (probe built clean), Proxmox VE
|
||||
9.2.3 admin guide (§14.7-14.8 pveum + privileges), sudoers(5) man
|
||||
page (NOEXEC/NOPASSWD), and freedesktop.org os-release spec.
|
||||
|
||||
## A. SSH library — `golang.org/x/crypto/ssh`
|
||||
|
||||
### A.1 go.mod addition
|
||||
|
||||
```
|
||||
require golang.org/x/crypto v0.54.0
|
||||
```
|
||||
|
||||
Latest available, compatible with go 1.25. Transitive deps (verified
|
||||
by probe build):
|
||||
- `golang.org/x/crypto v0.54.0` (direct)
|
||||
- `golang.org/x/sys v0.47.0` (indirect — bumps from v0.42.0)
|
||||
- `golang.org/x/term v0.45.0` (indirect — pulled by ssh for PTY)
|
||||
|
||||
**3 module entries, 0 new heavy deps.** Matches D-030 minimal-deps
|
||||
rationale. `go.sum` gains ~6 lines.
|
||||
|
||||
### A.2 Minimal API surface
|
||||
|
||||
```go
|
||||
import (
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
"net"
|
||||
"time"
|
||||
"golang.org/x/crypto/ssh"
|
||||
"golang.org/x/crypto/ssh/knownhosts"
|
||||
)
|
||||
```
|
||||
|
||||
Key functions:
|
||||
- `ssh.Dial(network, addr, config) (*ssh.Client, error)` — high-level dialer
|
||||
- `(*ssh.Client).NewSession() (*ssh.Session, error)`
|
||||
- `(*ssh.Session).CombinedOutput(cmd) ([]byte, error)` — run + capture
|
||||
- `ssh.ClientConfig{User, Auth, HostKeyCallback, Timeout}`
|
||||
- `ssh.Password(secret) ssh.AuthMethod` — password auth
|
||||
- `ssh.PublicKeys(signer) ssh.AuthMethod` — pubkey auth
|
||||
- `ssh.ParsePrivateKey(pem) (ssh.Signer, error)` — parse PKCS8 PEM (works with orca's existing key format)
|
||||
- `ssh.NewPublicKey(pub) (ssh.PublicKey, error)` + `ssh.MarshalAuthorizedKey(pub) []byte` — authorized_keys line
|
||||
- `ssh.FixedHostKey(key) ssh.HostKeyCallback` — strict pin (subsequent connects)
|
||||
- `knownhosts.New(path) (ssh.HostKeyCallback, error)` — TOFU via known_hosts file (cleaner than custom callback; avoids deprecated `InsecureIgnoreHostKey`)
|
||||
|
||||
### A.3 Ed25519 keygen (D-037)
|
||||
|
||||
Verified end-to-end: `ed25519.GenerateKey(rand.Reader)` →
|
||||
`x509.MarshalPKCS8PrivateKey(priv)` → PEM encode → `ssh.ParsePrivateKey`
|
||||
round-trips cleanly. `ssh.MarshalAuthorizedKey` produces valid
|
||||
`ssh-ed25519 AAAA...` line. **PKCS8 PEM (orca's existing format)
|
||||
parses with `ssh.ParsePrivateKey` — no OpenSSH-format marshaller
|
||||
needed.** Reuse `security.WriteKey`/`writeAtomic` for persistence.
|
||||
|
||||
### A.4 File upload — `cat > file` via session, NOT SFTP
|
||||
|
||||
SFTP lives in separate module `github.com/pkg/sftp` — would add a 4th
|
||||
direct dep beyond D-030. The only files orca uploads are:
|
||||
- `~orca/.ssh/authorized_keys` (1-line append)
|
||||
- `/etc/sudoers.d/orca` (few lines)
|
||||
|
||||
Both are text. Use `session.CombinedOutput` with heredoc / `tee -a`.
|
||||
Keeps everything within `x/crypto/ssh`.
|
||||
|
||||
### A.5 TOFU host-key handling (D-035)
|
||||
|
||||
Use `golang.org/x/crypto/ssh/knownhosts.New(path)` as the
|
||||
`HostKeyCallback`. On first connect, the callback writes the host key
|
||||
to `~/.orca/known_hosts` (OpenSSH format). On subsequent connects, it
|
||||
verifies and returns an error on mismatch. **Avoids
|
||||
`ssh.InsecureIgnoreHostKey` deprecation** — `knownhosts.New` handles
|
||||
both capture and verify in one callback. On host-key change
|
||||
(reinstall), fail closed with a clear error; operator runs
|
||||
`orca node key-reset <node>` (future) or manually edits `known_hosts`.
|
||||
|
||||
## B. `/etc/os-release` parsing (D-032)
|
||||
|
||||
### B.1 Confirmed `ID=` values
|
||||
|
||||
| Distro | `ID=` | `ID_LIKE=` | Verified |
|
||||
|--------|-------|-----------|----------|
|
||||
| Ubuntu | `ubuntu` | `debian` | ✅ (this host: Ubuntu 24.04) |
|
||||
| Debian | `debian` | — | ✅ (freedesktop spec) |
|
||||
| Alpine | `alpine` | — | ✅ (Alpine policy) |
|
||||
| Proxmox VE | `pve` | `debian` | ✅ (PVE ships own os-release) |
|
||||
|
||||
`VARIANT_ID` absent on all four target distros — not worth capturing
|
||||
for v0.6.
|
||||
|
||||
### B.2 Parsing approach
|
||||
|
||||
No Go stdlib helper. Trivial: `bufio.Scanner` +
|
||||
`strings.SplitN(line, "=", 2)` + strip surrounding quotes. ~15 lines.
|
||||
Returns `map[string]string`; read `ID` field. Fallback `"linux"` if
|
||||
file missing or `ID` absent (D-032). Read `/etc/os-release` first;
|
||||
fall back to `/usr/lib/os-release` for minimal containers. Unknown `ID`
|
||||
values stored verbatim (not masked) — `doctor os` can warn.
|
||||
|
||||
## C. Proxmox VE role & user management
|
||||
|
||||
### C.1 Realm: `orca@pam` (NOT `orca@pve`)
|
||||
|
||||
Confirmed by both researchers + PVE User Management docs: since
|
||||
`orca node join` SSHes in and creates a Linux system user via
|
||||
`useradd`, the PVE user must be `orca@pam` (PAM realm maps to host
|
||||
system users). `orca@pve` would require a separate PVE-internal
|
||||
password and interactive `-password` prompt over non-PTY SSH (hangs).
|
||||
`@pam` sidesteps both issues. **D-033 refined: `orca@pam`.**
|
||||
|
||||
### C.2 OrcaOperator PVE role — privilege set
|
||||
|
||||
Per D-033 (operator-confirmed): `VM.Audit`, `Datastore.AllocateSpace`,
|
||||
`SDN.Use`. This is a **minimal API-level role** — the actual management
|
||||
capability comes from the sudoers allowlist (sudo runs as root, bypassing
|
||||
PVE RBAC). The PVE role governs non-sudo API access (future REST client).
|
||||
|
||||
**Refinement from research**: `VM.Audit` covers containers (CTs) as well
|
||||
as VMs (both live under `/vms/{vmid}` path; no separate `CT.*` family).
|
||||
PVE 8→9: privilege set valid on both (no breaking changes to pveum or
|
||||
the core privilege names).
|
||||
|
||||
Researcher 2 proposed an expanded 21-privilege set for fuller API-level
|
||||
management. **Decision: keep D-033's 3-priv minimal set for v0.6** — the
|
||||
operator explicitly confirmed it, and the sudoers allowlist is the
|
||||
primary management path. The expanded set is noted as a v0.7+
|
||||
enhancement option if orca adds a direct PVE REST client.
|
||||
|
||||
### C.3 pveum command sequence (idempotent)
|
||||
|
||||
```bash
|
||||
# 1. Role — probe-then-add (pveum role add fails if exists)
|
||||
pveum role list | grep -q '^OrcaOperator' || \
|
||||
pveum role add OrcaOperator --privs "VM.Audit Datastore.AllocateSpace SDN.Use"
|
||||
|
||||
# 2. User — probe-then-add (maps to existing Linux system user)
|
||||
pveum user list | grep -q 'orca@pam' || \
|
||||
pveum user add orca@pam -comment "Orca automation user"
|
||||
|
||||
# 3. ACL — modify is idempotent (creates or updates)
|
||||
pveum acl modify / -user orca@pam -role OrcaOperator
|
||||
```
|
||||
|
||||
Flag syntax: both `-privs` and `--privs` work (Perl Getopt::Long). Use
|
||||
`--privs` (canonical). Privs are **space-separated** inside quotes
|
||||
(NOT comma-separated).
|
||||
|
||||
### C.4 sudoers file `/etc/sudoers.d/orca` (D-033 refined)
|
||||
|
||||
**Research refinement**: exclude `pvesh` from sudoers — `pvesh` can
|
||||
reach the `/nodes/{node}/execute` API endpoint which spawns shell
|
||||
commands server-side, bypassing sudo's `NOEXEC` tag. Keep `pct`/`qm`
|
||||
with `NOEXEC`; `apt-get`/`dpkg` without `NOEXEC` (they need to spawn
|
||||
child processes for maintainer scripts).
|
||||
|
||||
```
|
||||
# /etc/sudoers.d/orca — mode 0440, owner root:root
|
||||
# Orca automation: VM/CT management + package management, no shell escape
|
||||
orca ALL=(root) NOPASSWD: NOEXEC: /usr/bin/pct, /usr/bin/qm
|
||||
orca ALL=(root) NOPASSWD: /usr/bin/apt-get, /usr/bin/dpkg
|
||||
```
|
||||
|
||||
`NOEXEC` works via Linux seccomp (sudoers man page). `pct`/`qm` are
|
||||
Perl scripts run via dynamically-linked `/usr/bin/perl` → NOEXEC
|
||||
effective. `apt-get`/`dpkg` need exec for postinst scripts → no
|
||||
NOEXEC. File mode **0440** or sudo refuses to load. Validate with
|
||||
`visudo -cf /etc/sudoers.d/orca` after writing; abort bootstrap on
|
||||
validation failure.
|
||||
|
||||
**Resolve binary paths at runtime** via `command -v pct` etc. before
|
||||
writing the sudoers file (cheap insurance against non-standard installs).
|
||||
|
||||
### C.5 PVE 8 vs 9
|
||||
|
||||
No breaking changes to pveum, privilege names, or sudo defaults
|
||||
between 8 and 9. `VM.Monitor` removed in 9.0 (OrcaOperator doesn't
|
||||
use it). Privileged container creation needs `Sys.Modify` in 9.0
|
||||
(OrcaOperator doesn't have it → intended). Both versions: `orca@pam`
|
||||
flow identical. Binary paths identical (`/usr/bin/{pct,qm,pvesh}`).
|
||||
|
||||
## D. Codebase integration points (confirmed by reading files)
|
||||
|
||||
### D.1 Files to modify/create per requirement
|
||||
|
||||
| File | Change | REQ |
|
||||
|------|--------|-----|
|
||||
| `go.mod` / `go.sum` | Add `golang.org/x/crypto v0.54.0`; bump sys, add term | REQ-050 |
|
||||
| `internal/model/node.go` | Add `Kind`, `OS` string fields + `NodeKind` constants | REQ-049 |
|
||||
| `internal/store/migrations/0006_node_kind_os.sql` | **NEW**: `ALTER TABLE nodes ADD COLUMN kind TEXT; ADD COLUMN os TEXT;` (nullable, backward-compatible) | REQ-049 |
|
||||
| `internal/store/node_repo.go` | Extend INSERT/SELECT/scanNode for `kind, os`; add `GetByName`, `UpdateLastSeenAndOS` helpers | REQ-049 |
|
||||
| `internal/cli/init.go` | Full bootstrap: MkdirAll → store.Open (runs migrations) → CAInit → server cert gen (if absent) → detectOS → localhost node upsert | REQ-047,048 |
|
||||
| `internal/cli/node.go` | Add `--type`, `--host`, `--user`, `--password`, `--proxmox-user`, `--proxmox-role` flags; `bootstrapProxmox` branch | REQ-050,051 |
|
||||
| `internal/security/sshkey.go` | **NEW**: `GenerateOrLoadSSHKey(dir)` — Ed25519 keygen, PKCS8 PEM, 0600/0644 modes | REQ-050 |
|
||||
| `internal/proxmox/bootstrap.go` | **NEW package**: `BootstrapProxmox(ctx, opts)` — SSH dial, pubkey deploy, useradd, pveum role/user/acl, sudoers write, visudo validate | REQ-050,051 |
|
||||
| `internal/doctor/doctor.go` | Add `OS()` and `Proxmox()` checks; extend `All()` | REQ-052 |
|
||||
| `internal/cli/doctor.go` | Add `doctor os` + `doctor proxmox` subcommands | REQ-052 |
|
||||
| `internal/certpaths/certpaths.go` | Add `SSHKeyPath`, `SSHPubPath`, `KnownHostsPath` | REQ-050 |
|
||||
|
||||
### D.2 Reuse opportunities (confirmed)
|
||||
|
||||
- `security.CAInit` (ca.go:63) — **already idempotent** (fast-path loads existing). `orca init` calls it directly.
|
||||
- `security.GenerateCSR` (csr.go) — signature fits: `GenerateCSR("localhost", []string{"localhost","127.0.0.1"})`.
|
||||
- `security.WriteCert`/`WriteKey` (ca.go:292) — enforce 0644/0600 via `writeAtomic`; reuse for SSH key.
|
||||
- `store.Open` (migrate.go) — runs migrations on open; calling it in `orca init` auto-applies 0006.
|
||||
- Migration runner — FS-embedded, sorts lexicographically, idempotent per-file. Adding `0006_*.sql` is the entire change.
|
||||
- `doctor.Network()` (doctor.go:222) — exact pattern to clone for `doctor.Proxmox()` (list nodes, filter by kind, 3s timeout per peer, PASS/WARN/FAIL).
|
||||
|
||||
### D.3 No changes needed
|
||||
|
||||
- `internal/security/ca.go`, `csr.go` — idempotent already, signatures fit.
|
||||
- `internal/store/migrate.go` — runner is generic.
|
||||
- `internal/transport/*` — mTLS transport not involved in SSH bootstrap.
|
||||
- `internal/engine/*` — NodeRegistry.Join works; new fields are metadata.
|
||||
|
||||
## E. Pitfalls & gotchas
|
||||
|
||||
1. **`pveum` flag is `--privs` (space-separated)**, not `--privs "a,b,c"`. Confirmed by both researchers + official docs.
|
||||
2. **`orca@pam` not `orca@pve`** — PVE-internal realm requires interactive password prompt over non-PTY SSH (hangs). PAM realm maps to the Linux system user orca creates.
|
||||
3. **Exclude `pvesh` from sudoers** — `pvesh` can trigger API `execute` endpoint spawning shell commands server-side, bypassing `NOEXEC`. Use PVE API via OrcaOperator role for API access instead.
|
||||
4. **`NOEXEC` only on dynamically-linked binaries** — `pct`/`qm` are Perl scripts via dynamically-linked `/usr/bin/perl` → effective. `apt-get`/`dpkg` need exec → no NOEXEC.
|
||||
5. **sudoers file mode 0440** — or sudo silently refuses to load it. `chmod 0440` + `visudo -cf` validate after write.
|
||||
6. **Migration 0006 NULL handling** — `scanNode` must use `sql.NullString` for `kind`/`os` and map NULL → `""` (Go struct fields are `string`, not `*string`).
|
||||
7. **localhost node idempotency** — `NodeRepo.Insert` fails on UNIQUE constraint if `orca init` re-runs. Need `GetByName("localhost")` check first; if found, `UpdateLastSeenAndOS` instead of `Insert`. Don't change `id` or `joined_at` (D-036).
|
||||
8. **`orca init` must not regenerate server cert** (D-036) — check `certpaths.ServerCertPath()` existence before `GenerateCSR`. `CAInit` has a fast-path; server cert gen needs an explicit existence check.
|
||||
9. **Password handling (D-031)** — `--password` flag visible in `ps`/`/proc` briefly. Prefer `$ORCA_PROXMOX_PASSWORD` env var. Never log the password (slog redaction). Zero the byte slice after use.
|
||||
10. **`knownhosts.New` for TOFU** — avoids deprecated `ssh.InsecureIgnoreHostKey`. Handles both capture and verify in one callback.
|
||||
11. **PKCS8 PEM parses with `ssh.ParsePrivateKey`** — no need for OpenSSH-format marshaller. Consistent with `ca.key`/`server.key` format.
|
||||
12. **`/etc/os-release` is a symlink** on most distros → `os.ReadFile` follows it. Fall back to `/usr/lib/os-release` for minimal containers.
|
||||
|
||||
## F. Persona recommendations (v0.6 roster)
|
||||
|
||||
| Persona | Active | Reason |
|
||||
|---------|--------|--------|
|
||||
| `lead-developer` | ✅ | Coordination across P01/P02/P03; SSH/bootstrap touches security + cli + store + doctor |
|
||||
| `backend-engineer` | ✅ | Owns `internal/cli/init.go` full-bootstrap orchestration + `internal/proxmox/bootstrap.go` SSH logic |
|
||||
| `cli-engineer` | ✅ | Owns `--type`/`--host`/`--password` flag wiring, `doctor os`/`doctor proxmox` subcommands, init output UX |
|
||||
| `data-engineer` | ✅ **REACTIVATE** | Owns migration 0006 + `NodeRepo` schema extension (kind/os columns, new helpers) |
|
||||
| `security-engineer` | ✅ **REACTIVATE** | Owns `internal/security/sshkey.go`, TOFU host-key, sudoers design, password redaction, audit logging |
|
||||
| `devops-engineer` | ❌ **DEACTIVATE** | No install.sh/Dockerfile/.coreci.yml surface in v0.6 |
|
||||
| `network-engineer` | ❌ | No transport/mTLS surface (SSH is point-to-point bootstrap, not mesh) |
|
||||
| `frontend-engineer` | ❌ | No web UI |
|
||||
|
||||
**Territory overlaps to adjudicate (lead-developer)**:
|
||||
- `internal/proxmox/bootstrap.go` (security-engineer SSH/sudoers logic) vs `internal/cli/node.go` (cli-engineer flag wiring) — boundary: security package exposes `BootstrapProxmox(ctx, opts) error`, CLI just calls it.
|
||||
- `internal/doctor/doctor.go` `Proxmox()` reuses SSH client from `internal/proxmox` (security) but check scaffolding clones `doctor.Network()` pattern (backend adjudicates since network-engineer deactivated).
|
||||
@@ -1,161 +0,0 @@
|
||||
# Research: Orca v0.7 — Hardening & Completion
|
||||
|
||||
## 1. Codebase audit findings (RESEARCH stage)
|
||||
|
||||
A full codebase audit surfaced the gaps that define the v0.7 scope.
|
||||
Each finding is grounded in a specific file/coverage measurement.
|
||||
|
||||
### 1.1 `orca cert` command tree is unreachable (critical)
|
||||
|
||||
- `internal/cli/cert.go:44` exports `NewCommand(log *slog.Logger)
|
||||
*cobra.Command` which builds the full `cert ca-init | gen | show |
|
||||
renew | fingerprint` tree (5 subcommands, all implemented, all
|
||||
spec-compliant per REQ-033/035/036).
|
||||
- **No file in the repo calls `NewCommand` or registers it on
|
||||
`rootCmd`.** `grep -rn "rootCmd.AddCommand" internal/cli/` lists
|
||||
daemon, init, audit, version, job, node, doctor, status — `cert` is
|
||||
absent. `./bin/orca cert` returns `error: unknown command "cert"`.
|
||||
- The function is named `NewCommand` (not `newCertCmd`), so it is not
|
||||
picked up by any init-based registration convention.
|
||||
- **Impact**: every cert operation the spec promises (REQ-023, REQ-025,
|
||||
REQ-033, REQ-035, REQ-036) is unreachable from the CLI. Operators
|
||||
cannot bootstrap a CA, issue a server cert, or rotate one without
|
||||
hand-crafting calls into the `security` package. This is the single
|
||||
highest-impact bug in the v0.1–v0.6 line.
|
||||
- **Fix**: one-line `rootCmd.AddCommand(NewCommand(log))` in
|
||||
`internal/cli/cert.go` (or a new `init()`), plus a regression test
|
||||
that asserts `rootCmd.Commands()` contains a child whose `Use ==
|
||||
"cert"`.
|
||||
|
||||
### 1.2 `internal/store/cert_repo.go` has no test file
|
||||
|
||||
- `internal/store/cert_repo.go` exists (the `certs` table from
|
||||
migration 0004) but `internal/store/cert_repo_test.go` does not.
|
||||
- Every other repo in `internal/store/` has a `_test.go`:
|
||||
`node_repo_test.go`, `job_task_repo_test.go`, `capacity_repo_test.go`,
|
||||
`audit_repo_test.go`, `migrate_test.go`.
|
||||
- **Fix**: add `cert_repo_test.go` covering Insert/Get/List/rotation
|
||||
history (N=3 per REQ-025) + serial_hex uniqueness.
|
||||
|
||||
### 1.3 Low test coverage in core packages
|
||||
|
||||
| Package | Coverage | Missing tests for |
|
||||
|---------|----------|-------------------|
|
||||
| `internal/engine` | 8.3% | `executor.go`, `dispatcher.go`, `peer.go` (only `scheduler_test.go` exists) |
|
||||
| `internal/transport` | 26.3% | `mtls.go`, `dispatch.go`, `handshake_log.go` (only `idempotency_test.go` exists) |
|
||||
| `internal/proxmox` | 5.1% | `bootstrap.go` SSH path (only `bootstrap_test.go` exists, exercises the no-op dry-run) |
|
||||
| `internal/audit` | no test files | `audit.go` (Emit, EmitWithErr, LogHandshake*) |
|
||||
|
||||
- Target per D-042: 50% floor per package, 70% for new code in P02/P04.
|
||||
- Strategy: table-driven tests + `httptest.NewTLSServer` for transport;
|
||||
interface-based mocks for the SSH dialer (already an interface in
|
||||
`proxmox/bootstrap.go:211` `defaultSSHDialer` with `DialContext`).
|
||||
|
||||
### 1.4 No HCL config file parser
|
||||
|
||||
- D-009 specified `~/.orca/config.hcl` and `/etc/orca/orca.hcl` as
|
||||
config locations. `find . -name "*.hcl"` returns only testdata
|
||||
(`testdata/hello.hcl`, `testdata/fail.hcl`) used by jobspec tests.
|
||||
- The CLI relies entirely on flags + env vars (`ORCA_HOME`,
|
||||
`ORCA_DB`, `ORCA_PROXMOX_PASSWORD`). There is no `internal/config`
|
||||
package.
|
||||
- `internal/jobspec/spec.go:40` already uses
|
||||
`hclsimple.Decode(filename, data, nil, &spec)` — the exact same
|
||||
pattern works for a `Config` struct. No new dep required (hashicorp/hcl/v2
|
||||
is already a direct dep).
|
||||
- **Fix**: new `internal/config` package with a `Config` struct (HCL
|
||||
tags: `db_path`, `listen_addr`, `ca_path`, `server_cert_path`,
|
||||
`server_key_path`, `node_capacity`), a `Load(paths ...string)`
|
||||
function, and a `--config` flag on the root command. Precedence per
|
||||
D-039: flag > env > file > default.
|
||||
|
||||
### 1.5 pprof endpoint (I-308, deferred since v0.2)
|
||||
|
||||
- I-308 was deferred in v0.2 IDEATE ("keep v0.2 lean") and never
|
||||
revisited. The daemon (`internal/daemon/server.go`) has no pprof
|
||||
surface today.
|
||||
- `net/http/pprof` is stdlib — zero new deps. Mount on a separate
|
||||
`*http.ServeMux` so it never touches the mTLS daemon listener.
|
||||
- **Fix**: `--pprof <addr>` flag on `orca daemon` (default disabled).
|
||||
If set, start a second `http.Server` on `<addr>` with
|
||||
`pprof.Index`/`pprof.Cmdline`/etc. registered. Log a WARN that the
|
||||
endpoint is unauthenticated + operator-only.
|
||||
|
||||
## 2. Prior art & patterns
|
||||
|
||||
### 2.1 HCL config in HashiCorp tools
|
||||
|
||||
Nomad, Consul, and Terraform all use HCL for config with the same
|
||||
`hclsimple.Decode` + struct-tag pattern. The precedence model (flag >
|
||||
env > file > default) is the de-facto standard; Viper implements it but
|
||||
adds a large dep. Orca's `internal/config` will implement the 4-layer
|
||||
merge by hand (~80 LOC) to stay minimal-deps.
|
||||
|
||||
### 2.2 pprof in Go daemons
|
||||
|
||||
Standard pattern: `import _ "net/http/pprof"` registers handlers on
|
||||
`http.DefaultServeMux`. Best practice for production daemons is a
|
||||
**separate listener** (not DefaultServeMux) so pprof is never exposed
|
||||
on the public port. Orca will use a dedicated `*http.ServeMux` +
|
||||
`http.Server` on the `--pprof` addr, default disabled.
|
||||
|
||||
### 2.3 Test coverage for concurrent Go
|
||||
|
||||
`internal/engine` (executor, dispatcher) and `internal/transport`
|
||||
(mtls, dispatch) are concurrent. Coverage strategy:
|
||||
- `httptest.NewTLSServer` for transport — exercise real TLS handshakes
|
||||
against an in-process server.
|
||||
- Interface-based mocks for the SSH dialer (proxmox) and the peer
|
||||
client (transport) — both already have interface seams.
|
||||
- `sync.WaitGroup` + channel assertions for executor/dispatcher
|
||||
lifecycle.
|
||||
- `-race` is already on in CI (REQ-031) — new tests inherit it.
|
||||
|
||||
## 3. v0.7 Architectural Decisions (AD-022..AD-026)
|
||||
|
||||
| ID | Decision | Rationale |
|
||||
|----|----------|-----------|
|
||||
| AD-022 | `orca cert` registered via `init()` in `cert.go` calling `rootCmd.AddCommand(NewCommand(slog.Default()))` | Keeps registration co-located with the command definition; matches the pattern in `daemon.go`/`audit.go` where each command file self-registers. Avoids a central registration function that would drift. |
|
||||
| AD-023 | `internal/config` package: `Config` struct + `Load(paths ...string) (*Config, error)`; no global singleton | Config is passed explicitly to `daemon.NewServer`, `cli` commands, etc. No package-level state — testable, no init-order surprises. |
|
||||
| AD-024 | pprof on a separate `*http.Server` + `*http.ServeMux`, default disabled | Never co-mingles with the mTLS daemon listener. Operator opts in via `--pprof :6060`. Matches Go daemon best practice. |
|
||||
| AD-025 | Coverage floor measured per-package via `go test -cover ./<pkg>` | No aggregate threshold (aggregates hide low-coverage packages). CI gate added in P03: `go test -cover ./internal/engine ./internal/transport ./internal/proxmox ./internal/audit` and assert each ≥ 50%. |
|
||||
| AD-026 | No new direct dependencies in v0.7 | `net/http/pprof` (stdlib), `hashicorp/hcl/v2` (already direct). v0.7 preserves the minimal-deps ethos. |
|
||||
|
||||
## 4. PERSONAS assessment
|
||||
|
||||
v0.7 is an NFR milestone touching CLI, config, tests, and daemon. The
|
||||
default 3-persona roster (lead-developer, backend-engineer,
|
||||
data-engineer) is sufficient:
|
||||
|
||||
- **lead-developer**: owns P01 (cert registration) + P04 (pprof) — CLI/
|
||||
daemon territory.
|
||||
- **backend-engineer**: owns P02 (config package) — internal/config +
|
||||
CLI integration.
|
||||
- **data-engineer**: owns P01 cert_repo tests + P03 store coverage —
|
||||
`internal/store` territory.
|
||||
- **lead-developer** also owns P03 engine/transport/proxmox/audit
|
||||
coverage (test-only phase, no schema changes).
|
||||
|
||||
No new personas needed. No phase-specific personas. Territory
|
||||
enforcement stays `warn`. See `.ciagent/PERSONAS.md` (updated).
|
||||
|
||||
## 5. Dependencies
|
||||
|
||||
v0.7 adds **zero** new direct dependencies:
|
||||
- HCL parsing: `hashicorp/hcl/v2` (already direct, used by jobspec).
|
||||
- pprof: `net/http/pprof` (stdlib).
|
||||
- Tests: `net/http/httptest` (stdlib), existing interfaces.
|
||||
|
||||
`go.mod` is unchanged by v0.7.
|
||||
|
||||
## 6. Risks
|
||||
|
||||
- **P01 cert registration** may surface latent bugs in the cert
|
||||
subcommands (they've never been exercised end-to-end). Mitigation:
|
||||
P01 includes a smoke test that runs `cert ca-init` + `cert gen` +
|
||||
`cert show` + `cert fingerprint` against a temp `ORCA_HOME`.
|
||||
- **P02 config precedence** is easy to get wrong (flag/env/file/default
|
||||
merge order). Mitigation: table-driven test covering all 4 layers.
|
||||
- **P03 coverage** on concurrent packages may reveal race conditions
|
||||
(already hidden by the 8.3% coverage). Mitigation: `-race` is on; P03
|
||||
fixes any races it uncovers as part of the same phase.
|
||||
@@ -1,285 +0,0 @@
|
||||
# Research: Orca v0.8 — Coverage & Trust Hardening
|
||||
|
||||
Findings grounded in codebase analysis (44 source/test files read, coverage
|
||||
re-measured for all 9 target packages) + `golang.org/x/crypto` v0.54.0 API
|
||||
verification (`ssh.FingerprintSHA256`, `knownhosts.Line`/`Normalize`/`KeyError`).
|
||||
|
||||
## 1. Coverage analysis (P01 — REQ-057)
|
||||
|
||||
### 1.1 Re-measured coverage (confirmed via `go test ./<pkg>/... -cover`)
|
||||
|
||||
| Package | Coverage | Tier (D-047) | Notes |
|
||||
|---------|----------|--------------|-------|
|
||||
| `internal/engine` | **8.3%** | ≥ 70% floor | Only `scheduler_test.go` (4 tests, 66 LOC); executor/dispatcher/peer/registry/audit untested |
|
||||
| `internal/proxmox` | **5.1%** | ≥ 70% floor | Only `bootstrap_test.go` (4 tests, validation + sudoersContent string asserts); SSH dial path untested |
|
||||
| `internal/cli` | **27.6%** | ≥ 70% floor | 5 test files (root, init, namespace, osdetect, watch); node/job/cert/doctor/audit/cmds untested |
|
||||
| `internal/transport` | **26.3%** | ≥ 70% floor | Only `idempotency_test.go` (7 tests); mtls/dispatch/retry/handshake_log untested |
|
||||
| `internal/store` | **47.2%** | ≥ 70% floor | node_repo + job_task + capacity + audit + migrate tested; **cert_repo has NO test** (REQ-053 leftover — v0.7 P01 was supposed to add it but it's missing) |
|
||||
| `internal/jobspec` | **47.6%** | ≥ 70% floor | Only `spec_test.go` (4 tests); `Validate()`, `ParseFile` (file I/O), edge cases untested |
|
||||
| `internal/audit` | **0%** (no test files) | ≥ 50% toe-hold | `go: no such tool "covdata"` is a known tooling gap, NOT a real number — the package simply has no `_test.go` |
|
||||
| `internal/certpaths` | **0%** (no test files) | ≥ 50% toe-hold | Same `covdata` tooling gap; no `_test.go` exists |
|
||||
| `cmd/orca` | **0%** (no test files) | ≥ 50% toe-hold | Same; `main.go` is 15 LOC of glue (`cli.Execute()` + error print) |
|
||||
|
||||
**Coverage-floor achievability assessment (per package):**
|
||||
|
||||
- **engine → 70% REALISTIC.** The package has clean seams: `LocalExecutor` interface (dispatcher.go:39), `PeerRegistry` is in-memory with `Add`/`Remove`/`All`/`Get` (peer.go), `Executor.Submit/Status` take a `*store.JobRepo`+`*store.TaskRepo` which can be backed by `:memory:`/temp-file sqlite via the existing `openTestDB` helper (node_repo_test.go:12). The `sshDialer` seam pattern (proxmox) has an analogue here: `transport.NewDispatchClient` is called inside `dispatchToPeer` (dispatcher.go:158) — to test dispatch-to-peer without a real mTLS server, either (a) inject a fake `DispatchClient` via a new interface seam, or (b) use `httptest.NewTLSServer` with a self-signed CA. Option (a) is lower-effort and aligns with the `LocalExecutor` pattern. Recommendation: extract a `peerDispatcher` interface (`Submit(ctx, spec, key) (*SubmitResponse, error)`) and inject it, OR test via `LocalSubmit`/`LocalStatus` paths (which only need a stubbed `LocalExecutor`) — the latter covers ~60% of dispatcher.go without a new seam. **Flag: 70% may require a small refactor to inject the dispatch client; 60-65% is achievable without one. Plan should decide whether to add the seam or accept 65%.**
|
||||
- **proxmox → 70% REALISTIC.** The `sshDialer` seam already exists (bootstrap.go:201-213, `sshDialerType` interface + `defaultSSHDialer` struct, overridable package-level var). A fake SSH dialer returning a mock `*ssh.Client` is the path. **However:** `*ssh.Client.NewSession()` + `session.CombinedOutput()` are concrete methods on the real `*ssh.Client` — there's no `sshSession` interface seam. To test `runRemote`/`deployPubKey`/`createLinuxUser`/`createPVERole`/etc. without a real SSH server, EITHER (a) introduce a `sessionRunner` interface seam (small refactor), OR (b) use `httptest.NewTLSServer` is wrong (it's SSH not HTTP) — instead use a real in-process SSH server via `golang.org/x/crypto/ssh` `NewServerConn` (more code but no new dep). **Flag: 70% likely requires either a `sessionRunner` interface refactor OR an in-process SSH server fixture. 50-55% is achievable with just the existing `sshDialer` seam + testing validation paths + `sudoersContent` string asserts (already done). Plan should add the `sessionRunner` seam — it's a 1-interface, ~10-LOC change that unlocks the bulk of the package.**
|
||||
- **cli → 70% AMBITIOUS but realistic.** The package is the largest (17 source files, ~2000 LOC). The existing tests use `rootCmd.SetArgs()` + `rootCmd.Execute()` + `t.TempDir()` + `ORCA_HOME` env (namespace_test.go:46-53 — `TestInitHonorsORCAHOME` is the template). The untested commands are `node join/leave/list`, `job run/list/stop/logs`, `cert *`, `doctor *`, `audit list`, `status`, `version`, `daemon`. Many touch the DB + certpaths + (for `node join --type proxmox`) the SSH dialer. **Strategy:** table-driven `rootCmd.Execute()` against a temp `ORCA_HOME` for each subcommand; mock the proxmox path via the existing `sshDialer` seam; capture stdout via `rootCmd.SetOut(&buf)`. **Flag: 70% across the whole package is a lot of test code; 55-65% is more realistic for one phase. The `daemon` command (background server) is hard to test without a lifecycle harness — recommend excluding it from the 70% target and documenting why.**
|
||||
- **transport → 70% REALISTIC.** `httptest.NewTLSServer` is the standard seam (already used in `internal/daemon/dispatch_test.go:59` and `server_test.go`). The `Dispatcher` interface (dispatch.go:49) is already mockable (`stubDispatcher` in dispatch_test.go:24 is the template). `MTLSClient.Do` wraps `http.Client.Do` — testable via `httptest.NewTLSServer` with a CA + client cert. `retry.go` `Do[T]` is generic + already partly tested via `idempotency_test.go` (TestRetrySucceedsAfterTransient etc.) — extend with backoff-timing asserts. `handshake_log.go` is pure slog calls — trivial to test by capturing into a `slog.Handler`. **No new seams needed; 70% achievable.**
|
||||
- **store → 70% REALISTIC.** The existing `openTestDB` helper (node_repo_test.go:12) + `withFastWatch` (job_task_repo_test.go:36) are reusable. **Critical gap:** `cert_repo.go` has NO test file despite v0.7 P01 REQ-053 claiming it was added — this is a v0.7 leftover bug. Adding `cert_repo_test.go` (Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + N=3 rotation history per REQ-025) alone lifts coverage significantly. Job/Task repo `Watch` is tested; `ListRecent`, error paths, scan-edge cases need coverage. **No new seams; 70% achievable.**
|
||||
- **jobspec → 70% REALISTIC.** `Parse` + `Validate` + `ParseFile` are pure functions over HCL bytes. Add golden-file HCL fixtures (multi-task, env vars, args) + error-path table (missing job, no tasks, missing command, malformed HCL, empty file, nonexistent file for `ParseFile`). `testdata/` dir doesn't exist yet — create it. **No new seams; 70% achievable, likely the easiest of the six.**
|
||||
- **audit → 50% toe-hold REALISTIC.** Package is 125 LOC, 4 exported funcs (`New`, `Emit`, `EmitWithErr`, `LogHandshakeOK`, `LogHandshakeFailed`, `FormatAction`, `Action.String`, `Result.String`). Strategy: construct `Audit` with a real `engine.Audit` backed by `:memory:` sqlite (via `store.NewAuditRepo` + `engine.NewAudit`) + assert rows in `audit_log` table; capture slog output via a test `slog.Handler`. **No new seams; 50% easily achievable, 70% achievable if desired.**
|
||||
- **certpaths → 50% toe-hold TRIVIAL.** Package is 64 LOC, pure path-join functions honoring `ORCA_HOME`/`ORCA_DB` env. Strategy: temp dir + `t.Setenv("ORCA_HOME", dir)` + assert each `*Path()` returns `filepath.Join(dir, <file>)`; test `ORCA_DB` override; test default-to-`~/.orca` fallback. Model the test on `namespace_test.go` (cli). **No new seams; 50%+ trivially achievable.**
|
||||
- **cmd/orca → 50% toe-hold REALISTIC but LOW VALUE.** `main.go` is 15 LOC: `cli.Execute()` + `fmt.Fprintf(os.Stderr, "error: %v")` + `os.Exit(1)`. The only testable behavior is "main() calls Execute and exits non-zero on error." A smoke test that calls `main()` in a subprocess (or refactors main into a `run() int` for testability) is the path. **Flag: 50% on a 15-LOC glue file is ~7 lines of covered code — the effort:coverage ratio is poor. D-047 explicitly called this out ("0→70% risks a coverage rathole on `cmd/orca` which is glue code"). Recommend the plan keep this at the 50% toe-hold and not over-invest.**
|
||||
|
||||
### 1.2 Existing test-helper utilities (reuse, do NOT re-create)
|
||||
|
||||
| Helper | Location | Reuse for |
|
||||
|--------|----------|-----------|
|
||||
| `openTestDB(t)` | `internal/store/node_repo_test.go:12` | engine, audit, store tests — returns `(*NodeRepo, func())` backed by temp-file sqlite; adapt to return `*sql.DB` for JobRepo/TaskRepo/AuditRepo/CapacityRepo/CertRepo |
|
||||
| `withFastWatch(t, d)` | `internal/store/job_task_repo_test.go:36` | store Watch tests — overrides `watchInterval` for deterministic ticks |
|
||||
| `initTestEnv(t)` | `internal/cli/init_test.go:17` | cli tests — sets `ORCA_HOME` to temp dir + returns cleanup |
|
||||
| `resetRootFlags(t)` | `internal/cli/namespace_test.go:13` | cli tests — resets `rootCmd` args/out/json/system flags between subtests |
|
||||
| `discardWriter` | `internal/cli/init_test.go:33` | cli tests — `io.Writer` that discards stdout |
|
||||
| `stubDispatcher` | `internal/daemon/dispatch_test.go:24` | transport/engine tests — implements `transport.Dispatcher` (`LocalSubmit`/`LocalStatus`); reusable as a `LocalExecutor` too since the signatures match |
|
||||
| `insertNode(t, repo, ctx, id, name)` | `internal/store/node_repo_test.go:217` | store/doctor tests — inserts a minimal node |
|
||||
| `security.CAInit`/`LoadCA`/`GenerateCSR`/`SignCSR`/`WriteCert`/`WriteKey` | `internal/security/ca.go` | transport mTLS tests — bootstrap a real CA + server cert into a temp dir (pattern in `doctor_test.go:69-94`) |
|
||||
| `t.Setenv("ORCA_HOME", dir)` + `t.Setenv("ORCA_DB", ...)` | `internal/doctor/doctor_test.go:23-24` | any test needing the orca namespace — preferred over manual `os.Setenv` (auto-cleanup) |
|
||||
|
||||
### 1.3 Injected seams already present in the codebase (confirm by reading)
|
||||
|
||||
1. **`sshDialer` (proxmox)** — `internal/proxmox/bootstrap.go:201-213`: package-level `var sshDialer sshDialerType = defaultSSHDialer{}`; interface `sshDialerType{ DialContext(ctx, network, addr, *ssh.ClientConfig) (*ssh.Client, error) }`. Tests can swap `sshDialer` for a fake. **GAP:** no `sessionRunner` seam — `runRemote` (line 217) calls `conn.NewSession()` + `session.CombinedOutput(cmd)` directly on the concrete `*ssh.Client`. Recommend P01 plan add a `sessionRunner` interface (`CombinedOutput(cmd) ([]byte, error)`) so `deployPubKey`/`createLinuxUser`/`createPVERole`/`createPVEUser`/`assignPVEACL`/`writeSudoers`/`validateSudoers` become testable without a real SSH endpoint.
|
||||
2. **`LocalExecutor` (engine dispatcher)** — `internal/engine/dispatcher.go:39`: interface `Submit(ctx, []byte) (string, error)` + `Status(ctx, string) (string, error)`. `Dispatcher` depends on it; tests inject a stub. **GAP:** `dispatchToPeer` (line 154) calls `transport.NewDispatchClient` directly (no seam) — to test the remote-dispatch branch, either add a `peerDispatcher` interface or test via `httptest.NewTLSServer`.
|
||||
3. **`PeerPersister` (engine peer)** — `internal/engine/peer.go:39`: optional persist callback; unused in production but available as a seam.
|
||||
4. **`Dispatcher` (transport)** — `internal/transport/dispatch.go:49`: `LocalSubmit`/`LocalStatus` interface; `stubDispatcher` in `daemon/dispatch_test.go:24` is the template stub.
|
||||
5. **`watchInterval` (store)** — `internal/store/job_task_repo.go:20`: unexported `var watchInterval = 1 * time.Second`; tests override via `withFastWatch`.
|
||||
|
||||
### 1.4 Packages where 70% is unrealistic in a single phase (with evidence)
|
||||
|
||||
- **`internal/cli` — 70% is ambitious.** 17 source files, ~2000 LOC. The `daemon` command (`internal/cli/daemon.go`) starts a long-running mTLS server — testing it requires a lifecycle harness (start, probe, shutdown) and is better covered by `internal/daemon/server_test.go` (already exists, 150 LOC). Recommend the P01 plan **exclude `daemon.go` from the cli 70% target** (document it as covered by the daemon package's own tests) and aim for 70% of the *remaining* cli files. Even so, 55-65% is the realistic single-phase outcome for the rest.
|
||||
- **`cmd/orca` — 70% is explicitly out of scope per D-047.** 15 LOC of glue; 50% toe-hold is the right call.
|
||||
- **`internal/proxmox` — 70% likely requires the `sessionRunner` seam refactor.** Without it, only the validation paths + `sudoersContent` string asserts are testable (~50-55%). The plan should add the seam; with it, 70% is achievable.
|
||||
|
||||
---
|
||||
|
||||
## 2. SSH trust hardening research (P02 — REQ-058, REQ-059)
|
||||
|
||||
### 2.1 Current TOFU `knownhosts.New()` callback — how it works
|
||||
|
||||
**Location:** `internal/proxmox/bootstrap.go:125-128` (bootstrap) + `internal/doctor/doctor.go:412-415` (doctor proxmox probe).
|
||||
|
||||
```go
|
||||
hostKeyCallback, err := knownhosts.New(certpaths.KnownHostsPath())
|
||||
// ...
|
||||
sshConfig := &ssh.ClientConfig{
|
||||
HostKeyCallback: hostKeyCallback,
|
||||
// ...
|
||||
}
|
||||
```
|
||||
|
||||
**Mechanism (`golang.org/x/crypto/ssh/knownhosts`):**
|
||||
- `knownhosts.New(files ...string)` returns an `ssh.HostKeyCallback` that reads the OpenSSH-format `known_hosts` file at `certpaths.KnownHostsPath()` (= `$ORCA_HOME/known_hosts`, see `internal/certpaths/certpaths.go:62`).
|
||||
- **First connect (host absent from file):** the callback returns a `*knownhosts.KeyError` with `Want: []` (empty). This is a "host unknown" signal. **IMPORTANT:** `knownhosts.New` does NOT auto-write the key on first connect — it returns an error. The current orca code at `bootstrap.go:140` treats ANY dial error as a failure (`return nil, fmt.Errorf("ssh dial %s: %w", sshAddr, err)`). **This means the current TOFU flow is INCOMPLETE:** on a truly first connect, `knownhosts.New` returns `KeyError{Want:[]}` and the dial fails — there is no capture-and-persist step. The v0.6 RESEARCH_v0.6.md §A.5 claimed `knownhosts.New` "handles both capture and verify in one callback" but the actual `golang.org/x/crypto` API does NOT auto-capture; it only verifies. **This is a latent bug OR the operator is expected to pre-populate `known_hosts` manually (which contradicts the TOFU UX).** P02 must address this: either (a) wrap `knownhosts.New` with a custom callback that captures on `KeyError{Want:[]}` and writes via `knownhosts.Line`, or (b) accept that `--host-key-fingerprint` (REQ-058) becomes the *required* path for first connect and TOFU capture is a separate enhancement. **Flag for plan: the current TOFU capture is broken; P02 should fix it as part of the trust-hardening work (the `--host-key-fingerprint` path is actually simpler than TOFU because it doesn't need capture).**
|
||||
- **Subsequent connects (host present, key matches):** callback returns `nil` → dial proceeds.
|
||||
- **Subsequent connects (host present, key MISMATCH):** callback returns `*knownhosts.KeyError{Want: [knownKey]}` → dial fails with a clear error. This is the MITM-detection path.
|
||||
|
||||
**File format:** OpenSSH `known_hosts` — one line per host: `[host]:port ssh-key-type base64-key` (or hashed-host form via `knownhosts.HashHostname`). `knownhosts.Line(addresses []string, key ssh.PublicKey) string` produces the line; `knownhosts.Normalize(address)` normalizes the host:port.
|
||||
|
||||
### 2.2 `Result.HostKeyFingerprint` — current computation (CRITICAL FINDING)
|
||||
|
||||
**Location:** `internal/proxmox/bootstrap.go:83-85` (field declaration) + `bootstrap.go:195-198` (return statement).
|
||||
|
||||
```go
|
||||
type Result struct {
|
||||
NodeName string
|
||||
NodeAddress string
|
||||
HostKeyFingerprint string // field EXISTS
|
||||
}
|
||||
// ...
|
||||
return &Result{
|
||||
NodeName: opts.Host,
|
||||
NodeAddress: opts.Host + ":8443",
|
||||
// HostKeyFingerprint is NOT SET — always empty string
|
||||
}, nil
|
||||
```
|
||||
|
||||
**Finding:** `Result.HostKeyFingerprint` is **declared but never populated**. The current `BootstrapProxmox` returns it as `""`. There is **no fingerprint computation today** — no `ssh.FingerprintSHA256` call, no hex digest, nothing. D-045's rationale ("matches the fingerprint format operators already see from `orca node join`'s own `Result.HostKeyFingerprint` output") is based on a field that is currently always empty.
|
||||
|
||||
**Implication for P02:** The plan must ADD the fingerprint computation. The correct function is `ssh.FingerprintSHA256(pubKey ssh.PublicKey) string` (verified via `go doc`), which returns the **OpenSSH `SHA256:base64` format** (unpadded base64, exactly what `ssh-keyscan -E sha256` emits and what D-045 specifies). So D-045's format choice is correct *by intent* but the code doesn't produce it yet — P02 populates `Result.HostKeyFingerprint = ssh.FingerprintSHA256(hostKey)` during the capture path, and `--host-key-fingerprint` compares against `ssh.FingerprintSHA256` of the server-presented key.
|
||||
|
||||
**No existing fingerprint-comparison utility in `internal/security/`.** `security.Fingerprint` (fingerprint.go:17) computes SHA-256 **hex** of an X.509 cert's DER — a DIFFERENT format (hex, not base64; X.509, not SSH). `security.FingerprintOf` (fingerprint.go:34) is the same. **Do NOT reuse these for SSH host-key comparison** — they're for the mTLS CA pin (`--ca-fingerprint`). P02 needs a new SSH-specific helper, e.g. `security.SSHFingerprintSHA256(pubKey ssh.PublicKey) string` (thin wrapper over `ssh.FingerprintSHA256`) or inline in `proxmox/bootstrap.go`.
|
||||
|
||||
### 2.3 Where `--host-key-fingerprint` plugs in (REQ-058)
|
||||
|
||||
**CLI seam:** `internal/cli/node.go:344-354` — the `init()` registers flags on `nodeJoinCmd`. Add:
|
||||
```go
|
||||
nodeJoinCmd.Flags().StringVar(&joinHostKeyFP, "host-key-fingerprint", "", "SSH host key SHA256:base64 fingerprint (pre-pin; supersedes TOFU for --type proxmox)")
|
||||
```
|
||||
Per D-044, the flag lives on `orca node join` (not just `--type proxmox`); validation in `RunE` (`node.go:78-83`) emits a clear error if the flag is set for a non-proxmox type.
|
||||
|
||||
**Transport seam:** `internal/proxmox/bootstrap.go:131-136` — `ssh.ClientConfig.HostKeyCallback`. Currently `knownhosts.New(...)`. When `--host-key-fingerprint` is supplied, replace the callback with a `ssh.FixedHostKey`-style verifier that:
|
||||
1. Parses the operator-supplied `SHA256:base64` string (strip `SHA256:` prefix, base64-decode → 32 bytes).
|
||||
2. In the callback, receives the server's `ssh.PublicKey`, computes `ssh.FingerprintSHA256(key)`, compares to the operator string.
|
||||
3. Returns `nil` on match, `error` on mismatch (fail closed).
|
||||
|
||||
**Recommended callback shape (concrete):**
|
||||
```go
|
||||
func pinnedHostKeyCallback(expectedSHA256Base64 string) (ssh.HostKeyCallback, error) {
|
||||
// Validate format: must start with "SHA256:".
|
||||
if !strings.HasPrefix(expectedSHA256Base64, "SHA256:") {
|
||||
return nil, fmt.Errorf("host-key-fingerprint: must be OpenSSH SHA256:base64 format (got %q)", expectedSHA256Base64)
|
||||
}
|
||||
expected := expectedSHA256Base64 // store full string for direct compare
|
||||
return func(_ string, _ net.Addr, key ssh.PublicKey) error {
|
||||
got := ssh.FingerprintSHA256(key)
|
||||
if got != expected {
|
||||
return fmt.Errorf("host key fingerprint mismatch: got %s, want %s — refusing to connect (REQ-058)", got, expected)
|
||||
}
|
||||
return nil
|
||||
}, nil
|
||||
}
|
||||
```
|
||||
**Why compare full strings (not base64-decoded bytes):** `ssh.FingerprintSHA256` returns the canonical `SHA256:base64` string; comparing it directly to the operator-supplied string is simplest and avoids a base64-decode step. Reject non-`SHA256:`-prefixed input up front with a clear error (D-045: "Accept only `SHA256:`-prefixed base64; reject raw hex with a clear error").
|
||||
|
||||
**Pass-through to proxmox:** `internal/cli/node.go:158-166` — add `HostKeyFingerprint string` to `proxmox.Options` (bootstrap.go:55) and pass `joinHostKeyFP` through. `BootstrapProxmox` selects the callback: if `opts.HostKeyFingerprint != ""` use `pinnedHostKeyCallback`, else fall back to the TOFU `knownhosts.New` (with the capture-fix from §2.1).
|
||||
|
||||
### 2.4 `orca node key-reset <node>` (REQ-059, D-046 — local known_hosts only)
|
||||
|
||||
**Scope (D-046):** clear the local `~/.orca/known_hosts` entry for the node ONLY; do NOT revoke the remote authorized_keys entry (would orphan a working node). Audit-log `event=node.key_reset` with `actor` + `node`.
|
||||
|
||||
**`known_hosts` line format written by `golang.org/x/crypto/ssh/knownhosts`:**
|
||||
- `knownhosts.Line(addresses []string, key ssh.PublicKey) string` → `"[host]:port ssh-ed25519 AAAA...\n"` (or `host ssh-ed25519 AAAA...` if port 22 — `knownhosts.Normalize` handles the `:22` vs bare-host normalization).
|
||||
- The file is plain text, one entry per line, `#`-prefixed comments allowed.
|
||||
|
||||
**No library function to remove a host's entries.** `knownhosts.New` only reads. The reset must be implemented manually:
|
||||
1. Read `certpaths.KnownHostsPath()` (`internal/certpaths/certpaths.go:62`).
|
||||
2. Filter lines: keep lines whose host field (before the first whitespace) does NOT match `knownhosts.Normalize(nodeName)` (or the node's address). **Edge:** a host may have multiple entries (one per key type); remove all matching lines.
|
||||
3. Write the filtered content back via **atomic rewrite** (temp file in same dir + `os.Rename`) — reuse `security.writeAtomic` (ca.go:305) OR implement inline (it's unexported in `security`; either export it or copy the ~20-LOC pattern). **Recommend atomic rewrite, NOT in-place truncation** — in-place rewrite via `os.OpenFile(O_TRUNC|O_WRONLY)` risks data loss on crash mid-write.
|
||||
|
||||
**CLI registration seam:** `internal/cli/node.go:358-360` — the `init()` does `nodeCmd.AddCommand(nodeJoinCmd)`, `nodeLeaveCmd`, `nodeListCmd`. Add:
|
||||
```go
|
||||
nodeCmd.AddCommand(nodeKeyResetCmd)
|
||||
```
|
||||
where `nodeKeyResetCmd` is a new `&cobra.Command{Use: "key-reset <node>", Args: cobra.ExactArgs(1), RunE: ...}`. The `RunE`:
|
||||
1. Resolve `<node>` arg → look up the node in the registry (`nodeRegistry()` at node.go:37) to get its address (for matching `known_hosts` lines) — OR accept the raw host string directly. **Recommend:** accept the node NAME (consistent with `doctor proxmox` which iterates `node.Name`), look up the node row, use `node.Name` (which is the host address for proxmox nodes per `bootstrap.go:196`) as the `known_hosts` match key.
|
||||
2. Call a new `proxmox.ResetHostKey(host string) error` (or inline in cli) that does the atomic rewrite.
|
||||
3. Audit-log via `engine.Audit.Record(ctx, "cli", "node.key_reset", nodeID, "success", nil, map[string]any{"host": host})`.
|
||||
4. Print `✓ Host key reset for <node> (next connect will re-pin via TOFU or --host-key-fingerprint)`.
|
||||
|
||||
**Reusability:** the `nodeRegistry()` helper (node.go:37) + `openDB()` (node.go:25) + `newLogger()` (node.go:33) are all available for the key-reset command.
|
||||
|
||||
### 2.5 CLI registration seam summary (P02)
|
||||
|
||||
| Addition | File:line | Change |
|
||||
|----------|-----------|--------|
|
||||
| `--host-key-fingerprint` flag | `internal/cli/node.go:344-354` (init) | `nodeJoinCmd.Flags().StringVar(&joinHostKeyFP, "host-key-fingerprint", "", "...")` |
|
||||
| `joinHostKeyFP` var | `internal/cli/node.go:47-60` (var block) | add `joinHostKeyFP string` |
|
||||
| Pass-through to proxmox | `internal/cli/node.go:158-166` (joinProxmox) | add `HostKeyFingerprint: joinHostKeyFP` to `proxmox.Options` |
|
||||
| `HostKeyFingerprint` field | `internal/proxmox/bootstrap.go:55` (Options) | add field |
|
||||
| Pinned callback | `internal/proxmox/bootstrap.go:131-136` | branch: if `opts.HostKeyFingerprint != ""` use pinned callback else TOFU |
|
||||
| Populate `Result.HostKeyFingerprint` | `internal/proxmox/bootstrap.go:195-198` | set `HostKeyFingerprint: ssh.FingerprintSHA256(hostKey)` during capture |
|
||||
| `key-reset` subcommand | `internal/cli/node.go:358-360` (init) | `nodeCmd.AddCommand(nodeKeyResetCmd)` + new cmd var |
|
||||
| `ResetHostKey` helper | `internal/proxmox/bootstrap.go` (new) OR `internal/security/sshkey.go` | atomic known_hosts rewrite |
|
||||
|
||||
---
|
||||
|
||||
## 3. Requirements-hygiene gate research (P03 — REQ-060)
|
||||
|
||||
### 3.1 Current Makefile targets
|
||||
|
||||
`Makefile` has 11 targets: `build`, `test`, `test-race`, `lint`, `fmt`, `clean`, `run`, `version`, `changelog`, `release`, `security-scan` (Makefile:1-100). **No `verify-reqs` target exists.** The `.PHONY` list at line 1 must be extended.
|
||||
|
||||
### 3.2 Current `.coreci.yml` pipeline structure
|
||||
|
||||
4 pipelines (`.coreci.yml:19-134`):
|
||||
- **validate** (line 20): 4 steps — `go-version` (gofmt+vet), `gosec`, `govulncheck`, `gitleaks`.
|
||||
- **build** (line 53): 1 step — version-injected `go build`.
|
||||
- **test** (line 72): 1 step — `go test -race -coverprofile=coverage.out ./...` + `go tool cover -func | tail -1`.
|
||||
- **release** (line 81): gated on `refs/tags/v*`; 3 steps — build-artifact, gitea-release, container-publish.
|
||||
|
||||
**Hook for `verify-reqs`:** add a 5th step to the `validate` pipeline (after `go-version`, before/after `gosec`) OR add it to the `test` pipeline. **Recommend `validate` pipeline** — requirements hygiene is a static check (no test run needed), belongs alongside gofmt/vet/lint. Step shape:
|
||||
```yaml
|
||||
- name: verify-reqs
|
||||
image: golang:1.25
|
||||
commands:
|
||||
- make verify-reqs
|
||||
```
|
||||
|
||||
### 3.3 `verify-reqs` implementation recommendation
|
||||
|
||||
**Assertion (REQ-060):** every REQ row in `ROADMAP.md` marked `[x]`/Complete must have a matching REQ-ID row in `REQUIREMENTS.md` with `Complete` status. (Reverse direction — every REQUIREMENTS `Complete` has a ROADMAP `[x]` — is also worth checking but the drift that motivated this was ROADMAP-shipped-but-REQUIREMENTS-Pending, so the forward direction is the priority.)
|
||||
|
||||
**Approach: small Go program in `cmd/verify-reqs` OR a shell+awk script?**
|
||||
|
||||
- **Go program** (~80 LOC): parse both markdown tables with `regexp`, build two `map[string]string` (REQ-ID → status), diff. Pros: type-safe, testable, consistent with the Go toolchain; can be a `cmd/verify-reqs/main.go` with its own `_test.go`. Cons: adds a binary target.
|
||||
- **Shell+awk** (~30 LOC): `awk` over the markdown tables. Pros: no new Go package; minimal. Cons: fragile parsing, hard to test, shell-quoting issues.
|
||||
|
||||
**Recommendation: Go program at `cmd/verify-reqs/main.go`.** Reasons: (1) testable with golden-file fixtures (parse a sample ROADMAP+REQUIREMENTS pair, assert diff); (2) consistent with the project's Go-only tooling ethos (no shell-awk fragility); (3) the `make verify-reqs` target just calls `go run ./cmd/verify-reqs`; (4) CoreCI's `golang:1.25` image has `go` available — no extra dep.
|
||||
|
||||
**Parsing approach (concrete):**
|
||||
1. ROADMAP.md: regex `^\s*-\s*\[(x|X| )\]\s*Phase.*—.*tag` is NOT the right pattern (that's phase lines, not REQ rows). The REQ coverage is in per-phase bullet lists under "### Per-phase REQ coverage" (ROADMAP.md:161-180) AND in the milestone section bodies. **Simpler:** the ROADMAP uses `- [x] Phase N: ...` for completed phases. The authoritative REQ↔status mapping lives in **REQUIREMENTS.md** (the single table at lines 9-56 + per-milestone tables at 103-142). **Re-interpret REQ-060:** the assertion is really "ROADMAP milestone sections marked COMPLETE ↔ REQUIREMENTS rows for that milestone marked Complete." The drift was: v0.7 ROADMAP said "COMPLETE" (line 116) but REQUIREMENTS v0.7 rows (REQ-053..056) were "Pending" (now corrected to "Complete" in SPECIFY).
|
||||
2. **Refined assertion:** parse REQUIREMENTS.md table rows (`| REQ-XXX | ... | ... | ... | **Complete** |` or `| Pending |`); for each REQ-ID, record status. Then parse ROADMAP.md for milestone-level "COMPLETE" markers (`## Milestone v0.X: ... — **COMPLETE**`) AND phase-level `- [x]` markers. For each milestone marked COMPLETE in ROADMAP, assert every REQ-ID belonging to that milestone (per the REQUIREMENTS milestone column) is `Complete` in REQUIREMENTS. **OR (simpler, matches the SPECIFY wording):** for every REQ-ID in REQUIREMENTS.md whose `Phase` column references a milestone that ROADMAP marks COMPLETE, the Status must be `Complete`. This catches the exact drift (ROADMAP-shipped, REQUIREMENTS-stale).
|
||||
|
||||
**Concrete regex:**
|
||||
- REQUIREMENTS row: `^\|\s*(REQ-\d+)\s*\|.*?\|\s*\*\*(Complete|Pending)\*\*\s*\|` (capture ID + status).
|
||||
- ROADMAP milestone-complete: `^##\s*Milestone\s+v0\.\d+:.*—\s*\*\*COMPLETE\*\*` (capture milestone label).
|
||||
- Map milestone → REQs via the REQUIREMENTS `Phase` column (e.g. `v0.7 P1` → milestone `v0.7`).
|
||||
|
||||
**Where it hooks in:** `make verify-reqs` runs `go run ./cmd/verify-reqs .ciagent/ROADMAP.md .ciagent/REQUIREMENTS.md`; `.coreci.yml` validate pipeline adds the step. Exit 0 on consistency, exit 1 with a diff listing on drift.
|
||||
|
||||
### 3.4 The drift that motivated REQ-060
|
||||
|
||||
After v0.7 ship, REQUIREMENTS.md rows REQ-053..056 were "Pending" despite ROADMAP.md marking milestone v0.7 COMPLETE and all phases `[x]`. This was corrected during v0.8 SPECIFY (the rows now read `**Complete**`). REQ-060 ensures the drift cannot recur: the CI validate pipeline fails if ROADMAP says COMPLETE but REQUIREMENTS says Pending.
|
||||
|
||||
---
|
||||
|
||||
## 4. Architectural decisions surfaced (AD-027..AD-030)
|
||||
|
||||
| ID | Decision | Rationale |
|
||||
|----|----------|-----------|
|
||||
| AD-027 | `ssh.FingerprintSHA256` (OpenSSH `SHA256:base64`) as the SSH host-key fingerprint format | Matches D-045 + `ssh-keyscan -E sha256` output. The existing `security.Fingerprint` (hex, X.509) is NOT reused — different domain. P02 adds a thin SSH-specific helper. |
|
||||
| AD-028 | `--host-key-fingerprint` callback compares full `SHA256:base64` strings, not decoded bytes | `ssh.FingerprintSHA256` returns the canonical string; direct string compare avoids a base64-decode step and is less error-prone. Validate `SHA256:` prefix up front. |
|
||||
| AD-029 | `orca node key-reset` rewrites `known_hosts` via atomic temp-file + rename | Prevents data loss on crash mid-write. Reuse the `writeAtomic` pattern from `security/ca.go:305` (export it or copy the ~20 LOC). |
|
||||
| AD-030 | `verify-reqs` implemented as `cmd/verify-reqs/main.go` (Go program), not shell+awk | Testable, type-safe, consistent with Go-only tooling. `make verify-reqs` runs `go run ./cmd/verify-reqs`. Hooked into `.coreci.yml` validate pipeline. |
|
||||
|
||||
---
|
||||
|
||||
## 5. Pitfalls, gaps, and flags for the plan
|
||||
|
||||
1. **TOFU capture is currently BROKEN (§2.1).** `knownhosts.New` returns `KeyError{Want:[]}` on first connect and does NOT auto-write the key. The current `BootstrapProxmox` treats this as a dial failure. P02 must either (a) wrap the callback to capture-and-persist on `KeyError{Want:[]}` via `knownhosts.Line` + atomic write, or (b) make `--host-key-fingerprint` the required first-connect path. **Recommend (a) — fix TOFU + add pre-pin as superset.** This is a v0.6 latent bug that P02 closes.
|
||||
2. **`Result.HostKeyFingerprint` is never populated (§2.2).** D-045's rationale references "existing output" that doesn't exist. P02 must ADD the computation (`ssh.FingerprintSHA256`). Low risk — it's a 1-line addition once the host key is available.
|
||||
3. **No `sessionRunner` seam in proxmox (§1.3).** Testing the SSH command sequence (deployPubKey, createLinuxUser, pveum, sudoers, visudo) without a real SSH server requires a new interface seam. **Recommend P01 plan add it** — 1 interface, ~10 LOC, unlocks ~40% of proxmox coverage.
|
||||
4. **`internal/store/cert_repo.go` has NO test (§1.1).** v0.7 P01 REQ-053 was supposed to add `cert_repo_test.go` but it's missing — `internal/store/` glob shows no `cert_repo_test.go`. This is a v0.7 leftover. P01 should add it (it directly lifts store coverage toward 70%).
|
||||
5. **`internal/cli/daemon.go` excluded from cli 70% target (§1.4).** The daemon command starts a long-running server; it's covered by `internal/daemon/server_test.go` (150 LOC). Don't double-test in cli.
|
||||
6. **`cmd/orca` 50% toe-hold is low-value (§1.1).** 15 LOC of glue; the test effort:coverage ratio is poor. D-047 already called this out. Don't over-invest.
|
||||
7. **`go: no such tool "covdata"` for zero-test packages (§1.1).** This is a Go toolchain quirk when a package has no test files — `go test -cover` can't compute coverage without a test binary. It's NOT a real 0% number (it's "undefined"). Adding any `_test.go` file makes the number computable. Don't treat the error as a coverage measurement.
|
||||
8. **`transport.dispatchToPeer` has no seam (§1.3).** Testing the remote-dispatch branch of `Dispatcher.Submit` requires either a new `peerDispatcher` interface OR `httptest.NewTLSServer`. The latter is already used in `daemon/dispatch_test.go`; recommend the plan use `httptest.NewTLSServer` (no refactor needed) for transport coverage.
|
||||
9. **`knownhosts.Line` + `knownhosts.Normalize` are the helpers for the TOFU-capture fix and for `key-reset` matching (§2.1, §2.4).** Use `Normalize` to match host strings consistently (handles `host:22` vs `host`).
|
||||
10. **`security.writeAtomic` is unexported (ca.go:305).** `key-reset`'s atomic known_hosts rewrite needs it. Either export `WriteAtomic` from `security`, or copy the ~20-LOC pattern into `proxmox`/`cli`. **Recommend export** — it's already used across ca.go + sshkey.go and is generally useful.
|
||||
|
||||
---
|
||||
|
||||
## 6. Dependencies
|
||||
|
||||
v0.8 adds **zero** new direct dependencies:
|
||||
- SSH host-key fingerprint: `ssh.FingerprintSHA256` (already in `golang.org/x/crypto/ssh` v0.54.0, direct dep since v0.6).
|
||||
- `knownhosts.Line`/`Normalize`/`KeyError`: same `golang.org/x/crypto` module.
|
||||
- `verify-reqs`: stdlib only (`regexp`, `os`, `fmt`).
|
||||
- Tests: `net/http/httptest` (stdlib), existing interfaces.
|
||||
|
||||
`go.mod` is unchanged by v0.8.
|
||||
|
||||
---
|
||||
|
||||
## 7. PERSONAS assessment (v0.8)
|
||||
|
||||
v0.8 is an NFR milestone touching tests (9 packages), SSH trust surface (proxmox + cli/node + security), and a requirements-hygiene Go program. The 3-persona roster from config.json (lead-developer, backend-engineer, data-engineer) is sufficient — no phase-specific personas needed.
|
||||
|
||||
**Roster confirmation:**
|
||||
- **lead-developer** — owns coordination + `cmd/orca` smoke test + `internal/cli` coverage (cert/doctor/audit/status/version subcommands) + the `verify-reqs` Go program (coordination territory).
|
||||
- **backend-engineer** — owns `internal/transport` tests (httptest.NewTLSServer) + `internal/engine` tests (LocalExecutor stubs, PeerRegistry) + SSH trust-surface in `internal/proxmox/bootstrap.go` (pinned callback, TOFU capture fix, sessionRunner seam) + `internal/cli/node.go` (`--host-key-fingerprint` flag, `key-reset` subcommand).
|
||||
- **data-engineer** — owns `internal/store` tests (cert_repo_test.go gap + coverage uplift) + `internal/audit` tests (sqlite-backed audit_log asserts) + `internal/certpaths` tests (path-join asserts) + `internal/jobspec` tests (golden HCL fixtures).
|
||||
|
||||
No frontend persona (no UI). No devops persona (no packaging/distribution — `verify-reqs` is a Go program, not a CI config change; the `.coreci.yml` edit is a 3-line hook, lead-developer territory). No security-engineer persona (the SSH trust work is backend-engineer territory — the security-engineer was deactivated in v0.7 and v0.8 doesn't re-add it; the trust-surface hardening is a refinement of the existing `proxmox` package, not new security architecture).
|
||||
|
||||
See `.ciagent/PERSONAS.md` (updated with v0.8 YAML frontmatter + territory globs matching the actual file structure).
|
||||
+43
-148
@@ -20,167 +20,62 @@
|
||||
- `iter.Seq` streaming job lists (REQ-022)
|
||||
- Frontend / devops personas (no web UI; CoreCI handles release)
|
||||
|
||||
## Milestone v0.2: Networking, Observability, Security Hardening — **COMPLETE (merged to main via v0.3)**
|
||||
## Milestone v0.2: Networking, Observability, Security Hardening — **IN PROGRESS**
|
||||
|
||||
Scope: extend v0.1 with secure cross-node transport, multi-node scheduling,
|
||||
richer CI security scanning, and streaming I/O.
|
||||
|
||||
- [x] Phase 8: mTLS handshake + internal CA with CSR join (Wave 1) — shipped v0.2.1
|
||||
- [x] Phase 9: Multi-node scheduling & job dispatch (Wave 1) — shipped v0.2.2
|
||||
- [x] Phase 10: `gosec` + `govulncheck` + gitleaks in CI (Wave 2) — shipped v0.2.3
|
||||
- [x] Phase 11: `iter.Seq` streaming job/node lists (Wave 2) — **completed in v0.3 P01** (shipped v0.3.1)
|
||||
- [ ] Phase 8: mTLS handshake + internal CA with CSR join (Wave 1)
|
||||
- [ ] Phase 9: Multi-node scheduling & job dispatch (Wave 1)
|
||||
- [ ] Phase 10: `gosec` + `govulncheck` + gitleaks in CI (Wave 2)
|
||||
- [ ] Phase 11: `iter.Seq` streaming job/node lists (Wave 2)
|
||||
|
||||
**Milestone tag**: `v0.4.0` (shipped — v0.2 work merged to main via v0.3 milestone).
|
||||
**Target milestone tag**: `v0.3.0` (next-minor per feature-milestone promotion rule).
|
||||
|
||||
Per-phase tags: `v0.2.1` (P01), `v0.2.2` (P02), `v0.2.3` (P03) — all shipped.
|
||||
|
||||
## Milestone v0.3: Scheduling & Streaming Completion — **COMPLETE**
|
||||
|
||||
Scope: complete the two work items deferred from v0.2 that were not
|
||||
already shipped in P08-P10. A re-init SPECIFY codebase audit confirmed
|
||||
that REQ-014/027/028/029/031/037/039/040 all shipped in P08-P10 despite
|
||||
stale REQUIREMENTS.md marking them Pending. The remaining work is lean:
|
||||
|
||||
- [x] Phase 0: Pre-execution (specify → clarify → research → plan → grill) — shipped v0.3.0
|
||||
- [x] Phase 1: `iter.Seq` streaming for `--watch` flags (REQ-022, REQ-030) — shipped v0.3.1
|
||||
- [x] Phase 2: `orca doctor` network + db full implementation (REQ-032 completion) — shipped v0.3.2
|
||||
- [x] Phase 3: Final review + ship + audit (milestone release) — shipped v0.3.3
|
||||
|
||||
**Milestone tag**: `v0.4.0` (next-minor per feature-milestone promotion rule).
|
||||
|
||||
Per-phase tags: `v0.3.0` (P0), `v0.3.1` (P01), `v0.3.2` (P02), `v0.3.3` (P03 final = milestone release).
|
||||
Per-phase tags: `v0.2.1` (P01), `v0.2.2` (P02), `v0.2.3` (P03), `v0.2.4` (P04).
|
||||
Per `.ciagent/RELEASE_POLICY.md`, every phase tag produces a Gitea release.
|
||||
|
||||
### Per-phase REQ coverage
|
||||
### Per-phase REQ coverage (post-IDEATE)
|
||||
|
||||
- **P01 — `iter.Seq` streaming for `--watch` flags**
|
||||
- REQ-022 (`iter.Seq` for streaming job lists, Go 1.25+)
|
||||
- REQ-030 (`--watch` output format mode: table default vs streaming JSON per event)
|
||||
- Applies to both `orca job list --watch` and `orca node list --watch`
|
||||
(D-024, per ARCHITECTURE.md CLI layer + D-017)
|
||||
- **P01 — mTLS handshake + internal CA with CSR join** (Wave 1)
|
||||
- REQ-011, REQ-023 (carried over from v0.1)
|
||||
- REQ-025 (cert rotation history), REQ-026 (CA fingerprint pinning),
|
||||
REQ-033 (file mode enforcement), REQ-034 (rotation alarm),
|
||||
REQ-035 (cert show redaction), REQ-036 (SAN validation),
|
||||
REQ-038 (mTLS failure log fields)
|
||||
- REQ-032 (orca doctor — initial implementation; checks CA/cert state)
|
||||
|
||||
- **P02 — `orca doctor` network + db full implementation**
|
||||
- REQ-032 (completion: network reachability via mTLS `/healthz` probe,
|
||||
db integrity via `PRAGMA integrity_check` + migration version)
|
||||
- Replaces `NetworkStub` and `DBStub` from v0.2 P01
|
||||
- **P02 — Multi-node scheduling & job dispatch** (Wave 1)
|
||||
- REQ-028 (NodeCapacity HCL schema — P02 enabler; lands first)
|
||||
- REQ-037 (X-Orca-Idempotency-Key on cross-node POST)
|
||||
|
||||
### v0.3 is a completion milestone, not a direction change
|
||||
- **P03 — `gosec` + `govulncheck` + gitleaks in CI** (Wave 2)
|
||||
- REQ-014 (carried over)
|
||||
- REQ-027 (govulncheck offline mode — new in v0.2 IDEATE, per REQ-cand-C;
|
||||
this changes P03's scope: CI must not call `vuln.go.dev` by default;
|
||||
resolve via pre-mirrored DB or `-format json` + `jq` wrapper. PLAN
|
||||
stage decides between the two options.)
|
||||
- REQ-029 (gitleaks baseline for pre-existing `.env` leak in history,
|
||||
per REQ-cand-E)
|
||||
- REQ-039 (`.gitleaks.toml` stopwords), REQ-040 (`.golangci.yml`)
|
||||
|
||||
The vision ("minimalist, offline-first, CLI-first orchestration
|
||||
engine") is unchanged. v0.3 closes out the v0.2 deferrals and merges
|
||||
the accumulated v0.2 work to main.
|
||||
- **P04 — `iter.Seq` streaming job/node lists** (Wave 2)
|
||||
- REQ-022 (carried over)
|
||||
- REQ-030 (`--watch --json` streaming output mode, per REQ-cand-F)
|
||||
|
||||
## Milestone v0.5: Distribution — **COMPLETE**
|
||||
- **Cross-cutting (P01–P04)**
|
||||
- REQ-031 (`go test -race` enabled in CI for all v0.2 packages)
|
||||
|
||||
Scope: make Orca installable, distributable, and containerized. The
|
||||
engine functionality from v0.1–v0.3 is unchanged; this milestone is
|
||||
purely about delivery surface.
|
||||
### P03 scope change (vs. pre-IDEATE plan)
|
||||
|
||||
- [x] Phase 0: Pre-execution (specify → clarify → research → plan) — shipped `v0.4.1` (+ repo public)
|
||||
- [x] Phase 1: Namespace unification (`ORCA_HOME` + `--system`) (REQ-041, REQ-042) — shipped `v0.4.2`
|
||||
- [x] Phase 2: `install.sh` + in-place update + README quickstart (REQ-043, REQ-044) — shipped `v0.4.3`
|
||||
- [x] Phase 3: Docker release (Dockerfile + Gitea container registry) (REQ-046) — shipped `v0.4.4`
|
||||
- [x] Phase 4: Final review + ship + audit (milestone release) — shipped `v0.4.5`
|
||||
REQ-027 (govulncheck offline mode) adds explicit work to P03: the CI
|
||||
job must be configured to NOT make outbound calls to `vuln.go.dev`
|
||||
(default `govulncheck` behavior). Two implementation paths are viable;
|
||||
PLAN chooses:
|
||||
- Pre-mirror the vulnerability database inside the CoreCI image
|
||||
(`GOVULNCHECK_DB=/path/to/local.db`).
|
||||
- Use `govulncheck -format json` (which always exits 0) and gate
|
||||
merges via a wrapper that parses the JSON and returns non-zero on
|
||||
unsuppressed findings.
|
||||
|
||||
**Operational prerequisite (P0 ship)**: repo + org visibility flipped to
|
||||
public (REQ-045) — unauth releases API + asset download + docker pull all
|
||||
verified HTTP 200.
|
||||
|
||||
**Milestone tag**: `v0.4.5` (final phase patch = milestone release per
|
||||
feature-milestone promotion rule). Per-phase tags: `v0.4.1`…`v0.4.5`.
|
||||
|
||||
## Milestone v0.6: Node Bootstrap & Proxmox
|
||||
|
||||
## Milestone v0.6: Node Bootstrap & Proxmox — **COMPLETE**
|
||||
|
||||
Scope: make `orca init` produce a fully working single-node cluster
|
||||
(CA + server cert + DB + localhost node registered with auto-detected
|
||||
OS), and add Proxmox 8 & 9 as a first-class remote node type joined
|
||||
over SSH with least-privilege role delegation.
|
||||
|
||||
- [x] Phase 0: Pre-execution (specify → clarify → research → plan → grill) — tag `v0.5.0`
|
||||
- [x] Phase 1: `orca init` full bootstrap + localhost node + schema 0006 (REQ-047, REQ-048, REQ-049) — tag `v0.5.1`
|
||||
- [x] Phase 2: Proxmox SSH join + OrcaOperator role + sudoers allowlist (REQ-050, REQ-051) — tag `v0.5.2`
|
||||
- [x] Phase 3: `doctor os` + `doctor proxmox` SSH probe + audit logging (REQ-052) — tag `v0.5.3`
|
||||
- [x] Phase 4: Final review + ship + audit (milestone release) — tag `v0.5.4`
|
||||
|
||||
**Milestone type**: feature (P1/P2/P3 ship `feat` phases).
|
||||
**Milestone tag**: `v0.5.4` (final phase patch = milestone release per
|
||||
feature-milestone promotion rule). Per-phase tags: `v0.5.0`…`v0.5.4`.
|
||||
|
||||
Tags run on the previous minor's patch line (v0.5.x) per
|
||||
branch-strategy.md. The milestone branch label uses the milestone
|
||||
number (`milestone/v0.6-node-bootstrap-proxmox`); no separate minor
|
||||
tag is created.
|
||||
|
||||
## Milestone v0.7: Hardening & Completion — **COMPLETE**
|
||||
|
||||
Scope: NFR milestone closing gaps surfaced by the v0.7 IDEATE stage —
|
||||
an unreachable command tree, a missing config file layer, low test
|
||||
coverage in core packages, and the long-deferred pprof endpoint.
|
||||
|
||||
- [x] Phase 0: Pre-execution (specify → clarify → research → ideate → plan) — tag `v0.6.0` (shipped)
|
||||
- [x] Phase 1: Register `orca cert` command tree + cert_repo tests (REQ-053) — tag `v0.6.1` (shipped)
|
||||
- [x] Phase 2: HCL config file parsing — `internal/config` package (REQ-054) — tag `v0.6.2` (shipped)
|
||||
- [x] Phase 3: Test coverage uplift — engine/transport/proxmox/audit ≥ 50% (REQ-055) — tag `v0.6.3` (shipped)
|
||||
- [x] Phase 4: `--pprof` opt-in on `orca daemon` (REQ-056) — tag `v0.6.4` (shipped)
|
||||
- [x] Phase 5: Final review + ship + audit (milestone release) — tag `v0.6.5` (shipped)
|
||||
|
||||
**Milestone type**: NFR (all phases are fix/test/chore; no `feat` phases).
|
||||
**Milestone tag**: `v0.6.5` (final phase patch = milestone release per
|
||||
NFR-milestone progressive-patch rule). Per-phase tags: `v0.6.0`…`v0.6.5`.
|
||||
Tags run on the previous minor's patch line (v0.6.x) per
|
||||
branch-strategy.md. The milestone branch label uses the milestone
|
||||
number (`milestone/v0.7-hardening-completion`); no separate minor tag.
|
||||
|
||||
## Milestone v0.8: Coverage & Trust Hardening
|
||||
|
||||
Scope: continue the v0.7 hardening theme. v0.7 P03's ≥ 50% floor left
|
||||
six packages still under 50% (engine 8.3%, proxmox 5.1%, cli 27.6%,
|
||||
transport 26.3%, store 46.7%, jobspec 47.6%) and three packages with
|
||||
no tests at all (`internal/audit`, `internal/certpaths`, `cmd/orca`).
|
||||
v0.8 also closes the two SSH-trust "future enhancement" hooks deferred
|
||||
in v0.6 (D-035 `--host-key-fingerprint` pre-pin, RESEARCH_v0.6 §80
|
||||
`orca node key-reset`) and adds a requirements-hygiene gate to prevent
|
||||
the stale-REQ-status drift seen after v0.7 ship.
|
||||
|
||||
- [ ] Phase 0: Pre-execution (specify → clarify → research → plan → grill) — tag `v0.7.0`
|
||||
- [ ] Phase 1: Test coverage uplift round 2 — 6 packages to ≥ 70%, 3 zero-test packages to first tests (REQ-057) — tag `v0.7.1`
|
||||
- [ ] Phase 2: SSH trust hardening — `--host-key-fingerprint` pre-pin + `orca node key-reset` + TOFU bugfix + `HostKeyFingerprint` population (REQ-058, REQ-059) — tag `v0.7.2`
|
||||
- [ ] Phase 3: Requirements-hygiene gate — `make verify-reqs` + verify assertion (REQ-060) — tag `v0.7.3`
|
||||
- [ ] Phase 4: Final review + ship + audit (milestone release) — tag `v0.7.4`
|
||||
|
||||
**Milestone type**: NFR (P01 test, P02 chore on trust surface per
|
||||
D-043, P03 chore, P04 docs/review). Final phase patch IS the milestone
|
||||
release per NFR-milestone progressive-patch rule. Per-phase tags:
|
||||
`v0.7.0`…`v0.7.4`. Tags run on the previous minor's patch line (v0.7.x)
|
||||
per branch-strategy.md. The milestone branch label uses the milestone
|
||||
number (`milestone/v0.8-coverage-trust-hardening`); no separate minor
|
||||
tag.
|
||||
|
||||
### Per-phase REQ coverage
|
||||
|
||||
- **P01 — Coverage uplift round 2**
|
||||
- REQ-057 (raise `internal/engine`, `internal/proxmox`,
|
||||
`internal/cli`, `internal/transport`, `internal/store`,
|
||||
`internal/jobspec` to ≥ 70%; add first tests for `internal/audit`,
|
||||
`internal/certpaths`, `cmd/orca`)
|
||||
|
||||
- **P02 — SSH trust hardening**
|
||||
- REQ-058 (`--host-key-fingerprint <sha256>` pre-pin flag on
|
||||
`orca node join --type proxmox`; fail fast on mismatch; supersedes
|
||||
TOFU for pre-pinned deployments)
|
||||
- REQ-059 (`orca node key-reset <node>` clears persisted SSH host
|
||||
key so next `doctor proxmox`/dispatch re-pins via TOFU or
|
||||
`--host-key-fingerprint`)
|
||||
|
||||
- **P03 — Requirements-hygiene gate**
|
||||
- REQ-060 (`make verify-reqs` target + verify-stage assertion:
|
||||
every REQ `Complete` in ROADMAP.md has matching `Complete` row in
|
||||
REQUIREMENTS.md; enforced in CI `validate` pipeline)
|
||||
|
||||
### v0.8 is a continuation milestone, not a direction change
|
||||
|
||||
The vision ("minimalist, offline-first, CLI-first orchestration
|
||||
engine") is unchanged. v0.8 closes the coverage debt left by v0.7's
|
||||
50% floor and the trust-surface gaps explicitly deferred in v0.6.
|
||||
Either path keeps the offline-first invariant (REQ-003) intact.
|
||||
|
||||
+3
-34
@@ -5,9 +5,9 @@
|
||||
"slug": "orca",
|
||||
"name": "Orca",
|
||||
"description": "Offline/CLI-first orchestration engine (Orca) — Nomad-inspired, far simpler than Kubernetes",
|
||||
"milestone": "v0.8",
|
||||
"milestone": "v0.1",
|
||||
"phase": 0,
|
||||
"milestone_type": "nfr",
|
||||
"milestone_type": "feature",
|
||||
"default_branch": "main",
|
||||
"tech_stack": {
|
||||
"language": "go",
|
||||
@@ -24,18 +24,12 @@
|
||||
],
|
||||
"active_project": "orca",
|
||||
"active_projects": ["orca"],
|
||||
"ship": {
|
||||
"per_phase": true,
|
||||
"allow_skip": false,
|
||||
"max_release_retries": 3
|
||||
},
|
||||
"autonomy": {
|
||||
"level": "full",
|
||||
"decision_confidence_threshold": 0.60,
|
||||
"max_revision_iterations": 3,
|
||||
"max_verification_retries": 2,
|
||||
"clarify_budget": 10,
|
||||
"escalation_hooks": ["deploy", "delete_data", "merge_to_main"]
|
||||
"escalation_hooks": ["delete", "drop", "force", "reset --hard"]
|
||||
},
|
||||
"workflow": {
|
||||
"no_hitl": true,
|
||||
@@ -120,31 +114,6 @@
|
||||
"url": "https://git.cloudinit.dev/coreci/orca.git",
|
||||
"main_branch": "main"
|
||||
},
|
||||
"release": {
|
||||
"forge": "gitea",
|
||||
"gitea": {
|
||||
"base_url": "https://git.cloudinit.dev",
|
||||
"owner": "coreci",
|
||||
"repo": "orca",
|
||||
"token_env": "GITEA_TOKEN"
|
||||
},
|
||||
"container_registry": {
|
||||
"forge": "gitea",
|
||||
"registry": "git.cloudinit.dev",
|
||||
"owner": "coreci",
|
||||
"image": "orca",
|
||||
"credential_env": "GITEA_TOKEN"
|
||||
}
|
||||
},
|
||||
"secrets": {
|
||||
"scopes": [
|
||||
{
|
||||
"name": "gitea",
|
||||
"vars": ["GITEA_TOKEN", "GITEA_USER"],
|
||||
"env_file": ".env"
|
||||
}
|
||||
]
|
||||
},
|
||||
"commands": {
|
||||
"test": "make test",
|
||||
"build": "make build",
|
||||
|
||||
-20
@@ -112,23 +112,3 @@ pipelines:
|
||||
--title "Orca ${VERSION}"
|
||||
--note-file CHANGELOG.md
|
||||
--asset orca-${VERSION}-linux-amd64.tar.gz
|
||||
- name: container-publish
|
||||
description: Build and publish OCI image to Gitea container registry (REQ-046)
|
||||
image: docker:24-cli
|
||||
env:
|
||||
GITEA_TOKEN: ${GITEA_TOKEN}
|
||||
VERSION: ${CI_COMMIT_TAG}
|
||||
GIT_COMMIT: ${CI_COMMIT_SHA}
|
||||
BUILD_TIME: ${CI_BUILD_TIME}
|
||||
commands:
|
||||
- docker build
|
||||
--build-arg VERSION=${VERSION}
|
||||
--build-arg GIT_COMMIT=${GIT_COMMIT}
|
||||
--build-arg BUILD_TIME=${BUILD_TIME}
|
||||
-t git.cloudinit.dev/coreci/orca:${VERSION}
|
||||
-t git.cloudinit.dev/coreci/orca:latest
|
||||
.
|
||||
- echo "${GITEA_TOKEN}" | docker login git.cloudinit.dev -u cloudinit-bot --password-stdin
|
||||
- docker push git.cloudinit.dev/coreci/orca:${VERSION}
|
||||
- docker push git.cloudinit.dev/coreci/orca:latest
|
||||
- docker logout git.cloudinit.dev
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
.git
|
||||
.githooks
|
||||
.bin
|
||||
bin/
|
||||
*.tar.gz
|
||||
*.tar.gz.asc
|
||||
.env
|
||||
.env.*
|
||||
.gitleaks-baseline.json
|
||||
.gitleaks.toml
|
||||
.golangci.yml
|
||||
.ciagent/
|
||||
testdata/
|
||||
docs/
|
||||
*.md
|
||||
!README.md
|
||||
LICENSE
|
||||
coverage.out
|
||||
orca
|
||||
orca-v*
|
||||
@@ -10,6 +10,4 @@ orca
|
||||
*.db-shm
|
||||
.env
|
||||
.env.local
|
||||
.env.secrets
|
||||
.env.*
|
||||
*.tar.gz
|
||||
|
||||
-56
@@ -1,56 +0,0 @@
|
||||
# Dockerfile — multi-stage build for orca
|
||||
#
|
||||
# Stage 1: build the static binary with golang:1.25
|
||||
# Stage 2: distroless static runtime (CGO-free, ~2MB image)
|
||||
#
|
||||
# Build args:
|
||||
# VERSION — semver tag injected via -ldflags (e.g. v0.4.4)
|
||||
# GIT_COMMIT — short commit hash
|
||||
# BUILD_TIME — ISO 8601 build timestamp
|
||||
#
|
||||
# Build:
|
||||
# docker build --build-arg VERSION=v0.4.4 -t git.cloudinit.dev/coreci/orca:v0.4.4 .
|
||||
#
|
||||
# Run:
|
||||
# docker run --rm git.cloudinit.dev/coreci/orca:v0.4.4 version
|
||||
# docker run --rm -v orca-data:/var/lib/orca git.cloudinit.dev/coreci/orca:v0.4.4 init
|
||||
|
||||
ARG VERSION=dev
|
||||
ARG GIT_COMMIT=unknown
|
||||
ARG BUILD_TIME=unknown
|
||||
|
||||
# --- Stage 1: build -------------------------------------------------------
|
||||
|
||||
FROM golang:1.25 AS builder
|
||||
|
||||
ARG VERSION
|
||||
ARG GIT_COMMIT
|
||||
ARG BUILD_TIME
|
||||
|
||||
WORKDIR /src
|
||||
|
||||
# Cache module downloads — copy go.mod/go.sum first, download, then copy source.
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
|
||||
COPY . .
|
||||
|
||||
# CGO_ENABLED=0 guarantees a static binary (modernc/sqlite is pure Go).
|
||||
RUN CGO_ENABLED=0 go build -trimpath \
|
||||
-ldflags="-s -w \
|
||||
-X git.cloudinit.dev/coreci/orca/internal/cli.version=${VERSION} \
|
||||
-X git.cloudinit.dev/coreci/orca/internal/cli.gitCommit=${GIT_COMMIT} \
|
||||
-X git.cloudinit.dev/coreci/orca/internal/cli.buildTime=${BUILD_TIME}" \
|
||||
-o /orca ./cmd/orca
|
||||
|
||||
# --- Stage 2: runtime -----------------------------------------------------
|
||||
|
||||
FROM gcr.io/distroless/static-debian12:nonroot
|
||||
|
||||
# ORCA_HOME points to a volume-mountable path inside the container.
|
||||
# Mount a volume at /var/lib/orca to persist state across container restarts.
|
||||
ENV ORCA_HOME=/var/lib/orca
|
||||
|
||||
COPY --from=builder /orca /orca
|
||||
|
||||
ENTRYPOINT ["/orca"]
|
||||
@@ -18,43 +18,16 @@ Offline/CLI-first orchestration engine inspired by HashiCorp Nomad, far simpler
|
||||
|
||||
## Quickstart
|
||||
|
||||
### Install (1-liner)
|
||||
|
||||
```bash
|
||||
# User-level install (binary at ~/.local/bin/orca, state at ~/.orca)
|
||||
curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash
|
||||
# Build
|
||||
make build
|
||||
|
||||
# System-level install (binary at /usr/local/bin/orca, state at /root/.orca)
|
||||
curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | sudo bash -s -- --system
|
||||
# Run
|
||||
./bin/orca version
|
||||
./bin/orca --help
|
||||
|
||||
# Pin a specific version
|
||||
curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash -s -- --version v0.4.2
|
||||
```
|
||||
|
||||
Then initialize local state and verify:
|
||||
|
||||
```bash
|
||||
orca init # creates ~/.orca/ (or /root/.orca with --system)
|
||||
orca version # prints version info
|
||||
orca --help # show all subcommands
|
||||
```
|
||||
|
||||
### Build from source
|
||||
|
||||
```bash
|
||||
make build # Build binary to ./bin/orca
|
||||
./bin/orca init # Initialize local state
|
||||
./bin/orca version # Verify
|
||||
```
|
||||
|
||||
### Update in place
|
||||
|
||||
Re-running the installer updates the binary while preserving your
|
||||
config, database, and certificates in the namespace dir:
|
||||
|
||||
```bash
|
||||
curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash
|
||||
# → "updated orca from v0.4.1 to v0.4.2"
|
||||
# Initialize local state
|
||||
./bin/orca init
|
||||
```
|
||||
|
||||
## Subcommands
|
||||
|
||||
+1
-9
@@ -8,16 +8,8 @@ import (
|
||||
)
|
||||
|
||||
func main() {
|
||||
os.Exit(run())
|
||||
}
|
||||
|
||||
// run executes the orca CLI and returns the process exit code. It is
|
||||
// extracted from main so tests can exercise the error path without
|
||||
// os.Exit terminating the test process.
|
||||
func run() int {
|
||||
if err := cli.Execute(); err != nil {
|
||||
fmt.Fprintf(os.Stderr, "error: %v\n", err)
|
||||
return 1
|
||||
os.Exit(1)
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
@@ -1,41 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"io"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestRunSuccess(t *testing.T) {
|
||||
orig := os.Args
|
||||
t.Cleanup(func() { os.Args = orig })
|
||||
os.Args = []string{"orca", "version"}
|
||||
if code := run(); code != 0 {
|
||||
t.Errorf("run() = %d, want 0", code)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunError(t *testing.T) {
|
||||
origArgs := os.Args
|
||||
t.Cleanup(func() { os.Args = origArgs })
|
||||
os.Args = []string{"orca", "job", "run", "/nonexistent/spec.hcl"}
|
||||
|
||||
r, w, err := os.Pipe()
|
||||
if err != nil {
|
||||
t.Fatalf("pipe: %v", err)
|
||||
}
|
||||
origStderr := os.Stderr
|
||||
os.Stderr = w
|
||||
t.Cleanup(func() { os.Stderr = origStderr })
|
||||
|
||||
code := run()
|
||||
w.Close()
|
||||
out, _ := io.ReadAll(r)
|
||||
if code != 1 {
|
||||
t.Errorf("run() = %d, want 1", code)
|
||||
}
|
||||
if !strings.Contains(string(out), "error:") {
|
||||
t.Errorf("stderr missing 'error:' prefix: %s", out)
|
||||
}
|
||||
}
|
||||
@@ -1,96 +0,0 @@
|
||||
# Docker Guide
|
||||
|
||||
Orca is available as a container image on the Gitea container registry.
|
||||
The image is a minimal distroless static build (~2MB runtime layer)
|
||||
that runs the orca binary directly.
|
||||
|
||||
## Image
|
||||
|
||||
```
|
||||
git.cloudinit.dev/coreci/orca:<version>
|
||||
git.cloudinit.dev/coreci/orca:latest
|
||||
```
|
||||
|
||||
The image is built from the `Dockerfile` in the repo root:
|
||||
- **Build stage**: `golang:1.25` — compiles a static binary with
|
||||
`CGO_ENABLED=0` (modernc/sqlite is pure Go, no CGO).
|
||||
- **Runtime stage**: `gcr.io/distroless/static-debian12:nonroot` —
|
||||
~2MB, no shell, runs as `nonroot` user.
|
||||
|
||||
## Pull
|
||||
|
||||
```bash
|
||||
docker pull git.cloudinit.dev/coreci/orca:latest
|
||||
# or pin a version
|
||||
docker pull git.cloudinit.dev/coreci/orca:v0.4.4
|
||||
```
|
||||
|
||||
The repo is public (REQ-045), so anonymous pull works without login.
|
||||
|
||||
## Run
|
||||
|
||||
```bash
|
||||
# Print version
|
||||
docker run --rm git.cloudinit.dev/coreci/orca:v0.4.4 version
|
||||
|
||||
# Initialize state (creates /var/lib/orca/ inside the container)
|
||||
docker run --rm -v orca-data:/var/lib/orca git.cloudinit.dev/coreci/orca:v0.4.4 init
|
||||
|
||||
# Run the daemon (persist state via volume)
|
||||
docker run -d --name orca \
|
||||
-p 8080:8080 \
|
||||
-v orca-data:/var/lib/orca \
|
||||
git.cloudinit.dev/coreci/orca:v0.4.4 daemon --addr=:8080
|
||||
```
|
||||
|
||||
## State Persistence
|
||||
|
||||
The image sets `ENV ORCA_HOME=/var/lib/orca`. All orca state (SQLite
|
||||
database, CA certs, server certs) is written under this path. To
|
||||
persist state across container restarts, mount a volume:
|
||||
|
||||
```bash
|
||||
docker volume create orca-data
|
||||
docker run --rm -v orca-data:/var/lib/orca git.cloudinit.dev/coreci/orca:v0.4.4 init
|
||||
docker run -d --name orca -p 8080:8080 -v orca-data:/var/lib/orca git.cloudinit.dev/coreci/orca:v0.4.4 daemon
|
||||
```
|
||||
|
||||
Without a volume, state is lost when the container exits.
|
||||
|
||||
## System-Level Namespace Inside Containers
|
||||
|
||||
The `--system` flag is not needed inside containers — the image already
|
||||
sets `ORCA_HOME=/var/lib/orca`. Use `--system` only if you want a
|
||||
different namespace root (e.g., `/root/.orca`), which requires running
|
||||
as root (the distroless image runs as `nonroot` by default).
|
||||
|
||||
## Build Locally
|
||||
|
||||
```bash
|
||||
docker build --build-arg VERSION=v0.4.4 -t orca-local:v0.4.4 .
|
||||
docker run --rm orca-local:v0.4.4 version
|
||||
```
|
||||
|
||||
Build args:
|
||||
- `VERSION` — semver tag (injected via `-ldflags`)
|
||||
- `GIT_COMMIT` — short commit hash
|
||||
- `BUILD_TIME` — ISO 8601 build timestamp
|
||||
|
||||
## Publish (for maintainers)
|
||||
|
||||
The `.coreci.yml` release pipeline includes a `container-publish` step
|
||||
that builds and pushes the image on every tag release. To publish
|
||||
manually:
|
||||
|
||||
```bash
|
||||
export GITEA_TOKEN=<token>
|
||||
docker build --build-arg VERSION=v0.4.4 -t git.cloudinit.dev/coreci/orca:v0.4.4 -t git.cloudinit.dev/coreci/orca:latest .
|
||||
echo "$GITEA_TOKEN" | docker login git.cloudinit.dev -u cloudinit-bot --password-stdin
|
||||
docker push git.cloudinit.dev/coreci/orca:v0.4.4
|
||||
docker push git.cloudinit.dev/coreci/orca:latest
|
||||
```
|
||||
|
||||
## See Also
|
||||
|
||||
- [Install Guide](install.md) — binary install (alternative to Docker).
|
||||
- [Namespace and Paths](namespace.md) — `ORCA_HOME` and `--system` flag.
|
||||
-139
@@ -1,139 +0,0 @@
|
||||
# Install Guide
|
||||
|
||||
Orca is distributed as a single binary via a 1-liner installer that
|
||||
pulls from the public Gitea release artifacts. This guide covers
|
||||
user-level install, system-level install, in-place updates, version
|
||||
pinning, and troubleshooting.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- A Linux system with `curl` and `tar` installed.
|
||||
- For user-level install: write access to `~/.local/bin/`.
|
||||
- For system-level install: root (`sudo`) access.
|
||||
|
||||
## User-Level Install (Default)
|
||||
|
||||
```bash
|
||||
curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash
|
||||
```
|
||||
|
||||
This installs:
|
||||
- Binary: `~/.local/bin/orca`
|
||||
- Namespace root: `~/.orca/` (created by `orca init`)
|
||||
|
||||
If `~/.local/bin` is not on your `PATH`, add it:
|
||||
```bash
|
||||
echo 'export PATH="$PATH:$HOME/.local/bin"' >> ~/.bashrc
|
||||
source ~/.bashrc
|
||||
```
|
||||
|
||||
## System-Level Install
|
||||
|
||||
```bash
|
||||
curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | sudo bash -s -- --system
|
||||
```
|
||||
|
||||
This installs:
|
||||
- Binary: `/usr/local/bin/orca`
|
||||
- Namespace root: `/root/.orca/` (created by `orca --system init`)
|
||||
|
||||
The `--system` flag requires root (uid 0). It errors if `ORCA_HOME` is
|
||||
already set to a conflicting value.
|
||||
|
||||
## Initialize State
|
||||
|
||||
After installing, initialize the local state directory:
|
||||
|
||||
```bash
|
||||
# User-level
|
||||
orca init
|
||||
|
||||
# System-level
|
||||
orca --system init
|
||||
```
|
||||
|
||||
This creates the namespace root directory (`~/.orca` or `/root/.orca`).
|
||||
|
||||
## Version Pinning
|
||||
|
||||
By default, the installer fetches the **latest** release. To pin a
|
||||
specific version:
|
||||
|
||||
```bash
|
||||
curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash -s -- --version v0.4.2
|
||||
```
|
||||
|
||||
## In-Place Update
|
||||
|
||||
Re-running the installer updates the binary in place while **preserving**
|
||||
your config, database, and certificates in the namespace dir:
|
||||
|
||||
```bash
|
||||
curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash
|
||||
```
|
||||
|
||||
Output:
|
||||
```
|
||||
install: ✓ updated orca from v0.4.1 to v0.4.2 at /home/user/.local/bin/orca
|
||||
```
|
||||
|
||||
The installer:
|
||||
1. Detects the existing binary at the install path.
|
||||
2. Reads its version via `orca version --json`.
|
||||
3. Downloads the new release.
|
||||
4. Overwrites the binary.
|
||||
5. **Never touches** the namespace dir (`~/.orca` or `/root/.orca`).
|
||||
|
||||
## Uninstall
|
||||
|
||||
```bash
|
||||
# Remove the binary
|
||||
rm ~/.local/bin/orca # user-level
|
||||
sudo rm /usr/local/bin/orca # system-level
|
||||
|
||||
# Optionally remove state (THIS DELETES YOUR DATABASE + CERTS)
|
||||
rm -rf ~/.orca # user-level
|
||||
sudo rm -rf /root/.orca # system-level
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### `install: error: --system requires root`
|
||||
|
||||
The `--system` flag requires root. Re-run with `sudo`:
|
||||
```bash
|
||||
curl -fsSL ... | sudo bash -s -- --system
|
||||
```
|
||||
|
||||
### `install: error: --system conflicts with ORCA_HOME=...`
|
||||
|
||||
`ORCA_HOME` is set to a non-system path. Either unset it or drop `--system`:
|
||||
```bash
|
||||
unset ORCA_HOME
|
||||
curl -fsSL ... | sudo bash -s -- --system
|
||||
```
|
||||
|
||||
### `install: error: could not find asset orca-vX.Y.Z-linux-amd64.tar.gz`
|
||||
|
||||
The requested version does not have a Linux release asset. Check
|
||||
available releases at
|
||||
`https://git.cloudinit.dev/coreci/orca/releases`.
|
||||
|
||||
### `install: error: unsupported architecture: ...`
|
||||
|
||||
The installer supports `amd64` (x86_64), `arm64` (aarch64), and `armv7`.
|
||||
Contact the maintainers if you need another architecture.
|
||||
|
||||
### `~/.local/bin is not on your PATH`
|
||||
|
||||
Add it to your shell profile:
|
||||
```bash
|
||||
echo 'export PATH="$PATH:$HOME/.local/bin"' >> ~/.bashrc
|
||||
source ~/.bashrc
|
||||
```
|
||||
|
||||
## See Also
|
||||
|
||||
- [Namespace and Paths](namespace.md) — `ORCA_HOME`, `--system`, path layout.
|
||||
- [Docker Guide](docker.md) — running orca in a container.
|
||||
- [Development](../README.md#development) — building from source.
|
||||
@@ -1,96 +0,0 @@
|
||||
# Namespace and Paths
|
||||
|
||||
Orca stores all on-disk state (SQLite database, CA certs, server certs,
|
||||
config) under a single **namespace root** directory. This document
|
||||
describes how that root is resolved and how to override it.
|
||||
|
||||
## Default: User-Level (`~/.orca`)
|
||||
|
||||
By default, the namespace root is `~/.orca` (i.e., `$HOME/.orca`).
|
||||
All orca state lives under this directory:
|
||||
|
||||
| Path | Contents |
|
||||
|------|----------|
|
||||
| `~/.orca/orca.db` | SQLite database (jobs, nodes, tasks, audit log, capacity) |
|
||||
| `~/.orca/ca.crt` | CA certificate (PEM, mode 0644) |
|
||||
| `~/.orca/ca.key` | CA private key (PEM, mode 0600) |
|
||||
| `~/.orca/server.crt` | Server certificate (PEM, mode 0644) |
|
||||
| `~/.orca/server.key` | Server private key (PEM, mode 0600) |
|
||||
|
||||
## Override: `ORCA_HOME` Environment Variable (REQ-041)
|
||||
|
||||
Set the `ORCA_HOME` environment variable to change the namespace root
|
||||
for **all** orca components (database, certs, init, daemon):
|
||||
|
||||
```bash
|
||||
export ORCA_HOME=/var/lib/orca
|
||||
orca init # creates /var/lib/orca/
|
||||
orca daemon # reads /var/lib/orca/orca.db
|
||||
orca cert ca-init # writes CA to /var/lib/orca/
|
||||
```
|
||||
|
||||
This is the single source of truth for the namespace root. Every
|
||||
component that reads or writes on-disk state resolves the root via
|
||||
`ORCA_HOME` (falling back to `~/.orca` when unset).
|
||||
|
||||
### Use cases
|
||||
|
||||
- **Testing**: point `ORCA_HOME` at a temp directory.
|
||||
- **Multi-instance**: run multiple orca daemons on the same host with
|
||||
different `ORCA_HOME` values.
|
||||
- **Custom layout**: store state on a mounted volume
|
||||
(`ORCA_HOME=/mnt/orca-data`).
|
||||
|
||||
## System-Level: `--system` Flag (REQ-042)
|
||||
|
||||
The `--system` persistent flag selects the system-level namespace root
|
||||
`/root/.orca`. This is intended for root-owned system deployments
|
||||
(where orca runs as a system service under root):
|
||||
|
||||
```bash
|
||||
sudo orca --system init # creates /root/.orca/
|
||||
sudo orca --system daemon # reads /root/.orca/orca.db
|
||||
sudo orca --system cert ca-init # writes CA to /root/.orca/
|
||||
```
|
||||
|
||||
The `--system` flag is equivalent to setting `ORCA_HOME=/root/.orca`,
|
||||
but it is a CLI convenience that does not require exporting an env var.
|
||||
If `ORCA_HOME` is already set to a different value, `--system` returns
|
||||
an error (to avoid silent namespace mismatches).
|
||||
|
||||
### Path layout
|
||||
|
||||
System-level uses the same directory shape as user-level, just under
|
||||
`/root/.orca` instead of `~/.orca`:
|
||||
|
||||
| Path | Contents |
|
||||
|------|----------|
|
||||
| `/root/.orca/orca.db` | SQLite database |
|
||||
| `/root/.orca/ca.crt` | CA certificate |
|
||||
| `/root/.orca/ca.key` | CA private key |
|
||||
| `/root/.orca/server.crt` | Server certificate |
|
||||
| `/root/.orca/server.key` | Server private key |
|
||||
|
||||
## Resolution Order
|
||||
|
||||
1. If `--system` flag is passed → root is `/root/.orca` (errors if
|
||||
`ORCA_HOME` is set to a conflicting value).
|
||||
2. Else if `ORCA_HOME` is set → root is `$ORCA_HOME`.
|
||||
3. Else → root is `~/.orca` (`$HOME/.orca`).
|
||||
|
||||
## `ORCA_DB` Override
|
||||
|
||||
For finer-grained control, `ORCA_DB` overrides **only** the database
|
||||
path (not the cert paths). This is primarily a testing affordance. When
|
||||
`ORCA_DB` is set, certs still resolve under `ORCA_HOME` (or `~/.orca`).
|
||||
|
||||
```bash
|
||||
export ORCA_DB=/tmp/test.db
|
||||
orca daemon # uses /tmp/test.db for the DB, ~/.orca/ for certs
|
||||
```
|
||||
|
||||
## See Also
|
||||
|
||||
- [Install Guide](install.md) — 1-liner install with `install.sh`.
|
||||
- [Docker Guide](docker.md) — running orca in a container (uses
|
||||
`ORCA_HOME=/var/lib/orca` inside the image).
|
||||
@@ -6,7 +6,6 @@ require (
|
||||
github.com/google/uuid v1.6.0
|
||||
github.com/hashicorp/hcl/v2 v2.24.0
|
||||
github.com/spf13/cobra v1.8.1
|
||||
golang.org/x/crypto v0.54.0
|
||||
modernc.org/sqlite v1.51.0
|
||||
)
|
||||
|
||||
@@ -22,11 +21,11 @@ require (
|
||||
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
||||
github.com/spf13/pflag v1.0.5 // indirect
|
||||
github.com/zclconf/go-cty v1.16.3 // indirect
|
||||
golang.org/x/mod v0.37.0 // indirect
|
||||
golang.org/x/sync v0.22.0 // indirect
|
||||
golang.org/x/sys v0.47.0 // indirect
|
||||
golang.org/x/text v0.40.0 // indirect
|
||||
golang.org/x/tools v0.47.0 // indirect
|
||||
golang.org/x/mod v0.33.0 // indirect
|
||||
golang.org/x/sync v0.20.0 // indirect
|
||||
golang.org/x/sys v0.42.0 // indirect
|
||||
golang.org/x/text v0.25.0 // indirect
|
||||
golang.org/x/tools v0.42.0 // indirect
|
||||
modernc.org/libc v1.72.3 // indirect
|
||||
modernc.org/mathutil v1.7.1 // indirect
|
||||
modernc.org/memory v1.11.0 // indirect
|
||||
|
||||
@@ -38,21 +38,17 @@ github.com/zclconf/go-cty v1.16.3 h1:osr++gw2T61A8KVYHoQiFbFd1Lh3JOCXc/jFLJXKTxk
|
||||
github.com/zclconf/go-cty v1.16.3/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
|
||||
github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
|
||||
github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
|
||||
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
|
||||
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
|
||||
golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
|
||||
golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
|
||||
golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
|
||||
golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
|
||||
golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
|
||||
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
|
||||
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
|
||||
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
|
||||
golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
|
||||
golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
|
||||
golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
|
||||
golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
|
||||
golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
|
||||
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
|
||||
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
|
||||
golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
|
||||
golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
|
||||
golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
|
||||
|
||||
@@ -1,140 +0,0 @@
|
||||
package audit
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"errors"
|
||||
"log/slog"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/engine"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
func newTestAudit(t *testing.T) (*Audit, *store.AuditRepo, func()) {
|
||||
t.Helper()
|
||||
path := filepath.Join(t.TempDir(), "test.db")
|
||||
db, err := store.Open(path)
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
repo := store.NewAuditRepo(db)
|
||||
eng := engine.NewAudit(repo, nil)
|
||||
return New(eng), repo, func() { _ = db.Close() }
|
||||
}
|
||||
|
||||
func TestAudit_Emit(t *testing.T) {
|
||||
a, repo, cleanup := newTestAudit(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
a.Emit(ctx, ActionCertIssued, "cert:node-1", ResultSuccess, map[string]any{"cn": "node-1"})
|
||||
|
||||
entries, err := repo.List(ctx, 10)
|
||||
if err != nil {
|
||||
t.Fatalf("List: %v", err)
|
||||
}
|
||||
if len(entries) != 1 {
|
||||
t.Fatalf("expected 1 audit entry, got %d", len(entries))
|
||||
}
|
||||
e := entries[0]
|
||||
if e.Action != string(ActionCertIssued) {
|
||||
t.Errorf("action: got %q, want %q", e.Action, ActionCertIssued)
|
||||
}
|
||||
if e.Result != string(ResultSuccess) {
|
||||
t.Errorf("result: got %q, want %q", e.Result, ResultSuccess)
|
||||
}
|
||||
if e.Resource != "cert:node-1" {
|
||||
t.Errorf("resource: got %q, want cert:node-1", e.Resource)
|
||||
}
|
||||
if e.Actor != "security" {
|
||||
t.Errorf("actor: got %q, want security", e.Actor)
|
||||
}
|
||||
if e.Error != "" {
|
||||
t.Errorf("error: got %q, want empty", e.Error)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAudit_EmitWithErr(t *testing.T) {
|
||||
a, repo, cleanup := newTestAudit(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
a.EmitWithErr(ctx, ActionNodeHandshakeFail, "hs:node-2", errors.New("bad cert"), nil)
|
||||
|
||||
entries, err := repo.List(ctx, 10)
|
||||
if err != nil {
|
||||
t.Fatalf("List: %v", err)
|
||||
}
|
||||
if len(entries) != 1 {
|
||||
t.Fatalf("expected 1 audit entry, got %d", len(entries))
|
||||
}
|
||||
e := entries[0]
|
||||
if e.Result != string(ResultFailure) {
|
||||
t.Errorf("result: got %q, want %q", e.Result, ResultFailure)
|
||||
}
|
||||
if !strings.Contains(e.Error, "bad cert") {
|
||||
t.Errorf("error: got %q, want it to contain 'bad cert'", e.Error)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAudit_LogHandshakeOK(t *testing.T) {
|
||||
var buf bytes.Buffer
|
||||
logger := slog.New(slog.NewTextHandler(&buf, nil))
|
||||
LogHandshakeOK(logger, "peer-1", "AA:BB:CC")
|
||||
out := buf.String()
|
||||
for _, want := range []string{"event=mtls.handshake", "result=ok", "peer=peer-1", "cert_fp=AA:BB:CC"} {
|
||||
if !strings.Contains(out, want) {
|
||||
t.Errorf("LogHandshakeOK: output missing %q\noutput: %s", want, out)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestAudit_LogHandshakeFailed(t *testing.T) {
|
||||
var buf bytes.Buffer
|
||||
logger := slog.New(slog.NewTextHandler(&buf, nil))
|
||||
LogHandshakeFailed(logger, "peer-2", "", errors.New("tls: handshake"))
|
||||
out := buf.String()
|
||||
for _, want := range []string{"event=mtls.handshake", "result=failed", "peer=peer-2", "err=\"tls: handshake\""} {
|
||||
if !strings.Contains(out, want) {
|
||||
t.Errorf("LogHandshakeFailed: output missing %q\noutput: %s", want, out)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestAudit_LogHandshake_NilLogger(t *testing.T) {
|
||||
LogHandshakeOK(nil, "p", "fp")
|
||||
LogHandshakeFailed(nil, "p", "fp", errors.New("x"))
|
||||
}
|
||||
|
||||
func TestAudit_NilSafe(t *testing.T) {
|
||||
var a *Audit
|
||||
a.Emit(context.Background(), ActionCertIssued, "x", ResultSuccess, nil)
|
||||
a.EmitWithErr(context.Background(), ActionCertIssued, "x", errors.New("y"), nil)
|
||||
}
|
||||
|
||||
func TestAction_String(t *testing.T) {
|
||||
if got := ActionCertIssued.String(); got != "cert.issued" {
|
||||
t.Errorf("ActionCertIssued.String(): got %q, want cert.issued", got)
|
||||
}
|
||||
if got := ActionNodeHandshakeOK.String(); got != "node.handshake_ok" {
|
||||
t.Errorf("ActionNodeHandshakeOK.String(): got %q, want node.handshake_ok", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestResult_String(t *testing.T) {
|
||||
if got := ResultSuccess.String(); got != "success" {
|
||||
t.Errorf("ResultSuccess.String(): got %q, want success", got)
|
||||
}
|
||||
if got := ResultFailure.String(); got != "failure" {
|
||||
t.Errorf("ResultFailure.String(): got %q, want failure", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFormatAction(t *testing.T) {
|
||||
got := FormatAction(ActionCertIssued, ResultSuccess)
|
||||
want := "action=cert.issued result=success"
|
||||
if got != want {
|
||||
t.Errorf("FormatAction: got %q, want %q", got, want)
|
||||
}
|
||||
}
|
||||
@@ -36,29 +36,3 @@ func ServerCertPath() string { return filepath.Join(Dir(), "server.crt") }
|
||||
|
||||
// ServerKeyPath returns the path to server.key.
|
||||
func ServerKeyPath() string { return filepath.Join(Dir(), "server.key") }
|
||||
|
||||
// DBPath returns the path to the orca SQLite database. Honors $ORCA_DB
|
||||
// for testability and explicit override; otherwise defaults to
|
||||
// ~/.orca/orca.db under the same Dir() as the cert files.
|
||||
func DBPath() string {
|
||||
if p := os.Getenv("ORCA_DB"); p != "" {
|
||||
return p
|
||||
}
|
||||
return filepath.Join(Dir(), "orca.db")
|
||||
}
|
||||
|
||||
// SSHKeyPath returns the path to the orca SSH private key (Ed25519,
|
||||
// D-037). Used by `orca node join --type proxmox` to authenticate
|
||||
// to remote Proxmox hosts after the initial password-based bootstrap.
|
||||
// File mode 0600 (enforced by security.WriteKey).
|
||||
func SSHKeyPath() string { return filepath.Join(Dir(), "orca_ssh_key") }
|
||||
|
||||
// SSHPubPath returns the path to the orca SSH public key (authorized_keys
|
||||
// format). Deployed to remote Proxmox hosts during `orca node join`.
|
||||
// File mode 0644 (enforced by security.WriteCert).
|
||||
func SSHPubPath() string { return filepath.Join(Dir(), "orca_ssh_key.pub") }
|
||||
|
||||
// KnownHostsPath returns the path to the SSH known_hosts file used for
|
||||
// TOFU host-key pinning (D-035). Captured on first connect, verified
|
||||
// on all subsequent connects via golang.org/x/crypto/ssh/knownhosts.
|
||||
func KnownHostsPath() string { return filepath.Join(Dir(), "known_hosts") }
|
||||
|
||||
@@ -1,157 +0,0 @@
|
||||
package certpaths
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestPaths_HonorORCAHOME(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
// Ensure ORCA_DB doesn't leak from the environment / prior tests.
|
||||
t.Setenv("ORCA_DB", "")
|
||||
|
||||
cases := []struct {
|
||||
name string
|
||||
got string
|
||||
file string
|
||||
}{
|
||||
{"CACertPath", CACertPath(), "ca.crt"},
|
||||
{"CAKeyPath", CAKeyPath(), "ca.key"},
|
||||
{"ServerCertPath", ServerCertPath(), "server.crt"},
|
||||
{"ServerKeyPath", ServerKeyPath(), "server.key"},
|
||||
{"SSHKeyPath", SSHKeyPath(), "orca_ssh_key"},
|
||||
{"SSHPubPath", SSHPubPath(), "orca_ssh_key.pub"},
|
||||
{"KnownHostsPath", KnownHostsPath(), "known_hosts"},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
want := filepath.Join(dir, tc.file)
|
||||
if tc.got != want {
|
||||
t.Errorf("%s = %q, want %q", tc.name, tc.got, want)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// DBPath defaults to $ORCA_HOME/orca.db.
|
||||
if got, want := DBPath(), filepath.Join(dir, "orca.db"); got != want {
|
||||
t.Errorf("DBPath = %q, want %q", got, want)
|
||||
}
|
||||
|
||||
// Dir() returns ORCA_HOME verbatim.
|
||||
if got, want := Dir(), dir; got != want {
|
||||
t.Errorf("Dir = %q, want %q", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDBPath_OrcaDBOverride(t *testing.T) {
|
||||
home := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", home)
|
||||
custom := filepath.Join(t.TempDir(), "custom.db")
|
||||
t.Setenv("ORCA_DB", custom)
|
||||
|
||||
if got := DBPath(); got != custom {
|
||||
t.Errorf("DBPath = %q, want %q (ORCA_DB override)", got, custom)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDBPath_OrcaDBEmptyStringFallsBackToHome(t *testing.T) {
|
||||
home := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", home)
|
||||
t.Setenv("ORCA_DB", "")
|
||||
|
||||
want := filepath.Join(home, "orca.db")
|
||||
if got := DBPath(); got != want {
|
||||
t.Errorf("DBPath = %q, want %q", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDir_DefaultHomeFallback(t *testing.T) {
|
||||
// Unset ORCA_HOME so Dir() falls back to ~/.orca.
|
||||
// We can't reliably mutate the real HOME in a portable way, so just
|
||||
// assert that the returned path ends with the default subdir on the
|
||||
// current OS and is absolute.
|
||||
os.Unsetenv("ORCA_HOME")
|
||||
// Also clear ORCA_DB so DBPath's fallback to Dir() is exercised.
|
||||
os.Unsetenv("ORCA_DB")
|
||||
|
||||
home, err := os.UserHomeDir()
|
||||
if err != nil {
|
||||
t.Skipf("os.UserHomeDir: %v (cannot verify default fallback)", err)
|
||||
}
|
||||
want := filepath.Join(home, defaultCADir)
|
||||
if got := Dir(); got != want {
|
||||
t.Errorf("Dir() default = %q, want %q", got, want)
|
||||
}
|
||||
if got := CACertPath(); got != filepath.Join(want, "ca.crt") {
|
||||
t.Errorf("CACertPath default = %q, want %q", got, filepath.Join(want, "ca.crt"))
|
||||
}
|
||||
}
|
||||
|
||||
func TestDir_ORCAHOMEEmptyFallsBack(t *testing.T) {
|
||||
// Empty string ORCA_HOME is treated as unset → ~/.orca fallback.
|
||||
t.Setenv("ORCA_HOME", "")
|
||||
home, err := os.UserHomeDir()
|
||||
if err != nil {
|
||||
t.Skipf("os.UserHomeDir: %v", err)
|
||||
}
|
||||
want := filepath.Join(home, defaultCADir)
|
||||
if got := Dir(); got != want {
|
||||
t.Errorf("Dir() with empty ORCA_HOME = %q, want %q", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDir_ORCAHOMERelativePath(t *testing.T) {
|
||||
// A relative ORCA_HOME is honored verbatim (no cleaning/absolutizing).
|
||||
t.Setenv("ORCA_HOME", "relative/orca/home")
|
||||
if got, want := Dir(), "relative/orca/home"; got != want {
|
||||
t.Errorf("Dir() relative = %q, want %q", got, want)
|
||||
}
|
||||
// CACertPath joins the relative dir with ca.crt using filepath.Join.
|
||||
if got, want := CACertPath(), filepath.Join("relative/orca/home", "ca.crt"); got != want {
|
||||
t.Errorf("CACertPath relative = %q, want %q", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAllPaths_AreConsistentWithDir(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", "")
|
||||
|
||||
// Every *Path() must live under Dir() except DBPath which also does.
|
||||
base := Dir()
|
||||
for _, p := range []string{
|
||||
CACertPath(), CAKeyPath(),
|
||||
ServerCertPath(), ServerKeyPath(),
|
||||
SSHKeyPath(), SSHPubPath(),
|
||||
KnownHostsPath(), DBPath(),
|
||||
} {
|
||||
if !strings.HasPrefix(p, base+string(filepath.Separator)) && p != filepath.Join(base, filepath.Base(p)) {
|
||||
t.Errorf("path %q is not under Dir() %q", p, base)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestSSHPaths_Filenames(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
if got, want := filepath.Base(SSHKeyPath()), "orca_ssh_key"; got != want {
|
||||
t.Errorf("SSHKeyPath base = %q, want %q", got, want)
|
||||
}
|
||||
if got, want := filepath.Base(SSHPubPath()), "orca_ssh_key.pub"; got != want {
|
||||
t.Errorf("SSHPubPath base = %q, want %q", got, want)
|
||||
}
|
||||
if got, want := filepath.Base(KnownHostsPath()), "known_hosts"; got != want {
|
||||
t.Errorf("KnownHostsPath base = %q, want %q", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func init() {
|
||||
// On Windows the default home subdir is still ".orca"; the test for
|
||||
// default fallback uses os.UserHomeDir which is platform-aware. This
|
||||
// guard keeps the suite from running a meaningless check on plan9.
|
||||
_ = runtime.GOOS
|
||||
}
|
||||
@@ -1,113 +0,0 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
func TestAuditListEmpty(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"audit", "list"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("audit list: %v", err)
|
||||
}
|
||||
if !strings.Contains(buf.String(), "No audit entries") {
|
||||
t.Errorf("audit list empty output unexpected: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuditListJSONEmpty(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"audit", "list", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("audit list --json: %v", err)
|
||||
}
|
||||
var entries []map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &entries); err != nil {
|
||||
t.Fatalf("unmarshal audit json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if len(entries) != 0 {
|
||||
t.Errorf("audit list --json empty = %d entries, want 0", len(entries))
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuditListWithEntries(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
db, err := store.Open(certpaths.DBPath())
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo := store.NewAuditRepo(db)
|
||||
ctx := t.Context()
|
||||
if err := repo.Append(ctx, &store.AuditEntry{
|
||||
Actor: "test", Action: "test.action", Resource: "res", Result: "success",
|
||||
}); err != nil {
|
||||
t.Fatalf("append audit: %v", err)
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"audit", "list"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("audit list: %v", err)
|
||||
}
|
||||
out := buf.String()
|
||||
if !strings.Contains(out, "test.action") {
|
||||
t.Errorf("audit list missing entry: %s", out)
|
||||
}
|
||||
if !strings.Contains(out, "TIMESTAMP") {
|
||||
t.Errorf("audit list missing header: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuditListLimitFlag(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
db, err := store.Open(certpaths.DBPath())
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo := store.NewAuditRepo(db)
|
||||
ctx := t.Context()
|
||||
for i := 0; i < 5; i++ {
|
||||
if err := repo.Append(ctx, &store.AuditEntry{
|
||||
Actor: "test", Action: "test.action", Resource: "res", Result: "success",
|
||||
}); err != nil {
|
||||
t.Fatalf("append audit %d: %v", i, err)
|
||||
}
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"audit", "list", "--json", "--limit", "2"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("audit list --json --limit 2: %v", err)
|
||||
}
|
||||
var entries []map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &entries); err != nil {
|
||||
t.Fatalf("unmarshal audit json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if len(entries) != 2 {
|
||||
t.Errorf("audit list --limit 2 = %d entries, want 2", len(entries))
|
||||
}
|
||||
}
|
||||
@@ -253,7 +253,3 @@ func parseFirstCertDER(pemBytes []byte) []byte {
|
||||
}
|
||||
return block.Bytes
|
||||
}
|
||||
|
||||
func init() {
|
||||
rootCmd.AddCommand(NewCommand(slog.Default()))
|
||||
}
|
||||
|
||||
@@ -1,121 +0,0 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func runCertArgs(t *testing.T, args []string) (string, error) {
|
||||
t.Helper()
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs(args)
|
||||
defer func() {
|
||||
rootCmd.SetArgs(nil)
|
||||
rootCmd.SetOut(os.Stdout)
|
||||
rootCmd.SetErr(os.Stderr)
|
||||
}()
|
||||
err := rootCmd.Execute()
|
||||
return buf.String(), err
|
||||
}
|
||||
|
||||
func TestCertSmoke(t *testing.T) {
|
||||
t.Setenv("ORCA_HOME", t.TempDir())
|
||||
|
||||
t.Run("ca-init", func(t *testing.T) {
|
||||
out, err := runCertArgs(t, []string{"cert", "ca-init", "--cn", "test-ca"})
|
||||
if err != nil {
|
||||
t.Fatalf("ca-init: %v\n%s", err, out)
|
||||
}
|
||||
if !strings.Contains(out, "CA initialized") {
|
||||
t.Errorf("ca-init output unexpected: %s", out)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("gen", func(t *testing.T) {
|
||||
out, err := runCertArgs(t, []string{"cert", "gen", "--cn", "test-server", "--san", "localhost", "--san", "127.0.0.1"})
|
||||
if err != nil {
|
||||
t.Fatalf("gen: %v\n%s", err, out)
|
||||
}
|
||||
if !strings.Contains(out, "Server cert generated") {
|
||||
t.Errorf("gen output unexpected: %s", out)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("show", func(t *testing.T) {
|
||||
out, err := runCertArgs(t, []string{"cert", "show"})
|
||||
if err != nil {
|
||||
t.Fatalf("show: %v\n%s", err, out)
|
||||
}
|
||||
if strings.Contains(out, "PRIVATE KEY") {
|
||||
t.Errorf("show leaked private key material (REQ-035):\n%s", out)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("fingerprint_ca", func(t *testing.T) {
|
||||
out, err := runCertArgs(t, []string{"cert", "fingerprint", "--which", "ca"})
|
||||
if err != nil {
|
||||
t.Fatalf("fingerprint ca: %v\n%s", err, out)
|
||||
}
|
||||
fp := strings.TrimSpace(out)
|
||||
if len(fp) != 64 || !isHex(fp) {
|
||||
t.Errorf("ca fingerprint = %q, want 64 hex chars", fp)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("fingerprint_server", func(t *testing.T) {
|
||||
out, err := runCertArgs(t, []string{"cert", "fingerprint", "--which", "server"})
|
||||
if err != nil {
|
||||
t.Fatalf("fingerprint server: %v\n%s", err, out)
|
||||
}
|
||||
fp := strings.TrimSpace(out)
|
||||
if len(fp) != 64 || !isHex(fp) {
|
||||
t.Errorf("server fingerprint = %q, want 64 hex chars", fp)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("renew", func(t *testing.T) {
|
||||
out, err := runCertArgs(t, []string{"cert", "renew"})
|
||||
if err != nil {
|
||||
t.Fatalf("renew: %v\n%s", err, out)
|
||||
}
|
||||
if !strings.Contains(out, "rotated") {
|
||||
t.Errorf("renew output unexpected: %s", out)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("file_modes", func(t *testing.T) {
|
||||
dir := os.Getenv("ORCA_HOME")
|
||||
checks := []struct {
|
||||
path string
|
||||
want os.FileMode
|
||||
}{
|
||||
{"ca.crt", 0o644},
|
||||
{"ca.key", 0o600},
|
||||
{"server.crt", 0o644},
|
||||
{"server.key", 0o600},
|
||||
}
|
||||
for _, c := range checks {
|
||||
info, err := os.Stat(filepath.Join(dir, c.path))
|
||||
if err != nil {
|
||||
t.Fatalf("stat %s: %v", c.path, err)
|
||||
}
|
||||
if got := info.Mode().Perm(); got != c.want {
|
||||
t.Errorf("mode %s = %04o, want %04o (REQ-033)", c.path, got, c.want)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func isHex(s string) bool {
|
||||
for _, r := range s {
|
||||
if !((r >= '0' && r <= '9') || (r >= 'a' && r <= 'f') || (r >= 'A' && r <= 'F')) {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
@@ -1,37 +0,0 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestCertCommandRegistered(t *testing.T) {
|
||||
found := false
|
||||
for _, cmd := range rootCmd.Commands() {
|
||||
if strings.Fields(cmd.Use)[0] == "cert" {
|
||||
found = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
t.Fatal("cert command not registered on rootCmd")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCertSubcommands(t *testing.T) {
|
||||
expected := []string{"ca-init", "gen", "show", "renew", "fingerprint"}
|
||||
registered := make(map[string]bool)
|
||||
for _, cmd := range rootCmd.Commands() {
|
||||
if strings.Fields(cmd.Use)[0] != "cert" {
|
||||
continue
|
||||
}
|
||||
for _, sub := range cmd.Commands() {
|
||||
registered[strings.Fields(sub.Use)[0]] = true
|
||||
}
|
||||
}
|
||||
for _, name := range expected {
|
||||
if !registered[name] {
|
||||
t.Errorf("expected cert subcommand %q not registered", name)
|
||||
}
|
||||
}
|
||||
}
|
||||
+4
-14
@@ -20,7 +20,6 @@ import (
|
||||
|
||||
var (
|
||||
daemonAddr string
|
||||
pprofAddr string
|
||||
)
|
||||
|
||||
var daemonCmd = &cobra.Command{
|
||||
@@ -35,16 +34,11 @@ var daemonCmd = &cobra.Command{
|
||||
defer closer()
|
||||
|
||||
log := newLogger()
|
||||
addr := daemonAddr
|
||||
if cfg := configFromCtx(cmd.Context()); cfg != nil && cfg.ListenAddr != "" && !cmd.Flags().Changed("addr") {
|
||||
addr = cfg.ListenAddr
|
||||
}
|
||||
srv := daemon.NewServer(daemon.Options{
|
||||
DB: db,
|
||||
Log: log,
|
||||
Addr: addr,
|
||||
Actor: "daemon",
|
||||
PprofAddr: pprofAddr,
|
||||
DB: db,
|
||||
Log: log,
|
||||
Addr: daemonAddr,
|
||||
Actor: "daemon",
|
||||
})
|
||||
|
||||
// Wire the orca.v1.Dispatch service (v0.2 P02). The executor
|
||||
@@ -73,9 +67,6 @@ var daemonCmd = &cobra.Command{
|
||||
fmt.Fprintln(cmd.OutOrStdout(), " /v1/tasks - list tasks")
|
||||
fmt.Fprintln(cmd.OutOrStdout(), " /orca.v1.Dispatch/Submit - cross-node job submit (P02)")
|
||||
fmt.Fprintln(cmd.OutOrStdout(), " /orca.v1.Dispatch/Status - cross-node job status (P02)")
|
||||
if pprofAddr != "" {
|
||||
fmt.Fprintf(cmd.OutOrStdout(), " /debug/pprof/ (pprof) - %s\n", pprofAddr)
|
||||
}
|
||||
fmt.Fprintln(cmd.OutOrStdout(), " press Ctrl+C to stop")
|
||||
|
||||
ctx, stop := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM)
|
||||
@@ -95,7 +86,6 @@ var daemonCmd = &cobra.Command{
|
||||
|
||||
func init() {
|
||||
daemonCmd.Flags().StringVar(&daemonAddr, "addr", ":8080", "listen address")
|
||||
daemonCmd.Flags().StringVar(&pprofAddr, "pprof", "", "enable pprof endpoint on <addr> (e.g. :6060); unauthenticated, operator-only")
|
||||
rootCmd.AddCommand(daemonCmd)
|
||||
_ = slog.Default // keep import if unused above
|
||||
}
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
package cli
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestDaemonPprofFlag(t *testing.T) {
|
||||
f := daemonCmd.Flags().Lookup("pprof")
|
||||
if f == nil {
|
||||
t.Fatal("--pprof flag not registered on daemonCmd")
|
||||
}
|
||||
if f.DefValue != "" {
|
||||
t.Errorf("--pprof default = %q, want empty", f.DefValue)
|
||||
}
|
||||
}
|
||||
+3
-31
@@ -51,7 +51,7 @@ var doctorNetworkCmd = &cobra.Command{
|
||||
Use: "network",
|
||||
Short: "Run the network self-check (P02 impl)",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c := doctor.Network()
|
||||
c := doctor.NetworkStub()
|
||||
r, msg := c.Run(cmd.Context())
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "%-20s %-5s %s\n", c.Name, r, msg)
|
||||
return nil
|
||||
@@ -62,42 +62,14 @@ var doctorDBCmd = &cobra.Command{
|
||||
Use: "db",
|
||||
Short: "Run the database self-check (P02 impl)",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c := doctor.DB()
|
||||
c := doctor.DBStub()
|
||||
r, msg := c.Run(cmd.Context())
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "%-20s %-5s %s\n", c.Name, r, msg)
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
var doctorOSCmd = &cobra.Command{
|
||||
Use: "os",
|
||||
Short: "Run the OS detection self-check (v0.6 P03)",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c := doctor.OS()
|
||||
r, msg := c.Run(cmd.Context())
|
||||
if jsonOutput {
|
||||
return printJSON(doctor.CheckResult{Name: c.Name, Result: r, Message: msg})
|
||||
}
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "%-20s %-5s %s\n", c.Name, r, msg)
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
var doctorProxmoxCmd = &cobra.Command{
|
||||
Use: "proxmox",
|
||||
Short: "Run the proxmox node reachability self-check (v0.6 P03)",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
c := doctor.Proxmox()
|
||||
r, msg := c.Run(cmd.Context())
|
||||
if jsonOutput {
|
||||
return printJSON(doctor.CheckResult{Name: c.Name, Result: r, Message: msg})
|
||||
}
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "%-20s %-5s %s\n", c.Name, r, msg)
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
func init() {
|
||||
doctorCmd.AddCommand(doctorCertCmd, doctorNetworkCmd, doctorDBCmd, doctorOSCmd, doctorProxmoxCmd)
|
||||
doctorCmd.AddCommand(doctorCertCmd, doctorNetworkCmd, doctorDBCmd)
|
||||
rootCmd.AddCommand(doctorCmd)
|
||||
}
|
||||
|
||||
@@ -1,196 +0,0 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestDoctorText(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
if err := runInit(discardWriter{}); err != nil {
|
||||
t.Fatalf("init: %v", err)
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"doctor"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("doctor: %v", err)
|
||||
}
|
||||
out := buf.String()
|
||||
for _, want := range []string{"CA", "cert", "PASS", "WARN", "FAIL"} {
|
||||
_ = want
|
||||
}
|
||||
if !strings.Contains(out, "CA") {
|
||||
t.Errorf("doctor output missing CA check: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDoctorJSON(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
if err := runInit(discardWriter{}); err != nil {
|
||||
t.Fatalf("init: %v", err)
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"doctor", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("doctor --json: %v", err)
|
||||
}
|
||||
var checks []map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &checks); err != nil {
|
||||
t.Fatalf("unmarshal doctor json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if len(checks) == 0 {
|
||||
t.Errorf("doctor --json returned no checks: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestDoctorCertSubcommand(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
if err := runInit(discardWriter{}); err != nil {
|
||||
t.Fatalf("init: %v", err)
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"doctor", "cert"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("doctor cert: %v", err)
|
||||
}
|
||||
out := buf.String()
|
||||
if !strings.Contains(out, "CA") {
|
||||
t.Errorf("doctor cert output missing CA: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDoctorCertJSON(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
if err := runInit(discardWriter{}); err != nil {
|
||||
t.Fatalf("init: %v", err)
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"doctor", "cert", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("doctor cert --json: %v", err)
|
||||
}
|
||||
var results []map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &results); err != nil {
|
||||
t.Fatalf("unmarshal doctor cert json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if len(results) == 0 {
|
||||
t.Errorf("doctor cert --json returned no results: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestDoctorDBSubcommand(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
if err := runInit(discardWriter{}); err != nil {
|
||||
t.Fatalf("init: %v", err)
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"doctor", "db"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("doctor db: %v", err)
|
||||
}
|
||||
out := buf.String()
|
||||
if !strings.Contains(out, "db") {
|
||||
t.Errorf("doctor db output unexpected: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDoctorOSSubcommand(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
if err := runInit(discardWriter{}); err != nil {
|
||||
t.Fatalf("init: %v", err)
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"doctor", "os"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("doctor os: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDoctorOSJSON(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
if err := runInit(discardWriter{}); err != nil {
|
||||
t.Fatalf("init: %v", err)
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"doctor", "os", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("doctor os --json: %v", err)
|
||||
}
|
||||
var result map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
|
||||
t.Fatalf("unmarshal doctor os json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if result["Name"] == nil {
|
||||
t.Errorf("doctor os --json missing Name: %v", result)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDoctorNetworkSubcommand(t *testing.T) {
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"doctor", "network"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("doctor network: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDoctorProxmoxSubcommand(t *testing.T) {
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"doctor", "proxmox"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("doctor proxmox: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDoctorProxmoxJSON(t *testing.T) {
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"doctor", "proxmox", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("doctor proxmox --json: %v", err)
|
||||
}
|
||||
var result map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
|
||||
t.Fatalf("unmarshal doctor proxmox json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if result["Name"] == nil {
|
||||
t.Errorf("doctor proxmox --json missing Name: %v", result)
|
||||
}
|
||||
}
|
||||
+20
-176
@@ -1,194 +1,38 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"time"
|
||||
"path/filepath"
|
||||
|
||||
"github.com/google/uuid"
|
||||
"github.com/spf13/cobra"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
||||
"git.cloudinit.dev/coreci/orca/internal/model"
|
||||
"git.cloudinit.dev/coreci/orca/internal/security"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
const (
|
||||
initCAN = "orca-internal-ca"
|
||||
localhostName = "localhost"
|
||||
localhostAddr = "localhost:8443"
|
||||
)
|
||||
|
||||
var initCmd = &cobra.Command{
|
||||
Use: "init",
|
||||
Short: "Initialize local orca state with full bootstrap",
|
||||
Long: `Initialize the local orca state directory and provision all
|
||||
dependencies required for ` + "`orca doctor`" + ` to pass:
|
||||
|
||||
1. Create the namespace directory (honors $ORCA_HOME; defaults to ~/.orca)
|
||||
2. Open and migrate the SQLite database (migrations 0001..0006)
|
||||
3. Bootstrap the internal CA (ca.crt + ca.key) if not already present
|
||||
4. Generate the server cert (server.crt + server.key) if not already present
|
||||
5. Auto-detect the local OS via /etc/os-release
|
||||
6. Register a localhost node (kind=localhost, os=<detected>)
|
||||
|
||||
Idempotent: re-running is safe and will refresh last_seen + os on the
|
||||
localhost node without regenerating certs or changing the node ID.`,
|
||||
Short: "Initialize local orca state directory",
|
||||
Long: "Create the local orca state directory at ~/.orca/ and write a default config file.",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return runInit(cmd.OutOrStdout())
|
||||
home, err := os.UserHomeDir()
|
||||
if err != nil {
|
||||
return fmt.Errorf("get home dir: %w", err)
|
||||
}
|
||||
orcaDir := filepath.Join(home, ".orca")
|
||||
if err := os.MkdirAll(orcaDir, 0o755); err != nil {
|
||||
return fmt.Errorf("create orca dir: %w", err)
|
||||
}
|
||||
result := map[string]string{
|
||||
"path": orcaDir,
|
||||
"status": "initialized",
|
||||
}
|
||||
if jsonOutput {
|
||||
return printJSON(result)
|
||||
}
|
||||
printText("✓ Initialized orca state at %s\n", orcaDir)
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
func runInit(out interface{ Write([]byte) (int, error) }) error {
|
||||
dir := certpaths.Dir()
|
||||
|
||||
type stepResult struct {
|
||||
Label string `json:"label"`
|
||||
Status string `json:"status"`
|
||||
Detail string `json:"detail,omitempty"`
|
||||
}
|
||||
type initSummary struct {
|
||||
Namespace string `json:"namespace"`
|
||||
Database string `json:"database"`
|
||||
CAFingerprint string `json:"ca_fingerprint,omitempty"`
|
||||
CertFingerprint string `json:"cert_fingerprint,omitempty"`
|
||||
OS string `json:"os"`
|
||||
NodeID string `json:"node_id"`
|
||||
NodeName string `json:"node_name"`
|
||||
Steps []stepResult `json:"steps"`
|
||||
}
|
||||
summary := initSummary{Namespace: dir}
|
||||
|
||||
// Step 1: namespace dir.
|
||||
if err := os.MkdirAll(dir, 0o755); err != nil {
|
||||
return fmt.Errorf("create orca dir: %w", err)
|
||||
}
|
||||
summary.Steps = append(summary.Steps, stepResult{Label: "namespace", Status: "ok", Detail: dir})
|
||||
if !jsonOutput {
|
||||
fmt.Fprintf(out, "✓ Namespace dir: %s\n", dir)
|
||||
}
|
||||
|
||||
// Step 2: database + migrations.
|
||||
dbPath := certpaths.DBPath()
|
||||
db, err := store.Open(dbPath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("open database: %w", err)
|
||||
}
|
||||
defer db.Close()
|
||||
summary.Database = dbPath
|
||||
summary.Steps = append(summary.Steps, stepResult{Label: "database", Status: "ok", Detail: dbPath})
|
||||
if !jsonOutput {
|
||||
fmt.Fprintf(out, "✓ Database initialized: %s\n", dbPath)
|
||||
}
|
||||
|
||||
// Step 3: CA bootstrap (idempotent — CAInit has a fast-path).
|
||||
ca, err := security.CAInit(dir, initCAN)
|
||||
if err != nil {
|
||||
return fmt.Errorf("bootstrap CA: %w", err)
|
||||
}
|
||||
caFp := ca.Fingerprint()
|
||||
summary.CAFingerprint = caFp
|
||||
summary.Steps = append(summary.Steps, stepResult{Label: "ca", Status: "ok", Detail: caFp[:16] + "..."})
|
||||
if !jsonOutput {
|
||||
fmt.Fprintf(out, "✓ CA provisioned: fp=%s\n", caFp[:16]+"...")
|
||||
}
|
||||
|
||||
// Step 4: server cert (only if absent — D-036 idempotency).
|
||||
certPath := certpaths.ServerCertPath()
|
||||
certFp := ""
|
||||
if _, err := os.Stat(certPath); err == nil {
|
||||
// Already exists — load fingerprint for the summary.
|
||||
if fp, err := security.Fingerprint(certPath); err == nil {
|
||||
certFp = fp
|
||||
}
|
||||
summary.Steps = append(summary.Steps, stepResult{Label: "server-cert", Status: "skipped", Detail: "already present"})
|
||||
} else if os.IsNotExist(err) {
|
||||
keyPEM, csrPEM, err := security.GenerateCSR("localhost", []string{"localhost", "127.0.0.1"})
|
||||
if err != nil {
|
||||
return fmt.Errorf("generate server CSR: %w", err)
|
||||
}
|
||||
certPEM, err := ca.SignCSR(csrPEM)
|
||||
if err != nil {
|
||||
return fmt.Errorf("sign server CSR: %w", err)
|
||||
}
|
||||
if err := security.WriteCert(certPath, certPEM); err != nil {
|
||||
return fmt.Errorf("write server cert: %w", err)
|
||||
}
|
||||
if err := security.WriteKey(certpaths.ServerKeyPath(), keyPEM); err != nil {
|
||||
return fmt.Errorf("write server key: %w", err)
|
||||
}
|
||||
certFp = security.FingerprintOf(parseFirstCertDER(certPEM))
|
||||
summary.Steps = append(summary.Steps, stepResult{Label: "server-cert", Status: "ok", Detail: certFp[:16] + "..."})
|
||||
} else {
|
||||
return fmt.Errorf("stat server cert: %w", err)
|
||||
}
|
||||
summary.CertFingerprint = certFp
|
||||
if !jsonOutput {
|
||||
if certFp != "" {
|
||||
fmt.Fprintf(out, "✓ Server cert provisioned: fp=%s\n", certFp[:16]+"...")
|
||||
} else {
|
||||
fmt.Fprintf(out, "✓ Server cert: already present\n")
|
||||
}
|
||||
}
|
||||
|
||||
// Step 5: OS detection.
|
||||
osDetected := detectOS()
|
||||
summary.OS = osDetected
|
||||
summary.Steps = append(summary.Steps, stepResult{Label: "os", Status: "ok", Detail: osDetected})
|
||||
if !jsonOutput {
|
||||
fmt.Fprintf(out, "✓ OS detected: %s\n", osDetected)
|
||||
}
|
||||
|
||||
// Step 6: localhost node upsert (idempotent per D-036).
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
defer cancel()
|
||||
|
||||
repo := store.NewNodeRepo(db)
|
||||
existing, err := repo.GetByName(ctx, localhostName)
|
||||
if err == nil {
|
||||
// Refresh last_seen + os; keep id and joined_at.
|
||||
if err := repo.UpdateLastSeenAndOS(ctx, existing.ID, osDetected); err != nil {
|
||||
return fmt.Errorf("refresh localhost node: %w", err)
|
||||
}
|
||||
summary.NodeID = existing.ID
|
||||
summary.NodeName = existing.Name
|
||||
summary.Steps = append(summary.Steps, stepResult{Label: "localhost-node", Status: "refreshed", Detail: existing.ID})
|
||||
if !jsonOutput {
|
||||
fmt.Fprintf(out, "✓ Localhost node refreshed: %s (os=%s)\n", existing.ID, osDetected)
|
||||
}
|
||||
} else if err == store.ErrNotFound {
|
||||
node := &model.Node{
|
||||
ID: uuid.NewString(),
|
||||
Name: localhostName,
|
||||
Address: localhostAddr,
|
||||
State: model.NodeStateReady,
|
||||
JoinedAt: time.Now().UTC(),
|
||||
LastSeen: time.Now().UTC(),
|
||||
Kind: string(model.NodeKindLocalhost),
|
||||
OS: osDetected,
|
||||
}
|
||||
if err := repo.Insert(ctx, node); err != nil {
|
||||
return fmt.Errorf("insert localhost node: %w", err)
|
||||
}
|
||||
summary.NodeID = node.ID
|
||||
summary.NodeName = node.Name
|
||||
summary.Steps = append(summary.Steps, stepResult{Label: "localhost-node", Status: "ok", Detail: node.ID})
|
||||
if !jsonOutput {
|
||||
fmt.Fprintf(out, "✓ Localhost node registered: %s (os=%s)\n", node.ID, osDetected)
|
||||
}
|
||||
} else {
|
||||
return fmt.Errorf("lookup localhost node: %w", err)
|
||||
}
|
||||
|
||||
if jsonOutput {
|
||||
return printJSON(summary)
|
||||
}
|
||||
fmt.Fprintf(out, "\n✓ orca init complete — run `orca doctor` to verify.\n")
|
||||
return nil
|
||||
}
|
||||
|
||||
func init() {
|
||||
rootCmd.AddCommand(initCmd)
|
||||
}
|
||||
|
||||
@@ -1,205 +0,0 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"context"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
||||
"git.cloudinit.dev/coreci/orca/internal/model"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
// initTestEnv sets ORCA_HOME to a temp dir and returns a cleanup func.
|
||||
func initTestEnv(t *testing.T) (string, func()) {
|
||||
t.Helper()
|
||||
dir := t.TempDir()
|
||||
orig := os.Getenv("ORCA_HOME")
|
||||
if err := os.Setenv("ORCA_HOME", dir); err != nil {
|
||||
t.Fatalf("set ORCA_HOME: %v", err)
|
||||
}
|
||||
return dir, func() {
|
||||
if err := os.Setenv("ORCA_HOME", orig); err != nil {
|
||||
t.Fatalf("restore ORCA_HOME: %v", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// discardWriter is an io.Writer that discards all output (for tests
|
||||
// that don't need to inspect init stdout).
|
||||
type discardWriter struct{}
|
||||
|
||||
func (discardWriter) Write(p []byte) (int, error) { return len(p), nil }
|
||||
|
||||
var _ io.Writer = discardWriter{}
|
||||
|
||||
func TestInit_FullBootstrap(t *testing.T) {
|
||||
dir, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
|
||||
if err := runInit(discardWriter{}); err != nil {
|
||||
t.Fatalf("init: %v", err)
|
||||
}
|
||||
|
||||
// Verify namespace dir exists.
|
||||
if _, err := os.Stat(dir); err != nil {
|
||||
t.Errorf("namespace dir missing: %v", err)
|
||||
}
|
||||
|
||||
// Verify CA files exist with correct modes.
|
||||
caCert := certpaths.CACertPath()
|
||||
caKey := certpaths.CAKeyPath()
|
||||
if _, err := os.Stat(caCert); err != nil {
|
||||
t.Errorf("ca.crt missing: %v", err)
|
||||
}
|
||||
if info, err := os.Stat(caKey); err == nil {
|
||||
if info.Mode().Perm() != 0o600 {
|
||||
t.Errorf("ca.key mode = %04o, want 0600", info.Mode().Perm())
|
||||
}
|
||||
} else {
|
||||
t.Errorf("ca.key missing: %v", err)
|
||||
}
|
||||
|
||||
// Verify server cert exists.
|
||||
if _, err := os.Stat(certpaths.ServerCertPath()); err != nil {
|
||||
t.Errorf("server.crt missing: %v", err)
|
||||
}
|
||||
|
||||
// Verify DB exists and has migrations applied.
|
||||
db, err := store.Open(certpaths.DBPath())
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
ctx := context.Background()
|
||||
version, err := store.MigrationVersion(ctx, db)
|
||||
if err != nil {
|
||||
t.Fatalf("migration version: %v", err)
|
||||
}
|
||||
if version != "0007_certs_serial_unique.sql" {
|
||||
t.Errorf("migration version = %q, want 0007_certs_serial_unique.sql", version)
|
||||
}
|
||||
|
||||
// Verify localhost node registered with kind=localhost.
|
||||
repo := store.NewNodeRepo(db)
|
||||
node, err := repo.GetByName(ctx, "localhost")
|
||||
if err != nil {
|
||||
t.Fatalf("get localhost node: %v", err)
|
||||
}
|
||||
if node.Kind != string(model.NodeKindLocalhost) {
|
||||
t.Errorf("node kind = %q, want localhost", node.Kind)
|
||||
}
|
||||
if node.OS == "" {
|
||||
t.Errorf("node os is empty, expected detected value")
|
||||
}
|
||||
if node.Address != "localhost:8443" {
|
||||
t.Errorf("node address = %q, want localhost:8443", node.Address)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInit_IdempotentReRun(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
|
||||
// First init.
|
||||
if err := runInit(discardWriter{}); err != nil {
|
||||
t.Fatalf("first init: %v", err)
|
||||
}
|
||||
|
||||
// Capture first-run state.
|
||||
caCertBefore, _ := os.ReadFile(certpaths.CACertPath())
|
||||
serverCertBefore, _ := os.ReadFile(certpaths.ServerCertPath())
|
||||
|
||||
db, err := store.Open(certpaths.DBPath())
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
repo := store.NewNodeRepo(db)
|
||||
ctx := context.Background()
|
||||
nodeBefore, err := repo.GetByName(ctx, "localhost")
|
||||
if err != nil {
|
||||
t.Fatalf("get node before: %v", err)
|
||||
}
|
||||
nodeIDBefore := nodeBefore.ID
|
||||
joinedAtBefore := nodeBefore.JoinedAt
|
||||
if err := db.Close(); err != nil {
|
||||
t.Fatalf("close db: %v", err)
|
||||
}
|
||||
|
||||
// Wait a moment so last_seen can differ.
|
||||
time.Sleep(50 * time.Millisecond)
|
||||
|
||||
// Second init (should be idempotent).
|
||||
if err := runInit(discardWriter{}); err != nil {
|
||||
t.Fatalf("second init: %v", err)
|
||||
}
|
||||
|
||||
// CA and server cert must NOT have been regenerated.
|
||||
caCertAfter, _ := os.ReadFile(certpaths.CACertPath())
|
||||
serverCertAfter, _ := os.ReadFile(certpaths.ServerCertPath())
|
||||
if string(caCertBefore) != string(caCertAfter) {
|
||||
t.Error("CA was regenerated on re-run (D-036 violation)")
|
||||
}
|
||||
if string(serverCertBefore) != string(serverCertAfter) {
|
||||
t.Error("server cert was regenerated on re-run (D-036 violation)")
|
||||
}
|
||||
|
||||
// Node ID and joined_at must be unchanged; last_seen should be refreshed.
|
||||
db, err = store.Open(certpaths.DBPath())
|
||||
if err != nil {
|
||||
t.Fatalf("reopen db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo = store.NewNodeRepo(db)
|
||||
nodeAfter, err := repo.GetByName(ctx, "localhost")
|
||||
if err != nil {
|
||||
t.Fatalf("get node after: %v", err)
|
||||
}
|
||||
if nodeAfter.ID != nodeIDBefore {
|
||||
t.Errorf("node id changed: was %s, now %s (D-036 violation)", nodeIDBefore, nodeAfter.ID)
|
||||
}
|
||||
if !nodeAfter.JoinedAt.Equal(joinedAtBefore) {
|
||||
t.Errorf("joined_at changed: was %v, now %v (D-036 violation)", joinedAtBefore, nodeAfter.JoinedAt)
|
||||
}
|
||||
if !nodeAfter.LastSeen.After(joinedAtBefore) {
|
||||
t.Errorf("last_seen not refreshed: was %v, now %v", joinedAtBefore, nodeAfter.LastSeen)
|
||||
}
|
||||
|
||||
// No duplicate localhost nodes.
|
||||
nodes, err := repo.List(ctx)
|
||||
if err != nil {
|
||||
t.Fatalf("list nodes: %v", err)
|
||||
}
|
||||
localhostCount := 0
|
||||
for _, n := range nodes {
|
||||
if n.Name == "localhost" {
|
||||
localhostCount++
|
||||
}
|
||||
}
|
||||
if localhostCount != 1 {
|
||||
t.Errorf("found %d localhost nodes, want 1 (idempotency)", localhostCount)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInit_NamespaceDirCreation(t *testing.T) {
|
||||
dir, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
|
||||
// The namespace dir is the ORCA_HOME temp dir itself — but let's
|
||||
// point at a non-existent subdir to test MkdirAll.
|
||||
subDir := filepath.Join(dir, "nested", "orca-state")
|
||||
if err := os.Setenv("ORCA_HOME", subDir); err != nil {
|
||||
t.Fatalf("set ORCA_HOME: %v", err)
|
||||
}
|
||||
|
||||
if err := runInit(discardWriter{}); err != nil {
|
||||
t.Fatalf("init with nested dir: %v", err)
|
||||
}
|
||||
if _, err := os.Stat(subDir); err != nil {
|
||||
t.Errorf("nested namespace dir not created: %v", err)
|
||||
}
|
||||
}
|
||||
+1
-76
@@ -5,9 +5,6 @@ import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/signal"
|
||||
"syscall"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
@@ -39,7 +36,6 @@ var (
|
||||
stopID string
|
||||
runTarget string
|
||||
runIDKey string
|
||||
jobWatch bool
|
||||
)
|
||||
|
||||
var jobRunCmd = &cobra.Command{
|
||||
@@ -116,11 +112,8 @@ var jobRunCmd = &cobra.Command{
|
||||
var jobListCmd = &cobra.Command{
|
||||
Use: "list",
|
||||
Short: "List all jobs",
|
||||
Long: "Display all jobs and their status. Use --watch to stream updates until Ctrl-C.",
|
||||
Long: "Display all jobs and their status.",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
if jobWatch {
|
||||
return watchJobs(cmd)
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
|
||||
defer cancel()
|
||||
|
||||
@@ -149,73 +142,6 @@ var jobListCmd = &cobra.Command{
|
||||
},
|
||||
}
|
||||
|
||||
func watchJobs(cmd *cobra.Command) error {
|
||||
ctx, cancel := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM)
|
||||
defer cancel()
|
||||
return watchJobsCtx(cmd, ctx)
|
||||
}
|
||||
|
||||
func watchJobsCtx(cmd *cobra.Command, ctx context.Context) error {
|
||||
db, closer, err := openDB()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer closer()
|
||||
|
||||
out := cmd.OutOrStdout()
|
||||
|
||||
if jsonOutput {
|
||||
seen := make(map[string]string)
|
||||
for snapshot := range store.NewJobRepo(db).Watch(ctx) {
|
||||
current := make(map[string]bool, len(snapshot))
|
||||
for _, j := range snapshot {
|
||||
current[j.ID] = true
|
||||
compact, _ := json.Marshal(j)
|
||||
key := string(compact)
|
||||
if prev, ok := seen[j.ID]; !ok || prev != key {
|
||||
event := "init"
|
||||
if ok {
|
||||
event = "update"
|
||||
}
|
||||
line, _ := json.Marshal(map[string]any{"event": event, "job": j})
|
||||
fmt.Fprintln(out, string(line))
|
||||
seen[j.ID] = key
|
||||
}
|
||||
}
|
||||
for id := range seen {
|
||||
if !current[id] {
|
||||
line, _ := json.Marshal(map[string]any{"event": "delete", "id": id})
|
||||
fmt.Fprintln(out, string(line))
|
||||
delete(seen, id)
|
||||
}
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
prevTable := ""
|
||||
for snapshot := range store.NewJobRepo(db).Watch(ctx) {
|
||||
table := renderJobTable(snapshot)
|
||||
if table != prevTable {
|
||||
fmt.Fprint(out, "\033[2J\033[H")
|
||||
fmt.Fprint(out, table)
|
||||
prevTable = table
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func renderJobTable(jobs []*model.Job) string {
|
||||
if len(jobs) == 0 {
|
||||
return "No jobs.\n"
|
||||
}
|
||||
out := fmt.Sprintf("%-36s %-20s %-12s %-8s\n", "ID", "NAME", "STATUS", "EXIT")
|
||||
for _, j := range jobs {
|
||||
out += fmt.Sprintf("%-36s %-20s %-12s %-8d\n", j.ID, j.Name, j.Status, j.ExitCode)
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
var jobStopCmd = &cobra.Command{
|
||||
Use: "stop [job-id]",
|
||||
Short: "Stop a running job",
|
||||
@@ -309,7 +235,6 @@ func init() {
|
||||
jobLogsCmd.Flags().StringVar(&stopID, "id", "", "job id")
|
||||
jobRunCmd.Flags().StringVar(&runTarget, "target", "", "pin job to a specific node id (overrides bin-packing)")
|
||||
jobRunCmd.Flags().StringVar(&runIDKey, "idempotency-key", "", "X-Orca-Idempotency-Key for cross-node dispatch dedupe")
|
||||
jobListCmd.Flags().BoolVar(&jobWatch, "watch", false, "stream jobs until Ctrl-C (table refresh or --json per-event)")
|
||||
|
||||
jobCmd.AddCommand(jobRunCmd)
|
||||
jobCmd.AddCommand(jobListCmd)
|
||||
|
||||
@@ -1,312 +0,0 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
||||
"git.cloudinit.dev/coreci/orca/internal/model"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
func writeJobSpec(t *testing.T, content string) string {
|
||||
t.Helper()
|
||||
dir := t.TempDir()
|
||||
p := filepath.Join(dir, "spec.hcl")
|
||||
if err := os.WriteFile(p, []byte(content), 0o644); err != nil {
|
||||
t.Fatalf("write spec: %v", err)
|
||||
}
|
||||
return p
|
||||
}
|
||||
|
||||
const trueJobSpec = `job "true" {}
|
||||
task "t" {
|
||||
command = "/bin/true"
|
||||
}
|
||||
`
|
||||
|
||||
const falseJobSpec = `job "false" {}
|
||||
task "t" {
|
||||
command = "/bin/false"
|
||||
}
|
||||
`
|
||||
|
||||
func TestJobRunComplete(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
spec := writeJobSpec(t, trueJobSpec)
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "run", spec})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("job run: %v", err)
|
||||
}
|
||||
if !strings.Contains(buf.String(), "Job complete") {
|
||||
t.Errorf("job run output unexpected: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobRunCompleteJSON(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
spec := writeJobSpec(t, trueJobSpec)
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "run", spec, "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("job run --json: %v", err)
|
||||
}
|
||||
var result map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
|
||||
t.Fatalf("unmarshal job run json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if result["status"] != "complete" {
|
||||
t.Errorf("job run --json status = %v, want complete", result["status"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobRunFailed(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
spec := writeJobSpec(t, falseJobSpec)
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "run", spec})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for failing job, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobRunFailedJSON(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
spec := writeJobSpec(t, falseJobSpec)
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "run", spec, "--json"})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for failing job --json, got nil")
|
||||
}
|
||||
if !strings.Contains(buf.String(), "failed") {
|
||||
t.Errorf("job run --json failed output unexpected: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobRunMissingSpecFile(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "run", "/nonexistent/spec.hcl"})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for missing spec file, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobListEmpty(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "list"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("job list: %v", err)
|
||||
}
|
||||
if !strings.Contains(buf.String(), "No jobs") {
|
||||
t.Errorf("job list empty output unexpected: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobListJSONEmpty(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "list", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("job list --json: %v", err)
|
||||
}
|
||||
var jobs []map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &jobs); err != nil {
|
||||
t.Fatalf("unmarshal job list json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if len(jobs) != 0 {
|
||||
t.Errorf("job list --json empty = %d jobs, want 0", len(jobs))
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobListAfterRun(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
spec := writeJobSpec(t, trueJobSpec)
|
||||
resetRootFlags(t)
|
||||
rootCmd.SetArgs([]string{"job", "run", spec})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("job run: %v", err)
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "list"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("job list: %v", err)
|
||||
}
|
||||
out := buf.String()
|
||||
if !strings.Contains(out, "true") {
|
||||
t.Errorf("job list missing job name: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobStop(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
jobID := seedJob(t, "stopper", model.JobStatusRunning)
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "stop", jobID})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("job stop: %v", err)
|
||||
}
|
||||
if !strings.Contains(buf.String(), "Job stopped") {
|
||||
t.Errorf("job stop output unexpected: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobStopJSON(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
jobID := seedJob(t, "jsonstopper", model.JobStatusRunning)
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "stop", jobID, "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("job stop --json: %v", err)
|
||||
}
|
||||
var result map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
|
||||
t.Fatalf("unmarshal job stop json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if result["status"] != "stopped" {
|
||||
t.Errorf("job stop --json status = %v, want stopped", result["status"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobStopNotFound(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "stop", "nonexistent-id"})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for job stop not found, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobStopMissingID(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "stop"})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for job stop without id, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobLogsEmpty(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
jobID := seedJob(t, "logger", model.JobStatusComplete)
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "logs", jobID})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("job logs: %v", err)
|
||||
}
|
||||
if !strings.Contains(buf.String(), "No tasks") {
|
||||
t.Errorf("job logs empty output unexpected: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobLogsJSONEmpty(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
jobID := seedJob(t, "jsonlogger", model.JobStatusComplete)
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "logs", jobID, "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("job logs --json: %v", err)
|
||||
}
|
||||
var tasks []map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &tasks); err != nil {
|
||||
t.Fatalf("unmarshal job logs json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if len(tasks) != 0 {
|
||||
t.Errorf("job logs --json empty = %d tasks, want 0", len(tasks))
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobLogsMissingID(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"job", "logs"})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for job logs without id, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func seedJob(t *testing.T, name string, status model.JobStatus) string {
|
||||
t.Helper()
|
||||
db, err := store.Open(certpaths.DBPath())
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo := store.NewJobRepo(db)
|
||||
j := &model.Job{
|
||||
ID: "job-" + name,
|
||||
Name: name,
|
||||
Spec: "spec.hcl",
|
||||
Status: status,
|
||||
}
|
||||
if err := repo.Insert(t.Context(), j); err != nil {
|
||||
t.Fatalf("insert job: %v", err)
|
||||
}
|
||||
return j.ID
|
||||
}
|
||||
@@ -1,143 +0,0 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
||||
)
|
||||
|
||||
func resetRootFlags(t *testing.T) {
|
||||
t.Helper()
|
||||
rootCmd.SetArgs(nil)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
_ = rootCmd.PersistentFlags().Set("system", "false")
|
||||
_ = rootCmd.PersistentFlags().Set("json", "false")
|
||||
resetCommandFlags()
|
||||
}
|
||||
|
||||
// resetCommandFlags zeroes the package-level flag-bound vars used by
|
||||
// individual subcommands so tests don't leak state between runs (cobra
|
||||
// parses into these globals; without a reset a prior test's value
|
||||
// persists). resetRootFlags calls this; tests that exercise a single
|
||||
// command without resetRootFlags may call it directly.
|
||||
func resetCommandFlags() {
|
||||
joinName, joinAddr, joinCAFinger, joinType = "", "", "", "localhost"
|
||||
joinHost, joinSSHUser, joinPassword, proxmoxUser, proxmoxRole = "", "root", "", "orca", "OrcaOperator"
|
||||
joinSSHPort, leaveID, nodeWatch = 22, "", false
|
||||
stopID, runTarget, runIDKey, jobWatch = "", "", "", false
|
||||
capSetCPU, capSetMem, capSetDisk, capNodeID = 0, 0, 0, ""
|
||||
auditLimit = 50
|
||||
}
|
||||
|
||||
func TestNamespaceDefaultsToUserHome(t *testing.T) {
|
||||
t.Setenv("ORCA_HOME", "")
|
||||
home, err := os.UserHomeDir()
|
||||
if err != nil {
|
||||
t.Fatalf("UserHomeDir: %v", err)
|
||||
}
|
||||
want := filepath.Join(home, ".orca")
|
||||
if got := certpaths.Dir(); got != want {
|
||||
t.Errorf("certpaths.Dir() = %q, want %q", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNamespaceHonorsORCAHOME(t *testing.T) {
|
||||
tmp := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", tmp)
|
||||
if got := certpaths.Dir(); got != tmp {
|
||||
t.Errorf("certpaths.Dir() = %q, want %q", got, tmp)
|
||||
}
|
||||
if got := certpaths.DBPath(); got != filepath.Join(tmp, "orca.db") {
|
||||
t.Errorf("certpaths.DBPath() = %q, want %q", got, filepath.Join(tmp, "orca.db"))
|
||||
}
|
||||
}
|
||||
|
||||
func TestInitHonorsORCAHOME(t *testing.T) {
|
||||
tmp := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", tmp)
|
||||
resetRootFlags(t)
|
||||
|
||||
rootCmd.SetArgs([]string{"init"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("init: %v", err)
|
||||
}
|
||||
|
||||
info, err := os.Stat(tmp)
|
||||
if err != nil {
|
||||
t.Fatalf("stat %s: %v", tmp, err)
|
||||
}
|
||||
if !info.IsDir() {
|
||||
t.Errorf("%s is not a directory", tmp)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSystemFlagSetsORCAHOME(t *testing.T) {
|
||||
t.Setenv("ORCA_HOME", "")
|
||||
resetRootFlags(t)
|
||||
|
||||
rootCmd.SetArgs([]string{"--system", "init"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("--system init: %v", err)
|
||||
}
|
||||
if got := os.Getenv("ORCA_HOME"); got != systemNamespaceRoot {
|
||||
t.Errorf("ORCA_HOME = %q, want %q", got, systemNamespaceRoot)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSystemFlagConflictsWithORCAHOME(t *testing.T) {
|
||||
t.Setenv("ORCA_HOME", "/custom/path")
|
||||
resetRootFlags(t)
|
||||
|
||||
rootCmd.SetArgs([]string{"--system", "init"})
|
||||
err := rootCmd.Execute()
|
||||
if err == nil {
|
||||
t.Fatal("expected error for --system + ORCA_HOME conflict, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestInitJSONOutput(t *testing.T) {
|
||||
tmp := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", tmp)
|
||||
resetRootFlags(t)
|
||||
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetArgs([]string{"init", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("init --json: %v", err)
|
||||
}
|
||||
|
||||
// v0.6: init --json now outputs a full bootstrap summary object.
|
||||
var result map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
|
||||
t.Fatalf("unmarshal init output: %v\noutput: %s", err, buf.String())
|
||||
}
|
||||
if result["namespace"] != tmp {
|
||||
t.Errorf("init --json namespace = %q, want %q", result["namespace"], tmp)
|
||||
}
|
||||
if result["os"] == nil || result["os"] == "" {
|
||||
t.Errorf("init --json os is missing/empty")
|
||||
}
|
||||
if result["node_id"] == nil || result["node_id"] == "" {
|
||||
t.Errorf("init --json node_id is missing/empty")
|
||||
}
|
||||
steps, ok := result["steps"].([]any)
|
||||
if !ok || len(steps) < 6 {
|
||||
t.Errorf("init --json steps: expected 6+ entries, got %v", result["steps"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestSystemFlagIsPersistent(t *testing.T) {
|
||||
for _, name := range []string{"system", "json"} {
|
||||
f := rootCmd.PersistentFlags().Lookup(name)
|
||||
if f == nil {
|
||||
t.Errorf("persistent flag %q not found", name)
|
||||
}
|
||||
}
|
||||
}
|
||||
+57
-221
@@ -3,12 +3,10 @@ package cli
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"os"
|
||||
"os/signal"
|
||||
"syscall"
|
||||
"path/filepath"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
@@ -17,13 +15,20 @@ import (
|
||||
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
||||
"git.cloudinit.dev/coreci/orca/internal/engine"
|
||||
"git.cloudinit.dev/coreci/orca/internal/model"
|
||||
"git.cloudinit.dev/coreci/orca/internal/proxmox"
|
||||
"git.cloudinit.dev/coreci/orca/internal/security"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
func dbPath() string {
|
||||
if p := os.Getenv("ORCA_DB"); p != "" {
|
||||
return p
|
||||
}
|
||||
home, _ := os.UserHomeDir()
|
||||
return filepath.Join(home, ".orca", "orca.db")
|
||||
}
|
||||
|
||||
func openDB() (*sql.DB, func() error, error) {
|
||||
db, err := store.Open(certpaths.DBPath())
|
||||
db, err := store.Open(dbPath())
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
@@ -48,15 +53,7 @@ var (
|
||||
joinName string
|
||||
joinAddr string
|
||||
joinCAFinger string
|
||||
joinType string
|
||||
joinHost string
|
||||
joinSSHUser string
|
||||
joinPassword string
|
||||
joinSSHPort int
|
||||
proxmoxUser string
|
||||
proxmoxRole string
|
||||
leaveID string
|
||||
nodeWatch bool
|
||||
)
|
||||
|
||||
var nodeCmd = &cobra.Command{
|
||||
@@ -68,141 +65,58 @@ var nodeCmd = &cobra.Command{
|
||||
var nodeJoinCmd = &cobra.Command{
|
||||
Use: "join",
|
||||
Short: "Join a node to the orca registry",
|
||||
Long: `Register a node in the local orca registry. Persisted to SQLite.
|
||||
|
||||
Node types (via --type):
|
||||
localhost (default): register a local or Linux node (existing behavior)
|
||||
proxmox: SSH-bootstrap a remote Proxmox VE 8/9 host
|
||||
(deploys orca pubkey, creates orca user + PVE role +
|
||||
sudoers allowlist; requires --host + --password)`,
|
||||
Long: "Register a node in the local orca registry. Persisted to SQLite.",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
if joinType == "proxmox" {
|
||||
return joinProxmox(cmd)
|
||||
if joinName == "" {
|
||||
return fmt.Errorf("--name is required")
|
||||
}
|
||||
if joinAddr == "" {
|
||||
joinAddr = "localhost:8443"
|
||||
}
|
||||
return joinLocal(cmd)
|
||||
},
|
||||
}
|
||||
|
||||
// joinLocal is the existing localhost/Linux node join flow (fingerprint
|
||||
// check + registry.Insert).
|
||||
func joinLocal(cmd *cobra.Command) error {
|
||||
if joinName == "" {
|
||||
return fmt.Errorf("--name is required")
|
||||
}
|
||||
if joinAddr == "" {
|
||||
joinAddr = "localhost:8443"
|
||||
}
|
||||
// REQ-026: if --ca-fingerprint is set, verify the on-disk CA
|
||||
// matches the pinned value before we touch the registry. This
|
||||
// prevents typos in the operator-supplied fingerprint from
|
||||
// silently degrading to "no pin" and accepting any cert.
|
||||
if joinCAFinger != "" {
|
||||
fp, err := security.Fingerprint(certpaths.CACertPath())
|
||||
if err != nil {
|
||||
return fmt.Errorf("--ca-fingerprint set but local CA is missing: %w (run `orca cert ca-init` first)", err)
|
||||
}
|
||||
if fp != joinCAFinger {
|
||||
return fmt.Errorf(
|
||||
"CA fingerprint mismatch: on-disk=%s, pinned=%s — refusing to join (REQ-026)",
|
||||
fp, joinCAFinger,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
// REQ-026: if --ca-fingerprint is set, verify the on-disk CA
|
||||
// matches the pinned value before we touch the registry. This
|
||||
// prevents typos in the operator-supplied fingerprint from
|
||||
// silently degrading to "no pin" and accepting any cert.
|
||||
if joinCAFinger != "" {
|
||||
fp, err := security.Fingerprint(certpaths.CACertPath())
|
||||
ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
|
||||
defer cancel()
|
||||
|
||||
registry, closer, err := nodeRegistry()
|
||||
if err != nil {
|
||||
return fmt.Errorf("--ca-fingerprint set but local CA is missing: %w (run `orca cert ca-init` first)", err)
|
||||
return err
|
||||
}
|
||||
if fp != joinCAFinger {
|
||||
return fmt.Errorf(
|
||||
"CA fingerprint mismatch: on-disk=%s, pinned=%s — refusing to join (REQ-026)",
|
||||
fp, joinCAFinger,
|
||||
)
|
||||
defer closer()
|
||||
|
||||
node := &model.Node{
|
||||
ID: uuid.NewString(),
|
||||
Name: joinName,
|
||||
Address: joinAddr,
|
||||
State: model.NodeStateReady,
|
||||
JoinedAt: time.Now().UTC(),
|
||||
LastSeen: time.Now().UTC(),
|
||||
}
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
|
||||
defer cancel()
|
||||
|
||||
registry, closer, err := nodeRegistry()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer closer()
|
||||
|
||||
node := &model.Node{
|
||||
ID: uuid.NewString(),
|
||||
Name: joinName,
|
||||
Address: joinAddr,
|
||||
State: model.NodeStateReady,
|
||||
JoinedAt: time.Now().UTC(),
|
||||
LastSeen: time.Now().UTC(),
|
||||
}
|
||||
if err := registry.Join(ctx, node); err != nil {
|
||||
return err
|
||||
}
|
||||
if jsonOutput {
|
||||
return printJSON(node)
|
||||
}
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "✓ Node joined: %s (%s) at %s\n", node.ID, node.Name, node.Address)
|
||||
return nil
|
||||
}
|
||||
|
||||
// joinProxmox bootstraps a remote Proxmox VE 8/9 host via SSH and
|
||||
// registers it as an orca node (REQ-050, REQ-051). The password is
|
||||
// never persisted (D-031).
|
||||
func joinProxmox(cmd *cobra.Command) error {
|
||||
if joinHost == "" {
|
||||
return fmt.Errorf("--host is required for --type proxmox")
|
||||
}
|
||||
password := joinPassword
|
||||
if password == "" {
|
||||
password = os.Getenv("ORCA_PROXMOX_PASSWORD")
|
||||
}
|
||||
if password == "" {
|
||||
return fmt.Errorf("password is required for --type proxmox (use --password or $ORCA_PROXMOX_PASSWORD)")
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(cmd.Context(), 60*time.Second)
|
||||
defer cancel()
|
||||
|
||||
result, err := proxmox.BootstrapProxmox(ctx, proxmox.Options{
|
||||
Host: joinHost,
|
||||
SSHUser: joinSSHUser,
|
||||
Password: password,
|
||||
ProxmoxUser: proxmoxUser,
|
||||
ProxmoxRole: proxmoxRole,
|
||||
SSHPort: joinSSHPort,
|
||||
Logger: newLogger(),
|
||||
})
|
||||
if err != nil {
|
||||
return fmt.Errorf("proxmox bootstrap: %w", err)
|
||||
}
|
||||
|
||||
// Zero the password byte slice (D-031 — never persist, minimize memory exposure).
|
||||
pwBytes := []byte(password)
|
||||
for i := range pwBytes {
|
||||
pwBytes[i] = 0
|
||||
}
|
||||
|
||||
// Register the proxmox node in the orca registry.
|
||||
registry, closer, err := nodeRegistry()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer closer()
|
||||
|
||||
regCtx, regCancel := context.WithTimeout(ctx, 5*time.Second)
|
||||
defer regCancel()
|
||||
|
||||
node := &model.Node{
|
||||
ID: uuid.NewString(),
|
||||
Name: result.NodeName,
|
||||
Address: result.NodeAddress,
|
||||
State: model.NodeStateReady,
|
||||
JoinedAt: time.Now().UTC(),
|
||||
LastSeen: time.Now().UTC(),
|
||||
Kind: string(model.NodeKindProxmox),
|
||||
OS: "pve",
|
||||
}
|
||||
if err := registry.Join(regCtx, node); err != nil {
|
||||
return fmt.Errorf("register proxmox node: %w", err)
|
||||
}
|
||||
if jsonOutput {
|
||||
return printJSON(node)
|
||||
}
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "✓ Proxmox node joined: %s (%s) at %s\n", node.ID, node.Name, node.Address)
|
||||
fmt.Fprintf(cmd.OutOrStdout(), " role: %s, user: %s@pam\n", proxmoxRole, proxmoxUser)
|
||||
return nil
|
||||
if err := registry.Join(ctx, node); err != nil {
|
||||
return err
|
||||
}
|
||||
if jsonOutput {
|
||||
return printJSON(node)
|
||||
}
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "✓ Node joined: %s (%s) at %s\n", node.ID, node.Name, node.Address)
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
var nodeLeaveCmd = &cobra.Command{
|
||||
@@ -241,11 +155,8 @@ var nodeLeaveCmd = &cobra.Command{
|
||||
var nodeListCmd = &cobra.Command{
|
||||
Use: "list",
|
||||
Short: "List all nodes in the orca registry",
|
||||
Long: "Display all registered nodes and their state. Use --watch to stream updates until Ctrl-C.",
|
||||
Long: "Display all registered nodes and their state.",
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
if nodeWatch {
|
||||
return watchNodes(cmd)
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
|
||||
defer cancel()
|
||||
|
||||
@@ -274,86 +185,11 @@ var nodeListCmd = &cobra.Command{
|
||||
},
|
||||
}
|
||||
|
||||
func watchNodes(cmd *cobra.Command) error {
|
||||
ctx, cancel := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM)
|
||||
defer cancel()
|
||||
return watchNodesCtx(cmd, ctx)
|
||||
}
|
||||
|
||||
func watchNodesCtx(cmd *cobra.Command, ctx context.Context) error {
|
||||
db, closer, err := openDB()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer closer()
|
||||
|
||||
out := cmd.OutOrStdout()
|
||||
|
||||
if jsonOutput {
|
||||
seen := make(map[string]string)
|
||||
for snapshot := range store.NewNodeRepo(db).Watch(ctx) {
|
||||
current := make(map[string]bool, len(snapshot))
|
||||
for _, n := range snapshot {
|
||||
current[n.ID] = true
|
||||
compact, _ := json.Marshal(n)
|
||||
key := string(compact)
|
||||
if prev, ok := seen[n.ID]; !ok || prev != key {
|
||||
event := "init"
|
||||
if ok {
|
||||
event = "update"
|
||||
}
|
||||
line, _ := json.Marshal(map[string]any{"event": event, "node": n})
|
||||
fmt.Fprintln(out, string(line))
|
||||
seen[n.ID] = key
|
||||
}
|
||||
}
|
||||
for id := range seen {
|
||||
if !current[id] {
|
||||
line, _ := json.Marshal(map[string]any{"event": "delete", "id": id})
|
||||
fmt.Fprintln(out, string(line))
|
||||
delete(seen, id)
|
||||
}
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
prevTable := ""
|
||||
for snapshot := range store.NewNodeRepo(db).Watch(ctx) {
|
||||
table := renderNodeTable(snapshot)
|
||||
if table != prevTable {
|
||||
fmt.Fprint(out, "\033[2J\033[H")
|
||||
fmt.Fprint(out, table)
|
||||
prevTable = table
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func renderNodeTable(nodes []*model.Node) string {
|
||||
if len(nodes) == 0 {
|
||||
return "No nodes registered.\n"
|
||||
}
|
||||
out := fmt.Sprintf("%-36s %-20s %-22s %-10s\n", "ID", "NAME", "ADDRESS", "STATE")
|
||||
for _, n := range nodes {
|
||||
out += fmt.Sprintf("%-36s %-20s %-22s %-10s\n", n.ID, n.Name, n.Address, n.State)
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func init() {
|
||||
nodeJoinCmd.Flags().StringVar(&joinName, "name", "", "node name (required for --type localhost)")
|
||||
nodeJoinCmd.Flags().StringVar(&joinName, "name", "", "node name (required)")
|
||||
nodeJoinCmd.Flags().StringVar(&joinAddr, "addr", "", "node address (default localhost:8443)")
|
||||
nodeJoinCmd.Flags().StringVar(&joinCAFinger, "ca-fingerprint", "", "pin CA cert SHA-256 (REQ-026); fails if on-disk CA doesn't match")
|
||||
nodeJoinCmd.Flags().StringVar(&joinType, "type", "localhost", "node type: localhost (default) or proxmox (SSH bootstrap)")
|
||||
nodeJoinCmd.Flags().StringVar(&joinHost, "host", "", "proxmox host address (IP/hostname, no port; required for --type proxmox)")
|
||||
nodeJoinCmd.Flags().StringVar(&joinSSHUser, "ssh-user", "root", "SSH username for proxmox bootstrap (default root)")
|
||||
nodeJoinCmd.Flags().StringVar(&joinPassword, "password", "", "SSH password for proxmox bootstrap (never persisted; prefer $ORCA_PROXMOX_PASSWORD)")
|
||||
nodeJoinCmd.Flags().IntVar(&joinSSHPort, "ssh-port", 22, "SSH port for proxmox bootstrap (default 22)")
|
||||
nodeJoinCmd.Flags().StringVar(&proxmoxUser, "proxmox-user", "orca", "Linux system user to create on the proxmox host (config-overridable)")
|
||||
nodeJoinCmd.Flags().StringVar(&proxmoxRole, "proxmox-role", "OrcaOperator", "PVE custom role to create (config-overridable)")
|
||||
nodeLeaveCmd.Flags().StringVar(&leaveID, "id", "", "node id")
|
||||
nodeListCmd.Flags().BoolVar(&nodeWatch, "watch", false, "stream nodes until Ctrl-C (table refresh or --json per-event)")
|
||||
|
||||
nodeCmd.AddCommand(nodeJoinCmd)
|
||||
nodeCmd.AddCommand(nodeLeaveCmd)
|
||||
|
||||
@@ -1,194 +0,0 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
func TestNodeCapacitySetMissingArgs(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "capacity", "set", "--cpu", "1000"})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for capacity set missing memory/disk, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeCapacitySet(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "capacity", "set", "--cpu", "2000", "--memory", "4096", "--disk", "51200"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("capacity set: %v", err)
|
||||
}
|
||||
if !strings.Contains(buf.String(), "Capacity set") {
|
||||
t.Errorf("capacity set output unexpected: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeCapacitySetJSON(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "capacity", "set", "--cpu", "3000", "--memory", "8192", "--disk", "102400", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("capacity set --json: %v", err)
|
||||
}
|
||||
var c map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &c); err != nil {
|
||||
t.Fatalf("unmarshal capacity set json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if c["NodeID"] != "self" {
|
||||
t.Errorf("capacity set --json NodeID = %v, want self", c["NodeID"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeCapacityShowNotFound(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "capacity", "show", "missing-node"})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for capacity show missing node, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeCapacityShowAfterSet(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
seedCapacity(t, "show-node", 4000, 4096, 51200)
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "capacity", "show", "show-node"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("capacity show: %v", err)
|
||||
}
|
||||
out := buf.String()
|
||||
if !strings.Contains(out, "show-node") {
|
||||
t.Errorf("capacity show missing node id: %s", out)
|
||||
}
|
||||
if !strings.Contains(out, "4000") {
|
||||
t.Errorf("capacity show missing cpu: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeCapacityShowJSON(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
seedCapacity(t, "jsonshow-node", 4000, 4096, 51200)
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "capacity", "show", "jsonshow-node", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("capacity show --json: %v", err)
|
||||
}
|
||||
var c map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &c); err != nil {
|
||||
t.Fatalf("unmarshal capacity show json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if c["NodeID"] != "jsonshow-node" {
|
||||
t.Errorf("capacity show --json NodeID = %v, want jsonshow-node", c["NodeID"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeCapacityListEmpty(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "capacity", "list"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("capacity list: %v", err)
|
||||
}
|
||||
if !strings.Contains(buf.String(), "No capacity") {
|
||||
t.Errorf("capacity list empty output unexpected: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeCapacityListAfterSet(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
seedCapacity(t, "list-node", 5000, 4096, 51200)
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "capacity", "list"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("capacity list: %v", err)
|
||||
}
|
||||
if !strings.Contains(buf.String(), "list-node") {
|
||||
t.Errorf("capacity list missing node: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeCapacityListJSON(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
seedCapacity(t, "jsonlist-node", 5000, 4096, 51200)
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "capacity", "list", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("capacity list --json: %v", err)
|
||||
}
|
||||
var rows []map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &rows); err != nil {
|
||||
t.Fatalf("unmarshal capacity list json: %v\n%s", err, buf.String())
|
||||
}
|
||||
found := false
|
||||
for _, r := range rows {
|
||||
if r["NodeID"] == "jsonlist-node" {
|
||||
found = true
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
t.Errorf("capacity list --json missing jsonlist-node: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func seedCapacity(t *testing.T, nodeID string, cpu, mem, disk int64) {
|
||||
t.Helper()
|
||||
db, err := store.Open(certpaths.DBPath())
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo := store.NewCapacityRepo(db)
|
||||
c := &store.NodeCapacity{
|
||||
NodeID: nodeID,
|
||||
CPUMillicores: cpu,
|
||||
MemoryMiB: mem,
|
||||
DiskMiB: disk,
|
||||
}
|
||||
if err := repo.Upsert(t.Context(), c); err != nil {
|
||||
t.Fatalf("upsert capacity: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -1,320 +0,0 @@
|
||||
// This file tests the `orca node` subcommand family (join/leave/list,
|
||||
// capacity is covered in node_capacity_test.go). Tests execute rootCmd
|
||||
// against a temp ORCA_HOME and assert stdout/stderr/exit per RESEARCH
|
||||
// §1.2.
|
||||
//
|
||||
// daemon.go is EXCLUDED from the cli ≥70% coverage target: the daemon
|
||||
// command starts a long-running mTLS server whose lifecycle is better
|
||||
// covered by internal/daemon/server_test.go (already 150 LOC). The
|
||||
// --pprof flag registration is verified in daemon_test.go.
|
||||
package cli
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
||||
"git.cloudinit.dev/coreci/orca/internal/model"
|
||||
"git.cloudinit.dev/coreci/orca/internal/security"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
func TestNodeJoinLocalText(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "join", "--name", "worker-1", "--addr", "10.0.0.5:8443"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("node join: %v", err)
|
||||
}
|
||||
out := buf.String()
|
||||
if !strings.Contains(out, "Node joined") {
|
||||
t.Errorf("node join output unexpected: %s", out)
|
||||
}
|
||||
if !strings.Contains(out, "worker-1") {
|
||||
t.Errorf("node join output missing name: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeJoinLocalJSON(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "join", "--name", "worker-2", "--addr", "10.0.0.6:8443", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("node join --json: %v", err)
|
||||
}
|
||||
var node map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &node); err != nil {
|
||||
t.Fatalf("unmarshal node json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if node["name"] != "worker-2" {
|
||||
t.Errorf("node join --json name = %v, want worker-2", node["name"])
|
||||
}
|
||||
if node["address"] != "10.0.0.6:8443" {
|
||||
t.Errorf("node join --json address = %v, want 10.0.0.6:8443", node["address"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeJoinMissingName(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "join"})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for missing --name, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeJoinDefaultAddr(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "join", "--name", "defaulter", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("node join: %v", err)
|
||||
}
|
||||
var node map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &node); err != nil {
|
||||
t.Fatalf("unmarshal node json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if node["address"] != "localhost:8443" {
|
||||
t.Errorf("node join default addr = %v, want localhost:8443", node["address"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeJoinCAFingerprintMatch(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
if err := runInit(discardWriter{}); err != nil {
|
||||
t.Fatalf("init: %v", err)
|
||||
}
|
||||
fp, err := security.Fingerprint(certpaths.CACertPath())
|
||||
if err != nil {
|
||||
t.Fatalf("fingerprint: %v", err)
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "join", "--name", "pinned", "--ca-fingerprint", fp, "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("node join with matching fingerprint: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeJoinCAFingerprintMismatch(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "join", "--name", "badpin", "--ca-fingerprint", padHex(64)})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for CA fingerprint mismatch, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeJoinCAFingerprintNoCA(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "join", "--name", "noca", "--ca-fingerprint", padHex(64)})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for missing CA with --ca-fingerprint, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeJoinProxmoxMissingHost(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "join", "--type", "proxmox", "--password", "x"})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for proxmox without --host, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeJoinProxmoxMissingPassword(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "join", "--type", "proxmox", "--host", "10.0.0.99"})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for proxmox without password, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeListEmpty(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "list"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("node list: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeListAfterJoin(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
rootCmd.SetArgs([]string{"node", "join", "--name", "lister", "--addr", "10.0.0.7:8443"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("node join: %v", err)
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "list"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("node list: %v", err)
|
||||
}
|
||||
out := buf.String()
|
||||
if !strings.Contains(out, "lister") {
|
||||
t.Errorf("node list missing joined node: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeListJSON(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
rootCmd.SetArgs([]string{"node", "join", "--name", "jsonlister", "--addr", "10.0.0.8:8443"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("node join: %v", err)
|
||||
}
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "list", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("node list --json: %v", err)
|
||||
}
|
||||
var nodes []map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &nodes); err != nil {
|
||||
t.Fatalf("unmarshal node list json: %v\n%s", err, buf.String())
|
||||
}
|
||||
found := false
|
||||
for _, n := range nodes {
|
||||
if n["name"] == "jsonlister" {
|
||||
found = true
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
t.Errorf("node list --json missing jsonlister: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeLeave(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
nodeID := seedNode(t, "leaver", "10.0.0.9:8443")
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "leave", nodeID})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("node leave: %v", err)
|
||||
}
|
||||
if !strings.Contains(buf.String(), "Node left") {
|
||||
t.Errorf("node leave output unexpected: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeLeaveJSON(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
nodeID := seedNode(t, "jsonleaver", "10.0.0.10:8443")
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "leave", nodeID, "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("node leave --json: %v", err)
|
||||
}
|
||||
var result map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
|
||||
t.Fatalf("unmarshal node leave json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if result["state"] != "left" {
|
||||
t.Errorf("node leave --json state = %v, want left", result["state"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeLeaveMissingID(t *testing.T) {
|
||||
_, cleanup := initTestEnv(t)
|
||||
defer cleanup()
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"node", "leave"})
|
||||
if err := rootCmd.Execute(); err == nil {
|
||||
t.Fatal("expected error for node leave without id, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func seedNode(t *testing.T, name, addr string) string {
|
||||
t.Helper()
|
||||
db, err := store.Open(certpaths.DBPath())
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo := store.NewNodeRepo(db)
|
||||
ctx := context.Background()
|
||||
n := &model.Node{
|
||||
ID: "node-" + name,
|
||||
Name: name,
|
||||
Address: addr,
|
||||
State: model.NodeStateReady,
|
||||
JoinedAt: time.Now().UTC(),
|
||||
LastSeen: time.Now().UTC(),
|
||||
}
|
||||
if err := repo.Insert(ctx, n); err != nil {
|
||||
t.Fatalf("insert node: %v", err)
|
||||
}
|
||||
return n.ID
|
||||
}
|
||||
|
||||
func padHex(n int) string {
|
||||
b := make([]byte, n)
|
||||
for i := range b {
|
||||
b[i] = 'a'
|
||||
}
|
||||
return string(b)
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
package cli
|
||||
|
||||
import "git.cloudinit.dev/coreci/orca/internal/osdetect"
|
||||
|
||||
// detectOS reads /etc/os-release and returns the ID= value.
|
||||
// Delegates to internal/osdetect to avoid import cycles with
|
||||
// internal/doctor (both need OS detection).
|
||||
func detectOS() string {
|
||||
return osdetect.Detect()
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"testing"
|
||||
)
|
||||
|
||||
// The osdetect parsing/detection logic is tested in
|
||||
// internal/osdetect/osdetect_test.go. These tests verify the cli
|
||||
// wrapper delegates correctly.
|
||||
|
||||
func TestDetectOS_DelegatesToPackage(t *testing.T) {
|
||||
// On this host (Ubuntu), detectOS should return "ubuntu" via the
|
||||
// osdetect package. If /etc/os-release is absent (e.g., in a
|
||||
// minimal container), it returns "linux".
|
||||
result := detectOS()
|
||||
if result == "" {
|
||||
t.Error("detectOS returned empty string, expected a non-empty OS ID")
|
||||
}
|
||||
}
|
||||
+1
-40
@@ -1,26 +1,18 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/spf13/cobra"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/config"
|
||||
)
|
||||
|
||||
type configCtxKey struct{}
|
||||
|
||||
var (
|
||||
version = "0.1.0-dev"
|
||||
gitCommit = "unknown"
|
||||
buildTime = "unknown"
|
||||
)
|
||||
|
||||
const systemNamespaceRoot = "/root/.orca"
|
||||
|
||||
var rootCmd = &cobra.Command{
|
||||
Use: "orca",
|
||||
Short: "Orca — offline/CLI-first orchestration engine",
|
||||
@@ -29,43 +21,12 @@ inspired by HashiCorp Nomad, prioritizing stability, security, and simplicity
|
||||
over feature richness.`,
|
||||
SilenceUsage: true,
|
||||
SilenceErrors: true,
|
||||
PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
|
||||
if systemNamespace {
|
||||
if existing := os.Getenv("ORCA_HOME"); existing != "" && existing != systemNamespaceRoot {
|
||||
return fmt.Errorf("--system conflicts with ORCA_HOME=%q (already set); unset ORCA_HOME or drop --system", existing)
|
||||
}
|
||||
if err := os.Setenv("ORCA_HOME", systemNamespaceRoot); err != nil {
|
||||
return fmt.Errorf("set ORCA_HOME for --system: %w", err)
|
||||
}
|
||||
}
|
||||
if configPath != "" {
|
||||
cfg, err := config.Load(configPath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("load config %s: %w", configPath, err)
|
||||
}
|
||||
cmd.SetContext(context.WithValue(cmd.Context(), configCtxKey{}, cfg))
|
||||
}
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
var (
|
||||
jsonOutput bool
|
||||
systemNamespace bool
|
||||
configPath string
|
||||
)
|
||||
var jsonOutput bool
|
||||
|
||||
func init() {
|
||||
rootCmd.PersistentFlags().BoolVar(&jsonOutput, "json", false, "output in JSON format")
|
||||
rootCmd.PersistentFlags().BoolVar(&systemNamespace, "system", false, "use system-level namespace root (/root/.orca) instead of user-level (~/.orca)")
|
||||
rootCmd.PersistentFlags().StringVar(&configPath, "config", "", "path to config.hcl (overrides ~/.orca/config.hcl)")
|
||||
}
|
||||
|
||||
func configFromCtx(ctx context.Context) *config.Config {
|
||||
if v, ok := ctx.Value(configCtxKey{}).(*config.Config); ok {
|
||||
return v
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func Execute() error {
|
||||
|
||||
@@ -1,11 +1,8 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/config"
|
||||
)
|
||||
|
||||
func TestVersionCommandExists(t *testing.T) {
|
||||
@@ -68,47 +65,3 @@ func TestRootHelpMentionsKeyPillars(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestConfigFlagRegistered(t *testing.T) {
|
||||
f := rootCmd.PersistentFlags().Lookup("config")
|
||||
if f == nil {
|
||||
t.Fatal("--config persistent flag not registered")
|
||||
}
|
||||
if f.DefValue != "" {
|
||||
t.Errorf("--config default = %q, want empty", f.DefValue)
|
||||
}
|
||||
}
|
||||
|
||||
func TestConfigFlagLoadsFile(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
cfgPath := dir + "/config.hcl"
|
||||
cfgContent := `db_path = "` + dir + `/test.db"
|
||||
listen_addr = "127.0.0.1:9999"
|
||||
ca_path = "` + dir + `/ca.crt"
|
||||
server_cert_path = "` + dir + `/server.crt"
|
||||
server_key_path = "` + dir + `/server.key"
|
||||
|
||||
node_capacity {
|
||||
cpu = 4
|
||||
memory_mb = 8192
|
||||
}
|
||||
`
|
||||
if err := os.WriteFile(cfgPath, []byte(cfgContent), 0o644); err != nil {
|
||||
t.Fatalf("write config: %v", err)
|
||||
}
|
||||
|
||||
old := configPath
|
||||
configPath = cfgPath
|
||||
defer func() { configPath = old }()
|
||||
|
||||
cfg, err := config.Load(cfgPath)
|
||||
if err != nil {
|
||||
t.Fatalf("load config: %v", err)
|
||||
}
|
||||
if cfg.ListenAddr != "127.0.0.1:9999" {
|
||||
t.Errorf("listen_addr = %q, want 127.0.0.1:9999", cfg.ListenAddr)
|
||||
}
|
||||
if cfg.NodeCapacity == nil || cfg.NodeCapacity.CPU != 4 {
|
||||
t.Errorf("node_capacity.cpu not parsed, got %+v", cfg.NodeCapacity)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,47 +0,0 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestStatusText(t *testing.T) {
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"status"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("status: %v", err)
|
||||
}
|
||||
out := buf.String()
|
||||
if !strings.Contains(out, "orca daemon status") {
|
||||
t.Errorf("status text output unexpected: %s", out)
|
||||
}
|
||||
if !strings.Contains(out, "version") {
|
||||
t.Errorf("status output missing version: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStatusJSON(t *testing.T) {
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"status", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("status --json: %v", err)
|
||||
}
|
||||
var info map[string]any
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &info); err != nil {
|
||||
t.Fatalf("unmarshal status json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if info["daemon"] != "stopped" {
|
||||
t.Errorf("status json daemon = %v, want stopped", info["daemon"])
|
||||
}
|
||||
if info["api_addr"] != "https://localhost:8443" {
|
||||
t.Errorf("status json api_addr = %v, want https://localhost:8443", info["api_addr"])
|
||||
}
|
||||
}
|
||||
@@ -1,47 +0,0 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestVersionText(t *testing.T) {
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"version"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("version: %v", err)
|
||||
}
|
||||
out := buf.String()
|
||||
if !strings.Contains(out, "orca version") {
|
||||
t.Errorf("version text output unexpected: %s", out)
|
||||
}
|
||||
if !strings.Contains(out, "git commit") {
|
||||
t.Errorf("version output missing git commit: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestVersionJSON(t *testing.T) {
|
||||
resetRootFlags(t)
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
rootCmd.SetArgs([]string{"version", "--json"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Fatalf("version --json: %v", err)
|
||||
}
|
||||
var info map[string]string
|
||||
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &info); err != nil {
|
||||
t.Fatalf("unmarshal version json: %v\n%s", err, buf.String())
|
||||
}
|
||||
if info["version"] == "" {
|
||||
t.Errorf("version json missing version field: %v", info)
|
||||
}
|
||||
if info["git_commit"] == "" {
|
||||
t.Errorf("version json missing git_commit field: %v", info)
|
||||
}
|
||||
}
|
||||
@@ -1,287 +0,0 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/model"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
func TestWatchJobs_JSONStreaming(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
dbPath := filepath.Join(dir, "orca.db")
|
||||
db, err := store.Open(dbPath)
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
repo := store.NewJobRepo(db)
|
||||
bgCtx := context.Background()
|
||||
_ = repo.Insert(bgCtx, &model.Job{ID: "seed-job", Name: "seed", Spec: "t", Status: model.JobStatusPending})
|
||||
|
||||
t.Setenv("ORCA_DB", dbPath)
|
||||
|
||||
jsonOutput = true
|
||||
t.Cleanup(func() { jsonOutput = false })
|
||||
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
t.Cleanup(func() { rootCmd.SetOut(os.Stdout); rootCmd.SetErr(os.Stderr) })
|
||||
|
||||
ctx, cancel := context.WithCancel(bgCtx)
|
||||
|
||||
done := make(chan error, 1)
|
||||
go func() { done <- watchJobsCtx(rootCmd, ctx) }()
|
||||
|
||||
// First yield is immediate (G-002); wait for it.
|
||||
time.Sleep(100 * time.Millisecond)
|
||||
|
||||
_ = repo.Insert(bgCtx, &model.Job{ID: "watch-job", Name: "watch", Spec: "t", Status: model.JobStatusPending})
|
||||
|
||||
// Wait for at least one ticker interval (default 1s) to capture the change.
|
||||
time.Sleep(1100 * time.Millisecond)
|
||||
cancel()
|
||||
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("watchJobsCtx did not return within 2s after cancel")
|
||||
}
|
||||
|
||||
output := buf.String()
|
||||
if !strings.Contains(output, `"event":"init"`) {
|
||||
t.Errorf("expected init event, got: %s", output)
|
||||
}
|
||||
if !strings.Contains(output, "watch-job") {
|
||||
t.Errorf("expected watch-job in output, got: %s", output)
|
||||
}
|
||||
}
|
||||
|
||||
func TestWatchJobs_TableRefresh(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
dbPath := filepath.Join(dir, "orca.db")
|
||||
db, err := store.Open(dbPath)
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
repo := store.NewJobRepo(db)
|
||||
bgCtx := context.Background()
|
||||
_ = repo.Insert(bgCtx, &model.Job{ID: "seed-job", Name: "seed", Spec: "t", Status: model.JobStatusPending})
|
||||
|
||||
t.Setenv("ORCA_DB", dbPath)
|
||||
|
||||
jsonOutput = false
|
||||
t.Cleanup(func() { jsonOutput = false })
|
||||
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
t.Cleanup(func() { rootCmd.SetOut(os.Stdout); rootCmd.SetErr(os.Stderr) })
|
||||
|
||||
ctx, cancel := context.WithCancel(bgCtx)
|
||||
|
||||
done := make(chan error, 1)
|
||||
go func() { done <- watchJobsCtx(rootCmd, ctx) }()
|
||||
|
||||
time.Sleep(100 * time.Millisecond)
|
||||
|
||||
_ = repo.Insert(bgCtx, &model.Job{ID: "table-job", Name: "table", Spec: "t", Status: model.JobStatusPending})
|
||||
|
||||
time.Sleep(1100 * time.Millisecond)
|
||||
cancel()
|
||||
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("watchJobsCtx did not return within 2s after cancel")
|
||||
}
|
||||
|
||||
output := buf.String()
|
||||
if !strings.Contains(output, "\033[2J\033[H") {
|
||||
t.Errorf("expected clear-screen escape in table watch output, got: %s", output)
|
||||
}
|
||||
if !strings.Contains(output, "table-job") {
|
||||
t.Errorf("expected table-job in output, got: %s", output)
|
||||
}
|
||||
}
|
||||
|
||||
func TestWatchNodes_JSONStreaming(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
dbPath := filepath.Join(dir, "orca.db")
|
||||
db, err := store.Open(dbPath)
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
repo := store.NewNodeRepo(db)
|
||||
bgCtx := context.Background()
|
||||
_ = repo.Insert(bgCtx, &model.Node{
|
||||
ID: "seed-node", Name: "seed", Address: "addr",
|
||||
State: model.NodeStateReady, JoinedAt: time.Now().UTC(), LastSeen: time.Now().UTC(),
|
||||
})
|
||||
|
||||
t.Setenv("ORCA_DB", dbPath)
|
||||
|
||||
jsonOutput = true
|
||||
t.Cleanup(func() { jsonOutput = false })
|
||||
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
t.Cleanup(func() { rootCmd.SetOut(os.Stdout); rootCmd.SetErr(os.Stderr) })
|
||||
|
||||
ctx, cancel := context.WithCancel(bgCtx)
|
||||
|
||||
done := make(chan error, 1)
|
||||
go func() { done <- watchNodesCtx(rootCmd, ctx) }()
|
||||
|
||||
time.Sleep(100 * time.Millisecond)
|
||||
|
||||
_ = repo.Insert(bgCtx, &model.Node{
|
||||
ID: "watch-node", Name: "watch", Address: "addr2",
|
||||
State: model.NodeStateReady, JoinedAt: time.Now().UTC(), LastSeen: time.Now().UTC(),
|
||||
})
|
||||
|
||||
time.Sleep(1100 * time.Millisecond)
|
||||
cancel()
|
||||
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("watchNodesCtx did not return within 2s after cancel")
|
||||
}
|
||||
|
||||
output := buf.String()
|
||||
initFound := false
|
||||
watchNodeFound := false
|
||||
for _, line := range strings.Split(output, "\n") {
|
||||
line = strings.TrimSpace(line)
|
||||
if line == "" {
|
||||
continue
|
||||
}
|
||||
var event map[string]any
|
||||
if err := json.Unmarshal([]byte(line), &event); err != nil {
|
||||
continue
|
||||
}
|
||||
if event["event"] == "init" {
|
||||
initFound = true
|
||||
if node, ok := event["node"].(map[string]any); ok {
|
||||
if node["id"] == "watch-node" {
|
||||
watchNodeFound = true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if !initFound {
|
||||
t.Errorf("expected init event in JSON stream, got: %s", output)
|
||||
}
|
||||
if !watchNodeFound {
|
||||
t.Errorf("expected watch-node in JSON stream, got: %s", output)
|
||||
}
|
||||
}
|
||||
|
||||
func TestWatchNodes_TableRefresh(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
dbPath := filepath.Join(dir, "orca.db")
|
||||
db, err := store.Open(dbPath)
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
repo := store.NewNodeRepo(db)
|
||||
bgCtx := context.Background()
|
||||
_ = repo.Insert(bgCtx, &model.Node{
|
||||
ID: "seed-node", Name: "seed", Address: "addr",
|
||||
State: model.NodeStateReady, JoinedAt: time.Now().UTC(), LastSeen: time.Now().UTC(),
|
||||
})
|
||||
|
||||
t.Setenv("ORCA_DB", dbPath)
|
||||
|
||||
jsonOutput = false
|
||||
t.Cleanup(func() { jsonOutput = false })
|
||||
|
||||
var buf bytes.Buffer
|
||||
rootCmd.SetOut(&buf)
|
||||
rootCmd.SetErr(&buf)
|
||||
t.Cleanup(func() { rootCmd.SetOut(os.Stdout); rootCmd.SetErr(os.Stderr) })
|
||||
|
||||
ctx, cancel := context.WithCancel(bgCtx)
|
||||
|
||||
done := make(chan error, 1)
|
||||
go func() { done <- watchNodesCtx(rootCmd, ctx) }()
|
||||
|
||||
time.Sleep(100 * time.Millisecond)
|
||||
|
||||
_ = repo.Insert(bgCtx, &model.Node{
|
||||
ID: "table-node", Name: "table", Address: "addr2",
|
||||
State: model.NodeStateReady, JoinedAt: time.Now().UTC(), LastSeen: time.Now().UTC(),
|
||||
})
|
||||
|
||||
time.Sleep(1100 * time.Millisecond)
|
||||
cancel()
|
||||
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("watchNodesCtx did not return within 2s after cancel")
|
||||
}
|
||||
|
||||
output := buf.String()
|
||||
if !strings.Contains(output, "\033[2J\033[H") {
|
||||
t.Errorf("expected clear-screen escape in table watch output, got: %s", output)
|
||||
}
|
||||
if !strings.Contains(output, "table-node") {
|
||||
t.Errorf("expected table-node in output, got: %s", output)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRenderJobTable(t *testing.T) {
|
||||
jobs := []*model.Job{
|
||||
{ID: "j1", Name: "alpha", Status: "running", ExitCode: 0},
|
||||
{ID: "j2", Name: "beta", Status: "done", ExitCode: 0},
|
||||
}
|
||||
out := renderJobTable(jobs)
|
||||
if !strings.Contains(out, "j1") || !strings.Contains(out, "alpha") {
|
||||
t.Errorf("renderJobTable missing job 1: %s", out)
|
||||
}
|
||||
if !strings.Contains(out, "j2") || !strings.Contains(out, "beta") {
|
||||
t.Errorf("renderJobTable missing job 2: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRenderJobTableEmpty(t *testing.T) {
|
||||
out := renderJobTable(nil)
|
||||
if !strings.Contains(out, "No jobs") {
|
||||
t.Errorf("expected empty message, got: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRenderNodeTable(t *testing.T) {
|
||||
nodes := []*model.Node{
|
||||
{ID: "n1", Name: "alpha", Address: "localhost:8443", State: "ready"},
|
||||
}
|
||||
out := renderNodeTable(nodes)
|
||||
if !strings.Contains(out, "n1") || !strings.Contains(out, "alpha") {
|
||||
t.Errorf("renderNodeTable missing node: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRenderNodeTableEmpty(t *testing.T) {
|
||||
out := renderNodeTable(nil)
|
||||
if !strings.Contains(out, "No nodes") {
|
||||
t.Errorf("expected empty message, got: %s", out)
|
||||
}
|
||||
}
|
||||
@@ -1,127 +0,0 @@
|
||||
package config
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/hashicorp/hcl/v2/hclsimple"
|
||||
)
|
||||
|
||||
type CapacityConfig struct {
|
||||
CPU int `hcl:"cpu,optional"`
|
||||
MemoryMB int `hcl:"memory_mb,optional"`
|
||||
}
|
||||
|
||||
type Config struct {
|
||||
DBPath string `hcl:"db_path,optional"`
|
||||
ListenAddr string `hcl:"listen_addr,optional"`
|
||||
CAPath string `hcl:"ca_path,optional"`
|
||||
ServerCertPath string `hcl:"server_cert_path,optional"`
|
||||
ServerKeyPath string `hcl:"server_key_path,optional"`
|
||||
NodeCapacity *CapacityConfig `hcl:"node_capacity,block"`
|
||||
}
|
||||
|
||||
type Flags struct {
|
||||
DBPath *string
|
||||
ListenAddr *string
|
||||
CAPath *string
|
||||
ServerCertPath *string
|
||||
ServerKeyPath *string
|
||||
CPU *int
|
||||
MemoryMB *int
|
||||
}
|
||||
|
||||
type Environ map[string]string
|
||||
|
||||
func Load(paths ...string) (*Config, error) {
|
||||
for _, p := range paths {
|
||||
if _, err := os.Stat(p); err != nil {
|
||||
continue
|
||||
}
|
||||
data, err := os.ReadFile(p)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("read config %s: %w", p, err)
|
||||
}
|
||||
var cfg Config
|
||||
if err := hclsimple.Decode(p, data, nil, &cfg); err != nil {
|
||||
return nil, fmt.Errorf("decode config %s: %w", p, err)
|
||||
}
|
||||
return &cfg, nil
|
||||
}
|
||||
return &Config{}, nil
|
||||
}
|
||||
|
||||
func (c *Config) MergeOverrides(flags Flags, env Environ) *Config {
|
||||
out := &Config{
|
||||
DBPath: c.DBPath,
|
||||
ListenAddr: c.ListenAddr,
|
||||
CAPath: c.CAPath,
|
||||
ServerCertPath: c.ServerCertPath,
|
||||
ServerKeyPath: c.ServerKeyPath,
|
||||
NodeCapacity: c.NodeCapacity,
|
||||
}
|
||||
|
||||
applyStr := func(flag *string, envKey, fileVal string) string {
|
||||
if flag != nil {
|
||||
return *flag
|
||||
}
|
||||
if v, ok := env[envKey]; ok && v != "" {
|
||||
return v
|
||||
}
|
||||
return fileVal
|
||||
}
|
||||
|
||||
out.DBPath = applyStr(flags.DBPath, "ORCA_DB", out.DBPath)
|
||||
out.ListenAddr = applyStr(flags.ListenAddr, "ORCA_LISTEN_ADDR", out.ListenAddr)
|
||||
out.CAPath = applyStr(flags.CAPath, "ORCA_CA_PATH", out.CAPath)
|
||||
out.ServerCertPath = applyStr(flags.ServerCertPath, "ORCA_SERVER_CERT_PATH", out.ServerCertPath)
|
||||
out.ServerKeyPath = applyStr(flags.ServerKeyPath, "ORCA_SERVER_KEY_PATH", out.ServerKeyPath)
|
||||
|
||||
if out.NodeCapacity == nil {
|
||||
out.NodeCapacity = &CapacityConfig{}
|
||||
} else {
|
||||
nc := *out.NodeCapacity
|
||||
out.NodeCapacity = &nc
|
||||
}
|
||||
|
||||
if flags.CPU != nil {
|
||||
out.NodeCapacity.CPU = *flags.CPU
|
||||
} else if v, ok := env["ORCA_NODE_CPU"]; ok && v != "" {
|
||||
if n, err := atoi(v); err == nil {
|
||||
out.NodeCapacity.CPU = n
|
||||
}
|
||||
}
|
||||
|
||||
if flags.MemoryMB != nil {
|
||||
out.NodeCapacity.MemoryMB = *flags.MemoryMB
|
||||
} else if v, ok := env["ORCA_NODE_MEMORY_MB"]; ok && v != "" {
|
||||
if n, err := atoi(v); err == nil {
|
||||
out.NodeCapacity.MemoryMB = n
|
||||
}
|
||||
}
|
||||
|
||||
return out
|
||||
}
|
||||
|
||||
func atoi(s string) (int, error) {
|
||||
n := 0
|
||||
if s == "" {
|
||||
return 0, fmt.Errorf("empty")
|
||||
}
|
||||
neg := false
|
||||
i := 0
|
||||
if s[0] == '-' {
|
||||
neg = true
|
||||
i = 1
|
||||
}
|
||||
for ; i < len(s); i++ {
|
||||
if s[i] < '0' || s[i] > '9' {
|
||||
return 0, fmt.Errorf("bad")
|
||||
}
|
||||
n = n*10 + int(s[i]-'0')
|
||||
}
|
||||
if neg {
|
||||
n = -n
|
||||
}
|
||||
return n, nil
|
||||
}
|
||||
@@ -1,197 +0,0 @@
|
||||
package config
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
const exampleHCL = `
|
||||
db_path = "/tmp/orca/test.db"
|
||||
listen_addr = "127.0.0.1:9999"
|
||||
ca_path = "/tmp/orca/ca.crt"
|
||||
server_cert_path = "/tmp/orca/server.crt"
|
||||
server_key_path = "/tmp/orca/server.key"
|
||||
|
||||
node_capacity {
|
||||
cpu = 4
|
||||
memory_mb = 8192
|
||||
}
|
||||
`
|
||||
|
||||
func writeFile(t *testing.T, dir, name, content string) string {
|
||||
t.Helper()
|
||||
p := filepath.Join(dir, name)
|
||||
if err := os.WriteFile(p, []byte(content), 0644); err != nil {
|
||||
t.Fatalf("write %s: %v", p, err)
|
||||
}
|
||||
return p
|
||||
}
|
||||
|
||||
func TestLoad_Valid(t *testing.T) {
|
||||
p := writeFile(t, t.TempDir(), "config.hcl", exampleHCL)
|
||||
cfg, err := Load(p)
|
||||
if err != nil {
|
||||
t.Fatalf("Load: %v", err)
|
||||
}
|
||||
if cfg.DBPath != "/tmp/orca/test.db" {
|
||||
t.Errorf("DBPath=%q", cfg.DBPath)
|
||||
}
|
||||
if cfg.ListenAddr != "127.0.0.1:9999" {
|
||||
t.Errorf("ListenAddr=%q", cfg.ListenAddr)
|
||||
}
|
||||
if cfg.CAPath != "/tmp/orca/ca.crt" {
|
||||
t.Errorf("CAPath=%q", cfg.CAPath)
|
||||
}
|
||||
if cfg.ServerCertPath != "/tmp/orca/server.crt" {
|
||||
t.Errorf("ServerCertPath=%q", cfg.ServerCertPath)
|
||||
}
|
||||
if cfg.ServerKeyPath != "/tmp/orca/server.key" {
|
||||
t.Errorf("ServerKeyPath=%q", cfg.ServerKeyPath)
|
||||
}
|
||||
if cfg.NodeCapacity == nil {
|
||||
t.Fatal("NodeCapacity nil")
|
||||
}
|
||||
if cfg.NodeCapacity.CPU != 4 {
|
||||
t.Errorf("CPU=%d", cfg.NodeCapacity.CPU)
|
||||
}
|
||||
if cfg.NodeCapacity.MemoryMB != 8192 {
|
||||
t.Errorf("MemoryMB=%d", cfg.NodeCapacity.MemoryMB)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoad_Missing(t *testing.T) {
|
||||
cfg, err := Load(filepath.Join(t.TempDir(), "nope.hcl"))
|
||||
if err != nil {
|
||||
t.Fatalf("Load: %v", err)
|
||||
}
|
||||
if cfg == nil {
|
||||
t.Fatal("nil config")
|
||||
}
|
||||
if cfg.DBPath != "" || cfg.ListenAddr != "" || cfg.NodeCapacity != nil {
|
||||
t.Errorf("expected zero config, got %+v", cfg)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoad_Malformed(t *testing.T) {
|
||||
p := writeFile(t, t.TempDir(), "bad.hcl", "db_path = ")
|
||||
cfg, err := Load(p)
|
||||
if err == nil {
|
||||
t.Fatalf("expected error, got %+v", cfg)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoad_FirstExisting(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
existing := writeFile(t, dir, "real.hcl", exampleHCL)
|
||||
missing := filepath.Join(dir, "missing.hcl")
|
||||
cfg, err := Load(missing, existing)
|
||||
if err != nil {
|
||||
t.Fatalf("Load: %v", err)
|
||||
}
|
||||
if cfg.DBPath != "/tmp/orca/test.db" {
|
||||
t.Errorf("DBPath=%q", cfg.DBPath)
|
||||
}
|
||||
}
|
||||
|
||||
func strPtr(s string) *string { return &s }
|
||||
func intPtr(i int) *int { return &i }
|
||||
|
||||
func TestMergeOverrides_FlagWins(t *testing.T) {
|
||||
cfg := &Config{
|
||||
DBPath: "/file.db",
|
||||
ListenAddr: "127.0.0.1:9000",
|
||||
NodeCapacity: &CapacityConfig{
|
||||
CPU: 4,
|
||||
MemoryMB: 8192,
|
||||
},
|
||||
}
|
||||
flags := Flags{
|
||||
DBPath: strPtr("/flag.db"),
|
||||
ListenAddr: strPtr("0.0.0.0:1234"),
|
||||
}
|
||||
env := Environ{"ORCA_DB": "/env.db"}
|
||||
out := cfg.MergeOverrides(flags, env)
|
||||
if out.DBPath != "/flag.db" {
|
||||
t.Errorf("DBPath=%q want /flag.db", out.DBPath)
|
||||
}
|
||||
if out.ListenAddr != "0.0.0.0:1234" {
|
||||
t.Errorf("ListenAddr=%q want 0.0.0.0:1234", out.ListenAddr)
|
||||
}
|
||||
if cfg.DBPath != "/file.db" {
|
||||
t.Errorf("receiver mutated: %q", cfg.DBPath)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMergeOverrides_EnvWinsOverFile(t *testing.T) {
|
||||
cfg := &Config{DBPath: "/file.db", ListenAddr: "127.0.0.1:9000"}
|
||||
env := Environ{"ORCA_DB": "/env.db"}
|
||||
out := cfg.MergeOverrides(Flags{}, env)
|
||||
if out.DBPath != "/env.db" {
|
||||
t.Errorf("DBPath=%q want /env.db", out.DBPath)
|
||||
}
|
||||
if out.ListenAddr != "127.0.0.1:9000" {
|
||||
t.Errorf("ListenAddr=%q want 127.0.0.1:9000", out.ListenAddr)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMergeOverrides_FileWinsOverDefault(t *testing.T) {
|
||||
cfg := &Config{DBPath: "/file.db", ListenAddr: "127.0.0.1:9000"}
|
||||
out := cfg.MergeOverrides(Flags{}, Environ{})
|
||||
if out.DBPath != "/file.db" {
|
||||
t.Errorf("DBPath=%q want /file.db", out.DBPath)
|
||||
}
|
||||
if out.ListenAddr != "127.0.0.1:9000" {
|
||||
t.Errorf("ListenAddr=%q want 127.0.0.1:9000", out.ListenAddr)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMergeOverrides_EmptyFlagDoesNotOverride(t *testing.T) {
|
||||
cfg := &Config{DBPath: "/file.db"}
|
||||
env := Environ{"ORCA_DB": "/env.db"}
|
||||
out := cfg.MergeOverrides(Flags{}, env)
|
||||
if out.DBPath != "/env.db" {
|
||||
t.Errorf("DBPath=%q want /env.db", out.DBPath)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMergeOverrides_EmptyEnvDoesNotOverride(t *testing.T) {
|
||||
cfg := &Config{DBPath: "/file.db"}
|
||||
env := Environ{"ORCA_DB": ""}
|
||||
out := cfg.MergeOverrides(Flags{}, env)
|
||||
if out.DBPath != "/file.db" {
|
||||
t.Errorf("DBPath=%q want /file.db", out.DBPath)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMergeOverrides_NodeCapacity(t *testing.T) {
|
||||
cfg := &Config{
|
||||
NodeCapacity: &CapacityConfig{CPU: 4, MemoryMB: 8192},
|
||||
}
|
||||
out := cfg.MergeOverrides(Flags{}, Environ{})
|
||||
if out.NodeCapacity == nil {
|
||||
t.Fatal("NodeCapacity nil")
|
||||
}
|
||||
if out.NodeCapacity.CPU != 4 {
|
||||
t.Errorf("CPU=%d want 4", out.NodeCapacity.CPU)
|
||||
}
|
||||
if out.NodeCapacity.MemoryMB != 8192 {
|
||||
t.Errorf("MemoryMB=%d want 8192", out.NodeCapacity.MemoryMB)
|
||||
}
|
||||
if cfg.NodeCapacity == out.NodeCapacity {
|
||||
t.Error("NodeCapacity not cloned")
|
||||
}
|
||||
}
|
||||
|
||||
func TestMergeOverrides_NodeCapacityFlagAndEnv(t *testing.T) {
|
||||
cfg := &Config{NodeCapacity: &CapacityConfig{CPU: 4, MemoryMB: 8192}}
|
||||
flags := Flags{CPU: intPtr(8)}
|
||||
env := Environ{"ORCA_NODE_MEMORY_MB": "16384"}
|
||||
out := cfg.MergeOverrides(flags, env)
|
||||
if out.NodeCapacity.CPU != 8 {
|
||||
t.Errorf("CPU=%d want 8", out.NodeCapacity.CPU)
|
||||
}
|
||||
if out.NodeCapacity.MemoryMB != 16384 {
|
||||
t.Errorf("MemoryMB=%d want 16384", out.NodeCapacity.MemoryMB)
|
||||
}
|
||||
}
|
||||
Vendored
-10
@@ -1,10 +0,0 @@
|
||||
db_path = "/tmp/orca/test.db"
|
||||
listen_addr = "127.0.0.1:9999"
|
||||
ca_path = "/tmp/orca/ca.crt"
|
||||
server_cert_path = "/tmp/orca/server.crt"
|
||||
server_key_path = "/tmp/orca/server.key"
|
||||
|
||||
node_capacity {
|
||||
cpu = 4
|
||||
memory_mb = 8192
|
||||
}
|
||||
@@ -1,45 +0,0 @@
|
||||
package daemon
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/http/pprof"
|
||||
"time"
|
||||
)
|
||||
|
||||
func StartPprof(addr string, log *slog.Logger) (*http.Server, error) {
|
||||
if addr == "" {
|
||||
return nil, nil
|
||||
}
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("/debug/pprof/", pprof.Index)
|
||||
mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
|
||||
mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
|
||||
mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
|
||||
mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
|
||||
mux.Handle("/debug/pprof/heap", pprof.Handler("heap"))
|
||||
mux.Handle("/debug/pprof/goroutine", pprof.Handler("goroutine"))
|
||||
mux.Handle("/debug/pprof/threadcreate", pprof.Handler("threadcreate"))
|
||||
mux.Handle("/debug/pprof/block", pprof.Handler("block"))
|
||||
mux.Handle("/debug/pprof/mutex", pprof.Handler("mutex"))
|
||||
|
||||
server := &http.Server{
|
||||
Addr: addr,
|
||||
Handler: mux,
|
||||
ReadHeaderTimeout: 5 * time.Second,
|
||||
}
|
||||
|
||||
log.Warn("pprof endpoint exposed",
|
||||
slog.String("addr", addr),
|
||||
slog.String("warning", "unauthenticated, operator-only — do not expose publicly"))
|
||||
|
||||
go func() {
|
||||
err := server.ListenAndServe()
|
||||
if err != nil && !errors.Is(err, http.ErrServerClosed) {
|
||||
log.Error("pprof server stopped", slog.String("addr", addr), slog.Any("err", err))
|
||||
}
|
||||
}()
|
||||
|
||||
return server, nil
|
||||
}
|
||||
@@ -1,263 +0,0 @@
|
||||
package daemon
|
||||
|
||||
import (
|
||||
"context"
|
||||
"io"
|
||||
"log/slog"
|
||||
"net"
|
||||
"net/http"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
func TestStartPprof_Disabled(t *testing.T) {
|
||||
srv, err := StartPprof("", slog.Default())
|
||||
if err != nil {
|
||||
t.Fatalf("StartPprof(\"\", _) returned err: %v", err)
|
||||
}
|
||||
if srv != nil {
|
||||
t.Fatalf("StartPprof(\"\", _) returned non-nil server: %v", srv)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStartPprof_Enabled(t *testing.T) {
|
||||
log := slog.New(slog.NewTextHandler(io.Discard, nil))
|
||||
|
||||
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listen: %v", err)
|
||||
}
|
||||
addr := ln.Addr().String()
|
||||
_ = ln.Close()
|
||||
|
||||
srv, err := StartPprof(addr, log)
|
||||
if err != nil {
|
||||
t.Fatalf("StartPprof returned err: %v", err)
|
||||
}
|
||||
if srv == nil {
|
||||
t.Fatal("StartPprof returned nil server for non-empty addr")
|
||||
}
|
||||
t.Cleanup(func() {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
|
||||
defer cancel()
|
||||
_ = srv.Shutdown(ctx)
|
||||
})
|
||||
|
||||
deadline := time.Now().Add(2 * time.Second)
|
||||
var base string
|
||||
for time.Now().Before(deadline) {
|
||||
conn, derr := net.DialTimeout("tcp", addr, 50*time.Millisecond)
|
||||
if derr == nil {
|
||||
_ = conn.Close()
|
||||
base = "http://" + addr
|
||||
break
|
||||
}
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
}
|
||||
if base == "" {
|
||||
t.Fatal("pprof server did not start listening")
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: 500 * time.Millisecond}
|
||||
for _, path := range []string{"/debug/pprof/", "/debug/pprof/cmdline", "/debug/pprof/heap"} {
|
||||
resp, gerr := client.Get(base + path)
|
||||
if gerr != nil {
|
||||
t.Errorf("GET %s: %v", path, gerr)
|
||||
continue
|
||||
}
|
||||
_, _ = io.Copy(io.Discard, resp.Body)
|
||||
_ = resp.Body.Close()
|
||||
if resp.StatusCode != 200 {
|
||||
t.Errorf("GET %s: expected 200, got %d", path, resp.StatusCode)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestStartPprof_Shutdown(t *testing.T) {
|
||||
log := slog.New(slog.NewTextHandler(io.Discard, nil))
|
||||
|
||||
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listen: %v", err)
|
||||
}
|
||||
addr := ln.Addr().String()
|
||||
_ = ln.Close()
|
||||
|
||||
srv, err := StartPprof(addr, log)
|
||||
if err != nil {
|
||||
t.Fatalf("StartPprof returned err: %v", err)
|
||||
}
|
||||
if srv == nil {
|
||||
t.Fatal("StartPprof returned nil server")
|
||||
}
|
||||
|
||||
deadline := time.Now().Add(2 * time.Second)
|
||||
for time.Now().Before(deadline) {
|
||||
conn, derr := net.DialTimeout("tcp", addr, 50*time.Millisecond)
|
||||
if derr == nil {
|
||||
_ = conn.Close()
|
||||
break
|
||||
}
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
|
||||
defer cancel()
|
||||
if err := srv.Shutdown(ctx); err != nil {
|
||||
t.Fatalf("Shutdown: %v", err)
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: 300 * time.Millisecond}
|
||||
_, gerr := client.Get("http://" + addr + "/debug/pprof/")
|
||||
if gerr == nil {
|
||||
t.Error("expected GET to fail after Shutdown, but it succeeded")
|
||||
}
|
||||
}
|
||||
|
||||
func TestStartPprof_MuxIsolated(t *testing.T) {
|
||||
log := slog.New(slog.NewTextHandler(io.Discard, nil))
|
||||
|
||||
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listen: %v", err)
|
||||
}
|
||||
addr := ln.Addr().String()
|
||||
_ = ln.Close()
|
||||
|
||||
srv, err := StartPprof(addr, log)
|
||||
if err != nil {
|
||||
t.Fatalf("StartPprof returned err: %v", err)
|
||||
}
|
||||
if srv == nil {
|
||||
t.Fatal("StartPprof returned nil server")
|
||||
}
|
||||
t.Cleanup(func() {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
|
||||
defer cancel()
|
||||
_ = srv.Shutdown(ctx)
|
||||
})
|
||||
|
||||
deadline := time.Now().Add(2 * time.Second)
|
||||
for time.Now().Before(deadline) {
|
||||
conn, derr := net.DialTimeout("tcp", addr, 50*time.Millisecond)
|
||||
if derr == nil {
|
||||
_ = conn.Close()
|
||||
break
|
||||
}
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: 500 * time.Millisecond}
|
||||
resp, err := client.Get("http://" + addr + "/healthz")
|
||||
if err != nil {
|
||||
t.Fatalf("GET /healthz: %v", err)
|
||||
}
|
||||
_, _ = io.Copy(io.Discard, resp.Body)
|
||||
_ = resp.Body.Close()
|
||||
if resp.StatusCode != 404 {
|
||||
t.Errorf("expected /healthz to 404 on pprof-only mux, got %d", resp.StatusCode)
|
||||
}
|
||||
}
|
||||
|
||||
func TestServer_WithPprof(t *testing.T) {
|
||||
db, err := store.Open(filepath.Join(t.TempDir(), "pprof.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
log := slog.New(slog.NewTextHandler(io.Discard, nil))
|
||||
|
||||
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listen main: %v", err)
|
||||
}
|
||||
mainAddr := ln.Addr().String()
|
||||
|
||||
pln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listen pprof: %v", err)
|
||||
}
|
||||
pprofAddr := pln.Addr().String()
|
||||
_ = pln.Close()
|
||||
|
||||
s := NewServer(Options{
|
||||
DB: db,
|
||||
Log: log,
|
||||
Addr: mainAddr,
|
||||
PprofAddr: pprofAddr,
|
||||
})
|
||||
s.MarkReady()
|
||||
|
||||
if s.pprofServer == nil {
|
||||
t.Fatal("expected pprofServer to be non-nil after NewServer with PprofAddr")
|
||||
}
|
||||
|
||||
errCh := make(chan error, 2)
|
||||
go func() {
|
||||
err := s.httpServer.Serve(ln)
|
||||
if err != nil && err != http.ErrServerClosed {
|
||||
errCh <- err
|
||||
}
|
||||
}()
|
||||
|
||||
deadline := time.Now().Add(2 * time.Second)
|
||||
for time.Now().Before(deadline) {
|
||||
conn, derr := net.DialTimeout("tcp", pprofAddr, 50*time.Millisecond)
|
||||
if derr == nil {
|
||||
_ = conn.Close()
|
||||
break
|
||||
}
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: 500 * time.Millisecond}
|
||||
resp, err := client.Get("http://" + mainAddr + "/healthz")
|
||||
if err != nil {
|
||||
t.Fatalf("GET main /healthz: %v", err)
|
||||
}
|
||||
if resp.StatusCode != 200 {
|
||||
t.Errorf("main /healthz: expected 200, got %d", resp.StatusCode)
|
||||
}
|
||||
_, _ = io.Copy(io.Discard, resp.Body)
|
||||
_ = resp.Body.Close()
|
||||
|
||||
presp, err := client.Get("http://" + pprofAddr + "/debug/pprof/")
|
||||
if err != nil {
|
||||
t.Fatalf("GET pprof /debug/pprof/: %v", err)
|
||||
}
|
||||
if presp.StatusCode != 200 {
|
||||
t.Errorf("pprof /debug/pprof/: expected 200, got %d", presp.StatusCode)
|
||||
}
|
||||
_, _ = io.Copy(io.Discard, presp.Body)
|
||||
_ = presp.Body.Close()
|
||||
|
||||
presp, err = client.Get("http://" + pprofAddr + "/healthz")
|
||||
if err != nil {
|
||||
t.Fatalf("GET pprof /healthz: %v", err)
|
||||
}
|
||||
_, _ = io.Copy(io.Discard, presp.Body)
|
||||
_ = presp.Body.Close()
|
||||
if presp.StatusCode != 404 {
|
||||
t.Errorf("expected /healthz 404 on pprof mux, got %d", presp.StatusCode)
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
|
||||
defer cancel()
|
||||
if err := s.Shutdown(ctx); err != nil {
|
||||
t.Errorf("Shutdown: %v", err)
|
||||
}
|
||||
|
||||
client = &http.Client{Timeout: 300 * time.Millisecond}
|
||||
_, gerr := client.Get("http://" + pprofAddr + "/debug/pprof/")
|
||||
if gerr == nil {
|
||||
t.Error("expected pprof GET to fail after Shutdown")
|
||||
}
|
||||
_, merr := client.Get("http://" + mainAddr + "/healthz")
|
||||
if merr == nil {
|
||||
t.Error("expected main GET to fail after Shutdown")
|
||||
}
|
||||
}
|
||||
@@ -29,8 +29,7 @@ type Server struct {
|
||||
addr string
|
||||
ready atomic.Bool
|
||||
|
||||
httpServer *http.Server
|
||||
pprofServer *http.Server
|
||||
httpServer *http.Server
|
||||
|
||||
// mtls is non-nil after StartMTLS has been called; nil otherwise.
|
||||
// Plaintext HTTP and mTLS are mutually exclusive — a Server is
|
||||
@@ -50,12 +49,6 @@ type Options struct {
|
||||
Log *slog.Logger
|
||||
Addr string
|
||||
Actor string // used for audit logging from API requests
|
||||
|
||||
// PprofAddr enables the pprof endpoint on a separate listener
|
||||
// when non-empty (e.g. "127.0.0.1:6060"). Default "" disables it.
|
||||
// The pprof listener is unauthenticated and operator-only; never
|
||||
// expose it publicly (AD-024).
|
||||
PprofAddr string
|
||||
}
|
||||
|
||||
// NewServer constructs a Server with the default mux and route table.
|
||||
@@ -82,14 +75,6 @@ func NewServer(opts Options) *Server {
|
||||
WriteTimeout: 30 * time.Second,
|
||||
IdleTimeout: 60 * time.Second,
|
||||
}
|
||||
if opts.PprofAddr != "" {
|
||||
ps, perr := StartPprof(opts.PprofAddr, opts.Log)
|
||||
if perr != nil {
|
||||
s.log.Error("pprof start failed", slog.String("component", "daemon"), slog.Any("err", perr))
|
||||
} else {
|
||||
s.pprofServer = ps
|
||||
}
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
@@ -157,11 +142,6 @@ func (s *Server) Start() error {
|
||||
func (s *Server) Shutdown(ctx context.Context) error {
|
||||
s.MarkNotReady()
|
||||
s.log.Info("daemon shutting down", slog.String("component", "daemon"))
|
||||
if s.pprofServer != nil {
|
||||
if perr := s.pprofServer.Shutdown(ctx); perr != nil {
|
||||
s.log.Error("pprof shutdown failed", slog.String("component", "daemon"), slog.Any("err", perr))
|
||||
}
|
||||
}
|
||||
return s.httpServer.Shutdown(ctx)
|
||||
}
|
||||
|
||||
|
||||
+13
-293
@@ -19,21 +19,12 @@ import (
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"os"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"golang.org/x/crypto/ssh"
|
||||
"golang.org/x/crypto/ssh/knownhosts"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
||||
"git.cloudinit.dev/coreci/orca/internal/model"
|
||||
"git.cloudinit.dev/coreci/orca/internal/osdetect"
|
||||
"git.cloudinit.dev/coreci/orca/internal/security"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
"git.cloudinit.dev/coreci/orca/internal/transport"
|
||||
)
|
||||
|
||||
// Result is the outcome of a single check.
|
||||
@@ -72,10 +63,8 @@ func All() []Check {
|
||||
CertServer(),
|
||||
CertExpiry(),
|
||||
CertFingerprint(),
|
||||
OS(),
|
||||
Network(),
|
||||
Proxmox(),
|
||||
DB(),
|
||||
NetworkStub(),
|
||||
DBStub(),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -188,297 +177,28 @@ func CertFingerprint() Check {
|
||||
}
|
||||
}
|
||||
|
||||
// DB checks SQLite integrity and migration version (REQ-032 completion).
|
||||
func DB() Check {
|
||||
return Check{
|
||||
Name: "db",
|
||||
Description: "SQLite integrity_check + migration version",
|
||||
Run: func(ctx context.Context) (Result, string) {
|
||||
path := certpaths.DBPath()
|
||||
db, err := store.Open(path)
|
||||
if err != nil {
|
||||
return ResultFail, fmt.Sprintf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
var integrity string
|
||||
if err := db.QueryRowContext(ctx, "PRAGMA integrity_check").Scan(&integrity); err != nil {
|
||||
return ResultFail, fmt.Sprintf("integrity_check: %v", err)
|
||||
}
|
||||
if !strings.EqualFold(integrity, "ok") {
|
||||
return ResultFail, fmt.Sprintf("integrity_check: %s", integrity)
|
||||
}
|
||||
|
||||
version, err := store.MigrationVersion(ctx, db)
|
||||
if err != nil {
|
||||
return ResultFail, fmt.Sprintf("migration version: %v", err)
|
||||
}
|
||||
if version == "" {
|
||||
return ResultWarn, "integrity OK but no migrations applied (fresh db)"
|
||||
}
|
||||
return ResultPass, fmt.Sprintf("integrity OK, migrations up to %s", version)
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// Network probes peer reachability via mTLS /healthz (REQ-032 completion).
|
||||
// Peers are sourced from the persisted nodes table (not the in-memory
|
||||
// PeerRegistry, which is empty at CLI time). Zero peers → WARN (single-node
|
||||
// is legitimate). Any peer unreachable → FAIL (D-038).
|
||||
func Network() Check {
|
||||
// NetworkStub is a stub for the network check; full impl in P02.
|
||||
func NetworkStub() Check {
|
||||
return Check{
|
||||
Name: "network",
|
||||
Description: "peer reachability via mTLS /healthz probe",
|
||||
Run: func(ctx context.Context) (Result, string) {
|
||||
caPath := certpaths.CACertPath()
|
||||
certPath := certpaths.ServerCertPath()
|
||||
keyPath := certpaths.ServerKeyPath()
|
||||
|
||||
// Check that cert files exist before attempting probes.
|
||||
if _, err := os.Stat(caPath); err != nil {
|
||||
return ResultFail, fmt.Sprintf("CA cert missing: %v (run `orca cert init`)", err)
|
||||
}
|
||||
|
||||
path := certpaths.DBPath()
|
||||
db, err := store.Open(path)
|
||||
if err != nil {
|
||||
return ResultFail, fmt.Sprintf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
nodes, err := store.NewNodeRepo(db).List(ctx)
|
||||
if err != nil {
|
||||
return ResultFail, fmt.Sprintf("list nodes: %v", err)
|
||||
}
|
||||
|
||||
live := make([]*model.Node, 0, len(nodes))
|
||||
for _, n := range nodes {
|
||||
if n.State != model.NodeStateLeft {
|
||||
live = append(live, n)
|
||||
}
|
||||
}
|
||||
|
||||
if len(live) == 0 {
|
||||
return ResultWarn, "no peers registered (single-node?)"
|
||||
}
|
||||
|
||||
var lines []string
|
||||
anyFail := false
|
||||
for _, n := range live {
|
||||
probeCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
|
||||
err := probeHealthz(probeCtx, caPath, certPath, keyPath, n.Name, n.Address)
|
||||
cancel()
|
||||
if err != nil {
|
||||
anyFail = true
|
||||
lines = append(lines, fmt.Sprintf(" ✗ %s (%s): %v", n.Name, n.Address, err))
|
||||
} else {
|
||||
lines = append(lines, fmt.Sprintf(" ✓ %s (%s)", n.Name, n.Address))
|
||||
}
|
||||
}
|
||||
|
||||
result := ResultPass
|
||||
if anyFail {
|
||||
result = ResultFail
|
||||
}
|
||||
return result, strings.Join(lines, "\n")
|
||||
Description: "TCP reachability + mTLS handshake (full impl in P02)",
|
||||
Run: func(_ context.Context) (Result, string) {
|
||||
return ResultWarn, "network check is a stub in P01; full impl in P02"
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// probeHealthz opens an mTLS connection to the peer and GETs /healthz.
|
||||
func probeHealthz(ctx context.Context, caPath, certPath, keyPath, serverName, addr string) error {
|
||||
client, err := transport.NewMTLSClient(caPath, serverName, certPath, keyPath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("mTLS client: %w", err)
|
||||
}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://"+addr+"/healthz", nil)
|
||||
if err != nil {
|
||||
return fmt.Errorf("request: %w", err)
|
||||
}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return fmt.Errorf("probe: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return fmt.Errorf("healthz returned %d", resp.StatusCode)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// OS checks that the auto-detected OS matches the stored localhost
|
||||
// node's os field (REQ-052). Drift (e.g., OS upgraded since init)
|
||||
// returns WARN; match returns PASS; missing localhost node returns FAIL.
|
||||
func OS() Check {
|
||||
// DBStub is a stub for the database check; full impl in P02.
|
||||
func DBStub() Check {
|
||||
return Check{
|
||||
Name: "os",
|
||||
Description: "localhost OS detection vs stored node row",
|
||||
Run: func(ctx context.Context) (Result, string) {
|
||||
detected := osdetect.Detect()
|
||||
|
||||
db, err := store.Open(certpaths.DBPath())
|
||||
if err != nil {
|
||||
return ResultFail, fmt.Sprintf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
node, err := store.NewNodeRepo(db).GetByName(ctx, "localhost")
|
||||
if err == store.ErrNotFound {
|
||||
return ResultFail, "no localhost node registered — run `orca init`"
|
||||
}
|
||||
if err != nil {
|
||||
return ResultFail, fmt.Sprintf("lookup localhost node: %v", err)
|
||||
}
|
||||
if node.OS == "" {
|
||||
return ResultWarn, fmt.Sprintf("localhost node has no os field (pre-0006 row?); detected=%s — re-run `orca init` to refresh", detected)
|
||||
}
|
||||
if node.OS != detected {
|
||||
return ResultWarn, fmt.Sprintf("OS drift: init=%s, now=%s — re-run `orca init` to refresh", node.OS, detected)
|
||||
}
|
||||
return ResultPass, fmt.Sprintf("localhost os=%s (matches /etc/os-release)", detected)
|
||||
Name: "db",
|
||||
Description: "SQLite open + migration apply (full impl in P02)",
|
||||
Run: func(_ context.Context) (Result, string) {
|
||||
return ResultWarn, "db check is a stub in P01; full impl in P02"
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// Proxmox probes each kind=proxmox node via SSH with `pveversion`
|
||||
// (REQ-052). Clones the Network() pattern: list nodes, filter by kind,
|
||||
// 3s timeout per peer, PASS/WARN/FAIL per node. Zero proxmox nodes
|
||||
// returns WARN (single-node cluster is legitimate).
|
||||
func Proxmox() Check {
|
||||
return Check{
|
||||
Name: "proxmox",
|
||||
Description: "proxmox node reachability via SSH pveversion probe",
|
||||
Run: func(ctx context.Context) (Result, string) {
|
||||
db, err := store.Open(certpaths.DBPath())
|
||||
if err != nil {
|
||||
return ResultFail, fmt.Sprintf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
nodes, err := store.NewNodeRepo(db).List(ctx)
|
||||
if err != nil {
|
||||
return ResultFail, fmt.Sprintf("list nodes: %v", err)
|
||||
}
|
||||
|
||||
proxmoxNodes := make([]*model.Node, 0, len(nodes))
|
||||
for _, n := range nodes {
|
||||
if n.Kind == string(model.NodeKindProxmox) && n.State != model.NodeStateLeft {
|
||||
proxmoxNodes = append(proxmoxNodes, n)
|
||||
}
|
||||
}
|
||||
|
||||
if len(proxmoxNodes) == 0 {
|
||||
return ResultWarn, "no proxmox nodes registered (single-node?)"
|
||||
}
|
||||
|
||||
var lines []string
|
||||
anyFail := false
|
||||
for _, n := range proxmoxNodes {
|
||||
probeCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
|
||||
err := probeProxmoxPVEVersion(probeCtx, n.Name)
|
||||
cancel()
|
||||
if err != nil {
|
||||
anyFail = true
|
||||
lines = append(lines, fmt.Sprintf(" ✗ %s: %v", n.Name, err))
|
||||
} else {
|
||||
lines = append(lines, fmt.Sprintf(" ✓ %s", n.Name))
|
||||
}
|
||||
}
|
||||
|
||||
result := ResultPass
|
||||
if anyFail {
|
||||
result = ResultFail
|
||||
}
|
||||
return result, strings.Join(lines, "\n")
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// probeProxmoxPVEVersion SSHes into the proxmox host and runs
|
||||
// `pveversion` to verify reachability + PVE installation. Uses the
|
||||
// orca SSH key for auth (deployed during `orca node join --type proxmox`)
|
||||
// and the known_hosts TOFU store for host-key verification (D-035).
|
||||
func probeProxmoxPVEVersion(ctx context.Context, host string) error {
|
||||
// Load the orca SSH key for public-key auth.
|
||||
keyPEM, err := os.ReadFile(certpaths.SSHKeyPath())
|
||||
if err != nil {
|
||||
return fmt.Errorf("read SSH key: %w (run `orca node join --type proxmox` first)", err)
|
||||
}
|
||||
signer, err := ssh.ParsePrivateKey(keyPEM)
|
||||
if err != nil {
|
||||
return fmt.Errorf("parse SSH key: %w", err)
|
||||
}
|
||||
|
||||
hostKeyCallback, err := knownhosts.New(certpaths.KnownHostsPath())
|
||||
if err != nil {
|
||||
return fmt.Errorf("known_hosts: %w", err)
|
||||
}
|
||||
|
||||
config := &ssh.ClientConfig{
|
||||
User: "orca",
|
||||
Auth: []ssh.AuthMethod{ssh.PublicKeys(signer)},
|
||||
HostKeyCallback: hostKeyCallback,
|
||||
Timeout: 3 * time.Second,
|
||||
}
|
||||
|
||||
// Extract host from the node address (orca stores host:8443;
|
||||
// SSH needs host:22). We dial the SSH port, not the orca daemon port.
|
||||
sshHost := host
|
||||
if strings.Contains(host, ":") {
|
||||
sshHost = strings.SplitN(host, ":", 2)[0]
|
||||
}
|
||||
sshAddr := sshHost + ":22"
|
||||
|
||||
dialer := &netDialer{}
|
||||
conn, err := dialer.DialContext(ctx, "tcp", sshAddr, config)
|
||||
if err != nil {
|
||||
return fmt.Errorf("ssh dial: %w", err)
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
session, err := conn.NewSession()
|
||||
if err != nil {
|
||||
return fmt.Errorf("new session: %w", err)
|
||||
}
|
||||
defer session.Close()
|
||||
|
||||
out, err := session.CombinedOutput("pveversion")
|
||||
if err != nil {
|
||||
return fmt.Errorf("pveversion: %w (output: %s)", err, strings.TrimSpace(string(out)))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// netDialer wraps ssh.Dial with context support. The ssh package's
|
||||
// Dial doesn't accept a context directly, so we use a dialer that
|
||||
// respects ctx cancellation via a goroutine + channel.
|
||||
type netDialer struct{}
|
||||
|
||||
func (d *netDialer) DialContext(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
|
||||
type result struct {
|
||||
client *ssh.Client
|
||||
err error
|
||||
}
|
||||
ch := make(chan result, 1)
|
||||
go func() {
|
||||
client, err := ssh.Dial(network, addr, config)
|
||||
ch <- result{client, err}
|
||||
}()
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
// Best-effort: if the dial succeeds after ctx cancellation,
|
||||
// the goroutine will close the client. We return the ctx error.
|
||||
go func() {
|
||||
if r := <-ch; r.client != nil {
|
||||
_ = r.client.Close()
|
||||
}
|
||||
}()
|
||||
return nil, ctx.Err()
|
||||
case r := <-ch:
|
||||
return r.client, r.err
|
||||
}
|
||||
}
|
||||
|
||||
// loadCert reads a PEM cert from path and parses the first CERTIFICATE
|
||||
// block.
|
||||
func loadCert(path string) (*x509.Certificate, error) {
|
||||
|
||||
+35
-341
@@ -2,75 +2,60 @@ package doctor
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/model"
|
||||
"git.cloudinit.dev/coreci/orca/internal/osdetect"
|
||||
"git.cloudinit.dev/coreci/orca/internal/security"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
// TestRunAllChecksWithNoCA runs the full battery in a clean temp dir.
|
||||
// With the P02 real checks (no stubs): cert checks FAIL (no CA),
|
||||
// db check PASS (store.Open runs migrations), network check WARN
|
||||
// (no peers).
|
||||
// TestRunAllChecksWithNoCA runs the full battery in a clean temp dir
|
||||
// and expects all checks to FAIL (no CA, no server cert) except the
|
||||
// two stubs which return WARN.
|
||||
func TestRunAllChecksWithNoCA(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
|
||||
// Isolated home so we don't touch the real ~/.orca.
|
||||
t.Setenv("ORCA_HOME", t.TempDir())
|
||||
|
||||
rep := Run(context.Background())
|
||||
if len(rep.Checks) == 0 {
|
||||
t.Fatal("expected checks, got 0")
|
||||
}
|
||||
|
||||
byName := make(map[string]CheckResult, len(rep.Checks))
|
||||
hasFail := false
|
||||
hasWarn := false
|
||||
for _, c := range rep.Checks {
|
||||
byName[c.Name] = c
|
||||
}
|
||||
|
||||
// Cert checks: no CA → FAIL.
|
||||
for _, name := range []string{"cert.ca", "cert.server", "cert.expiry", "cert.fingerprint"} {
|
||||
c, ok := byName[name]
|
||||
if !ok {
|
||||
t.Errorf("missing check %s", name)
|
||||
continue
|
||||
if c.Result == ResultFail {
|
||||
hasFail = true
|
||||
}
|
||||
if c.Result != ResultFail {
|
||||
t.Errorf("%s: got %s, want FAIL — %s", name, c.Result, c.Message)
|
||||
if c.Result == ResultWarn {
|
||||
hasWarn = true
|
||||
}
|
||||
}
|
||||
|
||||
// DB check: store.Open runs migrations → PASS.
|
||||
if c, ok := byName["db"]; ok {
|
||||
if c.Result != ResultPass {
|
||||
t.Errorf("db: got %s, want PASS — %s", c.Result, c.Message)
|
||||
}
|
||||
} else {
|
||||
t.Error("missing check db")
|
||||
if !hasFail {
|
||||
t.Error("expected at least one FAIL (no CA installed)")
|
||||
}
|
||||
if !hasWarn {
|
||||
t.Error("expected at least one WARN (stubs in P01)")
|
||||
}
|
||||
|
||||
// Network check: no CA → FAIL (can't build mTLS client without CA).
|
||||
if c, ok := byName["network"]; ok {
|
||||
if c.Result != ResultFail {
|
||||
t.Errorf("network: got %s, want FAIL (no CA cert) — %s", c.Result, c.Message)
|
||||
}
|
||||
} else {
|
||||
t.Error("missing check network")
|
||||
// Render the report — basic shape check.
|
||||
out := rep.Print()
|
||||
if !strings.Contains(out, "PASS") {
|
||||
t.Errorf("expected PASS in output, got: %s", out)
|
||||
}
|
||||
if !strings.Contains(out, "WARN") {
|
||||
t.Errorf("expected WARN in output, got: %s", out)
|
||||
}
|
||||
if !strings.Contains(out, "FAIL") {
|
||||
t.Errorf("expected FAIL in output, got: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
// TestRunWithCAAndServerCert covers the happy path: CA + server cert
|
||||
// installed → all cert checks PASS, db PASS, network WARN (no peers).
|
||||
// installed → all cert checks PASS.
|
||||
func TestRunWithCAAndServerCert(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
|
||||
|
||||
// Bootstrap CA.
|
||||
if _, err := security.CAInit(dir, "test-ca"); err != nil {
|
||||
t.Fatalf("CAInit: %v", err)
|
||||
}
|
||||
@@ -78,6 +63,7 @@ func TestRunWithCAAndServerCert(t *testing.T) {
|
||||
if err != nil {
|
||||
t.Fatalf("LoadCA: %v", err)
|
||||
}
|
||||
// Generate + sign server cert.
|
||||
keyPEM, csrPEM, err := security.GenerateCSR("test-server", []string{"localhost", "127.0.0.1"})
|
||||
if err != nil {
|
||||
t.Fatalf("GenerateCSR: %v", err)
|
||||
@@ -94,305 +80,13 @@ func TestRunWithCAAndServerCert(t *testing.T) {
|
||||
}
|
||||
|
||||
rep := Run(context.Background())
|
||||
byName := make(map[string]CheckResult, len(rep.Checks))
|
||||
// The cert-related checks should be PASS; the network/db stubs WARN.
|
||||
for _, c := range rep.Checks {
|
||||
byName[c.Name] = c
|
||||
}
|
||||
|
||||
for _, name := range []string{"cert.ca", "cert.server", "cert.expiry", "cert.fingerprint", "db"} {
|
||||
c, ok := byName[name]
|
||||
if !ok {
|
||||
t.Errorf("missing check %s", name)
|
||||
continue
|
||||
}
|
||||
if c.Result != ResultPass {
|
||||
t.Errorf("%s: got %s, want PASS — %s", name, c.Result, c.Message)
|
||||
}
|
||||
}
|
||||
|
||||
if c, ok := byName["network"]; ok {
|
||||
if c.Result != ResultWarn {
|
||||
t.Errorf("network: got %s, want WARN (no peers) — %s", c.Result, c.Message)
|
||||
switch c.Name {
|
||||
case "cert.ca", "cert.server", "cert.expiry", "cert.fingerprint":
|
||||
if c.Result != ResultPass {
|
||||
t.Errorf("%s: got %s, want PASS — %s", c.Name, c.Result, c.Message)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestDBCheck_IntegrityOK verifies the DB check passes on a fresh
|
||||
// database with migrations applied.
|
||||
func TestDBCheck_IntegrityOK(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
|
||||
|
||||
db, err := store.Open(filepath.Join(dir, "orca.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
c := DB()
|
||||
r, msg := c.Run(context.Background())
|
||||
if r != ResultPass {
|
||||
t.Errorf("DB check: got %s, want PASS — %s", r, msg)
|
||||
}
|
||||
if !strings.Contains(msg, "migrations up to") {
|
||||
t.Errorf("DB check message should contain migration version, got: %s", msg)
|
||||
}
|
||||
}
|
||||
|
||||
// TestNetworkCheck_NoPeers verifies the network check returns WARN
|
||||
// when no peers are registered.
|
||||
func TestNetworkCheck_NoPeers(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
|
||||
|
||||
// Create a CA + server cert so the network check can build a client.
|
||||
if _, err := security.CAInit(dir, "test-ca"); err != nil {
|
||||
t.Fatalf("CAInit: %v", err)
|
||||
}
|
||||
ca, _ := security.LoadCA(dir)
|
||||
keyPEM, csrPEM, _ := security.GenerateCSR("test-server", []string{"localhost"})
|
||||
certPEM, _ := ca.SignCSR(csrPEM)
|
||||
_ = security.WriteCert(dir+"/server.crt", certPEM)
|
||||
_ = security.WriteKey(dir+"/server.key", keyPEM)
|
||||
|
||||
c := Network()
|
||||
r, msg := c.Run(context.Background())
|
||||
if r != ResultWarn {
|
||||
t.Errorf("Network check: got %s, want WARN — %s", r, msg)
|
||||
}
|
||||
if !strings.Contains(msg, "no peers") {
|
||||
t.Errorf("Network check message should mention no peers, got: %s", msg)
|
||||
}
|
||||
}
|
||||
|
||||
// TestNetworkCheck_PeerUnreachable verifies the network check returns
|
||||
// FAIL when a registered peer is not reachable.
|
||||
func TestNetworkCheck_PeerUnreachable(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
|
||||
|
||||
// Create a CA + server cert.
|
||||
if _, err := security.CAInit(dir, "test-ca"); err != nil {
|
||||
t.Fatalf("CAInit: %v", err)
|
||||
}
|
||||
ca, _ := security.LoadCA(dir)
|
||||
keyPEM, csrPEM, _ := security.GenerateCSR("test-server", []string{"localhost"})
|
||||
certPEM, _ := ca.SignCSR(csrPEM)
|
||||
_ = security.WriteCert(dir+"/server.crt", certPEM)
|
||||
_ = security.WriteKey(dir+"/server.key", keyPEM)
|
||||
|
||||
// Insert a peer node with an unreachable address.
|
||||
db, err := store.Open(filepath.Join(dir, "orca.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo := store.NewNodeRepo(db)
|
||||
_ = repo.Insert(context.Background(), &model.Node{
|
||||
ID: "dead-peer", Name: "dead", Address: "127.0.0.1:1",
|
||||
State: model.NodeStateReady, JoinedAt: time.Now().UTC(), LastSeen: time.Now().UTC(),
|
||||
})
|
||||
|
||||
c := Network()
|
||||
r, msg := c.Run(context.Background())
|
||||
if r != ResultFail {
|
||||
t.Errorf("Network check: got %s, want FAIL — %s", r, msg)
|
||||
}
|
||||
if !strings.Contains(msg, "dead") {
|
||||
t.Errorf("Network check message should mention the dead peer, got: %s", msg)
|
||||
}
|
||||
}
|
||||
|
||||
// TestNetworkCheck_NoCert verifies the network check returns FAIL
|
||||
// when no CA cert is installed.
|
||||
func TestNetworkCheck_NoCert(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
|
||||
|
||||
c := Network()
|
||||
r, msg := c.Run(context.Background())
|
||||
if r != ResultFail {
|
||||
t.Errorf("Network check: got %s, want FAIL — %s", r, msg)
|
||||
}
|
||||
if !strings.Contains(msg, "CA cert missing") {
|
||||
t.Errorf("Network check message should mention missing CA, got: %s", msg)
|
||||
}
|
||||
}
|
||||
|
||||
// TestRenderReport verifies the report output format.
|
||||
func TestRenderReport(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
|
||||
|
||||
rep := Run(context.Background())
|
||||
out := rep.Print()
|
||||
if !strings.Contains(out, "PASS") {
|
||||
t.Errorf("expected PASS in output, got: %s", out)
|
||||
}
|
||||
if !strings.Contains(out, "WARN") {
|
||||
t.Errorf("expected WARN in output, got: %s", out)
|
||||
}
|
||||
if !strings.Contains(out, "FAIL") {
|
||||
t.Errorf("expected FAIL in output, got: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
// TestOSCheck_MissingLocalhostNode verifies the OS check returns FAIL
|
||||
// when no localhost node is registered.
|
||||
func TestOSCheck_MissingLocalhostNode(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
|
||||
|
||||
// Open the DB to apply migrations but insert no nodes.
|
||||
db, err := store.Open(filepath.Join(dir, "orca.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
db.Close()
|
||||
|
||||
c := OS()
|
||||
r, msg := c.Run(context.Background())
|
||||
if r != ResultFail {
|
||||
t.Errorf("OS check: got %s, want FAIL — %s", r, msg)
|
||||
}
|
||||
if !strings.Contains(msg, "no localhost node") {
|
||||
t.Errorf("OS check message should mention missing localhost node, got: %s", msg)
|
||||
}
|
||||
}
|
||||
|
||||
// TestOSCheck_Match verifies the OS check returns PASS when the stored
|
||||
// localhost node's os matches the detected OS.
|
||||
func TestOSCheck_Match(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
|
||||
|
||||
db, err := store.Open(filepath.Join(dir, "orca.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo := store.NewNodeRepo(db)
|
||||
|
||||
// Insert a localhost node with the currently-detected OS.
|
||||
detected := osdetect.Detect()
|
||||
if err := repo.Insert(context.Background(), &model.Node{
|
||||
ID: "os-match-1", Name: "localhost", Address: "localhost:8443",
|
||||
State: model.NodeStateReady, JoinedAt: time.Now().UTC(), LastSeen: time.Now().UTC(),
|
||||
Kind: "localhost", OS: detected,
|
||||
}); err != nil {
|
||||
t.Fatalf("insert: %v", err)
|
||||
}
|
||||
|
||||
c := OS()
|
||||
r, msg := c.Run(context.Background())
|
||||
if r != ResultPass {
|
||||
t.Errorf("OS check: got %s, want PASS — %s", r, msg)
|
||||
}
|
||||
if !strings.Contains(msg, detected) {
|
||||
t.Errorf("OS check message should contain %s, got: %s", detected, msg)
|
||||
}
|
||||
}
|
||||
|
||||
// TestOSCheck_Drift verifies the OS check returns WARN when the stored
|
||||
// os differs from the detected os.
|
||||
func TestOSCheck_Drift(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
|
||||
|
||||
db, err := store.Open(filepath.Join(dir, "orca.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo := store.NewNodeRepo(db)
|
||||
|
||||
// Insert a localhost node with a deliberately wrong OS.
|
||||
if err := repo.Insert(context.Background(), &model.Node{
|
||||
ID: "os-drift-1", Name: "localhost", Address: "localhost:8443",
|
||||
State: model.NodeStateReady, JoinedAt: time.Now().UTC(), LastSeen: time.Now().UTC(),
|
||||
Kind: "localhost", OS: "debian",
|
||||
}); err != nil {
|
||||
t.Fatalf("insert: %v", err)
|
||||
}
|
||||
|
||||
c := OS()
|
||||
r, msg := c.Run(context.Background())
|
||||
if r != ResultWarn {
|
||||
t.Errorf("OS check: got %s, want WARN — %s", r, msg)
|
||||
}
|
||||
if !strings.Contains(msg, "drift") {
|
||||
t.Errorf("OS check message should mention drift, got: %s", msg)
|
||||
}
|
||||
}
|
||||
|
||||
// TestProxmoxCheck_NoProxmoxNodes verifies the proxmox check returns
|
||||
// WARN when no proxmox nodes are registered.
|
||||
func TestProxmoxCheck_NoProxmoxNodes(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
|
||||
|
||||
db, err := store.Open(filepath.Join(dir, "orca.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
c := Proxmox()
|
||||
r, msg := c.Run(context.Background())
|
||||
if r != ResultWarn {
|
||||
t.Errorf("Proxmox check: got %s, want WARN — %s", r, msg)
|
||||
}
|
||||
if !strings.Contains(msg, "no proxmox nodes") {
|
||||
t.Errorf("Proxmox check message should mention no proxmox nodes, got: %s", msg)
|
||||
}
|
||||
}
|
||||
|
||||
// TestProxmoxCheck_UnreachableNode verifies the proxmox check returns
|
||||
// FAIL when a proxmox node is registered but unreachable (no SSH key
|
||||
// or host down). We insert a proxmox node with an unreachable address;
|
||||
// the SSH dial will fail (no SSH key file → error).
|
||||
func TestProxmoxCheck_UnreachableNode(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
|
||||
|
||||
db, err := store.Open(filepath.Join(dir, "orca.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo := store.NewNodeRepo(db)
|
||||
|
||||
// Insert a proxmox node. The SSH probe will fail because no SSH
|
||||
// key exists in the test namespace dir.
|
||||
if err := repo.Insert(context.Background(), &model.Node{
|
||||
ID: "px-1", Name: "10.0.0.99", Address: "10.0.0.99:8443",
|
||||
State: model.NodeStateReady, JoinedAt: time.Now().UTC(), LastSeen: time.Now().UTC(),
|
||||
Kind: "proxmox", OS: "pve",
|
||||
}); err != nil {
|
||||
t.Fatalf("insert: %v", err)
|
||||
}
|
||||
|
||||
c := Proxmox()
|
||||
r, msg := c.Run(context.Background())
|
||||
if r != ResultFail {
|
||||
t.Errorf("Proxmox check: got %s, want FAIL — %s", r, msg)
|
||||
}
|
||||
if !strings.Contains(msg, "10.0.0.99") {
|
||||
t.Errorf("Proxmox check message should mention the node, got: %s", msg)
|
||||
}
|
||||
}
|
||||
|
||||
func init() {
|
||||
// Suppress slog noise during tests.
|
||||
_ = os.Setenv("ORCA_LOG_LEVEL", "error")
|
||||
}
|
||||
|
||||
@@ -1,304 +0,0 @@
|
||||
package engine
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
type mockExecutor struct {
|
||||
submitFn func(ctx context.Context, spec []byte) (string, error)
|
||||
statusFn func(ctx context.Context, jobID string) (string, error)
|
||||
submitted bool
|
||||
}
|
||||
|
||||
func (m *mockExecutor) Submit(ctx context.Context, spec []byte) (string, error) {
|
||||
m.submitted = true
|
||||
if m.submitFn != nil {
|
||||
return m.submitFn(ctx, spec)
|
||||
}
|
||||
return "mock-job-id", nil
|
||||
}
|
||||
|
||||
func (m *mockExecutor) Status(ctx context.Context, jobID string) (string, error) {
|
||||
if m.statusFn != nil {
|
||||
return m.statusFn(ctx, jobID)
|
||||
}
|
||||
return "complete", nil
|
||||
}
|
||||
|
||||
func newTestDispatcher(t *testing.T, exec LocalExecutor) (*Dispatcher, *store.CapacityRepo, func()) {
|
||||
t.Helper()
|
||||
path := filepath.Join(t.TempDir(), "test.db")
|
||||
db, err := store.Open(path)
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
capRepo := store.NewCapacityRepo(db)
|
||||
peers := NewPeerRegistry()
|
||||
d := NewDispatcher(nil, capRepo, peers, exec)
|
||||
return d, capRepo, func() { _ = db.Close() }
|
||||
}
|
||||
|
||||
func TestDispatcher_Submit_EmptySpec(t *testing.T) {
|
||||
d, _, cleanup := newTestDispatcher(t, &mockExecutor{})
|
||||
defer cleanup()
|
||||
_, _, err := d.Submit(context.Background(), "", nil, "")
|
||||
if err == nil {
|
||||
t.Fatal("Submit: expected error for empty spec, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_Submit_IdempotencyHit(t *testing.T) {
|
||||
exec := &mockExecutor{}
|
||||
d, _, cleanup := newTestDispatcher(t, exec)
|
||||
defer cleanup()
|
||||
|
||||
d.Dedupe().Put("key-1", "cached-job-id")
|
||||
spec := []byte(`{"cpu_millicores":100,"memory_mib":64,"disk_mib":64}`)
|
||||
jobID, nodeID, err := d.Submit(context.Background(), "", spec, "key-1")
|
||||
if err != nil {
|
||||
t.Fatalf("Submit: %v", err)
|
||||
}
|
||||
if jobID != "cached-job-id" {
|
||||
t.Errorf("jobID: got %q, want cached-job-id", jobID)
|
||||
}
|
||||
if nodeID != "self" {
|
||||
t.Errorf("nodeID: got %q, want self", nodeID)
|
||||
}
|
||||
if exec.submitted {
|
||||
t.Error("executor was called on idempotency hit; should have been short-circuited")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_Submit_LocalCapacity(t *testing.T) {
|
||||
exec := &mockExecutor{
|
||||
submitFn: func(ctx context.Context, spec []byte) (string, error) {
|
||||
return "local-job-id", nil
|
||||
},
|
||||
}
|
||||
d, capRepo, cleanup := newTestDispatcher(t, exec)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
if err := capRepo.Upsert(ctx, &store.NodeCapacity{
|
||||
NodeID: "self",
|
||||
CPUMillicores: 4000,
|
||||
MemoryMiB: 4096,
|
||||
DiskMiB: 4096,
|
||||
}); err != nil {
|
||||
t.Fatalf("Upsert capacity: %v", err)
|
||||
}
|
||||
spec := []byte(`{"cpu_millicores":100,"memory_mib":64,"disk_mib":64}`)
|
||||
jobID, nodeID, err := d.Submit(ctx, "", spec, "")
|
||||
if err != nil {
|
||||
t.Fatalf("Submit: %v", err)
|
||||
}
|
||||
if jobID != "local-job-id" {
|
||||
t.Errorf("jobID: got %q, want local-job-id", jobID)
|
||||
}
|
||||
if nodeID != "self" {
|
||||
t.Errorf("nodeID: got %q, want self", nodeID)
|
||||
}
|
||||
if !exec.submitted {
|
||||
t.Error("executor was not called for local-capacity path")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_Submit_ExplicitTarget(t *testing.T) {
|
||||
exec := &mockExecutor{}
|
||||
d, _, cleanup := newTestDispatcher(t, exec)
|
||||
defer cleanup()
|
||||
spec := []byte(`{"cpu_millicores":100,"memory_mib":64,"disk_mib":64}`)
|
||||
_, _, err := d.Submit(context.Background(), "nodeA", spec, "")
|
||||
if err == nil {
|
||||
t.Fatal("Submit with explicit target nodeA (no peer): expected error, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_Submit_NoPeers(t *testing.T) {
|
||||
exec := &mockExecutor{}
|
||||
d, capRepo, cleanup := newTestDispatcher(t, exec)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
if err := capRepo.Upsert(ctx, &store.NodeCapacity{
|
||||
NodeID: "self",
|
||||
CPUMillicores: 0,
|
||||
MemoryMiB: 0,
|
||||
DiskMiB: 0,
|
||||
}); err != nil {
|
||||
t.Fatalf("Upsert: %v", err)
|
||||
}
|
||||
spec := []byte(`{"cpu_millicores":1000,"memory_mib":1024,"disk_mib":1024}`)
|
||||
_, _, err := d.Submit(ctx, "", spec, "")
|
||||
if err == nil {
|
||||
t.Fatal("Submit: expected error when no peers and no local capacity, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_LocalSubmit(t *testing.T) {
|
||||
exec := &mockExecutor{
|
||||
submitFn: func(ctx context.Context, spec []byte) (string, error) {
|
||||
return "ls-job", nil
|
||||
},
|
||||
}
|
||||
d, _, cleanup := newTestDispatcher(t, exec)
|
||||
defer cleanup()
|
||||
jobID, err := d.LocalSubmit(context.Background(), []byte(`{"command":"/bin/true"}`))
|
||||
if err != nil {
|
||||
t.Fatalf("LocalSubmit: %v", err)
|
||||
}
|
||||
if jobID != "ls-job" {
|
||||
t.Errorf("LocalSubmit: got %q, want ls-job", jobID)
|
||||
}
|
||||
if !exec.submitted {
|
||||
t.Error("LocalSubmit: executor.Submit not called")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_LocalStatus(t *testing.T) {
|
||||
exec := &mockExecutor{
|
||||
statusFn: func(ctx context.Context, jobID string) (string, error) {
|
||||
if jobID == "known" {
|
||||
return "running", nil
|
||||
}
|
||||
return "", errors.New("not found")
|
||||
},
|
||||
}
|
||||
d, _, cleanup := newTestDispatcher(t, exec)
|
||||
defer cleanup()
|
||||
st, err := d.LocalStatus(context.Background(), "known")
|
||||
if err != nil {
|
||||
t.Fatalf("LocalStatus: %v", err)
|
||||
}
|
||||
if st != "running" {
|
||||
t.Errorf("LocalStatus: got %q, want running", st)
|
||||
}
|
||||
if _, err := d.LocalStatus(context.Background(), "missing"); err == nil {
|
||||
t.Error("LocalStatus: expected error for missing job, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_LocalSubmit_NilExecutor(t *testing.T) {
|
||||
d := NewDispatcher(nil, nil, NewPeerRegistry(), nil)
|
||||
if _, err := d.LocalSubmit(context.Background(), []byte(`{}`)); err == nil {
|
||||
t.Error("LocalSubmit with nil executor: expected error, got nil")
|
||||
}
|
||||
if _, err := d.LocalStatus(context.Background(), "x"); err == nil {
|
||||
t.Error("LocalStatus with nil executor: expected error, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseInlineSpec(t *testing.T) {
|
||||
spec, err := parseInlineSpec([]byte(`{"cpu_millicores":500,"memory_mib":256,"disk_mib":128}`))
|
||||
if err != nil {
|
||||
t.Fatalf("parseInlineSpec: %v", err)
|
||||
}
|
||||
if spec.CPUMillicores != 500 || spec.MemoryMiB != 256 || spec.DiskMiB != 128 {
|
||||
t.Errorf("parseInlineSpec: got %+v, want cpu=500 mem=256 disk=128", spec)
|
||||
}
|
||||
if _, err := parseInlineSpec([]byte(`{bad json`)); err == nil {
|
||||
t.Fatal("parseInlineSpec: expected error for malformed JSON, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_Submit_BadSpec(t *testing.T) {
|
||||
d, _, cleanup := newTestDispatcher(t, &mockExecutor{})
|
||||
defer cleanup()
|
||||
_, _, err := d.Submit(context.Background(), "", []byte(`{bad json`), "")
|
||||
if err == nil {
|
||||
t.Fatal("expected error for malformed spec")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_Submit_ExplicitTargetNoPeerRegistry(t *testing.T) {
|
||||
d := NewDispatcher(nil, nil, nil, &mockExecutor{})
|
||||
_, _, err := d.Submit(context.Background(), "nodeX", []byte(`{"cpu_millicores":100,"memory_mib":64,"disk_mib":64}`), "")
|
||||
if err == nil {
|
||||
t.Fatal("expected error for explicit target with no peer registry")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_Submit_ExplicitTargetPeerNotFound(t *testing.T) {
|
||||
d, _, cleanup := newTestDispatcher(t, &mockExecutor{})
|
||||
defer cleanup()
|
||||
_, _, err := d.Submit(context.Background(), "ghost", []byte(`{"cpu_millicores":100,"memory_mib":64,"disk_mib":64}`), "")
|
||||
if err == nil {
|
||||
t.Fatal("expected error for target not in registry")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_Submit_PickPeerMissingCA(t *testing.T) {
|
||||
exec := &mockExecutor{}
|
||||
d, capRepo, cleanup := newTestDispatcher(t, exec)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
if err := capRepo.Upsert(ctx, &store.NodeCapacity{
|
||||
NodeID: "self",
|
||||
CPUMillicores: 0,
|
||||
MemoryMiB: 0,
|
||||
DiskMiB: 0,
|
||||
}); err != nil {
|
||||
t.Fatalf("Upsert: %v", err)
|
||||
}
|
||||
if err := d.peers.Add(&Peer{
|
||||
NodeID: "peer-1",
|
||||
Address: "127.0.0.1:1",
|
||||
Capacity: &store.NodeCapacity{NodeID: "peer-1", CPUMillicores: 4000, MemoryMiB: 4096, DiskMiB: 4096},
|
||||
}); err != nil {
|
||||
t.Fatalf("Add peer: %v", err)
|
||||
}
|
||||
spec := []byte(`{"cpu_millicores":100,"memory_mib":64,"disk_mib":64}`)
|
||||
_, _, err := d.Submit(ctx, "", spec, "idem-peer-1")
|
||||
if err == nil {
|
||||
t.Fatal("expected error (peer missing CA/servername)")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_Submit_NoPeerRegistry(t *testing.T) {
|
||||
d := NewDispatcher(nil, nil, nil, &mockExecutor{})
|
||||
spec := []byte(`{"cpu_millicores":1000,"memory_mib":1024,"disk_mib":1024}`)
|
||||
_, _, err := d.Submit(context.Background(), "", spec, "")
|
||||
if err == nil {
|
||||
t.Fatal("expected error for no peer registry and no capacity repo")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_Submit_NilCapacityFallsThrough(t *testing.T) {
|
||||
exec := &mockExecutor{}
|
||||
d := NewDispatcher(nil, nil, NewPeerRegistry(), exec)
|
||||
spec := []byte(`{"cpu_millicores":1000,"memory_mib":1024,"disk_mib":1024}`)
|
||||
_, _, err := d.Submit(context.Background(), "", spec, "")
|
||||
if err == nil {
|
||||
t.Fatal("expected error when capacity repo is nil and no peers")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_Submit_AllPeersFailsPickNode(t *testing.T) {
|
||||
exec := &mockExecutor{}
|
||||
d, capRepo, cleanup := newTestDispatcher(t, exec)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
if err := capRepo.Upsert(ctx, &store.NodeCapacity{
|
||||
NodeID: "self",
|
||||
CPUMillicores: 0,
|
||||
MemoryMiB: 0,
|
||||
DiskMiB: 0,
|
||||
}); err != nil {
|
||||
t.Fatalf("Upsert: %v", err)
|
||||
}
|
||||
if err := d.peers.Add(&Peer{
|
||||
NodeID: "peer-tiny",
|
||||
Address: "127.0.0.1:1",
|
||||
Capacity: &store.NodeCapacity{NodeID: "peer-tiny", CPUMillicores: 10, MemoryMiB: 10, DiskMiB: 10},
|
||||
}); err != nil {
|
||||
t.Fatalf("Add peer: %v", err)
|
||||
}
|
||||
spec := []byte(`{"cpu_millicores":1000,"memory_mib":1024,"disk_mib":1024}`)
|
||||
_, _, err := d.Submit(ctx, "", spec, "")
|
||||
if err == nil {
|
||||
t.Fatal("expected error when no peer can fit")
|
||||
}
|
||||
}
|
||||
@@ -1,145 +0,0 @@
|
||||
package engine
|
||||
|
||||
import (
|
||||
"context"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/model"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
func newTestExecutor(t *testing.T) (*Executor, func()) {
|
||||
t.Helper()
|
||||
path := filepath.Join(t.TempDir(), "test.db")
|
||||
db, err := store.Open(path)
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
ex := NewExecutor(store.NewJobRepo(db), store.NewTaskRepo(db), nil)
|
||||
return ex, func() { _ = db.Close() }
|
||||
}
|
||||
|
||||
func TestExecutor_Submit_Success(t *testing.T) {
|
||||
ex, cleanup := newTestExecutor(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
spec := []byte(`{"command":"/bin/echo","args":["hello"]}`)
|
||||
jobID, err := ex.Submit(ctx, spec)
|
||||
if err != nil {
|
||||
t.Fatalf("Submit: %v", err)
|
||||
}
|
||||
if jobID == "" {
|
||||
t.Fatal("Submit: empty jobID")
|
||||
}
|
||||
status, err := ex.Status(ctx, jobID)
|
||||
if err != nil {
|
||||
t.Fatalf("Status: %v", err)
|
||||
}
|
||||
if status != string(model.JobStatusComplete) {
|
||||
t.Errorf("Status: got %q, want %q", status, model.JobStatusComplete)
|
||||
}
|
||||
}
|
||||
|
||||
func TestExecutor_Submit_MissingCommand(t *testing.T) {
|
||||
ex, cleanup := newTestExecutor(t)
|
||||
defer cleanup()
|
||||
_, err := ex.Submit(context.Background(), []byte(`{"name":"x"}`))
|
||||
if err == nil {
|
||||
t.Fatal("Submit: expected error for missing command, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestExecutor_Submit_MalformedJSON(t *testing.T) {
|
||||
ex, cleanup := newTestExecutor(t)
|
||||
defer cleanup()
|
||||
_, err := ex.Submit(context.Background(), []byte(`{bad json`))
|
||||
if err == nil {
|
||||
t.Fatal("Submit: expected error for malformed JSON, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestExecutor_Submit_FailingCommand(t *testing.T) {
|
||||
ex, cleanup := newTestExecutor(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
jobID, err := ex.Submit(ctx, []byte(`{"command":"/bin/false"}`))
|
||||
if err == nil {
|
||||
t.Fatal("Submit failing command: expected error, got nil")
|
||||
}
|
||||
if jobID == "" {
|
||||
t.Fatal("Submit failing command: empty jobID")
|
||||
}
|
||||
status, err := ex.Status(ctx, jobID)
|
||||
if err != nil {
|
||||
t.Fatalf("Status: %v", err)
|
||||
}
|
||||
if status != string(model.JobStatusFailed) {
|
||||
t.Errorf("Status: got %q, want %q", status, model.JobStatusFailed)
|
||||
}
|
||||
}
|
||||
|
||||
func TestExecutor_Status_NotFound(t *testing.T) {
|
||||
ex, cleanup := newTestExecutor(t)
|
||||
defer cleanup()
|
||||
_, err := ex.Status(context.Background(), "nonexistent-job-id")
|
||||
if err == nil {
|
||||
t.Fatal("Status: expected error for missing job, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestExecutor_Run_Success(t *testing.T) {
|
||||
ex, cleanup := newTestExecutor(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
job := &model.Job{
|
||||
ID: uuid.NewString(),
|
||||
Name: "run-success",
|
||||
Spec: "{}",
|
||||
Status: model.JobStatusPending,
|
||||
}
|
||||
specs := []TaskSpec{{Name: "echo", Command: "/bin/echo", Args: []string{"hi"}}}
|
||||
if err := ex.Run(ctx, job, specs); err != nil {
|
||||
t.Fatalf("Run: %v", err)
|
||||
}
|
||||
got, err := ex.Status(ctx, job.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("Status: %v", err)
|
||||
}
|
||||
if got != string(model.JobStatusComplete) {
|
||||
t.Errorf("Status: got %q, want %q", got, model.JobStatusComplete)
|
||||
}
|
||||
}
|
||||
|
||||
func TestExecutor_Run_ContextCancel(t *testing.T) {
|
||||
ex, cleanup := newTestExecutor(t)
|
||||
defer cleanup()
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
job := &model.Job{
|
||||
ID: uuid.NewString(),
|
||||
Name: "run-cancel",
|
||||
Spec: "{}",
|
||||
Status: model.JobStatusPending,
|
||||
}
|
||||
specs := []TaskSpec{{Name: "sleep", Command: "/bin/sleep", Args: []string{"10"}}}
|
||||
|
||||
go func() {
|
||||
time.Sleep(100 * time.Millisecond)
|
||||
cancel()
|
||||
}()
|
||||
|
||||
err := ex.Run(ctx, job, specs)
|
||||
if err == nil {
|
||||
t.Fatal("Run: expected error after context cancel, got nil")
|
||||
}
|
||||
status, sErr := ex.Status(context.Background(), job.ID)
|
||||
if sErr != nil {
|
||||
t.Fatalf("Status after cancel: %v", sErr)
|
||||
}
|
||||
if status == string(model.JobStatusComplete) {
|
||||
t.Errorf("Status: got %q, want not complete (task should have been killed)", status)
|
||||
}
|
||||
}
|
||||
@@ -1,136 +0,0 @@
|
||||
package engine
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
func TestPeerRegistry_AddAndGet(t *testing.T) {
|
||||
r := NewPeerRegistry()
|
||||
p := &Peer{
|
||||
NodeID: "node-1",
|
||||
Address: "localhost:8443",
|
||||
ServerName: "node-1.orca",
|
||||
CAPath: "/etc/orca/ca.pem",
|
||||
}
|
||||
if err := r.Add(p); err != nil {
|
||||
t.Fatalf("Add: %v", err)
|
||||
}
|
||||
got := r.Get("node-1")
|
||||
if got == nil {
|
||||
t.Fatal("Get: returned nil after Add")
|
||||
}
|
||||
if got.NodeID != "node-1" || got.Address != "localhost:8443" ||
|
||||
got.ServerName != "node-1.orca" || got.CAPath != "/etc/orca/ca.pem" {
|
||||
t.Errorf("Get: fields mismatch: %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestPeerRegistry_AddNil(t *testing.T) {
|
||||
r := NewPeerRegistry()
|
||||
if err := r.Add(nil); err == nil {
|
||||
t.Fatal("Add(nil): expected error, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestPeerRegistry_AddMissingID(t *testing.T) {
|
||||
r := NewPeerRegistry()
|
||||
if err := r.Add(&Peer{Address: "a"}); err == nil {
|
||||
t.Fatal("Add(empty NodeID): expected error, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestPeerRegistry_Remove(t *testing.T) {
|
||||
r := NewPeerRegistry()
|
||||
p := &Peer{NodeID: "node-r", Address: "a"}
|
||||
if err := r.Add(p); err != nil {
|
||||
t.Fatalf("Add: %v", err)
|
||||
}
|
||||
if !r.Remove("node-r") {
|
||||
t.Fatal("Remove: returned false for existing peer")
|
||||
}
|
||||
if got := r.Get("node-r"); got != nil {
|
||||
t.Errorf("Get after Remove: want nil, got %+v", got)
|
||||
}
|
||||
if r.Remove("node-r") {
|
||||
t.Error("Remove second time: want false, got true")
|
||||
}
|
||||
}
|
||||
|
||||
func TestPeerRegistry_All(t *testing.T) {
|
||||
r := NewPeerRegistry()
|
||||
for _, id := range []string{"node-c", "node-a", "node-b"} {
|
||||
if err := r.Add(&Peer{NodeID: id, Address: "a"}); err != nil {
|
||||
t.Fatalf("Add %s: %v", id, err)
|
||||
}
|
||||
}
|
||||
got, err := r.All(context.Background())
|
||||
if err != nil {
|
||||
t.Fatalf("All: %v", err)
|
||||
}
|
||||
if len(got) != 3 {
|
||||
t.Fatalf("All: got %d, want 3", len(got))
|
||||
}
|
||||
want := []string{"node-a", "node-b", "node-c"}
|
||||
for i, w := range want {
|
||||
if got[i].NodeID != w {
|
||||
t.Errorf("All[%d]: got %s, want %s (not sorted by NodeID)", i, got[i].NodeID, w)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestPeerRegistry_All_Empty(t *testing.T) {
|
||||
r := NewPeerRegistry()
|
||||
got, err := r.All(context.Background())
|
||||
if err != nil {
|
||||
t.Fatalf("All on empty: %v", err)
|
||||
}
|
||||
if len(got) != 0 {
|
||||
t.Errorf("All on empty: got %d, want 0", len(got))
|
||||
}
|
||||
}
|
||||
|
||||
func TestPeerRegistry_Len(t *testing.T) {
|
||||
r := NewPeerRegistry()
|
||||
if r.Len() != 0 {
|
||||
t.Errorf("Len on empty: got %d, want 0", r.Len())
|
||||
}
|
||||
if err := r.Add(&Peer{NodeID: "n1", Address: "a"}); err != nil {
|
||||
t.Fatalf("Add n1: %v", err)
|
||||
}
|
||||
if err := r.Add(&Peer{NodeID: "n2", Address: "a"}); err != nil {
|
||||
t.Fatalf("Add n2: %v", err)
|
||||
}
|
||||
if r.Len() != 2 {
|
||||
t.Errorf("Len: got %d, want 2", r.Len())
|
||||
}
|
||||
}
|
||||
|
||||
func TestPeerRegistry_UpdateLastSeen(t *testing.T) {
|
||||
r := NewPeerRegistry()
|
||||
old := time.Now().Add(-1 * time.Hour).UTC()
|
||||
p := &Peer{
|
||||
NodeID: "node-u",
|
||||
Address: "a",
|
||||
LastSeen: old,
|
||||
Capacity: &store.NodeCapacity{NodeID: "node-u", CPUMillicores: 1000, MemoryMiB: 1024, DiskMiB: 1024},
|
||||
}
|
||||
if err := r.Add(p); err != nil {
|
||||
t.Fatalf("Add: %v", err)
|
||||
}
|
||||
r.UpdateLastSeen("node-u")
|
||||
got := r.Get("node-u")
|
||||
if got == nil {
|
||||
t.Fatal("Get: nil after UpdateLastSeen")
|
||||
}
|
||||
if !got.LastSeen.After(old) {
|
||||
t.Errorf("UpdateLastSeen: LastSeen not bumped; old=%v now=%v", old, got.LastSeen)
|
||||
}
|
||||
if time.Since(got.LastSeen) > 5*time.Second {
|
||||
t.Errorf("UpdateLastSeen: LastSeen not recent: %v", got.LastSeen)
|
||||
}
|
||||
r.UpdateLastSeen("nonexistent")
|
||||
}
|
||||
@@ -1,229 +0,0 @@
|
||||
package engine
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"errors"
|
||||
"log/slog"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/model"
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
func newRegistryTestDB(t *testing.T) (*store.NodeRepo, *store.AuditRepo, *store.AuditRepo, func()) {
|
||||
t.Helper()
|
||||
path := filepath.Join(t.TempDir(), "test.db")
|
||||
db, err := store.Open(path)
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
return store.NewNodeRepo(db), store.NewAuditRepo(db), store.NewAuditRepo(db), func() { _ = db.Close() }
|
||||
}
|
||||
|
||||
func TestNewNodeRegistry_NilLogger(t *testing.T) {
|
||||
nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
|
||||
defer cleanup()
|
||||
audit := NewAudit(auditRepo, nil)
|
||||
r := NewNodeRegistry(nodeRepo, audit, nil)
|
||||
if r == nil {
|
||||
t.Fatal("NewNodeRegistry returned nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeRegistry_Join_Success(t *testing.T) {
|
||||
nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
|
||||
defer cleanup()
|
||||
var buf bytes.Buffer
|
||||
audit := NewAudit(auditRepo, slog.New(slog.NewTextHandler(&buf, nil)))
|
||||
r := NewNodeRegistry(nodeRepo, audit, slog.New(slog.NewTextHandler(&buf, nil)))
|
||||
|
||||
ctx := context.Background()
|
||||
n := &model.Node{
|
||||
ID: "node-join-1",
|
||||
Name: "pve-1",
|
||||
Address: "10.0.0.1:8443",
|
||||
State: model.NodeStateReady,
|
||||
}
|
||||
if err := r.Join(ctx, n); err != nil {
|
||||
t.Fatalf("Join: %v", err)
|
||||
}
|
||||
got, err := r.Get(ctx, "node-join-1")
|
||||
if err != nil {
|
||||
t.Fatalf("Get after Join: %v", err)
|
||||
}
|
||||
if got.Name != "pve-1" {
|
||||
t.Errorf("Get: Name = %q, want pve-1", got.Name)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeRegistry_Join_Duplicate(t *testing.T) {
|
||||
nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
|
||||
defer cleanup()
|
||||
audit := NewAudit(auditRepo, nil)
|
||||
r := NewNodeRegistry(nodeRepo, audit, nil)
|
||||
|
||||
ctx := context.Background()
|
||||
n := &model.Node{ID: "dup-1", Name: "n1", Address: "a:1", State: model.NodeStateReady}
|
||||
if err := r.Join(ctx, n); err != nil {
|
||||
t.Fatalf("first Join: %v", err)
|
||||
}
|
||||
err := r.Join(ctx, n)
|
||||
if err == nil {
|
||||
t.Fatal("expected error for duplicate Join")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeRegistry_Leave_Success(t *testing.T) {
|
||||
nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
|
||||
defer cleanup()
|
||||
audit := NewAudit(auditRepo, nil)
|
||||
r := NewNodeRegistry(nodeRepo, audit, nil)
|
||||
|
||||
ctx := context.Background()
|
||||
n := &model.Node{ID: "leave-1", Name: "n1", Address: "a:1", State: model.NodeStateReady}
|
||||
if err := r.Join(ctx, n); err != nil {
|
||||
t.Fatalf("Join: %v", err)
|
||||
}
|
||||
if err := r.Leave(ctx, "leave-1"); err != nil {
|
||||
t.Fatalf("Leave: %v", err)
|
||||
}
|
||||
got, err := r.Get(ctx, "leave-1")
|
||||
if err != nil {
|
||||
t.Fatalf("Get after Leave: %v", err)
|
||||
}
|
||||
if got.State != model.NodeStateLeft {
|
||||
t.Errorf("State = %q, want %q", got.State, model.NodeStateLeft)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeRegistry_Leave_NotFound(t *testing.T) {
|
||||
nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
|
||||
defer cleanup()
|
||||
audit := NewAudit(auditRepo, nil)
|
||||
r := NewNodeRegistry(nodeRepo, audit, nil)
|
||||
err := r.Leave(context.Background(), "nonexistent")
|
||||
if err == nil {
|
||||
t.Fatal("expected error for Leave on missing node")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeRegistry_Forget_Success(t *testing.T) {
|
||||
nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
|
||||
defer cleanup()
|
||||
audit := NewAudit(auditRepo, nil)
|
||||
r := NewNodeRegistry(nodeRepo, audit, nil)
|
||||
|
||||
ctx := context.Background()
|
||||
n := &model.Node{ID: "forget-1", Name: "n1", Address: "a:1", State: model.NodeStateReady}
|
||||
if err := r.Join(ctx, n); err != nil {
|
||||
t.Fatalf("Join: %v", err)
|
||||
}
|
||||
if err := r.Forget(ctx, "forget-1"); err != nil {
|
||||
t.Fatalf("Forget: %v", err)
|
||||
}
|
||||
if _, err := r.Get(ctx, "forget-1"); err == nil {
|
||||
t.Error("expected error after Forget")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeRegistry_Forget_NotFound(t *testing.T) {
|
||||
nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
|
||||
defer cleanup()
|
||||
audit := NewAudit(auditRepo, nil)
|
||||
r := NewNodeRegistry(nodeRepo, audit, nil)
|
||||
err := r.Forget(context.Background(), "nonexistent")
|
||||
if err == nil {
|
||||
t.Fatal("expected error for Forget on missing node")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeRegistry_List(t *testing.T) {
|
||||
nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
|
||||
defer cleanup()
|
||||
audit := NewAudit(auditRepo, nil)
|
||||
r := NewNodeRegistry(nodeRepo, audit, nil)
|
||||
|
||||
ctx := context.Background()
|
||||
if got, err := r.List(ctx); err != nil {
|
||||
t.Fatalf("List empty: %v", err)
|
||||
} else if len(got) != 0 {
|
||||
t.Errorf("List empty: got %d, want 0", len(got))
|
||||
}
|
||||
for _, id := range []string{"n3", "n1", "n2"} {
|
||||
if err := r.Join(ctx, &model.Node{ID: id, Name: id, Address: "a:1", State: model.NodeStateReady}); err != nil {
|
||||
t.Fatalf("Join %s: %v", id, err)
|
||||
}
|
||||
}
|
||||
got, err := r.List(ctx)
|
||||
if err != nil {
|
||||
t.Fatalf("List: %v", err)
|
||||
}
|
||||
if len(got) != 3 {
|
||||
t.Errorf("List: got %d, want 3", len(got))
|
||||
}
|
||||
}
|
||||
|
||||
func TestNodeRegistry_Get_NotFound(t *testing.T) {
|
||||
nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
|
||||
defer cleanup()
|
||||
audit := NewAudit(auditRepo, nil)
|
||||
r := NewNodeRegistry(nodeRepo, audit, nil)
|
||||
_, err := r.Get(context.Background(), "missing")
|
||||
if err == nil {
|
||||
t.Fatal("expected error for Get missing")
|
||||
}
|
||||
}
|
||||
|
||||
func TestNewAudit_NilLogger(t *testing.T) {
|
||||
_, auditRepo, _, cleanup := newRegistryTestDB(t)
|
||||
defer cleanup()
|
||||
a := NewAudit(auditRepo, nil)
|
||||
if a == nil {
|
||||
t.Fatal("NewAudit returned nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAudit_Record_Success(t *testing.T) {
|
||||
_, auditRepo, _, cleanup := newRegistryTestDB(t)
|
||||
defer cleanup()
|
||||
var buf bytes.Buffer
|
||||
a := NewAudit(auditRepo, slog.New(slog.NewTextHandler(&buf, nil)))
|
||||
a.Record(context.Background(), "cli", "node.join", "node-1", "success", nil, map[string]any{"host": "10.0.0.1"})
|
||||
entries, err := auditRepo.List(context.Background(), 10)
|
||||
if err != nil {
|
||||
t.Fatalf("List: %v", err)
|
||||
}
|
||||
if len(entries) != 1 {
|
||||
t.Fatalf("entries = %d, want 1", len(entries))
|
||||
}
|
||||
if entries[0].Action != "node.join" || entries[0].Result != "success" {
|
||||
t.Errorf("entry = %+v", entries[0])
|
||||
}
|
||||
}
|
||||
|
||||
func TestAudit_Record_WithError(t *testing.T) {
|
||||
_, auditRepo, _, cleanup := newRegistryTestDB(t)
|
||||
defer cleanup()
|
||||
var buf bytes.Buffer
|
||||
a := NewAudit(auditRepo, slog.New(slog.NewTextHandler(&buf, nil)))
|
||||
a.Record(context.Background(), "cli", "node.join", "node-1", "failure", errors.New("boom"), nil)
|
||||
entries, err := auditRepo.List(context.Background(), 10)
|
||||
if err != nil {
|
||||
t.Fatalf("List: %v", err)
|
||||
}
|
||||
if len(entries) != 1 {
|
||||
t.Fatalf("entries = %d, want 1", len(entries))
|
||||
}
|
||||
if entries[0].Error != "boom" {
|
||||
t.Errorf("Error = %q, want boom", entries[0].Error)
|
||||
}
|
||||
if !containsStr(buf.String(), "level=WARN") {
|
||||
t.Errorf("expected WARN level for error result, got: %s", buf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func containsStr(s, sub string) bool {
|
||||
return len(sub) == 0 || (len(s) >= len(sub) && (s[0:len(sub)] == sub || containsStr(s[1:], sub)))
|
||||
}
|
||||
@@ -1,7 +1,6 @@
|
||||
package engine
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
@@ -65,66 +64,3 @@ func TestJobSpecFits(t *testing.T) {
|
||||
t.Error("Fits: should not fit (CPU too low)")
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobSpecFits_NilCapacity(t *testing.T) {
|
||||
spec := JobSpec{CPUMillicores: 1000}
|
||||
if spec.Fits(nil) {
|
||||
t.Error("Fits(nil): should be false")
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobSpecScore_NilCapacity(t *testing.T) {
|
||||
spec := JobSpec{CPUMillicores: 1000, MemoryMiB: 1024}
|
||||
if got := spec.Score(nil); got != -1 {
|
||||
t.Errorf("Score(nil) = %d, want -1", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobSpecScore_OverCapacity(t *testing.T) {
|
||||
spec := JobSpec{CPUMillicores: 2000, MemoryMiB: 1024}
|
||||
c := &store.NodeCapacity{CPUMillicores: 1000, MemoryMiB: 2048}
|
||||
if got := spec.Score(c); got != -1 {
|
||||
t.Errorf("Score over CPU = %d, want -1", got)
|
||||
}
|
||||
c2 := &store.NodeCapacity{CPUMillicores: 4000, MemoryMiB: 512}
|
||||
if got := spec.Score(c2); got != -1 {
|
||||
t.Errorf("Score over Mem = %d, want -1", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestJobSpecScore_Fits(t *testing.T) {
|
||||
spec := JobSpec{CPUMillicores: 1000, MemoryMiB: 1024}
|
||||
c := &store.NodeCapacity{CPUMillicores: 4000, MemoryMiB: 4096}
|
||||
got := spec.Score(c)
|
||||
want := int64((4000 - 1000) + (4096 - 1024))
|
||||
if got != want {
|
||||
t.Errorf("Score = %d, want %d", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestPickNode_Empty(t *testing.T) {
|
||||
_, _, err := PickNode(JobSpec{}, nil)
|
||||
if err == nil {
|
||||
t.Fatal("expected error for empty capacities")
|
||||
}
|
||||
}
|
||||
|
||||
func TestMemLocalNode_Capacity(t *testing.T) {
|
||||
c := &store.NodeCapacity{NodeID: "self", CPUMillicores: 1000, MemoryMiB: 1024}
|
||||
ln := MemLocalNode(c)
|
||||
got, err := ln.Capacity(context.Background())
|
||||
if err != nil {
|
||||
t.Fatalf("Capacity: %v", err)
|
||||
}
|
||||
if got != c {
|
||||
t.Errorf("Capacity: got %+v, want %+v", got, c)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMemLocalNode_NilCapacity(t *testing.T) {
|
||||
ln := MemLocalNode(nil)
|
||||
_, err := ln.Capacity(context.Background())
|
||||
if err == nil {
|
||||
t.Fatal("expected error for nil capacity")
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
package jobspec
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
@@ -61,223 +58,3 @@ task "no-cmd" {}
|
||||
t.Fatal("expected error for missing command")
|
||||
}
|
||||
}
|
||||
|
||||
func TestParse_GoldenFiles(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
file string
|
||||
wantJob string
|
||||
wantJobType string
|
||||
wantTasks int
|
||||
checkTask func(t *testing.T, s *Spec)
|
||||
}{
|
||||
{
|
||||
name: "single_task",
|
||||
file: "valid_single_task.hcl",
|
||||
wantJob: "single",
|
||||
wantTasks: 1,
|
||||
wantJobType: "",
|
||||
checkTask: func(t *testing.T, s *Spec) {
|
||||
if s.Tasks[0].Name != "solo" {
|
||||
t.Errorf("task name = %q, want solo", s.Tasks[0].Name)
|
||||
}
|
||||
if s.Tasks[0].Command != "/bin/true" {
|
||||
t.Errorf("command = %q, want /bin/true", s.Tasks[0].Command)
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "multi_task",
|
||||
file: "valid_multi_task.hcl",
|
||||
wantJob: "multi",
|
||||
wantJobType: "batch",
|
||||
wantTasks: 3,
|
||||
checkTask: func(t *testing.T, s *Spec) {
|
||||
byName := map[string]TaskSpec{}
|
||||
for _, tk := range s.Tasks {
|
||||
byName[tk.Name] = tk
|
||||
}
|
||||
if _, ok := byName["build"]; !ok {
|
||||
t.Errorf("missing task 'build'")
|
||||
}
|
||||
if _, ok := byName["test"]; !ok {
|
||||
t.Errorf("missing task 'test'")
|
||||
}
|
||||
if len(byName["test"].Env) != 2 {
|
||||
t.Errorf("test env count = %d, want 2", len(byName["test"].Env))
|
||||
}
|
||||
if _, ok := byName["deploy"]; !ok {
|
||||
t.Errorf("missing task 'deploy'")
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "env_vars",
|
||||
file: "valid_env_vars.hcl",
|
||||
wantJob: "envvars",
|
||||
wantTasks: 1,
|
||||
checkTask: func(t *testing.T, s *Spec) {
|
||||
if len(s.Tasks[0].Env) != 3 {
|
||||
t.Errorf("env count = %d, want 3", len(s.Tasks[0].Env))
|
||||
}
|
||||
want := "FOO=bar"
|
||||
if s.Tasks[0].Env[0] != want {
|
||||
t.Errorf("env[0] = %q, want %q", s.Tasks[0].Env[0], want)
|
||||
}
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
path := filepath.Join("testdata", tc.file)
|
||||
spec, err := ParseFile(path)
|
||||
if err != nil {
|
||||
t.Fatalf("ParseFile(%s): %v", tc.file, err)
|
||||
}
|
||||
if spec.Job.Name != tc.wantJob {
|
||||
t.Errorf("job name = %q, want %q", spec.Job.Name, tc.wantJob)
|
||||
}
|
||||
if tc.wantJobType != "" && spec.Job.Type != tc.wantJobType {
|
||||
t.Errorf("job type = %q, want %q", spec.Job.Type, tc.wantJobType)
|
||||
}
|
||||
if len(spec.Tasks) != tc.wantTasks {
|
||||
t.Fatalf("tasks = %d, want %d", len(spec.Tasks), tc.wantTasks)
|
||||
}
|
||||
if tc.checkTask != nil {
|
||||
tc.checkTask(t, spec)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestParse_ErrorPaths(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
file string
|
||||
wantErr string
|
||||
useParse bool
|
||||
hcl string
|
||||
}{
|
||||
{name: "no_tasks", file: "err_no_tasks.hcl", wantErr: "at least one task"},
|
||||
{name: "missing_command", file: "err_missing_command.hcl", wantErr: "required"},
|
||||
{name: "malformed", file: "err_malformed.hcl", wantErr: "decode hcl"},
|
||||
{name: "missing_job", file: "err_missing_job.hcl", wantErr: "Missing job block"},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
path := filepath.Join("testdata", tc.file)
|
||||
_, err := ParseFile(path)
|
||||
if err == nil {
|
||||
t.Fatalf("expected error containing %q, got nil", tc.wantErr)
|
||||
}
|
||||
if !strings.Contains(err.Error(), tc.wantErr) {
|
||||
t.Errorf("error = %q, want it to contain %q", err.Error(), tc.wantErr)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestParse_EmptyFile(t *testing.T) {
|
||||
_, err := Parse([]byte(""), "empty.hcl")
|
||||
if err == nil {
|
||||
t.Fatal("expected error for empty file")
|
||||
}
|
||||
}
|
||||
|
||||
func TestParse_MalformedHCL(t *testing.T) {
|
||||
_, err := Parse([]byte("job = "), "bad.hcl")
|
||||
if err == nil {
|
||||
t.Fatal("expected error for malformed HCL")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "decode hcl") {
|
||||
t.Errorf("error = %q, want it to contain 'decode hcl'", err.Error())
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseFile_Nonexistent(t *testing.T) {
|
||||
_, err := ParseFile(filepath.Join("testdata", "does_not_exist.hcl"))
|
||||
if err == nil {
|
||||
t.Fatal("expected error for nonexistent file")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "read spec file") {
|
||||
t.Errorf("error = %q, want it to contain 'read spec file'", err.Error())
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseFile_ReadError(t *testing.T) {
|
||||
// Directory exists but is not readable as a file.
|
||||
_, err := ParseFile("testdata")
|
||||
if err == nil {
|
||||
t.Fatal("expected error when ParseFile target is a directory")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpec_Validate(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
spec *Spec
|
||||
wantErr string
|
||||
}{
|
||||
{
|
||||
name: "empty_job_name",
|
||||
spec: &Spec{Job: JobSpec{Name: " "}, Tasks: []TaskSpec{{Name: "t", Command: "/bin/echo"}}},
|
||||
wantErr: "job name is required",
|
||||
},
|
||||
{
|
||||
name: "no_tasks",
|
||||
spec: &Spec{Job: JobSpec{Name: "x"}},
|
||||
wantErr: "at least one task is required",
|
||||
},
|
||||
{
|
||||
name: "valid",
|
||||
spec: &Spec{Job: JobSpec{Name: "x"}, Tasks: []TaskSpec{{Name: "t", Command: "/bin/echo"}}},
|
||||
},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
err := tc.spec.Validate()
|
||||
if tc.wantErr == "" {
|
||||
if err != nil {
|
||||
t.Errorf("Validate: got %v, want nil", err)
|
||||
}
|
||||
return
|
||||
}
|
||||
if err == nil {
|
||||
t.Fatalf("expected error containing %q, got nil", tc.wantErr)
|
||||
}
|
||||
if !strings.Contains(err.Error(), tc.wantErr) {
|
||||
t.Errorf("error = %q, want it to contain %q", err.Error(), tc.wantErr)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpec_Validate_RoundTripFromParse(t *testing.T) {
|
||||
path := filepath.Join("testdata", "valid_single_task.hcl")
|
||||
spec, err := ParseFile(path)
|
||||
if err != nil {
|
||||
t.Fatalf("ParseFile: %v", err)
|
||||
}
|
||||
if err := spec.Validate(); err != nil {
|
||||
t.Errorf("Validate on parsed spec: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseFile_GoldenFilesExist(t *testing.T) {
|
||||
// Guard against accidentally removing testdata fixtures.
|
||||
files := []string{
|
||||
"valid_single_task.hcl",
|
||||
"valid_multi_task.hcl",
|
||||
"valid_env_vars.hcl",
|
||||
"err_no_tasks.hcl",
|
||||
"err_missing_command.hcl",
|
||||
"err_malformed.hcl",
|
||||
"err_missing_job.hcl",
|
||||
}
|
||||
for _, f := range files {
|
||||
path := filepath.Join("testdata", f)
|
||||
if _, err := os.Stat(path); err != nil {
|
||||
t.Errorf("missing testdata fixture %s: %v", f, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
-1
@@ -1 +0,0 @@
|
||||
job "x" { command = invalid }
|
||||
@@ -1,3 +0,0 @@
|
||||
job "x" {}
|
||||
|
||||
task "nocmd" {}
|
||||
@@ -1 +0,0 @@
|
||||
task "x" { command = "/bin/echo" }
|
||||
-1
@@ -1 +0,0 @@
|
||||
job "empty" {}
|
||||
@@ -1,6 +0,0 @@
|
||||
job "envvars" {}
|
||||
|
||||
task "runner" {
|
||||
command = "/bin/printenv"
|
||||
env = ["FOO=bar", "BAZ=qux", "EMPTY="]
|
||||
}
|
||||
-19
@@ -1,19 +0,0 @@
|
||||
job "multi" {
|
||||
type = "batch"
|
||||
}
|
||||
|
||||
task "build" {
|
||||
command = "/bin/echo"
|
||||
args = ["build", "done"]
|
||||
}
|
||||
|
||||
task "test" {
|
||||
command = "/usr/bin/go"
|
||||
args = ["test", "./..."]
|
||||
env = ["GOCACHE=/tmp/gocache", "GOFLAGS=-v"]
|
||||
}
|
||||
|
||||
task "deploy" {
|
||||
command = "/bin/sh"
|
||||
args = ["-c", "echo deploying"]
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
job "single" {}
|
||||
|
||||
task "solo" {
|
||||
command = "/bin/true"
|
||||
}
|
||||
@@ -10,19 +10,6 @@ const (
|
||||
NodeStateLeft NodeState = "left"
|
||||
)
|
||||
|
||||
// NodeKind classifies a node by how it joined the cluster.
|
||||
type NodeKind string
|
||||
|
||||
const (
|
||||
// NodeKindLocalhost is the auto-registered local node from `orca init`.
|
||||
NodeKindLocalhost NodeKind = "localhost"
|
||||
// NodeKindLinux is a generic Linux node (ubuntu/debian/alpine) joined
|
||||
// without a specific type. Reserved for future SSH-join flows.
|
||||
NodeKindLinux NodeKind = "linux"
|
||||
// NodeKindProxmox is a Proxmox VE 8/9 host joined via SSH bootstrap.
|
||||
NodeKindProxmox NodeKind = "proxmox"
|
||||
)
|
||||
|
||||
type Node struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
@@ -31,10 +18,4 @@ type Node struct {
|
||||
JoinedAt time.Time `json:"joined_at"`
|
||||
LastSeen time.Time `json:"last_seen"`
|
||||
Metadata map[string]string `json:"metadata,omitempty"`
|
||||
// Kind classifies the node: localhost | linux | proxmox (REQ-049).
|
||||
// Empty string for rows created before migration 0006.
|
||||
Kind string `json:"kind,omitempty"`
|
||||
// OS is the auto-detected OS identifier from /etc/os-release ID=
|
||||
// (ubuntu|debian|alpine|pve|linux). Empty for pre-0006 rows.
|
||||
OS string `json:"os,omitempty"`
|
||||
}
|
||||
|
||||
@@ -1,63 +0,0 @@
|
||||
// Package osdetect provides OS detection from /etc/os-release (D-032).
|
||||
// It's a separate package to avoid import cycles between internal/cli
|
||||
// and internal/doctor (both need to detect the local OS).
|
||||
package osdetect
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"os"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// osReleasePaths are checked in order for the os-release file. The
|
||||
// freedesktop.org spec says /etc/os-release is the canonical path,
|
||||
// with /usr/lib/os-release as a fallback for minimal containers that
|
||||
// may not symlink the former.
|
||||
var osReleasePaths = []string{"/etc/os-release", "/usr/lib/os-release"}
|
||||
|
||||
// Detect reads /etc/os-release (then /usr/lib/os-release as a
|
||||
// fallback) and returns the value of the ID= field. Returns "linux"
|
||||
// (the generic fallback per D-032) if the file is missing, the ID
|
||||
// field is absent, or the value is empty. Unknown ID values (e.g.
|
||||
// "fedora", "arch") are returned verbatim — doctor os can warn on
|
||||
// unknown values, but orca init must not fail.
|
||||
func Detect() string {
|
||||
for _, p := range osReleasePaths {
|
||||
data, err := os.ReadFile(p)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
if id := ParseID(data); id != "" {
|
||||
return id
|
||||
}
|
||||
}
|
||||
return "linux"
|
||||
}
|
||||
|
||||
// ParseID extracts the ID= value from os-release content.
|
||||
// The format is shell-compatible KEY=VALUE lines; values may be
|
||||
// double-quoted. Returns "" if ID is absent or empty.
|
||||
func ParseID(data []byte) string {
|
||||
scanner := bufio.NewScanner(strings.NewReader(string(data)))
|
||||
for scanner.Scan() {
|
||||
line := strings.TrimSpace(scanner.Text())
|
||||
if line == "" || strings.HasPrefix(line, "#") {
|
||||
continue
|
||||
}
|
||||
key, value, ok := strings.Cut(line, "=")
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
key = strings.TrimSpace(key)
|
||||
if key != "ID" {
|
||||
continue
|
||||
}
|
||||
value = strings.TrimSpace(value)
|
||||
// Strip surrounding double quotes (freedesktop spec allows quoted values).
|
||||
if len(value) >= 2 && value[0] == '"' && value[len(value)-1] == '"' {
|
||||
value = value[1 : len(value)-1]
|
||||
}
|
||||
return value
|
||||
}
|
||||
return ""
|
||||
}
|
||||
@@ -1,103 +0,0 @@
|
||||
package osdetect
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestParseID_Ubuntu(t *testing.T) {
|
||||
content := `NAME="Ubuntu"
|
||||
VERSION="24.04.4 LTS (Noble Numbat)"
|
||||
ID=ubuntu
|
||||
ID_LIKE=debian`
|
||||
if got := ParseID([]byte(content)); got != "ubuntu" {
|
||||
t.Errorf("got %q, want ubuntu", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseID_Debian(t *testing.T) {
|
||||
if got := ParseID([]byte("ID=debian\n")); got != "debian" {
|
||||
t.Errorf("got %q, want debian", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseID_Alpine(t *testing.T) {
|
||||
if got := ParseID([]byte("ID=alpine\n")); got != "alpine" {
|
||||
t.Errorf("got %q, want alpine", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseID_PVE(t *testing.T) {
|
||||
if got := ParseID([]byte("ID=pve\nID_LIKE=debian\n")); got != "pve" {
|
||||
t.Errorf("got %q, want pve", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseID_QuotedValue(t *testing.T) {
|
||||
if got := ParseID([]byte(`ID="ubuntu"` + "\n")); got != "ubuntu" {
|
||||
t.Errorf("got %q, want ubuntu", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseID_MissingID(t *testing.T) {
|
||||
if got := ParseID([]byte("NAME=Test\n")); got != "" {
|
||||
t.Errorf("got %q, want empty", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseID_UnknownIDVerbatim(t *testing.T) {
|
||||
if got := ParseID([]byte("ID=fedora\n")); got != "fedora" {
|
||||
t.Errorf("got %q, want fedora", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseID_CommentsAndBlanks(t *testing.T) {
|
||||
content := `# comment
|
||||
|
||||
NAME="Test"
|
||||
# ID below
|
||||
ID=arch`
|
||||
if got := ParseID([]byte(content)); got != "arch" {
|
||||
t.Errorf("got %q, want arch", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDetect_FallbackToLinux(t *testing.T) {
|
||||
orig := osReleasePaths
|
||||
defer func() { osReleasePaths = orig }()
|
||||
osReleasePaths = []string{filepath.Join(t.TempDir(), "nonexistent")}
|
||||
if got := Detect(); got != "linux" {
|
||||
t.Errorf("got %q, want linux (fallback)", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDetect_ReadsFile(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
orig := osReleasePaths
|
||||
defer func() { osReleasePaths = orig }()
|
||||
path := filepath.Join(dir, "os-release")
|
||||
osReleasePaths = []string{path}
|
||||
if err := os.WriteFile(path, []byte("ID=ubuntu\n"), 0o644); err != nil {
|
||||
t.Fatalf("write: %v", err)
|
||||
}
|
||||
if got := Detect(); got != "ubuntu" {
|
||||
t.Errorf("got %q, want ubuntu", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDetect_FallbackToUsrLib(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
orig := osReleasePaths
|
||||
defer func() { osReleasePaths = orig }()
|
||||
osReleasePaths = []string{
|
||||
filepath.Join(dir, "etc"), // missing
|
||||
filepath.Join(dir, "usr-lib"), // fallback
|
||||
}
|
||||
if err := os.WriteFile(osReleasePaths[1], []byte("ID=alpine\n"), 0o644); err != nil {
|
||||
t.Fatalf("write: %v", err)
|
||||
}
|
||||
if got := Detect(); got != "alpine" {
|
||||
t.Errorf("got %q, want alpine (from fallback)", got)
|
||||
}
|
||||
}
|
||||
@@ -1,364 +0,0 @@
|
||||
// Package proxmox implements the SSH-based bootstrap of a remote
|
||||
// Proxmox VE 8/9 host as an orca node (REQ-050, REQ-051).
|
||||
//
|
||||
// The bootstrap sequence (run via `orca node join --type proxmox`):
|
||||
// 1. Generate or load the orca SSH keypair (Ed25519, D-037)
|
||||
// 2. SSH dial with password auth + TOFU host-key capture (D-035)
|
||||
// 3. Deploy the orca pubkey to ~orca/.ssh/authorized_keys
|
||||
// 4. Create the `orca` Linux system user (config-overridable name)
|
||||
// 5. Create the OrcaOperator PVE role with least-privilege privileges
|
||||
// 6. Create the orca@pam PVE user (maps to the Linux system user)
|
||||
// 7. Assign the OrcaOperator role to orca@pam on path /
|
||||
// 8. Write /etc/sudoers.d/orca with NOEXEC on pct/qm, no NOEXEC on
|
||||
// apt-get/dpkg, and pvesh EXCLUDED (AD-020: pvesh can bypass NOEXEC
|
||||
// via the API execute endpoint)
|
||||
// 9. Validate the sudoers file with visudo -cf
|
||||
// 10. Return the node metadata for the caller to persist
|
||||
//
|
||||
// All steps are idempotent (D-036): re-running the bootstrap on an
|
||||
// already-configured host is a no-op. The password is never persisted
|
||||
// (D-031) — it is used only for the initial SSH auth and pubkey
|
||||
// deployment; subsequent orca→Proxmox access uses the deployed SSH key.
|
||||
package proxmox
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"golang.org/x/crypto/ssh"
|
||||
"golang.org/x/crypto/ssh/knownhosts"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
||||
"git.cloudinit.dev/coreci/orca/internal/security"
|
||||
)
|
||||
|
||||
// DefaultProxmoxUser is the default Linux system user created on the
|
||||
// Proxmox host. Overridable via Options.ProxmoxUser.
|
||||
const DefaultProxmoxUser = "orca"
|
||||
|
||||
// DefaultProxmoxRole is the default PVE custom role created for the
|
||||
// orca user. Overridable via Options.ProxmoxRole.
|
||||
const DefaultProxmoxRole = "OrcaOperator"
|
||||
|
||||
// DefaultSSHPort is the default SSH port for Proxmox hosts.
|
||||
const DefaultSSHPort = 22
|
||||
|
||||
// OrcaOperatorPrivileges is the least-privilege privilege set for the
|
||||
// OrcaOperator PVE role (D-033). Space-separated per pveum --privs
|
||||
// syntax. VM.Audit covers CTs as well (both live under /vms/{vmid}).
|
||||
const OrcaOperatorPrivileges = "VM.Audit Datastore.AllocateSpace SDN.Use"
|
||||
|
||||
// Options configures a Proxmox bootstrap run.
|
||||
type Options struct {
|
||||
// Host is the Proxmox host address (IP or hostname, no port).
|
||||
Host string
|
||||
// SSHUser is the initial SSH username (default "root").
|
||||
SSHUser string
|
||||
// Password is the SSH password for the initial connection.
|
||||
// NEVER persisted (D-031). The caller must zero this after use.
|
||||
Password string
|
||||
// ProxmoxUser is the Linux system user to create on the host
|
||||
// (default "orca"). Config-overridable.
|
||||
ProxmoxUser string
|
||||
// ProxmoxRole is the PVE custom role to create (default
|
||||
// "OrcaOperator"). Config-overridable.
|
||||
ProxmoxRole string
|
||||
// SSHPort is the SSH port (default 22).
|
||||
SSHPort int
|
||||
// Logger receives audit-log entries. If nil, slog.Default() is used.
|
||||
Logger *slog.Logger
|
||||
}
|
||||
|
||||
// Result is the outcome of a successful bootstrap.
|
||||
type Result struct {
|
||||
// NodeName is the name to use for the node in the orca registry
|
||||
// (typically the host address).
|
||||
NodeName string
|
||||
// NodeAddress is the orca daemon address on the Proxmox host
|
||||
// (host:8443 — the orca daemon port).
|
||||
NodeAddress string
|
||||
// HostKeyFingerprint is the SHA-256 fingerprint of the captured
|
||||
// SSH host key (for operator verification).
|
||||
HostKeyFingerprint string
|
||||
}
|
||||
|
||||
// BootstrapProxmox runs the full SSH bootstrap sequence on a remote
|
||||
// Proxmox VE 8/9 host. All steps are idempotent. Returns a Result
|
||||
// describing the node to register, or an error if any step fails.
|
||||
func BootstrapProxmox(ctx context.Context, opts Options) (*Result, error) {
|
||||
if opts.Host == "" {
|
||||
return nil, fmt.Errorf("proxmox bootstrap: host is required")
|
||||
}
|
||||
if opts.Password == "" {
|
||||
return nil, fmt.Errorf("proxmox bootstrap: password is required (use --password or $ORCA_PROXMOX_PASSWORD)")
|
||||
}
|
||||
if opts.SSHUser == "" {
|
||||
opts.SSHUser = "root"
|
||||
}
|
||||
if opts.ProxmoxUser == "" {
|
||||
opts.ProxmoxUser = DefaultProxmoxUser
|
||||
}
|
||||
if opts.ProxmoxRole == "" {
|
||||
opts.ProxmoxRole = DefaultProxmoxRole
|
||||
}
|
||||
if opts.SSHPort == 0 {
|
||||
opts.SSHPort = DefaultSSHPort
|
||||
}
|
||||
log := opts.Logger
|
||||
if log == nil {
|
||||
log = slog.Default()
|
||||
}
|
||||
|
||||
// Step 1: Generate or load the orca SSH keypair (D-037).
|
||||
// The key is deployed to the remote host's authorized_keys in step 3.
|
||||
_, pubLine, err := security.GenerateOrLoadSSHKey(certpaths.Dir())
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("ssh key: %w", err)
|
||||
}
|
||||
|
||||
// Step 2: SSH dial with password auth + TOFU host-key capture (D-035).
|
||||
// knownhosts.New reads ~/.orca/known_hosts; on first connect it
|
||||
// captures the host key, on subsequent connects it verifies.
|
||||
hostKeyCallback, err := knownhosts.New(certpaths.KnownHostsPath())
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("known_hosts callback: %w", err)
|
||||
}
|
||||
|
||||
sshAddr := fmt.Sprintf("%s:%d", opts.Host, opts.SSHPort)
|
||||
sshConfig := &ssh.ClientConfig{
|
||||
User: opts.SSHUser,
|
||||
Auth: []ssh.AuthMethod{ssh.Password(opts.Password)},
|
||||
HostKeyCallback: hostKeyCallback,
|
||||
Timeout: 10 * time.Second,
|
||||
}
|
||||
|
||||
dialCtx, dialCancel := context.WithTimeout(ctx, 15*time.Second)
|
||||
defer dialCancel()
|
||||
conn, err := sshDialer.DialContext(dialCtx, "tcp", sshAddr, sshConfig)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("ssh dial %s: %w", sshAddr, err)
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
if sessionRunner == nil {
|
||||
sessionRunner = &sshSessionRunner{client: conn}
|
||||
}
|
||||
|
||||
log.Info("proxmox.ssh_connected",
|
||||
slog.String("event", "proxmox.ssh_connected"),
|
||||
slog.String("host", opts.Host),
|
||||
slog.String("ssh_user", opts.SSHUser),
|
||||
)
|
||||
|
||||
// Step 3: Deploy orca pubkey to ~orca/.ssh/authorized_keys (idempotent).
|
||||
if err := deployPubKey(opts.ProxmoxUser, string(pubLine)); err != nil {
|
||||
return nil, fmt.Errorf("deploy pubkey: %w", err)
|
||||
}
|
||||
|
||||
// Step 4: Create orca Linux system user (idempotent).
|
||||
if err := createLinuxUser(opts.ProxmoxUser); err != nil {
|
||||
return nil, fmt.Errorf("create user %s: %w", opts.ProxmoxUser, err)
|
||||
}
|
||||
|
||||
// Step 5: Create OrcaOperator PVE role (idempotent).
|
||||
if err := createPVERole(opts.ProxmoxRole); err != nil {
|
||||
return nil, fmt.Errorf("create PVE role %s: %w", opts.ProxmoxRole, err)
|
||||
}
|
||||
|
||||
// Step 6: Create orca@pam PVE user (idempotent).
|
||||
if err := createPVEUser(opts.ProxmoxUser); err != nil {
|
||||
return nil, fmt.Errorf("create PVE user %s@pam: %w", opts.ProxmoxUser, err)
|
||||
}
|
||||
|
||||
// Step 7: Assign OrcaOperator role to orca@pam on path / (idempotent).
|
||||
if err := assignPVEACL(opts.ProxmoxUser, opts.ProxmoxRole); err != nil {
|
||||
return nil, fmt.Errorf("assign ACL: %w", err)
|
||||
}
|
||||
|
||||
// Step 8: Write /etc/sudoers.d/orca (AD-020: NOEXEC on pct/qm,
|
||||
// no NOEXEC on apt-get/dpkg, pvesh EXCLUDED).
|
||||
if err := writeSudoers(opts.ProxmoxUser); err != nil {
|
||||
return nil, fmt.Errorf("write sudoers: %w", err)
|
||||
}
|
||||
|
||||
// Step 9: Validate sudoers with visudo -cf.
|
||||
if err := validateSudoers(); err != nil {
|
||||
return nil, fmt.Errorf("validate sudoers: %w", err)
|
||||
}
|
||||
|
||||
log.Info("proxmox.bootstrap_ok",
|
||||
slog.String("event", "proxmox.bootstrap_ok"),
|
||||
slog.String("host", opts.Host),
|
||||
slog.String("proxmox_user", opts.ProxmoxUser),
|
||||
slog.String("proxmox_role", opts.ProxmoxRole),
|
||||
)
|
||||
|
||||
return &Result{
|
||||
NodeName: opts.Host,
|
||||
NodeAddress: opts.Host + ":8443",
|
||||
}, nil
|
||||
}
|
||||
|
||||
// sshDialer is the dialer used by BootstrapProxmox. It's a package-level
|
||||
// variable so tests can override it with a fake SSH server.
|
||||
var sshDialer sshDialerType = defaultSSHDialer{}
|
||||
|
||||
type sshDialerType interface {
|
||||
DialContext(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*ssh.Client, error)
|
||||
}
|
||||
|
||||
type defaultSSHDialer struct{}
|
||||
|
||||
func (defaultSSHDialer) DialContext(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
|
||||
return ssh.Dial(network, addr, config)
|
||||
}
|
||||
|
||||
type sessionRunnerType interface {
|
||||
CombinedOutput(cmd string) ([]byte, error)
|
||||
}
|
||||
|
||||
var sessionRunner sessionRunnerType
|
||||
|
||||
type sshSessionRunner struct {
|
||||
client *ssh.Client
|
||||
}
|
||||
|
||||
func (r *sshSessionRunner) CombinedOutput(cmd string) ([]byte, error) {
|
||||
session, err := r.client.NewSession()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("new session: %w", err)
|
||||
}
|
||||
defer session.Close()
|
||||
return session.CombinedOutput(cmd)
|
||||
}
|
||||
|
||||
// runRemote runs a command over the SSH connection and returns its
|
||||
// combined output. Returns an error if the command exits non-zero.
|
||||
func runRemote(cmd string) ([]byte, error) {
|
||||
out, err := sessionRunner.CombinedOutput(cmd)
|
||||
if err != nil {
|
||||
return out, fmt.Errorf("run %q: %w (output: %s)", cmd, err, strings.TrimSpace(string(out)))
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// deployPubKey appends the orca public key to the remote user's
|
||||
// authorized_keys file, creating the .ssh dir if needed. Idempotent:
|
||||
// if the key is already present, it is not re-appended.
|
||||
func deployPubKey(user, pubLine string) error {
|
||||
pubLine = strings.TrimSpace(pubLine)
|
||||
if pubLine == "" {
|
||||
return fmt.Errorf("deployPubKey: empty pub line")
|
||||
}
|
||||
home := "/home/" + user
|
||||
if user == "root" {
|
||||
home = "/root"
|
||||
}
|
||||
sshDir := home + "/.ssh"
|
||||
authFile := sshDir + "/authorized_keys"
|
||||
// Create .ssh dir, touch authorized_keys, set modes, append key if absent.
|
||||
cmd := fmt.Sprintf(
|
||||
"mkdir -p %s && touch %s && chmod 0700 %s && chmod 0600 %s && grep -qF '%s' %s || echo '%s' >> %s",
|
||||
sshDir, authFile, sshDir, authFile, pubLine, authFile, pubLine, authFile,
|
||||
)
|
||||
if _, err := runRemote(cmd); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// createLinuxUser creates the orca system user if it doesn't already
|
||||
// exist. Idempotent: `id -u` check before `useradd`.
|
||||
func createLinuxUser(user string) error {
|
||||
cmd := fmt.Sprintf("id -u %s 2>/dev/null || useradd -m -s /bin/bash %s", user, user)
|
||||
if _, err := runRemote(cmd); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// createPVERole creates the OrcaOperator PVE role if it doesn't exist.
|
||||
// Idempotent: probes `pveum role list` before `pveum role add`.
|
||||
func createPVERole(role string) error {
|
||||
cmd := fmt.Sprintf(
|
||||
"pveum role list 2>/dev/null | grep -q '^%s' || pveum role add %s --privs '%s'",
|
||||
role, role, OrcaOperatorPrivileges,
|
||||
)
|
||||
if _, err := runRemote(cmd); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// createPVEUser creates the orca@pam PVE user if it doesn't exist.
|
||||
// Idempotent: probes `pveum user list` before `pveum user add`.
|
||||
// Uses @pam realm (AD-019) since orca creates a Linux system user.
|
||||
func createPVEUser(user string) error {
|
||||
pveUserID := user + "@pam"
|
||||
cmd := fmt.Sprintf(
|
||||
"pveum user list 2>/dev/null | grep -q '%s' || pveum user add %s -comment 'Orca automation user'",
|
||||
pveUserID, pveUserID,
|
||||
)
|
||||
if _, err := runRemote(cmd); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// assignPVEACL assigns the OrcaOperator role to orca@pam on path /
|
||||
// (cluster-wide). `pveum acl modify` is idempotent (creates or updates).
|
||||
func assignPVEACL(user, role string) error {
|
||||
pveUserID := user + "@pam"
|
||||
cmd := fmt.Sprintf("pveum acl modify / -user %s -role %s", pveUserID, role)
|
||||
if _, err := runRemote(cmd); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// sudoersContent returns the /etc/sudoers.d/orca file content (AD-020).
|
||||
// NOEXEC on pct/qm (blocks shell escapes); no NOEXEC on apt-get/dpkg
|
||||
// (they need exec for maintainer scripts); pvesh EXCLUDED (API execute
|
||||
// bypasses NOEXEC). File must be mode 0440 per sudo requirements.
|
||||
func sudoersContent(user string) string {
|
||||
return fmt.Sprintf(`# /etc/sudoers.d/orca — Managed by orca; do not edit manually.
|
||||
# Least-privilege allowlist for the orca PVE operator user.
|
||||
# NOPASSWD: non-interactive SSH automation. NOEXEC: blocks shell escapes.
|
||||
# pvesh is EXCLUDED (AD-020: pvesh can bypass NOEXEC via API execute).
|
||||
%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/pct
|
||||
%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/qm
|
||||
%s ALL=(root) NOPASSWD: /usr/bin/apt-get
|
||||
%s ALL=(root) NOPASSWD: /usr/bin/dpkg
|
||||
`, user, user, user, user)
|
||||
}
|
||||
|
||||
// writeSudoers writes the /etc/sudoers.d/orca file on the remote host
|
||||
// with mode 0440. Uses a heredoc via cat to avoid quoting issues.
|
||||
func writeSudoers(user string) error {
|
||||
content := sudoersContent(user)
|
||||
// Write via cat heredoc, then chmod 0440.
|
||||
cmd := fmt.Sprintf("cat > /etc/sudoers.d/%s <<'ORCA_SUDOERS_EOF'\n%s\nORCA_SUDOERS_EOF\nchmod 0440 /etc/sudoers.d/%s",
|
||||
user, content, user)
|
||||
if _, err := runRemote(cmd); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// validateSudoers runs `visudo -cf` on the sudoers file. Aborts the
|
||||
// bootstrap if validation fails (prevents a broken sudoers from
|
||||
// locking the orca user out of sudo).
|
||||
func validateSudoers() error {
|
||||
cmd := "visudo -cf /etc/sudoers.d/orca"
|
||||
out, err := runRemote(cmd)
|
||||
if err != nil {
|
||||
return fmt.Errorf("visudo validation failed: %w (output: %s)", err, strings.TrimSpace(string(out)))
|
||||
}
|
||||
if !strings.Contains(string(out), "parsed OK") {
|
||||
return fmt.Errorf("visudo validation did not report OK: %s", strings.TrimSpace(string(out)))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -1,490 +0,0 @@
|
||||
package proxmox
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"errors"
|
||||
"log/slog"
|
||||
"net"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"golang.org/x/crypto/ssh"
|
||||
)
|
||||
|
||||
func TestSudoersContent(t *testing.T) {
|
||||
content := sudoersContent("orca")
|
||||
|
||||
if !strings.Contains(content, "NOPASSWD: NOEXEC: /usr/bin/pct") {
|
||||
t.Error("missing NOEXEC on pct (AD-020)")
|
||||
}
|
||||
if !strings.Contains(content, "NOPASSWD: NOEXEC: /usr/bin/qm") {
|
||||
t.Error("missing NOEXEC on qm (AD-020)")
|
||||
}
|
||||
|
||||
if !strings.Contains(content, "NOPASSWD: /usr/bin/apt-get") {
|
||||
t.Error("missing NOPASSWD on apt-get")
|
||||
}
|
||||
if !strings.Contains(content, "NOPASSWD: /usr/bin/dpkg") {
|
||||
t.Error("missing NOPASSWD on dpkg")
|
||||
}
|
||||
if strings.Contains(content, "NOEXEC: /usr/bin/apt-get") {
|
||||
t.Error("apt-get must NOT have NOEXEC (breaks maintainer scripts)")
|
||||
}
|
||||
if strings.Contains(content, "NOEXEC: /usr/bin/dpkg") {
|
||||
t.Error("dpkg must NOT have NOEXEC (breaks maintainer scripts)")
|
||||
}
|
||||
|
||||
for _, line := range strings.Split(content, "\n") {
|
||||
trimmed := strings.TrimSpace(line)
|
||||
if strings.HasPrefix(trimmed, "#") || trimmed == "" {
|
||||
continue
|
||||
}
|
||||
if strings.Contains(trimmed, "pvesh") {
|
||||
t.Errorf("pvesh must be EXCLUDED from sudoers command lines (AD-020): %s", trimmed)
|
||||
}
|
||||
}
|
||||
|
||||
if !strings.HasPrefix(content, "# /etc/sudoers.d/orca") {
|
||||
t.Error("missing managed-by-orca header")
|
||||
}
|
||||
if !strings.Contains(content, "orca ALL=(root)") {
|
||||
t.Error("missing orca user in sudoers")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSudoersContent_CustomUser(t *testing.T) {
|
||||
content := sudoersContent("custom-orca")
|
||||
if !strings.Contains(content, "custom-orca ALL=(root)") {
|
||||
t.Error("missing custom-orca user in sudoers")
|
||||
}
|
||||
}
|
||||
|
||||
func TestOrcaOperatorPrivileges(t *testing.T) {
|
||||
privs := strings.Fields(OrcaOperatorPrivileges)
|
||||
expected := map[string]bool{
|
||||
"VM.Audit": true,
|
||||
"Datastore.AllocateSpace": true,
|
||||
"SDN.Use": true,
|
||||
}
|
||||
if len(privs) != 3 {
|
||||
t.Errorf("expected 3 privileges, got %d: %v", len(privs), privs)
|
||||
}
|
||||
for _, p := range privs {
|
||||
if !expected[p] {
|
||||
t.Errorf("unexpected privilege %q", p)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_Validation(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
|
||||
_, err := BootstrapProxmox(ctx, Options{Password: "pw"})
|
||||
if err == nil || !strings.Contains(err.Error(), "host is required") {
|
||||
t.Errorf("expected host-required error, got %v", err)
|
||||
}
|
||||
|
||||
_, err = BootstrapProxmox(ctx, Options{Host: "10.0.0.1"})
|
||||
if err == nil || !strings.Contains(err.Error(), "password is required") {
|
||||
t.Errorf("expected password-required error, got %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDefaultOptions(t *testing.T) {
|
||||
if DefaultProxmoxUser != "orca" {
|
||||
t.Errorf("DefaultProxmoxUser = %q, want orca", DefaultProxmoxUser)
|
||||
}
|
||||
if DefaultProxmoxRole != "OrcaOperator" {
|
||||
t.Errorf("DefaultProxmoxRole = %q, want OrcaOperator", DefaultProxmoxRole)
|
||||
}
|
||||
if DefaultSSHPort != 22 {
|
||||
t.Errorf("DefaultSSHPort = %d, want 22", DefaultSSHPort)
|
||||
}
|
||||
}
|
||||
|
||||
type mockSSHDialer struct {
|
||||
client *ssh.Client
|
||||
err error
|
||||
calls int
|
||||
lastAddr string
|
||||
lastCfg *ssh.ClientConfig
|
||||
}
|
||||
|
||||
func (m *mockSSHDialer) DialContext(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
|
||||
m.calls++
|
||||
m.lastAddr = addr
|
||||
m.lastCfg = config
|
||||
if m.err != nil {
|
||||
return nil, m.err
|
||||
}
|
||||
return m.client, nil
|
||||
}
|
||||
|
||||
func setupORCAHome(t *testing.T) string {
|
||||
t.Helper()
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
knownHosts := filepath.Join(dir, "known_hosts")
|
||||
if err := os.WriteFile(knownHosts, []byte{}, 0o600); err != nil {
|
||||
t.Fatalf("create known_hosts: %v", err)
|
||||
}
|
||||
return dir
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_SSHAuthFailure(t *testing.T) {
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
sshDialer = &mockSSHDialer{err: errors.New("ssh: handshake failed: ssh: unable to authenticate")}
|
||||
|
||||
setupORCAHome(t)
|
||||
|
||||
_, err := BootstrapProxmox(context.Background(), Options{
|
||||
Host: "10.0.0.1",
|
||||
Password: "pw",
|
||||
})
|
||||
if err == nil {
|
||||
t.Fatal("expected error, got nil")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "ssh") {
|
||||
t.Errorf("error should mention ssh, got: %v", err)
|
||||
}
|
||||
if !strings.Contains(err.Error(), "ssh dial") {
|
||||
t.Errorf("error should mention ssh dial, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_SSHDialCalledWithCorrectAddr(t *testing.T) {
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
dialer := &mockSSHDialer{err: errors.New("connection refused")}
|
||||
sshDialer = dialer
|
||||
|
||||
setupORCAHome(t)
|
||||
|
||||
_, _ = BootstrapProxmox(context.Background(), Options{
|
||||
Host: "10.0.0.42",
|
||||
Password: "pw",
|
||||
SSHPort: 2222,
|
||||
})
|
||||
if dialer.calls != 1 {
|
||||
t.Errorf("dialer calls = %d, want 1", dialer.calls)
|
||||
}
|
||||
if dialer.lastAddr != "10.0.0.42:2222" {
|
||||
t.Errorf("dial addr = %q, want 10.0.0.42:2222", dialer.lastAddr)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_DefaultSSHPort(t *testing.T) {
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
dialer := &mockSSHDialer{err: errors.New("connection refused")}
|
||||
sshDialer = dialer
|
||||
|
||||
setupORCAHome(t)
|
||||
|
||||
_, _ = BootstrapProxmox(context.Background(), Options{
|
||||
Host: "10.0.0.99",
|
||||
Password: "pw",
|
||||
})
|
||||
if dialer.lastAddr != "10.0.0.99:22" {
|
||||
t.Errorf("dial addr = %q, want 10.0.0.99:22 (default port)", dialer.lastAddr)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_CustomSSHUser(t *testing.T) {
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
dialer := &mockSSHDialer{err: errors.New("connection refused")}
|
||||
sshDialer = dialer
|
||||
|
||||
setupORCAHome(t)
|
||||
|
||||
_, _ = BootstrapProxmox(context.Background(), Options{
|
||||
Host: "10.0.0.1",
|
||||
Password: "pw",
|
||||
SSHUser: "custom-admin",
|
||||
})
|
||||
if dialer.calls != 1 {
|
||||
t.Errorf("dialer calls = %d, want 1", dialer.calls)
|
||||
}
|
||||
if dialer.lastCfg == nil || dialer.lastCfg.User != "custom-admin" {
|
||||
t.Errorf("ssh user not propagated, got %+v", dialer.lastCfg)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_SSHKeyGenerated(t *testing.T) {
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
sshDialer = &mockSSHDialer{err: errors.New("connection refused")}
|
||||
|
||||
dir := setupORCAHome(t)
|
||||
|
||||
_, _ = BootstrapProxmox(context.Background(), Options{
|
||||
Host: "10.0.0.1",
|
||||
Password: "pw",
|
||||
})
|
||||
|
||||
keyPath := filepath.Join(dir, "orca_ssh_key")
|
||||
pubPath := filepath.Join(dir, "orca_ssh_key.pub")
|
||||
if _, err := os.Stat(keyPath); err != nil {
|
||||
t.Errorf("SSH key not generated at %s: %v", keyPath, err)
|
||||
}
|
||||
if _, err := os.Stat(pubPath); err != nil {
|
||||
t.Errorf("SSH pub not generated at %s: %v", pubPath, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_KnownHostsFileCreated(t *testing.T) {
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
sshDialer = &mockSSHDialer{err: errors.New("connection refused")}
|
||||
|
||||
dir := setupORCAHome(t)
|
||||
|
||||
_, _ = BootstrapProxmox(context.Background(), Options{
|
||||
Host: "10.0.0.1",
|
||||
Password: "pw",
|
||||
})
|
||||
|
||||
knownHosts := filepath.Join(dir, "known_hosts")
|
||||
if _, err := os.Stat(knownHosts); err != nil {
|
||||
t.Errorf("known_hosts not created at %s: %v", knownHosts, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_NilLogger(t *testing.T) {
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
sshDialer = &mockSSHDialer{err: errors.New("connection refused")}
|
||||
|
||||
setupORCAHome(t)
|
||||
|
||||
defer func() {
|
||||
if r := recover(); r != nil {
|
||||
t.Fatalf("nil logger panicked: %v", r)
|
||||
}
|
||||
}()
|
||||
_, _ = BootstrapProxmox(context.Background(), Options{
|
||||
Host: "10.0.0.1",
|
||||
Password: "pw",
|
||||
Logger: nil,
|
||||
})
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_CustomLogger(t *testing.T) {
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
sshDialer = &mockSSHDialer{err: errors.New("connection refused")}
|
||||
|
||||
setupORCAHome(t)
|
||||
|
||||
var buf bytes.Buffer
|
||||
log := slog.New(slog.NewTextHandler(&buf, nil))
|
||||
|
||||
defer func() {
|
||||
if r := recover(); r != nil {
|
||||
t.Fatalf("custom logger panicked: %v", r)
|
||||
}
|
||||
}()
|
||||
_, _ = BootstrapProxmox(context.Background(), Options{
|
||||
Host: "10.0.0.1",
|
||||
Password: "pw",
|
||||
Logger: log,
|
||||
})
|
||||
_ = buf.String()
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_ContextCancelled(t *testing.T) {
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
sshDialer = &mockSSHDialer{err: errors.New("connection refused")}
|
||||
|
||||
setupORCAHome(t)
|
||||
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
cancel()
|
||||
_, err := BootstrapProxmox(ctx, Options{
|
||||
Host: "10.0.0.1",
|
||||
Password: "pw",
|
||||
})
|
||||
if err == nil {
|
||||
t.Fatal("expected error with cancelled context")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeployPubKey_EmptyPubLine(t *testing.T) {
|
||||
err := deployPubKey("orca", "")
|
||||
if err == nil {
|
||||
t.Error("expected error for empty pub line")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "empty pub line") {
|
||||
t.Errorf("error should mention empty pub line, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeployPubKey_WhitespaceOnlyPubLine(t *testing.T) {
|
||||
err := deployPubKey("orca", " \n \t ")
|
||||
if err == nil {
|
||||
t.Error("expected error for whitespace-only pub line")
|
||||
}
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_FullFlow_IdempotentReRun(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
|
||||
home := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", home)
|
||||
if err := os.WriteFile(filepath.Join(home, "known_hosts"), []byte{}, 0o600); err != nil {
|
||||
t.Fatalf("create known_hosts: %v", err)
|
||||
}
|
||||
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
origRunner := sessionRunner
|
||||
defer func() { sessionRunner = origRunner }()
|
||||
|
||||
host, _, _ := net.SplitHostPort(srv.addr())
|
||||
sshDialer = &funcDialer{fn: func(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
|
||||
return fakeSSHClient(t, srv), nil
|
||||
}}
|
||||
|
||||
for i := 0; i < 2; i++ {
|
||||
sessionRunner = nil
|
||||
if _, err := BootstrapProxmox(t.Context(), Options{
|
||||
Host: host,
|
||||
Password: "pw",
|
||||
}); err != nil {
|
||||
t.Fatalf("bootstrap run %d: %v", i+1, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_FullFlow_NoPasswordInLogs(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
|
||||
home := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", home)
|
||||
if err := os.WriteFile(filepath.Join(home, "known_hosts"), []byte{}, 0o600); err != nil {
|
||||
t.Fatalf("create known_hosts: %v", err)
|
||||
}
|
||||
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
origRunner := sessionRunner
|
||||
defer func() { sessionRunner = origRunner }()
|
||||
sessionRunner = nil
|
||||
sshDialer = &staticDialer{client: fakeSSHClient(t, srv)}
|
||||
|
||||
host, _, _ := net.SplitHostPort(srv.addr())
|
||||
|
||||
var logBuf bytes.Buffer
|
||||
_, err := BootstrapProxmox(t.Context(), Options{
|
||||
Host: host,
|
||||
Password: "super-secret-pw-12345",
|
||||
Logger: slog.New(slog.NewTextHandler(&logBuf, nil)),
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("BootstrapProxmox: %v", err)
|
||||
}
|
||||
out := logBuf.String()
|
||||
if strings.Contains(out, "super-secret-pw-12345") {
|
||||
t.Errorf("password leaked into logs (D-031): %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_FullFlow_ValidateSudoersFails(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
srv.forceSudoersInvalid = true
|
||||
|
||||
home := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", home)
|
||||
if err := os.WriteFile(filepath.Join(home, "known_hosts"), []byte{}, 0o600); err != nil {
|
||||
t.Fatalf("create known_hosts: %v", err)
|
||||
}
|
||||
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
origRunner := sessionRunner
|
||||
defer func() { sessionRunner = origRunner }()
|
||||
sessionRunner = nil
|
||||
sshDialer = &staticDialer{client: fakeSSHClient(t, srv)}
|
||||
|
||||
host, _, _ := net.SplitHostPort(srv.addr())
|
||||
|
||||
_, err := BootstrapProxmox(t.Context(), Options{
|
||||
Host: host,
|
||||
Password: "pw",
|
||||
})
|
||||
if err == nil {
|
||||
t.Fatal("expected error for invalid sudoers")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "validate sudoers") {
|
||||
t.Errorf("error should mention validate sudoers, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDefaultSSHDialer_DialContext_ConnectionRefused(t *testing.T) {
|
||||
d := defaultSSHDialer{}
|
||||
cfg := &ssh.ClientConfig{
|
||||
User: "root",
|
||||
Auth: []ssh.AuthMethod{ssh.Password("pw")},
|
||||
HostKeyCallback: ssh.InsecureIgnoreHostKey(),
|
||||
Timeout: 200 * time.Millisecond,
|
||||
}
|
||||
_, err := d.DialContext(context.Background(), "tcp", "127.0.0.1:1", cfg)
|
||||
if err == nil {
|
||||
t.Fatal("expected error for connection refused")
|
||||
}
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_FullFlow_CreateLinuxUserFails(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
|
||||
home := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", home)
|
||||
if err := os.WriteFile(filepath.Join(home, "known_hosts"), []byte{}, 0o600); err != nil {
|
||||
t.Fatalf("create known_hosts: %v", err)
|
||||
}
|
||||
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
origRunner := sessionRunner
|
||||
defer func() { sessionRunner = origRunner }()
|
||||
sessionRunner = nil
|
||||
sshDialer = &staticDialer{client: fakeSSHClient(t, srv)}
|
||||
|
||||
host, _, _ := net.SplitHostPort(srv.addr())
|
||||
|
||||
// ProxmoxUser=root exercises the /root home branch in deployPubKey.
|
||||
_, err := BootstrapProxmox(t.Context(), Options{
|
||||
Host: host,
|
||||
Password: "pw",
|
||||
ProxmoxUser: "root",
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("BootstrapProxmox with ProxmoxUser=root: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSSHSessionRunner_CombinedOutput_NewSessionError(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
conn := fakeSSHClient(t, srv)
|
||||
conn.Close()
|
||||
r := &sshSessionRunner{client: conn}
|
||||
_, err := r.CombinedOutput("echo hi")
|
||||
if err == nil {
|
||||
t.Fatal("expected error from NewSession on closed client")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "new session") {
|
||||
t.Errorf("error should mention new session, got: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -1,502 +0,0 @@
|
||||
package proxmox
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"errors"
|
||||
"log/slog"
|
||||
"net"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"golang.org/x/crypto/ssh"
|
||||
)
|
||||
|
||||
type fakeSSHServer struct {
|
||||
listener net.Listener
|
||||
config *ssh.ServerConfig
|
||||
done chan struct{}
|
||||
|
||||
mu sync.Mutex
|
||||
state map[string]string
|
||||
authDir string
|
||||
forceSudoersInvalid bool
|
||||
}
|
||||
|
||||
func newFakeSSHServer(t *testing.T) *fakeSSHServer {
|
||||
t.Helper()
|
||||
_, priv, err := ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
t.Fatalf("ed25519 gen: %v", err)
|
||||
}
|
||||
hostSigner, err := ssh.NewSignerFromKey(priv)
|
||||
if err != nil {
|
||||
t.Fatalf("ssh signer: %v", err)
|
||||
}
|
||||
config := &ssh.ServerConfig{
|
||||
PasswordCallback: func(c ssh.ConnMetadata, password []byte) (*ssh.Permissions, error) {
|
||||
if string(password) != "pw" {
|
||||
return nil, errors.New("invalid password")
|
||||
}
|
||||
return nil, nil
|
||||
},
|
||||
}
|
||||
config.AddHostKey(hostSigner)
|
||||
|
||||
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listen: %v", err)
|
||||
}
|
||||
srv := &fakeSSHServer{
|
||||
listener: ln,
|
||||
config: config,
|
||||
done: make(chan struct{}),
|
||||
state: make(map[string]string),
|
||||
authDir: t.TempDir(),
|
||||
}
|
||||
go srv.serve()
|
||||
return srv
|
||||
}
|
||||
|
||||
func (s *fakeSSHServer) addr() string { return s.listener.Addr().String() }
|
||||
|
||||
func (s *fakeSSHServer) serve() {
|
||||
for {
|
||||
conn, err := s.listener.Accept()
|
||||
if err != nil {
|
||||
close(s.done)
|
||||
return
|
||||
}
|
||||
go s.handle(conn)
|
||||
}
|
||||
}
|
||||
|
||||
func (s *fakeSSHServer) handle(netConn net.Conn) {
|
||||
defer netConn.Close()
|
||||
_, chans, reqs, err := ssh.NewServerConn(netConn, s.config)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
go ssh.DiscardRequests(reqs)
|
||||
for newChan := range chans {
|
||||
if newChan.ChannelType() != "session" {
|
||||
newChan.Reject(ssh.UnknownChannelType, "only session")
|
||||
continue
|
||||
}
|
||||
go s.handleSession(newChan)
|
||||
}
|
||||
}
|
||||
|
||||
func (s *fakeSSHServer) handleSession(newChan ssh.NewChannel) {
|
||||
ch, reqs, err := newChan.Accept()
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
defer ch.Close()
|
||||
for req := range reqs {
|
||||
switch req.Type {
|
||||
case "exec":
|
||||
var execReq struct{ Command string }
|
||||
if err := ssh.Unmarshal(req.Payload, &execReq); err != nil {
|
||||
req.Reply(false, nil)
|
||||
continue
|
||||
}
|
||||
req.Reply(true, nil)
|
||||
out, code := s.runCommand(execReq.Command)
|
||||
_, _ = ch.Write(out)
|
||||
_, _ = ch.SendRequest("exit-status", false, ssh.Marshal(struct{ Code uint32 }{uint32(code)}))
|
||||
_ = ch.Close()
|
||||
default:
|
||||
req.Reply(false, nil)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (s *fakeSSHServer) runCommand(cmd string) ([]byte, int) {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
trimmed := strings.TrimSpace(cmd)
|
||||
switch {
|
||||
case trimmed == "echo hello":
|
||||
return []byte("hello\n"), 0
|
||||
case strings.HasPrefix(trimmed, "exit "):
|
||||
return nil, 1
|
||||
case strings.HasPrefix(trimmed, "id -u "):
|
||||
return []byte("1000\n"), 0
|
||||
case strings.Contains(trimmed, "pveum role list") || strings.Contains(trimmed, "pveum role add"):
|
||||
s.state["pve_role:"+extractField(trimmed, "add ", " ")] = "ok"
|
||||
return nil, 0
|
||||
case strings.Contains(trimmed, "pveum user list") || strings.Contains(trimmed, "pveum user add"):
|
||||
s.state["pve_user:orca@pam"] = "ok"
|
||||
return nil, 0
|
||||
case strings.Contains(trimmed, "pveum acl modify"):
|
||||
s.state["pve_acl"] = "ok"
|
||||
return nil, 0
|
||||
case strings.HasPrefix(trimmed, "mkdir -p ") && strings.Contains(trimmed, "authorized_keys"):
|
||||
return s.handleAuthKeyDeploy(trimmed)
|
||||
case strings.HasPrefix(trimmed, "cat > /etc/sudoers.d/"):
|
||||
return s.handleSudoersWrite(trimmed), 0
|
||||
case strings.HasPrefix(trimmed, "visudo -cf /etc/sudoers.d/orca"):
|
||||
force := s.forceSudoersInvalid
|
||||
if force || s.state["sudoers_valid"] != "true" {
|
||||
return []byte("/etc/sudoers.d/orca: syntax error\n"), 1
|
||||
}
|
||||
return []byte("/etc/sudoers.d/orca: parsed OK\n"), 0
|
||||
case strings.HasPrefix(trimmed, "cat /") && strings.HasSuffix(trimmed, "/authorized_keys"):
|
||||
return s.readAuthFile(trimmed[4:]), 0
|
||||
case strings.HasPrefix(trimmed, "cat /") && strings.Contains(trimmed, "/orca"):
|
||||
return s.readSudoers(trimmed[4:]), 0
|
||||
default:
|
||||
return []byte("sh: command not found\n"), 127
|
||||
}
|
||||
}
|
||||
|
||||
func (s *fakeSSHServer) handleAuthKeyDeploy(cmd string) ([]byte, int) {
|
||||
parts := strings.Split(cmd, "'")
|
||||
var pubLine string
|
||||
if len(parts) >= 2 {
|
||||
pubLine = parts[1]
|
||||
}
|
||||
authPath := filepath.Join(s.authDir, "authorized_keys")
|
||||
existing := string(s.readFile(authPath))
|
||||
if !strings.Contains(existing, pubLine) {
|
||||
existing += pubLine + "\n"
|
||||
}
|
||||
if err := os.WriteFile(authPath, []byte(existing), 0o600); err != nil {
|
||||
return []byte("mkdir: permission denied\n"), 1
|
||||
}
|
||||
return nil, 0
|
||||
}
|
||||
|
||||
func (s *fakeSSHServer) readAuthFile(path string) []byte {
|
||||
if strings.HasSuffix(path, "/authorized_keys") {
|
||||
return s.readFile(filepath.Join(s.authDir, "authorized_keys"))
|
||||
}
|
||||
return []byte("cat: " + path + ": No such file or directory\n")
|
||||
}
|
||||
|
||||
func (s *fakeSSHServer) handleSudoersWrite(cmd string) []byte {
|
||||
idx := strings.Index(cmd, "\n")
|
||||
if idx < 0 {
|
||||
return []byte("sh: bad heredoc\n")
|
||||
}
|
||||
content := cmd[idx+1:]
|
||||
if end := strings.Index(content, "ORCA_SUDOERS_EOF"); end >= 0 {
|
||||
content = content[:end]
|
||||
}
|
||||
s.state["sudoers_content"] = content
|
||||
s.state["sudoers_valid"] = "true"
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *fakeSSHServer) readSudoers(path string) []byte {
|
||||
if v, ok := s.state["sudoers_content"]; ok {
|
||||
return []byte(v)
|
||||
}
|
||||
return []byte("cat: " + path + ": No such file or directory\n")
|
||||
}
|
||||
|
||||
func (s *fakeSSHServer) readFile(path string) []byte {
|
||||
b, _ := os.ReadFile(path)
|
||||
return b
|
||||
}
|
||||
|
||||
func (s *fakeSSHServer) close() {
|
||||
s.listener.Close()
|
||||
<-s.done
|
||||
}
|
||||
|
||||
func extractField(s, after, until string) string {
|
||||
i := strings.Index(s, after)
|
||||
if i < 0 {
|
||||
return ""
|
||||
}
|
||||
rest := s[i+len(after):]
|
||||
j := strings.Index(rest, until)
|
||||
if j < 0 {
|
||||
return rest
|
||||
}
|
||||
return rest[:j]
|
||||
}
|
||||
|
||||
func fakeSSHClient(t *testing.T, srv *fakeSSHServer) *ssh.Client {
|
||||
t.Helper()
|
||||
config := &ssh.ClientConfig{
|
||||
User: "root",
|
||||
Auth: []ssh.AuthMethod{ssh.Password("pw")},
|
||||
HostKeyCallback: ssh.InsecureIgnoreHostKey(),
|
||||
Timeout: 5 * time.Second,
|
||||
}
|
||||
client, err := ssh.Dial("tcp", srv.addr(), config)
|
||||
if err != nil {
|
||||
t.Fatalf("ssh.Dial: %v", err)
|
||||
}
|
||||
return client
|
||||
}
|
||||
|
||||
func withSessionRunner(t *testing.T, conn *ssh.Client) {
|
||||
t.Helper()
|
||||
orig := sessionRunner
|
||||
t.Cleanup(func() { sessionRunner = orig })
|
||||
sessionRunner = &sshSessionRunner{client: conn}
|
||||
}
|
||||
|
||||
func TestRunRemote_Success(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
conn := fakeSSHClient(t, srv)
|
||||
defer conn.Close()
|
||||
withSessionRunner(t, conn)
|
||||
out, err := runRemote("echo hello")
|
||||
if err != nil {
|
||||
t.Fatalf("runRemote: %v", err)
|
||||
}
|
||||
if strings.TrimSpace(string(out)) != "hello" {
|
||||
t.Errorf("output = %q, want hello", strings.TrimSpace(string(out)))
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunRemote_Failure(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
conn := fakeSSHClient(t, srv)
|
||||
defer conn.Close()
|
||||
withSessionRunner(t, conn)
|
||||
_, err := runRemote("exit 7")
|
||||
if err == nil {
|
||||
t.Fatal("expected error for non-zero exit")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "run") {
|
||||
t.Errorf("error should mention run, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeployPubKey_Success(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
conn := fakeSSHClient(t, srv)
|
||||
defer conn.Close()
|
||||
withSessionRunner(t, conn)
|
||||
|
||||
if err := deployPubKey("orca", "ssh-ed25519 AAAA test@orca"); err != nil {
|
||||
t.Fatalf("deployPubKey: %v", err)
|
||||
}
|
||||
out := srv.readFile(filepath.Join(srv.authDir, "authorized_keys"))
|
||||
if !strings.Contains(string(out), "ssh-ed25519 AAAA test@orca") {
|
||||
t.Errorf("auth file does not contain the key: %s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeployPubKey_Idempotent(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
conn := fakeSSHClient(t, srv)
|
||||
defer conn.Close()
|
||||
withSessionRunner(t, conn)
|
||||
|
||||
if err := deployPubKey("orca", "ssh-ed25519 AAAA test@orca"); err != nil {
|
||||
t.Fatalf("first deploy: %v", err)
|
||||
}
|
||||
if err := deployPubKey("orca", "ssh-ed25519 AAAA test@orca"); err != nil {
|
||||
t.Fatalf("second deploy: %v", err)
|
||||
}
|
||||
out := srv.readFile(filepath.Join(srv.authDir, "authorized_keys"))
|
||||
if cnt := strings.Count(string(out), "ssh-ed25519 AAAA test@orca"); cnt != 1 {
|
||||
t.Errorf("key count = %d, want 1 (idempotent)", cnt)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreateLinuxUser_Success(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
conn := fakeSSHClient(t, srv)
|
||||
defer conn.Close()
|
||||
withSessionRunner(t, conn)
|
||||
if err := createLinuxUser("orca"); err != nil {
|
||||
t.Fatalf("createLinuxUser: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreatePVERole_Success(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
conn := fakeSSHClient(t, srv)
|
||||
defer conn.Close()
|
||||
withSessionRunner(t, conn)
|
||||
if err := createPVERole("OrcaOperator"); err != nil {
|
||||
t.Fatalf("createPVERole: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreatePVEUser_Success(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
conn := fakeSSHClient(t, srv)
|
||||
defer conn.Close()
|
||||
withSessionRunner(t, conn)
|
||||
if err := createPVEUser("orca"); err != nil {
|
||||
t.Fatalf("createPVEUser: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAssignPVEACL_Success(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
conn := fakeSSHClient(t, srv)
|
||||
defer conn.Close()
|
||||
withSessionRunner(t, conn)
|
||||
if err := assignPVEACL("orca", "OrcaOperator"); err != nil {
|
||||
t.Fatalf("assignPVEACL: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestWriteSudoers_Success(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
conn := fakeSSHClient(t, srv)
|
||||
defer conn.Close()
|
||||
withSessionRunner(t, conn)
|
||||
|
||||
if err := writeSudoers("orca"); err != nil {
|
||||
t.Fatalf("writeSudoers: %v", err)
|
||||
}
|
||||
if srv.state["sudoers_valid"] != "true" {
|
||||
t.Error("sudoers not marked valid")
|
||||
}
|
||||
if !strings.Contains(srv.state["sudoers_content"], "orca ALL=(root) NOPASSWD: NOEXEC: /usr/bin/pct") {
|
||||
t.Errorf("sudoers content missing pct: %s", srv.state["sudoers_content"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateSudoers_ParsedOK(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
conn := fakeSSHClient(t, srv)
|
||||
defer conn.Close()
|
||||
withSessionRunner(t, conn)
|
||||
|
||||
srv.state["sudoers_valid"] = "true"
|
||||
if err := validateSudoers(); err != nil {
|
||||
t.Errorf("validateSudoers: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateSudoers_Failure(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
conn := fakeSSHClient(t, srv)
|
||||
defer conn.Close()
|
||||
withSessionRunner(t, conn)
|
||||
|
||||
srv.state["sudoers_valid"] = "false"
|
||||
if err := validateSudoers(); err == nil {
|
||||
t.Error("expected error for invalid sudoers")
|
||||
}
|
||||
}
|
||||
|
||||
type staticDialer struct {
|
||||
client *ssh.Client
|
||||
}
|
||||
|
||||
func (d *staticDialer) DialContext(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
|
||||
return d.client, nil
|
||||
}
|
||||
|
||||
type funcDialer struct {
|
||||
fn func(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*ssh.Client, error)
|
||||
}
|
||||
|
||||
func (d *funcDialer) DialContext(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
|
||||
return d.fn(ctx, network, addr, config)
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_FullFlow_Success(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
|
||||
home := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", home)
|
||||
if err := os.WriteFile(filepath.Join(home, "known_hosts"), []byte{}, 0o600); err != nil {
|
||||
t.Fatalf("create known_hosts: %v", err)
|
||||
}
|
||||
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
origRunner := sessionRunner
|
||||
defer func() { sessionRunner = origRunner }()
|
||||
sessionRunner = nil
|
||||
sshDialer = &staticDialer{client: fakeSSHClient(t, srv)}
|
||||
|
||||
host, _, _ := net.SplitHostPort(srv.addr())
|
||||
|
||||
var logBuf bytes.Buffer
|
||||
result, err := BootstrapProxmox(t.Context(), Options{
|
||||
Host: host,
|
||||
Password: "pw",
|
||||
Logger: slog.New(slog.NewTextHandler(&logBuf, nil)),
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("BootstrapProxmox: %v", err)
|
||||
}
|
||||
if result == nil {
|
||||
t.Fatal("result is nil")
|
||||
}
|
||||
if result.NodeName != host {
|
||||
t.Errorf("NodeName = %q, want %q", result.NodeName, host)
|
||||
}
|
||||
if result.NodeAddress != host+":8443" {
|
||||
t.Errorf("NodeAddress = %q, want %q:8443", result.NodeAddress, host)
|
||||
}
|
||||
if !strings.Contains(logBuf.String(), "proxmox.bootstrap_ok") {
|
||||
t.Errorf("expected bootstrap_ok log, got: %s", logBuf.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestBootstrapProxmox_FullFlow_DeployPubKeyFails(t *testing.T) {
|
||||
srv := newFakeSSHServer(t)
|
||||
defer srv.close()
|
||||
|
||||
home := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", home)
|
||||
if err := os.WriteFile(filepath.Join(home, "known_hosts"), []byte{}, 0o600); err != nil {
|
||||
t.Fatalf("create known_hosts: %v", err)
|
||||
}
|
||||
|
||||
orig := sshDialer
|
||||
defer func() { sshDialer = orig }()
|
||||
origRunner := sessionRunner
|
||||
defer func() { sessionRunner = origRunner }()
|
||||
sessionRunner = nil
|
||||
|
||||
// Use a real client that connects to a server which will reject deploy
|
||||
// by returning a non-zero exit for the mkdir command. We achieve this
|
||||
// by using a dialer that returns a client to a server whose authDir
|
||||
// is read-only — but simpler: just use a fresh server that errors on
|
||||
// authorized_keys commands via a custom server. We reuse newFakeSSHServer
|
||||
// but sabotage it by pointing authDir to a read-only location.
|
||||
conn := fakeSSHClient(t, srv)
|
||||
defer conn.Close()
|
||||
sshDialer = &staticDialer{client: conn}
|
||||
|
||||
host, _, _ := net.SplitHostPort(srv.addr())
|
||||
|
||||
// Make authDir unwritable so deployPubKey's mkdir handler fails.
|
||||
srv.authDir = "/proc/1/forbidden-orca-test"
|
||||
|
||||
_, err := BootstrapProxmox(t.Context(), Options{
|
||||
Host: host,
|
||||
Password: "pw",
|
||||
})
|
||||
if err == nil {
|
||||
t.Fatal("expected error from deployPubKey failure")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "deploy pubkey") {
|
||||
t.Errorf("error should mention deploy pubkey, got: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -1,95 +0,0 @@
|
||||
package security
|
||||
|
||||
import (
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
|
||||
"golang.org/x/crypto/ssh"
|
||||
)
|
||||
|
||||
// SSHKeyMode is the file mode for the SSH private key. Matches the
|
||||
// CA key mode (REQ-033 spirit: 0600 for private keys).
|
||||
const SSHKeyMode os.FileMode = 0o600
|
||||
|
||||
// SSHPubMode is the file mode for the SSH public key (authorized_keys
|
||||
// line). Matches the CA cert mode (0644 for public material).
|
||||
const SSHPubMode os.FileMode = 0o644
|
||||
|
||||
const (
|
||||
sshKeyFile = "orca_ssh_key"
|
||||
sshPubFile = "orca_ssh_key.pub"
|
||||
)
|
||||
|
||||
// GenerateOrLoadSSHKey returns the orca SSH keypair, generating it
|
||||
// lazily on first call (D-037). The key is Ed25519 (smaller, faster,
|
||||
// more secure than RSA for SSH auth), persisted as PKCS8 PEM to
|
||||
// dir/orca_ssh_key (0600) and dir/orca_ssh_key.pub (0644).
|
||||
//
|
||||
// Idempotent: if both files exist with valid content, they are loaded
|
||||
// and returned without regeneration. This matches the CAInit fast-path
|
||||
// pattern (D-036 idempotency).
|
||||
//
|
||||
// Returns:
|
||||
// - keyPEM: PKCS8 PEM private key (parses with ssh.ParsePrivateKey)
|
||||
// - pubLine: authorized_keys line (ssh-ed25519 AAAA... comment\n)
|
||||
func GenerateOrLoadSSHKey(dir string) (keyPEM, pubLine []byte, err error) {
|
||||
if dir == "" {
|
||||
return nil, nil, errors.New("GenerateOrLoadSSHKey: dir is required")
|
||||
}
|
||||
if err := os.MkdirAll(dir, 0o755); err != nil {
|
||||
return nil, nil, fmt.Errorf("GenerateOrLoadSSHKey: mkdir: %w", err)
|
||||
}
|
||||
keyPath := filepath.Join(dir, sshKeyFile)
|
||||
pubPath := filepath.Join(dir, sshPubFile)
|
||||
|
||||
// Fast path: existing key — load and return.
|
||||
if ok, err := bothExist(keyPath, pubPath); err != nil {
|
||||
return nil, nil, err
|
||||
} else if ok {
|
||||
keyPEM, err := os.ReadFile(keyPath)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("read SSH key: %w", err)
|
||||
}
|
||||
pubLine, err := os.ReadFile(pubPath)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("read SSH pub: %w", err)
|
||||
}
|
||||
return keyPEM, pubLine, nil
|
||||
}
|
||||
|
||||
// Generate Ed25519 keypair.
|
||||
pub, priv, err := ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("GenerateOrLoadSSHKey: ed25519 gen: %w", err)
|
||||
}
|
||||
|
||||
// Serialize private key as PKCS8 PEM (consistent with ca.key/server.key).
|
||||
keyDER, err := x509.MarshalPKCS8PrivateKey(priv)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("GenerateOrLoadSSHKey: marshal key: %w", err)
|
||||
}
|
||||
keyPEM = pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER})
|
||||
|
||||
// Serialize public key as authorized_keys line.
|
||||
sshPub, err := ssh.NewPublicKey(pub)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("GenerateOrLoadSSHKey: new pubkey: %w", err)
|
||||
}
|
||||
pubLine = ssh.MarshalAuthorizedKey(sshPub)
|
||||
|
||||
// Persist with correct modes (atomic write + chmod).
|
||||
if err := writeAtomic(keyPath, SSHKeyMode, keyPEM); err != nil {
|
||||
return nil, nil, fmt.Errorf("write SSH key: %w", err)
|
||||
}
|
||||
if err := writeAtomic(pubPath, SSHPubMode, pubLine); err != nil {
|
||||
return nil, nil, fmt.Errorf("write SSH pub: %w", err)
|
||||
}
|
||||
|
||||
return keyPEM, pubLine, nil
|
||||
}
|
||||
@@ -1,93 +0,0 @@
|
||||
package security
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"golang.org/x/crypto/ssh"
|
||||
)
|
||||
|
||||
func TestGenerateOrLoadSSHKey_Generates(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
|
||||
keyPEM, pubLine, err := GenerateOrLoadSSHKey(dir)
|
||||
if err != nil {
|
||||
t.Fatalf("generate: %v", err)
|
||||
}
|
||||
|
||||
// Private key file exists with mode 0600.
|
||||
keyPath := filepath.Join(dir, sshKeyFile)
|
||||
info, err := os.Stat(keyPath)
|
||||
if err != nil {
|
||||
t.Fatalf("stat key: %v", err)
|
||||
}
|
||||
if info.Mode().Perm() != SSHKeyMode {
|
||||
t.Errorf("key mode = %04o, want %04o", info.Mode().Perm(), SSHKeyMode)
|
||||
}
|
||||
|
||||
// Public key file exists with mode 0644.
|
||||
pubPath := filepath.Join(dir, sshPubFile)
|
||||
info, err = os.Stat(pubPath)
|
||||
if err != nil {
|
||||
t.Fatalf("stat pub: %v", err)
|
||||
}
|
||||
if info.Mode().Perm() != SSHPubMode {
|
||||
t.Errorf("pub mode = %04o, want %04o", info.Mode().Perm(), SSHPubMode)
|
||||
}
|
||||
|
||||
// Public key line is ssh-ed25519 format.
|
||||
if !strings.HasPrefix(string(pubLine), "ssh-ed25519 ") {
|
||||
t.Errorf("pub line = %q, want ssh-ed25519 prefix", string(pubLine))
|
||||
}
|
||||
|
||||
// Private key PEM parses with ssh.ParsePrivateKey (PKCS8).
|
||||
signer, err := ssh.ParsePrivateKey(keyPEM)
|
||||
if err != nil {
|
||||
t.Fatalf("parse private key: %v", err)
|
||||
}
|
||||
if signer.PublicKey().Type() != "ssh-ed25519" {
|
||||
t.Errorf("signer key type = %q, want ssh-ed25519", signer.PublicKey().Type())
|
||||
}
|
||||
}
|
||||
|
||||
func TestGenerateOrLoadSSHKey_IdempotentLoad(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
|
||||
// First call generates.
|
||||
keyPEM1, pubLine1, err := GenerateOrLoadSSHKey(dir)
|
||||
if err != nil {
|
||||
t.Fatalf("first generate: %v", err)
|
||||
}
|
||||
|
||||
// Second call loads existing.
|
||||
keyPEM2, pubLine2, err := GenerateOrLoadSSHKey(dir)
|
||||
if err != nil {
|
||||
t.Fatalf("second load: %v", err)
|
||||
}
|
||||
|
||||
if string(keyPEM1) != string(keyPEM2) {
|
||||
t.Error("key was regenerated on second call (D-036 idempotency violation)")
|
||||
}
|
||||
if string(pubLine1) != string(pubLine2) {
|
||||
t.Error("pub was regenerated on second call (D-036 idempotency violation)")
|
||||
}
|
||||
}
|
||||
|
||||
func TestGenerateOrLoadSSHKey_EmptyDir(t *testing.T) {
|
||||
_, _, err := GenerateOrLoadSSHKey("")
|
||||
if err == nil {
|
||||
t.Error("expected error for empty dir")
|
||||
}
|
||||
}
|
||||
|
||||
func TestGenerateOrLoadSSHKey_CreatesDir(t *testing.T) {
|
||||
dir := filepath.Join(t.TempDir(), "nested", "ssh-dir")
|
||||
if _, _, err := GenerateOrLoadSSHKey(dir); err != nil {
|
||||
t.Fatalf("generate with nested dir: %v", err)
|
||||
}
|
||||
if _, err := os.Stat(dir); err != nil {
|
||||
t.Errorf("nested dir not created: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -65,87 +65,3 @@ func TestAuditRepo_WithError(t *testing.T) {
|
||||
t.Errorf("expected error 'exit status 1', got %q", entries[0].Error)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuditRepo_MetadataRoundTrip(t *testing.T) {
|
||||
repo, cleanup := openAuditTestDB(t)
|
||||
defer cleanup()
|
||||
|
||||
ctx := context.Background()
|
||||
want := map[string]any{"node": "node-1", "exit_code": float64(2)}
|
||||
if err := repo.Append(ctx, &AuditEntry{
|
||||
Actor: "cli",
|
||||
Action: "node.join",
|
||||
Resource: "node-1",
|
||||
Result: "success",
|
||||
Metadata: want,
|
||||
}); err != nil {
|
||||
t.Fatalf("append: %v", err)
|
||||
}
|
||||
entries, err := repo.List(ctx, 10)
|
||||
if err != nil {
|
||||
t.Fatalf("List: %v", err)
|
||||
}
|
||||
if len(entries) != 1 {
|
||||
t.Fatalf("expected 1 entry, got %d", len(entries))
|
||||
}
|
||||
if entries[0].Metadata == nil {
|
||||
t.Fatalf("metadata not round-tripped")
|
||||
}
|
||||
if entries[0].Metadata["node"] != "node-1" {
|
||||
t.Errorf("metadata[node] = %v, want node-1", entries[0].Metadata["node"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuditRepo_DefaultActorAndTimestamp(t *testing.T) {
|
||||
repo, cleanup := openAuditTestDB(t)
|
||||
defer cleanup()
|
||||
|
||||
ctx := context.Background()
|
||||
// Append with empty Actor and zero Timestamp — defaults should apply.
|
||||
if err := repo.Append(ctx, &AuditEntry{
|
||||
Action: "x",
|
||||
Resource: "y",
|
||||
Result: "success",
|
||||
}); err != nil {
|
||||
t.Fatalf("append: %v", err)
|
||||
}
|
||||
entries, _ := repo.List(ctx, 1)
|
||||
if len(entries) != 1 {
|
||||
t.Fatalf("expected 1 entry, got %d", len(entries))
|
||||
}
|
||||
if entries[0].Actor != "system" {
|
||||
t.Errorf("default actor = %q, want system", entries[0].Actor)
|
||||
}
|
||||
if entries[0].Timestamp.IsZero() {
|
||||
t.Errorf("default timestamp not set")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuditRepo_ListDefaultLimit(t *testing.T) {
|
||||
repo, cleanup := openAuditTestDB(t)
|
||||
defer cleanup()
|
||||
|
||||
ctx := context.Background()
|
||||
for i := 0; i < 5; i++ {
|
||||
if err := repo.Append(ctx, &AuditEntry{
|
||||
Action: "x", Resource: "y", Result: "success",
|
||||
}); err != nil {
|
||||
t.Fatalf("append[%d]: %v", i, err)
|
||||
}
|
||||
}
|
||||
// limit<=0 should default to 100.
|
||||
entries, err := repo.List(ctx, 0)
|
||||
if err != nil {
|
||||
t.Fatalf("List(0): %v", err)
|
||||
}
|
||||
if len(entries) != 5 {
|
||||
t.Errorf("List(0): got %d, want 5", len(entries))
|
||||
}
|
||||
entries, err = repo.List(ctx, -1)
|
||||
if err != nil {
|
||||
t.Fatalf("List(-1): %v", err)
|
||||
}
|
||||
if len(entries) != 5 {
|
||||
t.Errorf("List(-1): got %d, want 5", len(entries))
|
||||
}
|
||||
}
|
||||
|
||||
@@ -40,9 +40,6 @@ func TestCapacityRepoUpsertGetList(t *testing.T) {
|
||||
if got.CPUMillicores != 4000 || got.MemoryMiB != 4096 || got.DiskMiB != 4096 {
|
||||
t.Errorf("Get: got %+v, want cpu=4000 mem=4096 disk=4096", got)
|
||||
}
|
||||
if got.UpdatedAt.IsZero() {
|
||||
t.Errorf("Upsert did not fill UpdatedAt")
|
||||
}
|
||||
|
||||
// Update (overwrite).
|
||||
c2 := &NodeCapacity{NodeID: "self", CPUMillicores: 8000, MemoryMiB: 8192, DiskMiB: 8192}
|
||||
@@ -75,66 +72,3 @@ func TestCapacityRepoUpsertGetList(t *testing.T) {
|
||||
t.Error("expected ErrNotFound on Delete of missing row")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCapacityRepo_UpsertNilAndEmptyNodeID(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
db, err := Open(filepath.Join(dir, "test.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("Open: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo := NewCapacityRepo(db)
|
||||
ctx := context.Background()
|
||||
|
||||
if err := repo.Upsert(ctx, nil); err == nil {
|
||||
t.Error("Upsert(nil) should error")
|
||||
}
|
||||
if err := repo.Upsert(ctx, &NodeCapacity{NodeID: ""}); err == nil {
|
||||
t.Error("Upsert(empty NodeID) should error")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCapacityRepo_GetEmptyNodeID(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
db, err := Open(filepath.Join(dir, "test.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("Open: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo := NewCapacityRepo(db)
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := repo.Get(ctx, ""); err == nil {
|
||||
t.Error("Get(empty) should error")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCapacityRepo_DeleteMissing(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
db, err := Open(filepath.Join(dir, "test.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("Open: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
repo := NewCapacityRepo(db)
|
||||
ctx := context.Background()
|
||||
|
||||
if err := repo.Delete(ctx, "ghost"); err != ErrNotFound {
|
||||
t.Errorf("Delete(ghost) = %v, want ErrNotFound", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStore_OpenEmptyPath(t *testing.T) {
|
||||
// Open with "" should fall back to certpaths.DBPath() which honors
|
||||
// ORCA_HOME. Set a temp ORCA_HOME so we don't pollute the real home.
|
||||
home := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", home)
|
||||
db, err := Open("")
|
||||
if err != nil {
|
||||
t.Fatalf("Open(\"\"): %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
if err := db.Ping(); err != nil {
|
||||
t.Errorf("Ping: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user