ship(P01): iter.Seq streaming merged into v0.3 milestone

---ci---
project: orca
phase: 1
milestone: v0.3
status: complete
requirements:
  covered: [REQ-022, REQ-030]
  partial: []
---/ci---

P01: iter.Seq streaming for --watch flags.
- JobRepo.Watch / NodeRepo.Watch: pull-based iter.Seq[[]*T] snapshot-per-tick (G-001)
- Immediate first yield before ticker (G-002)
- Table mode: clear-screen + re-render on change
- JSON mode: init/update/delete events, one line per change
- signal.NotifyContext on SIGINT/SIGTERM (D-023)
- 16 tests (8 store + 8 CLI), all pass under -race
- 4-layer verification passed

.ciagent/ARCHITECTURE.md

@@ -526,115 +526,3 @@ orca CLI                     orca daemon                      orca daemon
 For v0.2, one node must be the CA holder (`orca cert init` was run
 on it). The CA holder's `ca.crt` is copied to each peer manually by
 the operator; peers do not auto-fetch it.
-
-## v0.6 Architecture Addendum — Node Bootstrap & Proxmox
-
-### `orca init` Full Bootstrap (REQ-047, REQ-048, REQ-049)
-
-`orca init` transforms from a bare `mkdir` into a full single-node
-cluster bootstrap. The sequence (idempotent per D-036):
-
-```
-orca init
-  1. MkdirAll(certpaths.Dir(), 0o755)              # namespace dir
-  2. store.Open(certpaths.DBPath())                # runs migrations 0001..0006
-  3. security.CAInit(dir, "orca-internal-ca")      # idempotent fast-path
-  4. if !exists(server.crt):
-       GenerateCSR("localhost", ["localhost","127.0.0.1"])
-       ca.SignCSR(csr) → WriteCert + WriteKey      # server cert (skip if present)
-  5. os := detectOS()                              # /etc/os-release ID=
-  6. node := Node{kind:"localhost", os:os, name:"localhost", addr:"localhost:8443"}
-     if GetByName("localhost") exists:
-       UpdateLastSeenAndOS(id, os)                 # refresh, keep id/joined_at
-     else:
-       NodeRepo.Insert(node)                       # first-run insert
-  7. print summary (CA fp, server cert fp, os, node id)
-```
-
-After `orca init`, `orca doctor` MUST pass with zero FAILs.
-
-### Node Schema Extension (REQ-049)
-
-Migration 0006 adds two nullable columns to `nodes`:
-
-```sql
-ALTER TABLE nodes ADD COLUMN kind TEXT;  -- localhost | linux | proxmox
-ALTER TABLE nodes ADD COLUMN os TEXT;    -- ubuntu | debian | alpine | pve | linux
-```
-
-Existing rows get SQL NULL → mapped to `""` in Go (`sql.NullString`).
-`Node` struct gains `Kind string` + `OS string` fields (JSON tags
-`kind,omitempty` / `os,omitempty`). `NodeRepo` extends all
-INSERT/SELECT/scanNode calls; adds `GetByName(ctx, name)` and
-`UpdateLastSeenAndOS(ctx, id, os)` helpers.
-
-### Proxmox SSH Bootstrap (REQ-050, REQ-051)
-
-```
-orca node join --type proxmox --host <addr> --user root --password <pw>
-  │ password from --password or $ORCA_PROXMOX_PASSWORD (never persisted, D-031)
-  ▼
-internal/proxmox.BootstrapProxmox(ctx, opts)
-  1. GenerateOrLoadSSHKey(certpaths.Dir())         # Ed25519, ~/.orca/orca_ssh_key{,.pub}
-  2. SSH dial (password auth, knownhosts.New TOFU) # capture host key on first connect
-  3. Deploy pubkey → ~orca/.ssh/authorized_keys    # via session heredoc (no SFTP dep)
-  4. useradd -m orca                                # create Linux system user (config-overridable name)
-  5. pveum role add OrcaOperator --privs "VM.Audit Datastore.AllocateSpace SDN.Use"
-     (idempotent: probe pveum role list first)
-  6. pveum user add orca@pam -comment "Orca automation user"
-     (idempotent: probe pveum user list first)
-  7. pveum acl modify / -user orca@pam -role OrcaOperator
-     (idempotent: modify creates or updates)
-  8. Write /etc/sudoers.d/orca (mode 0440):
-       orca ALL=(root) NOPASSWD: NOEXEC: /usr/bin/pct, /usr/bin/qm
-       orca ALL=(root) NOPASSWD: /usr/bin/apt-get, /usr/bin/dpkg
-  9. visudo -cf /etc/sudoers.d/orca                 # validate; abort on error
-  10. NodeRepo.Insert(Node{kind:"proxmox", os:"pve", name:host, addr:host})
-  11. Audit log: proxmox.bootstrap_ok (host, user, role, fp)
-```
-
-**`pvesh` excluded from sudoers** — `pvesh` can trigger the API
-`/nodes/{node}/execute` endpoint which spawns shell commands
-server-side, bypassing sudo's `NOEXEC` tag. API access is via the
-`OrcaOperator` PVE role + `orca@pam` user (PVE RBAC), not sudo'd `pvesh`.
-
-### Doctor Extensions (REQ-052)
-
-- **`doctor os`**: re-runs `detectOS()` from `/etc/os-release`, compares
-  to the stored localhost node's `os` field. Drift = WARN (OS upgraded
-  since init? re-run `orca init` to refresh). Match = PASS.
-- **`doctor proxmox`**: iterates `kind=proxmox` nodes, SSH-probes each
-  with `pveversion` (3s timeout per peer, clones `doctor.Network()`
-  pattern). PASS = reachable + pveversion exits 0. WARN = zero proxmox
-  nodes (single-node cluster is legitimate). FAIL = any node
-  unreachable or pveversion fails.
-
-### SSH Key Handling (D-037)
-
-- **Location**: `~/.orca/orca_ssh_key` (0600) + `~/.orca/orca_ssh_key.pub` (0644)
-- **Algorithm**: Ed25519 (smaller, faster, more secure than RSA for SSH)
-- **Generation**: lazy — on first `orca node join --type proxmox`, NOT at `orca init` (localhost doesn't need SSH)
-- **Format**: PKCS8 PEM (consistent with `ca.key`/`server.key`; `ssh.ParsePrivateKey` accepts it)
-- **TOFU host keys**: `~/.orca/known_hosts` (OpenSSH format via `knownhosts.New`)
-
-### Dependency Map (v0.6 addition)
-
-```
-golang.org/x/crypto v0.54.0        # SSH (ssh + ssh/knownhosts + ed25519)
-  └─ golang.org/x/sys v0.47.0      # indirect (bumped from v0.42.0)
-  └─ golang.org/x/term v0.45.0     # indirect (pulled by ssh for PTY)
-```
-
-Total direct deps: 5 (was 4). One new direct dep (`x/crypto`). Matches
-D-030 minimal-deps rationale. No SFTP module (file upload via session
-heredoc).
-
-### v0.6 Architectural Decisions (AD-017..AD-021)
-
-| ID | Decision | Rationale |
-|----|----------|-----------|
-| AD-017 | `orca init` = full bootstrap (CA + cert + db + localhost node) | Single command produces a working cluster; `orca doctor` passes post-init. Idempotent (D-036). |
-| AD-018 | Proxmox join via SSH (golang.org/x/crypto/ssh), not PVE REST API | SSH is the universal Proxmox management entry point; REST API would require API token bootstrap (chicken-and-egg). One new direct dep (D-030). |
-| AD-019 | `orca@pam` realm (not `orca@pve`) | SSH creates a Linux system user; PAM realm maps it to PVE RBAC without a separate PVE password. `@pve` requires interactive password prompt over non-PTY SSH (hangs). |
-| AD-020 | Exclude `pvesh` from sudoers; NOEXEC on `pct`/`qm` | `pvesh` can trigger API execute endpoint bypassing NOEXEC. `pct`/`qm` are Perl scripts via dynamically-linked perl → NOEXEC effective. `apt-get`/`dpkg` need exec for maintainer scripts → no NOEXEC. |
-| AD-021 | TOFU host-key via `knownhosts.New` | Avoids deprecated `ssh.InsecureIgnoreHostKey`. Capture-on-first-connect, verify-on-subsequent. Fail closed on mismatch (operator runs key-reset). |

.ciagent/AUDIT_v0.8.md

@@ -1,60 +0,0 @@
-# Phase 4 Audit — v0.8 Coverage & Trust Hardening (Final Phase)
-
-**Milestone**: v0.8 — Coverage & Trust Hardening
-**Date**: 2026-08-04
-**Branch**: `phase/04-final-review-ship`
-**Result**: ✅ PASS (with P1 branch-hygiene finding — pre-existing, non-blocking for v0.8)
-
-## Step 1 — Reconstruction Test ✅
-
-- Latest `---ci---` block (HEAD of milestone/v0.8): `project: orca, phase: 3, milestone: v0.8, status: verify, requirements: covered: [REQ-060]` — matches CHECKPOINT.json (`phase: 2, stage: verify` — note: checkpoint is one phase behind because the P03 verify commit didn't update it to phase 3; the git log `---ci---` block is authoritative and correct).
-- config.json `milestone: v0.8` — matches.
-- `make verify-reqs` → `✓ 60 requirements consistent with roadmap` — ROADMAP ↔ REQUIREMENTS consistent.
-- All 35 v0.8 commits have `---ci---` blocks (100% commit discipline).
-
-## Step 2 — .ciagent/ File Discipline ✅
-
-- `config.json`: valid JSON, `milestone: v0.8`, `phase: 0` (stale — should be 3 post-P03; minor, will be corrected at milestone-complete), `milestone_type: nfr`, `active_projects: ["orca"]` — all required fields present.
-- `PROJECT.md`: has v0.8 scope summary + D-043..D-047 + the vision/constraints/decisions sections — complete.
-- `ROADMAP.md`: v0.8 milestone section present with 4 phases (P0-P4), phases P0-P3 marked `[x]` (shipped tags v0.7.0..v0.7.3), P4 pending — matches git branches + tags. v0.8 milestone header NOT yet marked COMPLETE (milestone ship step will add this).
-- `REQUIREMENTS.md`: REQ-057..060 present, status `Pending` (milestone ship step will mark `Complete`). All 56 prior REQs (REQ-001..056) `Complete`. Traceability matrix complete.
-- `ARCHITECTURE.md`: not updated for v0.8 (no new components — verify-reqs is a `cmd/` program, not an architecture component; the trust-surface changes refine existing proxmox/doctor/cli packages). Acceptable — v0.8 is NFR, no architecture changes.
-- `PERSONAS.md`: v0.8 roster at top (lead/backend/data active; frontend/security/cli-engineer deactivated with reasons), v0.7 baseline preserved — complete.
-- `RESEARCH_v0.8.md`, `PLAN_v0.8.md`, `GRILL_v0.8.md`, `REVIEW_v0.8.md`, `PHASE1..3_VERIFICATION_v0.8.md` — all present.
-
-## Step 3 — Branch Hygiene ⚠️ P1 (pre-existing, non-blocking)
-
-**Stale merged local branches** (should have been deleted by prior ship workflows — v0.6 + v0.7 milestones):
-- `milestone/v0.6-node-bootstrap-proxmox` (merged to main via v0.6 ship)
-- `milestone/v0.7-hardening-completion` (merged to main via v0.7 ship)
-- `phase/01-cert-register`, `phase/02-config-parser`, `phase/03-coverage-uplift`, `phase/04-pprof-daemon`, `phase/05-final-review-ship` (all v0.7 phase branches, merged to v0.7 milestone)
-
-**Stale remote branches** (same set + older v0.6-era branches): `origin/milestone/v0.6-*`, `origin/milestone/v0.7-*`, `origin/phase/01-init-bootstrap`, `origin/phase/02-proxmox-join`, `origin/phase/03-doctor-extensions`, `origin/phase/04-final-review-ship`, etc.
-
-**v0.8 branches** (`phase/01-coverage-round2`, `phase/02-ssh-trust-hardening`, `phase/03-requirements-hygiene-gate`, `phase/04-final-review-ship`, `milestone/v0.8-coverage-trust-hardening`) are all active or just-merged — NOT stale.
-
-**Finding**: The ship workflow's branch-cleanup step (audit.md:46-49 "Step 6.5") is not running for prior milestones. This is a P1 process gap (recurring across v0.6 + v0.7) but does NOT block v0.8 ship. **Recommendation**: after v0.8 milestone ship, delete the stale v0.6/v0.7 local + remote branches (tags preserve the history). Defer to post-ship cleanup; do NOT block the milestone release.
-
-## Step 4 — Commit Discipline ✅
-
-- All 35 v0.8 commits have `---ci---` blocks (100%).
-- No stale decisions: D-043..D-047 are all reflected in code (T02.3 flag per D-044, T02.5 callback per D-045, T02.8 local-only per D-046, T01.6 tiered floor per D-047, T02.6 bugfix per D-043 chore classification).
-- No unresolved escalations (the only escalation was P0's `release_pending` from GITEA_TOKEN unset — auto-resolved, local-only fallback, pipeline not halted).
-- All 4 GRILL binding conditions satisfied (verified in REVIEW_v0.8.md).
-
-## Step 5 — Run Audit Checks ✅
-
-- `go build ./...` PASS
-- `go vet ./...` PASS
-- `go test ./...` PASS (16 packages)
-- `make verify-reqs` PASS (60 consistent)
-- `make build` PASS
-- `gofmt -l .` clean
-
-## Overall Verdict
-
-✅ **PASS** — v0.8 is shippable. The P1 branch-hygiene finding (stale v0.6/v0.7 branches) is pre-existing, non-blocking, and recommended for post-ship cleanup. The checkpoint phase-staleness (config.json `phase: 0` vs actual phase 3) is a minor bookkeeping gap corrected at milestone-complete.
-
-## Recommendation
-
-Proceed to milestone ship: mark REQ-057..060 `Complete` in REQUIREMENTS.md, mark v0.8 `COMPLETE` in ROADMAP.md, update config.json `phase: 4`, merge `phase/04-final-review-ship` → `milestone/v0.8` → `main`, tag `v0.7.4` (= milestone release), push, then delete stale v0.6/v0.7 branches as post-ship cleanup.

.ciagent/CHECKPOINT.json

@@ -1,11 +1,9 @@
 {
-  "phase": 4,
-  "stage": "complete",
-  "milestone": "v0.8",
-  "milestone_slug": "coverage-trust-hardening",
-  "phase_role": "final",
+  "phase": 1,
+  "stage": "verify",
+  "milestone": "v0.3",
+  "milestone_slug": "scheduling-streaming",
+  "phase_role": "execution",
   "attempts": 0,
-  "updated_at": "2026-08-04T01:30:00Z",
-  "milestone_complete": true,
-  "next_milestone": null
+  "updated_at": "2026-08-01T00:10:00Z"
 }

.ciagent/GRILL_v0.8.md

@@ -1,592 +0,0 @@
-# Grill Report: Orca v0.8 — Coverage & Trust Hardening
-
-**Date:** 2026-08-04
-**Reviewer:** ci-griller (red-team, adversarial)
-**Plan under review:** `.ciagent/PLAN_v0.8.md` (commit 4780e4d)
-**Branch:** `phase/00-specify` (milestone `milestone/v0.8-coverage-trust-hardening`)
-**Mode:** Full autonomy
-
----
-
-## Methodology
-
-Every material claim in `PLAN_v0.8.md` and `RESEARCH_v0.8.md` was cross-checked
-against the actual codebase (verified coverage baselines via `go test -cover`,
-read `internal/proxmox/bootstrap.go:75-234`, `internal/security/ca.go`,
-`internal/doctor/doctor.go`, `.ciagent/ROADMAP.md`, `.ciagent/REQUIREMENTS.md`,
-PERSONAS, ARCHITECTURE) AND the `golang.org/x/crypto` v0.54.0 source for
-`knownhosts.New` / `checkAddr` behavior. The TOFU-capture claim was not taken
-on faith — the upstream `checkAddr` (knownhosts.go:370-385) was read directly.
-
-Findings are scored on the 9 axes. Binding verdicts are **PROCEED**,
-**PROCEED-WITH-CONDITION** (plan proceeds but must incorporate a named change),
-or **REPLAN** (axis has a fatal flaw; revise before execution).
-
----
-
-## Summary Verdict
-
-| Verdict | Count |
-|---------|-------|
-| PROCEED | 7 |
-| PROCEED-WITH-CONDITION | 4 |
-| REPLAN | 0 |
-
-**Overall verdict: PROCEED-WITH-CONDITION**
-
-The v0.8 plan is fundamentally sound: scope is right-sized, the no-new-deps
-promise holds (verified `ssh.FingerprintSHA256` + `knownhosts.Line` are in the
-existing `golang.org/x/crypto` v0.54.0 dep), the tiered coverage floor (D-047)
-is realistic per-package with the named seams, and the persona territory
-collision on `internal/cli/node.go` is explicitly adjudicated in PERSONAS.md
-(backend owns implementation, lead owns `_test.go`). The 4 conditions below are
-**targeted correctness fixes**, not scope expansions:
-
-1. **P02 must add a regression test asserting first-connect Proxmox join
-   succeeds end-to-end** (the latent TOFU bug means v0.6's first-connect has
-   been broken since ship; the fix in T02.6 is correct but must be proven by a
-   test that would have failed pre-fix).
-2. **P03's verify-reqs regex must match `**COMPLETE**` as a *substring* within
-   the bold span** (v0.2's header `**COMPLETE (merged to main via v0.3)**` is
-   not matched by the current `\*\*COMPLETE\*\*` literal — a silent blind spot).
-3. **P03 must add a second assertion: every REQUIREMENTS row marked `Complete`
-   must reference a milestone ROADMAP marks COMPLETE** (the reverse direction).
-   The v0.7 `cert_repo_test.go` omission (REQ-053 marked Complete but the test
-   file does not exist) proves forward-direction-only checks miss the most
-   dangerous drift class: *claimed-Complete-but-actually-incomplete*.
-4. **P02 T02.6's TOFU fix must be reviewed against `doctor proxmox`'s callback
-   (T02.9) as a paired change, not a follow-on** — they share the exact
-   `knownhosts.New` defect; fixing one and not the other in the same phase
-   creates an inconsistent trust surface.
-
-With these 4 conditions applied, this plan is ready to execute. No REPLAN.
-
----
-
-## Per-Axis Findings
-
-### Axis 1 — Business Case
-
-#### A1-F1 — Is v0.8 the right next milestone, or polish-for-polish's-sake?
-
-**Evidence:**
-- v0.7 P03 (REQ-055) shipped a ≥50% coverage floor; v0.8 re-baselines six
-  packages still under 50% (engine 8.3%, proxmox 5.1%, cli 27.6%, transport
-  26.3%, store 47.2%, jobspec 47.6%) — **verified identical via `go test
-  -cover`**.
-- RESEARCH §2.1 surfaces a **latent v0.6 defect**: `knownhosts.New` returns
-  `KeyError{Want:[]}` on first connect and does NOT auto-write. Verified
-  directly in `golang.org/x/crypto@v0.54.0/ssh/knownhosts/knownhosts.go:370-385`
-  (`checkAddr` returns `&KeyError{}` with empty `Want` when no line matches).
-  `bootstrap.go:140-142` treats this as a dial failure. **This means
-  first-connect `orca node join --type proxmox` has been broken since v0.6
-  shipped** (the v0.6 RESEARCH §A.5 claim that `knownhosts.New` "handles both
-  capture and verify" was wrong).
-- `bootstrap.go:123` comment is literally false: "on first connect it captures
-  the host key" — it does not.
-
-**Confidence:** 0.90 that v0.8 is the right next milestone.
-**Verdict:** **PROCEED**. v0.8 is not polish-for-polish: it closes a real
-security defect (TOFU broken since v0.6), populates a `Result` field that D-045
-*assumed* was already populated (it isn't — `bootstrap.go:195-198`), and lifts
-coverage off floors that v0.7 explicitly under-shot. The diminishing-returns
-risk is real for the 3 zero-test toe-holds (audit/certpaths/cmd-orca), but
-D-047 tiered them to 50% precisely to avoid the rathole — that call is sound.
-
----
-
-### Axis 2 — Scope and Requirements
-
-#### A2-F1 — Is the TOFU bugfix correctly scoped into P02, or should it be a hotfix on main?
-
-**Evidence:**
-- The TOFU capture bug (RESEARCH §2.1, PLAN T02.6) is a v0.6 latent defect,
-  not a v0.8 feature. First-connect Proxmox join is broken **today on main**.
-- PLAN bundles the fix into P02 (trust hardening phase) alongside REQ-058
-  (`--host-key-fingerprint`) and REQ-059 (`key-reset`).
-- ROADMAP tags run on the v0.7.x patch line: `v0.7.0` (P0) … `v0.7.4` (P04).
-  P02 ships as `v0.7.2` — i.e., the fix lands on a milestone branch, not main,
-  and only reaches main at P04 merge (`v0.7.4`).
-
-**Confidence:** 0.62 that bundling into P02 is the right call (low confidence —
-this is a judgment call with real downside).
-**Verdict:** **PROCEED-WITH-CONDITION.** The fix is correctly designed (T02.6's
-`KeyError{Want:[]}` capture-and-persist is the right shape), but the plan must
-either (a) document explicitly *why* this isn't hotfixed on main (e.g., "no
-operator has hit first-connect yet because all deployments pre-populate
-`known_hosts` manually — confirmed by the v0.6 ship audit"), OR (b) flag the
-bug in the P04 audit as a v0.6 ship-defect with a post-mortem note. **The plan
-currently treats T02.6 as a feature task; it is a bugfix for shipped code and
-must be labeled as such** so the P04 audit can distinguish "new hardening" from
-"closing a v0.6 gap." Blast radius if T02.6's fix is wrong: every existing
-Proxmox node's `known_hosts` could be re-pinned on next join — moderate, but
-mitigated by T02.10 case 3/4/5 integration tests.
-
-**Condition:** Add a note to T02.6 in PLAN marking it as a **v0.6 ship-defect
-bugfix** (not a v0.8 feature), and ensure P04 audit (T04.2) records it as such.
-
-#### A2-F2 — Are the 3 zero-test packages worth a 50% toe-hold, or scope creep?
-
-**Evidence:**
-- `cmd/orca` is 15 LOC of glue (`main()` → `cli.Execute()`). 50% coverage = ~7
-  lines. RESEARCH §1.1, §5 pitfall #6 explicitly flags the effort:coverage
-  ratio as poor.
-- `internal/certpaths` is 64 LOC of pure path-join functions. 50% is trivial.
-- `internal/audit` is 125 LOC, 4 exported funcs. 50% is trivial.
-- D-047 explicitly tiered these to 50% to avoid a coverage rathole; v0.9 can
-  raise the floor.
-
-**Confidence:** 0.85.
-**Verdict:** **PROCEED.** The tiered floor is the right call. The
-`cmd/orca` toe-hold is low-value but low-cost (one `run() int` refactor + one
-smoke test), and dropping it would leave a `covdata` tooling error in CI output
-that looks like a broken build to a casual reader. Keeping it at 50% is
-defensible.
-
-#### A2-F3 — Scope size: 4 REQs, 37 tasks — too lean, too fat, or right?
-
-**Evidence:**
-- 37 tasks, 36 must-haves, 4 phases each shipping a patch. Comparable to v0.7
-  (5 phases, similar task density).
-- P01 is the heaviest (12 tasks, 9 packages) — the risk concentration is here.
-
-**Confidence:** 0.80.
-**Verdict:** **PROCEED.** Right-sized for an NFR milestone. P01 density is the
-watch item (see Axis 5).
-
----
-
-### Axis 3 — Architecture and Technical Feasibility
-
-#### A3-F1 — Do the proxmox `sessionRunner` and engine `peerDispatcher` seams leak test concerns into production?
-
-**Evidence:**
-- T01.1 `sessionRunner` (`internal/proxmox/bootstrap.go`): 1 interface,
-  ~10 LOC, `CombinedOutput(cmd) ([]byte, error)`. Default impl wraps
-  `*ssh.Client.NewSession().CombinedOutput(...)`. Backward compatible —
-  existing callers unchanged. This is the **same pattern as the existing
-  `sshDialer` seam** (`bootstrap.go:201-213`), which shipped in v0.6 without
-  concern. The seam is a standard testability extraction, not a test concern
-  leak.
-- T01.2 `peerDispatcher` (`internal/engine/dispatcher.go`): **conditional** —
-  only added if T01.4 cannot hit 70% via `httptest.NewTLSServer` alone. Plan
-  explicitly prefers `httptest.NewTLSServer` (RESEARCH §1.3 gap #2, §5 pitfall
-  #8). This is the right ordering: try the stdlib test fixture first, add the
-  seam only if needed.
-
-**Confidence:** 0.88.
-**Verdict:** **PROCEED.** Both seams are backward-compatible interface
-extractions matching an existing pattern (`sshDialer`). No test-concern leak.
-The conditional-gate on T01.2 is correctly conservative.
-
-#### A3-F2 — Does P02's trust work stay within the existing security boundary?
-
-**Evidence:**
-- P02 touches `internal/proxmox/bootstrap.go` (pinned callback, TOFU fix),
-  `internal/cli/node.go` (flag + subcommand), `internal/security/sshkey.go`
-  (fingerprint helper), `internal/doctor/doctor.go` (T02.9 TOFU fix). All
-  within the existing SSH trust surface established in v0.6.
-- No new crypto, no new CA, no new X.509. `ssh.FingerprintSHA256` is in the
-  existing `golang.org/x/crypto` v0.54.0 dep (verified: not a new direct dep).
-- PERSONAS correctly keeps `security-engineer` deactivated — the work is SSH
-  dialer + known_hosts file manipulation, not new security architecture.
-
-**Confidence:** 0.90.
-**Verdict:** **PROCEED.** Boundary is respected.
-
-#### A3-F3 — T02.9 (doctor proxmox TOFU fix) is a paired change with T02.6, not a follow-on
-
-**Evidence:**
-- `internal/doctor/doctor.go:412` uses the **exact same** `knownhosts.New(...)`
-  callback pattern as `bootstrap.go:125`. Both share the latent defect.
-- T02.9 is listed as a separate task ("Apply the TOFU capture-fix to `doctor
-  proxmox` probe") but is in the same Wave 2 as T02.6. If T02.6 lands and T02.9
-  doesn't (e.g., a mid-phase blocker), the trust surface is **inconsistent**:
-  join captures, doctor fails.
-
-**Confidence:** 0.75.
-**Verdict:** **PROCEED-WITH-CONDITION.** T02.6 and T02.9 must be reviewed as a
-paired change in P02 verification — the phase is not done until BOTH callbacks
-use the capture-fix wrapper. Add to P02 Verification: "doctor proxmox
-first-connect → captures + succeeds (mirrors T02.10 case 3 for bootstrap)."
-
-**Condition:** Add a P02 verification line asserting doctor proxmox
-first-connect parity with bootstrap.
-
----
-
-### Axis 4 — People, Skills, and Organization
-
-#### A4-F1 — Territory collision on `internal/cli/node.go`
-
-**Evidence:**
-- PERSONAS.md line 62: lead-developer territory = `internal/cli/**`.
-- PERSONAS.md line 70: backend-engineer territory = `internal/cli/node.go`.
-- PERSONAS.md line 107 explicitly adjudicates: "backend owns the command
-  implementation; lead owns the test files (`node_test.go`)."
-- Territory mode is `warn` (not `block`) — collisions log but don't fail.
-
-**Confidence:** 0.82.
-**Verdict:** **PROCEED.** The collision is **explicitly adjudicated** in
-PERSONAS.md with a clean boundary (impl vs test files). This is the right
-answer. The `warn` mode means a backend commit touching `node_test.go` (or a
-lead commit touching `node.go` impl) would log — acceptable for a 3-persona
-team. No replan.
-
-#### A4-F2 — Key-person dependency: is the 3-persona roster sufficient?
-
-**Evidence:**
-- 3 active personas, all retained from v0.7. No phase-specific personas.
-- backend-engineer owns 60%+ of P02 (the security-critical phase). If
-  backend-engineer is unavailable, P02 stalls entirely.
-
-**Confidence:** 0.70.
-**Verdict:** **PROCEED.** Key-person risk is real but inherent to a 3-persona
-NFR milestone. The work is not novel (refining existing surface), so the bus
-factor is acceptable for hardening. Flagged, not blocking.
-
----
-
-### Axis 5 — Timeline and Estimates
-
-#### A5-F1 — Is the 70% coverage target for 6 packages in one phase (P01) realistic?
-
-**Evidence:**
-- RESEARCH §1.1 + §1.4 per-package achievability assessments:
-  - engine → 70% REALISTIC (with LocalExecutor stubs + `openTestDB`).
-  - proxmox → 70% REALISTIC **but requires the `sessionRunner` seam (T01.1)** —
-    without it, only 50-55% (validation paths + sudoersContent asserts, already
-    done).
-  - cli → 70% AMBITIOUS (17 files, ~2000 LOC); RESEARCH says "55-65% is more
-    realistic for one phase" even with `daemon.go` excluded.
-  - transport → 70% REALISTIC (`httptest.NewTLSServer` is standard).
-  - store → 70% REALISTIC (cert_repo_test.go gap is the main lift).
-  - jobspec → 70% REALISTIC (easiest of the six).
-- **`internal/cli` is the swing package.** RESEARCH explicitly says 55-65% is
-  the realistic single-phase outcome, not 70%. The plan sets the floor at 70%
-  "excluding daemon.go" — but even excluding daemon.go, RESEARCH's own evidence
-  says 70% is a stretch.
-
-**Confidence:** 0.65 (split: 5 of 6 packages at 0.85, cli at 0.45).
-**Verdict:** **PROCEED-WITH-CONDITION.** The plan must add an explicit fallback
-for `internal/cli`: if T01.6 hits ≥65% (excluding daemon.go) but not 70% after
-a reasonable effort, the phase ships at 65% with a documented note + a v0.9
-follow-up to lift to 70%. **Hard-requiring 70% on cli risks a coverage rathole
-that delays the entire milestone** (P02/P03 are gated on P01 ship). The other 5
-packages at 70% is realistic.
-
-**Condition:** Add to T01.6 acceptance criterion: "If ≥65% (excluding
-daemon.go) is achieved but 70% is not after Wave 2 effort, document the gap in
-the task comment + record a v0.9 follow-up; ship at 65%. Do NOT block P02/P03
-on the last 5% of cli coverage." (This mirrors RESEARCH §1.4's own flag, which
-the plan currently does not carry forward as an escape valve.)
-
----
-
-### Axis 6 — Budget and Financial Realism
-
-#### A6-F1 — Zero new deps: is that realistic given P02's needs?
-
-**Evidence:**
-- `ssh.FingerprintSHA256`: verified in `golang.org/x/crypto/ssh` (direct dep
-  since v0.6 D-030).
-- `knownhosts.Line` / `Normalize` / `KeyError`: same `golang.org/x/crypto`
-  module (already imported in `bootstrap.go:32` and `doctor.go:29`).
-- `verify-reqs`: stdlib only (`regexp`, `os`, `fmt`).
-- `go.mod` unchanged by v0.8 (PLAN line 62).
-
-**Confidence:** 0.95.
-**Verdict:** **PROCEED.** Zero-new-deps is verified and realistic.
-
----
-
-### Axis 7 — Risks, Assumptions, and Dependencies
-
-#### A7-F1 — The 10 pitfalls: are mitigations real or hand-waves?
-
-**Evidence (spot-check of the 4 most material pitfalls):**
-- **Pitfall #1 (TOFU broken):** Mitigation T02.6 is **concrete and correct** —
-  wrap `knownhosts.New`, capture on `KeyError{Want:[]}` via `knownhosts.Line` +
-  `security.WriteAtomic`, return nil. Verified against x/crypto v0.54.0
-  `checkAddr` semantics. **Real mitigation.**
-- **Pitfall #2 (Result.HostKeyFingerprint never populated):** T02.7 adds
-  `ssh.FingerprintSHA256(hostKey)`. 1-line once host key is available. **Real.**
-- **Pitfall #3 (no sessionRunner seam):** T01.1 adds it, ~10 LOC. **Real.**
-- **Pitfall #10 (writeAtomic unexported):** T02.2 exports it. Verified
-  `ca.go:305` — `func writeAtomic(...)` is indeed unexported. **Real.**
-
-**Confidence:** 0.88.
-**Verdict:** **PROCEED.** Mitigations are concrete, not hand-waves.
-
-#### A7-F2 — TOFI bugfix blast radius if P02's fix is wrong
-
-**Evidence:**
-- T02.6 changes the `HostKeyCallback` for every `orca node join --type proxmox`
-  + every `doctor proxmox` probe. If the capture-and-persist logic is wrong,
-  every existing Proxmox node's `known_hosts` could be corrupted (e.g.,
-  duplicate entries, wrong-format lines, partial writes on crash).
-- Mitigations: T02.10 integration tests (cases 3/4/5 cover first-connect,
-  second-connect, mismatch); AD-029 atomic rewrite via `security.WriteAtomic`.
-- **Gap:** no test for "known_hosts already has an entry, join re-connects" —
-  i.e., the idempotent re-run path after the fix. T02.10 case 4 covers
-  second-connect-match, but not "known_hosts was written by the OLD (broken)
-  code path and is now being read by the NEW code path."
-
-**Confidence:** 0.70.
-**Verdict:** **PROCEED-WITH-CONDITION.** T02.10 must add a case for
-"known_hosts pre-populated in the expected format (e.g., from a manual
-`ssh-keyscan` or a prior v0.6 deployment that somehow succeeded) →
-second-connect matches + succeeds." This covers the migration path from
-v0.6's (broken) state to v0.8's fixed state.
-
-**Condition:** Add T02.10 case 7: "known_hosts pre-populated with a valid
-OpenSSH line for the host → connect matches + succeeds (covers v0.6→v0.8
-migration)."
-
----
-
-### Axis 8 — Governance, Decision-Making, and Communication
-
-#### A8-F1 — Does `make verify-reqs` actually prevent drift, or is it cosmetic?
-
-**Evidence:**
-- T03.1 regex (PLAN line 216):
-  - ROADMAP milestone-complete: `^##\s*Milestone\s+v0\.\d+:.*—\s*\*\*COMPLETE\*\*`
-  - REQUIREMENTS row: `^\|\s*(REQ-\d+)\s*\|.*?\|\s*\*\*(Complete|Pending)\*\*\s*\|`
-- **ROADMAP v0.2 header (line 23):** `## Milestone v0.2: Networking,
-  Observability, Security Hardening — **COMPLETE (merged to main via v0.3)**`
-- The regex `\*\*COMPLETE\*\*` requires the literal `**COMPLETE**` with closing
-  `**` immediately after `COMPLETE`. v0.2's header has `**COMPLETE (merged to
-  main via v0.3)**` — the `**` closes after the parenthetical, NOT after
-  `COMPLETE`. **The regex does NOT match v0.2 as complete.**
-- **Consequence:** all v0.2 REQs (REQ-011, 014, 023, 025-040) are **silently
-  exempted** from the check. A stale v0.2 REQ-035 row (marked Pending) would
-  NOT fail the gate.
-- **ROADMAP v0.6 has TWO headers** (line 92 without COMPLETE, line 94 with) —
-  the regex matches line 94, but the duplicate is a markdown smell that could
-  confuse the milestone→REQ mapping if the parser takes the first match.
-
-**Confidence:** 0.92 (high — the regex mismatch is verifiable).
-**Verdict:** **PROCEED-WITH-CONDITION.** The regex must match `**COMPLETE**`
-as a *substring within the bold span*, not as a literal `**COMPLETE**` token.
-Change to `—\s*\*\*[^*]*COMPLETE[^*]*\*\*` (matches `**COMPLETE**`,
-`**COMPLETE (merged to main via v0.3)**`, and any future variant). Add a
-golden-file test case (T03.2) with the v0.2-style parenthetical header to
-prevent regression.
-
-**Condition:** T03.1 regex changed to substring-match COMPLETE within the bold
-span; T03.2 adds a golden fixture with `**COMPLETE (merged to main via v0.3)**`.
-
-#### A8-F2 — Is the single-direction check (ROADMAP→REQUIREMENTS) enough?
-
-**Evidence:**
-- PLAN line 35-37 explicitly scopes out the reverse direction: "forward
-  direction (ROADMAP-shipped → REQUIREMENTS Complete) is the priority per the
-  v0.7 drift that motivated REQ-060."
-- **But the v0.7 drift had TWO symptoms:**
-  1. ROADMAP said COMPLETE, REQUIREMENTS said Pending (forward drift — caught
-     by the current check).
-  2. **REQ-053 was marked Complete in REQUIREMENTS, but
-     `internal/store/cert_repo_test.go` was never written** — verified: only
-     `cert_repo.go` exists in `internal/store/`. The "Complete" status was
-     false. **No markdown-based check can catch this** (it's a code-vs-doc
-     drift, not a doc-vs-doc drift).
-- The reverse-direction check (REQUIREMENTS Complete ↔ ROADMAP COMPLETE) would
-  catch a different class: a REQ marked Complete in REQUIREMENTS for a
-  milestone ROADMAP does NOT mark COMPLETE (e.g., premature marking). This is
-  a cheaper class of drift but still real.
-
-**Confidence:** 0.78.
-**Verdict:** **PROCEED-WITH-CONDITION.** Add the reverse-direction assertion
-to T03.1 (it's ~10 LOC on top of the existing parser — same maps, just diff
-both ways). Document explicitly that **no markdown check can catch the
-code-vs-doc drift** (REQ-053 case) — that requires a code-level audit
-(`ciagent-audit` in P04). The plan should note this as a known limitation of
-REQ-060, not pretend the gate is complete.
-
-**Condition:** T03.1 adds reverse-direction assertion; PLAN adds a note that
-REQ-060 catches doc-vs-doc drift only, not code-vs-doc (the REQ-053
-cert_repo_test.go case).
-
-#### A8-F3 — Is there a "stop the project" trigger?
-
-**Evidence:** P04 (T04.1-T04.9) is the final review + ship. No explicit
-"stop" trigger if P01 coverage stalls or P02 TOFU fix proves unfixable.
-
-**Confidence:** 0.60.
-**Verdict:** **PROCEED.** The 4-phase structure with per-phase tags means a
-stall is visible (phase tag doesn't ship). Acceptable for an NFR milestone.
-
----
-
-### Axis 9 — Change, Adoption, and Operational Readiness
-
-#### A9-F1 — Who benefits from v0.8? Is there operator pull for `--host-key-fingerprint`?
-
-**Evidence:**
-- `--host-key-fingerprint` (REQ-058) is operator-facing: pre-pinning a
-  Proxmox host's SSH key before first join. This is the standard
-  high-security-deployment pattern (the v0.6 D-035 caveat explicitly promised
-  it as a "future enhancement").
-- `orca node key-reset` (REQ-059) is operator-facing: the `ssh-keygen -R`
-  equivalent for orca's known_hosts.
-- The TOFU bugfix (T02.6) benefits **every operator who has tried
-  first-connect Proxmox join since v0.6** — i.e., it fixes a feature that was
-  advertised as working but wasn't.
-- Coverage uplift (REQ-057) is developer-facing (no operator pull).
-- verify-reqs (REQ-060) is internal-governance (no operator pull).
-
-**Confidence:** 0.82.
-**Verdict:** **PROCEED.** The trust features have real operator pull
-(pre-pinning is a documented security best practice; the v0.6 caveat promised
-it). The coverage + hygiene work is internal-debt paydown — justified by the
-v0.7 under-shot, not by operator demand. The mix is appropriate for an NFR
-milestone.
-
-#### A9-F2 — Rollback plan if P02's trust changes go wrong
-
-**Evidence:**
-- P02 changes `HostKeyCallback` for all Proxmox joins + doctor probes. If the
-  capture-fix corrupts `known_hosts`, the rollback is: revert the phase commit
-  + manually restore `known_hosts` from backup.
-- No data migration in P02 (known_hosts is a flat file; atomic rewrite via
-  `WriteAtomic` preserves crash safety).
-- `key-reset` (T02.8) is local-only (D-046) — no remote side effects to
-  reverse.
-
-**Confidence:** 0.80.
-**Verdict:** **PROCEED.** Rollback is straightforward (revert + file restore).
-The atomic-rewrite requirement (AD-029) is the right mitigation.
-
----
-
-## Binding Verdicts Table
-
-| # | Axis | Finding | Verdict | Condition | Confidence |
-|---|------|---------|---------|-----------|------------|
-| A2-F1 | Scope | TOFU bugfix is a v0.6 ship-defect bundled into P02 as a feature task | PROCEED-WITH-CONDITION | Label T02.6 as a v0.6 bugfix in PLAN; P04 audit records it as a ship-defect closure | 0.62 |
-| A2-F2 | Scope | 3 zero-test packages at 50% toe-hold | PROCEED | — | 0.85 |
-| A2-F3 | Scope | 37 tasks / 4 phases size | PROCEED | — | 0.80 |
-| A1-F1 | Business | v0.8 is the right next milestone (not polish) | PROCEED | — | 0.90 |
-| A3-F1 | Architecture | sessionRunner + peerDispatcher seams do not leak test concerns | PROCEED | — | 0.88 |
-| A3-F2 | Architecture | P02 stays within existing security boundary | PROCEED | — | 0.90 |
-| A3-F3 | Architecture | T02.6 + T02.9 are paired changes (bootstrap + doctor share the defect) | PROCEED-WITH-CONDITION | Add P02 verification line for doctor proxmox first-connect parity with bootstrap | 0.75 |
-| A4-F1 | People | internal/cli/node.go territory collision adjudicated | PROCEED | — | 0.82 |
-| A4-F2 | People | Key-person risk on backend-engineer in P02 | PROCEED | — | 0.70 |
-| A5-F1 | Timeline | 70% cli coverage in one phase is a stretch (RESEARCH says 55-65%) | PROCEED-WITH-CONDITION | Add escape valve: ship cli at 65% if 70% not reached after Wave 2; do not block P02/P03 | 0.65 |
-| A6-F1 | Budget | Zero new deps verified | PROCEED | — | 0.95 |
-| A7-F1 | Risks | 10 pitfalls mitigations are concrete | PROCEED | — | 0.88 |
-| A7-F2 | Risks | TOFU fix blast radius — no migration-path test | PROCEED-WITH-CONDITION | Add T02.10 case 7: known_hosts pre-populated → second-connect matches (v0.6→v0.8 migration) | 0.70 |
-| A8-F1 | Governance | verify-reqs regex does not match v0.2's `**COMPLETE (merged...)**` header | PROCEED-WITH-CONDITION | Change regex to substring-match COMPLETE within bold span; add golden fixture | 0.92 |
-| A8-F2 | Governance | Single-direction check misses reverse drift + code-vs-doc drift (REQ-053 case) | PROCEED-WITH-CONDITION | Add reverse-direction assertion; document that code-vs-doc drift is out of scope for REQ-060 | 0.78 |
-| A8-F3 | Governance | No explicit "stop" trigger | PROCEED | — | 0.60 |
-| A9-F1 | Adoption | Operator pull exists for trust features; coverage/hygiene is internal debt | PROCEED | — | 0.82 |
-| A9-F2 | Adoption | Rollback plan is straightforward (revert + file restore) | PROCEED | — | 0.80 |
-
----
-
-## Required Plan Changes (4 conditions)
-
-1. **T02.6 labeling (A2-F1):** Add a note to T02.6 in `PLAN_v0.8.md` marking
-   it as a **v0.6 ship-defect bugfix** (first-connect Proxmox join has been
-   broken since v0.6 shipped due to `knownhosts.New` returning
-   `KeyError{Want:[]}` with no capture-and-persist). P04 audit (T04.2) must
-   record it as a ship-defect closure, not a v0.8 feature.
-
-2. **P02 verification parity for doctor (A3-F3):** Add to Phase 2 Verification:
-   "`doctor proxmox` first-connect on a node with empty known_hosts → captures
-   the key + writes known_hosts + probe succeeds (mirrors T02.10 case 3 for
-   bootstrap). T02.6 and T02.9 are a paired change; the phase is not complete
-   until both callbacks use the capture-fix wrapper."
-
-3. **T01.6 cli coverage escape valve (A5-F1):** Add to T01.6 acceptance
-   criterion: "If ≥65% (excluding `daemon.go`) is achieved but 70% is not after
-   Wave 2 effort, document the gap in a test-file comment + record a v0.9
-   follow-up; ship P01 at 65% for cli. Do NOT block P02/P03 on the last 5% of
-   cli coverage." (Carries forward RESEARCH §1.4's own flag as an explicit
-   escape valve.)
-
-4. **verify-reqs regex + reverse direction (A8-F1 + A8-F2):**
-   - Change T03.1 ROADMAP-complete regex from
-     `^##\s*Milestone\s+v0\.\d+:.*—\s*\*\*COMPLETE\*\*` to
-     `^##\s*Milestone\s+v0\.\d+:.*—\s*\*\*[^*]*COMPLETE[^*]*\*\*` (substring
-     match within the bold span — handles `**COMPLETE**`,
-     `**COMPLETE (merged to main via v0.3)**`, and future variants).
-   - Add T03.2 golden fixture: a ROADMAP with
-     `**COMPLETE (merged to main via v0.3)**` → assert the milestone is
-     detected as complete.
-   - Add reverse-direction assertion to T03.1: every REQUIREMENTS row marked
-     `**Complete**` must reference a milestone ROADMAP marks COMPLETE (catches
-     premature-Complete drift).
-   - Add a PLAN note: "REQ-060 catches doc-vs-doc drift only. Code-vs-doc
-     drift (e.g., REQ-053 marked Complete but `cert_repo_test.go` missing —
-     verified missing in v0.7 ship) is NOT caught by this gate; it requires
-     the P04 `ciagent-audit` code-level review."
-
-Additionally (lower-priority, from A7-F2):
-
-5. **T02.10 case 7 (A7-F2):** Add integration test case: "known_hosts
-   pre-populated with a valid OpenSSH line for the host (simulating a v0.6
-   deployment or manual `ssh-keyscan`) → connect matches + succeeds. Covers
-   the v0.6→v0.8 migration path."
-
----
-
-## Escalations
-
-None. All 9 axes resolved at confidence ≥ 0.60. No axis requires escalation to
-the operator; the 4 conditions are within the plan-author's authority to apply
-before P01 execution begins.
-
----
-
-## What the Plan Is NOT Doing (and should it?)
-
-- **Not lifting the 3 zero-test packages to 70%.** Correct per D-047 — deferred
-  to v0.9. Not a gap.
-- **Not adding a `peerDispatcher` seam unless needed.** Correct — conditional
-  on T01.4's 70% via `httptest.NewTLSServer`. Not a gap.
-- **Not pre-populating `known_hosts` from a remote keyscan API.** Correct —
-  TOFU + manual `--host-key-fingerprint` cover the v0.8 surface. Not a gap.
-- **Not catching code-vs-doc drift in verify-reqs.** **Known limitation** —
-  REQ-060 is a markdown-vs-markdown check. The REQ-053
-  `cert_repo_test.go`-missing case proves this class of drift is real. P04
-  `ciagent-audit` is the backstop. Documented in condition #4.
-
----
-
-## Simplest 80%-of-the-value version
-
-If forced to cut v0.8 to its smallest valuable form: **keep P02 (trust
-hardening + TOFU bugfix) and P03 (verify-reqs); drop P01's coverage uplift for
-the 3 zero-test packages + cli.** The TOFU bugfix alone (T02.6 + T02.9) fixes a
-shipped security defect — that's the highest-value work. The verify-reqs gate
-prevents the v0.7 drift from recurring. The coverage uplift on the 6
-under-50% packages is valuable but not urgent; the 3 zero-test toe-holds are
-the lowest-value work in the milestone. **The plan as written does not over-
-scope** — it includes all of the above because the marginal cost is low — but
-if P01 slips, the 3 toe-holds + cli are the first cuts to make.
-
----
-
-## What Would Have to Be True for v0.8 to Succeed in the Next 90 Days
-
-1. The `sessionRunner` seam (T01.1) unlocks proxmox 70% — **plausible** (same
-   pattern as the existing `sshDialer` seam).
-2. `httptest.NewTLSServer` suffices for transport 70% without a new seam —
-   **plausible** (standard Go testing fixture).
-3. The TOFU capture-fix (T02.6) is correct — **plausible** (verified against
-   x/crypto v0.54.0 semantics; integration tests T02.10 cover the cases).
-4. `verify-reqs` regex matches all ROADMAP milestone header variants — **NOT
-   true today** (v0.2 header mismatch — condition #4 fixes this).
-5. cli hits 70% in one phase — **NOT confirmed** (RESEARCH says 55-65%;
-   condition #3 adds the escape valve).
-
-(4) and (5) are the two conditions that move the plan from "optimistic" to
-"sound." Both are addressed by the 4 required changes.
-
----
-
-**End of grill report.** Apply the 4 conditions to `PLAN_v0.8.md` before P01
-execution. No REPLAN; no escalations. Overall verdict: **PROCEED-WITH-
-CONDITION** (confidence 0.78).

.ciagent/IDEATION_v0.7.md

@@ -1,123 +0,0 @@
-# Ideation: Orca v0.7 — Hardening & Completion
-
-Full autonomy mode: all ideas with confidence >= 0.60 are auto-accepted.
-The RESEARCH stage (commit `7c4b603`) surfaced 5 codebase gaps which are
-assessed below alongside 8 additional ideas generated by the 3-tier
-ideation process.
-
-Total generated: 13 ideas (5 Tier 1 + 5 Tier 2 + 3 Tier 3) plus 5
-inherited research findings = 18 considered. 13 accepted (all >= 0.60),
-0 skipped, 0 deferred. 4 of the accepted ideas are implementation
-refinements with no new REQ; 4 map to the v0.7 REQs (REQ-053..056)
-already declared in SPECIFY; the research findings confirmed the v0.7
-scope.
-
-## Tier 1: Mechanical Analysis (git + filesystem)
-
-### 1.1 Git-Native Pattern Mining
-
-- `git log --all --grep="lessons:"` — 1 lesson found (orch-engine P00
-  config.json schema reference). No repeated lessons in orca's own
-  history → no systemic process gap.
-- `git log --all --grep="escalation:"` — 0 escalations. The pipeline
-  has run clean across v0.1–v0.6.
-- `git log --all --grep="compound:"` — 0 compound learnings.
-- Low-confidence decisions (confidence < 0.7): none in `---ci---`
-  blocks. The lowest-confidence v0.7 decision is D-040 (pprof) at 0.85,
-  above threshold.
-
-### 1.2 Coverage Gap Analysis
-
-| ID | Idea | Source | Confidence | Status | Maps to |
-|----|------|--------|------------|--------|---------|
-| I-401 | `orca cert` command tree is unreachable — `NewCommand` in `internal/cli/cert.go` is never AddCommand'd to `rootCmd` | research §1.1 + `grep -rn "rootCmd.AddCommand"` (cert absent) | 0.98 | Accepted | REQ-053 |
-| I-402 | `internal/store/cert_repo.go` has no test file — every other repo has one | research §1.2 + `ls internal/store/*_test.go` | 0.95 | Accepted | REQ-053 (P01 companion) |
-| I-403 | `internal/engine` coverage 8.3% — only `scheduler_test.go` exists; executor, dispatcher, peer untested | research §1.3 + `go test -cover` | 0.90 | Accepted | REQ-055 |
-| I-404 | `internal/transport` coverage 26.3% — only `idempotency_test.go`; mtls, dispatch, handshake_log untested | research §1.3 | 0.90 | Accepted | REQ-055 |
-| I-405 | `internal/audit` has no test files — Emit, EmitWithErr, LogHandshake* untested | research §1.3 + `ls internal/audit/*_test.go` | 0.88 | Accepted | REQ-055 |
-
-### 1.3 Verification Layer Inversion (missing items)
-
-- **Structural**: `internal/cli/cert.go` defines a command that is
-  never wired in — a "documented but unreachable" component (I-401).
-- **Behavioral**: 4 packages below 50% coverage (I-403/404/405 + proxmox).
-- **Security**: no STRIDE gap — v0.7 adds no new trust boundary (pprof
-  is operator-only, addr-gated; cert registration exposes existing
-  security code).
-- **Quality**: no unresolved P1/P2 findings from v0.6 final review.
-
-## Tier 2: Backend-Enriched Analysis
-
-| ID | Idea | Source | Confidence | Status | Maps to |
-|----|------|--------|------------|--------|---------|
-| I-406 | HCL config file parser — `internal/config` package reusing `hclsimple.Decode` pattern from jobspec; D-009 promised it, never built | research §1.4 + D-009 | 0.92 | Accepted | REQ-054 |
-| I-407 | `--pprof <addr>` opt-in on `orca daemon` — I-308 deferred since v0.2; stdlib only, separate mux | research §1.5 + I-308 | 0.82 | Accepted | REQ-056 |
-| I-408 | Config precedence flag>env>file>default — table-driven test covering all 4 layers | backend-enriched (D-039) | 0.90 | Accepted | (refinement of REQ-054; no new REQ) |
-| I-409 | pprof on separate `*http.Server` + `*http.ServeMux`, never on mTLS daemon listener | backend-enriched (AD-024) | 0.90 | Accepted | (refinement of REQ-056; no new REQ) |
-| I-410 | CI coverage gate: `go test -cover ./internal/engine ./internal/transport ./internal/proxmox ./internal/audit` assert each ≥ 50% | backend-enriched (AD-025) | 0.85 | Accepted | (refinement of REQ-055; no new REQ) |
-
-## Tier 3: Cross-Project Pattern Transfer
-
-| ID | Idea | Source | Confidence | Status | Maps to |
-|----|------|--------|------------|--------|---------|
-| I-411 | `orca version --json` already outputs structured `{version, commit, go_version, build_time}` (I-307 accepted v0.2) — verify still works, no new REQ | cross-project (carry-forward from v0.2 I-307) | 0.80 | Accepted (verification only) | (no new REQ; confirm in P03) |
-| I-412 | `orca cert` registration via `init()` co-located in `cert.go` — matches the self-registering pattern in `daemon.go`/`audit.go` | cross-project (orca's own convention) | 0.88 | Accepted | (refinement of REQ-053; no new REQ) |
-| I-413 | No new direct dependencies in v0.7 — `net/http/pprof` (stdlib), `hashicorp/hcl/v2` (already direct) | cross-project (minimal-deps ethos) | 0.95 | Accepted | (constraint; no new REQ) |
-
-## Research-stage findings (assessed)
-
-| Finding | Verdict | Maps to |
-|---------|---------|---------|
-| cert command unreachable (§1.1) | **Accepted** (I-401) | REQ-053 (P01) |
-| cert_repo has no test (§1.2) | **Accepted** (I-402) | REQ-053 (P01) |
-| low coverage: engine/transport/proxmox/audit (§1.3) | **Accepted** (I-403/404/405) | REQ-055 (P03) |
-| no HCL config parser (§1.4) | **Accepted** (I-406) | REQ-054 (P02) |
-| pprof deferred since v0.2 (§1.5) | **Accepted** (I-407) | REQ-056 (P04) |
-
-All 5 findings map to the v0.7 REQs declared in SPECIFY. The IDEATE
-stage confirms the scope and adds 8 implementation refinements
-(I-408..I-413) that inform the PLAN stage.
-
-## Dropped ideas (confidence < 0.60)
-
-None. The lowest-confidence accepted idea is I-407 (pprof) at 0.82.
-
-## Accepted Ideas (auto-accepted, full autonomy)
-
-13 ideas accepted (5 Tier 1 + 5 Tier 2 + 3 Tier 3). 4 map to net-new
-REQs (REQ-053..056, already declared in SPECIFY); 9 are implementation
-refinements recorded for the PLAN stage's benefit.
-
-## Resulting REQ additions
-
-| New REQ | Title | Phase | Source ideas |
-|---------|-------|-------|--------------|
-| REQ-053 | `orca cert` command tree registered + cert_repo tests | P01 | I-401, I-402, I-412 |
-| REQ-054 | HCL config file parsing (`internal/config`) | P02 | I-406, I-408 |
-| REQ-055 | Test coverage uplift — engine/transport/proxmox/audit ≥ 50% | P03 | I-403, I-404, I-405, I-410 |
-| REQ-056 | `--pprof <addr>` opt-in on `orca daemon` | P04 | I-407, I-409 |
-
-**Total net-new REQs**: 4 (REQ-053..056). All declared in SPECIFY;
-IDEATE confirms mapping and adds implementation refinements.
-
-## Deferred (recorded but not v0.7)
-
-None. I-308 (pprof) is no longer deferred — it is REQ-056 in P04.
-
-## Followup notes for PLAN stage
-
-- **P01** is the highest-impact, lowest-effort phase: a 1-line
-  `rootCmd.AddCommand` + a regression test + cert_repo_test.go. The
-  smoke test should run `cert ca-init` + `cert gen` + `cert show` +
-  `cert fingerprint` against a temp `ORCA_HOME` to catch any latent
-  bugs in the never-exercised cert subcommands.
-- **P02** config package must be a pure function (`Load(paths) ->
-  *Config`) with no package-level state. The `--config` flag on root
-  command loads the file and passes the merged `*Config` down via
-  cobra's `cmd.SetContext` or a struct field on the command.
-- **P03** coverage: target the interface seams (SSH dialer, peer
-  client) for mocks; use `httptest.NewTLSServer` for transport. Any
-  races uncovered by `-race` get fixed in P03, not deferred.
-- **P04** pprof: keep the daemon's mTLS listener untouched; start a
-  second `http.Server` only when `--pprof` is non-empty. Log a WARN
-  that the endpoint is unauthenticated.

.ciagent/PERSONAS.md

@@ -1,219 +1,161 @@
----
-active:
-  - lead-developer
-  - backend-engineer
-  - data-engineer
-deactivated:
-  - cli-engineer
-  - security-engineer
-  - devops-engineer
-  - network-engineer
-  - frontend-engineer
-phase_specific: []
-reason: |
-  Orca v0.8 is an NFR coverage & trust-hardening milestone. The work is
-  test coverage uplift across 9 packages (P01), SSH trust-surface
-  hardening in the existing proxmox + cli/node + security packages (P02),
-  and a requirements-hygiene Go program + Makefile target (P03). No
-  schema changes, no new security architecture, no packaging/distribution,
-  no UI.
-
-  Roster changes vs v0.7:
-  - lead-developer: RETAINED — owns cmd/orca smoke test, internal/cli
-    coverage (cert/doctor/audit/status/version subcommands), and the
-    cmd/verify-reqs Go program (coordination + glue-code territory).
-  - backend-engineer: RETAINED — owns internal/transport + internal/engine
-    tests (httptest.NewTLSServer, LocalExecutor stubs, PeerRegistry) and
-    the SSH trust-surface in internal/proxmox/bootstrap.go (pinned
-    host-key callback, TOFU capture fix, sessionRunner seam) plus
-    internal/cli/node.go (--host-key-fingerprint flag, key-reset
-    subcommand). Frameworks updated: connectrpc REMOVED (not in go.mod
-    per AD-014), golang.org/x/crypto/ssh ADDED (direct dep since v0.6).
-  - data-engineer: RETAINED — owns internal/store tests (cert_repo_test.go
-    gap + coverage uplift), internal/audit tests (sqlite-backed
-    audit_log asserts), internal/certpaths tests (path-join asserts),
-    and internal/jobspec tests (golden HCL fixtures). Frameworks
-    updated: modernc/sqlite + iter (matches actual go.mod).
-  - security-engineer: remains DEACTIVATED — v0.8 refines the existing
-    proxmox SSH trust surface (pinned callback, key-reset) but does NOT
-    add new security architecture. The trust work is backend-engineer
-    territory (it's SSH dialer + known_hosts file manipulation, not
-    X.509/CA/crypto code).
-  - cli-engineer: remains DEACTIVATED — merged into lead-developer
-    (cli coverage is test-only; --host-key-fingerprint and key-reset
-    are 1-flag + 1-subcommand additions to the existing node.go).
-  - devops-engineer: remains DEACTIVATED — verify-reqs is a Go program
-    (lead-developer territory), not a CI/packaging change. The
-    .coreci.yml edit is a 3-line validate-pipeline hook.
-  - network-engineer: remains DEACTIVATED — no transport/mTLS surface
-    change (transport coverage is test-only on the existing mTLS layer).
-  - frontend-engineer: remains DEACTIVATED — no web UI (unchanged
-    from v0.1 onward).
----
-
-# Personas: Orca
-
-## v0.8 persona assessment
-
-### lead-developer
-- **Domain**: coordination
-- **Frameworks**: `cobra`, `net/http/httptest`, `testing`
-- **Constraints**: `boundary-enforcement`, `offline-first`, `no-redundant-implementations`, `coverage-floor-70`
-- **Territory**: `cmd/**`, `internal/cli/**`, `cmd/verify-reqs/**`, `Makefile`, `.coreci.yml`, `.ciagent/**`
-- **Active**: true
-- **Reason**: Owns P01 coverage for `cmd/orca` (smoke test of `main()`/`cli.Execute()`), `internal/cli` coverage for the non-node, non-daemon subcommands (`cert *`, `doctor *`, `audit list`, `status`, `version`), and the P03 `cmd/verify-reqs/main.go` Go program + `make verify-reqs` Makefile target + `.coreci.yml` validate-pipeline hook. Added `coverage-floor-70` constraint (D-047 tiered floor: 70% for the 6 under-50% packages, 50% for the 3 zero-test packages). Added `testing` + `net/http/httptest` to frameworks (test-only phase).
-
-### backend-engineer
-- **Domain**: backend
-- **Frameworks**: `cobra`, `net/http`, `net/http/httptest`, `golang.org/x/crypto/ssh`, `golang.org/x/crypto/ssh/knownhosts`, `testing`
-- **Constraints**: `API-first`, `error-handling`, `minimal-dependencies`, `security-first`, `tofu-host-key-pinning`, `pinned-host-key-fail-closed`, `atomic-file-rewrite`, `coverage-floor-70`
-- **Territory**: `internal/transport/**`, `internal/engine/**`, `internal/proxmox/**`, `internal/cli/node.go`, `internal/daemon/**` (tests only)
-- **Active**: true
-- **Reason**: Owns P01 coverage for `internal/transport` (httptest.NewTLSServer for mTLS + stubDispatcher for DispatchClient) and `internal/engine` (LocalExecutor stubs + PeerRegistry in-memory tests). Owns P02 SSH trust hardening: `--host-key-fingerprint` pinned callback in `internal/proxmox/bootstrap.go` (D-045 OpenSSH SHA256:base64 format, AD-027/AD-028), the TOFU capture-fix (knownhosts.New returns KeyError{Want:[]} on first connect — must capture-and-persist via knownhosts.Line, AD-029 atomic rewrite), the `sessionRunner` seam refactor (P01 enabler for proxmox coverage), and `internal/cli/node.go` `--host-key-fingerprint` flag + `key-reset` subcommand (D-046 local known_hosts only). Frameworks updated: `connectrpc` REMOVED (not in go.mod per AD-014 — config.json still lists it but it's a stale entry), `golang.org/x/crypto/ssh` + `knownhosts` ADDED (direct dep since v0.6 D-030). Added `pinned-host-key-fail-closed` + `atomic-file-rewrite` + `coverage-floor-70` constraints.
-
-### data-engineer
-- **Domain**: data
-- **Frameworks**: `modernc/sqlite`, `iter`, `hashicorp/hcl/v2`, `testing`
-- **Constraints**: `schema-first`, `migration-safe`, `local-storage-only`, `no-goroutine-leak`, `nullable-column-handling`, `coverage-floor-70`
-- **Territory**: `internal/store/**`, `internal/audit/**`, `internal/certpaths/**`, `internal/jobspec/**`, `internal/model/**`, `internal/store/migrations/**`
-- **Active**: true
-- **Reason**: Owns P01 coverage for `internal/store` (including the missing `cert_repo_test.go` — a v0.7 P01 leftover; Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + N=3 rotation history per REQ-025), `internal/audit` (sqlite-backed audit_log row asserts via `engine.Audit` + `store.AuditRepo`, slog capture via test handler), `internal/certpaths` (path-join asserts with temp dir + ORCA_HOME/ORCA_DB env), and `internal/jobspec` (golden-file HCL fixtures in a new `testdata/` dir + error-path table for Parse/Validate/ParseFile). Frameworks updated: `iter` + `hashicorp/hcl/v2` added (matches actual go.mod — jobspec uses hclsimple; store Watch uses iter.Seq). Added `coverage-floor-70` constraint.
-
-### cli-engineer
-- **Active**: false (v0.8)
-- **Reason**: Deactivated — merged into lead-developer. The cli coverage work is test-only; `--host-key-fingerprint` and `key-reset` are a 1-flag and 1-subcommand addition to the existing `internal/cli/node.go`, not a new CLI subsystem.
-
-### security-engineer
-- **Active**: false (v0.8)
-- **Reason**: Deactivated — v0.8 refines the existing proxmox SSH trust surface (pinned host-key callback, key-reset known_hosts rewrite) but does NOT add new security architecture (no new CA, no new X.509, no new crypto). The trust work is backend-engineer territory (SSH dialer + known_hosts file manipulation). The `internal/security/sshkey.go` is unchanged in v0.8. Was active in v0.6 (SSH keygen + sudoers), deactivated in v0.7, remains deactivated in v0.8.
-
-### devops-engineer
-- **Active**: false (v0.8)
-- **Reason**: Deactivated — `verify-reqs` is a Go program (`cmd/verify-reqs/main.go`), not a CI/packaging change. The `.coreci.yml` edit is a 3-line validate-pipeline hook (lead-developer territory). No install.sh, Dockerfile, or release-pipeline surface in v0.8.
-
-### network-engineer
-- **Active**: false (v0.8)
-- **Reason**: Deactivated — no transport/mTLS surface change. `internal/transport` coverage is test-only on the existing mTLS layer (httptest.NewTLSServer, no new TLS config). The SSH trust work is point-to-point bootstrap, not the mTLS mesh network-engineer owns.
-
-### frontend-engineer
-- **Active**: false (v0.8)
-- **Reason**: No web UI in Orca (unchanged from v0.1 onward).
-
-## Territory Enforcement
-
-- **Mode**: `warn` (per `config.json`)
-- **Behavior**: Out-of-territory file changes log a warning but do not block.
-- **Key overlaps in v0.8** (lead-developer adjudicates):
-  - `internal/cli/node.go` — backend-engineer (`--host-key-fingerprint` flag + `key-reset` subcommand + proxmox pass-through) vs lead-developer (cli coverage tests). Boundary: backend owns the command implementation; lead owns the test files (`node_test.go`).
-  - `internal/proxmox/bootstrap.go` — backend-engineer (pinned callback, TOFU fix, sessionRunner seam) vs data-engineer (no overlap — proxmox has no store/audit code). Clean boundary.
-  - `cmd/verify-reqs/main.go` — lead-developer (Go program + Makefile + .coreci.yml) vs data-engineer (no overlap — verify-reqs parses markdown, not DB). Clean boundary.
-  - `internal/store/cert_repo_test.go` — data-engineer (test file) vs backend-engineer (no overlap — cert_repo is data territory). Clean boundary.
-
-## v0.8 vs v0.7 Persona Diff
-
-| Change | Rationale |
-|--------|-----------|
-| `lead-developer` retained | Owns cmd/orca smoke test, internal/cli coverage (non-node subcommands), cmd/verify-reqs Go program. |
-| `backend-engineer` retained | Owns internal/transport + internal/engine tests + SSH trust-surface in proxmox + cli/node. Frameworks corrected: connectrpc removed (not in go.mod), x/crypto/ssh added. |
-| `data-engineer` retained | Owns internal/store (cert_repo gap) + internal/audit + internal/certpaths + internal/jobspec tests. Frameworks corrected: iter + hcl/v2 added. |
-| `security-engineer` remains deactivated | v0.8 refines existing SSH trust surface, no new security architecture. |
-| `cli-engineer` remains deactivated | Merged into lead-developer (test-only + 1 flag + 1 subcommand). |
-| `devops-engineer` remains deactivated | verify-reqs is a Go program, not CI/packaging. |
-| `network-engineer` remains deactivated | No transport/mTLS surface change (test-only). |
-| `frontend-engineer` remains deactivated | No web UI. |
-
----
-
-## v0.7 baseline (preserved for traceability)
-
 ---
 active_personas:
   - lead-developer
   - backend-engineer
   - data-engineer
-deactivated_personas:
   - cli-engineer
   - security-engineer
-  - devops-engineer
   - network-engineer
+deactivated_personas:
   - frontend-engineer
-phase_specific: []
+  - devops-sre
+phase_specific:
+  - cli-engineer
+  - data-engineer
+  - security-engineer
+  - network-engineer
 reason: |
-  Orca v0.7 is an NFR hardening & completion milestone. The work is CLI
-  registration (cert command), a new internal/config package, test
-  coverage uplift across engine/transport/proxmox/audit, and an opt-in
-  pprof endpoint on the daemon. No schema changes, no new security
-  surface, no packaging/distribution, no UI.
+  Orca is a CLI-first, offline-first orchestration engine with no web UI and
+  a single-binary distribution model. The v0.3 milestone is a 2-phase
+  completion milestone (iter.Seq streaming + doctor network/db) that touches
+  the CLI, store, doctor, transport, and security layers. The persona roster
+  reflects this:
 
-  Roster changes vs v0.6:
-  - data-engineer: RETAINED — owns cert_repo tests + store coverage.
-  - security-engineer: DEACTIVATED — v0.7 adds no new security surface
-    (pprof is operator-only, addr-gated; cert registration exposes
-    existing security code, does not add new).
-  - cli-engineer: DEACTIVATED — merged into lead-developer for v0.7
-    (the cert registration is a 1-line AddCommand; config --config flag
-    is root-command wiring, not a new CLI subsystem).
-  - devops-engineer: DEACTIVATED — no packaging/distribution in v0.7.
+  - lead-developer: coordination, task decomposition, territory adjudication
+    (e.g. D-039 dbPath relocation between cli-engineer territory and the
+    doctor package).
+  - backend-engineer: daemon health endpoint surface that the doctor network
+    check probes; transport dispatch client reuse.
+  - data-engineer: iter.Seq[Job|Node] on the store repos (P01) and the
+    migration-version query + PRAGMA integrity_check in the store layer (P02).
+  - cli-engineer: the --watch flag on `orca job list` / `orca node list`
+    (P01) and the doctor subcommand wiring (P02).
+  - security-engineer: mTLS client config reuse for the doctor network probe
+    (P02) — TLS config is the security-engineer territory per v0.2.
+  - network-engineer: the doctor /healthz probe over mTLS reuses the
+    transport layer (P02) — connection lifecycle / peer reachability is the
+    network-engineer territory.
+
+  Deactivated:
+  - frontend-engineer: no web UI in Orca (v0.1 onward). NOT relevant to v0.3.
+  - devops-sre: no container/cloud integrations; release flow is handled by
+    CoreCI (not a persona territory).
+
+  Phase-specific (v0.3):
+  - cli-engineer: P01 (--watch flag is a CLI surface) + P02 (doctor
+    subcommand wiring).
+  - data-engineer: P01 (iter.Seq on store repos) + P02 (migration version +
+    integrity check in store layer).
+  - security-engineer: P02 only (mTLS client config for doctor network probe).
+  - network-engineer: P02 only (mTLS /healthz probe over transport).
 ---
 
-### lead-developer (v0.7)
+# Personas: Orca
+
+## Roster
+
+### lead-developer
 - **Domain**: coordination
 - **Frameworks**: `cobra`
 - **Constraints**: `boundary-enforcement`, `offline-first`, `no-redundant-implementations`
 - **Territory**: `**/*.go`, `cmd/**`, `internal/**`
 - **Active**: true
-- **Reason**: Coordination across P01/P02/P03. SSH/bootstrap touches security + cli + store + doctor — territory overlaps need adjudication (proxmox package boundary, doctor Proxmox check scaffolding).
 
-### backend-engineer (v0.7)
+### backend-engineer
 - **Domain**: backend
-- **Frameworks**: `cobra`, `net/http`, `golang.org/x/crypto/ssh`
-- **Constraints**: `API-first`, `error-handling`, `minimal-dependencies`, `security-first`, `idempotent-bootstrap`
-- **Territory**: `**/api/**`, `**/*_handler*`, `**/*_handler.go`, `internal/daemon/**`, `internal/proxmox/**`, `internal/cli/init.go`
+- **Frameworks**: `cobra`, `net/http`
+- **Constraints**: `API-first`, `error-handling`, `minimal-dependencies`, `security-first`
+- **Territory**: `**/api/**`, `**/*_handler*`, `**/*_handler.go`, `internal/daemon/**`
 - **Active**: true
-- **Reason**: Owns the `orca init` full-bootstrap orchestration (CA + cert + db + localhost node, idempotent) and the `internal/proxmox/bootstrap.go` SSH session sequence (dial, deploy pubkey, useradd, pveum, sudoers, visudo validate). Added `idempotent-bootstrap` constraint (D-036 — re-run must be skip-and-refresh) and `golang.org/x/crypto/ssh` to frameworks.
+- **Reason**: Owns the daemon health endpoints (`/healthz`, `/readyz`) that the P02 doctor network check probes. The transport dispatch client (reused by doctor) lives in `internal/transport` but the *handler* surface is backend-engineer territory.
 
-### data-engineer (v0.7)
+### data-engineer
 - **Domain**: data
 - **Frameworks**: `modernc/sqlite`, `iter`
-- **Constraints**: `schema-first`, `migration-safe`, `local-storage-only`, `no-goroutine-leak`, `nullable-column-handling`
-- **Territory**: `**/store/**`, `**/model.go`, `**/migration*`, `migrations/**`, `internal/store/migrations/**`, `internal/model/node.go`
+- **Constraints**: `schema-first`, `migration-safe`, `local-storage-only`, `no-goroutine-leak`
+- **Territory**: `**/store/**`, `**/model.go`, `**/migration*`, `migrations/**`, `internal/store/migrations/**`
 - **Active**: true
-- **Reason**: Reactivated for v0.6. Owns migration `0006_node_kind_os.sql` (REQ-049 — nullable `kind`/`os` columns, backward-compatible) and `NodeRepo` schema extension (Insert/Get/List/Watch/scanNode column additions + new `GetByName`/`UpdateLastSeenAndOS` helpers). Added `nullable-column-handling` constraint (NULL → `""` in Go struct, not nil-deref).
+- **Reason**: Owns the `iter.Seq[Job|Node]` implementations on `JobRepo`/`NodeRepo` (P01) and the `MigrationVersion` query + `PRAGMA integrity_check` helper (P02). Added `iter` to frameworks and `no-goroutine-leak` to constraints (the iter.Seq polling loop must not leak — see RESEARCH_v0.3.md D-032). Territory confirmed against actual file structure: `internal/store/` holds all repos + `migrations/` subdir with `0001..0005_*.sql`.
 
-### cli-engineer (v0.7)
+### cli-engineer (custom)
 - **Domain**: CLI/UX
 - **Frameworks**: `cobra`, `pflag`
-- **Constraints**: `discoverable-help`, `consistent-flag-naming`, `human-readable-output`, `machine-readable-json-flag`, `signal-handling`, `password-flag-redaction`
+- **Constraints**: `discoverable-help`, `consistent-flag-naming`, `human-readable-output`, `machine-readable-json-flag`, `signal-handling`
 - **Territory**: `cmd/**`, `internal/cli/**`, `internal/commands/**`
 - **Active**: true
-- **Reason**: Owns `orca init` multi-step bootstrap output UX (progress lines per step), `orca node join --type/--host/--user/--password/--proxmox-user/--proxmox-role` flag wiring, and `doctor os`/`doctor proxmox` subcommand wiring. Added `password-flag-redaction` constraint (D-031 — `--password` never echoed, prefer `$ORCA_PROXMOX_PASSWORD`, zero after use).
+- **Reason**: Orca is CLI-first; this persona ensures CLI quality and discoverability. For v0.3 P01 it owns the `--watch` flag on `orca job list` / `orca node list` (signal.NotifyContext cancellation, table refresh vs streaming JSON). For P02 it owns the `internal/cli/doctor.go` subcommand wiring (replacing NetworkStub/DBStub calls). Added `signal-handling` to constraints (ctrl-c propagation to iter.Seq is a P01 correctness requirement). Territory confirmed: `internal/cli/` holds all Cobra commands.
 
-### security-engineer (v0.7)
+### security-engineer (custom)
 - **Domain**: security
-- **Frameworks**: `crypto/tls`, `crypto/x509`, `crypto/ed25519`, `golang.org/x/crypto/ssh`, `slog`
-- **Constraints**: `no-panic-in-production`, `structured-audit-logging`, `no-secret-in-logs`, `input-validation`, `least-privilege`, `tofu-host-key-pinning`, `noexec-sudoers`
-- **Territory**: `**/auth/**`, `**/audit/**`, `internal/security/**`, `internal/transport/**` (TLS config only), `internal/proxmox/**` (SSH + sudoers + PVE role)
+- **Frameworks**: `crypto/tls`, `crypto/x509`, `slog`
+- **Constraints**: `no-panic-in-production`, `structured-audit-logging`, `no-secret-in-logs`, `input-validation`, `least-privilege`
+- **Territory**: `**/auth/**`, `**/audit/**`, `internal/security/**`, `internal/transport/**` (TLS config only)
 - **Active**: true
-- **Reason**: Reactivated for v0.6. Owns `internal/security/sshkey.go` (Ed25519 keygen, 0600/0644 mode enforcement per REQ-033 spirit), TOFU host-key pinning via `knownhosts.New`, sudoers least-privilege design (NOEXEC on pct/qm, exclude pvesh, no NOEXEC on apt-get/dpkg), password redaction (D-031), and audit logging of all bootstrap/join actions (REQ-052). Added `tofu-host-key-pinning` and `noexec-sudoers` constraints. Co-owns `internal/proxmox/**` with backend-engineer (security owns SSH auth + sudoers content; backend owns the session orchestration).
+- **Reason**: mTLS, audit logging, and input validation are first-class concerns. For v0.3 P02, the doctor network check reuses `security.ClientTLSConfig` (via `transport.NewMTLSClient`) to build the mTLS client that probes peer `/healthz`. The TLS-config portion of `internal/transport/**` remains security-engineer territory.
+- **Phase scope**: P02 only (mTLS client config for doctor network probe). P01 has no security surface.
 
-### devops-engineer (v0.7)
-- **Active**: false (v0.6)
-- **Reason**: Deactivated — v0.6 has no install.sh, Dockerfile, .coreci.yml, or release-pipeline surface. The Proxmox SSH bootstrap is backend + security work, not devops. Was active in v0.5 (distribution milestone).
+### network-engineer (custom, NEW in v0.2)
+- **Domain**: networking
+- **Frameworks**: `net/http`, `crypto/tls` (via `internal/security`), `iter`
+- **Constraints**: `connection-resilience`, `retry-with-backoff`, `graceful-disconnect`, `context-propagation`, `bounded-probe-timeout`
+- **Territory**: `**/transport/**`, `**/engine/dispatcher*`, `**/engine/peer*`, `internal/engine/dispatcher.go`, `internal/engine/peer.go`, `internal/transport/**`
+- **Active**: true
+- **Reason**: Owns the transport layer and peer-to-peer connection lifecycle. For v0.3 P02, the doctor network check is a read-only mTLS `/healthz` probe that reuses `transport.MTLSClient` — the connection lifecycle (dial, per-probe 3s timeout, handshake) is network-engineer territory. Added `bounded-probe-timeout` to constraints (doctor must not stall on one slow peer — RESEARCH_v0.3.md D-038). Territory confirmed: `internal/transport/` holds mtls.go, dispatch.go, retry.go, idempotency.go, handshake_log.go.
+- **Phase scope**: P02 only (doctor network probe reuses transport layer).
 
-### network-engineer (v0.7)
-- **Active**: false (v0.6)
-- **Reason**: v0.6 has no transport/mTLS surface. SSH is point-to-point bootstrap, not the mTLS mesh network-engineer owns.
+### frontend-engineer
+- **Active**: false
+- **Reason**: No web UI in Orca (v0.1 onward). NOT relevant to v0.3 — v0.3 adds no UI surface. Confirmed deactivated.
 
-### frontend-engineer (v0.7)
-- **Active**: false (v0.6)
-- **Reason**: No web UI in Orca (unchanged from v0.1 onward).
+### devops-sre
+- **Active**: false
+- **Reason**: No container/cloud integrations. Release flow is handled by CoreCI (not a persona territory). Confirmed deactivated.
 
-### v0.6 vs v0.5 Persona Diff (v0.7 baseline reference)
+## Territory Enforcement
+
+- **Mode**: `warn` (per `config.json`)
+- **Behavior**: Out-of-territory file changes log a warning but do not block.
+- **Rationale**: Allows flexibility during early development; tighten to `strict` post-v0.1. For v0.3, the main territory-overlap risk is D-039 (moving `dbPath` from `internal/cli` to `internal/certpaths`) which crosses cli-engineer and the shared-infra concern — lead-developer adjudicates.
+
+## Phase-Specific Personas (v0.3)
+
+| Persona | Active in | Reason |
+|---------|-----------|--------|
+| `cli-engineer` | P01, P02 | P01: `--watch` flag is a CLI surface (signal handling, table/JSON render). P02: doctor subcommand wiring in `internal/cli/doctor.go`. |
+| `data-engineer` | P01, P02 | P01: `iter.Seq[Job|Node]` on the store repos + the no-leak polling loop. P02: `MigrationVersion` query + `PRAGMA integrity_check` in the store layer. |
+| `security-engineer` | P02 | mTLS client config reuse for the doctor network probe. P01 has no security surface. |
+| `network-engineer` | P02 | mTLS `/healthz` probe over the transport layer (connection lifecycle, per-probe timeout). P01 has no network surface. |
+
+In full-autonomy mode, all personas are auto-accepted and the phase-scope
+assignments are applied automatically when a phase is committed.
+
+## v0.3 vs v0.2 Persona Diff
 
 | Change | Rationale |
 |--------|-----------|
-| `data-engineer` reactivated | Owns migration 0006 + NodeRepo schema extension (kind/os columns). |
-| `security-engineer` reactivated | Owns SSH keygen, TOFU host-key, sudoers, PVE role — first-class security surface. |
-| `devops-engineer` deactivated | v0.6 has no packaging/distribution surface. |
-| `network-engineer` remains deactivated | No transport/mTLS surface. |
-| `frontend-engineer` remains deactivated | No web UI. |
+| `data-engineer` frameworks: added `iter` | P01 introduces `iter.Seq[T]` on the store repos — a new stdlib framework surface for this persona. |
+| `data-engineer` constraints: added `no-goroutine-leak` | The iter.Seq polling loop must not leak goroutines (inline pull loop, defer ticker.Stop, rows.Close on every path — RESEARCH D-032). |
+| `cli-engineer` constraints: added `signal-handling` | P01 requires `signal.NotifyContext` for ctrl-c propagation to iter.Seq (D-031). |
+| `network-engineer` constraints: added `bounded-probe-timeout` | P02 doctor network check must bound each peer probe (3s) so one slow peer doesn't stall diagnostics (D-038). |
+| `network-engineer` phase scope: was P02-only (v0.2), now P02-only (v0.3) | Same persona, different phase content — v0.3 P02 is doctor network, not multi-node dispatch. |
+| `security-engineer` phase scope: was P01+P02 (v0.2), now P02-only (v0.3) | v0.3 has no new cert/CA work; security surface is limited to reusing the existing mTLS client config in doctor. |
+| `frontend-engineer` | Remains deactivated (no UI in v0.3). |
+| `devops-sre` | Remains deactivated (CoreCI handles release). |
+
+## Migration from v0.2
+
+- `backend-engineer` territory unchanged: `internal/daemon/**` still owns HTTP
+  handlers. The `/healthz` endpoint that the doctor network check probes is
+  backend-engineer territory; the *probing* client is network-engineer.
+- `data-engineer` territory expanded scope: still owns `internal/store/**` but
+  now adds the `iter.Seq` polling implementations (P01) and a public
+  `MigrationVersion` query (P02).
+- `security-engineer` territory unchanged: `internal/security/**` + the TLS
+  config portion of `internal/transport/**`. The doctor network check calls
+  into `security.ClientTLSConfig` indirectly via `transport.NewMTLSClient` —
+  no new security-engineer files, just reuse.
+- `cli-engineer` territory unchanged: `internal/cli/**`. P01 modifies
+  `job.go` and `node.go`; P02 modifies `doctor.go`. The `dbPath` relocation
+  (D-039) moves a 5-line function out of `internal/cli/node.go` into
+  `internal/certpaths` — cli-engineer territory loses one function, shared
+  infra gains it.

.ciagent/PHASE1_VERIFICATION.md

@@ -1,74 +0,0 @@
-# Phase 1 Verification: Namespace Unification (v0.5 P1)
-
-**Phase**: 1 (namespace unification)
-**Milestone**: v0.5 Distribution
-**Requirements covered**: REQ-041, REQ-042
-**Date**: 2026-08-03
-
-## Structural Layer
-
-- `gofmt -l .` → clean (no files need formatting).
-- `go vet ./...` → clean (no warnings).
-- `go build ./...` → succeeds.
-- New files: `internal/cli/namespace_test.go`, `docs/namespace.md`.
-- Modified files: `internal/cli/root.go`, `internal/cli/init.go`, `internal/store/store.go`.
-
-## Behavioral Layer
-
-### Unit tests (new)
-- `TestNamespaceDefaultsToUserHome` ✓ — empty `ORCA_HOME` → `~/.orca`.
-- `TestNamespaceHonorsORCAHOME` ✓ — `ORCA_HOME=/tmp/x` → `Dir()=/tmp/x`, `DBPath()=/tmp/x/orca.db`.
-- `TestInitHonorsORCAHOME` ✓ — `init` creates `$ORCA_HOME` dir.
-- `TestSystemFlagSetsORCAHOME` ✓ — `--system` sets `ORCA_HOME=/root/.orca`.
-- `TestSystemFlagConflictsWithORCAHOME` ✓ — `--system` + `ORCA_HOME=/custom` → error.
-- `TestInitJSONOutput` ✓ — `init --json` returns `{"path":"...","status":"initialized"}`.
-- `TestSystemFlagIsPersistent` ✓ — `--system` registered as persistent flag on `rootCmd`.
-
-### Unit tests (regression — all pass)
-- `internal/cli/` (9.8s) ✓
-- `internal/store/` ✓
-- `internal/doctor/` ✓
-- `internal/daemon/` ✓
-- `internal/security/` ✓
-- `internal/engine/` ✓
-- `internal/jobspec/` ✓
-- `internal/transport/` ✓
-
-### Manual e2e
-- `ORCA_HOME=/tmp/orca-test-user ./bin/orca init` → creates `/tmp/orca-test-user` ✓
-- `./bin/orca --system init` → creates `/root/.orca` ✓
-- `ORCA_HOME=/custom ./bin/orca --system init` → error "conflicts with ORCA_HOME" ✓
-- `./bin/orca version --json` → `{"version":"v0.4.1",...}` ✓
-
-## Security Layer
-
-- No new secret handling. The namespace unification moves path resolution
-  but does not change cert/key file modes (0600/0644 per REQ-033 unchanged).
-- `--system` flag does not escalate privileges — it only changes the
-  namespace root path. Running as non-root with `--system` will fail at
-  `os.MkdirAll("/root/.orca")` with a permission error (expected).
-- No new network surface.
-
-## Quality Layer
-
-- **Backward compatibility**: empty `ORCA_HOME` + no `--system` → `~/.orca`
-  (identical to pre-v0.5 behavior). All existing tests pass unmodified.
-- **Single source of truth**: `certpaths.Dir()` is the only namespace root
-  resolver. `store.Open("")` and `init` both route through it.
-- **No redundant implementations**: the `--system` flag maps to `ORCA_HOME`
-  rather than introducing a parallel path mechanism.
-- **Documentation**: `docs/namespace.md` covers default, `ORCA_HOME`, and
-  `--system` with examples and resolution order.
-
-## Must-Haves Checklist
-
-- [x] `go test ./...` passes (including new namespace_test.go).
-- [x] `ORCA_HOME=/tmp/x orca init` creates `/tmp/x` (not `~/.orca`).
-- [x] `orca --system init` creates `/root/.orca` (when run as root).
-- [x] Empty `ORCA_HOME` + no `--system` → `~/.orca` (backward compat).
-- [x] `orca version --json` works (needed by install.sh in P2).
-
-## Verdict
-
-**PASS** — all 4 verification layers pass. REQ-041 and REQ-042 are
-satisfied. Ready to ship as `v0.4.2`.

.ciagent/PHASE1_VERIFICATION_v0.6.md

@@ -1,73 +0,0 @@
-# Phase 1 Verification — Orca v0.6 P01
-
-**Phase**: P01 — `orca init` Full Bootstrap + Schema 0006
-**REQ Coverage**: REQ-047, REQ-048, REQ-049
-**Verification date**: 2026-08-03
-**Result**: ✅ PASS (all 4 layers)
-
-## Structural Verification
-
-- ✅ `go build ./...` — PASS (no compile errors)
-- ✅ `go vet ./...` — PASS (no vet warnings)
-- ✅ `gofmt -l .` — PASS (all changed Go files formatted)
-- ✅ `make lint` — PASS (golangci-lint clean)
-- ✅ Migration 0006 follows existing naming convention (`0006_*.sql`)
-- ✅ `model.Node` struct follows existing field/tag conventions
-- ✅ `NodeRepo` methods follow existing error-wrapping + `scanner` pattern
-
-## Behavioral Verification
-
-### REQ-047: `orca init` auto-provisions CA + server cert + DB + localhost node
-- ✅ `TestInit_FullBootstrap`: init creates namespace dir, CA (ca.crt 0644 + ca.key 0600), server cert, DB (migrations 0001..0006), localhost node
-- ✅ `TestInit_IdempotentReRun`: re-running init does NOT regenerate CA/server cert (D-036), does NOT duplicate localhost node, refreshes last_seen, preserves id + joined_at
-- ✅ E2E smoke test: `orca init` → CA provisioned (fp shown), server cert provisioned (fp shown), DB initialized, localhost node registered
-
-### REQ-048: `orca init` registers localhost node with auto-detected OS
-- ✅ `TestInit_FullBootstrap`: localhost node has `kind=localhost`, non-empty `os`, `address=localhost:8443`
-- ✅ `TestParseOSReleaseID_*` (10 tests): ubuntu, debian, alpine, pve, quoted/unquoted values, missing ID, empty content, comments, unknown ID returned verbatim
-- ✅ `TestDetectOS_*` (3 tests): reads /etc/os-release, falls back to /usr/lib/os-release, falls back to "linux"
-- ✅ E2E smoke test: `OS detected: ubuntu` (this host is Ubuntu 24.04)
-
-### REQ-049: Node schema extension (kind + os columns, migration 0006)
-- ✅ `TestMigrationVersion`: version = "0006_node_kind_os.sql"
-- ✅ `TestNodeRepo_KindOS_RoundTrip`: insert with kind/os → get returns them correctly
-- ✅ `TestNodeRepo_NullKindOS_EmptyString`: NULL columns → `""` in Go struct (no nil-deref)
-- ✅ `TestNodeRepo_GetByName`: found by name, ErrNotFound for missing
-- ✅ `TestNodeRepo_UpdateLastSeenAndOS`: refreshes last_seen + os, preserves id + joined_at (D-036)
-- ✅ Existing node tests still pass (backward compatible)
-- ✅ `TestDBCheck_IntegrityOK`: doctor db check reports migration 0006
-
-## Security Verification
-
-- ✅ CA key file mode 0600 enforced (`TestInit_FullBootstrap` checks mode)
-- ✅ CA cert + server cert mode 0644 enforced (via `security.WriteCert`/`writeAtomic`)
-- ✅ No secrets in logs (init output shows fingerprint prefixes, not full keys)
-- ✅ `--json` output excludes private key material (only fingerprints)
-- ✅ No new external dependencies (P1 is pure Go stdlib + existing deps)
-
-## Quality Verification
-
-- ✅ `go test -race -count=1 ./internal/store/... ./internal/cli/... ./internal/model/... ./internal/doctor/...` — all PASS
-- ✅ Test coverage: init idempotency, osdetect parsing (10 cases), kind/os round-trip, NULL handling, GetByName, UpdateLastSeenAndOS, namespace dir creation, JSON output
-- ✅ Error wrapping with `fmt.Errorf("...: %w", err)` (REQ-018 convention)
-- ✅ `context.Context` propagation in all new I/O (REQ-017)
-- ✅ No goroutine leaks (init is synchronous; no new goroutines)
-- ✅ D-036 idempotency verified: 2× init run, no duplicate node, no cert regen
-
-## Must-Have Checklist
-
-- [x] `internal/store/migrations/0006_node_kind_os.sql`
-- [x] `internal/model/node.go` — Kind + OS fields + NodeKind constants
-- [x] `internal/store/node_repo.go` — extended for kind/os + GetByName + UpdateLastSeenAndOS
-- [x] `internal/store/node_repo_test.go` — new tests for kind/os + helpers
-- [x] `internal/cli/osdetect.go` — detectOS() from /etc/os-release
-- [x] `internal/cli/osdetect_test.go` — 13 parsing + detection tests
-- [x] `internal/cli/init.go` — full bootstrap sequence
-- [x] `internal/cli/init_test.go` — idempotency + bootstrap tests
-- [x] `internal/cli/namespace_test.go` — updated for new JSON format
-- [x] `internal/doctor/doctor_test.go` — updated for migration 0006
-- [x] `internal/store/migrate_test.go` — updated for migration 0006
-
-## Escalations
-
-None. All 4 verification layers pass cleanly.

.ciagent/PHASE1_VERIFICATION_v0.7.md

@@ -1,67 +0,0 @@
-# Phase 1 Verification Report — v0.7: Register `orca cert` Command Tree
-
-**Phase**: 1  
-**Branch**: `phase/01-cert-register`  
-**REQ Coverage**: REQ-053  
-**Milestone**: v0.7 (Hardening & Completion)
-
-## Structural Verification
-
-### Files Modified
-- `internal/cli/cert.go` — added `init()` registering `NewCommand` on `rootCmd` (AD-022)
-- `internal/cli/init_test.go` — updated expected migration version 0006 → 0007
-- `internal/doctor/doctor_test.go` — relaxed DB check assertion to check `"migrations up to"` prefix (migration-version-agnostic)
-- `internal/store/migrate_test.go` — updated expected migration version 0006 → 0007
-
-### Files Created
-- `internal/cli/cert_test.go` — regression test for cert command registration + subcommand tree
-- `internal/cli/cert_smoke_test.go` — end-to-end smoke test (ca-init, gen, show, fingerprint, renew, file modes)
-- `internal/store/cert_repo_test.go` — 11 tests covering Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + error paths
-- `internal/store/migrations/0007_certs_serial_unique.sql` — UNIQUE index on `certs.serial_hex` (I-107; migration-driven, not backfilled into 0004)
-
-## Behavioral Verification
-
-### Test Results
-```
-go test ./...               → all PASS (exit 0)
-go test -race ./...         → all PASS (exit 0)
-go vet ./...                → clean
-make build                  → clean (v0.6.0)
-```
-
-### Coverage (store package)
-- Store total: 60.5% (up from 46.9%)
-- `cert_repo.go`: Insert 91.7%, Get 100%, LatestForKind 100%, PruneOlderThan 85.7%, Delete 85.7%, List/ListByNode 81.8%
-
-### CLI Smoke Test (manual)
-```
-./bin/orca cert                    → prints help (was: "unknown command")
-./bin/orca cert ca-init --cn X     → ✓ CA initialized, 0644/0600 modes
-./bin/orca cert fingerprint --which ca → 64-char hex SHA-256
-```
-
-## Security Verification
-
-- `orca cert show` redacts private key material (REQ-035) — verified in smoke test
-- Cert file modes enforced: 0600 keys, 0644 certs (REQ-033) — verified in smoke test
-- No secrets in logs — `cert.ca_init`/`cert.issued`/`cert.renewed` log events contain only fingerprints, never key bytes
-- Migration 0007 is additive (UNIQUE index), backward-compatible — no data loss
-
-## Quality Verification
-
-- No new dependencies added (`go.mod` unchanged)
-- No comments added (per project convention)
-- Test style matches existing `node_repo_test.go` / `root_test.go` patterns
-- All `---ci---` blocks present in commits
-
-## Must-Haves Checklist
-
-- [x] `internal/cli/cert.go` — `init()` with `rootCmd.AddCommand(NewCommand(slog.Default()))`
-- [x] `internal/cli/cert_test.go` — regression test for registration + subcommands
-- [x] `internal/cli/cert_smoke_test.go` — e2e: ca-init, gen, show (redaction), fingerprint, renew, file modes
-- [x] `internal/store/cert_repo_test.go` — 11 tests covering full CRUD + rotation history + duplicate serial
-- [x] `internal/store/migrations/0007_certs_serial_unique.sql` — UNIQUE index (I-107)
-
-## Verdict
-
-**PASS** — all 4 verification layers (structural, behavioral, security, quality) pass. REQ-053 is fully covered. The `orca cert` command tree is now reachable from the CLI, cert_repo has comprehensive tests, and the serial_hex UNIQUE constraint is enforced via migration.

.ciagent/PHASE1_VERIFICATION_v0.8.md

@@ -1,55 +0,0 @@
-# Phase 1 Verification — v0.8 Coverage & Trust Hardening
-
-**Phase**: P01 — Coverage uplift round 2
-**Milestone**: v0.8
-**REQ**: REQ-057
-**Date**: 2026-08-04
-**Result**: ✅ PASS (all 4 layers)
-
-## Layer 1 — Structural ✅
-
-- `go build ./...` PASS (no compile errors)
-- `go vet ./...` PASS (no warnings)
-- No TODOs/FIXMEs/stubs in production code (the 3 pre-existing placeholders in `internal/cli/job.go:78`, `internal/engine/scheduler.go:115`, `internal/security/tls_config.go:90` are unchanged from v0.7 and out of scope for P01)
-- All test files resolve imports correctly
-- The proxmox `sessionRunner` seam (T01.1) is backward compatible — `BootstrapProxmox` callers unchanged
-
-## Layer 2 — Behavioral ✅
-
-- `go test ./...` PASS (all 14 packages)
-- `go test -race ./...` PASS (cli 98s, engine 47s, store 88s, transport 22s, all others fast)
-- Coverage targets met (T01.12):
-  - ≥70% floor: engine 88.9%, proxmox 87.1%, cli 76.2%, transport 93.0%, store 84.7%, jobspec 90.5%
-  - ≥50% floor: audit 100.0%, certpaths 100.0%, cmd/orca 80.0%
-- GRILL condition #3 escape valve NOT needed (cli hit 76.2%, above 70%)
-- T01.2 (conditional `peerDispatcher` seam) NOT added — engine reached 88.9% via httptest + stubs
-- REQ-057 covered: all 9 target packages hit their tiered floor
-
-## Layer 3 — Security ✅
-
-- P01 is a test-only phase (the only production change is T01.1's `sessionRunner` interface extraction + T01.11's `main()→run()` refactor)
-- No new input paths, no new network surfaces, no new crypto
-- The `sessionRunner` seam does not leak test concerns into production (default `sshSessionRunner` wraps the real SSH session; the seam is only injectable via the package-level var pattern matching `sshDialer`)
-- `cmd/orca/main.go` refactor: `run() int` returns exit code; `main()` calls `os.Exit(run())` — no security impact (same behavior, testable)
-- No secrets in test code (all test DBs use `:memory:` or temp dirs; no real credentials)
-
-## Layer 4 — Quality ✅
-
-- Tests follow existing conventions (table-driven, `t.Run` subtests, `t.Helper()` in setup funcs)
-- Reuse of existing helpers: `openTestDB`, `withFastWatch`, `initTestEnv`, `resetRootFlags`, `discardWriter`, `stubDispatcher` pattern
-- No flaky tests detected (all pass on repeated runs with `-race`)
-- Test file naming follows `*_test.go` convention
-- No over-testing: daemon.go excluded from cli coverage (covered by `internal/daemon/server_test.go`)
-- P0 issues: none. P1+ issues: none flagged.
-
-## Requirement Coverage
-
-| REQ | Status | Evidence |
-|-----|--------|----------|
-| REQ-057 | ✅ Complete | All 9 packages hit tiered floor; `go test -cover` confirms; `go test -race` PASS |
-
-## Lessons
-
-- The `sessionRunner` seam pattern (package-level var + default init in entry func) is the canonical way to add testability to orca's SSH-dependent packages. Future SSH-adjacent packages should follow it.
-- `httptest.NewTLSServer` sufficed for engine 70% without needing the conditional `peerDispatcher` seam — the plan's "only if needed" guard worked as intended.
-- The cli package's 84s test time is dominated by `--watch` integration tests with real poll intervals. Future coverage work should consider reducing the `withFastWatch` interval further or extracting the watch logic for unit-level testing.

.ciagent/PHASE2_VERIFICATION.md

@@ -1,85 +0,0 @@
-# Phase 2 Verification: install.sh + In-Place Update (v0.5 P2)
-
-**Phase**: 2 (install.sh + in-place update)
-**Milestone**: v0.5 Distribution
-**Requirements covered**: REQ-043, REQ-044, REQ-016 (completion)
-**Date**: 2026-08-03
-
-## Structural Layer
-
-- `gofmt -l .` → clean.
-- `go vet ./...` → clean.
-- `go build ./...` → succeeds.
-- New files: `scripts/install.sh`, `scripts/install_test.sh`, `docs/install.md`.
-- Modified files: `README.md`.
-- `install.sh` is executable (`chmod +x`).
-
-## Behavioral Layer
-
-### install_test.sh — 8/8 tests pass
-
-Run via `timeout 120 bash scripts/install_test.sh`:
-
-1. **Test 1: user-level install (v0.4.1)** ✓
-   - Binary at `~/.local/bin/orca` ✓
-   - `orca version --json` returns `v0.4.1` ✓
-2. **Test 2: in-place update (v0.4.1 → v0.4.2) preserves namespace** ✓
-   - "updated orca from v0.4.1 to v0.4.2" message printed ✓
-   - `~/.orca/orca.db` content preserved ("preserve-me") ✓
-   - Binary version updated to `v0.4.2` ✓
-3. **Test 3: idempotent re-install (v0.4.2 → v0.4.2)** ✓
-   - "reinstalled orca v0.4.2" message printed ✓
-4. **Test 4: --system install (root)** ✓
-   - Binary at `/usr/local/bin/orca` ✓
-   - Reports `namespace root: /root/.orca` ✓
-5. **Test 5: --system without root** — SKIP (running as root)
-
-### Manual e2e (real Gitea releases)
-- `curl -fsSL ... | bash` downloads v0.4.2 tarball, extracts, installs ✓
-- Re-run updates binary; namespace dir untouched ✓
-- `--version v0.4.1` pins to v0.4.1 ✓
-
-### Regression — Go tests
-- `internal/cli/` ✓ (cached, no regressions from P1)
-- `internal/store/` ✓
-- `internal/doctor/` ✓
-
-## Security Layer
-
-- `install.sh` does not `eval` remote content — it downloads a tarball
-  and extracts it with `tar -xzf`.
-- No secrets in the script. `GITEA_TOKEN` is not required (public repo,
-  anonymous download per REQ-045).
-- `.env` is not referenced by install.sh.
-- The script uses `set -euo pipefail` for fail-fast safety.
-- `curl -fsSL` fails on HTTP errors (no silent 404 downloads).
-
-## Quality Layer
-
-- **1-liner install**: `curl -fsSL <url> | bash` works (verified).
-- **--system flag**: installs to `/usr/local/bin`, namespace `/root/.orca`,
-  requires root (errors otherwise).
-- **--version pinning**: `--version vX.Y.Z` queries the specific release tag.
-- **In-place update (REQ-044)**: detects existing binary, reads version via
-  `orca version --json`, prints update message, overwrites binary, preserves
-  namespace dir. Idempotent.
-- **Env-overridable**: `GITEA_URL`, `GITEA_OWNER`, `GITEA_REPO` honor
-  pre-set env vars (`${VAR:-default}`) for testability.
-- **Timeout-guarded**: test harness uses `timeout 30` per test + `timeout 120`
-  overall + `trap 'kill 0' EXIT` to prevent orphaned processes.
-- **Documentation**: `docs/install.md` covers user/system install, version
-  pinning, in-place update, uninstall, and troubleshooting. README quickstart
-  updated with the 1-liner (REQ-016 completion).
-
-## Must-Haves Checklist
-
-- [x] `bash scripts/install_test.sh` passes (8/8).
-- [x] `curl -fsSL <url> | bash` works on a fresh system.
-- [x] `curl -fsSL <url> | bash -s -- --system` installs to `/usr/local/bin` (as root).
-- [x] Re-running updates the binary; `~/.orca/orca.db` preserved.
-- [x] README quickstart documents the 1-liner + `--system` variant.
-
-## Verdict
-
-**PASS** — all 4 verification layers pass. REQ-043, REQ-044, and REQ-016
-(completion) are satisfied. Ready to ship as `v0.4.3`.

.ciagent/PHASE2_VERIFICATION_v0.6.md

@@ -1,86 +0,0 @@
-# Phase 2 Verification — Orca v0.6 P02
-
-**Phase**: P02 — Proxmox SSH Join
-**REQ Coverage**: REQ-050, REQ-051
-**Verification date**: 2026-08-03
-**Result**: ✅ PASS (all 4 layers; integration test against real PVE deferred — unit tests cover all logic)
-
-## Structural Verification
-
-- ✅ `go build ./...` — PASS
-- ✅ `go vet ./...` — PASS
-- ✅ `gofmt -l .` — PASS (all Go files formatted)
-- ✅ `make lint` — PASS
-- ✅ `golang.org/x/crypto v0.54.0` added as direct dep (D-030); transitive: x/sys v0.47.0, x/term v0.45.0
-- ✅ `internal/proxmox` new package follows existing package layout conventions
-- ✅ `internal/security/sshkey.go` follows the CAInit pattern (idempotent fast-path, writeAtomic, mode enforcement)
-
-## Behavioral Verification
-
-### REQ-050: Proxmox SSH bootstrap via golang.org/x/crypto/ssh
-- ✅ `TestGenerateOrLoadSSHKey_Generates`: Ed25519 keygen, 0600/0644 modes, ssh-ed25519 pub format, ssh.ParsePrivateKey round-trip
-- ✅ `TestGenerateOrLoadSSHKey_IdempotentLoad`: second call loads existing (D-036)
-- ✅ `TestGenerateOrLoadSSHKey_CreatesDir`: nested dir creation
-- ✅ `TestBootstrapProxmox_Validation`: missing host → error, missing password → error
-- ✅ `TestDefaultOptions`: DefaultProxmoxUser=orca, DefaultProxmoxRole=OrcaOperator, DefaultSSHPort=22
-- ✅ CLI `--type proxmox --host ... --password ...` flag wiring verified via `orca node join --help`
-- ✅ Password from `--password` flag OR `$ORCA_PROXMOX_PASSWORD` env var (D-031)
-- ✅ TOFU host-key via `knownhosts.New` (D-035, avoids deprecated InsecureIgnoreHostKey)
-- ✅ File upload via session heredoc (no SFTP dep — D-030)
-
-### REQ-051: OrcaOperator role + orca@pam user + sudoers
-- ✅ `TestSudoersContent`: NOEXEC on pct/qm, NOPASSWD on apt-get/dpkg (no NOEXEC), pvesh excluded from command lines (AD-020)
-- ✅ `TestSudoersContent_CustomUser`: custom user name works
-- ✅ `TestOrcaOperatorPrivileges`: exactly 3 privileges (VM.Audit, Datastore.AllocateSpace, SDN.Use) space-separated (D-033)
-- ✅ `orca@pam` realm (AD-019 — not @pve)
-- ✅ `pveum` commands use `--privs` (space-separated), probe-then-add idempotency pattern
-- ✅ `visudo -cf` validation step aborts bootstrap on syntax error
-- ✅ Node registered with kind=proxmox, os=pve
-
-## Security Verification
-
-- ✅ SSH private key mode 0600 enforced (TestGenerateOrLoadSSHKey_Generates)
-- ✅ SSH public key mode 0644 enforced
-- ✅ Password never persisted (D-031) — used only for SSH auth, zeroed after use
-- ✅ Password from env var preferred over flag (reduces ps/proc exposure)
-- ✅ pvesh excluded from sudoers (AD-020 — API execute bypasses NOEXEC)
-- ✅ NOEXEC on pct/qm (blocks shell escapes via dynamically-linked perl)
-- ✅ TOFU host-key pinning (D-035) — capture on first connect, verify on subsequent, fail closed on mismatch
-- ✅ No secrets in logs (audit log entries contain host, user, role — never password)
-- ✅ sudoers file mode 0440 enforced (sudo requirement)
-
-## Quality Verification
-
-- ✅ `go test -race -count=1 ./internal/proxmox/... ./internal/security/... ./internal/cli/...` — all PASS
-- ✅ Test coverage: sshkey (4 tests), proxmox (5 tests), sudoers content (2 tests), privileges (1 test), validation (1 test), defaults (1 test)
-- ✅ Error wrapping with `fmt.Errorf("...: %w", err)` (REQ-018)
-- ✅ `context.Context` propagation (REQ-017)
-- ✅ Idempotency: all bootstrap steps probe-before-add (D-036)
-- ✅ New direct dep: 1 (golang.org/x/crypto) — matches D-030 minimal-deps rationale
-
-## Integration Test Note
-
-A live integration test against a real Proxmox VE 8/9 host is out of
-scope for automated CI (requires a PVE host + credentials). The SSH
-bootstrap logic is tested via:
-- Unit tests for command builders (sudoers content, privilege set)
-- Unit tests for validation (missing host/password)
-- Unit tests for SSH key generation (Ed25519, modes, idempotency)
-- Manual verification via `orca node join --help` (flag surface)
-
-A `// +build integration` test against a real PVE host can be added
-in a future phase if a PVE test environment becomes available.
-
-## Must-Have Checklist
-
-- [x] `go.mod` / `go.sum` — golang.org/x/crypto v0.54.0
-- [x] `internal/certpaths/certpaths.go` — SSHKeyPath, SSHPubPath, KnownHostsPath
-- [x] `internal/security/sshkey.go` — GenerateOrLoadSSHKey (Ed25519)
-- [x] `internal/proxmox/bootstrap.go` — BootstrapProxmox full SSH dance
-- [x] `internal/cli/node.go` — --type/--host/--password flag wiring + joinProxmox
-- [x] `internal/security/sshkey_test.go` — 4 tests
-- [x] `internal/proxmox/bootstrap_test.go` — 5 tests
-
-## Escalations
-
-None.

.ciagent/PHASE2_VERIFICATION_v0.7.md

@@ -1,68 +0,0 @@
-# Phase 2 Verification Report — v0.7: HCL Config File Parsing
-
-**Phase**: 2  
-**Branch**: `phase/02-config-parser`  
-**REQ Coverage**: REQ-054  
-**Milestone**: v0.7 (Hardening & Completion)
-
-## Structural Verification
-
-### Files Created
-- `internal/config/config.go` — `Config` struct (HCL tags), `CapacityConfig`, `Flags`, `Environ`, `Load(paths...)`, `(*Config).MergeOverrides(flags, env)`
-- `internal/config/config_test.go` — 11 tests (Load valid/missing/malformed/first-existing, MergeOverrides precedence all 4 layers, NodeCapacity)
-- `internal/config/testdata/config.hcl` — example fixture
-
-### Files Modified
-- `internal/cli/root.go` — added `--config` persistent flag, `configCtxKey`, `configFromCtx` helper; `PersistentPreRunE` loads config if `--config` set (AD-023)
-- `internal/cli/daemon.go` — daemon uses `cfg.ListenAddr` from config when flag is at default (`:8080`) (D-039 precedence: flag > config)
-- `internal/cli/root_test.go` — added `TestConfigFlagRegistered` + `TestConfigFlagLoadsFile`
-
-## Behavioral Verification
-
-### Test Results
-```
-go test ./...               → all PASS (exit 0)
-go test -race ./internal/config/... ./internal/cli/... → all PASS
-go vet ./...                → clean
-make build                  → clean (v0.6.1)
-```
-
-### API Surface
-```go
-func Load(paths ...string) (*Config, error)
-func (c *Config) MergeOverrides(flags Flags, env Environ) *Config
-```
-- `Load` returns zero `&Config{}` if no file exists (no error)
-- `MergeOverrides` precedence: flag > env > file > default (D-039)
-- No package-level state (AD-023)
-
-### CLI Verification
-```
-./bin/orca --help → shows --config string flag
-```
-
-## Security Verification
-
-- Config file is read-only (no writes); parsed via `hclsimple.Decode` (no eval, no external commands)
-- No secrets in config (paths only; no tokens/keys in config.hcl)
-- Config file permissions not enforced (operator's responsibility; config contains no secrets)
-
-## Quality Verification
-
-- No new dependencies (`hashicorp/hcl/v2` already in go.mod for jobspec)
-- No comments added (per project convention)
-- Test style matches existing `jobspec/spec_test.go` + `cli/root_test.go`
-- `go.mod` unchanged
-
-## Must-Haves Checklist
-
-- [x] `internal/config/config.go` — Config struct + Load + MergeOverrides
-- [x] `internal/config/config_test.go` — 11 tests (all 4 precedence layers)
-- [x] `internal/config/testdata/config.hcl` — example fixture
-- [x] `internal/cli/root.go` — `--config` persistent flag + context wiring
-- [x] `internal/cli/daemon.go` — uses `cfg.ListenAddr` (flag still wins)
-- [x] `internal/cli/root_test.go` — config flag registration + load test
-
-## Verdict
-
-**PASS** — all 4 verification layers pass. REQ-054 is fully covered. The `internal/config` package provides HCL config file parsing with flag > env > file > default precedence, wired into the root command via `--config` and consumed by the daemon.

.ciagent/PHASE2_VERIFICATION_v0.8.md

@@ -1,55 +0,0 @@
-# Phase 2 Verification — v0.8 Coverage & Trust Hardening
-
-**Phase**: P02 — SSH trust hardening
-**Milestone**: v0.8
-**REQs**: REQ-058, REQ-059 (+ latent TOFU bugfix closure)
-**Date**: 2026-08-04
-**Result**: ✅ PASS (all 4 layers)
-
-## Layer 1 — Structural ✅
-
-- `go build ./...` PASS
-- `go vet ./...` PASS
-- No TODOs/stubs in new production code
-- All new exports resolve: `security.SSHFingerprintSHA256`, `security.WriteAtomic`, `proxmox.TOFUHostKeyCallback`, `proxmox.ResetHostKey`, `proxmox.pinnedHostKeyCallback`, `proxmox.Options.HostKeyFingerprint`, `cli.nodeKeyResetCmd`
-- Backward compatible: existing `BootstrapProxmox` callers work (the TOFU fix changed failure→success on first connect, which is the bugfix)
-
-## Layer 2 — Behavioral ✅
-
-- `go test ./internal/proxmox/... ./internal/cli/... ./internal/doctor/... ./internal/security/...` PASS
-- `go test -race ./internal/proxmox/... ./internal/doctor/...` PASS
-- Coverage held post-P02: proxmox 86.5% (was 87.1% in P01 — marginal change from new code paths), cli 76.7% (was 76.2%), doctor 70.4% (unchanged)
-- T02.10: all 7 end-to-end integration cases PASS (pinned correct/wrong, TOFU first/second/mismatch, key-reset+re-pin, pre-populated migration path)
-- T02.11: `--host-key-fingerprint` non-proxmox validation PASS
-
-## Layer 3 — Security ✅
-
-- **REQ-058**: `--host-key-fingerprint` fails closed on mismatch (pinnedHostKeyCallback returns error on any mismatch; bootstrap aborts before any SSH session command runs). SHA256: prefix validated up front. No downgrade to TOFU when pin supplied.
-- **REQ-059**: `orca node key-reset` is local-only (D-046) — only rewrites `~/.orca/known_hosts` via `security.WriteAtomic` (atomic temp+rename, AD-029); does NOT touch remote authorized_keys. Audit-logs `node.key_reset` with actor+node+host.
-- **TOFU bugfix (T02.6, v0.6 ship-defect)**: first-connect now captures + writes the key (was silently failing). Mismatch detection preserved (MITM protection). The `TOFUHostKeyCallback` is shared between bootstrap (T02.6) and doctor (T02.9) — GRILL condition #2 parity satisfied.
-- STRIDE: no new spoofing surface (pin is operator-supplied, fail-closed); no tampering (atomic rewrite); no repudiation (audit log); no info disclosure (fingerprint is a hash, not the key); no DoS (no network change); no elevation (local file ops only).
-- No secrets in test code (fake SSH keys generated in-test).
-
-## Layer 4 — Quality ✅
-
-- Tests follow existing conventions (table-driven, `fakeSSHServer` fixture reused, `sshDialer`/`sessionRunner` seams injected)
-- `TOFUHostKeyCallback` extracted to a shared helper (no duplication between bootstrap + doctor) — clean coupling (proxmox doesn't import doctor)
-- P0 issues: none. P1+ issues: none flagged.
-
-## Requirement Coverage
-
-| REQ | Status | Evidence |
-|-----|--------|----------|
-| REQ-058 | ✅ Complete | `--host-key-fingerprint` flag (T02.3) + `pinnedHostKeyCallback` (T02.5) + `Result.HostKeyFingerprint` (T02.7) + e2e tests (T02.10) + validation (T02.11) |
-| REQ-059 | ✅ Complete | `orca node key-reset <node>` (T02.8) + `proxmox.ResetHostKey` atomic rewrite + audit log + e2e test (T02.10 case 6) |
-| (TOFU bugfix) | ✅ Complete | T02.6 fixes v0.6 ship-defect (first-connect `knownhosts.New` KeyError{Want:[]} treated as dial failure); T02.9 doctor parity |
-
-## GRILL Conditions Check
-
-- **#1 (T02.6 labeled v0.6 ship-defect)**: ✅ commit `8b0cbe1` summary "TOFU capture bug — v0.6 ship-defect first-connect join always failed"
-- **#2 (T02.9 doctor parity)**: ✅ both bootstrap (`8b0cbe1`) and doctor (`2dcb143`) use the shared `proxmox.TOFUHostKeyCallback` wrapper
-
-## Lessons
-
-- The v0.6 TOFU bug was a latent ship-defect: `knownhosts.New` returns `KeyError{Want:[]}` on first connect without writing, and the original code treated this as a dial failure. This means first-connect Proxmox join has been broken since v0.6 shipped — a strong argument for P01's coverage uplift (the 5.1% proxmox coverage hid this). v0.8 P03's `verify-reqs` would not have caught this (it's code-vs-doc drift, not doc-vs-doc) — P04 audit is the backstop.
-- Extracting `TOFUHostKeyCallback` to a shared helper was the right call for GRILL condition #2 — duplicating the wrapper in doctor would have created drift risk.

.ciagent/PHASE3_VERIFICATION.md

@@ -1,75 +0,0 @@
-# Phase 3 Verification: Docker Release (v0.5 P3)
-
-**Phase**: 3 (docker release)
-**Milestone**: v0.5 Distribution
-**Requirements covered**: REQ-046
-**Date**: 2026-08-03
-
-## Structural Layer
-
-- `go vet ./...` → clean.
-- `go build ./...` → succeeds.
-- New files: `Dockerfile`, `.dockerignore`, `docs/docker.md`.
-- Modified files: `.coreci.yml` (container-publish step), `scripts/release.sh` (docker publish).
-- `.dockerignore` excludes `.git`, `bin/`, `.env`, `.ciagent/`, `testdata/`, `*.tar.gz`.
-
-## Behavioral Layer
-
-### Docker build
-- `docker build --build-arg VERSION=v0.4.4-test ... -t orca-test:v0.4.4 .` → succeeds.
-- Multi-stage build: `golang:1.25` (builder) → `gcr.io/distroless/static-debian12:nonroot` (runtime).
-- `CGO_ENABLED=0` guarantees static binary (modernc/sqlite is pure Go).
-
-### Docker run
-- `docker run --rm orca-test:v0.4.4 version` → `orca version v0.4.4-test` ✓
-- `docker run --rm orca-test:v0.4.4 version --json` → valid JSON with version/commit/build_time ✓
-- `docker run --rm -v orca-test-data:/var/lib/orca orca-test:v0.4.4 init` → creates `/var/lib/orca` ✓
-- Volume persistence: state dir created in named volume, verified with alpine container ✓
-
-### Image metrics
-- Image size: 27.9MB (distroless static + Go binary).
-- Runs as `nonroot` user (distroless default).
-- `ENV ORCA_HOME=/var/lib/orca` set for volume-mountable state.
-
-### .coreci.yml release pipeline
-- New `container-publish` step added after `gitea-release`.
-- Uses `docker:24-cli` image with `GITEA_TOKEN` as registry credential.
-- Builds, tags (`<version>` + `latest`), logs in, pushes, logs out.
-
-### scripts/release.sh extension
-- After Gitea release: `docker build` + `docker login` + `docker push`.
-- Skips gracefully if `docker` not on PATH (local dev without docker).
-- Skips push if `GITEA_TOKEN` not set (builds locally only).
-- Env-overridable: `CONTAINER_REGISTRY`, `CONTAINER_OWNER`, `CONTAINER_IMAGE`.
-
-### Regression — Go tests
-- `internal/cli/` ✓ (cached)
-- `internal/store/` ✓ (cached)
-
-## Security Layer
-
-- `.dockerignore` excludes `.env`, `.gitleaks-baseline.json`, `bin/` — no secrets in image.
-- Image runs as `nonroot` (distroless default) — least privilege.
-- `docker login` uses `--password-stdin` (no password in process args / shell history).
-- `docker logout` after push — no credential leakage.
-- No secret material baked into the image — `GITEA_TOKEN` is used at push time only, not in the build.
-
-## Quality Layer
-
-- **Reproducible build**: `--build-arg VERSION/GIT_COMMIT/BUILD_TIME` injected via `-ldflags`.
-- **Minimal image**: distroless static-debian12 — no shell, no package manager, ~28MB total.
-- **Graceful degradation**: `release.sh` skips docker publish when docker is absent.
-- **CI integration**: `.coreci.yml` container-publish step uses `docker:24-cli` (has docker CLI).
-- **Documentation**: `docs/docker.md` covers pull, run, state persistence, local build, manual publish.
-
-## Must-Haves Checklist
-
-- [x] `docker build -t orca-test .` succeeds locally.
-- [x] `docker run --rm orca-test version` prints the version.
-- [x] `scripts/release.sh vX.Y.Z` publishes both the Gitea release AND the container image.
-- [x] `.coreci.yml` release pipeline includes the container-publish step.
-
-## Verdict
-
-**PASS** — all 4 verification layers pass. REQ-046 is satisfied. Ready
-to ship as `v0.4.4`.

.ciagent/PHASE3_VERIFICATION_v0.6.md

@@ -1,62 +0,0 @@
-# Phase 3 Verification — Orca v0.6 P03
-
-**Phase**: P03 — Doctor Extensions + Audit Logging
-**REQ Coverage**: REQ-052
-**Verification date**: 2026-08-03
-**Result**: ✅ PASS (all 4 layers)
-
-## Structural Verification
-
-- ✅ `go build ./...` — PASS
-- ✅ `go vet ./...` — PASS
-- ✅ `gofmt -l .` — PASS
-- ✅ `make lint` — PASS
-- ✅ `internal/osdetect` new shared package (extracted from cli to avoid import cycle)
-- ✅ `doctor.OS()` and `doctor.Proxmox()` follow existing check pattern (Check struct, Result, Run func)
-- ✅ `doctor.All()` extended with OS + Proxmox in logical order
-
-## Behavioral Verification
-
-### REQ-052: doctor os + doctor proxmox + audit logging
-- ✅ `TestOSCheck_MissingLocalhostNode`: no localhost node → FAIL with clear message
-- ✅ `TestOSCheck_Match`: stored os matches detected → PASS
-- ✅ `TestOSCheck_Drift`: stored os differs from detected → WARN ("OS drift: init=debian, now=ubuntu")
-- ✅ `TestProxmoxCheck_NoProxmoxNodes`: zero proxmox nodes → WARN ("no proxmox nodes registered")
-- ✅ `TestProxmoxCheck_UnreachableNode`: unreachable proxmox node → FAIL with node name
-- ✅ E2E: `orca doctor os` → PASS (os=ubuntu matches)
-- ✅ E2E: `orca doctor proxmox` → WARN (no proxmox nodes)
-- ✅ E2E: `orca doctor os --json` → valid JSON
-- ✅ E2E: `orca doctor` (full) → 6 PASS / 1 WARN / 1 FAIL (network=daemon not running, expected)
-- ✅ osdetect package: 11 tests (ubuntu/debian/alpine/pve parsing, quoted/unquoted, missing ID, comments, fallback)
-- ✅ Audit logging: proxmox.BootstrapProxmox emits `proxmox.bootstrap_ok` (P02); doctor checks are read-only
-
-## Security Verification
-
-- ✅ Doctor checks are strictly read-only (no state changes)
-- ✅ SSH probe uses orca SSH key (not password) — no password in doctor flow
-- ✅ TOFU host-key verification via knownhosts.New (D-035)
-- ✅ 3s timeout per proxmox probe (D-038 bounded-probe-timeout pattern)
-- ✅ No secrets in doctor output (fingerprints only, never private keys)
-
-## Quality Verification
-
-- ✅ `go test -race -count=1 ./...` — all PASS (13 packages)
-- ✅ Test coverage: osdetect (11 tests), doctor OS (3 tests), doctor Proxmox (2 tests)
-- ✅ Error wrapping with `fmt.Errorf("...: %w", err)` (REQ-018)
-- ✅ `context.Context` propagation (REQ-017)
-- ✅ No goroutine leaks (netDialer cleans up on ctx cancellation)
-- ✅ D-036: doctor os handles pre-0006 rows (empty os field → WARN)
-
-## Must-Have Checklist
-
-- [x] `internal/osdetect/osdetect.go` — Detect + ParseID (shared package)
-- [x] `internal/osdetect/osdetect_test.go` — 11 tests
-- [x] `internal/cli/osdetect.go` — thin wrapper
-- [x] `internal/cli/osdetect_test.go` — delegation test
-- [x] `internal/doctor/doctor.go` — OS() + Proxmox() checks, All() extended
-- [x] `internal/doctor/doctor_test.go` — 5 new tests
-- [x] `internal/cli/doctor.go` — doctor os + doctor proxmox subcommands
-
-## Escalations
-
-None.

.ciagent/PHASE3_VERIFICATION_v0.7.md

@@ -1,76 +0,0 @@
-# Phase 3 Verification Report — v0.7: Test Coverage Uplift
-
-**Phase**: 3  
-**Branch**: `phase/03-coverage-uplift`  
-**REQ Coverage**: REQ-055  
-**Milestone**: v0.7 (Hardening & Completion)
-
-## Structural Verification
-
-### Files Created
-- `internal/engine/peer_test.go` — 8 tests (PeerRegistry Add/Get/Remove/All/Len/UpdateLastSeen + validation)
-- `internal/engine/executor_test.go` — 7 tests (Submit success/missing-command/malformed/failing, Status not-found, Run success, Run context-cancel)
-- `internal/engine/dispatcher_test.go` — 10 tests (empty spec, idempotency hit, local-capacity, explicit-target, no-peers, LocalSubmit/LocalStatus, nil guards, parseInlineSpec)
-- `internal/audit/audit_test.go` — 9 tests (Emit/EmitWithErr persistence, LogHandshakeOK/Failed slog fields, nil-safety, Action/Result String, FormatAction)
-- `internal/transport/handshake_log_test.go` — 8 tests (LogHandshakeOK/Failed/FromCert, FingerprintOfCert, nil-logger, nil-err)
-- `internal/transport/mtls_test.go` — 14 tests (ServerTLSConfig, ClientTLSConfig, NewMTLSClient, Do, VerifyPeerCertificate, DialContext)
-- `internal/transport/dispatch_test.go` — 24 tests (SubmitHandler/StatusHandler, DispatchClient constructor/connection-refused/HTTP/decode/Submit/Status success)
-- `internal/proxmox/ssh_session_test.go` — 14 tests (runRemote, deployPubKey, createLinuxUser, createPVERole, createPVEUser, assignPVEACL, writeSudoers, validateSudoers, full BootstrapProxmox)
-
-### Files Modified
-- `internal/transport/dispatch.go` — **bug fix**: `bytesReadCloser.Read` returned `fmt.Errorf("EOF")` instead of `io.EOF`, breaking HTTP request body transmission. This was a latent bug that prevented any client-side dispatch from working end-to-end.
-- `internal/proxmox/bootstrap_test.go` — extended with 10 new tests (mockSSHDialer, SSH auth failure, dial-addr/port/user propagation, SSH key generation, known_hosts, nil/custom logger, cancelled context, deployPubKey edge cases)
-
-## Behavioral Verification
-
-### Test Results
-```
-go test ./...               → all PASS (exit 0)
-go test -race ./...         → all PASS (exit 0)
-go vet ./...                → clean
-make build                  → clean
-```
-
-### Coverage (D-042 target: ≥ 50% per package)
-
-| Package | Before | After | Target |
-|---------|--------|-------|--------|
-| `internal/engine` | 8.3% | **65.1%** | 50% ✓ |
-| `internal/transport` | 26.3% | **84.6%** | 50% ✓ |
-| `internal/proxmox` | 5.1% | **82.7%** | 50% ✓ |
-| `internal/audit` | 0% | **100.0%** | 50% ✓ |
-
-All 4 packages exceed the 50% floor (AD-025).
-
-### Total new tests: 94 (37 engine+audit + 57 transport+proxmox)
-
-## Security Verification
-
-- The `dispatch.go` bug fix (`io.EOF` vs `fmt.Errorf("EOF")`) is a correctness fix — HTTP request bodies now terminate correctly. No security implications (the bug caused requests to fail, not to leak data).
-- No new dependencies added.
-- Test fixtures use temp dirs (`t.TempDir()`) — no persistent state.
-- No secrets in test code (SSH keys are test-generated Ed25519 pairs).
-
-## Quality Verification
-
-- No comments added (per project convention).
-- Test style matches existing patterns (`scheduler_test.go`, `node_repo_test.go`, `certgen_test.go`).
-- `go.mod` unchanged.
-- Bug fix in `dispatch.go` is minimal (1 line: `return fmt.Errorf("EOF")` → `return io.EOF` + `io` import).
-
-## Must-Haves Checklist
-
-- [x] `internal/engine/executor_test.go` — 7 tests
-- [x] `internal/engine/dispatcher_test.go` — 10 tests
-- [x] `internal/engine/peer_test.go` — 8 tests
-- [x] `internal/transport/mtls_test.go` — 14 tests
-- [x] `internal/transport/dispatch_test.go` — 24 tests
-- [x] `internal/transport/handshake_log_test.go` — 8 tests
-- [x] `internal/audit/audit_test.go` — 9 tests
-- [x] `internal/proxmox/ssh_session_test.go` — 14 tests + extended `bootstrap_test.go` (+10 tests)
-- [x] Bug fix: `dispatch.go` bytesReadCloser EOF (latent bug, root-caused during P03)
-- [x] All 4 target packages ≥ 50% coverage
-
-## Verdict
-
-**PASS** — all 4 verification layers pass. REQ-055 is fully covered. All 4 target packages exceed the 50% coverage floor (engine 65.1%, transport 84.6%, proxmox 82.7%, audit 100%). A latent bug in `dispatch.go` (non-`io.EOF` return) was found and fixed during coverage uplift.

.ciagent/PHASE3_VERIFICATION_v0.8.md

@@ -1,51 +0,0 @@
-# Phase 3 Verification — v0.8 Coverage & Trust Hardening
-
-**Phase**: P03 — Requirements-hygiene gate
-**Milestone**: v0.8
-**REQ**: REQ-060
-**Date**: 2026-08-04
-**Result**: ✅ PASS (all 4 layers)
-
-## Layer 1 — Structural ✅
-
-- `go build ./...` PASS
-- `go vet ./...` PASS
-- `cmd/verify-reqs/main.go` (~180 LOC, stdlib only) compiles + links
-- All exports resolve: `verify(roadmapPath, reqsPath) (diff []string, count int, err error)`
-- No new dependencies
-
-## Layer 2 — Behavioral ✅
-
-- `go test ./cmd/verify-reqs/...` PASS (7 golden-file tests: clean, multi-drift, default-args, malformed, missing-file, v0.2-substring-tolerant, real-repo regression)
-- `make verify-reqs` → exit 0 on the current repo (`✓ 60 requirements consistent with roadmap`)
-- T03.5 synthetic drift verification: scratch flip of REQ-053 → `make verify-reqs` exit 1 + `REQ-053: status=Pending, expected=Complete (direction=forward)`; revert → exit 0
-- `go test ./...` PASS (all 16 packages)
-- Forward + reverse assertions both exercised (golden test `TestVerify_drift` asserts `direction=reverse` for REQ-003)
-
-## Layer 3 — Security ✅
-
-- verify-reqs is a static doc-consistency checker — no network, no secrets, no input injection (markdown is parsed with `regexp` over local files only)
-- `.coreci.yml` step runs in the existing `golang:1.25` container (no new image, no new permissions)
-- No STRIDE surface added
-
-## Layer 4 — Quality ✅
-
-- Testable core (`verify()` function) + thin `main()` — follows the `cmd/orca/main.go` → `run()` pattern from T01.11
-- Golden-file test fixtures cover the substring-tolerant regex regression (v0.2 header variant)
-- GRILL condition #4 satisfied: substring-tolerant regex + reverse-direction assertion + scope note (doc-vs-doc only)
-- P0 issues: none. P1+ issues: none flagged.
-
-## Requirement Coverage
-
-| REQ | Status | Evidence |
-|-----|--------|----------|
-| REQ-060 | ✅ Complete | `cmd/verify-reqs` (T03.1) + golden tests (T03.2) + `make verify-reqs` (T03.3) + `.coreci.yml` validate hook (T03.4) + synthetic drift verification (T03.5) |
-
-## GRILL Conditions Check
-
-- **#4 (verify-reqs regex + reverse direction)**: ✅ substring-tolerant regex matches v0.2's `**COMPLETE (merged to main via v0.3)**` header (golden test `TestVerify_v0_2_substring_tolerant`); reverse-direction assertion implemented + tested; scope note documented in the commit + the verification report.
-
-## Lessons
-
-- The two-regex parser (one for REQ rows, one for milestone-complete headers) with substring tolerance is the right shape — a single strict regex would have silently exempted v0.2 (the exact drift the GRILL flagged).
-- Refactoring `main()` into a testable `verify()` function made golden-file testing trivial (no subprocess orchestration). This mirrors the T01.11 `main()→run()` pattern and should be the house style for all `cmd/` programs.

.ciagent/PHASE4_VERIFICATION_v0.7.md

@@ -1,64 +0,0 @@
-# Phase 4 Verification Report — v0.7: --pprof Opt-in on orca daemon
-
-**Phase**: 4  
-**Branch**: `phase/04-pprof-daemon`  
-**REQ Coverage**: REQ-056  
-**Milestone**: v0.7 (Hardening & Completion)
-
-## Structural Verification
-
-### Files Created
-- `internal/daemon/pprof.go` — `StartPprof(addr, log) (*http.Server, error)`: dedicated mux + server, disabled by default, WARN log
-- `internal/daemon/pprof_test.go` — 5 tests (disabled, enabled, shutdown, mux isolation, full server lifecycle)
-- `internal/cli/daemon_test.go` — `TestDaemonPprofFlag` (flag registration + default)
-
-### Files Modified
-- `internal/daemon/server.go` — `PprofAddr` in Options, `pprofServer` field, `NewServer` starts pprof, `Shutdown` stops both
-- `internal/cli/daemon.go` — `--pprof` flag, `PprofAddr` in daemon.Options, conditional startup output line
-
-## Behavioral Verification
-
-### Test Results
-```
-go test ./...               → all PASS (exit 0)
-go test -race ./internal/daemon/... ./internal/cli/... → all PASS
-go vet ./...                → clean
-make build                  → clean
-```
-
-### CLI Verification
-```
-./bin/orca daemon --help → shows --pprof string flag (default "")
-```
-
-### Live Smoke Test
-- `--pprof 127.0.0.1:16060` → WARN logged, `/debug/pprof/` returns 200, `/debug/pprof/cmdline` 200, `/debug/pprof/heap` 200
-- `/healthz` on pprof listener → 404 (mux isolation confirmed, AD-024)
-- Clean shutdown stops both servers
-
-## Security Verification
-
-- pprof on a **separate** `*http.Server` + `*http.ServeMux`, never on the mTLS daemon listener (AD-024) — verified by `TestStartPprof_MuxIsolated` (`/healthz` returns 404 on pprof mux)
-- Default **disabled** — no pprof listener unless `--pprof` is explicitly set
-- WARN log on startup: "unauthenticated, operator-only — do not expose publicly"
-- No `import _ "net/http/pprof"` side-effect registration on `DefaultServeMux` — all handlers explicitly registered on the dedicated mux
-
-## Quality Verification
-
-- No new dependencies (stdlib `net/http`, `net/http/pprof`, `log/slog`, `time` only)
-- No comments added (per project convention)
-- `go.mod` unchanged
-- Test style matches existing `server_test.go`
-
-## Must-Haves Checklist
-
-- [x] `internal/daemon/pprof.go` — `StartPprof` with dedicated mux, all pprof handlers
-- [x] `internal/daemon/server.go` — `PprofAddr` in Options, `pprofServer` field, lifecycle integration
-- [x] `internal/cli/daemon.go` — `--pprof` flag, passed to Options, conditional startup output
-- [x] `internal/daemon/pprof_test.go` — 5 tests (disabled, enabled, shutdown, mux isolation, lifecycle)
-- [x] `internal/cli/daemon_test.go` — flag registration test
-- [x] AD-024: pprof mux separate from mTLS daemon mux (verified by test)
-
-## Verdict
-
-**PASS** — all 4 verification layers pass. REQ-056 is fully covered. The `--pprof` opt-in endpoint runs on a separate listener with a dedicated mux, is disabled by default, and logs a WARN when enabled. I-308 (deferred since v0.2) is now implemented.

.ciagent/PLAN_v0.5.md

@@ -1,175 +0,0 @@
----
-milestone: v0.5
-milestone_slug: distribution
-type: feature
-phase_count: 4
----
-
-# Plan: Orca v0.5 — Distribution
-
-Vertical-slice plan for the v0.5 Distribution milestone. Each phase is a
-vertical slice that ships independently as a patch on the v0.4.x line.
-The final phase (P4) is the milestone release (promoted to v0.5.0).
-
-## Requirement → Phase Mapping
-
-| REQ | Phase | Priority |
-|-----|-------|----------|
-| REQ-045 (public releases) | P0 ship (operational) | High |
-| REQ-041 (ORCA_HOME unified namespace) | P1 | High |
-| REQ-042 (--system flag) | P1 | High |
-| REQ-043 (install.sh 1-liner) | P2 | High |
-| REQ-044 (in-place update) | P2 | High |
-| REQ-046 (docker release) | P3 | Medium |
-| REQ-016 (README quickstart) | P2 | Medium (completion) |
-
-## Phase 1 — Namespace Unification (REQ-041, REQ-042)
-
-**Goal**: Single `ORCA_HOME` env var as namespace root for all
-on-disk state; `--system` flag selects `/root/.orca`.
-
-**Persona**: backend-engineer (store/certpaths routing) + cli-engineer
-(`--system` flag).
-
-**Wave 1** (single wave — no inter-task dependencies):
-
-| Task | File(s) | Persona | REQ |
-|------|---------|---------|-----|
-| T1.1: Route `store.Open("")` through `certpaths.DBPath()` | `internal/store/store.go` | backend-engineer | REQ-041 |
-| T1.2: Route `init` command through `certpaths.Dir()` | `internal/cli/init.go` | backend-engineer | REQ-041 |
-| T1.3: Add `--system` persistent flag on `rootCmd` + `PersistentPreRunE` that sets `ORCA_HOME=/root/.orca` | `internal/cli/root.go` | cli-engineer | REQ-042 |
-| T1.4: Add `namespace_test.go` covering user-level, `ORCA_HOME` override, `--system` | `internal/cli/namespace_test.go` | cli-engineer | REQ-041/042 |
-| T1.5: Update `docs/namespace.md` (paths reference) | `docs/namespace.md` | backend-engineer | REQ-041 |
-
-**Must-haves**:
-- `go test ./...` passes (including new namespace_test.go).
-- `ORCA_HOME=/tmp/x orca init` creates `/tmp/x` (not `~/.orca`).
-- `orca --system init` creates `/root/.orca` (when run as root).
-- Empty `ORCA_HOME` + no `--system` → `~/.orca` (backward compat).
-
-**Verification**: 4-layer (structural: gofmt/vet; behavioral: namespace_test
-+ existing doctor_test; security: no new secret surface; quality: no
-regression in existing tests).
-
-**Ship**: tag `v0.4.2`.
-
-## Phase 2 — install.sh + In-Place Update (REQ-043, REQ-044, REQ-016)
-
-**Goal**: 1-liner installer from public Gitea releases; idempotent
-update-in-place; README quickstart.
-
-**Persona**: devops-engineer.
-
-**Wave 1**:
-
-| Task | File(s) | Persona | REQ |
-|------|---------|---------|-----|
-| T2.1: Write `scripts/install.sh` (curl 1-liner, user/system, latest/pinned, in-place update) | `scripts/install.sh` | devops-engineer | REQ-043/044 |
-| T2.2: Write `scripts/install_test.sh` (mocked download, path verification, update-in-place) | `scripts/install_test.sh` | devops-engineer | REQ-043/044 |
-| T2.3: Update README quickstart with 1-liner install + `--system` variant | `README.md` | devops-engineer | REQ-016 |
-| T2.4: Write `docs/install.md` (full install reference, troubleshooting, ORCA_HOME) | `docs/install.md` | devops-engineer | REQ-043 |
-
-**install.sh spec** (per R-006):
-- Default: user-level. Binary → `~/.local/bin/orca`. Namespace → `~/.orca`.
-- `--system`: binary → `/usr/local/bin/orca`, namespace → `/root/.orca`. Requires root (uid 0).
-- `--version vX.Y.Z`: pin version. Default: query `/api/v1/repos/coreci/orca/releases/latest`.
-- Download `orca-{tag}-linux-{arch}.tar.gz` from the release asset.
-- In-place update: if `orca` exists at install path, run `orca version --json`,
-  parse `version`, print "updated from X to Y". Overwrite binary. **Never**
-  touch the namespace dir.
-- Detect arch: `amd64` (x86_64), `arm64` (aarch64).
-- Idempotent: re-running with same version is a no-op (or reinstalls).
-
-**Must-haves**:
-- `bash scripts/install_test.sh` passes (mocked).
-- `curl -fsSL <url> | bash` works on a fresh system (verified in P4 e2e).
-- `curl -fsSL <url> | bash -s -- --system` installs to `/usr/local/bin` (as root).
-- Re-running updates the binary; `~/.orca/orca.db` preserved.
-
-**Verification**: 4-layer (structural: shellcheck; behavioral:
-install_test.sh; security: no secret in script, no eval of remote
-content beyond the script itself; quality: idempotent).
-
-**Ship**: tag `v0.4.3`.
-
-## Phase 3 — Docker Release (REQ-046)
-
-**Goal**: Multi-stage Dockerfile; publish to Gitea container registry
-per release.
-
-**Persona**: devops-engineer.
-
-**Wave 1**:
-
-| Task | File(s) | Persona | REQ |
-|------|---------|---------|-----|
-| T3.1: Write `Dockerfile` (multi-stage: golang:1.25 → distroless/static-debian12) | `Dockerfile` | devops-engineer | REQ-046 |
-| T3.2: Extend `scripts/release.sh` with docker build + login + push | `scripts/release.sh` | devops-engineer | REQ-046 |
-| T3.3: Add `container-publish` step to `.coreci.yml` release pipeline | `.coreci.yml` | devops-engineer | REQ-046 |
-| T3.4: Write `docs/docker.md` (docker run quickstart, volume mounts, ORCA_HOME) | `docs/docker.md` | devops-engineer | REQ-046 |
-| T3.5: Add `.dockerignore` (exclude .git, bin, .env, *.tar.gz) | `.dockerignore` | devops-engineer | REQ-046 |
-
-**Dockerfile spec** (per R-005):
-- Stage 1 (`golang:1.25`): `CGO_ENABLED=0 go build -trimpath -ldflags=... -o /orca ./cmd/orca`.
-- Stage 2 (`gcr.io/distroless/static-debian12:nonroot`): `COPY --from=builder /orca /orca`, `ENV ORCA_HOME=/var/lib/orca`, `ENTRYPOINT ["/orca"]`.
-- `ARG VERSION` + `ARG GIT_COMMIT` + `ARG BUILD_TIME` for ldflags injection.
-- Image runs as `nonroot` user (distroless default) — `ORCA_HOME=/var/lib/orca` must be volume-mounted.
-
-**release.sh extension**:
-- After Gitea release: `docker build --build-arg VERSION=$VERSION ... -t git.cloudinit.dev/coreci/orca:$VERSION -t git.cloudinit.dev/coreci/orca:latest .`
-- `echo "$GITEA_TOKEN" | docker login git.cloudinit.dev -u cloudinit-bot --password-stdin`
-- `docker push git.cloudinit.dev/coreci/orca:$VERSION` + `docker push git.cloudinit.dev/coreci/orca:latest`
-- Skip gracefully if `docker` not on PATH (local dev without docker).
-
-**.coreci.yml extension**:
-- New step `container-publish` in the `release` pipeline, using an image with docker CLI (e.g., `docker:24-cli` with docker-in-docker service, or a custom image). Per P-001 pitfall.
-
-**Must-haves**:
-- `docker build -t orca-test .` succeeds locally.
-- `docker run --rm orca-test version` prints the version.
-- `scripts/release.sh vX.Y.Z` publishes both the Gitea release AND the container image.
-- `.coreci.yml` release pipeline includes the container-publish step.
-
-**Verification**: 4-layer (structural: Dockerfile lint; behavioral: docker
-build + run; security: no secret in image, .env excluded; quality:
-reproducible build via ARGs).
-
-**Ship**: tag `v0.4.4`.
-
-## Phase 4 — Final Review + Ship + Audit (Milestone Release)
-
-**Goal**: Multi-persona review, audit, milestone ship.
-
-**Tasks**:
-| Task | Persona | Detail |
-|------|---------|--------|
-| T4.1: `ciagent-review` | all | Review P1-P3 changes across personas |
-| T4.2: `ciagent-audit` | lead-developer | Reconstruction test, file/branch/commit discipline |
-| T4.3: End-to-end verification | lead-developer | Unauth curl to releases API (REQ-045 ✓), fresh install.sh (REQ-043 ✓), `--system` (REQ-042 ✓), update-in-place (REQ-044 ✓), docker pull+run (REQ-046 ✓) |
-| T4.4: Milestone ship | lead-developer | Merge phase/04 → milestone/v0.5 → main, tag v0.4.5, create milestone release, build + upload all artifacts |
-| T4.5: Complete milestone | lead-developer | Update REQUIREMENTS.md (REQ-041..046 complete), ROADMAP.md (v0.5 complete), clear CHECKPOINT.json |
-
-**Ship**: tag `v0.4.5` (the milestone release, promoted to `v0.5.0`).
-
-## Wave Ordering Summary
-
-All 4 phases are single-wave (no inter-phase dependencies within a
-phase). Phases execute strictly sequentially: P1 → P2 → P3 → P4.
-
-- **P1** (Wave 1): T1.1..T1.5 — namespace unification.
-- **P2** (Wave 1): T2.1..T2.4 — install.sh.
-- **P3** (Wave 1): T3.1..T3.5 — docker.
-- **P4** (Wave 1): T4.1..T4.5 — review + ship.
-
-## Versioning
-
-- P0 ship: `v0.4.1` (first patch on v0.4.x line after v0.4.0 milestone tag).
-- P1 ship: `v0.4.2`.
-- P2 ship: `v0.4.3`.
-- P3 ship: `v0.4.4`.
-- P4 ship: `v0.4.5` (final phase = milestone release, promoted to `v0.5.0`).
-
-Tags run on the v0.4.x line (previous minor). The milestone branch label
-is `milestone/v0.5-distribution`. No separate minor tag — the final
-phase's patch IS the milestone release per `run.md` versioning logic
-for feature milestones.

.ciagent/PLAN_v0.6.md

@@ -1,236 +0,0 @@
-# Phase Plans: Orca v0.6 — Node Bootstrap & Proxmox
-
-All 3 execution phases + final review with vertical-slice structure,
-wave ordering, and REQ-ID mapping. v0.6 scope: **Node Bootstrap &
-Proxmox** — `orca init` full bootstrap, Proxmox SSH join, doctor
-extensions.
-
-Branching: branches numbered from phase 12 onward (v0.1 used 01-07,
-v0.2 used 08-11, v0.3 used 00+01-03, v0.5 used 00+01-04). v0.6 uses
-`phase/01-*`..`phase/04-*` on the `milestone/v0.6-node-bootstrap-proxmox`
-branch (numbering restarts per milestone per branch-strategy.md).
-
----
-
-## Phase 1: `orca init` Full Bootstrap + Schema 0006 (Wave 1)
-
-**Branch**: `phase/01-init-bootstrap`
-**REQ Coverage**: REQ-047, REQ-048, REQ-049
-**Persona leads**: data-engineer (schema), backend-engineer (init orchestration), cli-engineer (output UX)
-
-### Must-Haves
-
-#### data-engineer territory
-- [ ] `internal/store/migrations/0006_node_kind_os.sql` — `ALTER TABLE nodes ADD COLUMN kind TEXT; ALTER TABLE nodes ADD COLUMN os TEXT;` (nullable, backward-compatible)
-- [ ] `internal/model/node.go` — add `Kind string `json:"kind,omitempty"`` + `OS string `json:"os,omitempty"`` fields; add `NodeKind` constants (`NodeKindLocalhost`, `NodeKindLinux`, `NodeKindProxmox`)
-- [ ] `internal/store/node_repo.go` — extend `Insert`/`Get`/`List`/`Watch`/`scanNode` for `kind, os` columns (use `sql.NullString`, map NULL → `""`); add `GetByName(ctx, name) (*Node, error)` and `UpdateLastSeenAndOS(ctx, id, os string) error` helpers
-- [ ] `internal/store/node_repo_test.go` — extend tests for new columns + helpers; assert NULL → `""` mapping; assert `GetByName` returns `ErrNotFound` for missing; assert `UpdateLastSeenAndOS` refreshes `last_seen` + `os` without changing `id`/`joined_at`
-
-#### backend-engineer territory
-- [ ] `internal/cli/init.go` — full bootstrap sequence (replace current 35-line mkdir-only impl):
-  - [ ] MkdirAll(certpaths.Dir(), 0o755) — keep
-  - [ ] store.Open(certpaths.DBPath()) — runs migrations 0001..0006
-  - [ ] security.CAInit(certpaths.Dir(), "orca-internal-ca") — idempotent (existing fast-path)
-  - [ ] if !exists(certpaths.ServerCertPath()): GenerateCSR("localhost", ["localhost","127.0.0.1"]) → ca.SignCSR → WriteCert + WriteKey
-  - [ ] detectOS() from /etc/os-release (see cli-engineer territory)
-  - [ ] localhost node upsert: GetByName("localhost") → if found UpdateLastSeenAndOS; else Insert with kind=localhost, os=<detected>, name="localhost", addr="localhost:8443"
-  - [ ] print summary (CA fp, server cert fp, os, node id, db path)
-- [ ] `internal/cli/init_test.go` — idempotency test: run init twice, assert no duplicate localhost node, last_seen refreshed, os unchanged; assert CA/cert not regenerated on re-run; assert doctor passes after init
-
-#### cli-engineer territory
-- [ ] `internal/cli/osdetect.go` (NEW) — `detectOS() string`: read `/etc/os-release` then fall back to `/usr/lib/os-release`; parse `KEY=VALUE` lines via bufio.Scanner + strings.SplitN; strip surrounding quotes; return `ID` value or `"linux"` fallback. Map ubuntu/debian/alpine → verbatim; unknown values stored verbatim (not masked).
-- [ ] `internal/cli/osdetect_test.go` — test parsing with sample os-release content (ubuntu, debian, alpine, missing file, missing ID=, unknown ID, quoted values)
-- [ ] `internal/cli/init.go` output UX — multi-step progress lines: "✓ Namespace dir: ...", "✓ Database initialized: ...", "✓ CA provisioned: ... (fp=...)", "✓ Server cert provisioned: ... (fp=...)", "✓ OS detected: ubuntu", "✓ Localhost node registered: <id>"; `--json` outputs a single JSON summary object
-
-### Verification
-
-- `go build ./...` PASS
-- `go test ./internal/store/... ./internal/cli/... ./internal/model/...` PASS
-- `go test -race ./...` PASS
-- `orca init` on a fresh namespace → creates dir, db, CA, server cert, localhost node; `orca doctor` passes with zero FAILs
-- `orca init` re-run → no duplicate localhost node, last_seen refreshed, CA/cert not regenerated (idempotent, D-036)
-- `orca init --json` → valid JSON summary
-- `orca node list` shows the localhost node with kind=localhost, os=<detected>
-- Migration 0006 applies cleanly on existing dbs (existing rows get NULL kind/os → scanned as `""`)
-
----
-
-## Phase 2: Proxmox SSH Join (Wave 1)
-
-**Branch**: `phase/02-proxmox-join`
-**REQ Coverage**: REQ-050, REQ-051
-**Persona leads**: security-engineer (SSH key, TOFU, sudoers, PVE role), backend-engineer (SSH session orchestration), cli-engineer (flag wiring)
-**Depends on**: Phase 1 (migration 0006 + Node.Kind/OS fields)
-
-### Must-Haves
-
-#### dependency + security-engineer territory
-- [ ] `go.mod` / `go.sum` — add `golang.org/x/crypto v0.54.0`; bump `golang.org/x/sys` to v0.47.0; add `golang.org/x/term v0.45.0` (indirect). Run `go mod tidy`.
-- [ ] `internal/certpaths/certpaths.go` — add `SSHKeyPath() → Dir()/orca_ssh_key`, `SSHPubPath() → Dir()/orca_ssh_key.pub`, `KnownHostsPath() → Dir()/known_hosts`
-- [ ] `internal/security/sshkey.go` (NEW) — `GenerateOrLoadSSHKey(dir string) (keyPEM, pubLine []byte, err error)`:
-  - [ ] If `orca_ssh_key` + `.pub` exist → load + return (idempotent)
-  - [ ] Else: `ed25519.GenerateKey(rand.Reader)` → `x509.MarshalPKCS8PrivateKey` → PEM encode → `writeAtomic(keyPath, 0600, keyPEM)`; `ssh.NewPublicKey(pub)` → `ssh.MarshalAuthorizedKey` → `writeAtomic(pubPath, 0644, pubLine)`
-  - [ ] Return keyPEM (for `ssh.ParsePrivateKey`) + pubLine (authorized_keys line)
-- [ ] `internal/security/sshkey_test.go` — test generate → load round-trip; test idempotent re-load; test file modes (0600/0644); test `ssh.ParsePrivateKey` accepts the PKCS8 PEM
-
-#### backend-engineer territory (with security-engineer co-own)
-- [ ] `internal/proxmox/bootstrap.go` (NEW package) — `BootstrapProxmox(ctx context.Context, opts Options) (*Result, error)`:
-  - **Options**: `Host, SSHUser, Password, ProxmoxUser (default "orca"), ProxmoxRole (default "OrcaOperator"), Port (default 22)`, `Logger *slog.Logger`
-  - **Step 1**: `security.GenerateOrLoadSSHKey(certpaths.Dir())` → keyPEM, pubLine
-  - **Step 2**: Build `ssh.ClientConfig` with `ssh.Password(opts.Password)` auth + `knownhosts.New(certpaths.KnownHostsPath())` HostKeyCallback (TOFU: captures on first connect, verifies on subsequent)
-  - **Step 3**: `ssh.Dial("tcp", host:port, config)` with 10s timeout
-  - **Step 4**: Deploy pubkey — `session.CombinedOutput("mkdir -p ~orca/.ssh && touch ~orca/.ssh/authorized_keys && chmod 0700 ~orca/.ssh && chmod 0600 ~orca/.ssh/authorized_keys && grep -qF '<publine>' ~orca/.ssh/authorized_keys || echo '<publine>' >> ~orca/.ssh/authorized_keys")` (idempotent append)
-  - **Step 5**: Create orca system user — `session.CombinedOutput("id -u orca 2>/dev/null || useradd -m -s /bin/bash orca")` (idempotent)
-  - **Step 6**: Create PVE role — `session.CombinedOutput("pveum role list 2>/dev/null | grep -q '^OrcaOperator' || pveum role add OrcaOperator --privs 'VM.Audit Datastore.AllocateSpace SDN.Use'")` (idempotent; use opts.ProxmoxRole for the name)
-  - [ ] Step 7: Create PVE user — `session.CombinedOutput("pveum user list 2>/dev/null | grep -q 'orca@pam' || pveum user add orca@pam -comment 'Orca automation user'")` (idempotent; use opts.ProxmoxUser)
-  - [ ] Step 8: Assign ACL — `session.CombinedOutput("pveum acl modify / -user orca@pam -role OrcaOperator")` (idempotent)
-  - [ ] Step 9: Write sudoers — resolve binary paths via `command -v pct` etc.; write `/etc/sudoers.d/orca` (mode 0440) with NOEXEC on pct/qm, no NOEXEC on apt-get/dpkg; exclude pvesh (AD-020)
-  - [ ] Step 10: Validate sudoers — `session.CombinedOutput("visudo -cf /etc/sudoers.d/orca")`; abort + cleanup if validation fails
-  - [ ] Step 11: Audit log — `logger.Info("proxmox.bootstrap_ok", slog.String("host", opts.Host), slog.String("user", opts.ProxmoxUser), slog.String("role", opts.ProxmoxRole))`
-  - [ ] **Result**: `Node{Kind: "proxmox", OS: "pve", Name: opts.Host, Address: opts.Host + ":8443"}`
-- [ ] `internal/proxmox/bootstrap_test.go` — unit tests with a mock SSH server (`httptest`-style or `net.Pipe` + manual SSH handshake) OR test the command-builder functions in isolation (probe commands, sudoers content, idempotency checks). Integration test against a real Proxmox host is out of scope for unit tests (flagged as `// +build integration`).
-
-#### cli-engineer territory
-- [ ] `internal/cli/node.go` — extend `nodeJoinCmd`:
-  - [ ] Add `--type` flag (values: `localhost` default, `linux`, `proxmox`)
-  - [ ] Add `--host`, `--ssh-user` (default `root`), `--password`, `--proxmox-user` (default `orca`), `--proxmox-role` (default `OrcaOperator`), `--ssh-port` (default `22`) flags
-  - [ ] When `--type proxmox`: validate `--host` + (`--password` or `$ORCA_PROXMOX_PASSWORD`) are set; call `proxmox.BootstrapProxmox(ctx, opts)`; insert the returned node via `NodeRepo.Insert`; print summary
-  - [ ] When `--type localhost` (default): existing flow (fingerprint check + registry.Join)
-  - [ ] Password from `--password` flag OR `$ORCA_PROXMOX_PASSWORD` env var (prefer env var per D-031; never log the password; zero the byte slice after use)
-- [ ] `internal/cli/node_test.go` — test flag wiring; test `--type proxmox` validation (missing host/password → error); test env var fallback
-
-### Verification
-
-- `go build ./...` PASS
-- `go test ./internal/proxmox/... ./internal/security/... ./internal/cli/...` PASS
-- `go test -race ./...` PASS
-- `go mod tidy` leaves no unused deps; `go.sum` has `golang.org/x/crypto v0.54.0`
-- `orca node join --type proxmox --host <pve-host> --password <pw>` on a real Proxmox 8/9 host:
-  - Creates orcaOperator role, orca@pam user, ACL, sudoers file
-  - `orca@pam` can `sudo pct list`, `sudo qm list`, `sudo apt-get update` without password
-  - `orca@pam` CANNOT `sudo pvesh` (not in sudoers)
-  - `orca@pam` CANNOT `sudo bash` (not in sudoers)
-  - `visudo -cf /etc/sudoers.d/orca` passes
-  - Re-running the join command is idempotent (no duplicate role/user/ACL/sudoers/key)
-- `orca node list` shows the proxmox node with kind=proxmox, os=pve
-- Audit log contains `proxmox.bootstrap_ok` entry with host, user, role
-- `~/.orca/orca_ssh_key` is 0600, `.pub` is 0644, `known_hosts` contains the PVE host key
-
----
-
-## Phase 3: Doctor Extensions + Audit Logging (Wave 2)
-
-**Branch**: `phase/03-doctor-extensions`
-**REQ Coverage**: REQ-052
-**Persona leads**: cli-engineer (subcommand wiring), backend-engineer (check logic), security-engineer (audit logging)
-**Depends on**: Phase 1 (localhost node + os field), Phase 2 (proxmox nodes + SSH client)
-
-### Must-Haves
-
-#### backend-engineer territory
-- [ ] `internal/doctor/doctor.go` — add `OS()` check:
-  - Re-run `detectOS()` (from `internal/cli/osdetect.go` — extract to shared package or pass as param)
-  - Load localhost node via `NodeRepo.GetByName("localhost")`
-  - Compare detected OS to stored `node.OS`; drift → WARN ("OS drift: init=ubuntu, now=debian — re-run `orca init` to refresh"); match → PASS
-  - Missing localhost node → FAIL ("no localhost node — run `orca init`")
-- [ ] `internal/doctor/doctor.go` — add `Proxmox()` check (clone `Network()` pattern):
-  - List nodes from `NodeRepo`, filter `kind == "proxmox"`
-  - Zero proxmox nodes → WARN ("no proxmox nodes registered (single-node?)")
-  - Per node: load orca SSH key, build `ssh.ClientConfig` with `ssh.PublicKeys(signer)` + `knownhosts.New`, dial with 3s timeout, run `pveversion` via session
-  - PASS = reachable + pveversion exits 0; FAIL = unreachable or pveversion fails
-  - Accumulate per-node lines (clone `Network()`'s `lines []string` pattern)
-- [ ] `internal/doctor/doctor.go` — extend `All()` to include `OS()` and `Proxmox()`
-- [ ] `internal/doctor/doctor_test.go` — test `OS()` with mock node repo (drift, match, missing); test `Proxmox()` with mock nodes (zero nodes → WARN, reachable → PASS, unreachable → FAIL)
-
-#### cli-engineer territory
-- [ ] `internal/cli/doctor.go` — add `doctorOSCmd` + `doctorProxmoxCmd` subcommands wired to `doctor.OS()` / `doctor.Proxmox()`; add to `doctorCmd.AddCommand(...)`
-- [ ] `internal/cli/doctor.go` — `doctor os` and `doctor proxmox` honor `--json` flag (reuse existing pattern)
-
-#### security-engineer territory
-- [ ] `internal/audit/audit.go` (extend) — emit `proxmox.bootstrap_ok`, `proxmox.bootstrap_fail`, `node.os_drift` events with structured slog fields
-- [ ] Audit log entries for all bootstrap + join actions (REQ-052): `orca init` emits `init.bootstrap_ok` (os, node_id, ca_fp); `orca node join --type proxmox` emits `proxmox.bootstrap_ok` (host, user, role); `doctor os` drift emits `node.os_drift` (init_os, current_os)
-
-### Verification
-
-- `go build ./...` PASS
-- `go test ./internal/doctor/... ./internal/cli/...` PASS
-- `go test -race ./...` PASS
-- `orca doctor` (after `orca init`) → all checks PASS (cert, db, os, network=zero peers WARN, proxmox=zero nodes WARN)
-- `orca doctor os` → PASS (OS matches)
-- `orca doctor proxmox` (no proxmox nodes) → WARN ("no proxmox nodes registered")
-- `orca doctor proxmox` (after joining a PVE host) → PASS per node
-- `orca doctor proxmox` (PVE host down) → FAIL per node with error message
-- Audit log contains `init.bootstrap_ok` and `proxmox.bootstrap_ok` entries
-- `--json` output for `doctor os` and `doctor proxmox` is valid JSON
-
----
-
-## Phase 4: Final Review + Ship + Audit (Wave 3)
-
-**Branch**: `phase/04-final-review-ship`
-**REQ Coverage**: REQ-047, REQ-048, REQ-049, REQ-050, REQ-051, REQ-052 (all)
-**Persona leads**: lead-developer (review + audit), all personas (post-hoc review)
-
-### Must-Haves
-
-- [ ] **Review** (delegate to `ciagent-review`): multi-persona code review across P01-P03
-  - Auto-apply P0 fixes; flag P1+ for post-hoc review
-  - Review territory discipline (warn mode)
-  - Review test coverage for all 6 REQs
-- [ ] **Audit** (delegate to `ciagent-audit`):
-  - Reconstruction test: git log matches `.ciagent/` files
-  - Branch hygiene: phase branches merged cleanly to milestone
-  - Commit discipline: all commits have `---ci---` blocks
-  - File discipline: no stale `.ciagent/` files
-- [ ] **Ship** (delegate to `ciagent-ship`):
-  - Merge `phase/04` → `milestone/v0.6`
-  - Merge `milestone/v0.6` → `main` (rebase-then-fast-forward per config.json)
-  - Tag `v0.5.4` (final phase patch = milestone release per feature-milestone promotion)
-  - Create Gitea release with full milestone summary (all phases, all REQs)
-- [ ] **Complete milestone**:
-  - Update `.ciagent/REQUIREMENTS.md` — mark REQ-047..052 as Complete
-  - Update `.ciagent/ROADMAP.md` — mark v0.6 as complete
-  - Update `.ciagent/CHECKPOINT.json` — `milestone_complete: true`
-  - Commit: `docs(milestone): complete node-bootstrap-proxmox`
-
-### Verification
-
-- `git log --oneline main..milestone/v0.6` shows all phase commits in order
-- `git tag --list v0.5.*` shows v0.5.0..v0.5.4
-- `main` branch contains all v0.6 work (fast-forward merge)
-- `orca init && orca doctor` on a fresh checkout passes end-to-end
-- Gitea release `v0.5.4` exists with milestone summary
-
----
-
-## Wave Ordering
-
-- **Wave 1** (Phases 1-2): Schema + init bootstrap (P01) is a hard
-  prerequisite for Proxmox join (P02) — P02 depends on the `Node.Kind`/
-  `OS` fields + migration 0006 from P01. `parallelization.enabled=false`
-  → sequential.
-- **Wave 2** (Phase 3): Doctor extensions depend on both P01 (localhost
-  node + os field for `doctor os`) and P02 (proxmox nodes + SSH client
-  for `doctor proxmox`).
-- **Wave 3** (Phase 4): Final review + ship + audit — covers all
-  execution phases.
-
-For v0.6, `parallelization.enabled=false` — phases run sequentially.
-
-## Versioning
-
-- **Milestone type**: `feature` (P01/P02/P03 ship `feat` phases)
-- **Patch per phase**: `v0.5.0` (P0), `v0.5.1` (P01), `v0.5.2` (P02), `v0.5.3` (P03), `v0.5.4` (P04 final = milestone release)
-- Tags run on the previous minor's patch line (v0.5.x) per branch-strategy.md
-- Milestone branch label: `milestone/v0.6-node-bootstrap-proxmox` (uses milestone number, not tag line)
-
-## Requirement Coverage Matrix
-
-| REQ | Phase | Persona lead | Must-haves |
-|-----|-------|-------------|------------|
-| REQ-047 | P01 | backend-engineer | init.go full bootstrap (CA + cert + db + localhost node, idempotent) |
-| REQ-048 | P01 | backend-engineer + cli-engineer | detectOS() from /etc/os-release + localhost node registration |
-| REQ-049 | P01 | data-engineer | migration 0006 + Node.Kind/OS + NodeRepo schema extension |
-| REQ-050 | P02 | security-engineer + backend-engineer | proxmox.BootstrapProxmox SSH dance + sshkey.go + certpaths SSH paths |
-| REQ-051 | P02 | security-engineer | OrcaOperator PVE role + orca@pam user + sudoers NOEXEC design |
-| REQ-052 | P03 | backend-engineer + security-engineer | doctor OS() + Proxmox() + audit logging of all bootstrap/join actions |

.ciagent/PLAN_v0.7.md

@@ -1,250 +0,0 @@
-# Phase Plans: Orca v0.7 — Hardening & Completion
-
-All 4 execution phases + final review with vertical-slice structure, wave
-ordering, and REQ-ID mapping. v0.7 scope: **Hardening & Completion** —
-register the unreachable `orca cert` command, add HCL config file parsing,
-uplift test coverage in core packages, and add the long-deferred pprof
-endpoint.
-
-Branching: `phase/01-cert-register`..`phase/05-final-review-ship` on the
-`milestone/v0.7-hardening-completion` branch (numbering restarts per
-milestone per branch-strategy.md).
-
-Milestone type: **NFR** (all phases are fix/test/chore; no `feat` phases).
-Tags run on the v0.6.x patch line: `v0.6.0` (P0) … `v0.6.5` (P05 =
-milestone release).
-
----
-
-## Phase 1: Register `orca cert` Command Tree + cert_repo Tests (Wave 1)
-
-**Branch**: `phase/01-cert-register`
-**REQ Coverage**: REQ-053
-**Persona leads**: lead-developer (cert registration + smoke test), data-engineer (cert_repo tests)
-**Source ideas**: I-401, I-402, I-412
-
-### Must-Haves
-
-#### lead-developer territory
-- [ ] `internal/cli/cert.go` — add `init()` that calls `rootCmd.AddCommand(NewCommand(slog.Default()))`. This is the one-line fix that makes the entire `cert ca-init | gen | show | renew | fingerprint` tree reachable. (AD-022)
-- [ ] `internal/cli/cert_test.go` (NEW) — regression test asserting `rootCmd.Commands()` contains a child whose `Use == "cert"`; assert each subcommand (`ca-init`, `gen`, `show`, `renew`, `fingerprint`) is present on the cert child.
-- [ ] `internal/cli/cert_smoke_test.go` (NEW) — end-to-end smoke test against a temp `ORCA_HOME`:
-  - [ ] `orca cert ca-init --cn test-ca` → succeeds, `ca.crt` + `ca.key` exist with modes 0644/0600
-  - [ ] `orca cert gen --cn test-server --san localhost --san 127.0.0.1` → succeeds, `server.crt` + `server.key` exist with modes 0644/0600
-  - [ ] `orca cert show` → outputs PEM with no `PRIVATE KEY` blocks (REQ-035 redaction)
-  - [ ] `orca cert fingerprint --which ca` → outputs a 64-char hex SHA-256
-  - [ ] `orca cert fingerprint --which server` → outputs a 64-char hex SHA-256
-  - [ ] `orca cert renew` → succeeds, server cert file mtime updates
-- [ ] `internal/cli/root_test.go` — extend the existing root test to assert `orca cert` is in the command tree (belt-and-suspenders with cert_test.go)
-
-#### data-engineer territory
-- [ ] `internal/store/cert_repo_test.go` (NEW) — table-driven tests for `CertRepo`:
-  - [ ] `Insert` a cert row → `Get` by serial returns matching row
-  - [ ] `Insert` duplicate `serial_hex` → returns error (UNIQUE constraint, I-107)
-  - [ ] `List` returns certs ordered by `issued_at desc`
-  - [ ] Rotation history: Insert 4 certs for the same node → only last N=3 retained (REQ-025); oldest is pruned
-  - [ ] `GetActive` returns the most-recent cert for a node
-  - [ ] `Delete` removes a cert by serial
-
-### Verification
-
-- `go build ./...` PASS
-- `go vet ./...` PASS
-- `go test ./internal/cli/... ./internal/store/...` PASS
-- `go test -race ./...` PASS
-- `./bin/orca cert` → prints help (no longer "unknown command")
-- `./bin/orca cert ca-init` on a temp `ORCA_HOME` → succeeds
-- `./bin/orca cert show` → no private key material in output (REQ-035)
-- cert_repo_test.go covers Insert/Get/List/rotation-prune/duplicate-serial
-
----
-
-## Phase 2: HCL Config File Parsing (Wave 1)
-
-**Branch**: `phase/02-config-parser`
-**REQ Coverage**: REQ-054
-**Persona leads**: backend-engineer (config package), lead-developer (root command --config flag wiring)
-**Source ideas**: I-406, I-408
-**Depends on**: Phase 1 (cert registration lands first so the CLI surface is complete before config extends it)
-
-### Must-Haves
-
-#### backend-engineer territory
-- [ ] `internal/config/config.go` (NEW package) — `Config` struct with HCL tags:
-  - [ ] `DBPath string `hcl:"db_path,optional"``
-  - [ ] `ListenAddr string `hcl:"listen_addr,optional"``
-  - [ ] `CAPath string `hcl:"ca_path,optional"``
-  - [ ] `ServerCertPath string `hcl:"server_cert_path,optional"``
-  - [ ] `ServerKeyPath string `hcl:"server_key_path,optional"``
-  - [ ] `NodeCapacity *CapacityConfig `hcl:"node_capacity,block"` (optional block)
-  - [ ] `Load(paths ...string) (*Config, error)` — loads the first existing file from `paths` via `hclsimple.Decode` (reuse the jobspec pattern, `internal/jobspec/spec.go:40`); returns a zero-value `Config` if no file exists (no error)
-  - [ ] `(*Config).MergeOverrides(flags Flags, env Environ) *Config` — applies precedence flag > env > file > default (D-039). Only non-zero flag values override; only set env vars override; file values are the base; missing fields fall back to `certpaths.*` defaults.
-  - [ ] No package-level state (AD-023). `Load` is a pure function.
-- [ ] `internal/config/config_test.go` (NEW) — table-driven tests:
-  - [ ] Load from a valid HCL file → all fields populated
-  - [ ] Load from a missing file → zero Config, no error
-  - [ ] Load from a malformed HCL file → error
-  - [ ] MergeOverrides: flag wins over env wins over file wins over default (all 4 layers exercised)
-  - [ ] MergeOverrides: empty flag does NOT override a set env value
-  - [ ] MergeOverrides: empty env does NOT override a set file value
-  - [ ] Optional `node_capacity` block parsed correctly
-
-#### lead-developer territory
-- [ ] `internal/cli/root.go` — add `--config string` persistent flag (default `""`). In `PersistentPreRunE`, if `--config` is set, call `config.Load(flag)` and stash the `*Config` in `cmd.Context()` via a context key. If `--config` is empty, `config.Load` is not called (zero overhead; existing flag/env behavior unchanged).
-- [ ] `internal/cli/daemon.go` — in the daemon command, if a `*Config` is present in the context, use `cfg.ListenAddr` as the default addr (flag still overrides per D-039).
-- [ ] `internal/cli/root_test.go` — extend with `--config <tmpfile>` test: pass a config file, assert the merged values reach the daemon command.
-- [ ] `testdata/config.hcl` (NEW) — example config file for tests:
-  ```hcl
-  db_path       = "/tmp/orca/test.db"
-  listen_addr   = "127.0.0.1:9999"
-  ca_path       = "/tmp/orca/ca.crt"
-  server_cert_path = "/tmp/orca/server.crt"
-  server_key_path  = "/tmp/orca/server.key"
-  ```
-
-### Verification
-
-- `go build ./...` PASS
-- `go vet ./...` PASS
-- `go test ./internal/config/... ./internal/cli/...` PASS
-- `go test -race ./...` PASS
-- `./bin/orca --config testdata/config.hcl daemon --help` → no error
-- Precedence test: flag value overrides config file value for the same key
-- No new direct deps (`hashicorp/hcl/v2` already in go.mod)
-
----
-
-## Phase 3: Test Coverage Uplift (Wave 1)
-
-**Branch**: `phase/03-coverage-uplift`
-**REQ Coverage**: REQ-055
-**Persona leads**: lead-developer (engine/transport/audit tests), data-engineer (store coverage)
-**Source ideas**: I-403, I-404, I-405, I-410
-**Depends on**: Phase 1 + Phase 2 (tests build on the now-reachable cert tree + config package)
-
-### Must-Haves
-
-#### lead-developer territory — internal/engine
-- [ ] `internal/engine/executor_test.go` (NEW) — test `Executor.Start`/`Wait` lifecycle:
-  - [ ] Start a command (`/bin/echo hello`) → Wait → exit code 0, stdout captured
-  - [ ] Start a failing command (`/bin/false`) → exit code non-zero
-  - [ ] Cancel via ctx → process killed, `WaitDelay` honored (REQ-021)
-  - [ ] Env propagation: `Env=["FOO=bar"]` → child process sees `FOO=bar`
-- [ ] `internal/engine/dispatcher_test.go` (NEW) — test `Dispatcher.Submit`/`Dispatch`:
-  - [ ] Submit a job → dispatched to the correct peer (mock peer client)
-  - [ ] Idempotency key present → retry on transient failure (mock returns error twice then succeeds)
-  - [ ] Idempotency key absent → no retry (REQ-037)
-  - [ ] Bounded queue backpressure: fill the channel → Submit blocks (with timeout assertion)
-- [ ] `internal/engine/peer_test.go` (NEW) — test the peer HTTP client:
-  - [ ] `httptest.NewTLSServer` mock → peer client POSTs a dispatch request
-  - [ ] TLS handshake failure → structured error with `peer` + `err` fields
-
-#### lead-developer territory — internal/transport
-- [ ] `internal/transport/mtls_test.go` (NEW) — test mTLS handshake:
-  - [ ] `httptest.NewTLSServer` with a test CA → client with valid cert handshakes OK
-  - [ ] Client with expired cert → handshake fails with `event=mtls.handshake` log assertion
-  - [ ] Client with wrong CA → handshake fails
-- [ ] `internal/transport/dispatch_test.go` (NEW) — test `Dispatch` RPC:
-  - [ ] Successful dispatch → 200 OK
-  - [ ] Dispatch with `X-Orca-Idempotency-Key` → idempotent
-  - [ ] Dispatch without key → 400 (per REQ-037)
-- [ ] `internal/transport/handshake_log_test.go` (NEW) — assert `LogHandshakeOK`/`LogHandshakeFailed` emit the correct slog fields (`event`, `peer`, `cert_fp`, `err`)
-
-#### lead-developer territory — internal/audit
-- [ ] `internal/audit/audit_test.go` (NEW) — test the `Audit` wrapper:
-  - [ ] `Emit` with `ActionCertIssued` + `ResultSuccess` → `engine.Record` called with correct args (mock `engine.Audit`)
-  - [ ] `EmitWithErr` → `engine.Record` called with `result=failure` + err in metadata
-  - [ ] `LogHandshakeOK` → slog output contains `event=mtls.handshake`, `result=ok`, `peer`, `cert_fp`
-  - [ ] `LogHandshakeFailed` → slog output contains `result=failed` + `err`
-  - [ ] Nil-safe: `(*Audit)(nil).Emit(...)` → no panic
-
-#### data-engineer territory — internal/proxmox
-- [ ] `internal/proxmox/bootstrap_test.go` — extend the existing test:
-  - [ ] Mock the `sshDialer` interface (already present at `bootstrap.go:211`) → assert the full bootstrap sequence calls the right shell commands in order (user create, role create, role assign, sudoers drop, pubkey deploy)
-  - [ ] Idempotent re-run: mock returns "already exists" for user create → bootstrap succeeds without re-creating
-  - [ ] SSH auth failure → bootstrap returns wrapped error
-  - [ ] Assert no password is logged (D-031)
-
-#### CI gate (I-410)
-- [ ] `.coreci.yml` — add a `coverage-gate` step in the `test` pipeline that runs `go test -cover ./internal/engine ./internal/transport ./internal/proxmox ./internal/audit` and fails if any package < 50% (AD-025). Use a small shell snippet + `awk`/`grep` to parse coverage percentages.
-
-### Verification
-
-- `go build ./...` PASS
-- `go test -race ./...` PASS
-- `go test -cover ./internal/engine` → ≥ 50% (was 8.3%)
-- `go test -cover ./internal/transport` → ≥ 50% (was 26.3%)
-- `go test -cover ./internal/proxmox` → ≥ 50% (was 5.1%)
-- `go test -cover ./internal/audit` → ≥ 50% (was 0%)
-- CI coverage gate step passes
-- Any races uncovered by `-race` are fixed in this phase (not deferred)
-
----
-
-## Phase 4: `--pprof` Opt-in on `orca daemon` (Wave 1)
-
-**Branch**: `phase/04-pprof-daemon`
-**REQ Coverage**: REQ-056
-**Persona leads**: lead-developer (daemon flag + pprof server)
-**Source ideas**: I-407, I-409
-**Depends on**: Phase 3 (daemon tests exist; pprof adds a new daemon path)
-
-### Must-Haves
-
-#### lead-developer territory
-- [ ] `internal/daemon/pprof.go` (NEW) — `StartPprof(addr string, log *slog.Logger) (*http.Server, error)`:
-  - [ ] Create a dedicated `*http.ServeMux` (NOT `http.DefaultServeMux`)
-  - [ ] `import _ "net/http/pprof"` → register `pprof.Index`, `pprof.Cmdline`, `pprof.Profile`, `pprof.Symbol`, `pprof.Trace`, `pprof.Handler` on the dedicated mux
-  - [ ] Return a `*http.Server` listening on `addr` with the dedicated mux
-  - [ ] Log a WARN: `pprof endpoint exposed unauthenticated on <addr> — operator-only, do not expose publicly`
-  - [ ] Never touch the mTLS daemon listener (AD-024)
-- [ ] `internal/daemon/server.go` — add a `pprofAddr string` field to `Options` (default `""` = disabled). In `Start`, if `pprofAddr != ""`, call `StartPprof` and store the `*http.Server` for `Shutdown`.
-- [ ] `internal/daemon/pprof_test.go` (NEW) — test:
-  - [ ] `StartPprof("127.0.0.1:0", ...)` → server starts, GET `/debug/pprof/` returns 200
-  - [ ] GET `/debug/pprof/cmdline` returns the cmdline
-  - [ ] `Shutdown` stops the pprof server
-  - [ ] The mTLS daemon server (if running) is unaffected by pprof start/stop
-- [ ] `internal/cli/daemon.go` — add `--pprof string` flag (default `""` = disabled). Pass it into `daemon.Options.PprofAddr`. Document in `--help`: "enable pprof endpoint on <addr> (e.g. :6060); unauthenticated, operator-only".
-- [ ] `internal/cli/daemon_test.go` — extend: `--pprof 127.0.0.1:0` → daemon starts with pprof; flag absent → no pprof server.
-
-### Verification
-
-- `go build ./...` PASS
-- `go vet ./...` PASS
-- `go test -race ./internal/daemon/...` PASS
-- `./bin/orca daemon --pprof 127.0.0.1:0` (in background) → `curl http://127.0.0.1:<port>/debug/pprof/` returns 200
-- `./bin/orca daemon` (no `--pprof`) → no pprof listener, `/debug/pprof/` not reachable on the daemon port
-- pprof mux is separate from the mTLS daemon mux (asserted in test)
-
----
-
-## Phase 5: Final Review + Ship + Audit (Wave 1)
-
-**Branch**: `phase/05-final-review-ship`
-**REQ Coverage**: all (REQ-053..056)
-**Persona leads**: lead-developer (review + audit + ship)
-
-### Must-Haves
-
-- [ ] Multi-persona code review across all v0.7 phases (ciagent-review)
-- [ ] Audit: reconstruction test (git log matches `.ciagent/` files), branch hygiene, commit discipline (ciagent-audit)
-- [ ] Fix any P0 issues found by review; record P1+ in `.ciagent/` for post-hoc
-- [ ] Merge `phase/05` → `milestone/v0.7-hardening-completion`
-- [ ] Merge `milestone/v0.7` → `main` (rebase-then-fast-forward per config)
-- [ ] Tag `v0.6.5` (final phase patch = milestone release)
-- [ ] Create Gitea release with full milestone summary (all phases, all REQs)
-- [ ] Update `.ciagent/REQUIREMENTS.md` — mark REQ-053..056 complete
-- [ ] Update `.ciagent/ROADMAP.md` — mark v0.7 complete
-- [ ] Write checkpoint: `{phase: 5, stage: "complete", phase_role: "final", milestone_complete: true}`
-- [ ] Clear checkpoint (milestone complete; next run starts a new milestone)
-
-### Verification
-
-- `make build` PASS
-- `make test` PASS
-- `make lint` PASS
-- `go vet ./...` PASS
-- `git log` on main shows all v0.7 phase commits
-- `git tag --list 'v0.6.*'` shows v0.6.0..v0.6.5
-- REQUIREMENTS.md shows REQ-053..056 as Complete
-- ROADMAP.md shows v0.7 as COMPLETE

.ciagent/PLAN_v0.8.md

@@ -1,347 +0,0 @@
-# Phase Plans: Orca v0.8 — Coverage & Trust Hardening
-
-All 4 execution phases + final review with vertical-slice structure, wave
-ordering, persona assignment, and REQ-ID mapping. v0.8 scope: **Coverage &
-Trust Hardening** — round-2 test coverage uplift across 9 packages (tiered
-floor: ≥70% for 6 retested, ≥50% for 3 zero-test per D-047), SSH trust
-hardening (`--host-key-fingerprint` pre-pin + `orca node key-reset` + latent
-TOFU capture-fix + `Result.HostKeyFingerprint` population), and a
-requirements-hygiene gate (`make verify-reqs`).
-
-Branching: `phase/01-coverage-round2`..`phase/04-final-review-ship` on the
-`milestone/v0.8-coverage-trust-hardening` branch (numbering restarts per
-milestone per branch-strategy.md).
-
-Milestone type: **NFR** (P01 test, P02 chore on the trust surface per D-043,
-P03 chore, P04 docs/review). Tags run on the v0.7.x patch line: `v0.7.0`
-(P0) … `v0.7.4` (P04 = milestone release).
-
-**Vertical-slice integrity**: each phase is independently shippable.
-- **P01** ships tests-only (no production code changes except the proxmox
-  `sessionRunner` seam, a backward-compatible interface extraction, and the
-  engine `peerDispatcher` seam per RESEARCH §1.3).
-- **P02** ships the SSH trust features + TOFI bugfix + `Result` population.
-- **P03** ships the hygiene gate (Go program + Makefile + CI hook).
-- **P04** is review + ship + audit (no new REQs).
-
-**Out of scope for v0.8** (candidate for v0.9, noted not added):
-- Lifting the 3 zero-test packages from 50% → 70% (D-047 explicitly
-  toes-holds them; v0.9 can raise the floor).
-- A `peerDispatcher` interface seam in engine beyond what P01 needs for 70%
-  coverage (httptest.NewTLSServer suffices; the seam is only added if
-  coverage cannot otherwise hit 70%).
-- Pre-populating `known_hosts` from a remote keyscan API (TOFU + manual
-  `--host-key-fingerprint` cover the v0.8 trust surface).
-- `verify-reqs` reverse-direction check (REQUIREMENTS Complete ↔ ROADMAP
-  COMPLETE both ways) — forward direction (ROADMAP-shipped → REQUIREMENTS
-  Complete) is the priority per the v0.7 drift that motivated REQ-060.
-
-**Carried-forward research findings** (RESEARCH_v0.8.md, must incorporate):
-- §1.1 per-package coverage strategies + tiered floors (D-047).
-- §1.3 injected seams: reuse `sshDialer` (proxmox), `LocalExecutor` (engine),
-  `Dispatcher` (transport), `watchInterval` (store), `openTestDB`/`withFastWatch`/`initTestEnv`/`resetRootFlags`/`stubDispatcher` helpers.
-- §1.4 realism flags: cli excludes `daemon.go`; `cmd/orca` 50% toe-hold only;
-  proxmox needs the `sessionRunner` seam to hit 70%.
-- §2.1 latent TOFU capture bug (knownhosts.New returns KeyError{Want:[]} on
-  first connect and does NOT auto-write — current BootstrapProxmox treats it
-  as a dial failure).
-- §2.2 `Result.HostKeyFingerprint` is declared but never populated (always
-  `""`); P02 must add `ssh.FingerprintSHA256` computation.
-- §2.3 `--host-key-fingerprint` plugs in at `internal/cli/node.go` (flag) +
-  `internal/proxmox/bootstrap.go` (pinned callback).
-- §2.4 `key-reset` is local-known_hosts-only (D-046), atomic rewrite (AD-029).
-- §3 verify-reqs is a Go program at `cmd/verify-reqs/main.go` (~80 LOC,
-  stdlib only, AD-030) + `make verify-reqs` + `.coreci.yml` validate hook.
-- §4 AD-025..AD-030 (renumbered AD-027..AD-030 in research for SSH/trust;
-  AD-025/AD-026 from earlier milestones are stable).
-- §5 10 pitfalls carried into the risk register at the end of this file.
-
-**Dependencies (RESEARCH §6)**: v0.8 adds **zero** new direct dependencies.
-`ssh.FingerprintSHA256`, `knownhosts.Line`/`Normalize`/`KeyError` are in the
-existing `golang.org/x/crypto` v0.54.0 dep. `verify-reqs` is stdlib-only.
-`go.mod` is unchanged by v0.8.
-
----
-
-## Phase 1: Coverage Uplift Round 2 (REQ-057)
-
-**Branch**: `phase/01-coverage-round2`
-**REQ Coverage**: REQ-057
-**Tag**: `v0.7.1`
-**Depends on**: Phase 0 (this plan + clarify + research)
-**Source research**: RESEARCH_v0.8.md §1 (per-package strategies, helpers, seams)
-
-### Tiered floor (D-047)
-
-| Package | Current | Floor | Owner persona |
-|---------|---------|-------|---------------|
-| `internal/engine` | 8.3% | ≥ 70% | backend-engineer |
-| `internal/proxmox` | 5.1% | ≥ 70% | backend-engineer |
-| `internal/cli` | 27.6% | ≥ 70% (excluding `daemon.go`) | lead-developer |
-| `internal/transport` | 26.3% | ≥ 70% | backend-engineer |
-| `internal/store` | 47.2% | ≥ 70% | data-engineer |
-| `internal/jobspec` | 47.6% | ≥ 70% | data-engineer |
-| `internal/audit` | 0% (no tests) | ≥ 50% toe-hold | data-engineer |
-| `internal/certpaths` | 0% (no tests) | ≥ 50% toe-hold | data-engineer |
-| `cmd/orca` | 0% (no tests) | ≥ 50% toe-hold | lead-developer |
-
-### Wave 1 — Seams + foundational test helpers (no production logic changes)
-
-These are backward-compatible interface extractions that unlock the bulk of
-coverage in Wave 2. They are the only production-code changes in P01; all
-other P01 tasks add `_test.go` files only.
-
-| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
-|---------|-------|------|------|-------|---------------|----------------------|
-| T01.1 | backend-engineer | 1 | Y | Add `sessionRunner` interface seam to proxmox | `internal/proxmox/bootstrap.go` | Extract a `sessionRunner` interface (`CombinedOutput(cmd string) ([]byte, error)`) ~10 LOC; default impl wraps `*ssh.Client.NewSession().CombinedOutput(...)`; `runRemote`/`deployPubKey`/`createLinuxUser`/`createPVERole`/`createPVEUser`/`assignPVEACL`/`writeSudoers`/`validateSudoers` use the seam. Backward compatible: existing callers unchanged. `go build ./internal/proxmox` PASS. (RESEARCH §1.3 gap #1, §5 pitfall #3) |
-| T01.2 | backend-engineer | 1 | N | Add `peerDispatcher` seam to engine (only if needed for 70%) | `internal/engine/dispatcher.go` | Extract a `peerDispatcher` interface (`Submit(ctx, spec, key) (*SubmitResponse, error)`) so `dispatchToPeer` is testable without `httptest.NewTLSServer`. **Only add if T01.5 cannot otherwise hit 70% via `httptest.NewTLSServer` alone.** If added, backward compatible. (RESEARCH §1.3 gap #2, §5 pitfall #8) |
-
-### Wave 2 — Per-package coverage tests (build on Wave 1 seams)
-
-| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
-|---------|-------|------|------|-------|---------------|----------------------|
-| T01.3 | backend-engineer | 2 | Y | `internal/transport` tests → ≥ 70% | `internal/transport/mtls_test.go` (NEW), `internal/transport/dispatch_test.go` (NEW), `internal/transport/handshake_log_test.go` (NEW), `internal/transport/retry_test.go` (NEW, extend) | `httptest.NewTLSServer` with a test CA (reuse `security.CAInit`/`GenerateCSR`/`SignCSR` per RESEARCH §1.2) for mTLS handshake paths; `stubDispatcher` (daemon/dispatch_test.go:24) pattern for Dispatch RPC; capture slog via a test `slog.Handler` for handshake_log. `go test -cover ./internal/transport` → ≥ 70% (was 26.3%). |
-| T01.4 | backend-engineer | 2 | Y | `internal/engine` tests → ≥ 70% | `internal/engine/executor_test.go` (NEW), `internal/engine/dispatcher_test.go` (NEW), `internal/engine/peer_test.go` (NEW), `internal/engine/scheduler_test.go` (extend), `internal/engine/registry_test.go` (NEW, if registry exists) | `Executor.Start`/`Wait` lifecycle (echo/false/ctx-cancel/Env propagation per REQ-021); `Dispatcher.Submit` with stubbed `LocalExecutor` + (if T01.2 added) stubbed `peerDispatcher` OR `httptest.NewTLSServer`; `PeerRegistry` in-memory Add/Remove/All/Get. Reuse `openTestDB` (node_repo_test.go:12). `go test -cover ./internal/engine` → ≥ 70% (was 8.3%). |
-| T01.5 | backend-engineer | 2 | Y | `internal/proxmox` tests → ≥ 70% | `internal/proxmox/bootstrap_test.go` (extend) | Swap `sshDialer` (existing seam) for a fake returning a mock `*ssh.Client`; swap `sessionRunner` (T01.1 seam) for a fake that returns canned `CombinedOutput` bytes. Assert full bootstrap sequence calls the right shell commands in order; idempotent re-run ("already exists" → no-op); SSH auth failure → wrapped error; no password logged (D-031). `go test -cover ./internal/proxmox` → ≥ 70% (was 5.1%). |
-| T01.6 | lead-developer | 2 | Y | `internal/cli` tests → ≥ 70% (excluding daemon.go) with GRILL condition #3 escape valve | `internal/cli/node_test.go` (NEW), `internal/cli/job_test.go` (NEW), `internal/cli/cert_test.go` (NEW), `internal/cli/doctor_test.go` (NEW), `internal/cli/audit_test.go` (NEW), `internal/cli/status_test.go` (NEW), `internal/cli/version_test.go` (NEW), `internal/cli/node_capacity_test.go` (NEW) | Table-driven `rootCmd.Execute()` against temp `ORCA_HOME` per subcommand (reuse `initTestEnv`/`resetRootFlags`/`discardWriter` per RESEARCH §1.2). Mock the proxmox path via `sshDialer` + `sessionRunner` seams. `daemon.go` is excluded — covered by `internal/daemon/server_test.go`. `go test -cover ./internal/cli` → ≥ 70% of non-daemon files (document the exclusion in a test-file comment). **GRILL condition #3 escape valve**: if 70% is not reached after Wave 2 effort and ≥ 65% is achieved (RESEARCH §1.4 flags 55-65% as realistic for one phase), ship cli at 65% and do NOT block P02/P03 on the last 5%; record the shortfall + rationale in the P01 verification commit. |
-| T01.7 | data-engineer | 2 | Y | `internal/store` tests → ≥ 70% (incl. missing `cert_repo_test.go`) | `internal/store/cert_repo_test.go` (NEW — v0.7 P01 leftover, RESEARCH §1.1), `internal/store/node_repo_test.go` (extend), `internal/store/job_task_repo_test.go` (extend), `internal/store/audit_repo_test.go` (extend), `internal/store/capacity_repo_test.go` (extend) | `cert_repo_test.go`: Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + N=3 rotation history per REQ-025 + duplicate-serial error. Reuse `openTestDB`/`withFastWatch` (RESEARCH §1.2). `go test -cover ./internal/store` → ≥ 70% (was 47.2%). |
-| T01.8 | data-engineer | 2 | Y | `internal/jobspec` tests → ≥ 70% | `internal/jobspec/spec_test.go` (extend), `internal/jobspec/testdata/*.hcl` (NEW golden fixtures) | Golden-file HCL fixtures (multi-task, env vars, args) + error-path table (missing job, no tasks, missing command, malformed HCL, empty file, nonexistent file for `ParseFile`). `go test -cover ./internal/jobspec` → ≥ 70% (was 47.6%). |
-| T01.9 | data-engineer | 2 | Y | `internal/audit` first tests → ≥ 50% toe-hold | `internal/audit/audit_test.go` (NEW) | Construct `Audit` with real `engine.Audit` backed by `:memory:` sqlite (via `store.NewAuditRepo` + `engine.NewAudit`); assert rows in `audit_log` table; capture slog via a test `slog.Handler` for `LogHandshakeOK`/`LogHandshakeFailed`. `go test -cover ./internal/audit` → ≥ 50% (was 0%). |
-| T01.10 | data-engineer | 2 | Y | `internal/certpaths` first tests → ≥ 50% toe-hold | `internal/certpaths/certpaths_test.go` (NEW) | Temp dir + `t.Setenv("ORCA_HOME", dir)` + assert each `*Path()` returns `filepath.Join(dir, <file>)`; test `ORCA_DB` override; test default-to-`~/.orca` fallback. Model on `namespace_test.go` (cli). `go test -cover ./internal/certpaths` → ≥ 50% (was 0%). |
-| T01.11 | lead-developer | 2 | Y | `cmd/orca` smoke test → ≥ 50% toe-hold | `cmd/orca/main_test.go` (NEW), possibly `cmd/orca/main.go` (refactor `main()` into `run() int` for testability) | Refactor `main()` to `run() int` (returns exit code; `main()` calls `os.Exit(run())`) so the test can call `run()` directly with a forced error path and assert non-zero exit + stderr contains "error:". Low-effort toe-hold — do NOT over-invest (RESEARCH §1.1, §5 pitfall #6). `go test -cover ./cmd/orca` → ≥ 50% (was 0%). |
-
-### Wave 3 — Coverage gate verification
-
-| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
-|---------|-------|------|------|-------|---------------|----------------------|
-| T01.12 | lead-developer | 3 | Y | Coverage-gate verification (all 9 packages hit tiered floor) | none (verification only) | `go test -cover ./internal/engine ./internal/proxmox ./internal/cli ./internal/transport ./internal/store ./internal/jobspec` → each ≥ 70%; `go test -cover ./internal/audit ./internal/certpaths ./cmd/orca` → each ≥ 50%. `go test -race ./...` PASS. Any races fixed in-phase (not deferred). |
-
-### Phase 1 Must-Haves (summary)
-
-All 9 packages hit their tiered floor (D-047): T01.1, T01.3, T01.4, T01.5,
-T01.6, T01.7, T01.8, T01.9, T01.10, T01.11, T01.12. T01.2 is conditional
-(only if needed for engine 70%).
-
-### Phase 1 Verification
-
-- `go build ./...` PASS
-- `go vet ./...` PASS
-- `go test -race ./...` PASS
-- Per-package coverage hits the tiered floor (T01.12)
-- The proxmox `sessionRunner` seam is backward compatible (existing
-  `BootstrapProxmox` callers unchanged)
-- No new direct deps (`go.mod` unchanged)
-
----
-
-## Phase 2: SSH Trust Hardening (REQ-058, REQ-059)
-
-**Branch**: `phase/02-ssh-trust-hardening`
-**REQ Coverage**: REQ-058, REQ-059
-**Tag**: `v0.7.2`
-**Depends on**: Phase 1 (proxmox `sessionRunner` seam from T01.1 is in place;
-the trust-surface code is now testable)
-**Source research**: RESEARCH_v0.8.md §2 (TOFU bug, fingerprint computation,
-flag wiring, key-reset atomic rewrite) + §4 AD-027..AD-029
-**Phase type**: chore (trust-surface hardening per D-043 — refines existing
-`orca node join --type proxmox` flow + existing TOFU `known_hosts` store; no
-new orchestration capability)
-
-### Wave 1 — Trust-surface foundations (security helpers + flag declarations)
-
-| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
-|---------|-------|------|------|-------|---------------|----------------------|
-| T02.1 | backend-engineer | 1 | Y | Add `security.SSHFingerprintSHA256` helper (AD-027) | `internal/security/sshkey.go` (extend) OR `internal/security/fingerprint.go` (extend) | Thin wrapper over `ssh.FingerprintSHA256(pubKey ssh.PublicKey) string` returning the canonical `SHA256:base64` string. Do NOT reuse `security.Fingerprint` (X.509 hex — different domain per RESEARCH §2.2). Unit test: known Ed25519 pub key → known `SHA256:` string. |
-| T02.2 | backend-engineer | 1 | Y | Export `security.WriteAtomic` (AD-029 enabler) | `internal/security/ca.go` | Rename `writeAtomic` → `WriteAtomic` (export) + update existing in-package callers. The `key-reset` atomic known_hosts rewrite (T02.7) needs it. Alternatively copy the ~20-LOC pattern into `proxmox` if export is undesirable — **recommend export** (RESEARCH §5 pitfall #10). `go build ./internal/security` PASS. |
-| T02.3 | backend-engineer | 1 | Y | Add `--host-key-fingerprint` flag on `orca node join` (D-044) | `internal/cli/node.go` | `nodeJoinCmd.Flags().StringVar(&joinHostKeyFP, "host-key-fingerprint", "", "SSH host key SHA256:base64 fingerprint (pre-pin; supersedes TOFU for --type proxmox)")` in the flag-registration block (node.go:344-354). Add `joinHostKeyFP string` to the var block (node.go:47-60). Validation in `RunE`: if `joinHostKeyFP != ""` and `--type != proxmox`, emit a clear error ("--host-key-fingerprint requires --type proxmox today"). Flag is generic for future SSH-joined kinds (D-044). |
-| T02.4 | backend-engineer | 1 | Y | Add `HostKeyFingerprint` field to `proxmox.Options` | `internal/proxmox/bootstrap.go` | Add `HostKeyFingerprint string` to the `Options` struct (bootstrap.go:55). Pass-through from `internal/cli/node.go` joinProxmox (node.go:158-166): `HostKeyFingerprint: joinHostKeyFP`. |
-
-### Wave 2 — Trust features + bugfix (build on Wave 1)
-
-| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
-|---------|-------|------|------|-------|---------------|----------------------|
-| T02.5 | backend-engineer | 2 | Y | Implement `pinnedHostKeyCallback` (REQ-058, AD-028) | `internal/proxmox/bootstrap.go` | `pinnedHostKeyCallback(expectedSHA256Base64 string) (ssh.HostKeyCallback, error)`: validate `SHA256:` prefix up front (reject raw hex with a clear error per D-045); callback receives server's `ssh.PublicKey`, computes `ssh.FingerprintSHA256(key)` (via T02.1 helper or inline), compares full strings to the operator-supplied value; returns `nil` on match, `error` on mismatch (fail closed). In `BootstrapProxmox`: if `opts.HostKeyFingerprint != ""` use `pinnedHostKeyCallback`, else fall back to the TOFU callback (T02.6). Unit test: match → callback returns nil; mismatch → returns error mentioning REQ-058; non-`SHA256:`-prefixed input → constructor returns error. |
-| T02.6 | backend-engineer | 2 | Y | **BUGFIX (v0.6 ship-defect)**: FIX the latent TOFU capture bug (RESEARCH §2.1, §5 pitfall #1, GRILL condition #1) | `internal/proxmox/bootstrap.go` | Wrap `knownhosts.New(...)` with a custom callback that: on `*knownhosts.KeyError{Want: []}` (host unknown) captures the server-presented `ssh.PublicKey`, writes a line via `knownhosts.Line([]string{knownhosts.Normalize(addr)}, key)` to `certpaths.KnownHostsPath()` using `security.WriteAtomic` (T02.2, AD-029), and returns `nil` (allow the dial to proceed). On `*knownhosts.KeyError{Want: [knownKey]}` (mismatch) returns the error (MITM detection). On `nil` (host present + match) returns `nil`. This fixes the v0.6 latent ship-defect where first-connect Proxmox join always failed (verified against `golang.org/x/crypto@v0.54.0/ssh/knownhosts/knownhosts.go:370-385`). P04 audit must record this as ship-defect closure. Unit test: first-connect captures the key + writes known_hosts; second-connect matches; mismatch-connect fails. |
-| T02.7 | backend-engineer | 2 | Y | Populate `Result.HostKeyFingerprint` (RESEARCH §2.2, §5 pitfall #2) | `internal/proxmox/bootstrap.go` | In the capture path (T02.6) and the pinned path (T02.5), set `Result.HostKeyFingerprint = ssh.FingerprintSHA256(hostKey)` (via T02.1). The field is currently declared (bootstrap.go:83-85) but always `""`. After T02.7, `orca node join --type proxmox` output includes the real fingerprint. Unit test: `Result.HostKeyFingerprint` is non-empty + `SHA256:`-prefixed after a successful bootstrap. |
-| T02.8 | backend-engineer | 2 | Y | Implement `orca node key-reset <node>` (REQ-059, D-046, AD-029) | `internal/cli/node.go`, `internal/proxmox/bootstrap.go` (new `ResetHostKey` helper OR inline in cli) | New `nodeKeyResetCmd` (`&cobra.Command{Use: "key-reset <node>", Args: cobra.ExactArgs(1), RunE: ...}`) registered via `nodeCmd.AddCommand(nodeKeyResetCmd)` (node.go:358-360). `RunE`: (1) resolve `<node>` arg via `nodeRegistry()` (node.go:37) → get node row → use `node.Name` (the host address for proxmox nodes) as the `known_hosts` match key; (2) call `proxmox.ResetHostKey(host) error` which reads `certpaths.KnownHostsPath()`, filters lines whose host field (before first whitespace, normalized via `knownhosts.Normalize`) matches, rewrites via `security.WriteAtomic` (T02.2); (3) audit-log `event=node.key_reset` with `actor`+`node`+`host` via `engine.Audit.Record`; (4) print `✓ Host key reset for <node> (next connect will re-pin via TOFU or --host-key-fingerprint)`. **Local only — do NOT revoke remote authorized_keys** (D-046). Unit test: known_hosts with 2 entries for the target host + 1 for another host → after reset, target's 2 lines removed, other host's line intact; audit row inserted. |
-| T02.9 | backend-engineer | 2 | Y | Apply the TOFU capture-fix to `doctor proxmox` probe (GRILL condition #2 — doctor parity with bootstrap) | `internal/doctor/doctor.go` | The doctor proxmox probe (doctor.go:412-415) uses the same `knownhosts.New(...)` callback pattern as bootstrap. Apply the same capture-fix wrapper (T02.6) so `doctor proxmox` on a first-connect node doesn't fail. **P02 is not complete until both bootstrap (T02.6) and doctor (T02.9) callbacks use the capture-fix wrapper — GRILL condition #2 binding parity check.** (If the doctor probe already relies on a prior `node join` having populated `known_hosts`, the fix is still correct — it makes the doctor robust to a missing entry.) |
-
-### Wave 3 — End-to-end integration + verification
-
-| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
-|---------|-------|------|------|-------|---------------|----------------------|
-| T02.10 | backend-engineer | 3 | Y | End-to-end trust-surface integration tests | `internal/proxmox/bootstrap_test.go` (extend), `internal/cli/node_test.go` (extend) | (1) `--host-key-fingerprint` with a correct pin → bootstrap succeeds + `Result.HostKeyFingerprint` matches the pin; (2) `--host-key-fingerprint` with a wrong pin → bootstrap fails fast with the REQ-058 mismatch error; (3) no `--host-key-fingerprint` + first connect (empty known_hosts) → TOFU captures the key + writes known_hosts + bootstrap succeeds; (4) no flag + second connect (known_hosts has the key) → matches + succeeds; (5) no flag + mismatch (known_hosts has a different key) → fails with MITM error; (6) `orca node key-reset <node>` → known_hosts entry removed + audit row inserted + next connect re-pins; (7) known_hosts pre-populated (v0.6→v0.8 migration path: existing entry from a prior join) → second-connect matches without re-capture, covering the upgrade path. |
-| T02.11 | backend-engineer | 3 | Y | `--host-key-fingerprint` non-proxmox type validation test | `internal/cli/node_test.go` (extend) | `orca node join --type linux --host-key-fingerprint SHA256:...` → clear error ("--host-key-fingerprint requires --type proxmox today"). Validates D-044 RunE check from T02.3. |
-
-### Phase 2 Must-Haves (summary)
-
-- T02.1, T02.2, T02.3, T02.4 (Wave 1 foundations)
-- T02.5 (`--host-key-fingerprint` pinned callback — REQ-058)
-- T02.6 (TOFU capture-fix — latent bug)
-- T02.7 (`Result.HostKeyFingerprint` populated)
-- T02.8 (`orca node key-reset` — REQ-059)
-- T02.9 (doctor proxmox TOFU fix)
-- T02.10, T02.11 (integration + validation)
-
-### Phase 2 Verification
-
-- `go build ./...` PASS
-- `go vet ./...` PASS
-- `go test -race ./internal/proxmox/... ./internal/cli/... ./internal/doctor/... ./internal/security/...` PASS
-- `./bin/orca node join --help` shows `--host-key-fingerprint` flag
-- `./bin/orca node key-reset --help` shows the key-reset subcommand
-- Pinned mismatch → fail closed (T02.10 case 2)
-- TOFU first-connect → captures + succeeds (T02.10 case 3)
-- `Result.HostKeyFingerprint` is non-empty after bootstrap (T02.7)
-- `key-reset` removes only the target host's known_hosts lines + audit-logs (T02.8)
-- No new direct deps
-
----
-
-## Phase 3: Requirements-Hygiene Gate (REQ-060)
-
-**Branch**: `phase/03-verify-reqs`
-**REQ Coverage**: REQ-060
-**Tag**: `v0.7.3`
-**Depends on**: Phase 2 (P03 is independent of P02 code, but ships after per
-ROADMAP ordering; the verify-reqs program parses the `.ciagent/` markdown
-which is stable by P03)
-**Source research**: RESEARCH_v0.8.md §3 (Makefile, .coreci.yml, parsing
-approach, AD-030) + §4 AD-030
-
-### Wave 1 — Go program
-
-| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
-|---------|-------|------|------|-------|---------------|----------------------|
-| T03.1 | lead-developer | 1 | Y | `cmd/verify-reqs/main.go` — Go program (~80 LOC, stdlib only, AD-030, GRILL condition #4 regex + reverse direction) | `cmd/verify-reqs/main.go` (NEW) | Parses `.ciagent/ROADMAP.md` + `.ciagent/REQUIREMENTS.md` using `regexp` (stdlib). **Forward assertion**: for every REQ-ID in REQUIREMENTS.md whose `Phase` column references a milestone that ROADMAP marks COMPLETE (substring-match `COMPLETE` within the bold span — NOT exact `\*\*COMPLETE\*\*` which misses v0.2's `**COMPLETE (merged to main via v0.3)**` header at ROADMAP.md:23), the REQUIREMENTS `Status` must be `Complete`. **Reverse assertion (GRILL condition #4)**: for every REQ-ID in REQUIREMENTS.md marked `Complete`, the corresponding milestone in ROADMAP.md must be marked COMPLETE. Regex: REQUIREMENTS row `^\|\s*(REQ-\d+)\s*\|.*?\|\s*\*\*(Complete\|Pending)\*\*\s*\|`; ROADMAP milestone-complete `^##\s*Milestone\s+v0\.\d+:.*—\s*\*\*COMPLETE[^\*]*\*\*` (substring tolerant); map milestone → REQs via the REQUIREMENTS `Phase` column (e.g. `v0.7 P1` → milestone `v0.7`). Exit 0 on consistency; exit 1 with a diff listing (REQ-ID + current status + expected status + direction) on drift. CLI: `go run ./cmd/verify-reqs .ciagent/ROADMAP.md .ciagent/REQUIREMENTS.md` (args optional; defaults to those paths). **Scope note (GRILL)**: REQ-060 catches doc-vs-doc drift only; code-vs-doc drift (e.g. the REQ-053 `cert_repo_test.go` omission — verified missing) is out of scope for this gate and handled by P04 `ciagent-audit`. |
-| T03.2 | lead-developer | 1 | Y | `cmd/verify-reqs/main_test.go` — golden-file tests | `cmd/verify-reqs/main_test.go` (NEW), `cmd/verify-reqs/testdata/` (NEW: `roadmap_clean.md`, `requirements_clean.md`, `roadmap_drift.md`, `requirements_drift.md`) | (1) Clean pair (ROADMAP v0.X COMPLETE + REQUIREMENTS REQ-XXX Complete) → exit 0, no diff; (2) Drift pair (ROADMAP v0.X COMPLETE + REQUIREMENTS REQ-XXX Pending) → exit 1 + diff lists the stale REQ; (3) Multiple drifts → all reported; (4) Missing args → uses defaults; (5) Malformed markdown → clear error (not a silent pass). |
-
-### Wave 2 — Makefile + CI hook
-
-| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
-|---------|-------|------|------|-------|---------------|----------------------|
-| T03.3 | lead-developer | 2 | Y | `make verify-reqs` target | `Makefile` | Add `verify-reqs` target: `go run ./cmd/verify-reqs .ciagent/ROADMAP.md .ciagent/REQUIREMENTS.md`. Add to `.PHONY`. `make verify-reqs` exits 0 on the current repo (REQUIREMENTS was corrected during v0.8 SPECIFY). |
-| T03.4 | lead-developer | 2 | Y | `.coreci.yml` validate-pipeline hook | `.coreci.yml` | Add a `verify-reqs` step to the `validate` pipeline (after `go-version`, alongside `gosec`/`govulncheck`/`gitleaks` per RESEARCH §3.2): `image: golang:1.25`, `commands: [make verify-reqs]`. Pipeline fails on drift. |
-
-### Wave 3 — Synthetic drift verification
-
-| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
-|---------|-------|------|------|-------|---------------|----------------------|
-| T03.5 | lead-developer | 3 | Y | Synthetic drift verification (REQ-060 acceptance) | none (verification only; temporarily flip a REQUIREMENTS row to Pending in a scratch commit, run `make verify-reqs`, assert exit 1 + diff, then revert) | (1) `make verify-reqs` on the current repo → exit 0; (2) flip one v0.7 REQ row to `Pending` in a scratch edit → `make verify-reqs` → exit 1 + diff lists that REQ-ID; (3) revert the scratch edit → exit 0. This is the REQ-060 acceptance criterion ("passes on current repo + fails on synthetic drift"). |
-
-### Phase 3 Must-Haves (summary)
-
-T03.1, T03.2, T03.3, T03.4, T03.5 — all must complete for the hygiene gate to
-ship.
-
-### Phase 3 Verification
-
-- `go build ./cmd/verify-reqs` PASS
-- `go test ./cmd/verify-reqs/...` PASS (golden-file tests)
-- `make verify-reqs` → exit 0 on the current repo
-- Synthetic drift → `make verify-reqs` exit 1 + diff (T03.5)
-- `.coreci.yml` validate pipeline includes the `verify-reqs` step
-- No new direct deps (stdlib only)
-
----
-
-## Phase 4: Final Review + Ship + Audit (no new REQs)
-
-**Branch**: `phase/04-final-review-ship`
-**REQ Coverage**: all (REQ-057..060)
-**Tag**: `v0.7.4` (milestone release)
-**Depends on**: Phase 1 + Phase 2 + Phase 3
-**Source**: milestone-release checklist (matches PLAN_v0.7 P05 structure)
-
-### Wave 1 — Review + audit
-
-| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
-|---------|-------|------|------|-------|---------------|----------------------|
-| T04.1 | lead-developer | 1 | Y | Multi-persona code review across all v0.8 phases | none (review only) | ciagent-review across P01..P03; P0 issues fixed in-phase; P1+ recorded in `.ciagent/` for post-hoc. |
-| T04.2 | lead-developer | 1 | Y | Audit: reconstruction test + branch hygiene + commit discipline | none (audit only) | ciagent-audit: git log matches `.ciagent/` files; branch hygiene clean; commit discipline enforced. |
-
-### Wave 2 — Ship
-
-| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
-|---------|-------|------|------|-------|---------------|----------------------|
-| T04.3 | lead-developer | 2 | Y | Merge phase/04 → milestone/v0.8-coverage-trust-hardening | none | Fast-forward merge (or rebase-then-fast-forward per config). |
-| T04.4 | lead-developer | 2 | Y | Merge milestone/v0.8 → main | none | Rebase-then-fast-forward per config. |
-| T04.5 | lead-developer | 2 | Y | Tag `v0.7.4` (milestone release) | none | `git tag v0.7.4` on the merged main HEAD. Per-phase tags `v0.7.0`..`v0.7.4` all present. |
-| T04.6 | lead-developer | 2 | Y | Create Gitea release `v0.7.4` with milestone summary | none | Release notes cover all 4 phases + REQ-057..060 + coverage deltas + trust-surface additions. |
-
-### Wave 3 — Post-ship bookkeeping
-
-| Task ID | Owner | Wave | Must | Title | Files touched | Acceptance criterion |
-|---------|-------|------|------|-------|---------------|----------------------|
-| T04.7 | lead-developer | 3 | Y | Update REQUIREMENTS.md — mark REQ-057..060 Complete | `.ciagent/REQUIREMENTS.md` | All 4 v0.8 REQ rows show `**Complete**` with phase + ship tag. `make verify-reqs` still passes (self-consistency). |
-| T04.8 | lead-developer | 3 | Y | Update ROADMAP.md — mark v0.8 COMPLETE | `.ciagent/ROADMAP.md` | v0.8 milestone section shows `**COMPLETE**`; all phase checkboxes `[x]`. `make verify-reqs` still passes. |
-| T04.9 | lead-developer | 3 | Y | Write + clear checkpoint | `.ciagent/` checkpoint | `{phase: 4, stage: "complete", phase_role: "final", milestone_complete: true}`; then clear checkpoint (milestone complete; next run starts a new milestone). |
-
-### Phase 4 Must-Haves (summary)
-
-All tasks (T04.1..T04.9) are must-haves — the final-review phase has no
-optional work.
-
-### Phase 4 Verification
-
-- `make build` PASS
-- `make test` PASS
-- `make lint` PASS
-- `make verify-reqs` PASS
-- `go vet ./...` PASS
-- `git log` on main shows all v0.8 phase commits
-- `git tag --list 'v0.7.*'` shows v0.7.0..v0.7.4
-- REQUIREMENTS.md shows REQ-057..060 as Complete
-- ROADMAP.md shows v0.8 as COMPLETE
-- Gitea release `v0.7.4` published with milestone summary
-
----
-
-## Phase 5: Final Review (next milestone, not part of v0.8 execution)
-
-Per the v0.8 ROADMAP, there are 4 execution phases (P01..P04). P04 IS the
-final review + ship + audit phase. There is no separate P05 in v0.8 (unlike
-v0.7 which had P05). The orchestrator's next-milestone P0 begins after
-T04.9 clears the checkpoint.
-
----
-
-## Risk Register (carried forward from RESEARCH_v0.8.md §5)
-
-| # | Pitfall | Phase(s) affected | Mitigation |
-|---|---------|-------------------|------------|
-| 1 | TOFU capture is currently BROKEN: `knownhosts.New` returns `KeyError{Want:[]}` on first connect and does NOT auto-write; current `BootstrapProxmox` treats it as a dial failure. | P02 | T02.6 wraps the callback to capture-and-persist on `KeyError{Want:[]}` via `knownhosts.Line` + `security.WriteAtomic`. This is a v0.6 latent bug that P02 closes. |
-| 2 | `Result.HostKeyFingerprint` is declared but never populated (always `""`). D-045's rationale references "existing output" that doesn't exist. | P02 | T02.7 adds `ssh.FingerprintSHA256(hostKey)` computation in both the capture and pinned paths. 1-line addition once the host key is available. |
-| 3 | No `sessionRunner` seam in proxmox — testing the SSH command sequence without a real SSH server is impossible. | P01 | T01.1 adds a 1-interface ~10-LOC `sessionRunner` seam in Wave 1. Unlocks ~40% of proxmox coverage. Backward compatible. |
-| 4 | `internal/store/cert_repo.go` has NO test — v0.7 P01 REQ-053 was supposed to add `cert_repo_test.go` but it's missing (v0.7 leftover). | P01 | T01.7 adds `cert_repo_test.go` (Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + N=3 rotation). Directly lifts store coverage toward 70%. |
-| 5 | `internal/cli/daemon.go` starts a long-running mTLS server — testing it in cli requires a lifecycle harness; it's already covered by `internal/daemon/server_test.go`. | P01 | T01.6 excludes `daemon.go` from the cli 70% target; documents the exclusion in a test-file comment. Avoids double-testing. |
-| 6 | `cmd/orca` 50% toe-hold is low-value (15 LOC of glue; effort:coverage ratio is poor). | P01 | T01.11 keeps it at the 50% toe-hold per D-047; does NOT over-invest. A small `run() int` refactor enables a smoke test. |
-| 7 | `go: no such tool "covdata"` for zero-test packages — a Go toolchain quirk when a package has no test files; NOT a real 0% number. | P01 | T01.9, T01.10, T01.11 each add a `_test.go` file, which makes coverage computable. Don't treat the tooling error as a measurement. |
-| 8 | `transport.dispatchToPeer` has no seam — testing the remote-dispatch branch requires a new interface OR `httptest.NewTLSServer`. | P01 | T01.3 uses `httptest.NewTLSServer` (no refactor needed). T01.2 (conditional `peerDispatcher` seam) is only added if engine cannot otherwise hit 70%. |
-| 9 | `knownhosts.Line` + `knownhosts.Normalize` are the helpers for the TOFU-capture fix and `key-reset` matching. | P02 | T02.6 + T02.8 use `Normalize` to match host strings consistently (handles `host:22` vs `host`). |
-| 10 | `security.writeAtomic` is unexported (ca.go:305); `key-reset`'s atomic known_hosts rewrite needs it. | P02 | T02.2 exports `WriteAtomic` (recommended) OR copies the ~20-LOC pattern. Export is preferred — it's already used across ca.go + sshkey.go. |
-
----
-
-## REQ-ID → Task mapping (traceability)
-
-| REQ-ID | Phase | Tasks |
-|--------|-------|-------|
-| REQ-057 | P01 | T01.1, T01.2 (conditional), T01.3, T01.4, T01.5, T01.6, T01.7, T01.8, T01.9, T01.10, T01.11, T01.12 |
-| REQ-058 | P02 | T02.1, T02.3, T02.4, T02.5, T02.7, T02.10, T02.11 |
-| REQ-059 | P02 | T02.2, T02.8, T02.10 |
-| REQ-060 | P03 | T03.1, T03.2, T03.3, T03.4, T03.5 |
-| (latent TOFU bug) | P02 | T02.6, T02.9 (not a REQ — closes a v0.6 gap surfaced by RESEARCH §2.1) |
-| (milestone release) | P04 | T04.1..T04.9 |
-
----
-
-## Task counts
-
-| Phase | Tasks | Must-haves | Waves |
-|-------|-------|------------|-------|
-| P01 | 12 | 11 (T01.2 conditional) | 3 |
-| P02 | 11 | 11 | 3 |
-| P03 | 5 | 5 | 3 |
-| P04 | 9 | 9 | 3 |
-| **Total** | **37** | **36** | — |

.ciagent/PROJECT.md

@@ -141,239 +141,3 @@ despite stale REQUIREMENTS.md marking them Pending. The remaining work:
 The vision ("minimalist, offline-first, CLI-first orchestration
 engine") is unchanged. v0.3 is a completion milestone, not a direction
 change.
-
-## v0.5 Scope Summary — Distribution
-
-v0.5 is a 3-execution-phase milestone that makes Orca installable,
-distributable, and containerized. The engine functionality from
-v0.1–v0.3 is unchanged; this milestone is purely about **delivery
-surface**:
-
-- **P01 — Namespace unification.** A single `ORCA_HOME` environment
-  variable becomes the namespace root for *all* on-disk state (db,
-  certs, init, daemon). A `--system` flag on the root command selects
-  the system-level namespace root `/root/.orca`. Backward compatible:
-  empty `ORCA_HOME` → `~/.orca`. Covers REQ-041, REQ-042.
-- **P02 — `install.sh` + in-place update.** A 1-liner installer pulls
-  the release binary from the public Gitea release URL, installs at
-  user level by default (`~/.local/bin/orca`) or system level
-  (`/usr/local/bin/orca`) with `--system`. Re-running updates the
-  binary in place while preserving config/db/certs in the namespace
-  dir. Idempotent. Covers REQ-043, REQ-044. Also updates README
-  quickstart (REQ-016 completion).
-- **P03 — Docker release.** A multi-stage `Dockerfile` builds a
-  distroless image; `scripts/release.sh` and `.coreci.yml` publish the
-  image to the Gitea container registry per release. Covers REQ-046.
-- **P04 — Final review + ship + audit.** Milestone release.
-
-The vision ("minimalist, offline-first, CLI-first orchestration
-engine") is unchanged. v0.5 is a distribution milestone, not a
-direction change.
-
-## v0.5 Clarified Decisions (D-series, full autonomy)
-
-The 5 v0.5 decisions (D-025..D-029) were auto-resolved under full
-autonomy during the CLARIFY stage:
-
-| ID | Question | Decision | Rationale | Confidence |
-|----|----------|----------|-----------|------------|
-| D-025 | System-level namespace path layout? | **`/root/.orca`** (mirror of user-level `~/.orca`) | Consistent shape with user-level; just a different root. Matches the user's "starts at /root" wording. Single dir keeps it simple. | 0.90 |
-| D-026 | Namespace override mechanism at runtime? | **Unify on `ORCA_HOME`** as single namespace root for all components (db, certs, init, daemon). Add `--system` flag that sets root to `/root/.orca`. | `ORCA_HOME` already exists for certs; extend to all components. Backward compatible (empty → `~/.orca`). One knob, not many. | 0.92 |
-| D-027 | Docker registry target? | **Gitea built-in container registry** (`git.cloudinit.dev/coreci/orca`) | Keeps everything in one forge; uses Gitea's native registry. Consistent with REQ-045 (public repo → public image pulls). | 0.88 |
-| D-028 | How to make releases publicly accessible (REQ-045)? | **Flip repo visibility to public** via `tea repos edit coreci/orca --private=false` during P0 ship | Simplest path to anonymous downloads; enables both install.sh pulls and docker pulls. Pre-existing `.env` leak already suppressed via gitleaks baseline + rotate-forward (commit 00127ce). | 0.85 |
-| D-029 | install.sh default version? | **Latest release** (query Gitea releases API), optional `--version vX.Y.Z` to pin | Matches typical 1-liner installer UX; users get newest by default, can pin for reproducibility. | 0.92 |
-
-### v0.5 Operational prerequisite (P0 ship)
-
-The Gitea repo `coreci/orca` is currently **private** (returns 404
-unauthenticated). P0 ship flips visibility to public via `tea repos
-edit coreci/orca --private=false` so that `install.sh` can pull
-release binaries unauthenticated (REQ-045). This is an operational
-step performed during the P0 ship, verified by an unauth `curl`
-against the releases API.
-
-## v0.6 Scope Summary — Node Bootstrap & Proxmox
-
-v0.6 is a 3-execution-phase milestone that turns `orca init` from a
-bare `mkdir` into a full single-node cluster bootstrap, and adds
-Proxmox 8 & 9 as a first-class remote node type joined over SSH with
-least-privilege role delegation. The engine functionality from
-v0.1–v0.5 is unchanged; this milestone is about **bootstrap
-ergonomics** and **heterogeneous node support**:
-
-- **P01 — `orca init` full bootstrap.** A single `orca init` call now:
-  (a) creates the namespace dir (`~/.orca` or `/root/.orca` with
-  `--system`); (b) runs all DB migrations including the new 0006
-  (`nodes.kind`, `nodes.os` — backward-compatible nullable columns);
-  (c) bootstraps the internal CA via `security.CAInit` if `ca.crt` is
-  absent; (d) generates the server cert via `security.GenerateCSR` +
-  `ca.SignCSR` if `server.crt` is absent; (e) auto-detects the local
-  OS via `/etc/os-release` `ID=` field (ubuntu/debian/alpine); (f)
-  registers a `localhost` node with `kind=localhost`, `os=<detected>`,
-  `addr=localhost:8443` if no localhost node exists yet. After
-  `orca init`, `orca doctor` MUST pass with zero FAILs. Idempotent:
-  re-running `orca init` is a no-op (or refresh) for already-provisioned
-  artifacts. Covers REQ-047, REQ-048, REQ-049.
-- **P02 — Proxmox SSH join.** `orca node join --type proxmox --host
-  <addr> --user root --password <pw>` (password via flag or
-  `$ORCA_PROXMOX_PASSWORD`, **never persisted**) bootstraps a remote
-  Proxmox 8/9 host via `golang.org/x/crypto/ssh` (new direct dep).
-  Steps: (1) SSH password-auth; (2) generate or load orca's SSH
-  keypair (`~/.orca/orca_ssh_key` / `.pub`, 0600/0644); (3) deploy
-  pubkey to remote `~orca/.ssh/authorized_keys`; (4) create `orca`
-  user (config-overridable name via `--proxmox-user`, default `orca`);
-  (5) create PVE custom role `OrcaOperator` (config-overridable via
-  `--proxmox-role`) with privileges `VM.Audit`,
-  `Datastore.AllocateSpace`, `SDN.Use`; (6) assign role to `orca`
-  user on `/`; (7) drop `/etc/sudoers.d/orca` allowlist (`pct`, `qm`,
-  `pvesh`, `apt-get`, `dpkg` — no shell-escape commands); (8) record
-  node row `kind=proxmox`, `os=pve`, audit log. Idempotent re-run.
-  Covers REQ-050, REQ-051.
-- **P03 — `doctor os` + `doctor proxmox`.** Extends `orca doctor`
-  with two new checks: `doctor os` re-runs `/etc/os-release` detection
-  and verifies it matches the stored localhost node row's `os` field
-  (drift = WARN); `doctor proxmox` iterates `kind=proxmox` nodes and
-  SSH-probes each with `pveversion` / `pvecmd status` (3s timeout per
-  peer per D-038 pattern), reporting PASS/WARN/FAIL per node. All
-  bootstrap + join actions emit structured audit-log entries. Covers
-  REQ-052.
-- **P04 — Final review + ship + audit.** Milestone release.
-
-The vision ("minimalist, offline-first, CLI-first orchestration
-engine") is unchanged. v0.6 is a bootstrap-ergonomics + heterogeneous-
-nodes milestone, not a direction change.
-
-## v0.6 Clarified Decisions (D-series, full autonomy)
-
-The 8 v0.6 decisions (D-030..D-037) were resolved during the CLARIFY
-stage — D-030..D-034 confirmed by the operator in plan mode, D-035..D-037
-auto-resolved at full autonomy within the `clarify_budget`:
-
-| ID | Question | Decision | Rationale | Confidence |
-|----|----------|----------|-----------|------------|
-| D-030 | SSH library for Proxmox join? | **`golang.org/x/crypto/ssh`** | Stdlib-adjacent, well-maintained, single new direct dep. Matches orca's minimal-deps ethos. Shell-out to `/usr/bin/ssh` would require openssh-client on the orca host and complicate password-auth + idempotent pubkey deploy. | 0.92 (operator-confirmed) |
-| D-031 | Proxmox join password handling? | **Flag/env only, never persisted** | `--password` flag or `$ORCA_PROXMOX_PASSWORD` is used once to deploy the orca pubkey + create the `orca` user; the password is never written to SQLite. Subsequent orca→Proxmox access uses the deployed SSH key. | 0.95 (operator-confirmed) |
-| D-032 | Localhost OS auto-detect signal? | **`/etc/os-release` `ID=` field** | Parse `ID=` from `/etc/os-release`; map `ubuntu`/`debian`/`alpine` → node `os`. Falls back to `linux` (unknown) if none match. Simplest reliable signal across the three target distros. | 0.93 (operator-confirmed) |
-| D-033 | Least-privilege Proxmox role granularity? | **Custom PVE role `OrcaOperator`** with `VM.Audit`, `Datastore.AllocateSpace`, `SDN.Use` + `/etc/sudoers.d/orca` allowlist (`pct`, `qm`, `pvesh`, `apt-get`, `dpkg`) | Config-overridable role + user names. Sufficient for "manage the host, VMs/CTs, storage, packages" without granting root shell. Built-in `PVEAuditor` is too read-only; full `Administrator` is too broad. | 0.88 (operator-confirmed) |
-| D-034 | Node kind/os schema? | **Add `nodes.kind` + `nodes.os` columns via migration 0006** | Schema-first, queryable, doctor can branch on kind. Nullable with `localhost`/`""` defaults for existing rows (backward-compatible). data-engineer owns the migration. | 0.94 (operator-confirmed) |
-| D-035 | SSH host-key verification on first Proxmox connect? | **TOFU: pin on first connect, refuse on mismatch thereafter** | First connect uses `ssh.InsecureIgnoreHostKey` to capture the host key; it is then persisted to `~/.orca/known_hosts` (or the nodes metadata) and all subsequent connects require a match. Balances first-run ergonomics against MITM risk on subsequent runs. Switching to pre-pinned keys is a future enhancement. | 0.82 (auto) |
-| D-036 | `orca init` idempotency semantics for already-provisioned artifacts? | **Skip-and-refresh, never overwrite** | If `ca.crt` exists → load it (no regen). If `server.crt` exists → keep it (no reissue). If a localhost node row exists → update `last_seen` + re-detect `os`, never insert a duplicate. If DB migrations are ahead → no-op. If `~/.orca` exists → MkdirAll is a no-op. Idempotent re-run is a hard requirement (REQ-047). | 0.95 (auto) |
-| D-037 | orca SSH keypair location + algorithm? | **`~/.orca/orca_ssh_key` (0600) + `~/.orca/orca_ssh_key.pub` (0644), Ed25519** | Ed25519 keys are smaller, faster, and more secure than RSA for SSH auth. Stored in the orca namespace dir alongside ca.crt/server.crt so `ORCA_HOME` relocation works. File modes mirror the cert file-mode discipline (REQ-033 spirit). Generated lazily on first `orca node join --type proxmox`, not at `orca init` (localhost doesn't need SSH). | 0.90 (auto) |
-
-### v0.6 clarification notes
-
-- **D-035 TOFU caveat**: TOFU (trust-on-first-use) is the standard SSH
-  UX and matches the operator-mediated model from D-012 (CA cert
-  distribution). The operator is expected to verify the host key
-  fingerprint out-of-band on first connect if the network is
-  untrusted. A future milestone may add `--host-key-fingerprint` pin
-  flag to `orca node join --type proxmox` for pre-pinned deployments.
-- **D-036 idempotency**: re-running `orca init` on a node that already
-  has a localhost row updates `last_seen` and re-detects `os` (in case
-  the host OS was upgraded) but does NOT change the node `ID` or
-  `joined_at`. This makes `orca init` safe to put in a systemd
-  ExecStartPre or a config-management runbook.
-- **D-037 Ed25519**: `golang.org/x/crypto/ssh` + `golang.org/x/crypto/ed25519`
-  are in the same module; no additional direct dep beyond D-030.
-
-## v0.7 Clarified Decisions (D-series, full autonomy)
-
-The 5 v0.7 decisions (D-038..D-042) were auto-resolved at full autonomy
-within the `clarify_budget` (10):
-
-| ID | Question | Decision | Rationale | Confidence |
-|----|----------|----------|-----------|------------|
-| D-038 | Config file format — HCL or YAML? | **HCL** | D-009 already specced `config.hcl`. HCL is already a direct dep (hashicorp/hcl/v2 for jobspec). Adding YAML would introduce a second parser dep — violates minimal-deps. Use the existing `hclparse` pkg from jobspec. | 0.93 |
-| D-039 | Config precedence order (flag vs env vs file vs default)? | **flag > env > file > default** | Standard layered config: the most explicit (flag) wins, then the runtime (env), then the persisted (file), then the built-in default. Matches cobra/viper convention without the viper dep. | 0.92 |
-| D-040 | pprof security — bind to localhost only, or operator-chosen addr? | **Operator-chosen `--pprof <addr>` (default disabled)** | Default disabled keeps the minimalist posture. Operator picks the addr — localhost for dev, unix socket for prod. Separate mux so it never touches the mTLS daemon listener. No auth (pprof is operator-only, addr is the gate). | 0.85 |
-| D-041 | cert command registration — where in root command order? | **After `cert` is unreachable today, append after `node` in rootCmd.AddCommand order** | Alphabetical-ish with the existing cluster (audit, daemon, doctor, init, job, node, cert, status, version). No behavior change to existing commands. | 0.88 |
-| D-042 | Coverage target — 50% floor or higher? | **50% floor per package, 70% target for new packages** | 50% is achievable for the concurrent packages (engine, transport) without heroic mock effort; 70% is the floor for new code in P02/P04. Avoids a "raise coverage everywhere" rathole. | 0.85 |
-
-## v0.7 Scope Summary — Hardening & Completion
-
-v0.7 is a 4-execution-phase **NFR milestone** that closes out gaps
-surfaced by the v0.7 IDEATE stage: an unreachable command tree, a
-missing config file layer, low test coverage in core packages, and the
-long-deferred pprof endpoint. The engine functionality from v0.1–v0.6
-is unchanged; this milestone is purely about **correctness, coverage,
-and operability**:
-
-- **P01 — Register `orca cert` command tree + cert_repo tests.** The
-  `internal/cli/cert.go` command (`cert ca-init`, `cert gen`, `cert
-  show`, `cert renew`, `cert fingerprint`) is fully implemented but
-  never wired into `rootCmd`. This phase adds the missing
-  `rootCmd.AddCommand(newCertCmd(...))` and adds the missing
-  `internal/store/cert_repo_test.go`. Covers REQ-053.
-- **P02 — HCL config file parsing (`config.hcl`).** D-009 specified
-  `~/.orca/config.hcl` and `/etc/orca/orca.hcl` as config locations,
-  but no HCL config-file parser exists — the CLI relies entirely on
-  flags and env vars. This phase adds a minimal `internal/config`
-  package that loads `config.hcl` (keys: `db_path`, `listen_addr`,
-  `ca_path`, `server_cert_path`, `server_key_path`, `node_capacity`),
-  merges with env/flag overrides (flag > env > file > default), and
-  surfaces it via `--config` flag on the root command. Covers
-  REQ-054.
-- **P03 — Test coverage uplift.** Adds tests for the lowest-coverage
-  packages: `internal/engine` (executor, dispatcher, peer — currently
-  8.3%), `internal/transport` (mtls, dispatch, handshake_log —
-  currently 26.3%), `internal/proxmox` (bootstrap SSH path —
-  currently 5.1%), and `internal/audit` (no tests). Target: every
-  package ≥ 50% coverage. Covers REQ-055.
-- **P04 — `--pprof` opt-in on `orca daemon`.** Adds the long-deferred
-  I-308 pprof endpoint behind an opt-in `--pprof <addr>` flag (default
-  disabled). `net/http/pprof` mounted on a separate mux so it never
-  touches the mTLS daemon listener. Covers REQ-056.
-- **P05 — Final review + ship + audit.** Milestone release.
-
-The vision ("minimalist, offline-first, CLI-first orchestration
-engine") is unchanged. v0.7 is a hardening milestone, not a direction
-change. Milestone type: NFR (all phases are fix/test/chore); the final
-phase's progressive patch IS the deliverable per `run.md` versioning
-logic. Tags run on the v0.6.x patch line: `v0.6.0` (P0) … `v0.6.5` (P05
-= milestone release).
-
-## v0.8 Scope Summary — Coverage & Trust Hardening
-
-v0.8 is a 3-execution-phase **NFR milestone** that continues the
-hardening theme opened by v0.7. v0.7 P03 (REQ-055) lifted four
-packages to ≥ 50%, but a coverage re-baseline after v0.7 ship shows
-the floor was insufficient: `internal/engine` regressed to 8.3%,
-`internal/proxmox` to 5.1%, and four more packages sit between 26% and
-48%. Three packages (`internal/audit`, `internal/certpaths`,
-`cmd/orca`) still have **no test files at all**. v0.8 also closes the
-two "future enhancement" hooks explicitly deferred in v0.6 — SSH
-host-key pre-pinning (D-035 caveat) and `orca node key-reset`
-(RESEARCH_v0.6 §80) — and adds a requirements-hygiene gate so the
-stale-REQ-status drift seen in REQUIREMENTS.md after v0.7 ship cannot
-recur:
-
-- **P01 — Coverage uplift round 2.** Raise six under-50% packages to
-  ≥ 70% and add first tests for the three zero-test packages. Covers
-  REQ-057.
-- **P02 — SSH trust hardening.** `--host-key-fingerprint` pre-pin flag
-  on `orca node join --type proxmox` + `orca node key-reset <node>`
-  command. Covers REQ-058, REQ-059.
-- **P03 — Requirements-hygiene gate.** `make verify-reqs` target +
-  verify-stage assertion that ROADMAP `Complete` ↔ REQUIREMENTS
-  `Complete`. Covers REQ-060.
-- **P04 — Final review + ship + audit.** Milestone release.
-
-The vision is unchanged. v0.8 is a hardening milestone, not a
-direction change. Milestone type: NFR (all phases are test/feat-chore
-on the trust surface — see CLARIFY D-043 for the `feat` vs `chore`
-classification of P02); the final phase's progressive patch IS the
-deliverable per `run.md` versioning logic. Tags run on the **v0.7.x**
-patch line: `v0.7.0` (P0) … `v0.7.4` (P04 = milestone release).
-
-## v0.8 Clarified Decisions (D-series, full autonomy)
-
-The 5 v0.8 decisions (D-043..D-047) were auto-resolved at full autonomy
-within the `clarify_budget` (10):
-
-| ID | Question | Decision | Rationale | Confidence |
-|----|----------|----------|-----------|------------|
-| D-043 | Is P02 (SSH trust hardening) a `feat` phase or a `chore` phase? It adds a new flag + a new subcommand. | **`chore` (trust-surface hardening), not `feat`** | Both `--host-key-fingerprint` and `orca node key-reset` refine the *existing* `orca node join --type proxmox` flow and the existing TOFU `known_hosts` store (D-035). No new orchestration capability, no new node kind, no new API. They close a security gap explicitly deferred in v0.6, not open new surface area. Per `run.md` versioning logic this keeps v0.8 NFR (all phases fix/test/chore/perf/refactor). | 0.84 |
-| D-044 | Where does `--host-key-fingerprint` live — on `orca node join` or only on `--type proxmox`? | **On `orca node join` (root of the join subcommand), validated when `--type proxmox`** | The flag is generic (any future SSH-joined node kind will use it); gating it to `--type proxmox` only would require re-adding it later. Validation (`flag requires --type proxmox today`) happens in `RunE`, not in the flag declaration, so the flag is declared once on `node join` and the type check emits a clear error for non-proxmox types until other SSH-joined kinds exist. | 0.86 |
-| D-045 | `--host-key-fingerprint` format — raw hex, `sha256:`-prefixed, or OpenSSH `SHA256:base64`? | **OpenSSH `SHA256:base64` (the format `ssh-keyscan -E sha256 -D -` emits and operators expect)** | Matches the fingerprint format operators already see from `ssh-keyscan` and `orca node join`'s own `Result.HostKeyFingerprint` output. Accept only `SHA256:`-prefixed base64; reject raw hex with a clear error. Internally decode base64 → compare against `ssh.PublicKey` Marshal + sha256. | 0.88 |
-| D-046 | Does `orca node key-reset <node>` also revoke the orca pubkey on the remote host, or only clear the local `known_hosts` entry? | **Local `known_hosts` entry only** | Revoking the remote authorized_keys entry would orphan a working node (next dispatch would fail auth). `key-reset` is the local "forget this host's key" operation (mirrors `ssh-keygen -R host`); re-establishing trust is a separate `orca node join` re-run. Audit-log the reset with `actor`, `node`, `event=node.key_reset`. | 0.90 |
-| D-047 | Coverage target for P01 — 70% floor or higher? | **70% floor for the 6 under-50% packages; 50% floor for the 3 zero-test packages (`internal/audit`, `internal/certpaths`, `cmd/orca`) as a first-toe-hold** | 70% across the board for the already-tested packages matches D-042's "70% target for new packages" and is achievable without heroic mock effort. For the zero-test packages, going 0→50% is the realistic single-phase step (0→70% risks a coverage rathole on `cmd/orca` which is glue code); a future milestone can lift them to 70%. | 0.82 |

.ciagent/REQUIREMENTS.md

@@ -29,7 +29,7 @@ earlier versions of this file.
 | REQ-019 | Cobra CLI framework | High | v0.1 P01 | **Complete** |
 | REQ-020 | HCL parser integration (`hashicorp/hcl`) | Medium | v0.1 P03 | **Complete** |
 | REQ-021 | `os/exec` with `WaitDelay` (Go 1.25+) | Medium | v0.1 P03 | **Complete** |
-| REQ-022 | `iter.Seq` for streaming job lists (Go 1.25+) | Low | **v0.3 P01** | **Complete** (v0.3 P01 shipped v0.3.1) |
+| REQ-022 | `iter.Seq` for streaming job lists (Go 1.25+) | Low | **v0.3 P01** | Pending (v0.3 P01) |
 | REQ-023 | Self-signed mTLS cert generation | Medium | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
 | REQ-024 | `Makefile` with standard targets | High | v0.1 P01 | **Complete** |
 | REQ-025 | Bounded cert rotation history: retain last N=3 server certs per node for rollback | Medium | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
@@ -37,9 +37,9 @@ earlier versions of this file.
 | REQ-027 | `govulncheck` runs in offline mode in CI (no `vuln.go.dev` calls; pre-mirrored DB or `-format json` + `jq` gate) | High | v0.2 P03 | **Complete** (P10 shipped v0.2.3) |
 | REQ-028 | HCL/YAML schema for `NodeCapacity` declaration (`orca node join` flag and/or `~/.orca/node.hcl`) | High | v0.2 P02 | **Complete** (P09 shipped v0.2.2; `orca node capacity` CLI) |
 | REQ-029 | `gitleaks` baseline file committed to repo to suppress pre-existing `.env` SHA-1 leak in git history | Medium | v0.2 P03 | **Complete** (P10 shipped v0.2.3) |
-| REQ-030 | `--watch` output format mode: table (default) vs streaming one-line JSON per event | Low | **v0.3 P01** | **Complete** (v0.3 P01 shipped v0.3.1) |
+| REQ-030 | `--watch` output format mode: table (default) vs streaming one-line JSON per event | Low | **v0.3 P01** | Pending (v0.3 P01) |
 | REQ-031 | `go test -race` enabled in CI for all v0.2 packages | High | v0.2 P01–P04 | **Complete** (P10; `.coreci.yml` test pipeline runs `-race`) |
-| REQ-032 | `orca doctor` subcommand for diagnostics (CA/cert health, db integrity, peer reachability) | Medium | **v0.2 P01 / v0.3 P02** | **Complete** (cert checks P01 v0.2.1; network + db P02 v0.3.2) |
+| REQ-032 | `orca doctor` subcommand for diagnostics (CA/cert health, db integrity, peer reachability) | Medium | **v0.2 P01 / v0.3 P02** | **Partial** — cert checks complete (P01); network/db are stubs, full impl in v0.3 P02 |
 | REQ-033 | Cert file mode enforcement: 0600 for keys, 0644 for certs (refuses to start on violation) | High | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
 | REQ-034 | Cert proactive rotation alarm: structured slog WARN 30 days before `not_after` | Medium | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
 | REQ-035 | `orca cert show` redacts private key material from default and `--json` output | High | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
@@ -48,12 +48,6 @@ earlier versions of this file.
 | REQ-038 | Structured slog fields for mTLS failures: `event=mtls.handshake`, `peer`, `cert_fp`, `err` | Medium | **v0.2 P01** | **Complete** (P01 shipped v0.2.1) |
 | REQ-039 | `.gitleaks.toml` extended with stopwords for test data paths and CA cert PEM blocks | Medium | v0.2 P03 | **Complete** (P10 shipped v0.2.3) |
 | REQ-040 | `.golangci.yml` unified lint config superseding per-tool invocations | Low | v0.2 P03 | **Complete** (P10 shipped v0.2.3) |
-| REQ-041 | Unified namespace root via `ORCA_HOME` for all components (db, certs, init, daemon) | High | **v0.5 P1** | **Complete** (P1 shipped v0.4.2) |
-| REQ-042 | `--system` flag selects system-level namespace root `/root/.orca` | High | **v0.5 P1** | **Complete** (P1 shipped v0.4.2) |
-| REQ-043 | `install.sh` 1-liner pulling release binary from public Gitea URL; user-level default, `--system` for system-level | High | **v0.5 P2** | **Complete** (P2 shipped v0.4.3) |
-| REQ-044 | `install.sh` in-place update preserves config/state; idempotent re-run | High | **v0.5 P2** | **Complete** (P2 shipped v0.4.3) |
-| REQ-045 | Gitea repo + releases publicly accessible (unauthenticated download) | High | **v0.5 P0** | **Complete** (P0 ship: repo + org visibility public) |
-| REQ-046 | Docker image published to Gitea container registry per release | Medium | **v0.5 P3** | **Complete** (P3 shipped v0.4.4) |
 
 ## v0.1 Milestone Summary
 
@@ -77,66 +71,13 @@ deferred to v0.3.
 
 ## v0.3 Milestone Summary
 
-**Status: Complete** — P01 (iter.Seq streaming, v0.3.1) and P02 (doctor
-network+db, v0.3.2) both shipped. REQ-022, REQ-030, REQ-032 all complete.
-Re-init SPECIFY audit confirmed all other v0.2-deferred REQs (014, 027,
-028, 029, 031, 037, 039, 040) already shipped in P08-P10.
+**Status: In Progress** — 2 execution phases planned (P01 iter.Seq
+streaming, P02 doctor completion). Covers REQ-022, REQ-030, REQ-032
+(completion). Re-init SPECIFY audit confirmed all other v0.2-deferred
+REQs (014, 027, 028, 029, 031, 037, 039, 040) already shipped in
+P08-P10.
 
-## Deferred to v0.4
+## Deferred to v0.3
 
 - pprof endpoint on `orca daemon` (idea I-308, 0.70 confidence): deferred
   to keep v0.2 lean; revisit in v0.3 once P02's dispatcher is stable.
-
-## v0.5 Milestone Summary
-
-**Status: Complete** — all 3 execution phases + final review shipped.
-P0 (v0.4.1), P1 (v0.4.2), P2 (v0.4.3), P3 (v0.4.4), P4 final (v0.4.5).
-REQ-041..046 all complete. Repo + releases publicly accessible (REQ-045).
-Docker image published to Gitea container registry (REQ-046).
-
-- **P0** (v0.4.1): pre-execution + repo visibility flipped to public (REQ-045).
-- **P1** (v0.4.2): namespace unification — `ORCA_HOME` + `--system` (REQ-041/042).
-- **P2** (v0.4.3): `install.sh` 1-liner + in-place update (REQ-043/044) + README quickstart (REQ-016).
-- **P3** (v0.4.4): Docker release — distroless image + Gitea container registry (REQ-046).
-- **P4** (v0.4.5): final review + audit + milestone release.
-
-## v0.6 Requirements — Node Bootstrap & Proxmox
-
-| ID | Requirement | Priority | Phase | Status |
-|----|-------------|----------|-------|--------|
-| REQ-047 | `orca init` auto-provisions CA + server cert + DB migrations + localhost node (idempotent; safe re-run) | High | **v0.6 P1** | **Complete** (P1 shipped v0.5.1) |
-| REQ-048 | `orca init` registers a default `localhost` node with auto-detected OS via `/etc/os-release ID` | High | **v0.6 P1** | **Complete** (P1 shipped v0.5.1) |
-| REQ-049 | Node schema extension: `nodes.kind` (localhost\|linux\|proxmox) + `nodes.os` columns (migration 0006, backward-compatible) | High | **v0.6 P1** | **Complete** (P1 shipped v0.5.1) |
-| REQ-050 | `orca node join --type proxmox` SSH bootstrap via `golang.org/x/crypto/ssh` (new direct dep); password auth, deploy orca pubkey, create `orca` user (config-overridable), assign PVE role, drop sudoers allowlist; idempotent | High | **v0.6 P2** | **Complete** (P2 shipped v0.5.2) |
-| REQ-051 | Proxmox least-privilege `OrcaOperator` PVE role (VM.Audit, Datastore.AllocateSpace, SDN.Use) + `orca` user + `/etc/sudoers.d/orca` allowlist (pct, qm, pvesh, apt-get, dpkg); config-overridable user/role names | High | **v0.6 P2** | **Complete** (P2 shipped v0.5.2; refined: pvesh excluded per AD-020, orca@pam per AD-019) |
-| REQ-052 | `orca doctor` extensions: `doctor os` (verify localhost OS detection matches stored node row) + `doctor proxmox` (SSH-probe each `kind=proxmox` node with `pveversion`/`pvecmd status`, 3s timeout, PASS/WARN/FAIL); audit log all bootstrap + join actions | Medium | **v0.6 P3** | **Complete** (P3 shipped v0.5.3) |
-
-## v0.6 Milestone Summary
-
-**Status: Complete** — all 3 execution phases + final review shipped.
-P0 (v0.5.0), P1 (v0.5.1), P2 (v0.5.2), P3 (v0.5.3), P4 final (v0.5.4).
-REQ-047..052 all complete.
-
-- **P0** (v0.5.0): pre-execution (specify → clarify → research → plan). 8 decisions (D-030..D-037).
-- **P1** (v0.5.1): `orca init` full bootstrap + schema 0006 (REQ-047/048/049).
-- **P2** (v0.5.2): Proxmox SSH join + OrcaOperator role + sudoers (REQ-050/051).
-- **P3** (v0.5.3): `doctor os` + `doctor proxmox` + audit logging (REQ-052).
-- **P4** (v0.5.4): final review + audit + milestone release.
-
-## v0.7 Requirements — Hardening & Completion
-
-| ID | Requirement | Priority | Phase | Status |
-|----|-------------|----------|-------|--------|
-| REQ-053 | `orca cert` command tree registered on root command (`cert ca-init`, `cert gen`, `cert show`, `cert renew`, `cert fingerprint`) — code exists in `internal/cli/cert.go` but is never AddCommand'd; unreachable today | High | **v0.7 P1** | **Complete** (P1 shipped v0.6.1) |
-| REQ-054 | HCL config file parsing: `internal/config` package loads `~/.orca/config.hcl` / `/etc/orca/orca.hcl` (keys: db_path, listen_addr, ca_path, server_cert_path, server_key_path, node_capacity); merge precedence flag > env > file > default; `--config` flag on root command | High | **v0.7 P2** | **Complete** (P2 shipped v0.6.2) |
-| REQ-055 | Test coverage uplift: every package ≥ 50% — adds tests for `internal/engine` (executor, dispatcher, peer), `internal/transport` (mtls, dispatch, handshake_log), `internal/proxmox` (bootstrap SSH path), `internal/audit` | Medium | **v0.7 P3** | **Complete** (P3 shipped v0.6.3) |
-| REQ-056 | `--pprof <addr>` opt-in flag on `orca daemon` (default disabled); `net/http/pprof` mounted on a separate mux, never on the mTLS daemon listener | Low | **v0.7 P4** | **Complete** (P4 shipped v0.6.4) |
-
-## v0.8 Requirements — Coverage & Trust Hardening
-
-| ID | Requirement | Priority | Phase | Status |
-|----|-------------|----------|-------|--------|
-| REQ-057 | Test coverage uplift round 2: raise `internal/engine` (8.3%), `internal/proxmox` (5.1%), `internal/cli` (27.6%), `internal/transport` (26.3%), `internal/store` (46.7%), `internal/jobspec` (47.6%) to ≥ 70%; add first tests for `internal/audit`, `internal/certpaths`, `cmd/orca` (currently 0%) to ≥ 50% (D-047 tiered floor) | High | **v0.8 P1** | **Complete** (P1 shipped v0.7.1; all 9 packages exceeded floor) |
-| REQ-058 | `--host-key-fingerprint <SHA256:base64>` pre-pin flag on `orca node join` (validated when `--type proxmox`): when supplied, join fails fast if the SSH host key's OpenSSH SHA-256 fingerprint does not match; supersedes TOFU (D-035) for pre-pinned deployments (D-044, D-045) | Medium | **v0.8 P2** | **Complete** (P2 shipped v0.7.2) |
-| REQ-059 | `orca node key-reset <node>` command: clears the persisted SSH host key entry for the node from `~/.orca/known_hosts` only (local, not remote authorized_keys — D-046); audit-logs `event=node.key_reset`; next `doctor proxmox`/dispatch re-pins via TOFU or `--host-key-fingerprint` | Low | **v0.8 P2** | **Complete** (P2 shipped v0.7.2) |
-| REQ-060 | Requirement-status hygiene sweep: REQUIREMENTS.md v0.7 rows were stale ("Pending" after ship); add a verify-stage assertion that every REQ listed as `Complete` in ROADMAP.md has a matching `Complete` row in REQUIREMENTS.md, enforced by `make verify-reqs` | Medium | **v0.8 P3** | **Complete** (P3 shipped v0.7.3) |

.ciagent/RESEARCH_v0.5.md

@@ -1,161 +0,0 @@
-# Research: Orca v0.5 — Distribution
-
-Research findings for the v0.5 Distribution milestone (install, namespace,
-docker, public releases). Conducted during P0 RESEARCH under full autonomy.
-
-## R-001: Gitea Container Registry
-
-**Source**: https://docs.gitea.com/usage/packages/container (Gitea 1.27.1 docs)
-
-**Findings**:
-- Gitea ships a built-in OCI-compliant container registry.
-- Image naming convention: `{registry}/{owner}/{image}:{tag}`.
-  For orca: `git.cloudinit.dev/coreci/orca:{tag}`.
-- Auth: `docker login git.cloudinit.dev` with username + personal access
-  token (or password if no 2FA). The `GITEA_TOKEN` env var already used
-  for release publishing works as the password.
-- Push: `docker push git.cloudinit.dev/coreci/orca:v0.4.4`.
-- Pull: anonymous pull works **if the repo is public** (REQ-045 flips
-  this). For private repos, pull requires auth.
-- Tags are case-insensitive — use lowercase image names.
-- The registry supports multi-arch manifests via `docker buildx`.
-
-**Implication for P03**: `scripts/release.sh` must add a `docker build`
-+ `docker login` + `docker push` step. The `.coreci.yml` release
-pipeline needs a `container-publish` step. Credential is `GITEA_TOKEN`
-(reused from the existing release flow — no new secret needed).
-
-## R-002: `tea repos edit` — Repo Visibility
-
-**Source**: `tea repos edit --help` (tea 0.14.1 installed locally)
-
-**Findings**:
-- Command: `tea repos edit --private false --repo coreci/orca`
-- The `--private` flag accepts `true`/`false` (string, not bool).
-- Default login `bot` (cloudinit-bot) is already configured and is the
-  default login. No extra auth needed.
-- The change is immediate and reversible (re-run with `--private true`).
-
-**Implication for P0 ship**: Run this as an operational step during the
-P0 ship. Verify with unauth `curl` against the releases API afterward.
-
-## R-003: Gitea Releases API — Asset Download URLs
-
-**Source**: `/api/v1/repos/coreci/orca/releases/latest` (authed probe)
-
-**Findings**:
-- Auth header format: `Authorization: token <GITEA_TOKEN>` (NOT basic
-  auth — basic auth returns "invalid username, password or token").
-- Latest release endpoint: `GET /api/v1/repos/coreci/orca/releases/latest`
-  → JSON with `tag_name`, `name`, `body`, `assets[]`.
-- Each asset has `browser_download_url` — the direct download URL.
-- **Public access**: once the repo is public (R-002), the releases API
-  and asset downloads work **without authentication**. This is what
-  `install.sh` relies on (REQ-043).
-- Asset naming convention from existing releases:
-  `orca-{version}-linux-amd64.tar.gz` (per `scripts/release.sh`).
-
-**Implication for P02 install.sh**:
-1. Query `GET /api/v1/repos/coreci/orca/releases/latest` (unauth, post-R-002).
-2. Parse `tag_name` for the version.
-3. Find the asset with `name` matching `orca-{tag}-linux-{arch}.tar.gz`.
-4. Download `browser_download_url` with `curl -fsSL`.
-5. Extract and install.
-
-## R-004: ORCA_HOME Propagation Points (Codebase Audit)
-
-**Source**: `grep` for `UserHomeDir|os.Getenv("ORCA|\.orca` across `*.go`
-
-**Findings** — exactly 3 production code sites determine the namespace
-root today:
-
-| File | Current behavior | Needs change? |
-|------|-----------------|----------------|
-| `internal/certpaths/certpaths.go:21-26` | `Dir()` honors `ORCA_HOME` → `~/.orca` | **No** — this is the single source of truth. Already correct. |
-| `internal/store/store.go:13-19` | `Open("")` hardcodes `~/.orca/orca.db` (ignores `ORCA_HOME`) | **Yes** — route through `certpaths.DBPath()` instead. |
-| `internal/cli/init.go:16-22` | Hardcodes `~/.orca` via `os.UserHomeDir()` | **Yes** — route through `certpaths.Dir()`. |
-
-All other call sites (`node.go:openDB`, `daemon.go`, `job.go`, `doctor.go`,
-`cert.go`) already go through `certpaths.DBPath()` or `certpaths.Dir()`
-indirectly. **No other files need changes for REQ-041.**
-
-**For REQ-042 (`--system`)**: Add a `--system` persistent flag on
-`rootCmd`. When set, `rootCmd.PersistentPreRunE` sets
-`os.Setenv("ORCA_HOME", "/root/.orca")` before any subcommand runs.
-This is the minimal-touch approach — all downstream code already
-honors `ORCA_HOME`. The flag is a CLI convenience that maps to the
-env var, not a parallel mechanism.
-
-**Backward compatibility**: empty `ORCA_HOME` + no `--system` →
-`~/.orca` (unchanged). Existing tests that `t.Setenv("ORCA_HOME", ...)`
-continue to work.
-
-## R-005: Distroless Base Image for CGO-free Go Binaries
-
-**Source**: Go module audit — `modernc.org/sqlite` (pure Go, CGO-free),
-`go.mod` has no CGO dependencies.
-
-**Findings**:
-- `gcr.io/distroless/static-debian12` is the correct base for static
-  Go binaries with no CGO and no libc dependency. ~2MB image.
-- orca uses `modernc.org/sqlite` (pure Go) — no CGO, no libc. ✓
-- Multi-stage Dockerfile:
-  - Stage 1 (`golang:1.25`): build with `-trimpath -ldflags` (same as
-    Makefile), output `bin/orca`.
-  - Stage 2 (`gcr.io/distroless/static-debian12`): `COPY bin/orca /orca`,
-    `ENTRYPOINT ["/orca"]`.
-- `CGO_ENABLED=0` must be set in the build stage to guarantee a static
-  binary (Go defaults to CGO_ENABLED=1 on platforms with a C compiler).
-- The image runs as `nonroot` user by default in distroless — but orca
-  writes to `~/.orca` (or `/root/.orca` for `--system`). For the
-  container image, default `ORCA_HOME=/var/lib/orca` and document
-  volume mount at that path.
-
-**Implication for P03**: Dockerfile is ~15 lines. The `.coreci.yml`
-release pipeline adds a `docker build --build-arg VERSION=$VERSION -t
-git.cloudinit.dev/coreci/orca:$VERSION .` step + login + push.
-
-## R-006: install.sh Conventions (curl|sh pattern)
-
-**Source**: Common patterns from deno, rustup, homebrew installers.
-
-**Findings**:
-- 1-liner: `curl -fsSL <url> | bash` (or `| bash -s -- --system`).
-- The script must be downloadable from a stable URL. orca's script
-  lives at `scripts/install.sh` in the repo, accessible via
-  `https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh`
-  (once repo is public per R-002).
-- Args passed via `bash -s -- --system --version v0.4.4`.
-- In-place update: detect existing binary at install path, read its
-  version via `orca version --json` (parse `version` field), print
-  "updated from X to Y", overwrite binary. **Never** touch the
-  namespace dir (`~/.orca` or `/root/.orca`) — that's user state.
-- User-level default: `~/.local/bin/orca` (XDG-ish, on PATH on most
-  modern distros). System-level: `/usr/local/bin/orca` (requires root).
-
-**Implication for P02**: install.sh is ~80-100 lines of bash. Idempotent.
-Tested via a `scripts/install_test.sh` that mocks the download and
-verifies path selection + update-in-place.
-
-## Pitfalls (P-001..P-003)
-
-- **P-001**: `docker` may not be available in the CoreCI release
-  pipeline container. The `.coreci.yml` release step uses
-  `image: golang:1.25` which does NOT include docker. **Mitigation**:
-  the release pipeline must use a `docker:dind` sidecar or a step image
-  that has the docker CLI. Alternatively, `scripts/release.sh` handles
-  docker publish only when run locally or in a CI step that has docker.
-  The `.coreci.yml` container step must use an image with docker CLI
-  (e.g., `catthehacker/docker:docker-latest` or a custom image).
-
-- **P-002**: Making the repo public exposes git history including the
-  pre-existing `.env` SHA-1 leak (commit `00127ce` documented the
-  rotate-forward decision; `.gitleaks-baseline.json` suppresses it for
-  scanning). The leak is a **non-secret** (the token was rotated). This
-  is an accepted risk per the existing decision — no new action needed,
-  but document it in the P0 ship commit.
-
-- **P-003**: `CGO_ENABLED=0` must be explicit in the Dockerfile build
-  stage. Without it, `go build` in `golang:1.25` may produce a
-  dynamically-linked binary that won't run in distroless. Verified:
-  orca has no CGO deps, but `CGO_ENABLED=0` is belt-and-suspenders.

.ciagent/RESEARCH_v0.6.md

@@ -1,250 +0,0 @@
-# Research: Orca v0.6 — Node Bootstrap & Proxmox
-
-Findings grounded in codebase analysis (8 key files read) + verified
-against `golang.org/x/crypto` v0.54.0 (probe built clean), Proxmox VE
-9.2.3 admin guide (§14.7-14.8 pveum + privileges), sudoers(5) man
-page (NOEXEC/NOPASSWD), and freedesktop.org os-release spec.
-
-## A. SSH library — `golang.org/x/crypto/ssh`
-
-### A.1 go.mod addition
-
-```
-require golang.org/x/crypto v0.54.0
-```
-
-Latest available, compatible with go 1.25. Transitive deps (verified
-by probe build):
-- `golang.org/x/crypto v0.54.0` (direct)
-- `golang.org/x/sys v0.47.0` (indirect — bumps from v0.42.0)
-- `golang.org/x/term v0.45.0` (indirect — pulled by ssh for PTY)
-
-**3 module entries, 0 new heavy deps.** Matches D-030 minimal-deps
-rationale. `go.sum` gains ~6 lines.
-
-### A.2 Minimal API surface
-
-```go
-import (
-    "crypto/ed25519"
-    "crypto/rand"
-    "crypto/x509"
-    "encoding/pem"
-    "net"
-    "time"
-    "golang.org/x/crypto/ssh"
-    "golang.org/x/crypto/ssh/knownhosts"
-)
-```
-
-Key functions:
-- `ssh.Dial(network, addr, config) (*ssh.Client, error)` — high-level dialer
-- `(*ssh.Client).NewSession() (*ssh.Session, error)`
-- `(*ssh.Session).CombinedOutput(cmd) ([]byte, error)` — run + capture
-- `ssh.ClientConfig{User, Auth, HostKeyCallback, Timeout}`
-- `ssh.Password(secret) ssh.AuthMethod` — password auth
-- `ssh.PublicKeys(signer) ssh.AuthMethod` — pubkey auth
-- `ssh.ParsePrivateKey(pem) (ssh.Signer, error)` — parse PKCS8 PEM (works with orca's existing key format)
-- `ssh.NewPublicKey(pub) (ssh.PublicKey, error)` + `ssh.MarshalAuthorizedKey(pub) []byte` — authorized_keys line
-- `ssh.FixedHostKey(key) ssh.HostKeyCallback` — strict pin (subsequent connects)
-- `knownhosts.New(path) (ssh.HostKeyCallback, error)` — TOFU via known_hosts file (cleaner than custom callback; avoids deprecated `InsecureIgnoreHostKey`)
-
-### A.3 Ed25519 keygen (D-037)
-
-Verified end-to-end: `ed25519.GenerateKey(rand.Reader)` →
-`x509.MarshalPKCS8PrivateKey(priv)` → PEM encode → `ssh.ParsePrivateKey`
-round-trips cleanly. `ssh.MarshalAuthorizedKey` produces valid
-`ssh-ed25519 AAAA...` line. **PKCS8 PEM (orca's existing format)
-parses with `ssh.ParsePrivateKey` — no OpenSSH-format marshaller
-needed.** Reuse `security.WriteKey`/`writeAtomic` for persistence.
-
-### A.4 File upload — `cat > file` via session, NOT SFTP
-
-SFTP lives in separate module `github.com/pkg/sftp` — would add a 4th
-direct dep beyond D-030. The only files orca uploads are:
-- `~orca/.ssh/authorized_keys` (1-line append)
-- `/etc/sudoers.d/orca` (few lines)
-
-Both are text. Use `session.CombinedOutput` with heredoc / `tee -a`.
-Keeps everything within `x/crypto/ssh`.
-
-### A.5 TOFU host-key handling (D-035)
-
-Use `golang.org/x/crypto/ssh/knownhosts.New(path)` as the
-`HostKeyCallback`. On first connect, the callback writes the host key
-to `~/.orca/known_hosts` (OpenSSH format). On subsequent connects, it
-verifies and returns an error on mismatch. **Avoids
-`ssh.InsecureIgnoreHostKey` deprecation** — `knownhosts.New` handles
-both capture and verify in one callback. On host-key change
-(reinstall), fail closed with a clear error; operator runs
-`orca node key-reset <node>` (future) or manually edits `known_hosts`.
-
-## B. `/etc/os-release` parsing (D-032)
-
-### B.1 Confirmed `ID=` values
-
-| Distro | `ID=` | `ID_LIKE=` | Verified |
-|--------|-------|-----------|----------|
-| Ubuntu | `ubuntu` | `debian` | ✅ (this host: Ubuntu 24.04) |
-| Debian | `debian` | — | ✅ (freedesktop spec) |
-| Alpine | `alpine` | — | ✅ (Alpine policy) |
-| Proxmox VE | `pve` | `debian` | ✅ (PVE ships own os-release) |
-
-`VARIANT_ID` absent on all four target distros — not worth capturing
-for v0.6.
-
-### B.2 Parsing approach
-
-No Go stdlib helper. Trivial: `bufio.Scanner` +
-`strings.SplitN(line, "=", 2)` + strip surrounding quotes. ~15 lines.
-Returns `map[string]string`; read `ID` field. Fallback `"linux"` if
-file missing or `ID` absent (D-032). Read `/etc/os-release` first;
-fall back to `/usr/lib/os-release` for minimal containers. Unknown `ID`
-values stored verbatim (not masked) — `doctor os` can warn.
-
-## C. Proxmox VE role & user management
-
-### C.1 Realm: `orca@pam` (NOT `orca@pve`)
-
-Confirmed by both researchers + PVE User Management docs: since
-`orca node join` SSHes in and creates a Linux system user via
-`useradd`, the PVE user must be `orca@pam` (PAM realm maps to host
-system users). `orca@pve` would require a separate PVE-internal
-password and interactive `-password` prompt over non-PTY SSH (hangs).
-`@pam` sidesteps both issues. **D-033 refined: `orca@pam`.**
-
-### C.2 OrcaOperator PVE role — privilege set
-
-Per D-033 (operator-confirmed): `VM.Audit`, `Datastore.AllocateSpace`,
-`SDN.Use`. This is a **minimal API-level role** — the actual management
-capability comes from the sudoers allowlist (sudo runs as root, bypassing
-PVE RBAC). The PVE role governs non-sudo API access (future REST client).
-
-**Refinement from research**: `VM.Audit` covers containers (CTs) as well
-as VMs (both live under `/vms/{vmid}` path; no separate `CT.*` family).
-PVE 8→9: privilege set valid on both (no breaking changes to pveum or
-the core privilege names).
-
-Researcher 2 proposed an expanded 21-privilege set for fuller API-level
-management. **Decision: keep D-033's 3-priv minimal set for v0.6** — the
-operator explicitly confirmed it, and the sudoers allowlist is the
-primary management path. The expanded set is noted as a v0.7+
-enhancement option if orca adds a direct PVE REST client.
-
-### C.3 pveum command sequence (idempotent)
-
-```bash
-# 1. Role — probe-then-add (pveum role add fails if exists)
-pveum role list | grep -q '^OrcaOperator' || \
-  pveum role add OrcaOperator --privs "VM.Audit Datastore.AllocateSpace SDN.Use"
-
-# 2. User — probe-then-add (maps to existing Linux system user)
-pveum user list | grep -q 'orca@pam' || \
-  pveum user add orca@pam -comment "Orca automation user"
-
-# 3. ACL — modify is idempotent (creates or updates)
-pveum acl modify / -user orca@pam -role OrcaOperator
-```
-
-Flag syntax: both `-privs` and `--privs` work (Perl Getopt::Long). Use
-`--privs` (canonical). Privs are **space-separated** inside quotes
-(NOT comma-separated).
-
-### C.4 sudoers file `/etc/sudoers.d/orca` (D-033 refined)
-
-**Research refinement**: exclude `pvesh` from sudoers — `pvesh` can
-reach the `/nodes/{node}/execute` API endpoint which spawns shell
-commands server-side, bypassing sudo's `NOEXEC` tag. Keep `pct`/`qm`
-with `NOEXEC`; `apt-get`/`dpkg` without `NOEXEC` (they need to spawn
-child processes for maintainer scripts).
-
-```
-# /etc/sudoers.d/orca — mode 0440, owner root:root
-# Orca automation: VM/CT management + package management, no shell escape
-orca ALL=(root) NOPASSWD: NOEXEC: /usr/bin/pct, /usr/bin/qm
-orca ALL=(root) NOPASSWD: /usr/bin/apt-get, /usr/bin/dpkg
-```
-
-`NOEXEC` works via Linux seccomp (sudoers man page). `pct`/`qm` are
-Perl scripts run via dynamically-linked `/usr/bin/perl` → NOEXEC
-effective. `apt-get`/`dpkg` need exec for postinst scripts → no
-NOEXEC. File mode **0440** or sudo refuses to load. Validate with
-`visudo -cf /etc/sudoers.d/orca` after writing; abort bootstrap on
-validation failure.
-
-**Resolve binary paths at runtime** via `command -v pct` etc. before
-writing the sudoers file (cheap insurance against non-standard installs).
-
-### C.5 PVE 8 vs 9
-
-No breaking changes to pveum, privilege names, or sudo defaults
-between 8 and 9. `VM.Monitor` removed in 9.0 (OrcaOperator doesn't
-use it). Privileged container creation needs `Sys.Modify` in 9.0
-(OrcaOperator doesn't have it → intended). Both versions: `orca@pam`
-flow identical. Binary paths identical (`/usr/bin/{pct,qm,pvesh}`).
-
-## D. Codebase integration points (confirmed by reading files)
-
-### D.1 Files to modify/create per requirement
-
-| File | Change | REQ |
-|------|--------|-----|
-| `go.mod` / `go.sum` | Add `golang.org/x/crypto v0.54.0`; bump sys, add term | REQ-050 |
-| `internal/model/node.go` | Add `Kind`, `OS` string fields + `NodeKind` constants | REQ-049 |
-| `internal/store/migrations/0006_node_kind_os.sql` | **NEW**: `ALTER TABLE nodes ADD COLUMN kind TEXT; ADD COLUMN os TEXT;` (nullable, backward-compatible) | REQ-049 |
-| `internal/store/node_repo.go` | Extend INSERT/SELECT/scanNode for `kind, os`; add `GetByName`, `UpdateLastSeenAndOS` helpers | REQ-049 |
-| `internal/cli/init.go` | Full bootstrap: MkdirAll → store.Open (runs migrations) → CAInit → server cert gen (if absent) → detectOS → localhost node upsert | REQ-047,048 |
-| `internal/cli/node.go` | Add `--type`, `--host`, `--user`, `--password`, `--proxmox-user`, `--proxmox-role` flags; `bootstrapProxmox` branch | REQ-050,051 |
-| `internal/security/sshkey.go` | **NEW**: `GenerateOrLoadSSHKey(dir)` — Ed25519 keygen, PKCS8 PEM, 0600/0644 modes | REQ-050 |
-| `internal/proxmox/bootstrap.go` | **NEW package**: `BootstrapProxmox(ctx, opts)` — SSH dial, pubkey deploy, useradd, pveum role/user/acl, sudoers write, visudo validate | REQ-050,051 |
-| `internal/doctor/doctor.go` | Add `OS()` and `Proxmox()` checks; extend `All()` | REQ-052 |
-| `internal/cli/doctor.go` | Add `doctor os` + `doctor proxmox` subcommands | REQ-052 |
-| `internal/certpaths/certpaths.go` | Add `SSHKeyPath`, `SSHPubPath`, `KnownHostsPath` | REQ-050 |
-
-### D.2 Reuse opportunities (confirmed)
-
-- `security.CAInit` (ca.go:63) — **already idempotent** (fast-path loads existing). `orca init` calls it directly.
-- `security.GenerateCSR` (csr.go) — signature fits: `GenerateCSR("localhost", []string{"localhost","127.0.0.1"})`.
-- `security.WriteCert`/`WriteKey` (ca.go:292) — enforce 0644/0600 via `writeAtomic`; reuse for SSH key.
-- `store.Open` (migrate.go) — runs migrations on open; calling it in `orca init` auto-applies 0006.
-- Migration runner — FS-embedded, sorts lexicographically, idempotent per-file. Adding `0006_*.sql` is the entire change.
-- `doctor.Network()` (doctor.go:222) — exact pattern to clone for `doctor.Proxmox()` (list nodes, filter by kind, 3s timeout per peer, PASS/WARN/FAIL).
-
-### D.3 No changes needed
-
-- `internal/security/ca.go`, `csr.go` — idempotent already, signatures fit.
-- `internal/store/migrate.go` — runner is generic.
-- `internal/transport/*` — mTLS transport not involved in SSH bootstrap.
-- `internal/engine/*` — NodeRegistry.Join works; new fields are metadata.
-
-## E. Pitfalls & gotchas
-
-1. **`pveum` flag is `--privs` (space-separated)**, not `--privs "a,b,c"`. Confirmed by both researchers + official docs.
-2. **`orca@pam` not `orca@pve`** — PVE-internal realm requires interactive password prompt over non-PTY SSH (hangs). PAM realm maps to the Linux system user orca creates.
-3. **Exclude `pvesh` from sudoers** — `pvesh` can trigger API `execute` endpoint spawning shell commands server-side, bypassing `NOEXEC`. Use PVE API via OrcaOperator role for API access instead.
-4. **`NOEXEC` only on dynamically-linked binaries** — `pct`/`qm` are Perl scripts via dynamically-linked `/usr/bin/perl` → effective. `apt-get`/`dpkg` need exec → no NOEXEC.
-5. **sudoers file mode 0440** — or sudo silently refuses to load it. `chmod 0440` + `visudo -cf` validate after write.
-6. **Migration 0006 NULL handling** — `scanNode` must use `sql.NullString` for `kind`/`os` and map NULL → `""` (Go struct fields are `string`, not `*string`).
-7. **localhost node idempotency** — `NodeRepo.Insert` fails on UNIQUE constraint if `orca init` re-runs. Need `GetByName("localhost")` check first; if found, `UpdateLastSeenAndOS` instead of `Insert`. Don't change `id` or `joined_at` (D-036).
-8. **`orca init` must not regenerate server cert** (D-036) — check `certpaths.ServerCertPath()` existence before `GenerateCSR`. `CAInit` has a fast-path; server cert gen needs an explicit existence check.
-9. **Password handling (D-031)** — `--password` flag visible in `ps`/`/proc` briefly. Prefer `$ORCA_PROXMOX_PASSWORD` env var. Never log the password (slog redaction). Zero the byte slice after use.
-10. **`knownhosts.New` for TOFU** — avoids deprecated `ssh.InsecureIgnoreHostKey`. Handles both capture and verify in one callback.
-11. **PKCS8 PEM parses with `ssh.ParsePrivateKey`** — no need for OpenSSH-format marshaller. Consistent with `ca.key`/`server.key` format.
-12. **`/etc/os-release` is a symlink** on most distros → `os.ReadFile` follows it. Fall back to `/usr/lib/os-release` for minimal containers.
-
-## F. Persona recommendations (v0.6 roster)
-
-| Persona | Active | Reason |
-|---------|--------|--------|
-| `lead-developer` | ✅ | Coordination across P01/P02/P03; SSH/bootstrap touches security + cli + store + doctor |
-| `backend-engineer` | ✅ | Owns `internal/cli/init.go` full-bootstrap orchestration + `internal/proxmox/bootstrap.go` SSH logic |
-| `cli-engineer` | ✅ | Owns `--type`/`--host`/`--password` flag wiring, `doctor os`/`doctor proxmox` subcommands, init output UX |
-| `data-engineer` | ✅ **REACTIVATE** | Owns migration 0006 + `NodeRepo` schema extension (kind/os columns, new helpers) |
-| `security-engineer` | ✅ **REACTIVATE** | Owns `internal/security/sshkey.go`, TOFU host-key, sudoers design, password redaction, audit logging |
-| `devops-engineer` | ❌ **DEACTIVATE** | No install.sh/Dockerfile/.coreci.yml surface in v0.6 |
-| `network-engineer` | ❌ | No transport/mTLS surface (SSH is point-to-point bootstrap, not mesh) |
-| `frontend-engineer` | ❌ | No web UI |
-
-**Territory overlaps to adjudicate (lead-developer)**:
-- `internal/proxmox/bootstrap.go` (security-engineer SSH/sudoers logic) vs `internal/cli/node.go` (cli-engineer flag wiring) — boundary: security package exposes `BootstrapProxmox(ctx, opts) error`, CLI just calls it.
-- `internal/doctor/doctor.go` `Proxmox()` reuses SSH client from `internal/proxmox` (security) but check scaffolding clones `doctor.Network()` pattern (backend adjudicates since network-engineer deactivated).

.ciagent/RESEARCH_v0.7.md

@@ -1,161 +0,0 @@
-# Research: Orca v0.7 — Hardening & Completion
-
-## 1. Codebase audit findings (RESEARCH stage)
-
-A full codebase audit surfaced the gaps that define the v0.7 scope.
-Each finding is grounded in a specific file/coverage measurement.
-
-### 1.1 `orca cert` command tree is unreachable (critical)
-
-- `internal/cli/cert.go:44` exports `NewCommand(log *slog.Logger)
-  *cobra.Command` which builds the full `cert ca-init | gen | show |
-  renew | fingerprint` tree (5 subcommands, all implemented, all
-  spec-compliant per REQ-033/035/036).
-- **No file in the repo calls `NewCommand` or registers it on
-  `rootCmd`.** `grep -rn "rootCmd.AddCommand" internal/cli/` lists
-  daemon, init, audit, version, job, node, doctor, status — `cert` is
-  absent. `./bin/orca cert` returns `error: unknown command "cert"`.
-- The function is named `NewCommand` (not `newCertCmd`), so it is not
-  picked up by any init-based registration convention.
-- **Impact**: every cert operation the spec promises (REQ-023, REQ-025,
-  REQ-033, REQ-035, REQ-036) is unreachable from the CLI. Operators
-  cannot bootstrap a CA, issue a server cert, or rotate one without
-  hand-crafting calls into the `security` package. This is the single
-  highest-impact bug in the v0.1–v0.6 line.
-- **Fix**: one-line `rootCmd.AddCommand(NewCommand(log))` in
-  `internal/cli/cert.go` (or a new `init()`), plus a regression test
-  that asserts `rootCmd.Commands()` contains a child whose `Use ==
-  "cert"`.
-
-### 1.2 `internal/store/cert_repo.go` has no test file
-
-- `internal/store/cert_repo.go` exists (the `certs` table from
-  migration 0004) but `internal/store/cert_repo_test.go` does not.
-- Every other repo in `internal/store/` has a `_test.go`:
-  `node_repo_test.go`, `job_task_repo_test.go`, `capacity_repo_test.go`,
-  `audit_repo_test.go`, `migrate_test.go`.
-- **Fix**: add `cert_repo_test.go` covering Insert/Get/List/rotation
-  history (N=3 per REQ-025) + serial_hex uniqueness.
-
-### 1.3 Low test coverage in core packages
-
-| Package | Coverage | Missing tests for |
-|---------|----------|-------------------|
-| `internal/engine` | 8.3% | `executor.go`, `dispatcher.go`, `peer.go` (only `scheduler_test.go` exists) |
-| `internal/transport` | 26.3% | `mtls.go`, `dispatch.go`, `handshake_log.go` (only `idempotency_test.go` exists) |
-| `internal/proxmox` | 5.1% | `bootstrap.go` SSH path (only `bootstrap_test.go` exists, exercises the no-op dry-run) |
-| `internal/audit` | no test files | `audit.go` (Emit, EmitWithErr, LogHandshake*) |
-
-- Target per D-042: 50% floor per package, 70% for new code in P02/P04.
-- Strategy: table-driven tests + `httptest.NewTLSServer` for transport;
-  interface-based mocks for the SSH dialer (already an interface in
-  `proxmox/bootstrap.go:211` `defaultSSHDialer` with `DialContext`).
-
-### 1.4 No HCL config file parser
-
-- D-009 specified `~/.orca/config.hcl` and `/etc/orca/orca.hcl` as
-  config locations. `find . -name "*.hcl"` returns only testdata
-  (`testdata/hello.hcl`, `testdata/fail.hcl`) used by jobspec tests.
-- The CLI relies entirely on flags + env vars (`ORCA_HOME`,
-  `ORCA_DB`, `ORCA_PROXMOX_PASSWORD`). There is no `internal/config`
-  package.
-- `internal/jobspec/spec.go:40` already uses
-  `hclsimple.Decode(filename, data, nil, &spec)` — the exact same
-  pattern works for a `Config` struct. No new dep required (hashicorp/hcl/v2
-  is already a direct dep).
-- **Fix**: new `internal/config` package with a `Config` struct (HCL
-  tags: `db_path`, `listen_addr`, `ca_path`, `server_cert_path`,
-  `server_key_path`, `node_capacity`), a `Load(paths ...string)`
-  function, and a `--config` flag on the root command. Precedence per
-  D-039: flag > env > file > default.
-
-### 1.5 pprof endpoint (I-308, deferred since v0.2)
-
-- I-308 was deferred in v0.2 IDEATE ("keep v0.2 lean") and never
-  revisited. The daemon (`internal/daemon/server.go`) has no pprof
-  surface today.
-- `net/http/pprof` is stdlib — zero new deps. Mount on a separate
-  `*http.ServeMux` so it never touches the mTLS daemon listener.
-- **Fix**: `--pprof <addr>` flag on `orca daemon` (default disabled).
-  If set, start a second `http.Server` on `<addr>` with
-  `pprof.Index`/`pprof.Cmdline`/etc. registered. Log a WARN that the
-  endpoint is unauthenticated + operator-only.
-
-## 2. Prior art & patterns
-
-### 2.1 HCL config in HashiCorp tools
-
-Nomad, Consul, and Terraform all use HCL for config with the same
-`hclsimple.Decode` + struct-tag pattern. The precedence model (flag >
-env > file > default) is the de-facto standard; Viper implements it but
-adds a large dep. Orca's `internal/config` will implement the 4-layer
-merge by hand (~80 LOC) to stay minimal-deps.
-
-### 2.2 pprof in Go daemons
-
-Standard pattern: `import _ "net/http/pprof"` registers handlers on
-`http.DefaultServeMux`. Best practice for production daemons is a
-**separate listener** (not DefaultServeMux) so pprof is never exposed
-on the public port. Orca will use a dedicated `*http.ServeMux` +
-`http.Server` on the `--pprof` addr, default disabled.
-
-### 2.3 Test coverage for concurrent Go
-
-`internal/engine` (executor, dispatcher) and `internal/transport`
-(mtls, dispatch) are concurrent. Coverage strategy:
-- `httptest.NewTLSServer` for transport — exercise real TLS handshakes
-  against an in-process server.
-- Interface-based mocks for the SSH dialer (proxmox) and the peer
-  client (transport) — both already have interface seams.
-- `sync.WaitGroup` + channel assertions for executor/dispatcher
-  lifecycle.
-- `-race` is already on in CI (REQ-031) — new tests inherit it.
-
-## 3. v0.7 Architectural Decisions (AD-022..AD-026)
-
-| ID | Decision | Rationale |
-|----|----------|-----------|
-| AD-022 | `orca cert` registered via `init()` in `cert.go` calling `rootCmd.AddCommand(NewCommand(slog.Default()))` | Keeps registration co-located with the command definition; matches the pattern in `daemon.go`/`audit.go` where each command file self-registers. Avoids a central registration function that would drift. |
-| AD-023 | `internal/config` package: `Config` struct + `Load(paths ...string) (*Config, error)`; no global singleton | Config is passed explicitly to `daemon.NewServer`, `cli` commands, etc. No package-level state — testable, no init-order surprises. |
-| AD-024 | pprof on a separate `*http.Server` + `*http.ServeMux`, default disabled | Never co-mingles with the mTLS daemon listener. Operator opts in via `--pprof :6060`. Matches Go daemon best practice. |
-| AD-025 | Coverage floor measured per-package via `go test -cover ./<pkg>` | No aggregate threshold (aggregates hide low-coverage packages). CI gate added in P03: `go test -cover ./internal/engine ./internal/transport ./internal/proxmox ./internal/audit` and assert each ≥ 50%. |
-| AD-026 | No new direct dependencies in v0.7 | `net/http/pprof` (stdlib), `hashicorp/hcl/v2` (already direct). v0.7 preserves the minimal-deps ethos. |
-
-## 4. PERSONAS assessment
-
-v0.7 is an NFR milestone touching CLI, config, tests, and daemon. The
-default 3-persona roster (lead-developer, backend-engineer,
-data-engineer) is sufficient:
-
-- **lead-developer**: owns P01 (cert registration) + P04 (pprof) — CLI/
-  daemon territory.
-- **backend-engineer**: owns P02 (config package) — internal/config +
-  CLI integration.
-- **data-engineer**: owns P01 cert_repo tests + P03 store coverage —
-  `internal/store` territory.
-- **lead-developer** also owns P03 engine/transport/proxmox/audit
-  coverage (test-only phase, no schema changes).
-
-No new personas needed. No phase-specific personas. Territory
-enforcement stays `warn`. See `.ciagent/PERSONAS.md` (updated).
-
-## 5. Dependencies
-
-v0.7 adds **zero** new direct dependencies:
-- HCL parsing: `hashicorp/hcl/v2` (already direct, used by jobspec).
-- pprof: `net/http/pprof` (stdlib).
-- Tests: `net/http/httptest` (stdlib), existing interfaces.
-
-`go.mod` is unchanged by v0.7.
-
-## 6. Risks
-
-- **P01 cert registration** may surface latent bugs in the cert
-  subcommands (they've never been exercised end-to-end). Mitigation:
-  P01 includes a smoke test that runs `cert ca-init` + `cert gen` +
-  `cert show` + `cert fingerprint` against a temp `ORCA_HOME`.
-- **P02 config precedence** is easy to get wrong (flag/env/file/default
-  merge order). Mitigation: table-driven test covering all 4 layers.
-- **P03 coverage** on concurrent packages may reveal race conditions
-  (already hidden by the 8.3% coverage). Mitigation: `-race` is on; P03
-  fixes any races it uncovers as part of the same phase.

.ciagent/RESEARCH_v0.8.md

@@ -1,285 +0,0 @@
-# Research: Orca v0.8 — Coverage & Trust Hardening
-
-Findings grounded in codebase analysis (44 source/test files read, coverage
-re-measured for all 9 target packages) + `golang.org/x/crypto` v0.54.0 API
-verification (`ssh.FingerprintSHA256`, `knownhosts.Line`/`Normalize`/`KeyError`).
-
-## 1. Coverage analysis (P01 — REQ-057)
-
-### 1.1 Re-measured coverage (confirmed via `go test ./<pkg>/... -cover`)
-
-| Package | Coverage | Tier (D-047) | Notes |
-|---------|----------|--------------|-------|
-| `internal/engine` | **8.3%** | ≥ 70% floor | Only `scheduler_test.go` (4 tests, 66 LOC); executor/dispatcher/peer/registry/audit untested |
-| `internal/proxmox` | **5.1%** | ≥ 70% floor | Only `bootstrap_test.go` (4 tests, validation + sudoersContent string asserts); SSH dial path untested |
-| `internal/cli` | **27.6%** | ≥ 70% floor | 5 test files (root, init, namespace, osdetect, watch); node/job/cert/doctor/audit/cmds untested |
-| `internal/transport` | **26.3%** | ≥ 70% floor | Only `idempotency_test.go` (7 tests); mtls/dispatch/retry/handshake_log untested |
-| `internal/store` | **47.2%** | ≥ 70% floor | node_repo + job_task + capacity + audit + migrate tested; **cert_repo has NO test** (REQ-053 leftover — v0.7 P01 was supposed to add it but it's missing) |
-| `internal/jobspec` | **47.6%** | ≥ 70% floor | Only `spec_test.go` (4 tests); `Validate()`, `ParseFile` (file I/O), edge cases untested |
-| `internal/audit` | **0%** (no test files) | ≥ 50% toe-hold | `go: no such tool "covdata"` is a known tooling gap, NOT a real number — the package simply has no `_test.go` |
-| `internal/certpaths` | **0%** (no test files) | ≥ 50% toe-hold | Same `covdata` tooling gap; no `_test.go` exists |
-| `cmd/orca` | **0%** (no test files) | ≥ 50% toe-hold | Same; `main.go` is 15 LOC of glue (`cli.Execute()` + error print) |
-
-**Coverage-floor achievability assessment (per package):**
-
-- **engine → 70% REALISTIC.** The package has clean seams: `LocalExecutor` interface (dispatcher.go:39), `PeerRegistry` is in-memory with `Add`/`Remove`/`All`/`Get` (peer.go), `Executor.Submit/Status` take a `*store.JobRepo`+`*store.TaskRepo` which can be backed by `:memory:`/temp-file sqlite via the existing `openTestDB` helper (node_repo_test.go:12). The `sshDialer` seam pattern (proxmox) has an analogue here: `transport.NewDispatchClient` is called inside `dispatchToPeer` (dispatcher.go:158) — to test dispatch-to-peer without a real mTLS server, either (a) inject a fake `DispatchClient` via a new interface seam, or (b) use `httptest.NewTLSServer` with a self-signed CA. Option (a) is lower-effort and aligns with the `LocalExecutor` pattern. Recommendation: extract a `peerDispatcher` interface (`Submit(ctx, spec, key) (*SubmitResponse, error)`) and inject it, OR test via `LocalSubmit`/`LocalStatus` paths (which only need a stubbed `LocalExecutor`) — the latter covers ~60% of dispatcher.go without a new seam. **Flag: 70% may require a small refactor to inject the dispatch client; 60-65% is achievable without one. Plan should decide whether to add the seam or accept 65%.**
-- **proxmox → 70% REALISTIC.** The `sshDialer` seam already exists (bootstrap.go:201-213, `sshDialerType` interface + `defaultSSHDialer` struct, overridable package-level var). A fake SSH dialer returning a mock `*ssh.Client` is the path. **However:** `*ssh.Client.NewSession()` + `session.CombinedOutput()` are concrete methods on the real `*ssh.Client` — there's no `sshSession` interface seam. To test `runRemote`/`deployPubKey`/`createLinuxUser`/`createPVERole`/etc. without a real SSH server, EITHER (a) introduce a `sessionRunner` interface seam (small refactor), OR (b) use `httptest.NewTLSServer` is wrong (it's SSH not HTTP) — instead use a real in-process SSH server via `golang.org/x/crypto/ssh` `NewServerConn` (more code but no new dep). **Flag: 70% likely requires either a `sessionRunner` interface refactor OR an in-process SSH server fixture. 50-55% is achievable with just the existing `sshDialer` seam + testing validation paths + `sudoersContent` string asserts (already done). Plan should add the `sessionRunner` seam — it's a 1-interface, ~10-LOC change that unlocks the bulk of the package.**
-- **cli → 70% AMBITIOUS but realistic.** The package is the largest (17 source files, ~2000 LOC). The existing tests use `rootCmd.SetArgs()` + `rootCmd.Execute()` + `t.TempDir()` + `ORCA_HOME` env (namespace_test.go:46-53 — `TestInitHonorsORCAHOME` is the template). The untested commands are `node join/leave/list`, `job run/list/stop/logs`, `cert *`, `doctor *`, `audit list`, `status`, `version`, `daemon`. Many touch the DB + certpaths + (for `node join --type proxmox`) the SSH dialer. **Strategy:** table-driven `rootCmd.Execute()` against a temp `ORCA_HOME` for each subcommand; mock the proxmox path via the existing `sshDialer` seam; capture stdout via `rootCmd.SetOut(&buf)`. **Flag: 70% across the whole package is a lot of test code; 55-65% is more realistic for one phase. The `daemon` command (background server) is hard to test without a lifecycle harness — recommend excluding it from the 70% target and documenting why.**
-- **transport → 70% REALISTIC.** `httptest.NewTLSServer` is the standard seam (already used in `internal/daemon/dispatch_test.go:59` and `server_test.go`). The `Dispatcher` interface (dispatch.go:49) is already mockable (`stubDispatcher` in dispatch_test.go:24 is the template). `MTLSClient.Do` wraps `http.Client.Do` — testable via `httptest.NewTLSServer` with a CA + client cert. `retry.go` `Do[T]` is generic + already partly tested via `idempotency_test.go` (TestRetrySucceedsAfterTransient etc.) — extend with backoff-timing asserts. `handshake_log.go` is pure slog calls — trivial to test by capturing into a `slog.Handler`. **No new seams needed; 70% achievable.**
-- **store → 70% REALISTIC.** The existing `openTestDB` helper (node_repo_test.go:12) + `withFastWatch` (job_task_repo_test.go:36) are reusable. **Critical gap:** `cert_repo.go` has NO test file despite v0.7 P01 REQ-053 claiming it was added — this is a v0.7 leftover bug. Adding `cert_repo_test.go` (Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + N=3 rotation history per REQ-025) alone lifts coverage significantly. Job/Task repo `Watch` is tested; `ListRecent`, error paths, scan-edge cases need coverage. **No new seams; 70% achievable.**
-- **jobspec → 70% REALISTIC.** `Parse` + `Validate` + `ParseFile` are pure functions over HCL bytes. Add golden-file HCL fixtures (multi-task, env vars, args) + error-path table (missing job, no tasks, missing command, malformed HCL, empty file, nonexistent file for `ParseFile`). `testdata/` dir doesn't exist yet — create it. **No new seams; 70% achievable, likely the easiest of the six.**
-- **audit → 50% toe-hold REALISTIC.** Package is 125 LOC, 4 exported funcs (`New`, `Emit`, `EmitWithErr`, `LogHandshakeOK`, `LogHandshakeFailed`, `FormatAction`, `Action.String`, `Result.String`). Strategy: construct `Audit` with a real `engine.Audit` backed by `:memory:` sqlite (via `store.NewAuditRepo` + `engine.NewAudit`) + assert rows in `audit_log` table; capture slog output via a test `slog.Handler`. **No new seams; 50% easily achievable, 70% achievable if desired.**
-- **certpaths → 50% toe-hold TRIVIAL.** Package is 64 LOC, pure path-join functions honoring `ORCA_HOME`/`ORCA_DB` env. Strategy: temp dir + `t.Setenv("ORCA_HOME", dir)` + assert each `*Path()` returns `filepath.Join(dir, <file>)`; test `ORCA_DB` override; test default-to-`~/.orca` fallback. Model the test on `namespace_test.go` (cli). **No new seams; 50%+ trivially achievable.**
-- **cmd/orca → 50% toe-hold REALISTIC but LOW VALUE.** `main.go` is 15 LOC: `cli.Execute()` + `fmt.Fprintf(os.Stderr, "error: %v")` + `os.Exit(1)`. The only testable behavior is "main() calls Execute and exits non-zero on error." A smoke test that calls `main()` in a subprocess (or refactors main into a `run() int` for testability) is the path. **Flag: 50% on a 15-LOC glue file is ~7 lines of covered code — the effort:coverage ratio is poor. D-047 explicitly called this out ("0→70% risks a coverage rathole on `cmd/orca` which is glue code"). Recommend the plan keep this at the 50% toe-hold and not over-invest.**
-
-### 1.2 Existing test-helper utilities (reuse, do NOT re-create)
-
-| Helper | Location | Reuse for |
-|--------|----------|-----------|
-| `openTestDB(t)` | `internal/store/node_repo_test.go:12` | engine, audit, store tests — returns `(*NodeRepo, func())` backed by temp-file sqlite; adapt to return `*sql.DB` for JobRepo/TaskRepo/AuditRepo/CapacityRepo/CertRepo |
-| `withFastWatch(t, d)` | `internal/store/job_task_repo_test.go:36` | store Watch tests — overrides `watchInterval` for deterministic ticks |
-| `initTestEnv(t)` | `internal/cli/init_test.go:17` | cli tests — sets `ORCA_HOME` to temp dir + returns cleanup |
-| `resetRootFlags(t)` | `internal/cli/namespace_test.go:13` | cli tests — resets `rootCmd` args/out/json/system flags between subtests |
-| `discardWriter` | `internal/cli/init_test.go:33` | cli tests — `io.Writer` that discards stdout |
-| `stubDispatcher` | `internal/daemon/dispatch_test.go:24` | transport/engine tests — implements `transport.Dispatcher` (`LocalSubmit`/`LocalStatus`); reusable as a `LocalExecutor` too since the signatures match |
-| `insertNode(t, repo, ctx, id, name)` | `internal/store/node_repo_test.go:217` | store/doctor tests — inserts a minimal node |
-| `security.CAInit`/`LoadCA`/`GenerateCSR`/`SignCSR`/`WriteCert`/`WriteKey` | `internal/security/ca.go` | transport mTLS tests — bootstrap a real CA + server cert into a temp dir (pattern in `doctor_test.go:69-94`) |
-| `t.Setenv("ORCA_HOME", dir)` + `t.Setenv("ORCA_DB", ...)` | `internal/doctor/doctor_test.go:23-24` | any test needing the orca namespace — preferred over manual `os.Setenv` (auto-cleanup) |
-
-### 1.3 Injected seams already present in the codebase (confirm by reading)
-
-1. **`sshDialer` (proxmox)** — `internal/proxmox/bootstrap.go:201-213`: package-level `var sshDialer sshDialerType = defaultSSHDialer{}`; interface `sshDialerType{ DialContext(ctx, network, addr, *ssh.ClientConfig) (*ssh.Client, error) }`. Tests can swap `sshDialer` for a fake. **GAP:** no `sessionRunner` seam — `runRemote` (line 217) calls `conn.NewSession()` + `session.CombinedOutput(cmd)` directly on the concrete `*ssh.Client`. Recommend P01 plan add a `sessionRunner` interface (`CombinedOutput(cmd) ([]byte, error)`) so `deployPubKey`/`createLinuxUser`/`createPVERole`/`createPVEUser`/`assignPVEACL`/`writeSudoers`/`validateSudoers` become testable without a real SSH endpoint.
-2. **`LocalExecutor` (engine dispatcher)** — `internal/engine/dispatcher.go:39`: interface `Submit(ctx, []byte) (string, error)` + `Status(ctx, string) (string, error)`. `Dispatcher` depends on it; tests inject a stub. **GAP:** `dispatchToPeer` (line 154) calls `transport.NewDispatchClient` directly (no seam) — to test the remote-dispatch branch, either add a `peerDispatcher` interface or test via `httptest.NewTLSServer`.
-3. **`PeerPersister` (engine peer)** — `internal/engine/peer.go:39`: optional persist callback; unused in production but available as a seam.
-4. **`Dispatcher` (transport)** — `internal/transport/dispatch.go:49`: `LocalSubmit`/`LocalStatus` interface; `stubDispatcher` in `daemon/dispatch_test.go:24` is the template stub.
-5. **`watchInterval` (store)** — `internal/store/job_task_repo.go:20`: unexported `var watchInterval = 1 * time.Second`; tests override via `withFastWatch`.
-
-### 1.4 Packages where 70% is unrealistic in a single phase (with evidence)
-
-- **`internal/cli` — 70% is ambitious.** 17 source files, ~2000 LOC. The `daemon` command (`internal/cli/daemon.go`) starts a long-running mTLS server — testing it requires a lifecycle harness (start, probe, shutdown) and is better covered by `internal/daemon/server_test.go` (already exists, 150 LOC). Recommend the P01 plan **exclude `daemon.go` from the cli 70% target** (document it as covered by the daemon package's own tests) and aim for 70% of the *remaining* cli files. Even so, 55-65% is the realistic single-phase outcome for the rest.
-- **`cmd/orca` — 70% is explicitly out of scope per D-047.** 15 LOC of glue; 50% toe-hold is the right call.
-- **`internal/proxmox` — 70% likely requires the `sessionRunner` seam refactor.** Without it, only the validation paths + `sudoersContent` string asserts are testable (~50-55%). The plan should add the seam; with it, 70% is achievable.
-
----
-
-## 2. SSH trust hardening research (P02 — REQ-058, REQ-059)
-
-### 2.1 Current TOFU `knownhosts.New()` callback — how it works
-
-**Location:** `internal/proxmox/bootstrap.go:125-128` (bootstrap) + `internal/doctor/doctor.go:412-415` (doctor proxmox probe).
-
-```go
-hostKeyCallback, err := knownhosts.New(certpaths.KnownHostsPath())
-// ...
-sshConfig := &ssh.ClientConfig{
-    HostKeyCallback: hostKeyCallback,
-    // ...
-}
-```
-
-**Mechanism (`golang.org/x/crypto/ssh/knownhosts`):**
-- `knownhosts.New(files ...string)` returns an `ssh.HostKeyCallback` that reads the OpenSSH-format `known_hosts` file at `certpaths.KnownHostsPath()` (= `$ORCA_HOME/known_hosts`, see `internal/certpaths/certpaths.go:62`).
-- **First connect (host absent from file):** the callback returns a `*knownhosts.KeyError` with `Want: []` (empty). This is a "host unknown" signal. **IMPORTANT:** `knownhosts.New` does NOT auto-write the key on first connect — it returns an error. The current orca code at `bootstrap.go:140` treats ANY dial error as a failure (`return nil, fmt.Errorf("ssh dial %s: %w", sshAddr, err)`). **This means the current TOFU flow is INCOMPLETE:** on a truly first connect, `knownhosts.New` returns `KeyError{Want:[]}` and the dial fails — there is no capture-and-persist step. The v0.6 RESEARCH_v0.6.md §A.5 claimed `knownhosts.New` "handles both capture and verify in one callback" but the actual `golang.org/x/crypto` API does NOT auto-capture; it only verifies. **This is a latent bug OR the operator is expected to pre-populate `known_hosts` manually (which contradicts the TOFU UX).** P02 must address this: either (a) wrap `knownhosts.New` with a custom callback that captures on `KeyError{Want:[]}` and writes via `knownhosts.Line`, or (b) accept that `--host-key-fingerprint` (REQ-058) becomes the *required* path for first connect and TOFU capture is a separate enhancement. **Flag for plan: the current TOFU capture is broken; P02 should fix it as part of the trust-hardening work (the `--host-key-fingerprint` path is actually simpler than TOFU because it doesn't need capture).**
-- **Subsequent connects (host present, key matches):** callback returns `nil` → dial proceeds.
-- **Subsequent connects (host present, key MISMATCH):** callback returns `*knownhosts.KeyError{Want: [knownKey]}` → dial fails with a clear error. This is the MITM-detection path.
-
-**File format:** OpenSSH `known_hosts` — one line per host: `[host]:port ssh-key-type base64-key` (or hashed-host form via `knownhosts.HashHostname`). `knownhosts.Line(addresses []string, key ssh.PublicKey) string` produces the line; `knownhosts.Normalize(address)` normalizes the host:port.
-
-### 2.2 `Result.HostKeyFingerprint` — current computation (CRITICAL FINDING)
-
-**Location:** `internal/proxmox/bootstrap.go:83-85` (field declaration) + `bootstrap.go:195-198` (return statement).
-
-```go
-type Result struct {
-    NodeName           string
-    NodeAddress        string
-    HostKeyFingerprint string  // field EXISTS
-}
-// ...
-return &Result{
-    NodeName:    opts.Host,
-    NodeAddress: opts.Host + ":8443",
-    // HostKeyFingerprint is NOT SET — always empty string
-}, nil
-```
-
-**Finding:** `Result.HostKeyFingerprint` is **declared but never populated**. The current `BootstrapProxmox` returns it as `""`. There is **no fingerprint computation today** — no `ssh.FingerprintSHA256` call, no hex digest, nothing. D-045's rationale ("matches the fingerprint format operators already see from `orca node join`'s own `Result.HostKeyFingerprint` output") is based on a field that is currently always empty.
-
-**Implication for P02:** The plan must ADD the fingerprint computation. The correct function is `ssh.FingerprintSHA256(pubKey ssh.PublicKey) string` (verified via `go doc`), which returns the **OpenSSH `SHA256:base64` format** (unpadded base64, exactly what `ssh-keyscan -E sha256` emits and what D-045 specifies). So D-045's format choice is correct *by intent* but the code doesn't produce it yet — P02 populates `Result.HostKeyFingerprint = ssh.FingerprintSHA256(hostKey)` during the capture path, and `--host-key-fingerprint` compares against `ssh.FingerprintSHA256` of the server-presented key.
-
-**No existing fingerprint-comparison utility in `internal/security/`.** `security.Fingerprint` (fingerprint.go:17) computes SHA-256 **hex** of an X.509 cert's DER — a DIFFERENT format (hex, not base64; X.509, not SSH). `security.FingerprintOf` (fingerprint.go:34) is the same. **Do NOT reuse these for SSH host-key comparison** — they're for the mTLS CA pin (`--ca-fingerprint`). P02 needs a new SSH-specific helper, e.g. `security.SSHFingerprintSHA256(pubKey ssh.PublicKey) string` (thin wrapper over `ssh.FingerprintSHA256`) or inline in `proxmox/bootstrap.go`.
-
-### 2.3 Where `--host-key-fingerprint` plugs in (REQ-058)
-
-**CLI seam:** `internal/cli/node.go:344-354` — the `init()` registers flags on `nodeJoinCmd`. Add:
-```go
-nodeJoinCmd.Flags().StringVar(&joinHostKeyFP, "host-key-fingerprint", "", "SSH host key SHA256:base64 fingerprint (pre-pin; supersedes TOFU for --type proxmox)")
-```
-Per D-044, the flag lives on `orca node join` (not just `--type proxmox`); validation in `RunE` (`node.go:78-83`) emits a clear error if the flag is set for a non-proxmox type.
-
-**Transport seam:** `internal/proxmox/bootstrap.go:131-136` — `ssh.ClientConfig.HostKeyCallback`. Currently `knownhosts.New(...)`. When `--host-key-fingerprint` is supplied, replace the callback with a `ssh.FixedHostKey`-style verifier that:
-1. Parses the operator-supplied `SHA256:base64` string (strip `SHA256:` prefix, base64-decode → 32 bytes).
-2. In the callback, receives the server's `ssh.PublicKey`, computes `ssh.FingerprintSHA256(key)`, compares to the operator string.
-3. Returns `nil` on match, `error` on mismatch (fail closed).
-
-**Recommended callback shape (concrete):**
-```go
-func pinnedHostKeyCallback(expectedSHA256Base64 string) (ssh.HostKeyCallback, error) {
-    // Validate format: must start with "SHA256:".
-    if !strings.HasPrefix(expectedSHA256Base64, "SHA256:") {
-        return nil, fmt.Errorf("host-key-fingerprint: must be OpenSSH SHA256:base64 format (got %q)", expectedSHA256Base64)
-    }
-    expected := expectedSHA256Base64 // store full string for direct compare
-    return func(_ string, _ net.Addr, key ssh.PublicKey) error {
-        got := ssh.FingerprintSHA256(key)
-        if got != expected {
-            return fmt.Errorf("host key fingerprint mismatch: got %s, want %s — refusing to connect (REQ-058)", got, expected)
-        }
-        return nil
-    }, nil
-}
-```
-**Why compare full strings (not base64-decoded bytes):** `ssh.FingerprintSHA256` returns the canonical `SHA256:base64` string; comparing it directly to the operator-supplied string is simplest and avoids a base64-decode step. Reject non-`SHA256:`-prefixed input up front with a clear error (D-045: "Accept only `SHA256:`-prefixed base64; reject raw hex with a clear error").
-
-**Pass-through to proxmox:** `internal/cli/node.go:158-166` — add `HostKeyFingerprint string` to `proxmox.Options` (bootstrap.go:55) and pass `joinHostKeyFP` through. `BootstrapProxmox` selects the callback: if `opts.HostKeyFingerprint != ""` use `pinnedHostKeyCallback`, else fall back to the TOFU `knownhosts.New` (with the capture-fix from §2.1).
-
-### 2.4 `orca node key-reset <node>` (REQ-059, D-046 — local known_hosts only)
-
-**Scope (D-046):** clear the local `~/.orca/known_hosts` entry for the node ONLY; do NOT revoke the remote authorized_keys entry (would orphan a working node). Audit-log `event=node.key_reset` with `actor` + `node`.
-
-**`known_hosts` line format written by `golang.org/x/crypto/ssh/knownhosts`:**
-- `knownhosts.Line(addresses []string, key ssh.PublicKey) string` → `"[host]:port ssh-ed25519 AAAA...\n"` (or `host ssh-ed25519 AAAA...` if port 22 — `knownhosts.Normalize` handles the `:22` vs bare-host normalization).
-- The file is plain text, one entry per line, `#`-prefixed comments allowed.
-
-**No library function to remove a host's entries.** `knownhosts.New` only reads. The reset must be implemented manually:
-1. Read `certpaths.KnownHostsPath()` (`internal/certpaths/certpaths.go:62`).
-2. Filter lines: keep lines whose host field (before the first whitespace) does NOT match `knownhosts.Normalize(nodeName)` (or the node's address). **Edge:** a host may have multiple entries (one per key type); remove all matching lines.
-3. Write the filtered content back via **atomic rewrite** (temp file in same dir + `os.Rename`) — reuse `security.writeAtomic` (ca.go:305) OR implement inline (it's unexported in `security`; either export it or copy the ~20-LOC pattern). **Recommend atomic rewrite, NOT in-place truncation** — in-place rewrite via `os.OpenFile(O_TRUNC|O_WRONLY)` risks data loss on crash mid-write.
-
-**CLI registration seam:** `internal/cli/node.go:358-360` — the `init()` does `nodeCmd.AddCommand(nodeJoinCmd)`, `nodeLeaveCmd`, `nodeListCmd`. Add:
-```go
-nodeCmd.AddCommand(nodeKeyResetCmd)
-```
-where `nodeKeyResetCmd` is a new `&cobra.Command{Use: "key-reset <node>", Args: cobra.ExactArgs(1), RunE: ...}`. The `RunE`:
-1. Resolve `<node>` arg → look up the node in the registry (`nodeRegistry()` at node.go:37) to get its address (for matching `known_hosts` lines) — OR accept the raw host string directly. **Recommend:** accept the node NAME (consistent with `doctor proxmox` which iterates `node.Name`), look up the node row, use `node.Name` (which is the host address for proxmox nodes per `bootstrap.go:196`) as the `known_hosts` match key.
-2. Call a new `proxmox.ResetHostKey(host string) error` (or inline in cli) that does the atomic rewrite.
-3. Audit-log via `engine.Audit.Record(ctx, "cli", "node.key_reset", nodeID, "success", nil, map[string]any{"host": host})`.
-4. Print `✓ Host key reset for <node> (next connect will re-pin via TOFU or --host-key-fingerprint)`.
-
-**Reusability:** the `nodeRegistry()` helper (node.go:37) + `openDB()` (node.go:25) + `newLogger()` (node.go:33) are all available for the key-reset command.
-
-### 2.5 CLI registration seam summary (P02)
-
-| Addition | File:line | Change |
-|----------|-----------|--------|
-| `--host-key-fingerprint` flag | `internal/cli/node.go:344-354` (init) | `nodeJoinCmd.Flags().StringVar(&joinHostKeyFP, "host-key-fingerprint", "", "...")` |
-| `joinHostKeyFP` var | `internal/cli/node.go:47-60` (var block) | add `joinHostKeyFP string` |
-| Pass-through to proxmox | `internal/cli/node.go:158-166` (joinProxmox) | add `HostKeyFingerprint: joinHostKeyFP` to `proxmox.Options` |
-| `HostKeyFingerprint` field | `internal/proxmox/bootstrap.go:55` (Options) | add field |
-| Pinned callback | `internal/proxmox/bootstrap.go:131-136` | branch: if `opts.HostKeyFingerprint != ""` use pinned callback else TOFU |
-| Populate `Result.HostKeyFingerprint` | `internal/proxmox/bootstrap.go:195-198` | set `HostKeyFingerprint: ssh.FingerprintSHA256(hostKey)` during capture |
-| `key-reset` subcommand | `internal/cli/node.go:358-360` (init) | `nodeCmd.AddCommand(nodeKeyResetCmd)` + new cmd var |
-| `ResetHostKey` helper | `internal/proxmox/bootstrap.go` (new) OR `internal/security/sshkey.go` | atomic known_hosts rewrite |
-
----
-
-## 3. Requirements-hygiene gate research (P03 — REQ-060)
-
-### 3.1 Current Makefile targets
-
-`Makefile` has 11 targets: `build`, `test`, `test-race`, `lint`, `fmt`, `clean`, `run`, `version`, `changelog`, `release`, `security-scan` (Makefile:1-100). **No `verify-reqs` target exists.** The `.PHONY` list at line 1 must be extended.
-
-### 3.2 Current `.coreci.yml` pipeline structure
-
-4 pipelines (`.coreci.yml:19-134`):
-- **validate** (line 20): 4 steps — `go-version` (gofmt+vet), `gosec`, `govulncheck`, `gitleaks`.
-- **build** (line 53): 1 step — version-injected `go build`.
-- **test** (line 72): 1 step — `go test -race -coverprofile=coverage.out ./...` + `go tool cover -func | tail -1`.
-- **release** (line 81): gated on `refs/tags/v*`; 3 steps — build-artifact, gitea-release, container-publish.
-
-**Hook for `verify-reqs`:** add a 5th step to the `validate` pipeline (after `go-version`, before/after `gosec`) OR add it to the `test` pipeline. **Recommend `validate` pipeline** — requirements hygiene is a static check (no test run needed), belongs alongside gofmt/vet/lint. Step shape:
-```yaml
-- name: verify-reqs
-  image: golang:1.25
-  commands:
-    - make verify-reqs
-```
-
-### 3.3 `verify-reqs` implementation recommendation
-
-**Assertion (REQ-060):** every REQ row in `ROADMAP.md` marked `[x]`/Complete must have a matching REQ-ID row in `REQUIREMENTS.md` with `Complete` status. (Reverse direction — every REQUIREMENTS `Complete` has a ROADMAP `[x]` — is also worth checking but the drift that motivated this was ROADMAP-shipped-but-REQUIREMENTS-Pending, so the forward direction is the priority.)
-
-**Approach: small Go program in `cmd/verify-reqs` OR a shell+awk script?**
-
-- **Go program** (~80 LOC): parse both markdown tables with `regexp`, build two `map[string]string` (REQ-ID → status), diff. Pros: type-safe, testable, consistent with the Go toolchain; can be a `cmd/verify-reqs/main.go` with its own `_test.go`. Cons: adds a binary target.
-- **Shell+awk** (~30 LOC): `awk` over the markdown tables. Pros: no new Go package; minimal. Cons: fragile parsing, hard to test, shell-quoting issues.
-
-**Recommendation: Go program at `cmd/verify-reqs/main.go`.** Reasons: (1) testable with golden-file fixtures (parse a sample ROADMAP+REQUIREMENTS pair, assert diff); (2) consistent with the project's Go-only tooling ethos (no shell-awk fragility); (3) the `make verify-reqs` target just calls `go run ./cmd/verify-reqs`; (4) CoreCI's `golang:1.25` image has `go` available — no extra dep.
-
-**Parsing approach (concrete):**
-1. ROADMAP.md: regex `^\s*-\s*\[(x|X| )\]\s*Phase.*—.*tag` is NOT the right pattern (that's phase lines, not REQ rows). The REQ coverage is in per-phase bullet lists under "### Per-phase REQ coverage" (ROADMAP.md:161-180) AND in the milestone section bodies. **Simpler:** the ROADMAP uses `- [x] Phase N: ...` for completed phases. The authoritative REQ↔status mapping lives in **REQUIREMENTS.md** (the single table at lines 9-56 + per-milestone tables at 103-142). **Re-interpret REQ-060:** the assertion is really "ROADMAP milestone sections marked COMPLETE ↔ REQUIREMENTS rows for that milestone marked Complete." The drift was: v0.7 ROADMAP said "COMPLETE" (line 116) but REQUIREMENTS v0.7 rows (REQ-053..056) were "Pending" (now corrected to "Complete" in SPECIFY).
-2. **Refined assertion:** parse REQUIREMENTS.md table rows (`| REQ-XXX | ... | ... | ... | **Complete** |` or `| Pending |`); for each REQ-ID, record status. Then parse ROADMAP.md for milestone-level "COMPLETE" markers (`## Milestone v0.X: ... — **COMPLETE**`) AND phase-level `- [x]` markers. For each milestone marked COMPLETE in ROADMAP, assert every REQ-ID belonging to that milestone (per the REQUIREMENTS milestone column) is `Complete` in REQUIREMENTS. **OR (simpler, matches the SPECIFY wording):** for every REQ-ID in REQUIREMENTS.md whose `Phase` column references a milestone that ROADMAP marks COMPLETE, the Status must be `Complete`. This catches the exact drift (ROADMAP-shipped, REQUIREMENTS-stale).
-
-**Concrete regex:**
-- REQUIREMENTS row: `^\|\s*(REQ-\d+)\s*\|.*?\|\s*\*\*(Complete|Pending)\*\*\s*\|` (capture ID + status).
-- ROADMAP milestone-complete: `^##\s*Milestone\s+v0\.\d+:.*—\s*\*\*COMPLETE\*\*` (capture milestone label).
-- Map milestone → REQs via the REQUIREMENTS `Phase` column (e.g. `v0.7 P1` → milestone `v0.7`).
-
-**Where it hooks in:** `make verify-reqs` runs `go run ./cmd/verify-reqs .ciagent/ROADMAP.md .ciagent/REQUIREMENTS.md`; `.coreci.yml` validate pipeline adds the step. Exit 0 on consistency, exit 1 with a diff listing on drift.
-
-### 3.4 The drift that motivated REQ-060
-
-After v0.7 ship, REQUIREMENTS.md rows REQ-053..056 were "Pending" despite ROADMAP.md marking milestone v0.7 COMPLETE and all phases `[x]`. This was corrected during v0.8 SPECIFY (the rows now read `**Complete**`). REQ-060 ensures the drift cannot recur: the CI validate pipeline fails if ROADMAP says COMPLETE but REQUIREMENTS says Pending.
-
----
-
-## 4. Architectural decisions surfaced (AD-027..AD-030)
-
-| ID | Decision | Rationale |
-|----|----------|-----------|
-| AD-027 | `ssh.FingerprintSHA256` (OpenSSH `SHA256:base64`) as the SSH host-key fingerprint format | Matches D-045 + `ssh-keyscan -E sha256` output. The existing `security.Fingerprint` (hex, X.509) is NOT reused — different domain. P02 adds a thin SSH-specific helper. |
-| AD-028 | `--host-key-fingerprint` callback compares full `SHA256:base64` strings, not decoded bytes | `ssh.FingerprintSHA256` returns the canonical string; direct string compare avoids a base64-decode step and is less error-prone. Validate `SHA256:` prefix up front. |
-| AD-029 | `orca node key-reset` rewrites `known_hosts` via atomic temp-file + rename | Prevents data loss on crash mid-write. Reuse the `writeAtomic` pattern from `security/ca.go:305` (export it or copy the ~20 LOC). |
-| AD-030 | `verify-reqs` implemented as `cmd/verify-reqs/main.go` (Go program), not shell+awk | Testable, type-safe, consistent with Go-only tooling. `make verify-reqs` runs `go run ./cmd/verify-reqs`. Hooked into `.coreci.yml` validate pipeline. |
-
----
-
-## 5. Pitfalls, gaps, and flags for the plan
-
-1. **TOFU capture is currently BROKEN (§2.1).** `knownhosts.New` returns `KeyError{Want:[]}` on first connect and does NOT auto-write the key. The current `BootstrapProxmox` treats this as a dial failure. P02 must either (a) wrap the callback to capture-and-persist on `KeyError{Want:[]}` via `knownhosts.Line` + atomic write, or (b) make `--host-key-fingerprint` the required first-connect path. **Recommend (a) — fix TOFU + add pre-pin as superset.** This is a v0.6 latent bug that P02 closes.
-2. **`Result.HostKeyFingerprint` is never populated (§2.2).** D-045's rationale references "existing output" that doesn't exist. P02 must ADD the computation (`ssh.FingerprintSHA256`). Low risk — it's a 1-line addition once the host key is available.
-3. **No `sessionRunner` seam in proxmox (§1.3).** Testing the SSH command sequence (deployPubKey, createLinuxUser, pveum, sudoers, visudo) without a real SSH server requires a new interface seam. **Recommend P01 plan add it** — 1 interface, ~10 LOC, unlocks ~40% of proxmox coverage.
-4. **`internal/store/cert_repo.go` has NO test (§1.1).** v0.7 P01 REQ-053 was supposed to add `cert_repo_test.go` but it's missing — `internal/store/` glob shows no `cert_repo_test.go`. This is a v0.7 leftover. P01 should add it (it directly lifts store coverage toward 70%).
-5. **`internal/cli/daemon.go` excluded from cli 70% target (§1.4).** The daemon command starts a long-running server; it's covered by `internal/daemon/server_test.go` (150 LOC). Don't double-test in cli.
-6. **`cmd/orca` 50% toe-hold is low-value (§1.1).** 15 LOC of glue; the test effort:coverage ratio is poor. D-047 already called this out. Don't over-invest.
-7. **`go: no such tool "covdata"` for zero-test packages (§1.1).** This is a Go toolchain quirk when a package has no test files — `go test -cover` can't compute coverage without a test binary. It's NOT a real 0% number (it's "undefined"). Adding any `_test.go` file makes the number computable. Don't treat the error as a coverage measurement.
-8. **`transport.dispatchToPeer` has no seam (§1.3).** Testing the remote-dispatch branch of `Dispatcher.Submit` requires either a new `peerDispatcher` interface OR `httptest.NewTLSServer`. The latter is already used in `daemon/dispatch_test.go`; recommend the plan use `httptest.NewTLSServer` (no refactor needed) for transport coverage.
-9. **`knownhosts.Line` + `knownhosts.Normalize` are the helpers for the TOFU-capture fix and for `key-reset` matching (§2.1, §2.4).** Use `Normalize` to match host strings consistently (handles `host:22` vs `host`).
-10. **`security.writeAtomic` is unexported (ca.go:305).** `key-reset`'s atomic known_hosts rewrite needs it. Either export `WriteAtomic` from `security`, or copy the ~20-LOC pattern into `proxmox`/`cli`. **Recommend export** — it's already used across ca.go + sshkey.go and is generally useful.
-
----
-
-## 6. Dependencies
-
-v0.8 adds **zero** new direct dependencies:
-- SSH host-key fingerprint: `ssh.FingerprintSHA256` (already in `golang.org/x/crypto/ssh` v0.54.0, direct dep since v0.6).
-- `knownhosts.Line`/`Normalize`/`KeyError`: same `golang.org/x/crypto` module.
-- `verify-reqs`: stdlib only (`regexp`, `os`, `fmt`).
-- Tests: `net/http/httptest` (stdlib), existing interfaces.
-
-`go.mod` is unchanged by v0.8.
-
----
-
-## 7. PERSONAS assessment (v0.8)
-
-v0.8 is an NFR milestone touching tests (9 packages), SSH trust surface (proxmox + cli/node + security), and a requirements-hygiene Go program. The 3-persona roster from config.json (lead-developer, backend-engineer, data-engineer) is sufficient — no phase-specific personas needed.
-
-**Roster confirmation:**
-- **lead-developer** — owns coordination + `cmd/orca` smoke test + `internal/cli` coverage (cert/doctor/audit/status/version subcommands) + the `verify-reqs` Go program (coordination territory).
-- **backend-engineer** — owns `internal/transport` tests (httptest.NewTLSServer) + `internal/engine` tests (LocalExecutor stubs, PeerRegistry) + SSH trust-surface in `internal/proxmox/bootstrap.go` (pinned callback, TOFU capture fix, sessionRunner seam) + `internal/cli/node.go` (`--host-key-fingerprint` flag, `key-reset` subcommand).
-- **data-engineer** — owns `internal/store` tests (cert_repo_test.go gap + coverage uplift) + `internal/audit` tests (sqlite-backed audit_log asserts) + `internal/certpaths` tests (path-join asserts) + `internal/jobspec` tests (golden HCL fixtures).
-
-No frontend persona (no UI). No devops persona (no packaging/distribution — `verify-reqs` is a Go program, not a CI config change; the `.coreci.yml` edit is a 3-line hook, lead-developer territory). No security-engineer persona (the SSH trust work is backend-engineer territory — the security-engineer was deactivated in v0.7 and v0.8 doesn't re-add it; the trust-surface hardening is a refinement of the existing `proxmox` package, not new security architecture).
-
-See `.ciagent/PERSONAS.md` (updated with v0.8 YAML frontmatter + territory globs matching the actual file structure).

.ciagent/REVIEW_v0.8.md

@@ -1,321 +0,0 @@
-# Review: Orca v0.8 — Coverage & Trust Hardening (final-phase)
-
-**Reviewer**: ci-code-reviewer (multi-persona: correctness, testing, security, performance, maintainability, adversarial)
-**Branch**: `phase/04-final-review-ship` (review HEAD = P03 ship `70c5718`)
-**Diff scope**: `main...milestone/v0.8-coverage-trust-hardening` (all v0.8 work, 59 files, +6550/-173)
-**Date**: 2026-08-04
-**Verdict**: **PASS-WITH-FOLLOWUPS** (0 P0, 2 P1, 2 P2)
-
-## Methodology
-
-Read the full diff (`internal/`, `cmd/`, `Makefile`, `.coreci.yml`), all 3 phase
-verification reports, PLAN/RESEARCH/GRILL/PERSONAS, and the critical production
-files directly (`internal/proxmox/bootstrap.go`, `internal/security/ca.go`,
-`internal/security/sshkey.go`, `internal/doctor/doctor.go:400-454`,
-`cmd/verify-reqs/main.go`). Re-ran `go build ./...`, `go vet ./...`,
-`go test -race` on proxmox/security/doctor/cli/verify-reqs/cmd-orca, and
-`make verify-reqs` (all PASS). Re-verified the verify-reqs regex against the
-real ROADMAP.md (matches v0.1..v0.7 COMPLETE incl. v0.2 parenthetical; v0.8
-correctly not matched). Confirmed all 7 T02.10 e2e cases are present and
-exercised through a real in-process SSH server.
-
----
-
-## Per-Axis Findings
-
-### 1. Correctness (lead-developer)
-
-**C1 — `sessionRunner` seam backward-compat** ✅
-`internal/proxmox/bootstrap.go:170-172,322-339`. The seam is a package-level
-`var sessionRunner sessionRunnerType` (line 326) initialized lazily inside
-`BootstrapProxmox` from the dialed `*ssh.Client` (`if sessionRunner == nil {
-sessionRunner = &sshSessionRunner{client: conn} }`). Existing callers are
-unchanged — the default `sshSessionRunner` wraps the real
-`conn.NewSession().CombinedOutput(...)`. Tests reset `sessionRunner = nil`
-between runs (bootstrap_test.go:910, 1010, 1035) to avoid cross-test leakage.
-Backward compatible as required by P01 verification. No issue.
-
-**C2 — `verify-reqs` parser correctness** ✅
-`cmd/verify-reqs/main.go:18-26`. The `reqRowRe` uses a greedy `.*` for the
-Requirement+Priority cells and anchors the Phase+Status match at the END of
-the line, where those two columns always live. This correctly handles
-escaped pipes inside the Requirement cell (e.g. REQ-049
-`localhost\|linux\|proxmox` — verified by the passing `make verify-reqs`
-which reports 60 consistent rows, matching the 60 REQ rows in
-REQUIREMENTS.md). The status token is optionally bold-wrapped
-(`\*{0,2}(Complete|Pending)\*{0,2}`) with `[^|]*` for trailing notes —
-handles `**Complete** (P01 shipped v0.2.1)`. The milestone-complete regex
-`^##\s*Milestone\s+(v0\.\d+):.*—\s*\*\*[^*]*\bCOMPLETE\b[^*]*\*\*` is
-substring-tolerant (GRILL #4) — verified against the real ROADMAP: matches
-v0.1..v0.7 incl. v0.2's `**COMPLETE (merged to main via v0.3)**` and v0.6's
-duplicate header (line 94 matched; line 92 without COMPLETE ignored). v0.8
-(line 136, not yet COMPLETE) correctly not matched — so the v0.8 REQ rows
-being `Pending` is NOT flagged as drift (correct: milestone not shipped
-yet). No issue.
-
-**C3 — TOFU capture-fix logic** ✅
-`internal/proxmox/bootstrap.go:275-310`. On `*knownhosts.KeyError` with
-empty `Want` (host unknown), captures the key, reads existing known_hosts
-(create-if-missing), ensures trailing newline, appends
-`knownhosts.Line([]string{knownhosts.Normalize(addr)}, key)`, writes via
-`security.WriteAtomic`, returns nil (dial proceeds). On non-empty `Want`
-(mismatch) returns the error (MITM detection preserved). On `nil` (match)
-records key + returns nil. Correct against x/crypto v0.54.0 `checkAddr`
-semantics. No issue.
-
-**C4 — `ResetHostKey` line matching** ✅
-`internal/proxmox/bootstrap.go:479-523`. Matches a line when its first
-whitespace-delimited field, normalized via `knownhosts.Normalize`, equals
-the normalized target. Handles `[host]:22` vs bare `host` (Normalize
-brackets ports). Preserves comments/blanks. Atomic rewrite via
-`security.WriteAtomic`. Edge cases handled: empty host errors, missing
-file is a no-op, no matching lines is a no-op. Test
-`TestResetHostKey_RemovesTargetLines` (bootstrap_test.go:718) seeds 2 lines
-for target + 1 for another host, asserts target's 2 removed + other
-intact. No issue.
-
-**C5 — `--host-key-fingerprint` non-proxmox validation** ✅
-`internal/cli/node.go:79-81`. `RunE` checks `joinHostKeyFP != "" &&
-joinType != "proxmox"` → clear error. Test
-`TestNodeJoinHostKeyFingerprintRequiresProxmox` (node_test.go:445) asserts
-the error; `TestNodeJoinHostKeyFingerprintProxmoxAccepted` (node_test.go:477)
-asserts the negative-space (proxmox type accepts the flag). No issue.
-
-### 2. Testing (all personas)
-
-**T1 — Coverage held post-P02** ✅
-PHASE2 verification: proxmox 86.5% (was 87.1%), cli 76.7% (was 76.2%),
-doctor 70.4%. Marginal changes from new code paths — no coverage regression.
-Re-ran `go test -race ./internal/proxmox/... ./internal/cli/...` PASS.
-
-**T2 — Race tests pass** ✅
-`go test -race -count=1 ./internal/proxmox/... ./internal/security/...
-./internal/doctor/... ./cmd/verify-reqs/... ./cmd/orca/...` all PASS.
-`./internal/cli/...` PASS (77s, dominated by watch tests). No races.
-
-**T3 — 7 T02.10 integration cases** ✅
-All 7 present in `internal/proxmox/bootstrap_test.go`, exercised
-end-to-end through `BootstrapProxmox` with a real in-process SSH server
-(`bootstrapE2ESetup`):
-- Case 1: `TestBootstrapE2E_PinnedFingerprintCorrect` (815)
-- Case 2: `TestBootstrapE2E_PinnedFingerprintWrong` (842)
-- Case 3: `TestBootstrapE2E_TOFUFirstConnectCapturesKey` (865)
-- Case 4: `TestBootstrapE2E_TOFUSecondConnectMatches` (905)
-- Case 5: `TestBootstrapE2E_TOFUMismatchFails` (925)
-- Case 6: `TestBootstrapE2E_KeyResetThenRePin` (1002)
-- Case 7: `TestBootstrapE2E_PrePopulatedKnownHostsMatches` (966, v0.6→v0.8 migration)
-
-**T4 — Golden tests for verify-reqs** ✅
-`cmd/verify-reqs/main_test.go` has 7 tests covering: clean pair, multi-drift
-(both directions), default-args subprocess, malformed (no REQ rows → error),
-missing file → error, v0.2 substring-tolerant header regression guard
-(`TestVerify_v02SubstringTolerantHeader`), and real-repo regression guard.
-The substring-tolerant regex is explicitly exercised — the drift fixture's
-ROADMAP uses `**COMPLETE (merged to main via v0.3)**` on v0.2 and the test
-asserts REQ-002 (v0.2 P1, Pending) is flagged forward-drift (would be
-silently skipped if the regex regressed). No issue.
-
-**T5 — Doctor parity test** ✅
-`internal/doctor/doctor_test.go` extended with 94 LOC covering
-`probeProxmoxPVEVersion` paths. The doctor callback now uses the shared
-`proxmox.TOFUHostKeyCallback` (doctor.go:424) — GRILL #2 parity verified by
-reading both call sites. No issue.
-
-### 3. Security (backend-engineer)
-
-**S1 — `--host-key-fingerprint` fails closed** ✅
-`internal/proxmox/bootstrap.go:141-153,245-258`. The pinned/TOFU branch is
-mutually exclusive (`if opts.HostKeyFingerprint != "" { ... } else { ... }`).
-The pinned callback (245-258) validates `SHA256:` prefix up front (rejects
-raw hex per D-045), computes `ssh.FingerprintSHA256(key)`, returns an error
-on any mismatch — no fallback to TOFU. The dial (164) aborts on callback
-error before any SSH session command runs. Cannot be bypassed: the pin is
-compared as a full string against the canonical fingerprint of the
-server-presented key; a mismatch returns before `*capturedKey` is set. No
-issue.
-
-**S2 — `key-reset` is local-only (D-046)** ✅
-`internal/proxmox/bootstrap.go:479-523` + `internal/cli/node.go:348-407`.
-`ResetHostKey` only reads/writes `certpaths.KnownHostsPath()`. No SSH dial,
-no remote authorized_keys touch. Audit-logs `node.key_reset` with
-actor+node+host (node.go:396-400). Verified by `TestNodeKeyReset`
-(node_test.go:326) which asserts the audit row. No issue.
-
-**S3 — TOFU capture-fix doesn't weaken MITM detection** ✅
-See C3 — the fix ONLY captures on `KeyError{Want:[]}` (host unknown); a
-non-empty `Want` (key mismatch / MITM) returns the error. The capture path
-writes the server-presented key, so a subsequent different key fails. No
-issue.
-
-**S4 — `WriteAtomic` is actually atomic** ✅
-`internal/security/ca.go:308-337`. Temp file in same dir
-(`os.CreateTemp(dir, ".tmp-*")`), `Write`, `Chmod`, `Sync`, `Close`, then
-`os.Rename` (atomic on POSIX same-filesystem). `defer os.Remove(tmpName)`
-cleans up on failure. Genuine atomic-write pattern. No issue.
-
-### 4. Performance (all)
-
-**P1 — ResetHostKey is O(n) in file size** ✅
-`internal/proxmox/bootstrap.go:479-523`: one `os.ReadFile` (O(n)), one
-`strings.Split` + linear filter loop (O(n)), one `security.WriteAtomic`
-(O(n)). No nested loops, no O(n²). For a known_hosts file (typically tens
-of lines), this is negligible. No issue.
-
-**P2 — Unnecessary allocations** (P2 — nit)
-`bootstrap.go:494-510`: `strings.Split(string(existing), "\n")` allocates a
-slice of all lines + `append(kept, []byte(line+"\n")...)` reallocates the
-kept buffer. For known_hosts (small file) this is fine; a `bufio.Scanner`
-over `bytes.NewReader(existing)` with a `strings.Builder` would be leaner,
-but the current shape is clear and the file is tiny. Not worth changing.
-Flagged P2 (nit, no action).
-
-### 5. Maintainability (lead-developer)
-
-**M1 — `TOFUHostKeyCallback` extraction** ✅
-`internal/proxmox/bootstrap.go:261-310` is exported and shared by bootstrap
-(148) and doctor (doctor.go:424) via
-`proxmox.TOFUHostKeyCallback(sshAddr, &capturedHostKey)`. Clean coupling:
-doctor imports proxmox (one-way), no duplication, no circular dep. The
-GRILL #2 parity requirement (both call sites use the same wrapper) is
-satisfied by construction. No issue.
-
-**M2 — `verify()` testable** ✅
-`cmd/verify-reqs/main.go:98-148`: the core logic is a pure function
-`verify(roadmapPath, reqsPath string) (diff []string, count int, err error)`
-with `main()` as a thin wrapper. Golden-file tests call `verify()` directly
-(no subprocess). Mirrors the T01.11 `main()→run()` pattern. No issue.
-
-**M3 — cli tests follow conventions** ✅
-`internal/cli/namespace_test.go:21-35` adds `resetCommandFlags()` to zero
-the package-level flag-bound vars between subtests (cobra parses into
-globals; without reset a prior test's value persists). Called from
-`resetRootFlags`. This is a sound convention — the test isolation is
-correct. No issue.
-
-**M4 — `resetCommandFlags` completeness** (P2 — nit)
-`namespace_test.go:28-34` resets the join/leave/cap/audit/run/stop flags but
-NOT `joinHostKeyFP`. A test that sets `--host-key-fingerprint` without
-calling `resetRootFlags` could leak the value to a later test. In practice
-all node tests call `resetRootFlags` which calls `resetCommandFlags`, so
-this is a latent risk only. Recommend adding `joinHostKeyFP = ""` to
-`resetCommandFlags` for completeness. Flagged P2 (nit).
-
-### 6. Adversarial (backend-engineer)
-
-**A1 — Can `--host-key-fingerprint` be bypassed?** ✅
-No. The pinned callback (bootstrap.go:249-258) returns an error before
-recording the key or allowing the dial to proceed on any mismatch. There is
-no code path where a supplied pin is ignored — the branch at 141-153 is
-`if opts.HostKeyFingerprint != ""` (pinned) `else` (TOFU); once pinned is
-chosen, TOFU is not consulted. No bypass.
-
-**A2 — Can `key-reset` corrupt known_hosts under concurrent write?** (P1 — important, low likelihood)
-`proxmox.ResetHostKey` (bootstrap.go:479-523) and `TOFUHostKeyCallback`
-(bootstrap.go:290-302) both do read-modify-write on
-`certpaths.KnownHostsPath()` WITHOUT a lock. Two concurrent operations
-(e.g. `orca node join --type proxmox hostA` + `orca node key-reset hostB`,
-or two simultaneous joins to different hosts) could interleave:
-- T1 reads known_hosts (empty), T2 reads known_hosts (empty)
-- T1 writes hostA line, T2 writes hostB line
-- Last rename wins → one line lost.
-
-The `security.WriteAtomic` (temp+rename) prevents corruption (the file is
-always valid OpenSSH format), but a captured line can be silently lost. This
-is a **last-writer-wins race on a flat file with no lock**. Severity is low
-because orca is a single-operator CLI (concurrent joins are unusual) and
-the lost line is recoverable (re-connect re-pins via TOFU). But it is a
-real correctness gap for the trust surface. Recommend either (a) a
-file-lock around the read-modify-write, or (b) documenting the
-single-operator assumption explicitly. Flagged P1 (important, post-hoc).
-
-**A3 — Can verify-reqs be fooled by a crafted markdown table?** ✅
-No. The `reqRowRe` anchors on `^\|\s*(REQ-\d+)\s*\|` and the status column
-at end-of-line. A crafted row with a fake status would have to match the
-regex exactly. The "malformed" fixture (`requirements_malformed.md`)
-exercises the no-REQ-rows path → clear error. A row like
-`| REQ-999 | missing status cell | High | v0.1 |` (no final `|...|`) does
-NOT match `reqRowRe` (the trailing `\|\s*$` requires the status cell) — it
-is silently skipped, which `verify` reports as "no REQ rows" only if ALL
-rows are malformed. If some rows are valid + one malformed, the malformed
-row is skipped without error — a minor blind spot, but acceptable (the
-gate catches drift, not typos). No blocking issue.
-
----
-
-## GRILL Conditions Verification
-
-### #1 — T02.6 labeled as v0.6 ship-defect bugfix ✅
-Commit `8b0cbe1` summary: "fix(proxmox): TOFU capture bug — **v0.6
-ship-defect** first-connect join always failed (T02.6)". The commit message
-explicitly labels it as a v0.6 ship-defect bugfix, not a v0.8 feature.
-PHASE2 verification report records it as "TOFU bugfix (T02.6, v0.6
-ship-defect)". **Satisfied.**
-
-### #2 — T02.9 doctor parity (bootstrap + doctor use capture-fix wrapper) ✅
-- Bootstrap: `internal/proxmox/bootstrap.go:148` calls
-  `TOFUHostKeyCallback(sshAddr, &capturedHostKey)`.
-- Doctor: `internal/doctor/doctor.go:424` calls
-  `proxmox.TOFUHostKeyCallback(sshAddr, nil)`.
-Both use the SAME exported wrapper (`proxmox.TOFUHostKeyCallback`,
-bootstrap.go:275). No duplication. The doctor diff
-(`internal/doctor/doctor.go`) removes the direct `knownhosts.New` call and
-replaces it with the shared wrapper. **Satisfied.**
-
-### #3 — T01.6 cli escape valve (was it needed?) ✅
-PHASE1 verification: cli hit **76.2%** (above the 70% floor, excluding
-daemon.go). The escape valve (ship at 65% if 70% not reached) was **NOT
-needed**. The plan's conditional was correctly conservative; the actual
-result exceeded the floor. **Satisfied (not invoked).**
-
-### #4 — T03.1 verify-reqs regex substring-tolerant + reverse direction ✅
-- **Substring-tolerant**: `cmd/verify-reqs/main.go:30`:
-  `^##\s*Milestone\s+(v0\.\d+):.*—\s*\*\*[^*]*\bCOMPLETE\b[^*]*\*\*`.
-  Verified against the real ROADMAP: matches v0.2's
-  `**COMPLETE (merged to main via v0.3)**` and all other COMPLETE
-  milestones. Golden test `TestVerify_v02SubstringTolerantHeader`
-  (main_test.go:140) guards against regression.
-- **Reverse direction**: `cmd/verify-reqs/main.go:135-139`: a REQ marked
-  `Complete` whose referenced milestones are ALL not-C_COMPLETE in ROADMAP
-  is flagged as `direction=reverse` drift. Golden test `TestVerify_drift`
-  asserts REQ-003 is reverse-drift.
-- **Scope note**: PLAN + commit `fc2b020` document that REQ-060 catches
-  doc-vs-doc drift only (code-vs-doc like the REQ-053 cert_repo_test.go
-  case is out of scope; P04 audit is the backstop). **Satisfied.**
-
----
-
-## P0 Fixes Applied
-
-**None.** No P0 issues (correctness bugs, security holes, broken build/test)
-were found. `go build ./...`, `go vet ./...`, `go test -race` (all key
-packages), and `make verify-reqs` all PASS. The milestone is shippable as-is.
-
----
-
-## P1+ Issues Flagged (post-hoc review)
-
-| ID | Severity | File:line | Issue | Recommendation |
-|----|----------|-----------|-------|----------------|
-| A2 | P1 (important, low likelihood) | `internal/proxmox/bootstrap.go:290-302, 479-523` | `TOFUHostKeyCallback` capture path and `ResetHostKey` both do read-modify-write on `known_hosts` with no lock; concurrent operations can lose a captured line (last-writer-wins via atomic rename — no corruption, but data loss). | Add a file-lock (`flock` on a `.known_hosts.lock` sibling, or `github.com/gofrs/flock` if a dep is acceptable) around the RMW in both paths; OR document the single-operator assumption in the key-reset help text. Defer to v0.9. |
-| M4 | P2 (nit) | `internal/cli/namespace_test.go:28-34` | `resetCommandFlags()` does not reset `joinHostKeyFP`; a test setting `--host-key-fingerprint` without `resetRootFlags` could leak the value. | Add `joinHostKeyFP = ""` to `resetCommandFlags`. Trivial. |
-| P2 | P2 (nit) | `internal/proxmox/bootstrap.go:494-510` | `ResetHostKey` uses `strings.Split` + repeated `append` (minor allocation churn). | Optional: use `bufio.Scanner` + `strings.Builder`. Not worth changing for a small file. |
-
----
-
-## Overall Verdict
-
-**PASS-WITH-FOLLOWUPS**
-
-The v0.8 milestone is correct, secure, tested, and shippable. All 4 GRILL
-binding conditions are satisfied. Zero P0 issues. The single P1 (concurrent
-`known_hosts` write race, A2) is a real but low-likelihood gap appropriate
-for post-hoc follow-up — it does not block the milestone ship because orca
-is a single-operator CLI and the atomic-rename guarantees the file is never
-corrupted (only a captured line can be lost, recoverable on re-connect).
-The 2 P2 nits are cosmetic. Coverage held post-P02 (86.5%/76.7%/70.4% for
-proxmox/cli/doctor), race tests pass, all 7 T02.10 e2e cases are present and
-exercised through a real in-process SSH server, and `make verify-reqs`
-passes on the current repo (60 consistent rows).
-
-Recommend proceeding to P04 ship (T04.7/T04.8: mark REQ-057..060 Complete +
-ROADMAP v0.8 COMPLETE, then tag v0.7.4).

.ciagent/ROADMAP.md

@@ -20,7 +20,7 @@
 - `iter.Seq` streaming job lists (REQ-022)
 - Frontend / devops personas (no web UI; CoreCI handles release)
 
-## Milestone v0.2: Networking, Observability, Security Hardening — **COMPLETE (merged to main via v0.3)**
+## Milestone v0.2: Networking, Observability, Security Hardening — **FUNCTIONALLY COMPLETE (pending merge to main)**
 
 Scope: extend v0.1 with secure cross-node transport, multi-node scheduling,
 richer CI security scanning, and streaming I/O.
@@ -28,25 +28,25 @@ richer CI security scanning, and streaming I/O.
 - [x] Phase 8: mTLS handshake + internal CA with CSR join (Wave 1) — shipped v0.2.1
 - [x] Phase 9: Multi-node scheduling & job dispatch (Wave 1) — shipped v0.2.2
 - [x] Phase 10: `gosec` + `govulncheck` + gitleaks in CI (Wave 2) — shipped v0.2.3
-- [x] Phase 11: `iter.Seq` streaming job/node lists (Wave 2) — **completed in v0.3 P01** (shipped v0.3.1)
+- [ ] Phase 11: `iter.Seq` streaming job/node lists (Wave 2) — **deferred to v0.3 P01**
 
-**Milestone tag**: `v0.4.0` (shipped — v0.2 work merged to main via v0.3 milestone).
+**Milestone tag**: `v0.3.0` (next-minor per feature-milestone promotion rule) — pending merge to main.
 
 Per-phase tags: `v0.2.1` (P01), `v0.2.2` (P02), `v0.2.3` (P03) — all shipped.
 
-## Milestone v0.3: Scheduling & Streaming Completion — **COMPLETE**
+## Milestone v0.3: Scheduling & Streaming Completion — **IN PROGRESS**
 
 Scope: complete the two work items deferred from v0.2 that were not
 already shipped in P08-P10. A re-init SPECIFY codebase audit confirmed
 that REQ-014/027/028/029/031/037/039/040 all shipped in P08-P10 despite
 stale REQUIREMENTS.md marking them Pending. The remaining work is lean:
 
-- [x] Phase 0: Pre-execution (specify → clarify → research → plan → grill) — shipped v0.3.0
-- [x] Phase 1: `iter.Seq` streaming for `--watch` flags (REQ-022, REQ-030) — shipped v0.3.1
-- [x] Phase 2: `orca doctor` network + db full implementation (REQ-032 completion) — shipped v0.3.2
-- [x] Phase 3: Final review + ship + audit (milestone release) — shipped v0.3.3
+- [ ] Phase 0: Pre-execution (specify → clarify → research → plan)
+- [ ] Phase 1: `iter.Seq` streaming for `--watch` flags (REQ-022, REQ-030)
+- [ ] Phase 2: `orca doctor` network + db full implementation (REQ-032 completion)
+- [ ] Phase 3: Final review + ship + audit (milestone release)
 
-**Milestone tag**: `v0.4.0` (next-minor per feature-milestone promotion rule).
+**Target milestone tag**: `v0.4.0` (next-minor per feature-milestone promotion rule).
 
 Per-phase tags: `v0.3.0` (P0), `v0.3.1` (P01), `v0.3.2` (P02), `v0.3.3` (P03 final = milestone release).
 Per `.ciagent/RELEASE_POLICY.md`, every phase tag produces a Gitea release.
@@ -69,118 +69,3 @@ Per `.ciagent/RELEASE_POLICY.md`, every phase tag produces a Gitea release.
 The vision ("minimalist, offline-first, CLI-first orchestration
 engine") is unchanged. v0.3 closes out the v0.2 deferrals and merges
 the accumulated v0.2 work to main.
-
-## Milestone v0.5: Distribution — **COMPLETE**
-
-Scope: make Orca installable, distributable, and containerized. The
-engine functionality from v0.1–v0.3 is unchanged; this milestone is
-purely about delivery surface.
-
-- [x] Phase 0: Pre-execution (specify → clarify → research → plan) — shipped `v0.4.1` (+ repo public)
-- [x] Phase 1: Namespace unification (`ORCA_HOME` + `--system`) (REQ-041, REQ-042) — shipped `v0.4.2`
-- [x] Phase 2: `install.sh` + in-place update + README quickstart (REQ-043, REQ-044) — shipped `v0.4.3`
-- [x] Phase 3: Docker release (Dockerfile + Gitea container registry) (REQ-046) — shipped `v0.4.4`
-- [x] Phase 4: Final review + ship + audit (milestone release) — shipped `v0.4.5`
-
-**Operational prerequisite (P0 ship)**: repo + org visibility flipped to
-public (REQ-045) — unauth releases API + asset download + docker pull all
-verified HTTP 200.
-
-**Milestone tag**: `v0.4.5` (final phase patch = milestone release per
-feature-milestone promotion rule). Per-phase tags: `v0.4.1`…`v0.4.5`.
-
-## Milestone v0.6: Node Bootstrap & Proxmox
-
-## Milestone v0.6: Node Bootstrap & Proxmox — **COMPLETE**
-
-Scope: make `orca init` produce a fully working single-node cluster
-(CA + server cert + DB + localhost node registered with auto-detected
-OS), and add Proxmox 8 & 9 as a first-class remote node type joined
-over SSH with least-privilege role delegation.
-
-- [x] Phase 0: Pre-execution (specify → clarify → research → plan → grill) — tag `v0.5.0`
-- [x] Phase 1: `orca init` full bootstrap + localhost node + schema 0006 (REQ-047, REQ-048, REQ-049) — tag `v0.5.1`
-- [x] Phase 2: Proxmox SSH join + OrcaOperator role + sudoers allowlist (REQ-050, REQ-051) — tag `v0.5.2`
-- [x] Phase 3: `doctor os` + `doctor proxmox` SSH probe + audit logging (REQ-052) — tag `v0.5.3`
-- [x] Phase 4: Final review + ship + audit (milestone release) — tag `v0.5.4`
-
-**Milestone type**: feature (P1/P2/P3 ship `feat` phases).
-**Milestone tag**: `v0.5.4` (final phase patch = milestone release per
-feature-milestone promotion rule). Per-phase tags: `v0.5.0`…`v0.5.4`.
-
-Tags run on the previous minor's patch line (v0.5.x) per
-branch-strategy.md. The milestone branch label uses the milestone
-number (`milestone/v0.6-node-bootstrap-proxmox`); no separate minor
-tag is created.
-
-## Milestone v0.7: Hardening & Completion — **COMPLETE**
-
-Scope: NFR milestone closing gaps surfaced by the v0.7 IDEATE stage —
-an unreachable command tree, a missing config file layer, low test
-coverage in core packages, and the long-deferred pprof endpoint.
-
-- [x] Phase 0: Pre-execution (specify → clarify → research → ideate → plan) — tag `v0.6.0` (shipped)
-- [x] Phase 1: Register `orca cert` command tree + cert_repo tests (REQ-053) — tag `v0.6.1` (shipped)
-- [x] Phase 2: HCL config file parsing — `internal/config` package (REQ-054) — tag `v0.6.2` (shipped)
-- [x] Phase 3: Test coverage uplift — engine/transport/proxmox/audit ≥ 50% (REQ-055) — tag `v0.6.3` (shipped)
-- [x] Phase 4: `--pprof` opt-in on `orca daemon` (REQ-056) — tag `v0.6.4` (shipped)
-- [x] Phase 5: Final review + ship + audit (milestone release) — tag `v0.6.5` (shipped)
-
-**Milestone type**: NFR (all phases are fix/test/chore; no `feat` phases).
-**Milestone tag**: `v0.6.5` (final phase patch = milestone release per
-NFR-milestone progressive-patch rule). Per-phase tags: `v0.6.0`…`v0.6.5`.
-Tags run on the previous minor's patch line (v0.6.x) per
-branch-strategy.md. The milestone branch label uses the milestone
-number (`milestone/v0.7-hardening-completion`); no separate minor tag.
-
-## Milestone v0.8: Coverage & Trust Hardening — **COMPLETE**
-
-Scope: continue the v0.7 hardening theme. v0.7 P03's ≥ 50% floor left
-six packages still under 50% (engine 8.3%, proxmox 5.1%, cli 27.6%,
-transport 26.3%, store 46.7%, jobspec 47.6%) and three packages with
-no tests at all (`internal/audit`, `internal/certpaths`, `cmd/orca`).
-v0.8 also closes the two SSH-trust "future enhancement" hooks deferred
-in v0.6 (D-035 `--host-key-fingerprint` pre-pin, RESEARCH_v0.6 §80
-`orca node key-reset`) and adds a requirements-hygiene gate to prevent
-the stale-REQ-status drift seen after v0.7 ship.
-
-- [x] Phase 0: Pre-execution (specify → clarify → research → plan → grill) — tag `v0.7.0` (shipped)
-- [x] Phase 1: Test coverage uplift round 2 — 6 packages to ≥ 70%, 3 zero-test packages to first tests (REQ-057) — tag `v0.7.1` (shipped)
-- [x] Phase 2: SSH trust hardening — `--host-key-fingerprint` pre-pin + `orca node key-reset` + TOFU bugfix + `HostKeyFingerprint` population (REQ-058, REQ-059) — tag `v0.7.2` (shipped)
-- [x] Phase 3: Requirements-hygiene gate — `make verify-reqs` + verify assertion (REQ-060) — tag `v0.7.3` (shipped)
-- [x] Phase 4: Final review + ship + audit (milestone release) — tag `v0.7.4` (shipped)
-
-**Milestone type**: NFR (P01 test, P02 chore on trust surface per
-D-043, P03 chore, P04 docs/review). Final phase patch IS the milestone
-release per NFR-milestone progressive-patch rule. Per-phase tags:
-`v0.7.0`…`v0.7.4`. Tags run on the previous minor's patch line (v0.7.x)
-per branch-strategy.md. The milestone branch label uses the milestone
-number (`milestone/v0.8-coverage-trust-hardening`); no separate minor
-tag.
-
-### Per-phase REQ coverage
-
-- **P01 — Coverage uplift round 2**
-  - REQ-057 (raise `internal/engine`, `internal/proxmox`,
-    `internal/cli`, `internal/transport`, `internal/store`,
-    `internal/jobspec` to ≥ 70%; add first tests for `internal/audit`,
-    `internal/certpaths`, `cmd/orca`)
-
-- **P02 — SSH trust hardening**
-  - REQ-058 (`--host-key-fingerprint <sha256>` pre-pin flag on
-    `orca node join --type proxmox`; fail fast on mismatch; supersedes
-    TOFU for pre-pinned deployments)
-  - REQ-059 (`orca node key-reset <node>` clears persisted SSH host
-    key so next `doctor proxmox`/dispatch re-pins via TOFU or
-    `--host-key-fingerprint`)
-
-- **P03 — Requirements-hygiene gate**
-  - REQ-060 (`make verify-reqs` target + verify-stage assertion:
-    every REQ `Complete` in ROADMAP.md has matching `Complete` row in
-    REQUIREMENTS.md; enforced in CI `validate` pipeline)
-
-### v0.8 is a continuation milestone, not a direction change
-
-The vision ("minimalist, offline-first, CLI-first orchestration
-engine") is unchanged. v0.8 closes the coverage debt left by v0.7's
-50% floor and the trust-surface gaps explicitly deferred in v0.6.

.ciagent/config.json

@@ -5,9 +5,9 @@
       "slug": "orca",
       "name": "Orca",
       "description": "Offline/CLI-first orchestration engine (Orca) — Nomad-inspired, far simpler than Kubernetes",
-      "milestone": "v0.8",
-      "phase": 4,
-      "milestone_type": "nfr",
+      "milestone": "v0.3",
+      "phase": 0,
+      "milestone_type": "feature",
       "default_branch": "main",
       "tech_stack": {
         "language": "go",
@@ -24,11 +24,6 @@
   ],
   "active_project": "orca",
   "active_projects": ["orca"],
-  "ship": {
-    "per_phase": true,
-    "allow_skip": false,
-    "max_release_retries": 3
-  },
   "autonomy": {
     "level": "full",
     "decision_confidence_threshold": 0.60,
@@ -127,13 +122,6 @@
       "owner": "coreci",
       "repo": "orca",
       "token_env": "GITEA_TOKEN"
-    },
-    "container_registry": {
-      "forge": "gitea",
-      "registry": "git.cloudinit.dev",
-      "owner": "coreci",
-      "image": "orca",
-      "credential_env": "GITEA_TOKEN"
     }
   },
   "secrets": {

.coreci.yml

@@ -13,8 +13,6 @@ description: Orca — offline/CLI-first orchestration engine. Full release flow
 #   - gosec        (REQ-014, REQ-040)  Static analysis for Go security smells
 #   - govulncheck  (REQ-014, REQ-027)  Offline vuln scan of dependencies
 #   - gitleaks     (REQ-039)          Pre-commit-style secret scan
-# v0.8 P03 added a requirements-hygiene stage:
-#   - verify-reqs (REQ-060)          ROADMAP COMPLETE ↔ REQUIREMENTS Complete
 # The `test` pipeline runs with -race (REQ-031).
 # See docs/security-scanning.md for operator-facing details.
 
@@ -29,11 +27,6 @@ pipelines:
           - gofmt -l .
           - go vet ./...
 
-      - name: verify-reqs
-        image: golang:1.25
-        commands:
-          - make verify-reqs
-
       - name: gosec
         image: golang:1.25
         commands:
@@ -119,23 +112,3 @@ pipelines:
               --title "Orca ${VERSION}"
               --note-file CHANGELOG.md
               --asset orca-${VERSION}-linux-amd64.tar.gz
-      - name: container-publish
-        description: Build and publish OCI image to Gitea container registry (REQ-046)
-        image: docker:24-cli
-        env:
-          GITEA_TOKEN: ${GITEA_TOKEN}
-          VERSION: ${CI_COMMIT_TAG}
-          GIT_COMMIT: ${CI_COMMIT_SHA}
-          BUILD_TIME: ${CI_BUILD_TIME}
-        commands:
-          - docker build
-              --build-arg VERSION=${VERSION}
-              --build-arg GIT_COMMIT=${GIT_COMMIT}
-              --build-arg BUILD_TIME=${BUILD_TIME}
-              -t git.cloudinit.dev/coreci/orca:${VERSION}
-              -t git.cloudinit.dev/coreci/orca:latest
-              .
-          - echo "${GITEA_TOKEN}" | docker login git.cloudinit.dev -u cloudinit-bot --password-stdin
-          - docker push git.cloudinit.dev/coreci/orca:${VERSION}
-          - docker push git.cloudinit.dev/coreci/orca:latest
-          - docker logout git.cloudinit.dev

.dockerignore

@@ -1,20 +0,0 @@
-.git
-.githooks
-.bin
-bin/
-*.tar.gz
-*.tar.gz.asc
-.env
-.env.*
-.gitleaks-baseline.json
-.gitleaks.toml
-.golangci.yml
-.ciagent/
-testdata/
-docs/
-*.md
-!README.md
-LICENSE
-coverage.out
-orca
-orca-v*

Dockerfile

@@ -1,56 +0,0 @@
-# Dockerfile — multi-stage build for orca
-#
-# Stage 1: build the static binary with golang:1.25
-# Stage 2: distroless static runtime (CGO-free, ~2MB image)
-#
-# Build args:
-#   VERSION     — semver tag injected via -ldflags (e.g. v0.4.4)
-#   GIT_COMMIT  — short commit hash
-#   BUILD_TIME  — ISO 8601 build timestamp
-#
-# Build:
-#   docker build --build-arg VERSION=v0.4.4 -t git.cloudinit.dev/coreci/orca:v0.4.4 .
-#
-# Run:
-#   docker run --rm git.cloudinit.dev/coreci/orca:v0.4.4 version
-#   docker run --rm -v orca-data:/var/lib/orca git.cloudinit.dev/coreci/orca:v0.4.4 init
-
-ARG VERSION=dev
-ARG GIT_COMMIT=unknown
-ARG BUILD_TIME=unknown
-
-# --- Stage 1: build -------------------------------------------------------
-
-FROM golang:1.25 AS builder
-
-ARG VERSION
-ARG GIT_COMMIT
-ARG BUILD_TIME
-
-WORKDIR /src
-
-# Cache module downloads — copy go.mod/go.sum first, download, then copy source.
-COPY go.mod go.sum ./
-RUN go mod download
-
-COPY . .
-
-# CGO_ENABLED=0 guarantees a static binary (modernc/sqlite is pure Go).
-RUN CGO_ENABLED=0 go build -trimpath \
-      -ldflags="-s -w \
-        -X git.cloudinit.dev/coreci/orca/internal/cli.version=${VERSION} \
-        -X git.cloudinit.dev/coreci/orca/internal/cli.gitCommit=${GIT_COMMIT} \
-        -X git.cloudinit.dev/coreci/orca/internal/cli.buildTime=${BUILD_TIME}" \
-      -o /orca ./cmd/orca
-
-# --- Stage 2: runtime -----------------------------------------------------
-
-FROM gcr.io/distroless/static-debian12:nonroot
-
-# ORCA_HOME points to a volume-mountable path inside the container.
-# Mount a volume at /var/lib/orca to persist state across container restarts.
-ENV ORCA_HOME=/var/lib/orca
-
-COPY --from=builder /orca /orca
-
-ENTRYPOINT ["/orca"]

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test test-race lint fmt clean run release version changelog help security-scan verify-reqs
+.PHONY: build test test-race lint fmt clean run release version changelog help security-scan
 
 BINARY := bin/orca
 GOFLAGS := -trimpath
@@ -30,7 +30,6 @@ help:
 	@echo "  changelog       Generate CHANGELOG.md from ---ci--- commit blocks"
 	@echo "  release         Run scripts/release.sh [VERSION] — build, tar, publish"
 	@echo "  security-scan   Run gosec+govulncheck+gitleaks (P03, REQ-014/027/039)"
-	@echo "  verify-reqs    Assert ROADMAP COMPLETE ↔ REQUIREMENTS Complete (REQ-060)"
 
 build:
 	@mkdir -p bin
@@ -99,9 +98,3 @@ release:
 # in a developer's local environment; CI requires all three).
 security-scan:
 	./scripts/security_scan.sh
-
-# verify-reqs asserts ROADMAP milestone COMPLETE ↔ REQUIREMENTS row Complete
-# consistency (REQ-060). Catches doc-vs-doc drift; code-vs-doc drift is out
-# of scope (P04 audit). Exits 0 on consistency, 1 with a diff on drift.
-verify-reqs:
-	go run ./cmd/verify-reqs .ciagent/ROADMAP.md .ciagent/REQUIREMENTS.md

README.md

@@ -18,43 +18,16 @@ Offline/CLI-first orchestration engine inspired by HashiCorp Nomad, far simpler
 
 ## Quickstart
 
-### Install (1-liner)
-
 ```bash
-# User-level install (binary at ~/.local/bin/orca, state at ~/.orca)
-curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash
+# Build
+make build
 
-# System-level install (binary at /usr/local/bin/orca, state at /root/.orca)
-curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | sudo bash -s -- --system
+# Run
+./bin/orca version
+./bin/orca --help
 
-# Pin a specific version
-curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash -s -- --version v0.4.2
-```
-
-Then initialize local state and verify:
-
-```bash
-orca init          # creates ~/.orca/ (or /root/.orca with --system)
-orca version       # prints version info
-orca --help        # show all subcommands
-```
-
-### Build from source
-
-```bash
-make build         # Build binary to ./bin/orca
-./bin/orca init    # Initialize local state
-./bin/orca version # Verify
-```
-
-### Update in place
-
-Re-running the installer updates the binary while preserving your
-config, database, and certificates in the namespace dir:
-
-```bash
-curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash
-# → "updated orca from v0.4.1 to v0.4.2"
+# Initialize local state
+./bin/orca init
 ```
 
 ## Subcommands

cmd/orca/main.go

@@ -8,16 +8,8 @@ import (
 )
 
 func main() {
-	os.Exit(run())
-}
-
-// run executes the orca CLI and returns the process exit code. It is
-// extracted from main so tests can exercise the error path without
-// os.Exit terminating the test process.
-func run() int {
 	if err := cli.Execute(); err != nil {
 		fmt.Fprintf(os.Stderr, "error: %v\n", err)
-		return 1
+		os.Exit(1)
 	}
-	return 0
 }

cmd/orca/main_test.go

@@ -1,41 +0,0 @@
-package main
-
-import (
-	"io"
-	"os"
-	"strings"
-	"testing"
-)
-
-func TestRunSuccess(t *testing.T) {
-	orig := os.Args
-	t.Cleanup(func() { os.Args = orig })
-	os.Args = []string{"orca", "version"}
-	if code := run(); code != 0 {
-		t.Errorf("run() = %d, want 0", code)
-	}
-}
-
-func TestRunError(t *testing.T) {
-	origArgs := os.Args
-	t.Cleanup(func() { os.Args = origArgs })
-	os.Args = []string{"orca", "job", "run", "/nonexistent/spec.hcl"}
-
-	r, w, err := os.Pipe()
-	if err != nil {
-		t.Fatalf("pipe: %v", err)
-	}
-	origStderr := os.Stderr
-	os.Stderr = w
-	t.Cleanup(func() { os.Stderr = origStderr })
-
-	code := run()
-	w.Close()
-	out, _ := io.ReadAll(r)
-	if code != 1 {
-		t.Errorf("run() = %d, want 1", code)
-	}
-	if !strings.Contains(string(out), "error:") {
-		t.Errorf("stderr missing 'error:' prefix: %s", out)
-	}
-}

cmd/verify-reqs/main.go

@@ -1,183 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"regexp"
-	"sort"
-	"strings"
-)
-
-// reqRowRe captures a REQUIREMENTS.md table row's REQ-ID, Phase cell, and
-// status in one pass. The leading .* is greedy so it consumes the
-// Requirement and Priority cells (which may contain markdown-escaped pipes
-// like `localhost\|linux\|proxmox` — see REQ-049) and backtracks to anchor
-// the Phase + Status match at the END of the line, where those two columns
-// always live. The status token is optionally wrapped in markdown bold
-// (real rows use `**Complete**`; synthetic/future rows may use bare
-// `Pending`), and may carry trailing notes (e.g. "**Complete** (P01
-// shipped v0.2.1)") matched by [^|]* before the closing pipe.
-var reqRowRe = regexp.MustCompile(`^\|\s*(REQ-\d+)\s*\|.*\|\s*([^|]*?)\s*\|\s*\*{0,2}(Complete|Pending)\*{0,2}[^|]*\|\s*$`)
-
-// milestoneCompleteRe matches a ROADMAP.md milestone header that is marked
-// COMPLETE. The bold span is substring-tolerant (GRILL #4): it matches
-// `**COMPLETE**`, `**COMPLETE (merged to main via v0.3)**`, and any future
-// variant where the word COMPLETE appears inside the bold span, possibly
-// preceded or followed by non-asterisk text. The milestone version (v0.X)
-// is captured.
-var milestoneCompleteRe = regexp.MustCompile(`^##\s*Milestone\s+(v0\.\d+):.*—\s*\*\*[^*]*\bCOMPLETE\b[^*]*\*\*`)
-
-// phaseRe extracts the milestone version from a REQUIREMENTS Phase cell such
-// as `v0.7 P1`, `**v0.2 P01**`, `v0.2 P01–P04`, or bare `v0.7`. The cell may
-// contain multiple milestone refs separated by `/` or `–`; each is extracted.
-var phaseTokenRe = regexp.MustCompile(`v0\.\d+`)
-
-// reqRow holds a parsed REQUIREMENTS.md row.
-type reqRow struct {
-	id     string
-	phase  string // raw Phase cell (e.g. "v0.7 P1", "**v0.2 P01 / v0.3 P02**")
-	status string // "Complete" or "Pending"
-}
-
-// milestoneVersions returns the distinct v0.X milestones referenced in the
-// phase cell (e.g. "v0.7 P1" → ["v0.7"]; "v0.2 P01 / v0.3 P02" →
-// ["v0.2","v0.3"]).
-func (r reqRow) milestoneVersions() []string {
-	matches := phaseTokenRe.FindAllString(r.phase, -1)
-	seen := map[string]bool{}
-	var out []string
-	for _, m := range matches {
-		if !seen[m] {
-			seen[m] = true
-			out = append(out, m)
-		}
-	}
-	return out
-}
-
-func main() {
-	roadmapPath := ".ciagent/ROADMAP.md"
-	reqsPath := ".ciagent/REQUIREMENTS.md"
-	if len(os.Args) > 1 {
-		roadmapPath = os.Args[1]
-	}
-	if len(os.Args) > 2 {
-		reqsPath = os.Args[2]
-	}
-	diff, count, err := verify(roadmapPath, reqsPath)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "verify-reqs: %v\n", err)
-		os.Exit(2)
-	}
-	if len(diff) > 0 {
-		fmt.Fprintf(os.Stderr, "requirements drift detected (%d):\n", len(diff))
-		for _, line := range diff {
-			fmt.Fprintln(os.Stderr, line)
-		}
-		os.Exit(1)
-	}
-	fmt.Printf("✓ %d requirements consistent with roadmap\n", count)
-}
-
-// verify parses the ROADMAP and REQUIREMENTS markdown and returns a diff
-// listing of any drift. On success diff is nil and count is the number of
-// consistent REQ rows. A non-nil error signals a parse/read failure (not
-// drift); drift is reported via the diff slice.
-func verify(roadmapPath, reqsPath string) (diff []string, count int, err error) {
-	completeMilestones, err := parseRoadmap(roadmapPath)
-	if err != nil {
-		return nil, 0, fmt.Errorf("parse roadmap %q: %w", roadmapPath, err)
-	}
-	rows, err := parseRequirements(reqsPath)
-	if err != nil {
-		return nil, 0, fmt.Errorf("parse requirements %q: %w", reqsPath, err)
-	}
-	if len(rows) == 0 {
-		return nil, 0, fmt.Errorf("no REQ rows found in %s", reqsPath)
-	}
-
-	type driftEntry struct {
-		id      string
-		current string
-		want    string
-		dir     string // "forward" or "reverse"
-	}
-	var drifts []driftEntry
-
-	for _, r := range rows {
-		milestones := r.milestoneVersions()
-		anyComplete := false
-		for _, m := range milestones {
-			if completeMilestones[m] {
-				anyComplete = true
-				break
-			}
-		}
-		// Forward assertion: a REQ whose milestone is COMPLETE in ROADMAP
-		// must be marked Complete in REQUIREMENTS.
-		if anyComplete && r.status != "Complete" {
-			drifts = append(drifts, driftEntry{r.id, r.status, "Complete", "forward"})
-		}
-		// Reverse assertion (GRILL #4): a REQ marked Complete in
-		// REQUIREMENTS must reference at least one milestone ROADMAP marks
-		// COMPLETE. If all referenced milestones are NOT complete (or no
-		// milestone is referenced), that is premature-Complete drift.
-		if r.status == "Complete" && !anyComplete {
-			drifts = append(drifts, driftEntry{r.id, r.status, "Pending (milestone not COMPLETE in ROADMAP)", "reverse"})
-		}
-	}
-
-	sort.Slice(drifts, func(i, j int) bool { return drifts[i].id < drifts[j].id })
-	for _, d := range drifts {
-		diff = append(diff, fmt.Sprintf("  %s: status=%s, expected=%s (direction=%s)", d.id, d.current, d.want, d.dir))
-	}
-
-	consistent := len(rows) - len(drifts)
-	return diff, consistent, nil
-}
-
-func parseRoadmap(path string) (map[string]bool, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-	complete := map[string]bool{}
-	sc := bufio.NewScanner(f)
-	sc.Buffer(make([]byte, 1024*1024), 1024*1024)
-	for sc.Scan() {
-		line := sc.Text()
-		m := milestoneCompleteRe.FindStringSubmatch(line)
-		if m != nil {
-			complete[m[1]] = true
-		}
-	}
-	if err := sc.Err(); err != nil {
-		return nil, err
-	}
-	return complete, nil
-}
-
-func parseRequirements(path string) ([]reqRow, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-	var rows []reqRow
-	sc := bufio.NewScanner(f)
-	sc.Buffer(make([]byte, 1024*1024), 1024*1024)
-	for sc.Scan() {
-		line := sc.Text()
-		m := reqRowRe.FindStringSubmatch(line)
-		if m == nil {
-			continue
-		}
-		rows = append(rows, reqRow{id: m[1], phase: strings.TrimSpace(m[2]), status: m[3]})
-	}
-	if err := sc.Err(); err != nil {
-		return nil, err
-	}
-	return rows, nil
-}

cmd/verify-reqs/main_test.go

@@ -1,170 +0,0 @@
-package main
-
-import (
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// Tests run with cwd = package dir (cmd/verify-reqs), so `testdata/...`
-// paths resolve relative to the package. The real-repo tests use a
-// repoRoot helper to locate `.ciagent/...`.
-
-func repoRoot(t *testing.T) string {
-	t.Helper()
-	wd, err := os.Getwd()
-	if err != nil {
-		t.Fatalf("getwd: %v", err)
-	}
-	return filepath.Join(wd, "..", "..")
-}
-
-// case (1): clean pair → no drift.
-func TestVerify_clean(t *testing.T) {
-	diff, count, err := verify(
-		filepath.Join("testdata", "roadmap_clean.md"),
-		filepath.Join("testdata", "requirements_clean.md"),
-	)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(diff) != 0 {
-		t.Fatalf("expected no drift, got:\n%s", strings.Join(diff, "\n"))
-	}
-	if count != 5 {
-		t.Fatalf("expected 5 consistent rows, got %d", count)
-	}
-}
-
-// case (2)+(3): drift pair → all drifts reported, both directions.
-func TestVerify_drift(t *testing.T) {
-	diff, _, err := verify(
-		filepath.Join("testdata", "roadmap_drift.md"),
-		filepath.Join("testdata", "requirements_drift.md"),
-	)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(diff) != 4 {
-		t.Fatalf("expected 4 drifts (REQ-002 forward, REQ-003 reverse, REQ-004 forward, REQ-005 forward), got %d:\n%s",
-			len(diff), strings.Join(diff, "\n"))
-	}
-	joined := strings.Join(diff, "\n")
-	for _, want := range []string{"REQ-002", "REQ-003", "REQ-004", "REQ-005"} {
-		if !strings.Contains(joined, want) {
-			t.Errorf("diff missing %s:\n%s", want, joined)
-		}
-	}
-	if !strings.Contains(joined, "direction=reverse") {
-		t.Errorf("expected a reverse-direction drift, got:\n%s", joined)
-	}
-	if !strings.Contains(joined, "direction=forward") {
-		t.Errorf("expected a forward-direction drift, got:\n%s", joined)
-	}
-}
-
-// case (4): missing args → defaults resolve to the repo's .ciagent/ files.
-// Runs the program as a subprocess from the repo root.
-func TestVerify_defaultArgs(t *testing.T) {
-	if testing.Short() {
-		t.Skip("subprocess test skipped in -short mode")
-	}
-	root := repoRoot(t)
-	cmd := exec.Command("go", "run", "./cmd/verify-reqs")
-	cmd.Dir = root
-	out := &strings.Builder{}
-	cmd.Stdout = out
-	cmd.Stderr = out
-	if err := cmd.Run(); err != nil {
-		if exitErr, ok := err.(*exec.ExitError); ok {
-			t.Fatalf("verify-reqs on real repo exited %d (should be 0): %s",
-				exitErr.ExitCode(), out.String())
-		}
-		t.Fatalf("go run failed: %v", err)
-	}
-}
-
-// case (5): malformed markdown (no REQ rows) → clear error, not silent pass.
-func TestVerify_malformed(t *testing.T) {
-	_, _, err := verify(
-		filepath.Join("testdata", "roadmap_clean.md"),
-		filepath.Join("testdata", "requirements_malformed.md"),
-	)
-	if err == nil {
-		t.Fatal("expected error on malformed (no REQ rows) requirements, got nil")
-	}
-	if !strings.Contains(err.Error(), "no REQ rows") {
-		t.Errorf("expected 'no REQ rows' error, got: %v", err)
-	}
-}
-
-// case (6): missing file → clear error, not silent pass.
-func TestVerify_missingFile(t *testing.T) {
-	_, _, err := verify(
-		filepath.Join("testdata", "roadmap_clean.md"),
-		filepath.Join("testdata", "does_not_exist.md"),
-	)
-	if err == nil {
-		t.Fatal("expected error on missing file, got nil")
-	}
-	if !strings.Contains(err.Error(), "does_not_exist.md") {
-		t.Errorf("expected error to mention the missing file, got: %v", err)
-	}
-}
-
-// GRILL #4 golden test: the v0.2-style
-// `**COMPLETE (merged to main via v0.3)**` header MUST be recognized as a
-// complete milestone by the substring-tolerant regex. The drift fixture's
-// roadmap carries exactly this header on its v0.2 line, and the drift
-// fixture's REQ-002 (v0.2 P1, Pending) would be silently skipped if the
-// regex regressed to the exact `\*\*COMPLETE\*\*` form. TestVerify_drift
-// already asserts REQ-002 is flagged forward-drift; this test makes the
-// intent explicit and guards against a regex regression.
-func TestVerify_v02SubstringTolerantHeader(t *testing.T) {
-	diff, _, err := verify(
-		filepath.Join("testdata", "roadmap_drift.md"),
-		filepath.Join("testdata", "requirements_drift.md"),
-	)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	// REQ-002 references milestone v0.2, whose header uses the
-	// `**COMPLETE (merged to main via v0.3)**` variant. If the regex
-	// regressed, v0.2 would not be marked complete and REQ-002 (Pending)
-	// would NOT be flagged as forward drift.
-	found := false
-	for _, d := range diff {
-		if strings.Contains(d, "REQ-002") && strings.Contains(d, "direction=forward") {
-			found = true
-			break
-		}
-	}
-	if !found {
-		t.Fatalf("REQ-002 forward drift not reported — substring-tolerant regex may have regressed; diff:\n%s",
-			strings.Join(diff, "\n"))
-	}
-}
-
-// Verify the actual repo passes (regression guard for the real docs).
-func TestVerify_realRepo(t *testing.T) {
-	if testing.Short() {
-		t.Skip("real-repo test skipped in -short mode")
-	}
-	root := repoRoot(t)
-	diff, count, err := verify(
-		filepath.Join(root, ".ciagent", "ROADMAP.md"),
-		filepath.Join(root, ".ciagent", "REQUIREMENTS.md"),
-	)
-	if err != nil {
-		t.Fatalf("verify on real repo errored: %v", err)
-	}
-	if len(diff) != 0 {
-		t.Fatalf("real repo has requirements drift (should be clean after SPECIFY):\n%s",
-			strings.Join(diff, "\n"))
-	}
-	if count <= 0 {
-		t.Fatalf("real repo reported %d consistent rows (expected > 0)", count)
-	}
-}

cmd/verify-reqs/testdata/requirements_clean.md

@@ -1,9 +0,0 @@
-# Requirements: Clean Fixture
-
-| ID | Requirement | Priority | Phase | Status |
-|----|-------------|----------|-------|--------|
-| REQ-001 | Foundation req | High | v0.1 P1 | **Complete** |
-| REQ-002 | Multi-node with escaped pipes (kind\|os) | Medium | **v0.2 P1** | **Complete** (shipped v0.2.1) |
-| REQ-003 | Scheduling req | Low | v0.3 P1 | **Complete** |
-| REQ-004 | Future req spanning phases | Low | v0.2 P1 / v0.3 P2 | **Complete** (multi-phase) |
-| REQ-005 | Pending future req | Low | v0.9 P1 | Pending |

cmd/verify-reqs/testdata/requirements_drift.md

@@ -1,9 +0,0 @@
-# Requirements: Drift Fixture
-
-| ID | Requirement | Priority | Phase | Status |
-|----|-------------|----------|-------|--------|
-| REQ-001 | Foundation req (clean) | High | v0.1 P1 | **Complete** |
-| REQ-002 | Multi-node req (forward drift: milestone COMPLETE but row Pending) | Medium | **v0.2 P1** | Pending |
-| REQ-003 | Scheduling req (reverse drift: row Complete but milestone NOT complete) | Low | v0.9 P1 | **Complete** |
-| REQ-004 | Multi-phase with range (forward drift: spans COMPLETE v0.2 + non-COMPLETE v0.9) | Low | v0.2 P1–P2 | Pending |
-| REQ-005 | Second forward drift (v0.3 COMPLETE, row Pending) | Low | v0.3 P1 | Pending |

cmd/verify-reqs/testdata/requirements_malformed.md

@@ -1,8 +0,0 @@
-# Requirements: Malformed Fixture
-
-This file has no valid REQ rows, just prose and a broken table.
-
-| ID | Requirement | Priority | Phase | Status |
-|----|-------------|----------|-------|--------|
-| NOT-A-REQ | broken row | High | v0.1 | **Complete** |
-| REQ-999 | missing status cell | High | v0.1 |

cmd/verify-reqs/testdata/roadmap_clean.md

@@ -1,20 +0,0 @@
-# Roadmap: Clean Fixture
-
-## Milestone v0.1: Foundation — **COMPLETE**
-
-- [x] Phase 1
-
-## Milestone v0.2: Networking — **COMPLETE (merged to main via v0.3)**
-
-- [x] Phase 8
-- [x] Phase 9
-
-## Milestone v0.3: Scheduling — **COMPLETE**
-
-- [x] Phase 1
-
-## Milestone v0.9: Future Work
-
-Not yet shipped.
-
-- [ ] Phase 1

cmd/verify-reqs/testdata/roadmap_drift.md

@@ -1,20 +0,0 @@
-# Roadmap: Drift Fixture
-
-## Milestone v0.1: Foundation — **COMPLETE**
-
-- [x] Phase 1
-
-## Milestone v0.2: Networking — **COMPLETE (merged to main via v0.3)**
-
-- [x] Phase 8
-- [x] Phase 9
-
-## Milestone v0.3: Scheduling — **COMPLETE**
-
-- [x] Phase 1
-
-## Milestone v0.9: Future Work
-
-Not yet shipped.
-
-- [ ] Phase 1

docs/docker.md

@@ -1,96 +0,0 @@
-# Docker Guide
-
-Orca is available as a container image on the Gitea container registry.
-The image is a minimal distroless static build (~2MB runtime layer)
-that runs the orca binary directly.
-
-## Image
-
-```
-git.cloudinit.dev/coreci/orca:<version>
-git.cloudinit.dev/coreci/orca:latest
-```
-
-The image is built from the `Dockerfile` in the repo root:
-- **Build stage**: `golang:1.25` — compiles a static binary with
-  `CGO_ENABLED=0` (modernc/sqlite is pure Go, no CGO).
-- **Runtime stage**: `gcr.io/distroless/static-debian12:nonroot` —
-  ~2MB, no shell, runs as `nonroot` user.
-
-## Pull
-
-```bash
-docker pull git.cloudinit.dev/coreci/orca:latest
-# or pin a version
-docker pull git.cloudinit.dev/coreci/orca:v0.4.4
-```
-
-The repo is public (REQ-045), so anonymous pull works without login.
-
-## Run
-
-```bash
-# Print version
-docker run --rm git.cloudinit.dev/coreci/orca:v0.4.4 version
-
-# Initialize state (creates /var/lib/orca/ inside the container)
-docker run --rm -v orca-data:/var/lib/orca git.cloudinit.dev/coreci/orca:v0.4.4 init
-
-# Run the daemon (persist state via volume)
-docker run -d --name orca \
-  -p 8080:8080 \
-  -v orca-data:/var/lib/orca \
-  git.cloudinit.dev/coreci/orca:v0.4.4 daemon --addr=:8080
-```
-
-## State Persistence
-
-The image sets `ENV ORCA_HOME=/var/lib/orca`. All orca state (SQLite
-database, CA certs, server certs) is written under this path. To
-persist state across container restarts, mount a volume:
-
-```bash
-docker volume create orca-data
-docker run --rm -v orca-data:/var/lib/orca git.cloudinit.dev/coreci/orca:v0.4.4 init
-docker run -d --name orca -p 8080:8080 -v orca-data:/var/lib/orca git.cloudinit.dev/coreci/orca:v0.4.4 daemon
-```
-
-Without a volume, state is lost when the container exits.
-
-## System-Level Namespace Inside Containers
-
-The `--system` flag is not needed inside containers — the image already
-sets `ORCA_HOME=/var/lib/orca`. Use `--system` only if you want a
-different namespace root (e.g., `/root/.orca`), which requires running
-as root (the distroless image runs as `nonroot` by default).
-
-## Build Locally
-
-```bash
-docker build --build-arg VERSION=v0.4.4 -t orca-local:v0.4.4 .
-docker run --rm orca-local:v0.4.4 version
-```
-
-Build args:
-- `VERSION` — semver tag (injected via `-ldflags`)
-- `GIT_COMMIT` — short commit hash
-- `BUILD_TIME` — ISO 8601 build timestamp
-
-## Publish (for maintainers)
-
-The `.coreci.yml` release pipeline includes a `container-publish` step
-that builds and pushes the image on every tag release. To publish
-manually:
-
-```bash
-export GITEA_TOKEN=<token>
-docker build --build-arg VERSION=v0.4.4 -t git.cloudinit.dev/coreci/orca:v0.4.4 -t git.cloudinit.dev/coreci/orca:latest .
-echo "$GITEA_TOKEN" | docker login git.cloudinit.dev -u cloudinit-bot --password-stdin
-docker push git.cloudinit.dev/coreci/orca:v0.4.4
-docker push git.cloudinit.dev/coreci/orca:latest
-```
-
-## See Also
-
-- [Install Guide](install.md) — binary install (alternative to Docker).
-- [Namespace and Paths](namespace.md) — `ORCA_HOME` and `--system` flag.

docs/install.md

@@ -1,139 +0,0 @@
-# Install Guide
-
-Orca is distributed as a single binary via a 1-liner installer that
-pulls from the public Gitea release artifacts. This guide covers
-user-level install, system-level install, in-place updates, version
-pinning, and troubleshooting.
-
-## Prerequisites
-
-- A Linux system with `curl` and `tar` installed.
-- For user-level install: write access to `~/.local/bin/`.
-- For system-level install: root (`sudo`) access.
-
-## User-Level Install (Default)
-
-```bash
-curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash
-```
-
-This installs:
-- Binary: `~/.local/bin/orca`
-- Namespace root: `~/.orca/` (created by `orca init`)
-
-If `~/.local/bin` is not on your `PATH`, add it:
-```bash
-echo 'export PATH="$PATH:$HOME/.local/bin"' >> ~/.bashrc
-source ~/.bashrc
-```
-
-## System-Level Install
-
-```bash
-curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | sudo bash -s -- --system
-```
-
-This installs:
-- Binary: `/usr/local/bin/orca`
-- Namespace root: `/root/.orca/` (created by `orca --system init`)
-
-The `--system` flag requires root (uid 0). It errors if `ORCA_HOME` is
-already set to a conflicting value.
-
-## Initialize State
-
-After installing, initialize the local state directory:
-
-```bash
-# User-level
-orca init
-
-# System-level
-orca --system init
-```
-
-This creates the namespace root directory (`~/.orca` or `/root/.orca`).
-
-## Version Pinning
-
-By default, the installer fetches the **latest** release. To pin a
-specific version:
-
-```bash
-curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash -s -- --version v0.4.2
-```
-
-## In-Place Update
-
-Re-running the installer updates the binary in place while **preserving**
-your config, database, and certificates in the namespace dir:
-
-```bash
-curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash
-```
-
-Output:
-```
-install: ✓ updated orca from v0.4.1 to v0.4.2 at /home/user/.local/bin/orca
-```
-
-The installer:
-1. Detects the existing binary at the install path.
-2. Reads its version via `orca version --json`.
-3. Downloads the new release.
-4. Overwrites the binary.
-5. **Never touches** the namespace dir (`~/.orca` or `/root/.orca`).
-
-## Uninstall
-
-```bash
-# Remove the binary
-rm ~/.local/bin/orca          # user-level
-sudo rm /usr/local/bin/orca   # system-level
-
-# Optionally remove state (THIS DELETES YOUR DATABASE + CERTS)
-rm -rf ~/.orca                # user-level
-sudo rm -rf /root/.orca       # system-level
-```
-
-## Troubleshooting
-
-### `install: error: --system requires root`
-
-The `--system` flag requires root. Re-run with `sudo`:
-```bash
-curl -fsSL ... | sudo bash -s -- --system
-```
-
-### `install: error: --system conflicts with ORCA_HOME=...`
-
-`ORCA_HOME` is set to a non-system path. Either unset it or drop `--system`:
-```bash
-unset ORCA_HOME
-curl -fsSL ... | sudo bash -s -- --system
-```
-
-### `install: error: could not find asset orca-vX.Y.Z-linux-amd64.tar.gz`
-
-The requested version does not have a Linux release asset. Check
-available releases at
-`https://git.cloudinit.dev/coreci/orca/releases`.
-
-### `install: error: unsupported architecture: ...`
-
-The installer supports `amd64` (x86_64), `arm64` (aarch64), and `armv7`.
-Contact the maintainers if you need another architecture.
-
-### `~/.local/bin is not on your PATH`
-
-Add it to your shell profile:
-```bash
-echo 'export PATH="$PATH:$HOME/.local/bin"' >> ~/.bashrc
-source ~/.bashrc
-```
-
-## See Also
-
-- [Namespace and Paths](namespace.md) — `ORCA_HOME`, `--system`, path layout.
-- [Docker Guide](docker.md) — running orca in a container.
-- [Development](../README.md#development) — building from source.

docs/namespace.md

@@ -1,96 +0,0 @@
-# Namespace and Paths
-
-Orca stores all on-disk state (SQLite database, CA certs, server certs,
-config) under a single **namespace root** directory. This document
-describes how that root is resolved and how to override it.
-
-## Default: User-Level (`~/.orca`)
-
-By default, the namespace root is `~/.orca` (i.e., `$HOME/.orca`).
-All orca state lives under this directory:
-
-| Path | Contents |
-|------|----------|
-| `~/.orca/orca.db` | SQLite database (jobs, nodes, tasks, audit log, capacity) |
-| `~/.orca/ca.crt` | CA certificate (PEM, mode 0644) |
-| `~/.orca/ca.key` | CA private key (PEM, mode 0600) |
-| `~/.orca/server.crt` | Server certificate (PEM, mode 0644) |
-| `~/.orca/server.key` | Server private key (PEM, mode 0600) |
-
-## Override: `ORCA_HOME` Environment Variable (REQ-041)
-
-Set the `ORCA_HOME` environment variable to change the namespace root
-for **all** orca components (database, certs, init, daemon):
-
-```bash
-export ORCA_HOME=/var/lib/orca
-orca init          # creates /var/lib/orca/
-orca daemon        # reads /var/lib/orca/orca.db
-orca cert ca-init  # writes CA to /var/lib/orca/
-```
-
-This is the single source of truth for the namespace root. Every
-component that reads or writes on-disk state resolves the root via
-`ORCA_HOME` (falling back to `~/.orca` when unset).
-
-### Use cases
-
-- **Testing**: point `ORCA_HOME` at a temp directory.
-- **Multi-instance**: run multiple orca daemons on the same host with
-  different `ORCA_HOME` values.
-- **Custom layout**: store state on a mounted volume
-  (`ORCA_HOME=/mnt/orca-data`).
-
-## System-Level: `--system` Flag (REQ-042)
-
-The `--system` persistent flag selects the system-level namespace root
-`/root/.orca`. This is intended for root-owned system deployments
-(where orca runs as a system service under root):
-
-```bash
-sudo orca --system init          # creates /root/.orca/
-sudo orca --system daemon        # reads /root/.orca/orca.db
-sudo orca --system cert ca-init  # writes CA to /root/.orca/
-```
-
-The `--system` flag is equivalent to setting `ORCA_HOME=/root/.orca`,
-but it is a CLI convenience that does not require exporting an env var.
-If `ORCA_HOME` is already set to a different value, `--system` returns
-an error (to avoid silent namespace mismatches).
-
-### Path layout
-
-System-level uses the same directory shape as user-level, just under
-`/root/.orca` instead of `~/.orca`:
-
-| Path | Contents |
-|------|----------|
-| `/root/.orca/orca.db` | SQLite database |
-| `/root/.orca/ca.crt` | CA certificate |
-| `/root/.orca/ca.key` | CA private key |
-| `/root/.orca/server.crt` | Server certificate |
-| `/root/.orca/server.key` | Server private key |
-
-## Resolution Order
-
-1. If `--system` flag is passed → root is `/root/.orca` (errors if
-   `ORCA_HOME` is set to a conflicting value).
-2. Else if `ORCA_HOME` is set → root is `$ORCA_HOME`.
-3. Else → root is `~/.orca` (`$HOME/.orca`).
-
-## `ORCA_DB` Override
-
-For finer-grained control, `ORCA_DB` overrides **only** the database
-path (not the cert paths). This is primarily a testing affordance. When
-`ORCA_DB` is set, certs still resolve under `ORCA_HOME` (or `~/.orca`).
-
-```bash
-export ORCA_DB=/tmp/test.db
-orca daemon   # uses /tmp/test.db for the DB, ~/.orca/ for certs
-```
-
-## See Also
-
-- [Install Guide](install.md) — 1-liner install with `install.sh`.
-- [Docker Guide](docker.md) — running orca in a container (uses
-  `ORCA_HOME=/var/lib/orca` inside the image).

go.mod

@@ -6,7 +6,6 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/spf13/cobra v1.8.1
-	golang.org/x/crypto v0.54.0
 	modernc.org/sqlite v1.51.0
 )
 
@@ -22,11 +21,11 @@ require (
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/zclconf/go-cty v1.16.3 // indirect
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
+	golang.org/x/tools v0.42.0 // indirect
 	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

go.sum

@@ -38,21 +38,17 @@ github.com/zclconf/go-cty v1.16.3 h1:osr++gw2T61A8KVYHoQiFbFd1Lh3JOCXc/jFLJXKTxk
 github.com/zclconf/go-cty v1.16.3/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
+golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=

internal/audit/audit_test.go

@@ -1,140 +0,0 @@
-package audit
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"log/slog"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"git.cloudinit.dev/coreci/orca/internal/engine"
-	"git.cloudinit.dev/coreci/orca/internal/store"
-)
-
-func newTestAudit(t *testing.T) (*Audit, *store.AuditRepo, func()) {
-	t.Helper()
-	path := filepath.Join(t.TempDir(), "test.db")
-	db, err := store.Open(path)
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	repo := store.NewAuditRepo(db)
-	eng := engine.NewAudit(repo, nil)
-	return New(eng), repo, func() { _ = db.Close() }
-}
-
-func TestAudit_Emit(t *testing.T) {
-	a, repo, cleanup := newTestAudit(t)
-	defer cleanup()
-	ctx := context.Background()
-	a.Emit(ctx, ActionCertIssued, "cert:node-1", ResultSuccess, map[string]any{"cn": "node-1"})
-
-	entries, err := repo.List(ctx, 10)
-	if err != nil {
-		t.Fatalf("List: %v", err)
-	}
-	if len(entries) != 1 {
-		t.Fatalf("expected 1 audit entry, got %d", len(entries))
-	}
-	e := entries[0]
-	if e.Action != string(ActionCertIssued) {
-		t.Errorf("action: got %q, want %q", e.Action, ActionCertIssued)
-	}
-	if e.Result != string(ResultSuccess) {
-		t.Errorf("result: got %q, want %q", e.Result, ResultSuccess)
-	}
-	if e.Resource != "cert:node-1" {
-		t.Errorf("resource: got %q, want cert:node-1", e.Resource)
-	}
-	if e.Actor != "security" {
-		t.Errorf("actor: got %q, want security", e.Actor)
-	}
-	if e.Error != "" {
-		t.Errorf("error: got %q, want empty", e.Error)
-	}
-}
-
-func TestAudit_EmitWithErr(t *testing.T) {
-	a, repo, cleanup := newTestAudit(t)
-	defer cleanup()
-	ctx := context.Background()
-	a.EmitWithErr(ctx, ActionNodeHandshakeFail, "hs:node-2", errors.New("bad cert"), nil)
-
-	entries, err := repo.List(ctx, 10)
-	if err != nil {
-		t.Fatalf("List: %v", err)
-	}
-	if len(entries) != 1 {
-		t.Fatalf("expected 1 audit entry, got %d", len(entries))
-	}
-	e := entries[0]
-	if e.Result != string(ResultFailure) {
-		t.Errorf("result: got %q, want %q", e.Result, ResultFailure)
-	}
-	if !strings.Contains(e.Error, "bad cert") {
-		t.Errorf("error: got %q, want it to contain 'bad cert'", e.Error)
-	}
-}
-
-func TestAudit_LogHandshakeOK(t *testing.T) {
-	var buf bytes.Buffer
-	logger := slog.New(slog.NewTextHandler(&buf, nil))
-	LogHandshakeOK(logger, "peer-1", "AA:BB:CC")
-	out := buf.String()
-	for _, want := range []string{"event=mtls.handshake", "result=ok", "peer=peer-1", "cert_fp=AA:BB:CC"} {
-		if !strings.Contains(out, want) {
-			t.Errorf("LogHandshakeOK: output missing %q\noutput: %s", want, out)
-		}
-	}
-}
-
-func TestAudit_LogHandshakeFailed(t *testing.T) {
-	var buf bytes.Buffer
-	logger := slog.New(slog.NewTextHandler(&buf, nil))
-	LogHandshakeFailed(logger, "peer-2", "", errors.New("tls: handshake"))
-	out := buf.String()
-	for _, want := range []string{"event=mtls.handshake", "result=failed", "peer=peer-2", "err=\"tls: handshake\""} {
-		if !strings.Contains(out, want) {
-			t.Errorf("LogHandshakeFailed: output missing %q\noutput: %s", want, out)
-		}
-	}
-}
-
-func TestAudit_LogHandshake_NilLogger(t *testing.T) {
-	LogHandshakeOK(nil, "p", "fp")
-	LogHandshakeFailed(nil, "p", "fp", errors.New("x"))
-}
-
-func TestAudit_NilSafe(t *testing.T) {
-	var a *Audit
-	a.Emit(context.Background(), ActionCertIssued, "x", ResultSuccess, nil)
-	a.EmitWithErr(context.Background(), ActionCertIssued, "x", errors.New("y"), nil)
-}
-
-func TestAction_String(t *testing.T) {
-	if got := ActionCertIssued.String(); got != "cert.issued" {
-		t.Errorf("ActionCertIssued.String(): got %q, want cert.issued", got)
-	}
-	if got := ActionNodeHandshakeOK.String(); got != "node.handshake_ok" {
-		t.Errorf("ActionNodeHandshakeOK.String(): got %q, want node.handshake_ok", got)
-	}
-}
-
-func TestResult_String(t *testing.T) {
-	if got := ResultSuccess.String(); got != "success" {
-		t.Errorf("ResultSuccess.String(): got %q, want success", got)
-	}
-	if got := ResultFailure.String(); got != "failure" {
-		t.Errorf("ResultFailure.String(): got %q, want failure", got)
-	}
-}
-
-func TestFormatAction(t *testing.T) {
-	got := FormatAction(ActionCertIssued, ResultSuccess)
-	want := "action=cert.issued result=success"
-	if got != want {
-		t.Errorf("FormatAction: got %q, want %q", got, want)
-	}
-}

internal/certpaths/certpaths.go

@@ -36,29 +36,3 @@ func ServerCertPath() string { return filepath.Join(Dir(), "server.crt") }
 
 // ServerKeyPath returns the path to server.key.
 func ServerKeyPath() string { return filepath.Join(Dir(), "server.key") }
-
-// DBPath returns the path to the orca SQLite database. Honors $ORCA_DB
-// for testability and explicit override; otherwise defaults to
-// ~/.orca/orca.db under the same Dir() as the cert files.
-func DBPath() string {
-	if p := os.Getenv("ORCA_DB"); p != "" {
-		return p
-	}
-	return filepath.Join(Dir(), "orca.db")
-}
-
-// SSHKeyPath returns the path to the orca SSH private key (Ed25519,
-// D-037). Used by `orca node join --type proxmox` to authenticate
-// to remote Proxmox hosts after the initial password-based bootstrap.
-// File mode 0600 (enforced by security.WriteKey).
-func SSHKeyPath() string { return filepath.Join(Dir(), "orca_ssh_key") }
-
-// SSHPubPath returns the path to the orca SSH public key (authorized_keys
-// format). Deployed to remote Proxmox hosts during `orca node join`.
-// File mode 0644 (enforced by security.WriteCert).
-func SSHPubPath() string { return filepath.Join(Dir(), "orca_ssh_key.pub") }
-
-// KnownHostsPath returns the path to the SSH known_hosts file used for
-// TOFU host-key pinning (D-035). Captured on first connect, verified
-// on all subsequent connects via golang.org/x/crypto/ssh/knownhosts.
-func KnownHostsPath() string { return filepath.Join(Dir(), "known_hosts") }

internal/certpaths/certpaths_test.go

@@ -1,157 +0,0 @@
-package certpaths
-
-import (
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-)
-
-func TestPaths_HonorORCAHOME(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	// Ensure ORCA_DB doesn't leak from the environment / prior tests.
-	t.Setenv("ORCA_DB", "")
-
-	cases := []struct {
-		name string
-		got  string
-		file string
-	}{
-		{"CACertPath", CACertPath(), "ca.crt"},
-		{"CAKeyPath", CAKeyPath(), "ca.key"},
-		{"ServerCertPath", ServerCertPath(), "server.crt"},
-		{"ServerKeyPath", ServerKeyPath(), "server.key"},
-		{"SSHKeyPath", SSHKeyPath(), "orca_ssh_key"},
-		{"SSHPubPath", SSHPubPath(), "orca_ssh_key.pub"},
-		{"KnownHostsPath", KnownHostsPath(), "known_hosts"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			want := filepath.Join(dir, tc.file)
-			if tc.got != want {
-				t.Errorf("%s = %q, want %q", tc.name, tc.got, want)
-			}
-		})
-	}
-
-	// DBPath defaults to $ORCA_HOME/orca.db.
-	if got, want := DBPath(), filepath.Join(dir, "orca.db"); got != want {
-		t.Errorf("DBPath = %q, want %q", got, want)
-	}
-
-	// Dir() returns ORCA_HOME verbatim.
-	if got, want := Dir(), dir; got != want {
-		t.Errorf("Dir = %q, want %q", got, want)
-	}
-}
-
-func TestDBPath_OrcaDBOverride(t *testing.T) {
-	home := t.TempDir()
-	t.Setenv("ORCA_HOME", home)
-	custom := filepath.Join(t.TempDir(), "custom.db")
-	t.Setenv("ORCA_DB", custom)
-
-	if got := DBPath(); got != custom {
-		t.Errorf("DBPath = %q, want %q (ORCA_DB override)", got, custom)
-	}
-}
-
-func TestDBPath_OrcaDBEmptyStringFallsBackToHome(t *testing.T) {
-	home := t.TempDir()
-	t.Setenv("ORCA_HOME", home)
-	t.Setenv("ORCA_DB", "")
-
-	want := filepath.Join(home, "orca.db")
-	if got := DBPath(); got != want {
-		t.Errorf("DBPath = %q, want %q", got, want)
-	}
-}
-
-func TestDir_DefaultHomeFallback(t *testing.T) {
-	// Unset ORCA_HOME so Dir() falls back to ~/.orca.
-	// We can't reliably mutate the real HOME in a portable way, so just
-	// assert that the returned path ends with the default subdir on the
-	// current OS and is absolute.
-	os.Unsetenv("ORCA_HOME")
-	// Also clear ORCA_DB so DBPath's fallback to Dir() is exercised.
-	os.Unsetenv("ORCA_DB")
-
-	home, err := os.UserHomeDir()
-	if err != nil {
-		t.Skipf("os.UserHomeDir: %v (cannot verify default fallback)", err)
-	}
-	want := filepath.Join(home, defaultCADir)
-	if got := Dir(); got != want {
-		t.Errorf("Dir() default = %q, want %q", got, want)
-	}
-	if got := CACertPath(); got != filepath.Join(want, "ca.crt") {
-		t.Errorf("CACertPath default = %q, want %q", got, filepath.Join(want, "ca.crt"))
-	}
-}
-
-func TestDir_ORCAHOMEEmptyFallsBack(t *testing.T) {
-	// Empty string ORCA_HOME is treated as unset → ~/.orca fallback.
-	t.Setenv("ORCA_HOME", "")
-	home, err := os.UserHomeDir()
-	if err != nil {
-		t.Skipf("os.UserHomeDir: %v", err)
-	}
-	want := filepath.Join(home, defaultCADir)
-	if got := Dir(); got != want {
-		t.Errorf("Dir() with empty ORCA_HOME = %q, want %q", got, want)
-	}
-}
-
-func TestDir_ORCAHOMERelativePath(t *testing.T) {
-	// A relative ORCA_HOME is honored verbatim (no cleaning/absolutizing).
-	t.Setenv("ORCA_HOME", "relative/orca/home")
-	if got, want := Dir(), "relative/orca/home"; got != want {
-		t.Errorf("Dir() relative = %q, want %q", got, want)
-	}
-	// CACertPath joins the relative dir with ca.crt using filepath.Join.
-	if got, want := CACertPath(), filepath.Join("relative/orca/home", "ca.crt"); got != want {
-		t.Errorf("CACertPath relative = %q, want %q", got, want)
-	}
-}
-
-func TestAllPaths_AreConsistentWithDir(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", "")
-
-	// Every *Path() must live under Dir() except DBPath which also does.
-	base := Dir()
-	for _, p := range []string{
-		CACertPath(), CAKeyPath(),
-		ServerCertPath(), ServerKeyPath(),
-		SSHKeyPath(), SSHPubPath(),
-		KnownHostsPath(), DBPath(),
-	} {
-		if !strings.HasPrefix(p, base+string(filepath.Separator)) && p != filepath.Join(base, filepath.Base(p)) {
-			t.Errorf("path %q is not under Dir() %q", p, base)
-		}
-	}
-}
-
-func TestSSHPaths_Filenames(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	if got, want := filepath.Base(SSHKeyPath()), "orca_ssh_key"; got != want {
-		t.Errorf("SSHKeyPath base = %q, want %q", got, want)
-	}
-	if got, want := filepath.Base(SSHPubPath()), "orca_ssh_key.pub"; got != want {
-		t.Errorf("SSHPubPath base = %q, want %q", got, want)
-	}
-	if got, want := filepath.Base(KnownHostsPath()), "known_hosts"; got != want {
-		t.Errorf("KnownHostsPath base = %q, want %q", got, want)
-	}
-}
-
-func init() {
-	// On Windows the default home subdir is still ".orca"; the test for
-	// default fallback uses os.UserHomeDir which is platform-aware. This
-	// guard keeps the suite from running a meaningless check on plan9.
-	_ = runtime.GOOS
-}

internal/cli/audit_test.go

@@ -1,113 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"git.cloudinit.dev/coreci/orca/internal/certpaths"
-	"git.cloudinit.dev/coreci/orca/internal/store"
-)
-
-func TestAuditListEmpty(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"audit", "list"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("audit list: %v", err)
-	}
-	if !strings.Contains(buf.String(), "No audit entries") {
-		t.Errorf("audit list empty output unexpected: %s", buf.String())
-	}
-}
-
-func TestAuditListJSONEmpty(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"audit", "list", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("audit list --json: %v", err)
-	}
-	var entries []map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &entries); err != nil {
-		t.Fatalf("unmarshal audit json: %v\n%s", err, buf.String())
-	}
-	if len(entries) != 0 {
-		t.Errorf("audit list --json empty = %d entries, want 0", len(entries))
-	}
-}
-
-func TestAuditListWithEntries(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	db, err := store.Open(certpaths.DBPath())
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-	repo := store.NewAuditRepo(db)
-	ctx := t.Context()
-	if err := repo.Append(ctx, &store.AuditEntry{
-		Actor: "test", Action: "test.action", Resource: "res", Result: "success",
-	}); err != nil {
-		t.Fatalf("append audit: %v", err)
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"audit", "list"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("audit list: %v", err)
-	}
-	out := buf.String()
-	if !strings.Contains(out, "test.action") {
-		t.Errorf("audit list missing entry: %s", out)
-	}
-	if !strings.Contains(out, "TIMESTAMP") {
-		t.Errorf("audit list missing header: %s", out)
-	}
-}
-
-func TestAuditListLimitFlag(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	db, err := store.Open(certpaths.DBPath())
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-	repo := store.NewAuditRepo(db)
-	ctx := t.Context()
-	for i := 0; i < 5; i++ {
-		if err := repo.Append(ctx, &store.AuditEntry{
-			Actor: "test", Action: "test.action", Resource: "res", Result: "success",
-		}); err != nil {
-			t.Fatalf("append audit %d: %v", i, err)
-		}
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"audit", "list", "--json", "--limit", "2"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("audit list --json --limit 2: %v", err)
-	}
-	var entries []map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &entries); err != nil {
-		t.Fatalf("unmarshal audit json: %v\n%s", err, buf.String())
-	}
-	if len(entries) != 2 {
-		t.Errorf("audit list --limit 2 = %d entries, want 2", len(entries))
-	}
-}

internal/cli/cert.go

@@ -253,7 +253,3 @@ func parseFirstCertDER(pemBytes []byte) []byte {
 	}
 	return block.Bytes
 }
-
-func init() {
-	rootCmd.AddCommand(NewCommand(slog.Default()))
-}

internal/cli/cert_smoke_test.go

@@ -1,121 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func runCertArgs(t *testing.T, args []string) (string, error) {
-	t.Helper()
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs(args)
-	defer func() {
-		rootCmd.SetArgs(nil)
-		rootCmd.SetOut(os.Stdout)
-		rootCmd.SetErr(os.Stderr)
-	}()
-	err := rootCmd.Execute()
-	return buf.String(), err
-}
-
-func TestCertSmoke(t *testing.T) {
-	t.Setenv("ORCA_HOME", t.TempDir())
-
-	t.Run("ca-init", func(t *testing.T) {
-		out, err := runCertArgs(t, []string{"cert", "ca-init", "--cn", "test-ca"})
-		if err != nil {
-			t.Fatalf("ca-init: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "CA initialized") {
-			t.Errorf("ca-init output unexpected: %s", out)
-		}
-	})
-
-	t.Run("gen", func(t *testing.T) {
-		out, err := runCertArgs(t, []string{"cert", "gen", "--cn", "test-server", "--san", "localhost", "--san", "127.0.0.1"})
-		if err != nil {
-			t.Fatalf("gen: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "Server cert generated") {
-			t.Errorf("gen output unexpected: %s", out)
-		}
-	})
-
-	t.Run("show", func(t *testing.T) {
-		out, err := runCertArgs(t, []string{"cert", "show"})
-		if err != nil {
-			t.Fatalf("show: %v\n%s", err, out)
-		}
-		if strings.Contains(out, "PRIVATE KEY") {
-			t.Errorf("show leaked private key material (REQ-035):\n%s", out)
-		}
-	})
-
-	t.Run("fingerprint_ca", func(t *testing.T) {
-		out, err := runCertArgs(t, []string{"cert", "fingerprint", "--which", "ca"})
-		if err != nil {
-			t.Fatalf("fingerprint ca: %v\n%s", err, out)
-		}
-		fp := strings.TrimSpace(out)
-		if len(fp) != 64 || !isHex(fp) {
-			t.Errorf("ca fingerprint = %q, want 64 hex chars", fp)
-		}
-	})
-
-	t.Run("fingerprint_server", func(t *testing.T) {
-		out, err := runCertArgs(t, []string{"cert", "fingerprint", "--which", "server"})
-		if err != nil {
-			t.Fatalf("fingerprint server: %v\n%s", err, out)
-		}
-		fp := strings.TrimSpace(out)
-		if len(fp) != 64 || !isHex(fp) {
-			t.Errorf("server fingerprint = %q, want 64 hex chars", fp)
-		}
-	})
-
-	t.Run("renew", func(t *testing.T) {
-		out, err := runCertArgs(t, []string{"cert", "renew"})
-		if err != nil {
-			t.Fatalf("renew: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "rotated") {
-			t.Errorf("renew output unexpected: %s", out)
-		}
-	})
-
-	t.Run("file_modes", func(t *testing.T) {
-		dir := os.Getenv("ORCA_HOME")
-		checks := []struct {
-			path string
-			want os.FileMode
-		}{
-			{"ca.crt", 0o644},
-			{"ca.key", 0o600},
-			{"server.crt", 0o644},
-			{"server.key", 0o600},
-		}
-		for _, c := range checks {
-			info, err := os.Stat(filepath.Join(dir, c.path))
-			if err != nil {
-				t.Fatalf("stat %s: %v", c.path, err)
-			}
-			if got := info.Mode().Perm(); got != c.want {
-				t.Errorf("mode %s = %04o, want %04o (REQ-033)", c.path, got, c.want)
-			}
-		}
-	})
-}
-
-func isHex(s string) bool {
-	for _, r := range s {
-		if !((r >= '0' && r <= '9') || (r >= 'a' && r <= 'f') || (r >= 'A' && r <= 'F')) {
-			return false
-		}
-	}
-	return true
-}

internal/cli/cert_test.go

@@ -1,37 +0,0 @@
-package cli
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestCertCommandRegistered(t *testing.T) {
-	found := false
-	for _, cmd := range rootCmd.Commands() {
-		if strings.Fields(cmd.Use)[0] == "cert" {
-			found = true
-			break
-		}
-	}
-	if !found {
-		t.Fatal("cert command not registered on rootCmd")
-	}
-}
-
-func TestCertSubcommands(t *testing.T) {
-	expected := []string{"ca-init", "gen", "show", "renew", "fingerprint"}
-	registered := make(map[string]bool)
-	for _, cmd := range rootCmd.Commands() {
-		if strings.Fields(cmd.Use)[0] != "cert" {
-			continue
-		}
-		for _, sub := range cmd.Commands() {
-			registered[strings.Fields(sub.Use)[0]] = true
-		}
-	}
-	for _, name := range expected {
-		if !registered[name] {
-			t.Errorf("expected cert subcommand %q not registered", name)
-		}
-	}
-}

internal/cli/daemon.go

@@ -20,7 +20,6 @@ import (
 
 var (
 	daemonAddr string
-	pprofAddr  string
 )
 
 var daemonCmd = &cobra.Command{
@@ -35,16 +34,11 @@ var daemonCmd = &cobra.Command{
 		defer closer()
 
 		log := newLogger()
-		addr := daemonAddr
-		if cfg := configFromCtx(cmd.Context()); cfg != nil && cfg.ListenAddr != "" && !cmd.Flags().Changed("addr") {
-			addr = cfg.ListenAddr
-		}
 		srv := daemon.NewServer(daemon.Options{
-			DB:        db,
-			Log:       log,
-			Addr:      addr,
-			Actor:     "daemon",
-			PprofAddr: pprofAddr,
+			DB:    db,
+			Log:   log,
+			Addr:  daemonAddr,
+			Actor: "daemon",
 		})
 
 		// Wire the orca.v1.Dispatch service (v0.2 P02). The executor
@@ -73,9 +67,6 @@ var daemonCmd = &cobra.Command{
 		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/tasks                       - list tasks")
 		fmt.Fprintln(cmd.OutOrStdout(), "  /orca.v1.Dispatch/Submit        - cross-node job submit (P02)")
 		fmt.Fprintln(cmd.OutOrStdout(), "  /orca.v1.Dispatch/Status        - cross-node job status (P02)")
-		if pprofAddr != "" {
-			fmt.Fprintf(cmd.OutOrStdout(), "  /debug/pprof/ (pprof)        - %s\n", pprofAddr)
-		}
 		fmt.Fprintln(cmd.OutOrStdout(), "  press Ctrl+C to stop")
 
 		ctx, stop := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM)
@@ -95,7 +86,6 @@ var daemonCmd = &cobra.Command{
 
 func init() {
 	daemonCmd.Flags().StringVar(&daemonAddr, "addr", ":8080", "listen address")
-	daemonCmd.Flags().StringVar(&pprofAddr, "pprof", "", "enable pprof endpoint on <addr> (e.g. :6060); unauthenticated, operator-only")
 	rootCmd.AddCommand(daemonCmd)
 	_ = slog.Default // keep import if unused above
 }

internal/cli/daemon_test.go

@@ -1,13 +0,0 @@
-package cli
-
-import "testing"
-
-func TestDaemonPprofFlag(t *testing.T) {
-	f := daemonCmd.Flags().Lookup("pprof")
-	if f == nil {
-		t.Fatal("--pprof flag not registered on daemonCmd")
-	}
-	if f.DefValue != "" {
-		t.Errorf("--pprof default = %q, want empty", f.DefValue)
-	}
-}

internal/cli/doctor.go

@@ -51,7 +51,7 @@ var doctorNetworkCmd = &cobra.Command{
 	Use:   "network",
 	Short: "Run the network self-check (P02 impl)",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		c := doctor.Network()
+		c := doctor.NetworkStub()
 		r, msg := c.Run(cmd.Context())
 		fmt.Fprintf(cmd.OutOrStdout(), "%-20s %-5s  %s\n", c.Name, r, msg)
 		return nil
@@ -62,42 +62,14 @@ var doctorDBCmd = &cobra.Command{
 	Use:   "db",
 	Short: "Run the database self-check (P02 impl)",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		c := doctor.DB()
+		c := doctor.DBStub()
 		r, msg := c.Run(cmd.Context())
 		fmt.Fprintf(cmd.OutOrStdout(), "%-20s %-5s  %s\n", c.Name, r, msg)
 		return nil
 	},
 }
 
-var doctorOSCmd = &cobra.Command{
-	Use:   "os",
-	Short: "Run the OS detection self-check (v0.6 P03)",
-	RunE: func(cmd *cobra.Command, args []string) error {
-		c := doctor.OS()
-		r, msg := c.Run(cmd.Context())
-		if jsonOutput {
-			return printJSON(doctor.CheckResult{Name: c.Name, Result: r, Message: msg})
-		}
-		fmt.Fprintf(cmd.OutOrStdout(), "%-20s %-5s  %s\n", c.Name, r, msg)
-		return nil
-	},
-}
-
-var doctorProxmoxCmd = &cobra.Command{
-	Use:   "proxmox",
-	Short: "Run the proxmox node reachability self-check (v0.6 P03)",
-	RunE: func(cmd *cobra.Command, args []string) error {
-		c := doctor.Proxmox()
-		r, msg := c.Run(cmd.Context())
-		if jsonOutput {
-			return printJSON(doctor.CheckResult{Name: c.Name, Result: r, Message: msg})
-		}
-		fmt.Fprintf(cmd.OutOrStdout(), "%-20s %-5s  %s\n", c.Name, r, msg)
-		return nil
-	},
-}
-
 func init() {
-	doctorCmd.AddCommand(doctorCertCmd, doctorNetworkCmd, doctorDBCmd, doctorOSCmd, doctorProxmoxCmd)
+	doctorCmd.AddCommand(doctorCertCmd, doctorNetworkCmd, doctorDBCmd)
 	rootCmd.AddCommand(doctorCmd)
 }

internal/cli/doctor_test.go

@@ -1,196 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-func TestDoctorText(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	if err := runInit(discardWriter{}); err != nil {
-		t.Fatalf("init: %v", err)
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"doctor"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("doctor: %v", err)
-	}
-	out := buf.String()
-	for _, want := range []string{"CA", "cert", "PASS", "WARN", "FAIL"} {
-		_ = want
-	}
-	if !strings.Contains(out, "CA") {
-		t.Errorf("doctor output missing CA check: %s", out)
-	}
-}
-
-func TestDoctorJSON(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	if err := runInit(discardWriter{}); err != nil {
-		t.Fatalf("init: %v", err)
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"doctor", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("doctor --json: %v", err)
-	}
-	var checks []map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &checks); err != nil {
-		t.Fatalf("unmarshal doctor json: %v\n%s", err, buf.String())
-	}
-	if len(checks) == 0 {
-		t.Errorf("doctor --json returned no checks: %s", buf.String())
-	}
-}
-
-func TestDoctorCertSubcommand(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	if err := runInit(discardWriter{}); err != nil {
-		t.Fatalf("init: %v", err)
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"doctor", "cert"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("doctor cert: %v", err)
-	}
-	out := buf.String()
-	if !strings.Contains(out, "CA") {
-		t.Errorf("doctor cert output missing CA: %s", out)
-	}
-}
-
-func TestDoctorCertJSON(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	if err := runInit(discardWriter{}); err != nil {
-		t.Fatalf("init: %v", err)
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"doctor", "cert", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("doctor cert --json: %v", err)
-	}
-	var results []map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &results); err != nil {
-		t.Fatalf("unmarshal doctor cert json: %v\n%s", err, buf.String())
-	}
-	if len(results) == 0 {
-		t.Errorf("doctor cert --json returned no results: %s", buf.String())
-	}
-}
-
-func TestDoctorDBSubcommand(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	if err := runInit(discardWriter{}); err != nil {
-		t.Fatalf("init: %v", err)
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"doctor", "db"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("doctor db: %v", err)
-	}
-	out := buf.String()
-	if !strings.Contains(out, "db") {
-		t.Errorf("doctor db output unexpected: %s", out)
-	}
-}
-
-func TestDoctorOSSubcommand(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	if err := runInit(discardWriter{}); err != nil {
-		t.Fatalf("init: %v", err)
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"doctor", "os"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("doctor os: %v", err)
-	}
-}
-
-func TestDoctorOSJSON(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	if err := runInit(discardWriter{}); err != nil {
-		t.Fatalf("init: %v", err)
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"doctor", "os", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("doctor os --json: %v", err)
-	}
-	var result map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
-		t.Fatalf("unmarshal doctor os json: %v\n%s", err, buf.String())
-	}
-	if result["Name"] == nil {
-		t.Errorf("doctor os --json missing Name: %v", result)
-	}
-}
-
-func TestDoctorNetworkSubcommand(t *testing.T) {
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"doctor", "network"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("doctor network: %v", err)
-	}
-}
-
-func TestDoctorProxmoxSubcommand(t *testing.T) {
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"doctor", "proxmox"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("doctor proxmox: %v", err)
-	}
-}
-
-func TestDoctorProxmoxJSON(t *testing.T) {
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"doctor", "proxmox", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("doctor proxmox --json: %v", err)
-	}
-	var result map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
-		t.Fatalf("unmarshal doctor proxmox json: %v\n%s", err, buf.String())
-	}
-	if result["Name"] == nil {
-		t.Errorf("doctor proxmox --json missing Name: %v", result)
-	}
-}

internal/cli/init.go

@@ -1,194 +1,38 @@
 package cli
 
 import (
-	"context"
 	"fmt"
 	"os"
-	"time"
+	"path/filepath"
 
-	"github.com/google/uuid"
 	"github.com/spf13/cobra"
-
-	"git.cloudinit.dev/coreci/orca/internal/certpaths"
-	"git.cloudinit.dev/coreci/orca/internal/model"
-	"git.cloudinit.dev/coreci/orca/internal/security"
-	"git.cloudinit.dev/coreci/orca/internal/store"
-)
-
-const (
-	initCAN       = "orca-internal-ca"
-	localhostName = "localhost"
-	localhostAddr = "localhost:8443"
 )
 
 var initCmd = &cobra.Command{
 	Use:   "init",
-	Short: "Initialize local orca state with full bootstrap",
-	Long: `Initialize the local orca state directory and provision all
-dependencies required for ` + "`orca doctor`" + ` to pass:
-
-  1. Create the namespace directory (honors $ORCA_HOME; defaults to ~/.orca)
-  2. Open and migrate the SQLite database (migrations 0001..0006)
-  3. Bootstrap the internal CA (ca.crt + ca.key) if not already present
-  4. Generate the server cert (server.crt + server.key) if not already present
-  5. Auto-detect the local OS via /etc/os-release
-  6. Register a localhost node (kind=localhost, os=<detected>)
-
-Idempotent: re-running is safe and will refresh last_seen + os on the
-localhost node without regenerating certs or changing the node ID.`,
+	Short: "Initialize local orca state directory",
+	Long:  "Create the local orca state directory at ~/.orca/ and write a default config file.",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		return runInit(cmd.OutOrStdout())
+		home, err := os.UserHomeDir()
+		if err != nil {
+			return fmt.Errorf("get home dir: %w", err)
+		}
+		orcaDir := filepath.Join(home, ".orca")
+		if err := os.MkdirAll(orcaDir, 0o755); err != nil {
+			return fmt.Errorf("create orca dir: %w", err)
+		}
+		result := map[string]string{
+			"path":   orcaDir,
+			"status": "initialized",
+		}
+		if jsonOutput {
+			return printJSON(result)
+		}
+		printText("✓ Initialized orca state at %s\n", orcaDir)
+		return nil
 	},
 }
 
-func runInit(out interface{ Write([]byte) (int, error) }) error {
-	dir := certpaths.Dir()
-
-	type stepResult struct {
-		Label  string `json:"label"`
-		Status string `json:"status"`
-		Detail string `json:"detail,omitempty"`
-	}
-	type initSummary struct {
-		Namespace       string       `json:"namespace"`
-		Database        string       `json:"database"`
-		CAFingerprint   string       `json:"ca_fingerprint,omitempty"`
-		CertFingerprint string       `json:"cert_fingerprint,omitempty"`
-		OS              string       `json:"os"`
-		NodeID          string       `json:"node_id"`
-		NodeName        string       `json:"node_name"`
-		Steps           []stepResult `json:"steps"`
-	}
-	summary := initSummary{Namespace: dir}
-
-	// Step 1: namespace dir.
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return fmt.Errorf("create orca dir: %w", err)
-	}
-	summary.Steps = append(summary.Steps, stepResult{Label: "namespace", Status: "ok", Detail: dir})
-	if !jsonOutput {
-		fmt.Fprintf(out, "✓ Namespace dir: %s\n", dir)
-	}
-
-	// Step 2: database + migrations.
-	dbPath := certpaths.DBPath()
-	db, err := store.Open(dbPath)
-	if err != nil {
-		return fmt.Errorf("open database: %w", err)
-	}
-	defer db.Close()
-	summary.Database = dbPath
-	summary.Steps = append(summary.Steps, stepResult{Label: "database", Status: "ok", Detail: dbPath})
-	if !jsonOutput {
-		fmt.Fprintf(out, "✓ Database initialized: %s\n", dbPath)
-	}
-
-	// Step 3: CA bootstrap (idempotent — CAInit has a fast-path).
-	ca, err := security.CAInit(dir, initCAN)
-	if err != nil {
-		return fmt.Errorf("bootstrap CA: %w", err)
-	}
-	caFp := ca.Fingerprint()
-	summary.CAFingerprint = caFp
-	summary.Steps = append(summary.Steps, stepResult{Label: "ca", Status: "ok", Detail: caFp[:16] + "..."})
-	if !jsonOutput {
-		fmt.Fprintf(out, "✓ CA provisioned: fp=%s\n", caFp[:16]+"...")
-	}
-
-	// Step 4: server cert (only if absent — D-036 idempotency).
-	certPath := certpaths.ServerCertPath()
-	certFp := ""
-	if _, err := os.Stat(certPath); err == nil {
-		// Already exists — load fingerprint for the summary.
-		if fp, err := security.Fingerprint(certPath); err == nil {
-			certFp = fp
-		}
-		summary.Steps = append(summary.Steps, stepResult{Label: "server-cert", Status: "skipped", Detail: "already present"})
-	} else if os.IsNotExist(err) {
-		keyPEM, csrPEM, err := security.GenerateCSR("localhost", []string{"localhost", "127.0.0.1"})
-		if err != nil {
-			return fmt.Errorf("generate server CSR: %w", err)
-		}
-		certPEM, err := ca.SignCSR(csrPEM)
-		if err != nil {
-			return fmt.Errorf("sign server CSR: %w", err)
-		}
-		if err := security.WriteCert(certPath, certPEM); err != nil {
-			return fmt.Errorf("write server cert: %w", err)
-		}
-		if err := security.WriteKey(certpaths.ServerKeyPath(), keyPEM); err != nil {
-			return fmt.Errorf("write server key: %w", err)
-		}
-		certFp = security.FingerprintOf(parseFirstCertDER(certPEM))
-		summary.Steps = append(summary.Steps, stepResult{Label: "server-cert", Status: "ok", Detail: certFp[:16] + "..."})
-	} else {
-		return fmt.Errorf("stat server cert: %w", err)
-	}
-	summary.CertFingerprint = certFp
-	if !jsonOutput {
-		if certFp != "" {
-			fmt.Fprintf(out, "✓ Server cert provisioned: fp=%s\n", certFp[:16]+"...")
-		} else {
-			fmt.Fprintf(out, "✓ Server cert: already present\n")
-		}
-	}
-
-	// Step 5: OS detection.
-	osDetected := detectOS()
-	summary.OS = osDetected
-	summary.Steps = append(summary.Steps, stepResult{Label: "os", Status: "ok", Detail: osDetected})
-	if !jsonOutput {
-		fmt.Fprintf(out, "✓ OS detected: %s\n", osDetected)
-	}
-
-	// Step 6: localhost node upsert (idempotent per D-036).
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	repo := store.NewNodeRepo(db)
-	existing, err := repo.GetByName(ctx, localhostName)
-	if err == nil {
-		// Refresh last_seen + os; keep id and joined_at.
-		if err := repo.UpdateLastSeenAndOS(ctx, existing.ID, osDetected); err != nil {
-			return fmt.Errorf("refresh localhost node: %w", err)
-		}
-		summary.NodeID = existing.ID
-		summary.NodeName = existing.Name
-		summary.Steps = append(summary.Steps, stepResult{Label: "localhost-node", Status: "refreshed", Detail: existing.ID})
-		if !jsonOutput {
-			fmt.Fprintf(out, "✓ Localhost node refreshed: %s (os=%s)\n", existing.ID, osDetected)
-		}
-	} else if err == store.ErrNotFound {
-		node := &model.Node{
-			ID:       uuid.NewString(),
-			Name:     localhostName,
-			Address:  localhostAddr,
-			State:    model.NodeStateReady,
-			JoinedAt: time.Now().UTC(),
-			LastSeen: time.Now().UTC(),
-			Kind:     string(model.NodeKindLocalhost),
-			OS:       osDetected,
-		}
-		if err := repo.Insert(ctx, node); err != nil {
-			return fmt.Errorf("insert localhost node: %w", err)
-		}
-		summary.NodeID = node.ID
-		summary.NodeName = node.Name
-		summary.Steps = append(summary.Steps, stepResult{Label: "localhost-node", Status: "ok", Detail: node.ID})
-		if !jsonOutput {
-			fmt.Fprintf(out, "✓ Localhost node registered: %s (os=%s)\n", node.ID, osDetected)
-		}
-	} else {
-		return fmt.Errorf("lookup localhost node: %w", err)
-	}
-
-	if jsonOutput {
-		return printJSON(summary)
-	}
-	fmt.Fprintf(out, "\n✓ orca init complete — run `orca doctor` to verify.\n")
-	return nil
-}
-
 func init() {
 	rootCmd.AddCommand(initCmd)
 }

internal/cli/init_test.go

@@ -1,205 +0,0 @@
-package cli
-
-import (
-	"context"
-	"io"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"git.cloudinit.dev/coreci/orca/internal/certpaths"
-	"git.cloudinit.dev/coreci/orca/internal/model"
-	"git.cloudinit.dev/coreci/orca/internal/store"
-)
-
-// initTestEnv sets ORCA_HOME to a temp dir and returns a cleanup func.
-func initTestEnv(t *testing.T) (string, func()) {
-	t.Helper()
-	dir := t.TempDir()
-	orig := os.Getenv("ORCA_HOME")
-	if err := os.Setenv("ORCA_HOME", dir); err != nil {
-		t.Fatalf("set ORCA_HOME: %v", err)
-	}
-	return dir, func() {
-		if err := os.Setenv("ORCA_HOME", orig); err != nil {
-			t.Fatalf("restore ORCA_HOME: %v", err)
-		}
-	}
-}
-
-// discardWriter is an io.Writer that discards all output (for tests
-// that don't need to inspect init stdout).
-type discardWriter struct{}
-
-func (discardWriter) Write(p []byte) (int, error) { return len(p), nil }
-
-var _ io.Writer = discardWriter{}
-
-func TestInit_FullBootstrap(t *testing.T) {
-	dir, cleanup := initTestEnv(t)
-	defer cleanup()
-
-	if err := runInit(discardWriter{}); err != nil {
-		t.Fatalf("init: %v", err)
-	}
-
-	// Verify namespace dir exists.
-	if _, err := os.Stat(dir); err != nil {
-		t.Errorf("namespace dir missing: %v", err)
-	}
-
-	// Verify CA files exist with correct modes.
-	caCert := certpaths.CACertPath()
-	caKey := certpaths.CAKeyPath()
-	if _, err := os.Stat(caCert); err != nil {
-		t.Errorf("ca.crt missing: %v", err)
-	}
-	if info, err := os.Stat(caKey); err == nil {
-		if info.Mode().Perm() != 0o600 {
-			t.Errorf("ca.key mode = %04o, want 0600", info.Mode().Perm())
-		}
-	} else {
-		t.Errorf("ca.key missing: %v", err)
-	}
-
-	// Verify server cert exists.
-	if _, err := os.Stat(certpaths.ServerCertPath()); err != nil {
-		t.Errorf("server.crt missing: %v", err)
-	}
-
-	// Verify DB exists and has migrations applied.
-	db, err := store.Open(certpaths.DBPath())
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-
-	ctx := context.Background()
-	version, err := store.MigrationVersion(ctx, db)
-	if err != nil {
-		t.Fatalf("migration version: %v", err)
-	}
-	if version != "0007_certs_serial_unique.sql" {
-		t.Errorf("migration version = %q, want 0007_certs_serial_unique.sql", version)
-	}
-
-	// Verify localhost node registered with kind=localhost.
-	repo := store.NewNodeRepo(db)
-	node, err := repo.GetByName(ctx, "localhost")
-	if err != nil {
-		t.Fatalf("get localhost node: %v", err)
-	}
-	if node.Kind != string(model.NodeKindLocalhost) {
-		t.Errorf("node kind = %q, want localhost", node.Kind)
-	}
-	if node.OS == "" {
-		t.Errorf("node os is empty, expected detected value")
-	}
-	if node.Address != "localhost:8443" {
-		t.Errorf("node address = %q, want localhost:8443", node.Address)
-	}
-}
-
-func TestInit_IdempotentReRun(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-
-	// First init.
-	if err := runInit(discardWriter{}); err != nil {
-		t.Fatalf("first init: %v", err)
-	}
-
-	// Capture first-run state.
-	caCertBefore, _ := os.ReadFile(certpaths.CACertPath())
-	serverCertBefore, _ := os.ReadFile(certpaths.ServerCertPath())
-
-	db, err := store.Open(certpaths.DBPath())
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	repo := store.NewNodeRepo(db)
-	ctx := context.Background()
-	nodeBefore, err := repo.GetByName(ctx, "localhost")
-	if err != nil {
-		t.Fatalf("get node before: %v", err)
-	}
-	nodeIDBefore := nodeBefore.ID
-	joinedAtBefore := nodeBefore.JoinedAt
-	if err := db.Close(); err != nil {
-		t.Fatalf("close db: %v", err)
-	}
-
-	// Wait a moment so last_seen can differ.
-	time.Sleep(50 * time.Millisecond)
-
-	// Second init (should be idempotent).
-	if err := runInit(discardWriter{}); err != nil {
-		t.Fatalf("second init: %v", err)
-	}
-
-	// CA and server cert must NOT have been regenerated.
-	caCertAfter, _ := os.ReadFile(certpaths.CACertPath())
-	serverCertAfter, _ := os.ReadFile(certpaths.ServerCertPath())
-	if string(caCertBefore) != string(caCertAfter) {
-		t.Error("CA was regenerated on re-run (D-036 violation)")
-	}
-	if string(serverCertBefore) != string(serverCertAfter) {
-		t.Error("server cert was regenerated on re-run (D-036 violation)")
-	}
-
-	// Node ID and joined_at must be unchanged; last_seen should be refreshed.
-	db, err = store.Open(certpaths.DBPath())
-	if err != nil {
-		t.Fatalf("reopen db: %v", err)
-	}
-	defer db.Close()
-	repo = store.NewNodeRepo(db)
-	nodeAfter, err := repo.GetByName(ctx, "localhost")
-	if err != nil {
-		t.Fatalf("get node after: %v", err)
-	}
-	if nodeAfter.ID != nodeIDBefore {
-		t.Errorf("node id changed: was %s, now %s (D-036 violation)", nodeIDBefore, nodeAfter.ID)
-	}
-	if !nodeAfter.JoinedAt.Equal(joinedAtBefore) {
-		t.Errorf("joined_at changed: was %v, now %v (D-036 violation)", joinedAtBefore, nodeAfter.JoinedAt)
-	}
-	if !nodeAfter.LastSeen.After(joinedAtBefore) {
-		t.Errorf("last_seen not refreshed: was %v, now %v", joinedAtBefore, nodeAfter.LastSeen)
-	}
-
-	// No duplicate localhost nodes.
-	nodes, err := repo.List(ctx)
-	if err != nil {
-		t.Fatalf("list nodes: %v", err)
-	}
-	localhostCount := 0
-	for _, n := range nodes {
-		if n.Name == "localhost" {
-			localhostCount++
-		}
-	}
-	if localhostCount != 1 {
-		t.Errorf("found %d localhost nodes, want 1 (idempotency)", localhostCount)
-	}
-}
-
-func TestInit_NamespaceDirCreation(t *testing.T) {
-	dir, cleanup := initTestEnv(t)
-	defer cleanup()
-
-	// The namespace dir is the ORCA_HOME temp dir itself — but let's
-	// point at a non-existent subdir to test MkdirAll.
-	subDir := filepath.Join(dir, "nested", "orca-state")
-	if err := os.Setenv("ORCA_HOME", subDir); err != nil {
-		t.Fatalf("set ORCA_HOME: %v", err)
-	}
-
-	if err := runInit(discardWriter{}); err != nil {
-		t.Fatalf("init with nested dir: %v", err)
-	}
-	if _, err := os.Stat(subDir); err != nil {
-		t.Errorf("nested namespace dir not created: %v", err)
-	}
-}

internal/cli/job_test.go

@@ -1,312 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"git.cloudinit.dev/coreci/orca/internal/certpaths"
-	"git.cloudinit.dev/coreci/orca/internal/model"
-	"git.cloudinit.dev/coreci/orca/internal/store"
-)
-
-func writeJobSpec(t *testing.T, content string) string {
-	t.Helper()
-	dir := t.TempDir()
-	p := filepath.Join(dir, "spec.hcl")
-	if err := os.WriteFile(p, []byte(content), 0o644); err != nil {
-		t.Fatalf("write spec: %v", err)
-	}
-	return p
-}
-
-const trueJobSpec = `job "true" {}
-task "t" {
-  command = "/bin/true"
-}
-`
-
-const falseJobSpec = `job "false" {}
-task "t" {
-  command = "/bin/false"
-}
-`
-
-func TestJobRunComplete(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	spec := writeJobSpec(t, trueJobSpec)
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "run", spec})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("job run: %v", err)
-	}
-	if !strings.Contains(buf.String(), "Job complete") {
-		t.Errorf("job run output unexpected: %s", buf.String())
-	}
-}
-
-func TestJobRunCompleteJSON(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	spec := writeJobSpec(t, trueJobSpec)
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "run", spec, "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("job run --json: %v", err)
-	}
-	var result map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
-		t.Fatalf("unmarshal job run json: %v\n%s", err, buf.String())
-	}
-	if result["status"] != "complete" {
-		t.Errorf("job run --json status = %v, want complete", result["status"])
-	}
-}
-
-func TestJobRunFailed(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	spec := writeJobSpec(t, falseJobSpec)
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "run", spec})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for failing job, got nil")
-	}
-}
-
-func TestJobRunFailedJSON(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	spec := writeJobSpec(t, falseJobSpec)
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "run", spec, "--json"})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for failing job --json, got nil")
-	}
-	if !strings.Contains(buf.String(), "failed") {
-		t.Errorf("job run --json failed output unexpected: %s", buf.String())
-	}
-}
-
-func TestJobRunMissingSpecFile(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "run", "/nonexistent/spec.hcl"})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for missing spec file, got nil")
-	}
-}
-
-func TestJobListEmpty(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "list"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("job list: %v", err)
-	}
-	if !strings.Contains(buf.String(), "No jobs") {
-		t.Errorf("job list empty output unexpected: %s", buf.String())
-	}
-}
-
-func TestJobListJSONEmpty(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "list", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("job list --json: %v", err)
-	}
-	var jobs []map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &jobs); err != nil {
-		t.Fatalf("unmarshal job list json: %v\n%s", err, buf.String())
-	}
-	if len(jobs) != 0 {
-		t.Errorf("job list --json empty = %d jobs, want 0", len(jobs))
-	}
-}
-
-func TestJobListAfterRun(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	spec := writeJobSpec(t, trueJobSpec)
-	resetRootFlags(t)
-	rootCmd.SetArgs([]string{"job", "run", spec})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("job run: %v", err)
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "list"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("job list: %v", err)
-	}
-	out := buf.String()
-	if !strings.Contains(out, "true") {
-		t.Errorf("job list missing job name: %s", out)
-	}
-}
-
-func TestJobStop(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	jobID := seedJob(t, "stopper", model.JobStatusRunning)
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "stop", jobID})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("job stop: %v", err)
-	}
-	if !strings.Contains(buf.String(), "Job stopped") {
-		t.Errorf("job stop output unexpected: %s", buf.String())
-	}
-}
-
-func TestJobStopJSON(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	jobID := seedJob(t, "jsonstopper", model.JobStatusRunning)
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "stop", jobID, "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("job stop --json: %v", err)
-	}
-	var result map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
-		t.Fatalf("unmarshal job stop json: %v\n%s", err, buf.String())
-	}
-	if result["status"] != "stopped" {
-		t.Errorf("job stop --json status = %v, want stopped", result["status"])
-	}
-}
-
-func TestJobStopNotFound(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "stop", "nonexistent-id"})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for job stop not found, got nil")
-	}
-}
-
-func TestJobStopMissingID(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "stop"})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for job stop without id, got nil")
-	}
-}
-
-func TestJobLogsEmpty(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	jobID := seedJob(t, "logger", model.JobStatusComplete)
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "logs", jobID})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("job logs: %v", err)
-	}
-	if !strings.Contains(buf.String(), "No tasks") {
-		t.Errorf("job logs empty output unexpected: %s", buf.String())
-	}
-}
-
-func TestJobLogsJSONEmpty(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	jobID := seedJob(t, "jsonlogger", model.JobStatusComplete)
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "logs", jobID, "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("job logs --json: %v", err)
-	}
-	var tasks []map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &tasks); err != nil {
-		t.Fatalf("unmarshal job logs json: %v\n%s", err, buf.String())
-	}
-	if len(tasks) != 0 {
-		t.Errorf("job logs --json empty = %d tasks, want 0", len(tasks))
-	}
-}
-
-func TestJobLogsMissingID(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"job", "logs"})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for job logs without id, got nil")
-	}
-}
-
-func seedJob(t *testing.T, name string, status model.JobStatus) string {
-	t.Helper()
-	db, err := store.Open(certpaths.DBPath())
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-	repo := store.NewJobRepo(db)
-	j := &model.Job{
-		ID:     "job-" + name,
-		Name:   name,
-		Spec:   "spec.hcl",
-		Status: status,
-	}
-	if err := repo.Insert(t.Context(), j); err != nil {
-		t.Fatalf("insert job: %v", err)
-	}
-	return j.ID
-}

internal/cli/namespace_test.go

@@ -1,143 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"git.cloudinit.dev/coreci/orca/internal/certpaths"
-)
-
-func resetRootFlags(t *testing.T) {
-	t.Helper()
-	rootCmd.SetArgs(nil)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	_ = rootCmd.PersistentFlags().Set("system", "false")
-	_ = rootCmd.PersistentFlags().Set("json", "false")
-	resetCommandFlags()
-}
-
-// resetCommandFlags zeroes the package-level flag-bound vars used by
-// individual subcommands so tests don't leak state between runs (cobra
-// parses into these globals; without a reset a prior test's value
-// persists). resetRootFlags calls this; tests that exercise a single
-// command without resetRootFlags may call it directly.
-func resetCommandFlags() {
-	joinName, joinAddr, joinCAFinger, joinType = "", "", "", "localhost"
-	joinHost, joinSSHUser, joinPassword, proxmoxUser, proxmoxRole = "", "root", "", "orca", "OrcaOperator"
-	joinSSHPort, leaveID, nodeWatch = 22, "", false
-	stopID, runTarget, runIDKey, jobWatch = "", "", "", false
-	capSetCPU, capSetMem, capSetDisk, capNodeID = 0, 0, 0, ""
-	auditLimit = 50
-}
-
-func TestNamespaceDefaultsToUserHome(t *testing.T) {
-	t.Setenv("ORCA_HOME", "")
-	home, err := os.UserHomeDir()
-	if err != nil {
-		t.Fatalf("UserHomeDir: %v", err)
-	}
-	want := filepath.Join(home, ".orca")
-	if got := certpaths.Dir(); got != want {
-		t.Errorf("certpaths.Dir() = %q, want %q", got, want)
-	}
-}
-
-func TestNamespaceHonorsORCAHOME(t *testing.T) {
-	tmp := t.TempDir()
-	t.Setenv("ORCA_HOME", tmp)
-	if got := certpaths.Dir(); got != tmp {
-		t.Errorf("certpaths.Dir() = %q, want %q", got, tmp)
-	}
-	if got := certpaths.DBPath(); got != filepath.Join(tmp, "orca.db") {
-		t.Errorf("certpaths.DBPath() = %q, want %q", got, filepath.Join(tmp, "orca.db"))
-	}
-}
-
-func TestInitHonorsORCAHOME(t *testing.T) {
-	tmp := t.TempDir()
-	t.Setenv("ORCA_HOME", tmp)
-	resetRootFlags(t)
-
-	rootCmd.SetArgs([]string{"init"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("init: %v", err)
-	}
-
-	info, err := os.Stat(tmp)
-	if err != nil {
-		t.Fatalf("stat %s: %v", tmp, err)
-	}
-	if !info.IsDir() {
-		t.Errorf("%s is not a directory", tmp)
-	}
-}
-
-func TestSystemFlagSetsORCAHOME(t *testing.T) {
-	t.Setenv("ORCA_HOME", "")
-	resetRootFlags(t)
-
-	rootCmd.SetArgs([]string{"--system", "init"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("--system init: %v", err)
-	}
-	if got := os.Getenv("ORCA_HOME"); got != systemNamespaceRoot {
-		t.Errorf("ORCA_HOME = %q, want %q", got, systemNamespaceRoot)
-	}
-}
-
-func TestSystemFlagConflictsWithORCAHOME(t *testing.T) {
-	t.Setenv("ORCA_HOME", "/custom/path")
-	resetRootFlags(t)
-
-	rootCmd.SetArgs([]string{"--system", "init"})
-	err := rootCmd.Execute()
-	if err == nil {
-		t.Fatal("expected error for --system + ORCA_HOME conflict, got nil")
-	}
-}
-
-func TestInitJSONOutput(t *testing.T) {
-	tmp := t.TempDir()
-	t.Setenv("ORCA_HOME", tmp)
-	resetRootFlags(t)
-
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetArgs([]string{"init", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("init --json: %v", err)
-	}
-
-	// v0.6: init --json now outputs a full bootstrap summary object.
-	var result map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
-		t.Fatalf("unmarshal init output: %v\noutput: %s", err, buf.String())
-	}
-	if result["namespace"] != tmp {
-		t.Errorf("init --json namespace = %q, want %q", result["namespace"], tmp)
-	}
-	if result["os"] == nil || result["os"] == "" {
-		t.Errorf("init --json os is missing/empty")
-	}
-	if result["node_id"] == nil || result["node_id"] == "" {
-		t.Errorf("init --json node_id is missing/empty")
-	}
-	steps, ok := result["steps"].([]any)
-	if !ok || len(steps) < 6 {
-		t.Errorf("init --json steps: expected 6+ entries, got %v", result["steps"])
-	}
-}
-
-func TestSystemFlagIsPersistent(t *testing.T) {
-	for _, name := range []string{"system", "json"} {
-		f := rootCmd.PersistentFlags().Lookup(name)
-		if f == nil {
-			t.Errorf("persistent flag %q not found", name)
-		}
-	}
-}

internal/cli/node.go

@@ -8,6 +8,7 @@ import (
 	"log/slog"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"syscall"
 	"time"
 
@@ -17,13 +18,20 @@ import (
 	"git.cloudinit.dev/coreci/orca/internal/certpaths"
 	"git.cloudinit.dev/coreci/orca/internal/engine"
 	"git.cloudinit.dev/coreci/orca/internal/model"
-	"git.cloudinit.dev/coreci/orca/internal/proxmox"
 	"git.cloudinit.dev/coreci/orca/internal/security"
 	"git.cloudinit.dev/coreci/orca/internal/store"
 )
 
+func dbPath() string {
+	if p := os.Getenv("ORCA_DB"); p != "" {
+		return p
+	}
+	home, _ := os.UserHomeDir()
+	return filepath.Join(home, ".orca", "orca.db")
+}
+
 func openDB() (*sql.DB, func() error, error) {
-	db, err := store.Open(certpaths.DBPath())
+	db, err := store.Open(dbPath())
 	if err != nil {
 		return nil, nil, err
 	}
@@ -45,19 +53,11 @@ func nodeRegistry() (*engine.NodeRegistry, func() error, error) {
 }
 
 var (
-	joinName      string
-	joinAddr      string
-	joinCAFinger  string
-	joinType      string
-	joinHost      string
-	joinSSHUser   string
-	joinPassword  string
-	joinSSHPort   int
-	joinHostKeyFP string
-	proxmoxUser   string
-	proxmoxRole   string
-	leaveID       string
-	nodeWatch     bool
+	joinName     string
+	joinAddr     string
+	joinCAFinger string
+	leaveID      string
+	nodeWatch    bool
 )
 
 var nodeCmd = &cobra.Command{
@@ -69,145 +69,58 @@ var nodeCmd = &cobra.Command{
 var nodeJoinCmd = &cobra.Command{
 	Use:   "join",
 	Short: "Join a node to the orca registry",
-	Long: `Register a node in the local orca registry. Persisted to SQLite.
-
-Node types (via --type):
-  localhost (default): register a local or Linux node (existing behavior)
-  proxmox:             SSH-bootstrap a remote Proxmox VE 8/9 host
-                       (deploys orca pubkey, creates orca user + PVE role +
-                       sudoers allowlist; requires --host + --password)`,
+	Long:  "Register a node in the local orca registry. Persisted to SQLite.",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		if joinHostKeyFP != "" && joinType != "proxmox" {
-			return fmt.Errorf("--host-key-fingerprint requires --type proxmox today")
+		if joinName == "" {
+			return fmt.Errorf("--name is required")
 		}
-		if joinType == "proxmox" {
-			return joinProxmox(cmd)
+		if joinAddr == "" {
+			joinAddr = "localhost:8443"
 		}
-		return joinLocal(cmd)
-	},
-}
 
-// joinLocal is the existing localhost/Linux node join flow (fingerprint
-// check + registry.Insert).
-func joinLocal(cmd *cobra.Command) error {
-	if joinName == "" {
-		return fmt.Errorf("--name is required")
-	}
-	if joinAddr == "" {
-		joinAddr = "localhost:8443"
-	}
+		// REQ-026: if --ca-fingerprint is set, verify the on-disk CA
+		// matches the pinned value before we touch the registry. This
+		// prevents typos in the operator-supplied fingerprint from
+		// silently degrading to "no pin" and accepting any cert.
+		if joinCAFinger != "" {
+			fp, err := security.Fingerprint(certpaths.CACertPath())
+			if err != nil {
+				return fmt.Errorf("--ca-fingerprint set but local CA is missing: %w (run `orca cert ca-init` first)", err)
+			}
+			if fp != joinCAFinger {
+				return fmt.Errorf(
+					"CA fingerprint mismatch: on-disk=%s, pinned=%s — refusing to join (REQ-026)",
+					fp, joinCAFinger,
+				)
+			}
+		}
 
-	// REQ-026: if --ca-fingerprint is set, verify the on-disk CA
-	// matches the pinned value before we touch the registry. This
-	// prevents typos in the operator-supplied fingerprint from
-	// silently degrading to "no pin" and accepting any cert.
-	if joinCAFinger != "" {
-		fp, err := security.Fingerprint(certpaths.CACertPath())
+		ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
+		defer cancel()
+
+		registry, closer, err := nodeRegistry()
 		if err != nil {
-			return fmt.Errorf("--ca-fingerprint set but local CA is missing: %w (run `orca cert ca-init` first)", err)
+			return err
 		}
-		if fp != joinCAFinger {
-			return fmt.Errorf(
-				"CA fingerprint mismatch: on-disk=%s, pinned=%s — refusing to join (REQ-026)",
-				fp, joinCAFinger,
-			)
+		defer closer()
+
+		node := &model.Node{
+			ID:       uuid.NewString(),
+			Name:     joinName,
+			Address:  joinAddr,
+			State:    model.NodeStateReady,
+			JoinedAt: time.Now().UTC(),
+			LastSeen: time.Now().UTC(),
 		}
-	}
-
-	ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
-	defer cancel()
-
-	registry, closer, err := nodeRegistry()
-	if err != nil {
-		return err
-	}
-	defer closer()
-
-	node := &model.Node{
-		ID:       uuid.NewString(),
-		Name:     joinName,
-		Address:  joinAddr,
-		State:    model.NodeStateReady,
-		JoinedAt: time.Now().UTC(),
-		LastSeen: time.Now().UTC(),
-	}
-	if err := registry.Join(ctx, node); err != nil {
-		return err
-	}
-	if jsonOutput {
-		return printJSON(node)
-	}
-	fmt.Fprintf(cmd.OutOrStdout(), "✓ Node joined: %s (%s) at %s\n", node.ID, node.Name, node.Address)
-	return nil
-}
-
-// joinProxmox bootstraps a remote Proxmox VE 8/9 host via SSH and
-// registers it as an orca node (REQ-050, REQ-051). The password is
-// never persisted (D-031).
-func joinProxmox(cmd *cobra.Command) error {
-	if joinHost == "" {
-		return fmt.Errorf("--host is required for --type proxmox")
-	}
-	password := joinPassword
-	if password == "" {
-		password = os.Getenv("ORCA_PROXMOX_PASSWORD")
-	}
-	if password == "" {
-		return fmt.Errorf("password is required for --type proxmox (use --password or $ORCA_PROXMOX_PASSWORD)")
-	}
-
-	ctx, cancel := context.WithTimeout(cmd.Context(), 60*time.Second)
-	defer cancel()
-
-	result, err := proxmox.BootstrapProxmox(ctx, proxmox.Options{
-		Host:               joinHost,
-		SSHUser:            joinSSHUser,
-		Password:           password,
-		ProxmoxUser:        proxmoxUser,
-		ProxmoxRole:        proxmoxRole,
-		SSHPort:            joinSSHPort,
-		HostKeyFingerprint: joinHostKeyFP,
-		Logger:             newLogger(),
-	})
-	if err != nil {
-		return fmt.Errorf("proxmox bootstrap: %w", err)
-	}
-
-	// Zero the password byte slice (D-031 — never persist, minimize memory exposure).
-	pwBytes := []byte(password)
-	for i := range pwBytes {
-		pwBytes[i] = 0
-	}
-
-	// Register the proxmox node in the orca registry.
-	registry, closer, err := nodeRegistry()
-	if err != nil {
-		return err
-	}
-	defer closer()
-
-	regCtx, regCancel := context.WithTimeout(ctx, 5*time.Second)
-	defer regCancel()
-
-	node := &model.Node{
-		ID:       uuid.NewString(),
-		Name:     result.NodeName,
-		Address:  result.NodeAddress,
-		State:    model.NodeStateReady,
-		JoinedAt: time.Now().UTC(),
-		LastSeen: time.Now().UTC(),
-		Kind:     string(model.NodeKindProxmox),
-		OS:       "pve",
-	}
-	if err := registry.Join(regCtx, node); err != nil {
-		return fmt.Errorf("register proxmox node: %w", err)
-	}
-	if jsonOutput {
-		return printJSON(node)
-	}
-	fmt.Fprintf(cmd.OutOrStdout(), "✓ Proxmox node joined: %s (%s) at %s\n", node.ID, node.Name, node.Address)
-	fmt.Fprintf(cmd.OutOrStdout(), "  role: %s, user: %s@pam\n", proxmoxRole, proxmoxUser)
-	return nil
+		if err := registry.Join(ctx, node); err != nil {
+			return err
+		}
+		if jsonOutput {
+			return printJSON(node)
+		}
+		fmt.Fprintf(cmd.OutOrStdout(), "✓ Node joined: %s (%s) at %s\n", node.ID, node.Name, node.Address)
+		return nil
+	},
 }
 
 var nodeLeaveCmd = &cobra.Command{
@@ -346,82 +259,15 @@ func renderNodeTable(nodes []*model.Node) string {
 	return out
 }
 
-var nodeKeyResetCmd = &cobra.Command{
-	Use:   "key-reset <node>",
-	Short: "Reset the SSH known_hosts entry for a node",
-	Long: `Remove the pinned SSH host key for <node> from the local known_hosts
-file. The next connect re-pins the key via TOFU or --host-key-fingerprint.
-
-LOCAL ONLY (D-046): does not touch the remote host's authorized_keys.
-
-<node> is the node name (for proxmox nodes, this is the host address).`,
-	Args: cobra.ExactArgs(1),
-	RunE: func(cmd *cobra.Command, args []string) error {
-		nodeArg := args[0]
-
-		registry, closer, err := nodeRegistry()
-		if err != nil {
-			return err
-		}
-		defer closer()
-
-		ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
-		defer cancel()
-
-		nodes, err := registry.List(ctx)
-		if err != nil {
-			return fmt.Errorf("list nodes: %w", err)
-		}
-		var node *model.Node
-		for _, n := range nodes {
-			if n.Name == nodeArg || n.ID == nodeArg {
-				node = n
-				break
-			}
-		}
-		if node == nil {
-			return fmt.Errorf("node %q not found in the registry", nodeArg)
-		}
-		host := node.Name
-
-		if err := proxmox.ResetHostKey(host); err != nil {
-			return fmt.Errorf("reset host key: %w", err)
-		}
-
-		// Audit-log the reset (REQ-059): actor=cli, action=node.key_reset.
-		db, dbCloser, dbErr := openDB()
-		if dbErr == nil {
-			defer dbCloser()
-			audit := engine.NewAudit(store.NewAuditRepo(db), newLogger())
-			audit.Record(ctx, "cli", "node.key_reset", node.ID, "success", nil, map[string]any{
-				"node": node.Name,
-				"host": host,
-			})
-		}
-
-		fmt.Fprintf(cmd.OutOrStdout(), "✓ Host key reset for %s (next connect will re-pin via TOFU or --host-key-fingerprint)\n", node.Name)
-		return nil
-	},
-}
-
 func init() {
-	nodeJoinCmd.Flags().StringVar(&joinName, "name", "", "node name (required for --type localhost)")
+	nodeJoinCmd.Flags().StringVar(&joinName, "name", "", "node name (required)")
 	nodeJoinCmd.Flags().StringVar(&joinAddr, "addr", "", "node address (default localhost:8443)")
 	nodeJoinCmd.Flags().StringVar(&joinCAFinger, "ca-fingerprint", "", "pin CA cert SHA-256 (REQ-026); fails if on-disk CA doesn't match")
-	nodeJoinCmd.Flags().StringVar(&joinType, "type", "localhost", "node type: localhost (default) or proxmox (SSH bootstrap)")
-	nodeJoinCmd.Flags().StringVar(&joinHost, "host", "", "proxmox host address (IP/hostname, no port; required for --type proxmox)")
-	nodeJoinCmd.Flags().StringVar(&joinSSHUser, "ssh-user", "root", "SSH username for proxmox bootstrap (default root)")
-	nodeJoinCmd.Flags().StringVar(&joinPassword, "password", "", "SSH password for proxmox bootstrap (never persisted; prefer $ORCA_PROXMOX_PASSWORD)")
-	nodeJoinCmd.Flags().IntVar(&joinSSHPort, "ssh-port", 22, "SSH port for proxmox bootstrap (default 22)")
-	nodeJoinCmd.Flags().StringVar(&proxmoxUser, "proxmox-user", "orca", "Linux system user to create on the proxmox host (config-overridable)")
-	nodeJoinCmd.Flags().StringVar(&proxmoxRole, "proxmox-role", "OrcaOperator", "PVE custom role to create (config-overridable)")
-	nodeJoinCmd.Flags().StringVar(&joinHostKeyFP, "host-key-fingerprint", "", "SSH host key SHA256:base64 fingerprint (pre-pin; supersedes TOFU for --type proxmox)")
 	nodeLeaveCmd.Flags().StringVar(&leaveID, "id", "", "node id")
 	nodeListCmd.Flags().BoolVar(&nodeWatch, "watch", false, "stream nodes until Ctrl-C (table refresh or --json per-event)")
 
 	nodeCmd.AddCommand(nodeJoinCmd)
 	nodeCmd.AddCommand(nodeLeaveCmd)
 	nodeCmd.AddCommand(nodeListCmd)
-	nodeCmd.AddCommand(nodeKeyResetCmd)
 	rootCmd.AddCommand(nodeCmd)
 }

internal/cli/node_capacity_test.go

@@ -1,194 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"git.cloudinit.dev/coreci/orca/internal/certpaths"
-	"git.cloudinit.dev/coreci/orca/internal/store"
-)
-
-func TestNodeCapacitySetMissingArgs(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "capacity", "set", "--cpu", "1000"})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for capacity set missing memory/disk, got nil")
-	}
-}
-
-func TestNodeCapacitySet(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "capacity", "set", "--cpu", "2000", "--memory", "4096", "--disk", "51200"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("capacity set: %v", err)
-	}
-	if !strings.Contains(buf.String(), "Capacity set") {
-		t.Errorf("capacity set output unexpected: %s", buf.String())
-	}
-}
-
-func TestNodeCapacitySetJSON(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "capacity", "set", "--cpu", "3000", "--memory", "8192", "--disk", "102400", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("capacity set --json: %v", err)
-	}
-	var c map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &c); err != nil {
-		t.Fatalf("unmarshal capacity set json: %v\n%s", err, buf.String())
-	}
-	if c["NodeID"] != "self" {
-		t.Errorf("capacity set --json NodeID = %v, want self", c["NodeID"])
-	}
-}
-
-func TestNodeCapacityShowNotFound(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "capacity", "show", "missing-node"})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for capacity show missing node, got nil")
-	}
-}
-
-func TestNodeCapacityShowAfterSet(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	seedCapacity(t, "show-node", 4000, 4096, 51200)
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "capacity", "show", "show-node"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("capacity show: %v", err)
-	}
-	out := buf.String()
-	if !strings.Contains(out, "show-node") {
-		t.Errorf("capacity show missing node id: %s", out)
-	}
-	if !strings.Contains(out, "4000") {
-		t.Errorf("capacity show missing cpu: %s", out)
-	}
-}
-
-func TestNodeCapacityShowJSON(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	seedCapacity(t, "jsonshow-node", 4000, 4096, 51200)
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "capacity", "show", "jsonshow-node", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("capacity show --json: %v", err)
-	}
-	var c map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &c); err != nil {
-		t.Fatalf("unmarshal capacity show json: %v\n%s", err, buf.String())
-	}
-	if c["NodeID"] != "jsonshow-node" {
-		t.Errorf("capacity show --json NodeID = %v, want jsonshow-node", c["NodeID"])
-	}
-}
-
-func TestNodeCapacityListEmpty(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "capacity", "list"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("capacity list: %v", err)
-	}
-	if !strings.Contains(buf.String(), "No capacity") {
-		t.Errorf("capacity list empty output unexpected: %s", buf.String())
-	}
-}
-
-func TestNodeCapacityListAfterSet(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	seedCapacity(t, "list-node", 5000, 4096, 51200)
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "capacity", "list"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("capacity list: %v", err)
-	}
-	if !strings.Contains(buf.String(), "list-node") {
-		t.Errorf("capacity list missing node: %s", buf.String())
-	}
-}
-
-func TestNodeCapacityListJSON(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	seedCapacity(t, "jsonlist-node", 5000, 4096, 51200)
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "capacity", "list", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("capacity list --json: %v", err)
-	}
-	var rows []map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &rows); err != nil {
-		t.Fatalf("unmarshal capacity list json: %v\n%s", err, buf.String())
-	}
-	found := false
-	for _, r := range rows {
-		if r["NodeID"] == "jsonlist-node" {
-			found = true
-		}
-	}
-	if !found {
-		t.Errorf("capacity list --json missing jsonlist-node: %s", buf.String())
-	}
-}
-
-func seedCapacity(t *testing.T, nodeID string, cpu, mem, disk int64) {
-	t.Helper()
-	db, err := store.Open(certpaths.DBPath())
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-	repo := store.NewCapacityRepo(db)
-	c := &store.NodeCapacity{
-		NodeID:        nodeID,
-		CPUMillicores: cpu,
-		MemoryMiB:     mem,
-		DiskMiB:       disk,
-	}
-	if err := repo.Upsert(t.Context(), c); err != nil {
-		t.Fatalf("upsert capacity: %v", err)
-	}
-}

internal/cli/node_test.go

@@ -1,496 +0,0 @@
-// This file tests the `orca node` subcommand family (join/leave/list,
-// capacity is covered in node_capacity_test.go). Tests execute rootCmd
-// against a temp ORCA_HOME and assert stdout/stderr/exit per RESEARCH
-// §1.2.
-//
-// daemon.go is EXCLUDED from the cli ≥70% coverage target: the daemon
-// command starts a long-running mTLS server whose lifecycle is better
-// covered by internal/daemon/server_test.go (already 150 LOC). The
-// --pprof flag registration is verified in daemon_test.go.
-package cli
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"git.cloudinit.dev/coreci/orca/internal/certpaths"
-	"git.cloudinit.dev/coreci/orca/internal/model"
-	"git.cloudinit.dev/coreci/orca/internal/security"
-	"git.cloudinit.dev/coreci/orca/internal/store"
-)
-
-func TestNodeJoinLocalText(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "join", "--name", "worker-1", "--addr", "10.0.0.5:8443"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("node join: %v", err)
-	}
-	out := buf.String()
-	if !strings.Contains(out, "Node joined") {
-		t.Errorf("node join output unexpected: %s", out)
-	}
-	if !strings.Contains(out, "worker-1") {
-		t.Errorf("node join output missing name: %s", out)
-	}
-}
-
-func TestNodeJoinLocalJSON(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "join", "--name", "worker-2", "--addr", "10.0.0.6:8443", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("node join --json: %v", err)
-	}
-	var node map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &node); err != nil {
-		t.Fatalf("unmarshal node json: %v\n%s", err, buf.String())
-	}
-	if node["name"] != "worker-2" {
-		t.Errorf("node join --json name = %v, want worker-2", node["name"])
-	}
-	if node["address"] != "10.0.0.6:8443" {
-		t.Errorf("node join --json address = %v, want 10.0.0.6:8443", node["address"])
-	}
-}
-
-func TestNodeJoinMissingName(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "join"})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for missing --name, got nil")
-	}
-}
-
-func TestNodeJoinDefaultAddr(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "join", "--name", "defaulter", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("node join: %v", err)
-	}
-	var node map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &node); err != nil {
-		t.Fatalf("unmarshal node json: %v\n%s", err, buf.String())
-	}
-	if node["address"] != "localhost:8443" {
-		t.Errorf("node join default addr = %v, want localhost:8443", node["address"])
-	}
-}
-
-func TestNodeJoinCAFingerprintMatch(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	if err := runInit(discardWriter{}); err != nil {
-		t.Fatalf("init: %v", err)
-	}
-	fp, err := security.Fingerprint(certpaths.CACertPath())
-	if err != nil {
-		t.Fatalf("fingerprint: %v", err)
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "join", "--name", "pinned", "--ca-fingerprint", fp, "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("node join with matching fingerprint: %v", err)
-	}
-}
-
-func TestNodeJoinCAFingerprintMismatch(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "join", "--name", "badpin", "--ca-fingerprint", padHex(64)})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for CA fingerprint mismatch, got nil")
-	}
-}
-
-func TestNodeJoinCAFingerprintNoCA(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "join", "--name", "noca", "--ca-fingerprint", padHex(64)})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for missing CA with --ca-fingerprint, got nil")
-	}
-}
-
-func TestNodeJoinProxmoxMissingHost(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "join", "--type", "proxmox", "--password", "x"})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for proxmox without --host, got nil")
-	}
-}
-
-func TestNodeJoinProxmoxMissingPassword(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "join", "--type", "proxmox", "--host", "10.0.0.99"})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for proxmox without password, got nil")
-	}
-}
-
-func TestNodeListEmpty(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "list"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("node list: %v", err)
-	}
-}
-
-func TestNodeListAfterJoin(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	rootCmd.SetArgs([]string{"node", "join", "--name", "lister", "--addr", "10.0.0.7:8443"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("node join: %v", err)
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "list"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("node list: %v", err)
-	}
-	out := buf.String()
-	if !strings.Contains(out, "lister") {
-		t.Errorf("node list missing joined node: %s", out)
-	}
-}
-
-func TestNodeListJSON(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	rootCmd.SetArgs([]string{"node", "join", "--name", "jsonlister", "--addr", "10.0.0.8:8443"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("node join: %v", err)
-	}
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "list", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("node list --json: %v", err)
-	}
-	var nodes []map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &nodes); err != nil {
-		t.Fatalf("unmarshal node list json: %v\n%s", err, buf.String())
-	}
-	found := false
-	for _, n := range nodes {
-		if n["name"] == "jsonlister" {
-			found = true
-		}
-	}
-	if !found {
-		t.Errorf("node list --json missing jsonlister: %s", buf.String())
-	}
-}
-
-func TestNodeLeave(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	nodeID := seedNode(t, "leaver", "10.0.0.9:8443")
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "leave", nodeID})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("node leave: %v", err)
-	}
-	if !strings.Contains(buf.String(), "Node left") {
-		t.Errorf("node leave output unexpected: %s", buf.String())
-	}
-}
-
-func TestNodeLeaveJSON(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	nodeID := seedNode(t, "jsonleaver", "10.0.0.10:8443")
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "leave", nodeID, "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("node leave --json: %v", err)
-	}
-	var result map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
-		t.Fatalf("unmarshal node leave json: %v\n%s", err, buf.String())
-	}
-	if result["state"] != "left" {
-		t.Errorf("node leave --json state = %v, want left", result["state"])
-	}
-}
-
-func TestNodeLeaveMissingID(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "leave"})
-	if err := rootCmd.Execute(); err == nil {
-		t.Fatal("expected error for node leave without id, got nil")
-	}
-}
-
-func seedNode(t *testing.T, name, addr string) string {
-	t.Helper()
-	db, err := store.Open(certpaths.DBPath())
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-	repo := store.NewNodeRepo(db)
-	ctx := context.Background()
-	n := &model.Node{
-		ID:       "node-" + name,
-		Name:     name,
-		Address:  addr,
-		State:    model.NodeStateReady,
-		JoinedAt: time.Now().UTC(),
-		LastSeen: time.Now().UTC(),
-	}
-	if err := repo.Insert(ctx, n); err != nil {
-		t.Fatalf("insert node: %v", err)
-	}
-	return n.ID
-}
-
-func padHex(n int) string {
-	b := make([]byte, n)
-	for i := range b {
-		b[i] = 'a'
-	}
-	return string(b)
-}
-
-// TestNodeKeyReset removes the target node's known_hosts lines, leaves
-// other hosts' lines intact, and inserts an audit row (T02.8, REQ-059).
-func TestNodeKeyReset(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-
-	// Seed a proxmox node whose Name is the host address (matches the
-	// key-reset RunE, which uses node.Name as the known_hosts match key).
-	seedProxmoxNode(t, "10.0.0.1", "10.0.0.1:8443")
-
-	// Pre-populate known_hosts: 2 lines for the target + 1 for another host.
-	knownHosts := certpaths.KnownHostsPath()
-	if err := os.MkdirAll(filepath.Dir(knownHosts), 0o755); err != nil {
-		t.Fatalf("mkdir known_hosts dir: %v", err)
-	}
-	original := []byte("[10.0.0.1]:22 ssh-ed25519 AAAAKEY1 host1\n" +
-		"10.0.0.1 ssh-ed25519 AAAAKEY1ALT host1-alt\n" +
-		"[10.0.0.2]:22 ssh-ed25519 AAAAKEY2 host2\n")
-	if err := os.WriteFile(knownHosts, original, 0o600); err != nil {
-		t.Fatalf("write known_hosts: %v", err)
-	}
-
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "key-reset", "10.0.0.1"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("node key-reset: %v", err)
-	}
-	out := buf.String()
-	if !strings.Contains(out, "Host key reset for 10.0.0.1") {
-		t.Errorf("output missing reset confirmation: %s", out)
-	}
-
-	// known_hosts: target's 2 lines removed, other host's line intact.
-	data, err := os.ReadFile(knownHosts)
-	if err != nil {
-		t.Fatalf("read known_hosts: %v", err)
-	}
-	result := string(data)
-	if strings.Contains(result, "AAAAKEY1") {
-		t.Errorf("target key line 1 not removed: %s", result)
-	}
-	if strings.Contains(result, "AAAAKEY1ALT") {
-		t.Errorf("target key line 2 not removed: %s", result)
-	}
-	if !strings.Contains(result, "AAAAKEY2") {
-		t.Errorf("other host's line was removed (should be intact): %s", result)
-	}
-
-	// Audit row inserted with action=node.key_reset.
-	db, err := store.Open(certpaths.DBPath())
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-	entries, err := store.NewAuditRepo(db).List(context.Background(), 50)
-	if err != nil {
-		t.Fatalf("list audit: %v", err)
-	}
-	found := false
-	for _, e := range entries {
-		if e.Action == "node.key_reset" && strings.Contains(e.Resource, "10.0.0.1") {
-			found = true
-			break
-		}
-	}
-	if !found {
-		t.Errorf("audit row for node.key_reset not inserted: %+v", entries)
-	}
-}
-
-// TestNodeKeyReset_NodeNotFound verifies key-reset errors when the
-// node is not in the registry (T02.8).
-func TestNodeKeyReset_NodeNotFound(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"node", "key-reset", "no.such.host"})
-	err := rootCmd.Execute()
-	if err == nil {
-		t.Fatal("expected error for unknown node, got nil")
-	}
-	if !strings.Contains(err.Error(), "not found") {
-		t.Errorf("error should mention not found, got: %v", err)
-	}
-}
-
-func seedProxmoxNode(t *testing.T, name, addr string) string {
-	t.Helper()
-	db, err := store.Open(certpaths.DBPath())
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-	repo := store.NewNodeRepo(db)
-	ctx := context.Background()
-	n := &model.Node{
-		ID:       "node-" + name,
-		Name:     name,
-		Address:  addr,
-		State:    model.NodeStateReady,
-		JoinedAt: time.Now().UTC(),
-		LastSeen: time.Now().UTC(),
-		Kind:     string(model.NodeKindProxmox),
-		OS:       "pve",
-	}
-	if err := repo.Insert(ctx, n); err != nil {
-		t.Fatalf("insert proxmox node: %v", err)
-	}
-	return n.ID
-}
-
-// TestNodeJoinHostKeyFingerprintRequiresProxmox verifies T02.11:
-// `orca node join --type linux --host-key-fingerprint SHA256:...`
-// fails with a clear error from the D-044 RunE check. Exercises the
-// cobra Execute() error path end-to-end.
-func TestNodeJoinHostKeyFingerprintRequiresProxmox(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{
-		"node", "join",
-		"--type", "linux",
-		"--name", "linux-node",
-		"--host-key-fingerprint", "SHA256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
-	})
-	err := rootCmd.Execute()
-	if err == nil {
-		t.Fatal("expected error for --host-key-fingerprint without --type proxmox, got nil")
-	}
-	if !strings.Contains(err.Error(), "--host-key-fingerprint requires --type proxmox") {
-		t.Errorf("error should mention the --host-key-fingerprint/--type proxmox requirement, got: %v", err)
-	}
-}
-
-// TestNodeJoinHostKeyFingerprintProxmoxAccepted verifies that
-// --host-key-fingerprint IS accepted for --type proxmox (the RunE check
-// does not reject a proxmox-type join that pins the host key). This is
-// the negative-space companion to TestNodeJoinHostKeyFingerprintRequiresProxmox
-// (T02.11): the validation must only reject non-proxmox types.
-//
-// We can't run the full bootstrap without a real SSH server, so we
-// assert that the RunE check passes (no "requires --type proxmox"
-// error) and the failure — if any — comes from a later stage (missing
-// --host / password), not the D-044 guard.
-func TestNodeJoinHostKeyFingerprintProxmoxAccepted(t *testing.T) {
-	_, cleanup := initTestEnv(t)
-	defer cleanup()
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{
-		"node", "join",
-		"--type", "proxmox",
-		"--host-key-fingerprint", "SHA256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
-	})
-	err := rootCmd.Execute()
-	if err == nil {
-		t.Fatal("expected a later-stage error (missing --host), got nil")
-	}
-	if strings.Contains(err.Error(), "requires --type proxmox") {
-		t.Errorf("D-044 guard wrongly rejected proxmox type: %v", err)
-	}
-}

internal/cli/osdetect.go

@@ -1,10 +0,0 @@
-package cli
-
-import "git.cloudinit.dev/coreci/orca/internal/osdetect"
-
-// detectOS reads /etc/os-release and returns the ID= value.
-// Delegates to internal/osdetect to avoid import cycles with
-// internal/doctor (both need OS detection).
-func detectOS() string {
-	return osdetect.Detect()
-}

internal/cli/osdetect_test.go

@@ -1,19 +0,0 @@
-package cli
-
-import (
-	"testing"
-)
-
-// The osdetect parsing/detection logic is tested in
-// internal/osdetect/osdetect_test.go. These tests verify the cli
-// wrapper delegates correctly.
-
-func TestDetectOS_DelegatesToPackage(t *testing.T) {
-	// On this host (Ubuntu), detectOS should return "ubuntu" via the
-	// osdetect package. If /etc/os-release is absent (e.g., in a
-	// minimal container), it returns "linux".
-	result := detectOS()
-	if result == "" {
-		t.Error("detectOS returned empty string, expected a non-empty OS ID")
-	}
-}

internal/cli/root.go

@@ -1,26 +1,18 @@
 package cli
 
 import (
-	"context"
 	"encoding/json"
 	"fmt"
-	"os"
 
 	"github.com/spf13/cobra"
-
-	"git.cloudinit.dev/coreci/orca/internal/config"
 )
 
-type configCtxKey struct{}
-
 var (
 	version   = "0.1.0-dev"
 	gitCommit = "unknown"
 	buildTime = "unknown"
 )
 
-const systemNamespaceRoot = "/root/.orca"
-
 var rootCmd = &cobra.Command{
 	Use:   "orca",
 	Short: "Orca — offline/CLI-first orchestration engine",
@@ -29,43 +21,12 @@ inspired by HashiCorp Nomad, prioritizing stability, security, and simplicity
 over feature richness.`,
 	SilenceUsage:  true,
 	SilenceErrors: true,
-	PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
-		if systemNamespace {
-			if existing := os.Getenv("ORCA_HOME"); existing != "" && existing != systemNamespaceRoot {
-				return fmt.Errorf("--system conflicts with ORCA_HOME=%q (already set); unset ORCA_HOME or drop --system", existing)
-			}
-			if err := os.Setenv("ORCA_HOME", systemNamespaceRoot); err != nil {
-				return fmt.Errorf("set ORCA_HOME for --system: %w", err)
-			}
-		}
-		if configPath != "" {
-			cfg, err := config.Load(configPath)
-			if err != nil {
-				return fmt.Errorf("load config %s: %w", configPath, err)
-			}
-			cmd.SetContext(context.WithValue(cmd.Context(), configCtxKey{}, cfg))
-		}
-		return nil
-	},
 }
 
-var (
-	jsonOutput      bool
-	systemNamespace bool
-	configPath      string
-)
+var jsonOutput bool
 
 func init() {
 	rootCmd.PersistentFlags().BoolVar(&jsonOutput, "json", false, "output in JSON format")
-	rootCmd.PersistentFlags().BoolVar(&systemNamespace, "system", false, "use system-level namespace root (/root/.orca) instead of user-level (~/.orca)")
-	rootCmd.PersistentFlags().StringVar(&configPath, "config", "", "path to config.hcl (overrides ~/.orca/config.hcl)")
-}
-
-func configFromCtx(ctx context.Context) *config.Config {
-	if v, ok := ctx.Value(configCtxKey{}).(*config.Config); ok {
-		return v
-	}
-	return nil
 }
 
 func Execute() error {

internal/cli/root_test.go

@@ -1,11 +1,8 @@
 package cli
 
 import (
-	"os"
 	"strings"
 	"testing"
-
-	"git.cloudinit.dev/coreci/orca/internal/config"
 )
 
 func TestVersionCommandExists(t *testing.T) {
@@ -68,47 +65,3 @@ func TestRootHelpMentionsKeyPillars(t *testing.T) {
 		}
 	}
 }
-
-func TestConfigFlagRegistered(t *testing.T) {
-	f := rootCmd.PersistentFlags().Lookup("config")
-	if f == nil {
-		t.Fatal("--config persistent flag not registered")
-	}
-	if f.DefValue != "" {
-		t.Errorf("--config default = %q, want empty", f.DefValue)
-	}
-}
-
-func TestConfigFlagLoadsFile(t *testing.T) {
-	dir := t.TempDir()
-	cfgPath := dir + "/config.hcl"
-	cfgContent := `db_path          = "` + dir + `/test.db"
-listen_addr      = "127.0.0.1:9999"
-ca_path          = "` + dir + `/ca.crt"
-server_cert_path = "` + dir + `/server.crt"
-server_key_path  = "` + dir + `/server.key"
-
-node_capacity {
-  cpu       = 4
-  memory_mb = 8192
-}
-`
-	if err := os.WriteFile(cfgPath, []byte(cfgContent), 0o644); err != nil {
-		t.Fatalf("write config: %v", err)
-	}
-
-	old := configPath
-	configPath = cfgPath
-	defer func() { configPath = old }()
-
-	cfg, err := config.Load(cfgPath)
-	if err != nil {
-		t.Fatalf("load config: %v", err)
-	}
-	if cfg.ListenAddr != "127.0.0.1:9999" {
-		t.Errorf("listen_addr = %q, want 127.0.0.1:9999", cfg.ListenAddr)
-	}
-	if cfg.NodeCapacity == nil || cfg.NodeCapacity.CPU != 4 {
-		t.Errorf("node_capacity.cpu not parsed, got %+v", cfg.NodeCapacity)
-	}
-}

internal/cli/status_test.go

@@ -1,47 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-func TestStatusText(t *testing.T) {
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"status"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("status: %v", err)
-	}
-	out := buf.String()
-	if !strings.Contains(out, "orca daemon status") {
-		t.Errorf("status text output unexpected: %s", out)
-	}
-	if !strings.Contains(out, "version") {
-		t.Errorf("status output missing version: %s", out)
-	}
-}
-
-func TestStatusJSON(t *testing.T) {
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"status", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("status --json: %v", err)
-	}
-	var info map[string]any
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &info); err != nil {
-		t.Fatalf("unmarshal status json: %v\n%s", err, buf.String())
-	}
-	if info["daemon"] != "stopped" {
-		t.Errorf("status json daemon = %v, want stopped", info["daemon"])
-	}
-	if info["api_addr"] != "https://localhost:8443" {
-		t.Errorf("status json api_addr = %v, want https://localhost:8443", info["api_addr"])
-	}
-}

internal/cli/version_test.go

@@ -1,47 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-func TestVersionText(t *testing.T) {
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"version"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("version: %v", err)
-	}
-	out := buf.String()
-	if !strings.Contains(out, "orca version") {
-		t.Errorf("version text output unexpected: %s", out)
-	}
-	if !strings.Contains(out, "git commit") {
-		t.Errorf("version output missing git commit: %s", out)
-	}
-}
-
-func TestVersionJSON(t *testing.T) {
-	resetRootFlags(t)
-	var buf bytes.Buffer
-	rootCmd.SetOut(&buf)
-	rootCmd.SetErr(&buf)
-	rootCmd.SetArgs([]string{"version", "--json"})
-	if err := rootCmd.Execute(); err != nil {
-		t.Fatalf("version --json: %v", err)
-	}
-	var info map[string]string
-	if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &info); err != nil {
-		t.Fatalf("unmarshal version json: %v\n%s", err, buf.String())
-	}
-	if info["version"] == "" {
-		t.Errorf("version json missing version field: %v", info)
-	}
-	if info["git_commit"] == "" {
-		t.Errorf("version json missing git_commit field: %v", info)
-	}
-}

internal/config/config.go

@@ -1,127 +0,0 @@
-package config
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/hashicorp/hcl/v2/hclsimple"
-)
-
-type CapacityConfig struct {
-	CPU      int `hcl:"cpu,optional"`
-	MemoryMB int `hcl:"memory_mb,optional"`
-}
-
-type Config struct {
-	DBPath         string          `hcl:"db_path,optional"`
-	ListenAddr     string          `hcl:"listen_addr,optional"`
-	CAPath         string          `hcl:"ca_path,optional"`
-	ServerCertPath string          `hcl:"server_cert_path,optional"`
-	ServerKeyPath  string          `hcl:"server_key_path,optional"`
-	NodeCapacity   *CapacityConfig `hcl:"node_capacity,block"`
-}
-
-type Flags struct {
-	DBPath         *string
-	ListenAddr     *string
-	CAPath         *string
-	ServerCertPath *string
-	ServerKeyPath  *string
-	CPU            *int
-	MemoryMB       *int
-}
-
-type Environ map[string]string
-
-func Load(paths ...string) (*Config, error) {
-	for _, p := range paths {
-		if _, err := os.Stat(p); err != nil {
-			continue
-		}
-		data, err := os.ReadFile(p)
-		if err != nil {
-			return nil, fmt.Errorf("read config %s: %w", p, err)
-		}
-		var cfg Config
-		if err := hclsimple.Decode(p, data, nil, &cfg); err != nil {
-			return nil, fmt.Errorf("decode config %s: %w", p, err)
-		}
-		return &cfg, nil
-	}
-	return &Config{}, nil
-}
-
-func (c *Config) MergeOverrides(flags Flags, env Environ) *Config {
-	out := &Config{
-		DBPath:         c.DBPath,
-		ListenAddr:     c.ListenAddr,
-		CAPath:         c.CAPath,
-		ServerCertPath: c.ServerCertPath,
-		ServerKeyPath:  c.ServerKeyPath,
-		NodeCapacity:   c.NodeCapacity,
-	}
-
-	applyStr := func(flag *string, envKey, fileVal string) string {
-		if flag != nil {
-			return *flag
-		}
-		if v, ok := env[envKey]; ok && v != "" {
-			return v
-		}
-		return fileVal
-	}
-
-	out.DBPath = applyStr(flags.DBPath, "ORCA_DB", out.DBPath)
-	out.ListenAddr = applyStr(flags.ListenAddr, "ORCA_LISTEN_ADDR", out.ListenAddr)
-	out.CAPath = applyStr(flags.CAPath, "ORCA_CA_PATH", out.CAPath)
-	out.ServerCertPath = applyStr(flags.ServerCertPath, "ORCA_SERVER_CERT_PATH", out.ServerCertPath)
-	out.ServerKeyPath = applyStr(flags.ServerKeyPath, "ORCA_SERVER_KEY_PATH", out.ServerKeyPath)
-
-	if out.NodeCapacity == nil {
-		out.NodeCapacity = &CapacityConfig{}
-	} else {
-		nc := *out.NodeCapacity
-		out.NodeCapacity = &nc
-	}
-
-	if flags.CPU != nil {
-		out.NodeCapacity.CPU = *flags.CPU
-	} else if v, ok := env["ORCA_NODE_CPU"]; ok && v != "" {
-		if n, err := atoi(v); err == nil {
-			out.NodeCapacity.CPU = n
-		}
-	}
-
-	if flags.MemoryMB != nil {
-		out.NodeCapacity.MemoryMB = *flags.MemoryMB
-	} else if v, ok := env["ORCA_NODE_MEMORY_MB"]; ok && v != "" {
-		if n, err := atoi(v); err == nil {
-			out.NodeCapacity.MemoryMB = n
-		}
-	}
-
-	return out
-}
-
-func atoi(s string) (int, error) {
-	n := 0
-	if s == "" {
-		return 0, fmt.Errorf("empty")
-	}
-	neg := false
-	i := 0
-	if s[0] == '-' {
-		neg = true
-		i = 1
-	}
-	for ; i < len(s); i++ {
-		if s[i] < '0' || s[i] > '9' {
-			return 0, fmt.Errorf("bad")
-		}
-		n = n*10 + int(s[i]-'0')
-	}
-	if neg {
-		n = -n
-	}
-	return n, nil
-}

internal/config/config_test.go

@@ -1,197 +0,0 @@
-package config
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-const exampleHCL = `
-db_path          = "/tmp/orca/test.db"
-listen_addr      = "127.0.0.1:9999"
-ca_path          = "/tmp/orca/ca.crt"
-server_cert_path = "/tmp/orca/server.crt"
-server_key_path  = "/tmp/orca/server.key"
-
-node_capacity {
-  cpu       = 4
-  memory_mb = 8192
-}
-`
-
-func writeFile(t *testing.T, dir, name, content string) string {
-	t.Helper()
-	p := filepath.Join(dir, name)
-	if err := os.WriteFile(p, []byte(content), 0644); err != nil {
-		t.Fatalf("write %s: %v", p, err)
-	}
-	return p
-}
-
-func TestLoad_Valid(t *testing.T) {
-	p := writeFile(t, t.TempDir(), "config.hcl", exampleHCL)
-	cfg, err := Load(p)
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-	if cfg.DBPath != "/tmp/orca/test.db" {
-		t.Errorf("DBPath=%q", cfg.DBPath)
-	}
-	if cfg.ListenAddr != "127.0.0.1:9999" {
-		t.Errorf("ListenAddr=%q", cfg.ListenAddr)
-	}
-	if cfg.CAPath != "/tmp/orca/ca.crt" {
-		t.Errorf("CAPath=%q", cfg.CAPath)
-	}
-	if cfg.ServerCertPath != "/tmp/orca/server.crt" {
-		t.Errorf("ServerCertPath=%q", cfg.ServerCertPath)
-	}
-	if cfg.ServerKeyPath != "/tmp/orca/server.key" {
-		t.Errorf("ServerKeyPath=%q", cfg.ServerKeyPath)
-	}
-	if cfg.NodeCapacity == nil {
-		t.Fatal("NodeCapacity nil")
-	}
-	if cfg.NodeCapacity.CPU != 4 {
-		t.Errorf("CPU=%d", cfg.NodeCapacity.CPU)
-	}
-	if cfg.NodeCapacity.MemoryMB != 8192 {
-		t.Errorf("MemoryMB=%d", cfg.NodeCapacity.MemoryMB)
-	}
-}
-
-func TestLoad_Missing(t *testing.T) {
-	cfg, err := Load(filepath.Join(t.TempDir(), "nope.hcl"))
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-	if cfg == nil {
-		t.Fatal("nil config")
-	}
-	if cfg.DBPath != "" || cfg.ListenAddr != "" || cfg.NodeCapacity != nil {
-		t.Errorf("expected zero config, got %+v", cfg)
-	}
-}
-
-func TestLoad_Malformed(t *testing.T) {
-	p := writeFile(t, t.TempDir(), "bad.hcl", "db_path = ")
-	cfg, err := Load(p)
-	if err == nil {
-		t.Fatalf("expected error, got %+v", cfg)
-	}
-}
-
-func TestLoad_FirstExisting(t *testing.T) {
-	dir := t.TempDir()
-	existing := writeFile(t, dir, "real.hcl", exampleHCL)
-	missing := filepath.Join(dir, "missing.hcl")
-	cfg, err := Load(missing, existing)
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-	if cfg.DBPath != "/tmp/orca/test.db" {
-		t.Errorf("DBPath=%q", cfg.DBPath)
-	}
-}
-
-func strPtr(s string) *string { return &s }
-func intPtr(i int) *int       { return &i }
-
-func TestMergeOverrides_FlagWins(t *testing.T) {
-	cfg := &Config{
-		DBPath:     "/file.db",
-		ListenAddr: "127.0.0.1:9000",
-		NodeCapacity: &CapacityConfig{
-			CPU:      4,
-			MemoryMB: 8192,
-		},
-	}
-	flags := Flags{
-		DBPath:     strPtr("/flag.db"),
-		ListenAddr: strPtr("0.0.0.0:1234"),
-	}
-	env := Environ{"ORCA_DB": "/env.db"}
-	out := cfg.MergeOverrides(flags, env)
-	if out.DBPath != "/flag.db" {
-		t.Errorf("DBPath=%q want /flag.db", out.DBPath)
-	}
-	if out.ListenAddr != "0.0.0.0:1234" {
-		t.Errorf("ListenAddr=%q want 0.0.0.0:1234", out.ListenAddr)
-	}
-	if cfg.DBPath != "/file.db" {
-		t.Errorf("receiver mutated: %q", cfg.DBPath)
-	}
-}
-
-func TestMergeOverrides_EnvWinsOverFile(t *testing.T) {
-	cfg := &Config{DBPath: "/file.db", ListenAddr: "127.0.0.1:9000"}
-	env := Environ{"ORCA_DB": "/env.db"}
-	out := cfg.MergeOverrides(Flags{}, env)
-	if out.DBPath != "/env.db" {
-		t.Errorf("DBPath=%q want /env.db", out.DBPath)
-	}
-	if out.ListenAddr != "127.0.0.1:9000" {
-		t.Errorf("ListenAddr=%q want 127.0.0.1:9000", out.ListenAddr)
-	}
-}
-
-func TestMergeOverrides_FileWinsOverDefault(t *testing.T) {
-	cfg := &Config{DBPath: "/file.db", ListenAddr: "127.0.0.1:9000"}
-	out := cfg.MergeOverrides(Flags{}, Environ{})
-	if out.DBPath != "/file.db" {
-		t.Errorf("DBPath=%q want /file.db", out.DBPath)
-	}
-	if out.ListenAddr != "127.0.0.1:9000" {
-		t.Errorf("ListenAddr=%q want 127.0.0.1:9000", out.ListenAddr)
-	}
-}
-
-func TestMergeOverrides_EmptyFlagDoesNotOverride(t *testing.T) {
-	cfg := &Config{DBPath: "/file.db"}
-	env := Environ{"ORCA_DB": "/env.db"}
-	out := cfg.MergeOverrides(Flags{}, env)
-	if out.DBPath != "/env.db" {
-		t.Errorf("DBPath=%q want /env.db", out.DBPath)
-	}
-}
-
-func TestMergeOverrides_EmptyEnvDoesNotOverride(t *testing.T) {
-	cfg := &Config{DBPath: "/file.db"}
-	env := Environ{"ORCA_DB": ""}
-	out := cfg.MergeOverrides(Flags{}, env)
-	if out.DBPath != "/file.db" {
-		t.Errorf("DBPath=%q want /file.db", out.DBPath)
-	}
-}
-
-func TestMergeOverrides_NodeCapacity(t *testing.T) {
-	cfg := &Config{
-		NodeCapacity: &CapacityConfig{CPU: 4, MemoryMB: 8192},
-	}
-	out := cfg.MergeOverrides(Flags{}, Environ{})
-	if out.NodeCapacity == nil {
-		t.Fatal("NodeCapacity nil")
-	}
-	if out.NodeCapacity.CPU != 4 {
-		t.Errorf("CPU=%d want 4", out.NodeCapacity.CPU)
-	}
-	if out.NodeCapacity.MemoryMB != 8192 {
-		t.Errorf("MemoryMB=%d want 8192", out.NodeCapacity.MemoryMB)
-	}
-	if cfg.NodeCapacity == out.NodeCapacity {
-		t.Error("NodeCapacity not cloned")
-	}
-}
-
-func TestMergeOverrides_NodeCapacityFlagAndEnv(t *testing.T) {
-	cfg := &Config{NodeCapacity: &CapacityConfig{CPU: 4, MemoryMB: 8192}}
-	flags := Flags{CPU: intPtr(8)}
-	env := Environ{"ORCA_NODE_MEMORY_MB": "16384"}
-	out := cfg.MergeOverrides(flags, env)
-	if out.NodeCapacity.CPU != 8 {
-		t.Errorf("CPU=%d want 8", out.NodeCapacity.CPU)
-	}
-	if out.NodeCapacity.MemoryMB != 16384 {
-		t.Errorf("MemoryMB=%d want 16384", out.NodeCapacity.MemoryMB)
-	}
-}

internal/config/testdata/config.hcl

@@ -1,10 +0,0 @@
-db_path          = "/tmp/orca/test.db"
-listen_addr      = "127.0.0.1:9999"
-ca_path          = "/tmp/orca/ca.crt"
-server_cert_path = "/tmp/orca/server.crt"
-server_key_path  = "/tmp/orca/server.key"
-
-node_capacity {
-  cpu       = 4
-  memory_mb = 8192
-}

internal/daemon/pprof.go

@@ -1,45 +0,0 @@
-package daemon
-
-import (
-	"errors"
-	"log/slog"
-	"net/http"
-	"net/http/pprof"
-	"time"
-)
-
-func StartPprof(addr string, log *slog.Logger) (*http.Server, error) {
-	if addr == "" {
-		return nil, nil
-	}
-	mux := http.NewServeMux()
-	mux.HandleFunc("/debug/pprof/", pprof.Index)
-	mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
-	mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
-	mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
-	mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
-	mux.Handle("/debug/pprof/heap", pprof.Handler("heap"))
-	mux.Handle("/debug/pprof/goroutine", pprof.Handler("goroutine"))
-	mux.Handle("/debug/pprof/threadcreate", pprof.Handler("threadcreate"))
-	mux.Handle("/debug/pprof/block", pprof.Handler("block"))
-	mux.Handle("/debug/pprof/mutex", pprof.Handler("mutex"))
-
-	server := &http.Server{
-		Addr:              addr,
-		Handler:           mux,
-		ReadHeaderTimeout: 5 * time.Second,
-	}
-
-	log.Warn("pprof endpoint exposed",
-		slog.String("addr", addr),
-		slog.String("warning", "unauthenticated, operator-only — do not expose publicly"))
-
-	go func() {
-		err := server.ListenAndServe()
-		if err != nil && !errors.Is(err, http.ErrServerClosed) {
-			log.Error("pprof server stopped", slog.String("addr", addr), slog.Any("err", err))
-		}
-	}()
-
-	return server, nil
-}

internal/daemon/pprof_test.go

@@ -1,263 +0,0 @@
-package daemon
-
-import (
-	"context"
-	"io"
-	"log/slog"
-	"net"
-	"net/http"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"git.cloudinit.dev/coreci/orca/internal/store"
-)
-
-func TestStartPprof_Disabled(t *testing.T) {
-	srv, err := StartPprof("", slog.Default())
-	if err != nil {
-		t.Fatalf("StartPprof(\"\", _) returned err: %v", err)
-	}
-	if srv != nil {
-		t.Fatalf("StartPprof(\"\", _) returned non-nil server: %v", srv)
-	}
-}
-
-func TestStartPprof_Enabled(t *testing.T) {
-	log := slog.New(slog.NewTextHandler(io.Discard, nil))
-
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-	addr := ln.Addr().String()
-	_ = ln.Close()
-
-	srv, err := StartPprof(addr, log)
-	if err != nil {
-		t.Fatalf("StartPprof returned err: %v", err)
-	}
-	if srv == nil {
-		t.Fatal("StartPprof returned nil server for non-empty addr")
-	}
-	t.Cleanup(func() {
-		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-		defer cancel()
-		_ = srv.Shutdown(ctx)
-	})
-
-	deadline := time.Now().Add(2 * time.Second)
-	var base string
-	for time.Now().Before(deadline) {
-		conn, derr := net.DialTimeout("tcp", addr, 50*time.Millisecond)
-		if derr == nil {
-			_ = conn.Close()
-			base = "http://" + addr
-			break
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-	if base == "" {
-		t.Fatal("pprof server did not start listening")
-	}
-
-	client := &http.Client{Timeout: 500 * time.Millisecond}
-	for _, path := range []string{"/debug/pprof/", "/debug/pprof/cmdline", "/debug/pprof/heap"} {
-		resp, gerr := client.Get(base + path)
-		if gerr != nil {
-			t.Errorf("GET %s: %v", path, gerr)
-			continue
-		}
-		_, _ = io.Copy(io.Discard, resp.Body)
-		_ = resp.Body.Close()
-		if resp.StatusCode != 200 {
-			t.Errorf("GET %s: expected 200, got %d", path, resp.StatusCode)
-		}
-	}
-}
-
-func TestStartPprof_Shutdown(t *testing.T) {
-	log := slog.New(slog.NewTextHandler(io.Discard, nil))
-
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-	addr := ln.Addr().String()
-	_ = ln.Close()
-
-	srv, err := StartPprof(addr, log)
-	if err != nil {
-		t.Fatalf("StartPprof returned err: %v", err)
-	}
-	if srv == nil {
-		t.Fatal("StartPprof returned nil server")
-	}
-
-	deadline := time.Now().Add(2 * time.Second)
-	for time.Now().Before(deadline) {
-		conn, derr := net.DialTimeout("tcp", addr, 50*time.Millisecond)
-		if derr == nil {
-			_ = conn.Close()
-			break
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	defer cancel()
-	if err := srv.Shutdown(ctx); err != nil {
-		t.Fatalf("Shutdown: %v", err)
-	}
-
-	client := &http.Client{Timeout: 300 * time.Millisecond}
-	_, gerr := client.Get("http://" + addr + "/debug/pprof/")
-	if gerr == nil {
-		t.Error("expected GET to fail after Shutdown, but it succeeded")
-	}
-}
-
-func TestStartPprof_MuxIsolated(t *testing.T) {
-	log := slog.New(slog.NewTextHandler(io.Discard, nil))
-
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-	addr := ln.Addr().String()
-	_ = ln.Close()
-
-	srv, err := StartPprof(addr, log)
-	if err != nil {
-		t.Fatalf("StartPprof returned err: %v", err)
-	}
-	if srv == nil {
-		t.Fatal("StartPprof returned nil server")
-	}
-	t.Cleanup(func() {
-		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-		defer cancel()
-		_ = srv.Shutdown(ctx)
-	})
-
-	deadline := time.Now().Add(2 * time.Second)
-	for time.Now().Before(deadline) {
-		conn, derr := net.DialTimeout("tcp", addr, 50*time.Millisecond)
-		if derr == nil {
-			_ = conn.Close()
-			break
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-
-	client := &http.Client{Timeout: 500 * time.Millisecond}
-	resp, err := client.Get("http://" + addr + "/healthz")
-	if err != nil {
-		t.Fatalf("GET /healthz: %v", err)
-	}
-	_, _ = io.Copy(io.Discard, resp.Body)
-	_ = resp.Body.Close()
-	if resp.StatusCode != 404 {
-		t.Errorf("expected /healthz to 404 on pprof-only mux, got %d", resp.StatusCode)
-	}
-}
-
-func TestServer_WithPprof(t *testing.T) {
-	db, err := store.Open(filepath.Join(t.TempDir(), "pprof.db"))
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-
-	log := slog.New(slog.NewTextHandler(io.Discard, nil))
-
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen main: %v", err)
-	}
-	mainAddr := ln.Addr().String()
-
-	pln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen pprof: %v", err)
-	}
-	pprofAddr := pln.Addr().String()
-	_ = pln.Close()
-
-	s := NewServer(Options{
-		DB:        db,
-		Log:       log,
-		Addr:      mainAddr,
-		PprofAddr: pprofAddr,
-	})
-	s.MarkReady()
-
-	if s.pprofServer == nil {
-		t.Fatal("expected pprofServer to be non-nil after NewServer with PprofAddr")
-	}
-
-	errCh := make(chan error, 2)
-	go func() {
-		err := s.httpServer.Serve(ln)
-		if err != nil && err != http.ErrServerClosed {
-			errCh <- err
-		}
-	}()
-
-	deadline := time.Now().Add(2 * time.Second)
-	for time.Now().Before(deadline) {
-		conn, derr := net.DialTimeout("tcp", pprofAddr, 50*time.Millisecond)
-		if derr == nil {
-			_ = conn.Close()
-			break
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-
-	client := &http.Client{Timeout: 500 * time.Millisecond}
-	resp, err := client.Get("http://" + mainAddr + "/healthz")
-	if err != nil {
-		t.Fatalf("GET main /healthz: %v", err)
-	}
-	if resp.StatusCode != 200 {
-		t.Errorf("main /healthz: expected 200, got %d", resp.StatusCode)
-	}
-	_, _ = io.Copy(io.Discard, resp.Body)
-	_ = resp.Body.Close()
-
-	presp, err := client.Get("http://" + pprofAddr + "/debug/pprof/")
-	if err != nil {
-		t.Fatalf("GET pprof /debug/pprof/: %v", err)
-	}
-	if presp.StatusCode != 200 {
-		t.Errorf("pprof /debug/pprof/: expected 200, got %d", presp.StatusCode)
-	}
-	_, _ = io.Copy(io.Discard, presp.Body)
-	_ = presp.Body.Close()
-
-	presp, err = client.Get("http://" + pprofAddr + "/healthz")
-	if err != nil {
-		t.Fatalf("GET pprof /healthz: %v", err)
-	}
-	_, _ = io.Copy(io.Discard, presp.Body)
-	_ = presp.Body.Close()
-	if presp.StatusCode != 404 {
-		t.Errorf("expected /healthz 404 on pprof mux, got %d", presp.StatusCode)
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	defer cancel()
-	if err := s.Shutdown(ctx); err != nil {
-		t.Errorf("Shutdown: %v", err)
-	}
-
-	client = &http.Client{Timeout: 300 * time.Millisecond}
-	_, gerr := client.Get("http://" + pprofAddr + "/debug/pprof/")
-	if gerr == nil {
-		t.Error("expected pprof GET to fail after Shutdown")
-	}
-	_, merr := client.Get("http://" + mainAddr + "/healthz")
-	if merr == nil {
-		t.Error("expected main GET to fail after Shutdown")
-	}
-}

internal/daemon/server.go

@@ -29,8 +29,7 @@ type Server struct {
 	addr  string
 	ready atomic.Bool
 
-	httpServer  *http.Server
-	pprofServer *http.Server
+	httpServer *http.Server
 
 	// mtls is non-nil after StartMTLS has been called; nil otherwise.
 	// Plaintext HTTP and mTLS are mutually exclusive — a Server is
@@ -50,12 +49,6 @@ type Options struct {
 	Log   *slog.Logger
 	Addr  string
 	Actor string // used for audit logging from API requests
-
-	// PprofAddr enables the pprof endpoint on a separate listener
-	// when non-empty (e.g. "127.0.0.1:6060"). Default "" disables it.
-	// The pprof listener is unauthenticated and operator-only; never
-	// expose it publicly (AD-024).
-	PprofAddr string
 }
 
 // NewServer constructs a Server with the default mux and route table.
@@ -82,14 +75,6 @@ func NewServer(opts Options) *Server {
 		WriteTimeout:      30 * time.Second,
 		IdleTimeout:       60 * time.Second,
 	}
-	if opts.PprofAddr != "" {
-		ps, perr := StartPprof(opts.PprofAddr, opts.Log)
-		if perr != nil {
-			s.log.Error("pprof start failed", slog.String("component", "daemon"), slog.Any("err", perr))
-		} else {
-			s.pprofServer = ps
-		}
-	}
 	return s
 }
 
@@ -157,11 +142,6 @@ func (s *Server) Start() error {
 func (s *Server) Shutdown(ctx context.Context) error {
 	s.MarkNotReady()
 	s.log.Info("daemon shutting down", slog.String("component", "daemon"))
-	if s.pprofServer != nil {
-		if perr := s.pprofServer.Shutdown(ctx); perr != nil {
-			s.log.Error("pprof shutdown failed", slog.String("component", "daemon"), slog.Any("err", perr))
-		}
-	}
 	return s.httpServer.Shutdown(ctx)
 }
 

internal/doctor/doctor.go

@@ -19,21 +19,12 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
-	"net/http"
 	"os"
 	"sort"
-	"strings"
 	"time"
 
-	"golang.org/x/crypto/ssh"
-
 	"git.cloudinit.dev/coreci/orca/internal/certpaths"
-	"git.cloudinit.dev/coreci/orca/internal/model"
-	"git.cloudinit.dev/coreci/orca/internal/osdetect"
-	"git.cloudinit.dev/coreci/orca/internal/proxmox"
 	"git.cloudinit.dev/coreci/orca/internal/security"
-	"git.cloudinit.dev/coreci/orca/internal/store"
-	"git.cloudinit.dev/coreci/orca/internal/transport"
 )
 
 // Result is the outcome of a single check.
@@ -72,10 +63,8 @@ func All() []Check {
 		CertServer(),
 		CertExpiry(),
 		CertFingerprint(),
-		OS(),
-		Network(),
-		Proxmox(),
-		DB(),
+		NetworkStub(),
+		DBStub(),
 	}
 }
 
@@ -188,301 +177,28 @@ func CertFingerprint() Check {
 	}
 }
 
-// DB checks SQLite integrity and migration version (REQ-032 completion).
-func DB() Check {
-	return Check{
-		Name:        "db",
-		Description: "SQLite integrity_check + migration version",
-		Run: func(ctx context.Context) (Result, string) {
-			path := certpaths.DBPath()
-			db, err := store.Open(path)
-			if err != nil {
-				return ResultFail, fmt.Sprintf("open db: %v", err)
-			}
-			defer db.Close()
-
-			var integrity string
-			if err := db.QueryRowContext(ctx, "PRAGMA integrity_check").Scan(&integrity); err != nil {
-				return ResultFail, fmt.Sprintf("integrity_check: %v", err)
-			}
-			if !strings.EqualFold(integrity, "ok") {
-				return ResultFail, fmt.Sprintf("integrity_check: %s", integrity)
-			}
-
-			version, err := store.MigrationVersion(ctx, db)
-			if err != nil {
-				return ResultFail, fmt.Sprintf("migration version: %v", err)
-			}
-			if version == "" {
-				return ResultWarn, "integrity OK but no migrations applied (fresh db)"
-			}
-			return ResultPass, fmt.Sprintf("integrity OK, migrations up to %s", version)
-		},
-	}
-}
-
-// Network probes peer reachability via mTLS /healthz (REQ-032 completion).
-// Peers are sourced from the persisted nodes table (not the in-memory
-// PeerRegistry, which is empty at CLI time). Zero peers → WARN (single-node
-// is legitimate). Any peer unreachable → FAIL (D-038).
-func Network() Check {
+// NetworkStub is a stub for the network check; full impl in P02.
+func NetworkStub() Check {
 	return Check{
 		Name:        "network",
-		Description: "peer reachability via mTLS /healthz probe",
-		Run: func(ctx context.Context) (Result, string) {
-			caPath := certpaths.CACertPath()
-			certPath := certpaths.ServerCertPath()
-			keyPath := certpaths.ServerKeyPath()
-
-			// Check that cert files exist before attempting probes.
-			if _, err := os.Stat(caPath); err != nil {
-				return ResultFail, fmt.Sprintf("CA cert missing: %v (run `orca cert init`)", err)
-			}
-
-			path := certpaths.DBPath()
-			db, err := store.Open(path)
-			if err != nil {
-				return ResultFail, fmt.Sprintf("open db: %v", err)
-			}
-			defer db.Close()
-
-			nodes, err := store.NewNodeRepo(db).List(ctx)
-			if err != nil {
-				return ResultFail, fmt.Sprintf("list nodes: %v", err)
-			}
-
-			live := make([]*model.Node, 0, len(nodes))
-			for _, n := range nodes {
-				if n.State != model.NodeStateLeft {
-					live = append(live, n)
-				}
-			}
-
-			if len(live) == 0 {
-				return ResultWarn, "no peers registered (single-node?)"
-			}
-
-			var lines []string
-			anyFail := false
-			for _, n := range live {
-				probeCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
-				err := probeHealthz(probeCtx, caPath, certPath, keyPath, n.Name, n.Address)
-				cancel()
-				if err != nil {
-					anyFail = true
-					lines = append(lines, fmt.Sprintf("  ✗ %s (%s): %v", n.Name, n.Address, err))
-				} else {
-					lines = append(lines, fmt.Sprintf("  ✓ %s (%s)", n.Name, n.Address))
-				}
-			}
-
-			result := ResultPass
-			if anyFail {
-				result = ResultFail
-			}
-			return result, strings.Join(lines, "\n")
+		Description: "TCP reachability + mTLS handshake (full impl in P02)",
+		Run: func(_ context.Context) (Result, string) {
+			return ResultWarn, "network check is a stub in P01; full impl in P02"
 		},
 	}
 }
 
-// probeHealthz opens an mTLS connection to the peer and GETs /healthz.
-func probeHealthz(ctx context.Context, caPath, certPath, keyPath, serverName, addr string) error {
-	client, err := transport.NewMTLSClient(caPath, serverName, certPath, keyPath)
-	if err != nil {
-		return fmt.Errorf("mTLS client: %w", err)
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://"+addr+"/healthz", nil)
-	if err != nil {
-		return fmt.Errorf("request: %w", err)
-	}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("probe: %w", err)
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("healthz returned %d", resp.StatusCode)
-	}
-	return nil
-}
-
-// OS checks that the auto-detected OS matches the stored localhost
-// node's os field (REQ-052). Drift (e.g., OS upgraded since init)
-// returns WARN; match returns PASS; missing localhost node returns FAIL.
-func OS() Check {
+// DBStub is a stub for the database check; full impl in P02.
+func DBStub() Check {
 	return Check{
-		Name:        "os",
-		Description: "localhost OS detection vs stored node row",
-		Run: func(ctx context.Context) (Result, string) {
-			detected := osdetect.Detect()
-
-			db, err := store.Open(certpaths.DBPath())
-			if err != nil {
-				return ResultFail, fmt.Sprintf("open db: %v", err)
-			}
-			defer db.Close()
-
-			node, err := store.NewNodeRepo(db).GetByName(ctx, "localhost")
-			if err == store.ErrNotFound {
-				return ResultFail, "no localhost node registered — run `orca init`"
-			}
-			if err != nil {
-				return ResultFail, fmt.Sprintf("lookup localhost node: %v", err)
-			}
-			if node.OS == "" {
-				return ResultWarn, fmt.Sprintf("localhost node has no os field (pre-0006 row?); detected=%s — re-run `orca init` to refresh", detected)
-			}
-			if node.OS != detected {
-				return ResultWarn, fmt.Sprintf("OS drift: init=%s, now=%s — re-run `orca init` to refresh", node.OS, detected)
-			}
-			return ResultPass, fmt.Sprintf("localhost os=%s (matches /etc/os-release)", detected)
+		Name:        "db",
+		Description: "SQLite open + migration apply (full impl in P02)",
+		Run: func(_ context.Context) (Result, string) {
+			return ResultWarn, "db check is a stub in P01; full impl in P02"
 		},
 	}
 }
 
-// Proxmox probes each kind=proxmox node via SSH with `pveversion`
-// (REQ-052). Clones the Network() pattern: list nodes, filter by kind,
-// 3s timeout per peer, PASS/WARN/FAIL per node. Zero proxmox nodes
-// returns WARN (single-node cluster is legitimate).
-func Proxmox() Check {
-	return Check{
-		Name:        "proxmox",
-		Description: "proxmox node reachability via SSH pveversion probe",
-		Run: func(ctx context.Context) (Result, string) {
-			db, err := store.Open(certpaths.DBPath())
-			if err != nil {
-				return ResultFail, fmt.Sprintf("open db: %v", err)
-			}
-			defer db.Close()
-
-			nodes, err := store.NewNodeRepo(db).List(ctx)
-			if err != nil {
-				return ResultFail, fmt.Sprintf("list nodes: %v", err)
-			}
-
-			proxmoxNodes := make([]*model.Node, 0, len(nodes))
-			for _, n := range nodes {
-				if n.Kind == string(model.NodeKindProxmox) && n.State != model.NodeStateLeft {
-					proxmoxNodes = append(proxmoxNodes, n)
-				}
-			}
-
-			if len(proxmoxNodes) == 0 {
-				return ResultWarn, "no proxmox nodes registered (single-node?)"
-			}
-
-			var lines []string
-			anyFail := false
-			for _, n := range proxmoxNodes {
-				probeCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
-				err := probeProxmoxPVEVersion(probeCtx, n.Name)
-				cancel()
-				if err != nil {
-					anyFail = true
-					lines = append(lines, fmt.Sprintf("  ✗ %s: %v", n.Name, err))
-				} else {
-					lines = append(lines, fmt.Sprintf("  ✓ %s", n.Name))
-				}
-			}
-
-			result := ResultPass
-			if anyFail {
-				result = ResultFail
-			}
-			return result, strings.Join(lines, "\n")
-		},
-	}
-}
-
-// probeProxmoxPVEVersion SSHes into the proxmox host and runs
-// `pveversion` to verify reachability + PVE installation. Uses the
-// orca SSH key for auth (deployed during `orca node join --type proxmox`)
-// and the known_hosts TOFU store for host-key verification (D-035).
-func probeProxmoxPVEVersion(ctx context.Context, host string) error {
-	// Load the orca SSH key for public-key auth.
-	keyPEM, err := os.ReadFile(certpaths.SSHKeyPath())
-	if err != nil {
-		return fmt.Errorf("read SSH key: %w (run `orca node join --type proxmox` first)", err)
-	}
-	signer, err := ssh.ParsePrivateKey(keyPEM)
-	if err != nil {
-		return fmt.Errorf("parse SSH key: %w", err)
-	}
-
-	// Extract host from the node address (orca stores host:8443;
-	// SSH needs host:22). We dial the SSH port, not the orca daemon port.
-	sshHost := host
-	if strings.Contains(host, ":") {
-		sshHost = strings.SplitN(host, ":", 2)[0]
-	}
-	sshAddr := sshHost + ":22"
-
-	// Use the shared TOFU capture-fix wrapper (T02.9 — GRILL condition
-	// #2: doctor parity with bootstrap). Without this, a first-connect
-	// proxmox node (entry missing from known_hosts) fails the doctor
-	// probe even though it joined fine — the v0.6 ship-defect.
-	hostKeyCallback, err := proxmox.TOFUHostKeyCallback(sshAddr, nil)
-	if err != nil {
-		return fmt.Errorf("known_hosts: %w", err)
-	}
-
-	config := &ssh.ClientConfig{
-		User:            "orca",
-		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
-		HostKeyCallback: hostKeyCallback,
-		Timeout:         3 * time.Second,
-	}
-
-	dialer := &netDialer{}
-	conn, err := dialer.DialContext(ctx, "tcp", sshAddr, config)
-	if err != nil {
-		return fmt.Errorf("ssh dial: %w", err)
-	}
-	defer conn.Close()
-
-	session, err := conn.NewSession()
-	if err != nil {
-		return fmt.Errorf("new session: %w", err)
-	}
-	defer session.Close()
-
-	out, err := session.CombinedOutput("pveversion")
-	if err != nil {
-		return fmt.Errorf("pveversion: %w (output: %s)", err, strings.TrimSpace(string(out)))
-	}
-	return nil
-}
-
-// netDialer wraps ssh.Dial with context support. The ssh package's
-// Dial doesn't accept a context directly, so we use a dialer that
-// respects ctx cancellation via a goroutine + channel.
-type netDialer struct{}
-
-func (d *netDialer) DialContext(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
-	type result struct {
-		client *ssh.Client
-		err    error
-	}
-	ch := make(chan result, 1)
-	go func() {
-		client, err := ssh.Dial(network, addr, config)
-		ch <- result{client, err}
-	}()
-	select {
-	case <-ctx.Done():
-		// Best-effort: if the dial succeeds after ctx cancellation,
-		// the goroutine will close the client. We return the ctx error.
-		go func() {
-			if r := <-ch; r.client != nil {
-				_ = r.client.Close()
-			}
-		}()
-		return nil, ctx.Err()
-	case r := <-ch:
-		return r.client, r.err
-	}
-}
-
 // loadCert reads a PEM cert from path and parses the first CERTIFICATE
 // block.
 func loadCert(path string) (*x509.Certificate, error) {

internal/doctor/doctor_test.go

@@ -2,82 +2,60 @@ package doctor
 
 import (
 	"context"
-	"crypto/ed25519"
-	"crypto/rand"
-	"net"
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"
-	"time"
 
-	"golang.org/x/crypto/ssh"
-
-	"git.cloudinit.dev/coreci/orca/internal/certpaths"
-	"git.cloudinit.dev/coreci/orca/internal/model"
-	"git.cloudinit.dev/coreci/orca/internal/osdetect"
-	"git.cloudinit.dev/coreci/orca/internal/proxmox"
 	"git.cloudinit.dev/coreci/orca/internal/security"
-	"git.cloudinit.dev/coreci/orca/internal/store"
 )
 
-// TestRunAllChecksWithNoCA runs the full battery in a clean temp dir.
-// With the P02 real checks (no stubs): cert checks FAIL (no CA),
-// db check PASS (store.Open runs migrations), network check WARN
-// (no peers).
+// TestRunAllChecksWithNoCA runs the full battery in a clean temp dir
+// and expects all checks to FAIL (no CA, no server cert) except the
+// two stubs which return WARN.
 func TestRunAllChecksWithNoCA(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
+	// Isolated home so we don't touch the real ~/.orca.
+	t.Setenv("ORCA_HOME", t.TempDir())
 
 	rep := Run(context.Background())
 	if len(rep.Checks) == 0 {
 		t.Fatal("expected checks, got 0")
 	}
-
-	byName := make(map[string]CheckResult, len(rep.Checks))
+	hasFail := false
+	hasWarn := false
 	for _, c := range rep.Checks {
-		byName[c.Name] = c
-	}
-
-	// Cert checks: no CA → FAIL.
-	for _, name := range []string{"cert.ca", "cert.server", "cert.expiry", "cert.fingerprint"} {
-		c, ok := byName[name]
-		if !ok {
-			t.Errorf("missing check %s", name)
-			continue
+		if c.Result == ResultFail {
+			hasFail = true
 		}
-		if c.Result != ResultFail {
-			t.Errorf("%s: got %s, want FAIL — %s", name, c.Result, c.Message)
+		if c.Result == ResultWarn {
+			hasWarn = true
 		}
 	}
-
-	// DB check: store.Open runs migrations → PASS.
-	if c, ok := byName["db"]; ok {
-		if c.Result != ResultPass {
-			t.Errorf("db: got %s, want PASS — %s", c.Result, c.Message)
-		}
-	} else {
-		t.Error("missing check db")
+	if !hasFail {
+		t.Error("expected at least one FAIL (no CA installed)")
+	}
+	if !hasWarn {
+		t.Error("expected at least one WARN (stubs in P01)")
 	}
 
-	// Network check: no CA → FAIL (can't build mTLS client without CA).
-	if c, ok := byName["network"]; ok {
-		if c.Result != ResultFail {
-			t.Errorf("network: got %s, want FAIL (no CA cert) — %s", c.Result, c.Message)
-		}
-	} else {
-		t.Error("missing check network")
+	// Render the report — basic shape check.
+	out := rep.Print()
+	if !strings.Contains(out, "PASS") {
+		t.Errorf("expected PASS in output, got: %s", out)
+	}
+	if !strings.Contains(out, "WARN") {
+		t.Errorf("expected WARN in output, got: %s", out)
+	}
+	if !strings.Contains(out, "FAIL") {
+		t.Errorf("expected FAIL in output, got: %s", out)
 	}
 }
 
 // TestRunWithCAAndServerCert covers the happy path: CA + server cert
-// installed → all cert checks PASS, db PASS, network WARN (no peers).
+// installed → all cert checks PASS.
 func TestRunWithCAAndServerCert(t *testing.T) {
 	dir := t.TempDir()
 	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
 
+	// Bootstrap CA.
 	if _, err := security.CAInit(dir, "test-ca"); err != nil {
 		t.Fatalf("CAInit: %v", err)
 	}
@@ -85,6 +63,7 @@ func TestRunWithCAAndServerCert(t *testing.T) {
 	if err != nil {
 		t.Fatalf("LoadCA: %v", err)
 	}
+	// Generate + sign server cert.
 	keyPEM, csrPEM, err := security.GenerateCSR("test-server", []string{"localhost", "127.0.0.1"})
 	if err != nil {
 		t.Fatalf("GenerateCSR: %v", err)
@@ -101,392 +80,13 @@ func TestRunWithCAAndServerCert(t *testing.T) {
 	}
 
 	rep := Run(context.Background())
-	byName := make(map[string]CheckResult, len(rep.Checks))
+	// The cert-related checks should be PASS; the network/db stubs WARN.
 	for _, c := range rep.Checks {
-		byName[c.Name] = c
-	}
-
-	for _, name := range []string{"cert.ca", "cert.server", "cert.expiry", "cert.fingerprint", "db"} {
-		c, ok := byName[name]
-		if !ok {
-			t.Errorf("missing check %s", name)
-			continue
-		}
-		if c.Result != ResultPass {
-			t.Errorf("%s: got %s, want PASS — %s", name, c.Result, c.Message)
-		}
-	}
-
-	if c, ok := byName["network"]; ok {
-		if c.Result != ResultWarn {
-			t.Errorf("network: got %s, want WARN (no peers) — %s", c.Result, c.Message)
-		}
-	}
-}
-
-// TestDBCheck_IntegrityOK verifies the DB check passes on a fresh
-// database with migrations applied.
-func TestDBCheck_IntegrityOK(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
-
-	db, err := store.Open(filepath.Join(dir, "orca.db"))
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-
-	c := DB()
-	r, msg := c.Run(context.Background())
-	if r != ResultPass {
-		t.Errorf("DB check: got %s, want PASS — %s", r, msg)
-	}
-	if !strings.Contains(msg, "migrations up to") {
-		t.Errorf("DB check message should contain migration version, got: %s", msg)
-	}
-}
-
-// TestNetworkCheck_NoPeers verifies the network check returns WARN
-// when no peers are registered.
-func TestNetworkCheck_NoPeers(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
-
-	// Create a CA + server cert so the network check can build a client.
-	if _, err := security.CAInit(dir, "test-ca"); err != nil {
-		t.Fatalf("CAInit: %v", err)
-	}
-	ca, _ := security.LoadCA(dir)
-	keyPEM, csrPEM, _ := security.GenerateCSR("test-server", []string{"localhost"})
-	certPEM, _ := ca.SignCSR(csrPEM)
-	_ = security.WriteCert(dir+"/server.crt", certPEM)
-	_ = security.WriteKey(dir+"/server.key", keyPEM)
-
-	c := Network()
-	r, msg := c.Run(context.Background())
-	if r != ResultWarn {
-		t.Errorf("Network check: got %s, want WARN — %s", r, msg)
-	}
-	if !strings.Contains(msg, "no peers") {
-		t.Errorf("Network check message should mention no peers, got: %s", msg)
-	}
-}
-
-// TestNetworkCheck_PeerUnreachable verifies the network check returns
-// FAIL when a registered peer is not reachable.
-func TestNetworkCheck_PeerUnreachable(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
-
-	// Create a CA + server cert.
-	if _, err := security.CAInit(dir, "test-ca"); err != nil {
-		t.Fatalf("CAInit: %v", err)
-	}
-	ca, _ := security.LoadCA(dir)
-	keyPEM, csrPEM, _ := security.GenerateCSR("test-server", []string{"localhost"})
-	certPEM, _ := ca.SignCSR(csrPEM)
-	_ = security.WriteCert(dir+"/server.crt", certPEM)
-	_ = security.WriteKey(dir+"/server.key", keyPEM)
-
-	// Insert a peer node with an unreachable address.
-	db, err := store.Open(filepath.Join(dir, "orca.db"))
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-	repo := store.NewNodeRepo(db)
-	_ = repo.Insert(context.Background(), &model.Node{
-		ID: "dead-peer", Name: "dead", Address: "127.0.0.1:1",
-		State: model.NodeStateReady, JoinedAt: time.Now().UTC(), LastSeen: time.Now().UTC(),
-	})
-
-	c := Network()
-	r, msg := c.Run(context.Background())
-	if r != ResultFail {
-		t.Errorf("Network check: got %s, want FAIL — %s", r, msg)
-	}
-	if !strings.Contains(msg, "dead") {
-		t.Errorf("Network check message should mention the dead peer, got: %s", msg)
-	}
-}
-
-// TestNetworkCheck_NoCert verifies the network check returns FAIL
-// when no CA cert is installed.
-func TestNetworkCheck_NoCert(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
-
-	c := Network()
-	r, msg := c.Run(context.Background())
-	if r != ResultFail {
-		t.Errorf("Network check: got %s, want FAIL — %s", r, msg)
-	}
-	if !strings.Contains(msg, "CA cert missing") {
-		t.Errorf("Network check message should mention missing CA, got: %s", msg)
-	}
-}
-
-// TestRenderReport verifies the report output format.
-func TestRenderReport(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
-
-	rep := Run(context.Background())
-	out := rep.Print()
-	if !strings.Contains(out, "PASS") {
-		t.Errorf("expected PASS in output, got: %s", out)
-	}
-	if !strings.Contains(out, "WARN") {
-		t.Errorf("expected WARN in output, got: %s", out)
-	}
-	if !strings.Contains(out, "FAIL") {
-		t.Errorf("expected FAIL in output, got: %s", out)
-	}
-}
-
-// TestOSCheck_MissingLocalhostNode verifies the OS check returns FAIL
-// when no localhost node is registered.
-func TestOSCheck_MissingLocalhostNode(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
-
-	// Open the DB to apply migrations but insert no nodes.
-	db, err := store.Open(filepath.Join(dir, "orca.db"))
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	db.Close()
-
-	c := OS()
-	r, msg := c.Run(context.Background())
-	if r != ResultFail {
-		t.Errorf("OS check: got %s, want FAIL — %s", r, msg)
-	}
-	if !strings.Contains(msg, "no localhost node") {
-		t.Errorf("OS check message should mention missing localhost node, got: %s", msg)
-	}
-}
-
-// TestOSCheck_Match verifies the OS check returns PASS when the stored
-// localhost node's os matches the detected OS.
-func TestOSCheck_Match(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
-
-	db, err := store.Open(filepath.Join(dir, "orca.db"))
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-	repo := store.NewNodeRepo(db)
-
-	// Insert a localhost node with the currently-detected OS.
-	detected := osdetect.Detect()
-	if err := repo.Insert(context.Background(), &model.Node{
-		ID: "os-match-1", Name: "localhost", Address: "localhost:8443",
-		State: model.NodeStateReady, JoinedAt: time.Now().UTC(), LastSeen: time.Now().UTC(),
-		Kind: "localhost", OS: detected,
-	}); err != nil {
-		t.Fatalf("insert: %v", err)
-	}
-
-	c := OS()
-	r, msg := c.Run(context.Background())
-	if r != ResultPass {
-		t.Errorf("OS check: got %s, want PASS — %s", r, msg)
-	}
-	if !strings.Contains(msg, detected) {
-		t.Errorf("OS check message should contain %s, got: %s", detected, msg)
-	}
-}
-
-// TestOSCheck_Drift verifies the OS check returns WARN when the stored
-// os differs from the detected os.
-func TestOSCheck_Drift(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
-
-	db, err := store.Open(filepath.Join(dir, "orca.db"))
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-	repo := store.NewNodeRepo(db)
-
-	// Insert a localhost node with a deliberately wrong OS.
-	if err := repo.Insert(context.Background(), &model.Node{
-		ID: "os-drift-1", Name: "localhost", Address: "localhost:8443",
-		State: model.NodeStateReady, JoinedAt: time.Now().UTC(), LastSeen: time.Now().UTC(),
-		Kind: "localhost", OS: "debian",
-	}); err != nil {
-		t.Fatalf("insert: %v", err)
-	}
-
-	c := OS()
-	r, msg := c.Run(context.Background())
-	if r != ResultWarn {
-		t.Errorf("OS check: got %s, want WARN — %s", r, msg)
-	}
-	if !strings.Contains(msg, "drift") {
-		t.Errorf("OS check message should mention drift, got: %s", msg)
-	}
-}
-
-// TestProxmoxCheck_NoProxmoxNodes verifies the proxmox check returns
-// WARN when no proxmox nodes are registered.
-func TestProxmoxCheck_NoProxmoxNodes(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
-
-	db, err := store.Open(filepath.Join(dir, "orca.db"))
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-
-	c := Proxmox()
-	r, msg := c.Run(context.Background())
-	if r != ResultWarn {
-		t.Errorf("Proxmox check: got %s, want WARN — %s", r, msg)
-	}
-	if !strings.Contains(msg, "no proxmox nodes") {
-		t.Errorf("Proxmox check message should mention no proxmox nodes, got: %s", msg)
-	}
-}
-
-// TestProxmoxCheck_UnreachableNode verifies the proxmox check returns
-// FAIL when a proxmox node is registered but unreachable (no SSH key
-// or host down). We insert a proxmox node with an unreachable address;
-// the SSH dial will fail (no SSH key file → error).
-func TestProxmoxCheck_UnreachableNode(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-	t.Setenv("ORCA_DB", filepath.Join(dir, "orca.db"))
-
-	db, err := store.Open(filepath.Join(dir, "orca.db"))
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	defer db.Close()
-	repo := store.NewNodeRepo(db)
-
-	// Insert a proxmox node. The SSH probe will fail because no SSH
-	// key exists in the test namespace dir.
-	if err := repo.Insert(context.Background(), &model.Node{
-		ID: "px-1", Name: "10.0.0.99", Address: "10.0.0.99:8443",
-		State: model.NodeStateReady, JoinedAt: time.Now().UTC(), LastSeen: time.Now().UTC(),
-		Kind: "proxmox", OS: "pve",
-	}); err != nil {
-		t.Fatalf("insert: %v", err)
-	}
-
-	c := Proxmox()
-	r, msg := c.Run(context.Background())
-	if r != ResultFail {
-		t.Errorf("Proxmox check: got %s, want FAIL — %s", r, msg)
-	}
-	if !strings.Contains(msg, "10.0.0.99") {
-		t.Errorf("Proxmox check message should mention the node, got: %s", msg)
-	}
-}
-
-func init() {
-	// Suppress slog noise during tests.
-	_ = os.Setenv("ORCA_LOG_LEVEL", "error")
-}
-
-// TestProxmoxCheck_FirstConnectCapturesKey verifies that the doctor
-// proxmox probe uses the shared TOFU capture-fix wrapper
-// (proxmox.TOFUHostKeyCallback), which captures the host key on first
-// connect instead of failing with KeyError{Want:[]} (T02.9 — GRILL
-// condition #2: doctor parity with bootstrap). Before T02.9, the bare
-// knownhosts.New callback returned KeyError{Want:[]} on a missing
-// entry and the doctor probe reported FAIL even though the node had
-// joined successfully — the v0.6 ship-defect.
-//
-// We exercise the exact wrapper doctor.go calls against a real SSH
-// server on an ephemeral port (the probe hardcodes :22, which we
-// cannot bind in CI). This proves the doctor's chosen callback captures
-// on first connect rather than failing — the parity guarantee.
-func TestProxmoxCheck_FirstConnectCapturesKey(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("ORCA_HOME", dir)
-
-	// Empty known_hosts (first-connect scenario).
-	if err := os.WriteFile(certpaths.KnownHostsPath(), []byte{}, 0o600); err != nil {
-		t.Fatalf("create known_hosts: %v", err)
-	}
-
-	// Start a fake SSH server on an ephemeral port whose host key is
-	// NOT yet in known_hosts.
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-	defer ln.Close()
-	_, srvPriv, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		t.Fatalf("ed25519 gen: %v", err)
-	}
-	hostSigner, err := ssh.NewSignerFromKey(srvPriv)
-	if err != nil {
-		t.Fatalf("ssh signer: %v", err)
-	}
-	srvConfig := &ssh.ServerConfig{NoClientAuth: true}
-	srvConfig.AddHostKey(hostSigner)
-	go func() {
-		for {
-			nconn, err := ln.Accept()
-			if err != nil {
-				return
+		switch c.Name {
+		case "cert.ca", "cert.server", "cert.expiry", "cert.fingerprint":
+			if c.Result != ResultPass {
+				t.Errorf("%s: got %s, want PASS — %s", c.Name, c.Result, c.Message)
 			}
-			go func(c net.Conn) {
-				defer c.Close()
-				_, chans, reqs, err := ssh.NewServerConn(c, srvConfig)
-				if err != nil {
-					return
-				}
-				go ssh.DiscardRequests(reqs)
-				for nc := range chans {
-					nc.Reject(ssh.UnknownChannelType, "none")
-				}
-			}(nconn)
 		}
-	}()
-
-	sshAddr := ln.Addr().String()
-	host, _, _ := net.SplitHostPort(sshAddr)
-
-	// The doctor probe now builds its HostKeyCallback via
-	// proxmox.TOFUHostKeyCallback(sshAddr, nil). On first connect
-	// (empty known_hosts) this must capture + write the key and return
-	// nil, NOT a KeyError — the v0.6 ship-defect fix.
-	cb, err := proxmox.TOFUHostKeyCallback(sshAddr, nil)
-	if err != nil {
-		t.Fatalf("TOFUHostKeyCallback: %v", err)
-	}
-	if err := cb(sshAddr, &net.TCPAddr{IP: net.ParseIP(host), Port: 22}, hostSigner.PublicKey()); err != nil {
-		t.Fatalf("first-connect doctor callback should capture (not fail): %v", err)
-	}
-
-	// The captured key must now be in known_hosts.
-	data, err := os.ReadFile(certpaths.KnownHostsPath())
-	if err != nil {
-		t.Fatalf("read known_hosts: %v", err)
-	}
-	if len(data) == 0 {
-		t.Error("known_hosts is empty — doctor capture-fix did not write the key (T02.9)")
-	}
-	if !strings.Contains(string(data), hostSigner.PublicKey().Type()) {
-		t.Errorf("known_hosts missing the captured host key type: %s", data)
 	}
 }

internal/engine/dispatcher_test.go

@@ -1,304 +0,0 @@
-package engine
-
-import (
-	"context"
-	"errors"
-	"path/filepath"
-	"testing"
-
-	"git.cloudinit.dev/coreci/orca/internal/store"
-)
-
-type mockExecutor struct {
-	submitFn  func(ctx context.Context, spec []byte) (string, error)
-	statusFn  func(ctx context.Context, jobID string) (string, error)
-	submitted bool
-}
-
-func (m *mockExecutor) Submit(ctx context.Context, spec []byte) (string, error) {
-	m.submitted = true
-	if m.submitFn != nil {
-		return m.submitFn(ctx, spec)
-	}
-	return "mock-job-id", nil
-}
-
-func (m *mockExecutor) Status(ctx context.Context, jobID string) (string, error) {
-	if m.statusFn != nil {
-		return m.statusFn(ctx, jobID)
-	}
-	return "complete", nil
-}
-
-func newTestDispatcher(t *testing.T, exec LocalExecutor) (*Dispatcher, *store.CapacityRepo, func()) {
-	t.Helper()
-	path := filepath.Join(t.TempDir(), "test.db")
-	db, err := store.Open(path)
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	capRepo := store.NewCapacityRepo(db)
-	peers := NewPeerRegistry()
-	d := NewDispatcher(nil, capRepo, peers, exec)
-	return d, capRepo, func() { _ = db.Close() }
-}
-
-func TestDispatcher_Submit_EmptySpec(t *testing.T) {
-	d, _, cleanup := newTestDispatcher(t, &mockExecutor{})
-	defer cleanup()
-	_, _, err := d.Submit(context.Background(), "", nil, "")
-	if err == nil {
-		t.Fatal("Submit: expected error for empty spec, got nil")
-	}
-}
-
-func TestDispatcher_Submit_IdempotencyHit(t *testing.T) {
-	exec := &mockExecutor{}
-	d, _, cleanup := newTestDispatcher(t, exec)
-	defer cleanup()
-
-	d.Dedupe().Put("key-1", "cached-job-id")
-	spec := []byte(`{"cpu_millicores":100,"memory_mib":64,"disk_mib":64}`)
-	jobID, nodeID, err := d.Submit(context.Background(), "", spec, "key-1")
-	if err != nil {
-		t.Fatalf("Submit: %v", err)
-	}
-	if jobID != "cached-job-id" {
-		t.Errorf("jobID: got %q, want cached-job-id", jobID)
-	}
-	if nodeID != "self" {
-		t.Errorf("nodeID: got %q, want self", nodeID)
-	}
-	if exec.submitted {
-		t.Error("executor was called on idempotency hit; should have been short-circuited")
-	}
-}
-
-func TestDispatcher_Submit_LocalCapacity(t *testing.T) {
-	exec := &mockExecutor{
-		submitFn: func(ctx context.Context, spec []byte) (string, error) {
-			return "local-job-id", nil
-		},
-	}
-	d, capRepo, cleanup := newTestDispatcher(t, exec)
-	defer cleanup()
-	ctx := context.Background()
-	if err := capRepo.Upsert(ctx, &store.NodeCapacity{
-		NodeID:        "self",
-		CPUMillicores: 4000,
-		MemoryMiB:     4096,
-		DiskMiB:       4096,
-	}); err != nil {
-		t.Fatalf("Upsert capacity: %v", err)
-	}
-	spec := []byte(`{"cpu_millicores":100,"memory_mib":64,"disk_mib":64}`)
-	jobID, nodeID, err := d.Submit(ctx, "", spec, "")
-	if err != nil {
-		t.Fatalf("Submit: %v", err)
-	}
-	if jobID != "local-job-id" {
-		t.Errorf("jobID: got %q, want local-job-id", jobID)
-	}
-	if nodeID != "self" {
-		t.Errorf("nodeID: got %q, want self", nodeID)
-	}
-	if !exec.submitted {
-		t.Error("executor was not called for local-capacity path")
-	}
-}
-
-func TestDispatcher_Submit_ExplicitTarget(t *testing.T) {
-	exec := &mockExecutor{}
-	d, _, cleanup := newTestDispatcher(t, exec)
-	defer cleanup()
-	spec := []byte(`{"cpu_millicores":100,"memory_mib":64,"disk_mib":64}`)
-	_, _, err := d.Submit(context.Background(), "nodeA", spec, "")
-	if err == nil {
-		t.Fatal("Submit with explicit target nodeA (no peer): expected error, got nil")
-	}
-}
-
-func TestDispatcher_Submit_NoPeers(t *testing.T) {
-	exec := &mockExecutor{}
-	d, capRepo, cleanup := newTestDispatcher(t, exec)
-	defer cleanup()
-	ctx := context.Background()
-	if err := capRepo.Upsert(ctx, &store.NodeCapacity{
-		NodeID:        "self",
-		CPUMillicores: 0,
-		MemoryMiB:     0,
-		DiskMiB:       0,
-	}); err != nil {
-		t.Fatalf("Upsert: %v", err)
-	}
-	spec := []byte(`{"cpu_millicores":1000,"memory_mib":1024,"disk_mib":1024}`)
-	_, _, err := d.Submit(ctx, "", spec, "")
-	if err == nil {
-		t.Fatal("Submit: expected error when no peers and no local capacity, got nil")
-	}
-}
-
-func TestDispatcher_LocalSubmit(t *testing.T) {
-	exec := &mockExecutor{
-		submitFn: func(ctx context.Context, spec []byte) (string, error) {
-			return "ls-job", nil
-		},
-	}
-	d, _, cleanup := newTestDispatcher(t, exec)
-	defer cleanup()
-	jobID, err := d.LocalSubmit(context.Background(), []byte(`{"command":"/bin/true"}`))
-	if err != nil {
-		t.Fatalf("LocalSubmit: %v", err)
-	}
-	if jobID != "ls-job" {
-		t.Errorf("LocalSubmit: got %q, want ls-job", jobID)
-	}
-	if !exec.submitted {
-		t.Error("LocalSubmit: executor.Submit not called")
-	}
-}
-
-func TestDispatcher_LocalStatus(t *testing.T) {
-	exec := &mockExecutor{
-		statusFn: func(ctx context.Context, jobID string) (string, error) {
-			if jobID == "known" {
-				return "running", nil
-			}
-			return "", errors.New("not found")
-		},
-	}
-	d, _, cleanup := newTestDispatcher(t, exec)
-	defer cleanup()
-	st, err := d.LocalStatus(context.Background(), "known")
-	if err != nil {
-		t.Fatalf("LocalStatus: %v", err)
-	}
-	if st != "running" {
-		t.Errorf("LocalStatus: got %q, want running", st)
-	}
-	if _, err := d.LocalStatus(context.Background(), "missing"); err == nil {
-		t.Error("LocalStatus: expected error for missing job, got nil")
-	}
-}
-
-func TestDispatcher_LocalSubmit_NilExecutor(t *testing.T) {
-	d := NewDispatcher(nil, nil, NewPeerRegistry(), nil)
-	if _, err := d.LocalSubmit(context.Background(), []byte(`{}`)); err == nil {
-		t.Error("LocalSubmit with nil executor: expected error, got nil")
-	}
-	if _, err := d.LocalStatus(context.Background(), "x"); err == nil {
-		t.Error("LocalStatus with nil executor: expected error, got nil")
-	}
-}
-
-func TestParseInlineSpec(t *testing.T) {
-	spec, err := parseInlineSpec([]byte(`{"cpu_millicores":500,"memory_mib":256,"disk_mib":128}`))
-	if err != nil {
-		t.Fatalf("parseInlineSpec: %v", err)
-	}
-	if spec.CPUMillicores != 500 || spec.MemoryMiB != 256 || spec.DiskMiB != 128 {
-		t.Errorf("parseInlineSpec: got %+v, want cpu=500 mem=256 disk=128", spec)
-	}
-	if _, err := parseInlineSpec([]byte(`{bad json`)); err == nil {
-		t.Fatal("parseInlineSpec: expected error for malformed JSON, got nil")
-	}
-}
-
-func TestDispatcher_Submit_BadSpec(t *testing.T) {
-	d, _, cleanup := newTestDispatcher(t, &mockExecutor{})
-	defer cleanup()
-	_, _, err := d.Submit(context.Background(), "", []byte(`{bad json`), "")
-	if err == nil {
-		t.Fatal("expected error for malformed spec")
-	}
-}
-
-func TestDispatcher_Submit_ExplicitTargetNoPeerRegistry(t *testing.T) {
-	d := NewDispatcher(nil, nil, nil, &mockExecutor{})
-	_, _, err := d.Submit(context.Background(), "nodeX", []byte(`{"cpu_millicores":100,"memory_mib":64,"disk_mib":64}`), "")
-	if err == nil {
-		t.Fatal("expected error for explicit target with no peer registry")
-	}
-}
-
-func TestDispatcher_Submit_ExplicitTargetPeerNotFound(t *testing.T) {
-	d, _, cleanup := newTestDispatcher(t, &mockExecutor{})
-	defer cleanup()
-	_, _, err := d.Submit(context.Background(), "ghost", []byte(`{"cpu_millicores":100,"memory_mib":64,"disk_mib":64}`), "")
-	if err == nil {
-		t.Fatal("expected error for target not in registry")
-	}
-}
-
-func TestDispatcher_Submit_PickPeerMissingCA(t *testing.T) {
-	exec := &mockExecutor{}
-	d, capRepo, cleanup := newTestDispatcher(t, exec)
-	defer cleanup()
-	ctx := context.Background()
-	if err := capRepo.Upsert(ctx, &store.NodeCapacity{
-		NodeID:        "self",
-		CPUMillicores: 0,
-		MemoryMiB:     0,
-		DiskMiB:       0,
-	}); err != nil {
-		t.Fatalf("Upsert: %v", err)
-	}
-	if err := d.peers.Add(&Peer{
-		NodeID:   "peer-1",
-		Address:  "127.0.0.1:1",
-		Capacity: &store.NodeCapacity{NodeID: "peer-1", CPUMillicores: 4000, MemoryMiB: 4096, DiskMiB: 4096},
-	}); err != nil {
-		t.Fatalf("Add peer: %v", err)
-	}
-	spec := []byte(`{"cpu_millicores":100,"memory_mib":64,"disk_mib":64}`)
-	_, _, err := d.Submit(ctx, "", spec, "idem-peer-1")
-	if err == nil {
-		t.Fatal("expected error (peer missing CA/servername)")
-	}
-}
-
-func TestDispatcher_Submit_NoPeerRegistry(t *testing.T) {
-	d := NewDispatcher(nil, nil, nil, &mockExecutor{})
-	spec := []byte(`{"cpu_millicores":1000,"memory_mib":1024,"disk_mib":1024}`)
-	_, _, err := d.Submit(context.Background(), "", spec, "")
-	if err == nil {
-		t.Fatal("expected error for no peer registry and no capacity repo")
-	}
-}
-
-func TestDispatcher_Submit_NilCapacityFallsThrough(t *testing.T) {
-	exec := &mockExecutor{}
-	d := NewDispatcher(nil, nil, NewPeerRegistry(), exec)
-	spec := []byte(`{"cpu_millicores":1000,"memory_mib":1024,"disk_mib":1024}`)
-	_, _, err := d.Submit(context.Background(), "", spec, "")
-	if err == nil {
-		t.Fatal("expected error when capacity repo is nil and no peers")
-	}
-}
-
-func TestDispatcher_Submit_AllPeersFailsPickNode(t *testing.T) {
-	exec := &mockExecutor{}
-	d, capRepo, cleanup := newTestDispatcher(t, exec)
-	defer cleanup()
-	ctx := context.Background()
-	if err := capRepo.Upsert(ctx, &store.NodeCapacity{
-		NodeID:        "self",
-		CPUMillicores: 0,
-		MemoryMiB:     0,
-		DiskMiB:       0,
-	}); err != nil {
-		t.Fatalf("Upsert: %v", err)
-	}
-	if err := d.peers.Add(&Peer{
-		NodeID:   "peer-tiny",
-		Address:  "127.0.0.1:1",
-		Capacity: &store.NodeCapacity{NodeID: "peer-tiny", CPUMillicores: 10, MemoryMiB: 10, DiskMiB: 10},
-	}); err != nil {
-		t.Fatalf("Add peer: %v", err)
-	}
-	spec := []byte(`{"cpu_millicores":1000,"memory_mib":1024,"disk_mib":1024}`)
-	_, _, err := d.Submit(ctx, "", spec, "")
-	if err == nil {
-		t.Fatal("expected error when no peer can fit")
-	}
-}

internal/engine/executor_test.go

@@ -1,145 +0,0 @@
-package engine
-
-import (
-	"context"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-
-	"git.cloudinit.dev/coreci/orca/internal/model"
-	"git.cloudinit.dev/coreci/orca/internal/store"
-)
-
-func newTestExecutor(t *testing.T) (*Executor, func()) {
-	t.Helper()
-	path := filepath.Join(t.TempDir(), "test.db")
-	db, err := store.Open(path)
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	ex := NewExecutor(store.NewJobRepo(db), store.NewTaskRepo(db), nil)
-	return ex, func() { _ = db.Close() }
-}
-
-func TestExecutor_Submit_Success(t *testing.T) {
-	ex, cleanup := newTestExecutor(t)
-	defer cleanup()
-	ctx := context.Background()
-	spec := []byte(`{"command":"/bin/echo","args":["hello"]}`)
-	jobID, err := ex.Submit(ctx, spec)
-	if err != nil {
-		t.Fatalf("Submit: %v", err)
-	}
-	if jobID == "" {
-		t.Fatal("Submit: empty jobID")
-	}
-	status, err := ex.Status(ctx, jobID)
-	if err != nil {
-		t.Fatalf("Status: %v", err)
-	}
-	if status != string(model.JobStatusComplete) {
-		t.Errorf("Status: got %q, want %q", status, model.JobStatusComplete)
-	}
-}
-
-func TestExecutor_Submit_MissingCommand(t *testing.T) {
-	ex, cleanup := newTestExecutor(t)
-	defer cleanup()
-	_, err := ex.Submit(context.Background(), []byte(`{"name":"x"}`))
-	if err == nil {
-		t.Fatal("Submit: expected error for missing command, got nil")
-	}
-}
-
-func TestExecutor_Submit_MalformedJSON(t *testing.T) {
-	ex, cleanup := newTestExecutor(t)
-	defer cleanup()
-	_, err := ex.Submit(context.Background(), []byte(`{bad json`))
-	if err == nil {
-		t.Fatal("Submit: expected error for malformed JSON, got nil")
-	}
-}
-
-func TestExecutor_Submit_FailingCommand(t *testing.T) {
-	ex, cleanup := newTestExecutor(t)
-	defer cleanup()
-	ctx := context.Background()
-	jobID, err := ex.Submit(ctx, []byte(`{"command":"/bin/false"}`))
-	if err == nil {
-		t.Fatal("Submit failing command: expected error, got nil")
-	}
-	if jobID == "" {
-		t.Fatal("Submit failing command: empty jobID")
-	}
-	status, err := ex.Status(ctx, jobID)
-	if err != nil {
-		t.Fatalf("Status: %v", err)
-	}
-	if status != string(model.JobStatusFailed) {
-		t.Errorf("Status: got %q, want %q", status, model.JobStatusFailed)
-	}
-}
-
-func TestExecutor_Status_NotFound(t *testing.T) {
-	ex, cleanup := newTestExecutor(t)
-	defer cleanup()
-	_, err := ex.Status(context.Background(), "nonexistent-job-id")
-	if err == nil {
-		t.Fatal("Status: expected error for missing job, got nil")
-	}
-}
-
-func TestExecutor_Run_Success(t *testing.T) {
-	ex, cleanup := newTestExecutor(t)
-	defer cleanup()
-	ctx := context.Background()
-	job := &model.Job{
-		ID:     uuid.NewString(),
-		Name:   "run-success",
-		Spec:   "{}",
-		Status: model.JobStatusPending,
-	}
-	specs := []TaskSpec{{Name: "echo", Command: "/bin/echo", Args: []string{"hi"}}}
-	if err := ex.Run(ctx, job, specs); err != nil {
-		t.Fatalf("Run: %v", err)
-	}
-	got, err := ex.Status(ctx, job.ID)
-	if err != nil {
-		t.Fatalf("Status: %v", err)
-	}
-	if got != string(model.JobStatusComplete) {
-		t.Errorf("Status: got %q, want %q", got, model.JobStatusComplete)
-	}
-}
-
-func TestExecutor_Run_ContextCancel(t *testing.T) {
-	ex, cleanup := newTestExecutor(t)
-	defer cleanup()
-	ctx, cancel := context.WithCancel(context.Background())
-	job := &model.Job{
-		ID:     uuid.NewString(),
-		Name:   "run-cancel",
-		Spec:   "{}",
-		Status: model.JobStatusPending,
-	}
-	specs := []TaskSpec{{Name: "sleep", Command: "/bin/sleep", Args: []string{"10"}}}
-
-	go func() {
-		time.Sleep(100 * time.Millisecond)
-		cancel()
-	}()
-
-	err := ex.Run(ctx, job, specs)
-	if err == nil {
-		t.Fatal("Run: expected error after context cancel, got nil")
-	}
-	status, sErr := ex.Status(context.Background(), job.ID)
-	if sErr != nil {
-		t.Fatalf("Status after cancel: %v", sErr)
-	}
-	if status == string(model.JobStatusComplete) {
-		t.Errorf("Status: got %q, want not complete (task should have been killed)", status)
-	}
-}

internal/engine/peer_test.go

@@ -1,136 +0,0 @@
-package engine
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"git.cloudinit.dev/coreci/orca/internal/store"
-)
-
-func TestPeerRegistry_AddAndGet(t *testing.T) {
-	r := NewPeerRegistry()
-	p := &Peer{
-		NodeID:     "node-1",
-		Address:    "localhost:8443",
-		ServerName: "node-1.orca",
-		CAPath:     "/etc/orca/ca.pem",
-	}
-	if err := r.Add(p); err != nil {
-		t.Fatalf("Add: %v", err)
-	}
-	got := r.Get("node-1")
-	if got == nil {
-		t.Fatal("Get: returned nil after Add")
-	}
-	if got.NodeID != "node-1" || got.Address != "localhost:8443" ||
-		got.ServerName != "node-1.orca" || got.CAPath != "/etc/orca/ca.pem" {
-		t.Errorf("Get: fields mismatch: %+v", got)
-	}
-}
-
-func TestPeerRegistry_AddNil(t *testing.T) {
-	r := NewPeerRegistry()
-	if err := r.Add(nil); err == nil {
-		t.Fatal("Add(nil): expected error, got nil")
-	}
-}
-
-func TestPeerRegistry_AddMissingID(t *testing.T) {
-	r := NewPeerRegistry()
-	if err := r.Add(&Peer{Address: "a"}); err == nil {
-		t.Fatal("Add(empty NodeID): expected error, got nil")
-	}
-}
-
-func TestPeerRegistry_Remove(t *testing.T) {
-	r := NewPeerRegistry()
-	p := &Peer{NodeID: "node-r", Address: "a"}
-	if err := r.Add(p); err != nil {
-		t.Fatalf("Add: %v", err)
-	}
-	if !r.Remove("node-r") {
-		t.Fatal("Remove: returned false for existing peer")
-	}
-	if got := r.Get("node-r"); got != nil {
-		t.Errorf("Get after Remove: want nil, got %+v", got)
-	}
-	if r.Remove("node-r") {
-		t.Error("Remove second time: want false, got true")
-	}
-}
-
-func TestPeerRegistry_All(t *testing.T) {
-	r := NewPeerRegistry()
-	for _, id := range []string{"node-c", "node-a", "node-b"} {
-		if err := r.Add(&Peer{NodeID: id, Address: "a"}); err != nil {
-			t.Fatalf("Add %s: %v", id, err)
-		}
-	}
-	got, err := r.All(context.Background())
-	if err != nil {
-		t.Fatalf("All: %v", err)
-	}
-	if len(got) != 3 {
-		t.Fatalf("All: got %d, want 3", len(got))
-	}
-	want := []string{"node-a", "node-b", "node-c"}
-	for i, w := range want {
-		if got[i].NodeID != w {
-			t.Errorf("All[%d]: got %s, want %s (not sorted by NodeID)", i, got[i].NodeID, w)
-		}
-	}
-}
-
-func TestPeerRegistry_All_Empty(t *testing.T) {
-	r := NewPeerRegistry()
-	got, err := r.All(context.Background())
-	if err != nil {
-		t.Fatalf("All on empty: %v", err)
-	}
-	if len(got) != 0 {
-		t.Errorf("All on empty: got %d, want 0", len(got))
-	}
-}
-
-func TestPeerRegistry_Len(t *testing.T) {
-	r := NewPeerRegistry()
-	if r.Len() != 0 {
-		t.Errorf("Len on empty: got %d, want 0", r.Len())
-	}
-	if err := r.Add(&Peer{NodeID: "n1", Address: "a"}); err != nil {
-		t.Fatalf("Add n1: %v", err)
-	}
-	if err := r.Add(&Peer{NodeID: "n2", Address: "a"}); err != nil {
-		t.Fatalf("Add n2: %v", err)
-	}
-	if r.Len() != 2 {
-		t.Errorf("Len: got %d, want 2", r.Len())
-	}
-}
-
-func TestPeerRegistry_UpdateLastSeen(t *testing.T) {
-	r := NewPeerRegistry()
-	old := time.Now().Add(-1 * time.Hour).UTC()
-	p := &Peer{
-		NodeID:   "node-u",
-		Address:  "a",
-		LastSeen: old,
-		Capacity: &store.NodeCapacity{NodeID: "node-u", CPUMillicores: 1000, MemoryMiB: 1024, DiskMiB: 1024},
-	}
-	if err := r.Add(p); err != nil {
-		t.Fatalf("Add: %v", err)
-	}
-	r.UpdateLastSeen("node-u")
-	got := r.Get("node-u")
-	if got == nil {
-		t.Fatal("Get: nil after UpdateLastSeen")
-	}
-	if !got.LastSeen.After(old) {
-		t.Errorf("UpdateLastSeen: LastSeen not bumped; old=%v now=%v", old, got.LastSeen)
-	}
-	if time.Since(got.LastSeen) > 5*time.Second {
-		t.Errorf("UpdateLastSeen: LastSeen not recent: %v", got.LastSeen)
-	}
-	r.UpdateLastSeen("nonexistent")
-}

internal/engine/registry_test.go

@@ -1,229 +0,0 @@
-package engine
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"log/slog"
-	"path/filepath"
-	"testing"
-
-	"git.cloudinit.dev/coreci/orca/internal/model"
-	"git.cloudinit.dev/coreci/orca/internal/store"
-)
-
-func newRegistryTestDB(t *testing.T) (*store.NodeRepo, *store.AuditRepo, *store.AuditRepo, func()) {
-	t.Helper()
-	path := filepath.Join(t.TempDir(), "test.db")
-	db, err := store.Open(path)
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	return store.NewNodeRepo(db), store.NewAuditRepo(db), store.NewAuditRepo(db), func() { _ = db.Close() }
-}
-
-func TestNewNodeRegistry_NilLogger(t *testing.T) {
-	nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
-	defer cleanup()
-	audit := NewAudit(auditRepo, nil)
-	r := NewNodeRegistry(nodeRepo, audit, nil)
-	if r == nil {
-		t.Fatal("NewNodeRegistry returned nil")
-	}
-}
-
-func TestNodeRegistry_Join_Success(t *testing.T) {
-	nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
-	defer cleanup()
-	var buf bytes.Buffer
-	audit := NewAudit(auditRepo, slog.New(slog.NewTextHandler(&buf, nil)))
-	r := NewNodeRegistry(nodeRepo, audit, slog.New(slog.NewTextHandler(&buf, nil)))
-
-	ctx := context.Background()
-	n := &model.Node{
-		ID:      "node-join-1",
-		Name:    "pve-1",
-		Address: "10.0.0.1:8443",
-		State:   model.NodeStateReady,
-	}
-	if err := r.Join(ctx, n); err != nil {
-		t.Fatalf("Join: %v", err)
-	}
-	got, err := r.Get(ctx, "node-join-1")
-	if err != nil {
-		t.Fatalf("Get after Join: %v", err)
-	}
-	if got.Name != "pve-1" {
-		t.Errorf("Get: Name = %q, want pve-1", got.Name)
-	}
-}
-
-func TestNodeRegistry_Join_Duplicate(t *testing.T) {
-	nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
-	defer cleanup()
-	audit := NewAudit(auditRepo, nil)
-	r := NewNodeRegistry(nodeRepo, audit, nil)
-
-	ctx := context.Background()
-	n := &model.Node{ID: "dup-1", Name: "n1", Address: "a:1", State: model.NodeStateReady}
-	if err := r.Join(ctx, n); err != nil {
-		t.Fatalf("first Join: %v", err)
-	}
-	err := r.Join(ctx, n)
-	if err == nil {
-		t.Fatal("expected error for duplicate Join")
-	}
-}
-
-func TestNodeRegistry_Leave_Success(t *testing.T) {
-	nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
-	defer cleanup()
-	audit := NewAudit(auditRepo, nil)
-	r := NewNodeRegistry(nodeRepo, audit, nil)
-
-	ctx := context.Background()
-	n := &model.Node{ID: "leave-1", Name: "n1", Address: "a:1", State: model.NodeStateReady}
-	if err := r.Join(ctx, n); err != nil {
-		t.Fatalf("Join: %v", err)
-	}
-	if err := r.Leave(ctx, "leave-1"); err != nil {
-		t.Fatalf("Leave: %v", err)
-	}
-	got, err := r.Get(ctx, "leave-1")
-	if err != nil {
-		t.Fatalf("Get after Leave: %v", err)
-	}
-	if got.State != model.NodeStateLeft {
-		t.Errorf("State = %q, want %q", got.State, model.NodeStateLeft)
-	}
-}
-
-func TestNodeRegistry_Leave_NotFound(t *testing.T) {
-	nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
-	defer cleanup()
-	audit := NewAudit(auditRepo, nil)
-	r := NewNodeRegistry(nodeRepo, audit, nil)
-	err := r.Leave(context.Background(), "nonexistent")
-	if err == nil {
-		t.Fatal("expected error for Leave on missing node")
-	}
-}
-
-func TestNodeRegistry_Forget_Success(t *testing.T) {
-	nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
-	defer cleanup()
-	audit := NewAudit(auditRepo, nil)
-	r := NewNodeRegistry(nodeRepo, audit, nil)
-
-	ctx := context.Background()
-	n := &model.Node{ID: "forget-1", Name: "n1", Address: "a:1", State: model.NodeStateReady}
-	if err := r.Join(ctx, n); err != nil {
-		t.Fatalf("Join: %v", err)
-	}
-	if err := r.Forget(ctx, "forget-1"); err != nil {
-		t.Fatalf("Forget: %v", err)
-	}
-	if _, err := r.Get(ctx, "forget-1"); err == nil {
-		t.Error("expected error after Forget")
-	}
-}
-
-func TestNodeRegistry_Forget_NotFound(t *testing.T) {
-	nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
-	defer cleanup()
-	audit := NewAudit(auditRepo, nil)
-	r := NewNodeRegistry(nodeRepo, audit, nil)
-	err := r.Forget(context.Background(), "nonexistent")
-	if err == nil {
-		t.Fatal("expected error for Forget on missing node")
-	}
-}
-
-func TestNodeRegistry_List(t *testing.T) {
-	nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
-	defer cleanup()
-	audit := NewAudit(auditRepo, nil)
-	r := NewNodeRegistry(nodeRepo, audit, nil)
-
-	ctx := context.Background()
-	if got, err := r.List(ctx); err != nil {
-		t.Fatalf("List empty: %v", err)
-	} else if len(got) != 0 {
-		t.Errorf("List empty: got %d, want 0", len(got))
-	}
-	for _, id := range []string{"n3", "n1", "n2"} {
-		if err := r.Join(ctx, &model.Node{ID: id, Name: id, Address: "a:1", State: model.NodeStateReady}); err != nil {
-			t.Fatalf("Join %s: %v", id, err)
-		}
-	}
-	got, err := r.List(ctx)
-	if err != nil {
-		t.Fatalf("List: %v", err)
-	}
-	if len(got) != 3 {
-		t.Errorf("List: got %d, want 3", len(got))
-	}
-}
-
-func TestNodeRegistry_Get_NotFound(t *testing.T) {
-	nodeRepo, auditRepo, _, cleanup := newRegistryTestDB(t)
-	defer cleanup()
-	audit := NewAudit(auditRepo, nil)
-	r := NewNodeRegistry(nodeRepo, audit, nil)
-	_, err := r.Get(context.Background(), "missing")
-	if err == nil {
-		t.Fatal("expected error for Get missing")
-	}
-}
-
-func TestNewAudit_NilLogger(t *testing.T) {
-	_, auditRepo, _, cleanup := newRegistryTestDB(t)
-	defer cleanup()
-	a := NewAudit(auditRepo, nil)
-	if a == nil {
-		t.Fatal("NewAudit returned nil")
-	}
-}
-
-func TestAudit_Record_Success(t *testing.T) {
-	_, auditRepo, _, cleanup := newRegistryTestDB(t)
-	defer cleanup()
-	var buf bytes.Buffer
-	a := NewAudit(auditRepo, slog.New(slog.NewTextHandler(&buf, nil)))
-	a.Record(context.Background(), "cli", "node.join", "node-1", "success", nil, map[string]any{"host": "10.0.0.1"})
-	entries, err := auditRepo.List(context.Background(), 10)
-	if err != nil {
-		t.Fatalf("List: %v", err)
-	}
-	if len(entries) != 1 {
-		t.Fatalf("entries = %d, want 1", len(entries))
-	}
-	if entries[0].Action != "node.join" || entries[0].Result != "success" {
-		t.Errorf("entry = %+v", entries[0])
-	}
-}
-
-func TestAudit_Record_WithError(t *testing.T) {
-	_, auditRepo, _, cleanup := newRegistryTestDB(t)
-	defer cleanup()
-	var buf bytes.Buffer
-	a := NewAudit(auditRepo, slog.New(slog.NewTextHandler(&buf, nil)))
-	a.Record(context.Background(), "cli", "node.join", "node-1", "failure", errors.New("boom"), nil)
-	entries, err := auditRepo.List(context.Background(), 10)
-	if err != nil {
-		t.Fatalf("List: %v", err)
-	}
-	if len(entries) != 1 {
-		t.Fatalf("entries = %d, want 1", len(entries))
-	}
-	if entries[0].Error != "boom" {
-		t.Errorf("Error = %q, want boom", entries[0].Error)
-	}
-	if !containsStr(buf.String(), "level=WARN") {
-		t.Errorf("expected WARN level for error result, got: %s", buf.String())
-	}
-}
-
-func containsStr(s, sub string) bool {
-	return len(sub) == 0 || (len(s) >= len(sub) && (s[0:len(sub)] == sub || containsStr(s[1:], sub)))
-}

internal/engine/scheduler_test.go

@@ -1,7 +1,6 @@
 package engine
 
 import (
-	"context"
 	"testing"
 
 	"git.cloudinit.dev/coreci/orca/internal/store"
@@ -65,66 +64,3 @@ func TestJobSpecFits(t *testing.T) {
 		t.Error("Fits: should not fit (CPU too low)")
 	}
 }
-
-func TestJobSpecFits_NilCapacity(t *testing.T) {
-	spec := JobSpec{CPUMillicores: 1000}
-	if spec.Fits(nil) {
-		t.Error("Fits(nil): should be false")
-	}
-}
-
-func TestJobSpecScore_NilCapacity(t *testing.T) {
-	spec := JobSpec{CPUMillicores: 1000, MemoryMiB: 1024}
-	if got := spec.Score(nil); got != -1 {
-		t.Errorf("Score(nil) = %d, want -1", got)
-	}
-}
-
-func TestJobSpecScore_OverCapacity(t *testing.T) {
-	spec := JobSpec{CPUMillicores: 2000, MemoryMiB: 1024}
-	c := &store.NodeCapacity{CPUMillicores: 1000, MemoryMiB: 2048}
-	if got := spec.Score(c); got != -1 {
-		t.Errorf("Score over CPU = %d, want -1", got)
-	}
-	c2 := &store.NodeCapacity{CPUMillicores: 4000, MemoryMiB: 512}
-	if got := spec.Score(c2); got != -1 {
-		t.Errorf("Score over Mem = %d, want -1", got)
-	}
-}
-
-func TestJobSpecScore_Fits(t *testing.T) {
-	spec := JobSpec{CPUMillicores: 1000, MemoryMiB: 1024}
-	c := &store.NodeCapacity{CPUMillicores: 4000, MemoryMiB: 4096}
-	got := spec.Score(c)
-	want := int64((4000 - 1000) + (4096 - 1024))
-	if got != want {
-		t.Errorf("Score = %d, want %d", got, want)
-	}
-}
-
-func TestPickNode_Empty(t *testing.T) {
-	_, _, err := PickNode(JobSpec{}, nil)
-	if err == nil {
-		t.Fatal("expected error for empty capacities")
-	}
-}
-
-func TestMemLocalNode_Capacity(t *testing.T) {
-	c := &store.NodeCapacity{NodeID: "self", CPUMillicores: 1000, MemoryMiB: 1024}
-	ln := MemLocalNode(c)
-	got, err := ln.Capacity(context.Background())
-	if err != nil {
-		t.Fatalf("Capacity: %v", err)
-	}
-	if got != c {
-		t.Errorf("Capacity: got %+v, want %+v", got, c)
-	}
-}
-
-func TestMemLocalNode_NilCapacity(t *testing.T) {
-	ln := MemLocalNode(nil)
-	_, err := ln.Capacity(context.Background())
-	if err == nil {
-		t.Fatal("expected error for nil capacity")
-	}
-}

internal/jobspec/spec_test.go

@@ -1,9 +1,6 @@
 package jobspec
 
 import (
-	"os"
-	"path/filepath"
-	"strings"
 	"testing"
 )
 
@@ -61,223 +58,3 @@ task "no-cmd" {}
 		t.Fatal("expected error for missing command")
 	}
 }
-
-func TestParse_GoldenFiles(t *testing.T) {
-	cases := []struct {
-		name        string
-		file        string
-		wantJob     string
-		wantJobType string
-		wantTasks   int
-		checkTask   func(t *testing.T, s *Spec)
-	}{
-		{
-			name:        "single_task",
-			file:        "valid_single_task.hcl",
-			wantJob:     "single",
-			wantTasks:   1,
-			wantJobType: "",
-			checkTask: func(t *testing.T, s *Spec) {
-				if s.Tasks[0].Name != "solo" {
-					t.Errorf("task name = %q, want solo", s.Tasks[0].Name)
-				}
-				if s.Tasks[0].Command != "/bin/true" {
-					t.Errorf("command = %q, want /bin/true", s.Tasks[0].Command)
-				}
-			},
-		},
-		{
-			name:        "multi_task",
-			file:        "valid_multi_task.hcl",
-			wantJob:     "multi",
-			wantJobType: "batch",
-			wantTasks:   3,
-			checkTask: func(t *testing.T, s *Spec) {
-				byName := map[string]TaskSpec{}
-				for _, tk := range s.Tasks {
-					byName[tk.Name] = tk
-				}
-				if _, ok := byName["build"]; !ok {
-					t.Errorf("missing task 'build'")
-				}
-				if _, ok := byName["test"]; !ok {
-					t.Errorf("missing task 'test'")
-				}
-				if len(byName["test"].Env) != 2 {
-					t.Errorf("test env count = %d, want 2", len(byName["test"].Env))
-				}
-				if _, ok := byName["deploy"]; !ok {
-					t.Errorf("missing task 'deploy'")
-				}
-			},
-		},
-		{
-			name:      "env_vars",
-			file:      "valid_env_vars.hcl",
-			wantJob:   "envvars",
-			wantTasks: 1,
-			checkTask: func(t *testing.T, s *Spec) {
-				if len(s.Tasks[0].Env) != 3 {
-					t.Errorf("env count = %d, want 3", len(s.Tasks[0].Env))
-				}
-				want := "FOO=bar"
-				if s.Tasks[0].Env[0] != want {
-					t.Errorf("env[0] = %q, want %q", s.Tasks[0].Env[0], want)
-				}
-			},
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			path := filepath.Join("testdata", tc.file)
-			spec, err := ParseFile(path)
-			if err != nil {
-				t.Fatalf("ParseFile(%s): %v", tc.file, err)
-			}
-			if spec.Job.Name != tc.wantJob {
-				t.Errorf("job name = %q, want %q", spec.Job.Name, tc.wantJob)
-			}
-			if tc.wantJobType != "" && spec.Job.Type != tc.wantJobType {
-				t.Errorf("job type = %q, want %q", spec.Job.Type, tc.wantJobType)
-			}
-			if len(spec.Tasks) != tc.wantTasks {
-				t.Fatalf("tasks = %d, want %d", len(spec.Tasks), tc.wantTasks)
-			}
-			if tc.checkTask != nil {
-				tc.checkTask(t, spec)
-			}
-		})
-	}
-}
-
-func TestParse_ErrorPaths(t *testing.T) {
-	cases := []struct {
-		name     string
-		file     string
-		wantErr  string
-		useParse bool
-		hcl      string
-	}{
-		{name: "no_tasks", file: "err_no_tasks.hcl", wantErr: "at least one task"},
-		{name: "missing_command", file: "err_missing_command.hcl", wantErr: "required"},
-		{name: "malformed", file: "err_malformed.hcl", wantErr: "decode hcl"},
-		{name: "missing_job", file: "err_missing_job.hcl", wantErr: "Missing job block"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			path := filepath.Join("testdata", tc.file)
-			_, err := ParseFile(path)
-			if err == nil {
-				t.Fatalf("expected error containing %q, got nil", tc.wantErr)
-			}
-			if !strings.Contains(err.Error(), tc.wantErr) {
-				t.Errorf("error = %q, want it to contain %q", err.Error(), tc.wantErr)
-			}
-		})
-	}
-}
-
-func TestParse_EmptyFile(t *testing.T) {
-	_, err := Parse([]byte(""), "empty.hcl")
-	if err == nil {
-		t.Fatal("expected error for empty file")
-	}
-}
-
-func TestParse_MalformedHCL(t *testing.T) {
-	_, err := Parse([]byte("job = "), "bad.hcl")
-	if err == nil {
-		t.Fatal("expected error for malformed HCL")
-	}
-	if !strings.Contains(err.Error(), "decode hcl") {
-		t.Errorf("error = %q, want it to contain 'decode hcl'", err.Error())
-	}
-}
-
-func TestParseFile_Nonexistent(t *testing.T) {
-	_, err := ParseFile(filepath.Join("testdata", "does_not_exist.hcl"))
-	if err == nil {
-		t.Fatal("expected error for nonexistent file")
-	}
-	if !strings.Contains(err.Error(), "read spec file") {
-		t.Errorf("error = %q, want it to contain 'read spec file'", err.Error())
-	}
-}
-
-func TestParseFile_ReadError(t *testing.T) {
-	// Directory exists but is not readable as a file.
-	_, err := ParseFile("testdata")
-	if err == nil {
-		t.Fatal("expected error when ParseFile target is a directory")
-	}
-}
-
-func TestSpec_Validate(t *testing.T) {
-	cases := []struct {
-		name    string
-		spec    *Spec
-		wantErr string
-	}{
-		{
-			name:    "empty_job_name",
-			spec:    &Spec{Job: JobSpec{Name: "   "}, Tasks: []TaskSpec{{Name: "t", Command: "/bin/echo"}}},
-			wantErr: "job name is required",
-		},
-		{
-			name:    "no_tasks",
-			spec:    &Spec{Job: JobSpec{Name: "x"}},
-			wantErr: "at least one task is required",
-		},
-		{
-			name: "valid",
-			spec: &Spec{Job: JobSpec{Name: "x"}, Tasks: []TaskSpec{{Name: "t", Command: "/bin/echo"}}},
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			err := tc.spec.Validate()
-			if tc.wantErr == "" {
-				if err != nil {
-					t.Errorf("Validate: got %v, want nil", err)
-				}
-				return
-			}
-			if err == nil {
-				t.Fatalf("expected error containing %q, got nil", tc.wantErr)
-			}
-			if !strings.Contains(err.Error(), tc.wantErr) {
-				t.Errorf("error = %q, want it to contain %q", err.Error(), tc.wantErr)
-			}
-		})
-	}
-}
-
-func TestSpec_Validate_RoundTripFromParse(t *testing.T) {
-	path := filepath.Join("testdata", "valid_single_task.hcl")
-	spec, err := ParseFile(path)
-	if err != nil {
-		t.Fatalf("ParseFile: %v", err)
-	}
-	if err := spec.Validate(); err != nil {
-		t.Errorf("Validate on parsed spec: %v", err)
-	}
-}
-
-func TestParseFile_GoldenFilesExist(t *testing.T) {
-	// Guard against accidentally removing testdata fixtures.
-	files := []string{
-		"valid_single_task.hcl",
-		"valid_multi_task.hcl",
-		"valid_env_vars.hcl",
-		"err_no_tasks.hcl",
-		"err_missing_command.hcl",
-		"err_malformed.hcl",
-		"err_missing_job.hcl",
-	}
-	for _, f := range files {
-		path := filepath.Join("testdata", f)
-		if _, err := os.Stat(path); err != nil {
-			t.Errorf("missing testdata fixture %s: %v", f, err)
-		}
-	}
-}

internal/jobspec/testdata/err_malformed.hcl

@@ -1 +0,0 @@
-job "x" { command = invalid }

internal/jobspec/testdata/err_missing_command.hcl

@@ -1,3 +0,0 @@
-job "x" {}
-
-task "nocmd" {}

internal/jobspec/testdata/err_missing_job.hcl

@@ -1 +0,0 @@
-task "x" { command = "/bin/echo" }

internal/jobspec/testdata/err_no_tasks.hcl

@@ -1 +0,0 @@
-job "empty" {}

internal/jobspec/testdata/valid_env_vars.hcl

@@ -1,6 +0,0 @@
-job "envvars" {}
-
-task "runner" {
-  command = "/bin/printenv"
-  env     = ["FOO=bar", "BAZ=qux", "EMPTY="]
-}

internal/jobspec/testdata/valid_multi_task.hcl

@@ -1,19 +0,0 @@
-job "multi" {
-  type = "batch"
-}
-
-task "build" {
-  command = "/bin/echo"
-  args    = ["build", "done"]
-}
-
-task "test" {
-  command = "/usr/bin/go"
-  args    = ["test", "./..."]
-  env     = ["GOCACHE=/tmp/gocache", "GOFLAGS=-v"]
-}
-
-task "deploy" {
-  command = "/bin/sh"
-  args    = ["-c", "echo deploying"]
-}

internal/jobspec/testdata/valid_single_task.hcl

@@ -1,5 +0,0 @@
-job "single" {}
-
-task "solo" {
-  command = "/bin/true"
-}

internal/model/node.go

@@ -10,19 +10,6 @@ const (
 	NodeStateLeft    NodeState = "left"
 )
 
-// NodeKind classifies a node by how it joined the cluster.
-type NodeKind string
-
-const (
-	// NodeKindLocalhost is the auto-registered local node from `orca init`.
-	NodeKindLocalhost NodeKind = "localhost"
-	// NodeKindLinux is a generic Linux node (ubuntu/debian/alpine) joined
-	// without a specific type. Reserved for future SSH-join flows.
-	NodeKindLinux NodeKind = "linux"
-	// NodeKindProxmox is a Proxmox VE 8/9 host joined via SSH bootstrap.
-	NodeKindProxmox NodeKind = "proxmox"
-)
-
 type Node struct {
 	ID       string            `json:"id"`
 	Name     string            `json:"name"`
@@ -31,10 +18,4 @@ type Node struct {
 	JoinedAt time.Time         `json:"joined_at"`
 	LastSeen time.Time         `json:"last_seen"`
 	Metadata map[string]string `json:"metadata,omitempty"`
-	// Kind classifies the node: localhost | linux | proxmox (REQ-049).
-	// Empty string for rows created before migration 0006.
-	Kind string `json:"kind,omitempty"`
-	// OS is the auto-detected OS identifier from /etc/os-release ID=
-	// (ubuntu|debian|alpine|pve|linux). Empty for pre-0006 rows.
-	OS string `json:"os,omitempty"`
 }

internal/osdetect/osdetect.go

@@ -1,63 +0,0 @@
-// Package osdetect provides OS detection from /etc/os-release (D-032).
-// It's a separate package to avoid import cycles between internal/cli
-// and internal/doctor (both need to detect the local OS).
-package osdetect
-
-import (
-	"bufio"
-	"os"
-	"strings"
-)
-
-// osReleasePaths are checked in order for the os-release file. The
-// freedesktop.org spec says /etc/os-release is the canonical path,
-// with /usr/lib/os-release as a fallback for minimal containers that
-// may not symlink the former.
-var osReleasePaths = []string{"/etc/os-release", "/usr/lib/os-release"}
-
-// Detect reads /etc/os-release (then /usr/lib/os-release as a
-// fallback) and returns the value of the ID= field. Returns "linux"
-// (the generic fallback per D-032) if the file is missing, the ID
-// field is absent, or the value is empty. Unknown ID values (e.g.
-// "fedora", "arch") are returned verbatim — doctor os can warn on
-// unknown values, but orca init must not fail.
-func Detect() string {
-	for _, p := range osReleasePaths {
-		data, err := os.ReadFile(p)
-		if err != nil {
-			continue
-		}
-		if id := ParseID(data); id != "" {
-			return id
-		}
-	}
-	return "linux"
-}
-
-// ParseID extracts the ID= value from os-release content.
-// The format is shell-compatible KEY=VALUE lines; values may be
-// double-quoted. Returns "" if ID is absent or empty.
-func ParseID(data []byte) string {
-	scanner := bufio.NewScanner(strings.NewReader(string(data)))
-	for scanner.Scan() {
-		line := strings.TrimSpace(scanner.Text())
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
-		key, value, ok := strings.Cut(line, "=")
-		if !ok {
-			continue
-		}
-		key = strings.TrimSpace(key)
-		if key != "ID" {
-			continue
-		}
-		value = strings.TrimSpace(value)
-		// Strip surrounding double quotes (freedesktop spec allows quoted values).
-		if len(value) >= 2 && value[0] == '"' && value[len(value)-1] == '"' {
-			value = value[1 : len(value)-1]
-		}
-		return value
-	}
-	return ""
-}

internal/osdetect/osdetect_test.go

@@ -1,103 +0,0 @@
-package osdetect
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestParseID_Ubuntu(t *testing.T) {
-	content := `NAME="Ubuntu"
-VERSION="24.04.4 LTS (Noble Numbat)"
-ID=ubuntu
-ID_LIKE=debian`
-	if got := ParseID([]byte(content)); got != "ubuntu" {
-		t.Errorf("got %q, want ubuntu", got)
-	}
-}
-
-func TestParseID_Debian(t *testing.T) {
-	if got := ParseID([]byte("ID=debian\n")); got != "debian" {
-		t.Errorf("got %q, want debian", got)
-	}
-}
-
-func TestParseID_Alpine(t *testing.T) {
-	if got := ParseID([]byte("ID=alpine\n")); got != "alpine" {
-		t.Errorf("got %q, want alpine", got)
-	}
-}
-
-func TestParseID_PVE(t *testing.T) {
-	if got := ParseID([]byte("ID=pve\nID_LIKE=debian\n")); got != "pve" {
-		t.Errorf("got %q, want pve", got)
-	}
-}
-
-func TestParseID_QuotedValue(t *testing.T) {
-	if got := ParseID([]byte(`ID="ubuntu"` + "\n")); got != "ubuntu" {
-		t.Errorf("got %q, want ubuntu", got)
-	}
-}
-
-func TestParseID_MissingID(t *testing.T) {
-	if got := ParseID([]byte("NAME=Test\n")); got != "" {
-		t.Errorf("got %q, want empty", got)
-	}
-}
-
-func TestParseID_UnknownIDVerbatim(t *testing.T) {
-	if got := ParseID([]byte("ID=fedora\n")); got != "fedora" {
-		t.Errorf("got %q, want fedora", got)
-	}
-}
-
-func TestParseID_CommentsAndBlanks(t *testing.T) {
-	content := `# comment
-
-NAME="Test"
-# ID below
-ID=arch`
-	if got := ParseID([]byte(content)); got != "arch" {
-		t.Errorf("got %q, want arch", got)
-	}
-}
-
-func TestDetect_FallbackToLinux(t *testing.T) {
-	orig := osReleasePaths
-	defer func() { osReleasePaths = orig }()
-	osReleasePaths = []string{filepath.Join(t.TempDir(), "nonexistent")}
-	if got := Detect(); got != "linux" {
-		t.Errorf("got %q, want linux (fallback)", got)
-	}
-}
-
-func TestDetect_ReadsFile(t *testing.T) {
-	dir := t.TempDir()
-	orig := osReleasePaths
-	defer func() { osReleasePaths = orig }()
-	path := filepath.Join(dir, "os-release")
-	osReleasePaths = []string{path}
-	if err := os.WriteFile(path, []byte("ID=ubuntu\n"), 0o644); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-	if got := Detect(); got != "ubuntu" {
-		t.Errorf("got %q, want ubuntu", got)
-	}
-}
-
-func TestDetect_FallbackToUsrLib(t *testing.T) {
-	dir := t.TempDir()
-	orig := osReleasePaths
-	defer func() { osReleasePaths = orig }()
-	osReleasePaths = []string{
-		filepath.Join(dir, "etc"),     // missing
-		filepath.Join(dir, "usr-lib"), // fallback
-	}
-	if err := os.WriteFile(osReleasePaths[1], []byte("ID=alpine\n"), 0o644); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-	if got := Detect(); got != "alpine" {
-		t.Errorf("got %q, want alpine (from fallback)", got)
-	}
-}

internal/proxmox/bootstrap.go

@@ -1,523 +0,0 @@
-// Package proxmox implements the SSH-based bootstrap of a remote
-// Proxmox VE 8/9 host as an orca node (REQ-050, REQ-051).
-//
-// The bootstrap sequence (run via `orca node join --type proxmox`):
-//  1. Generate or load the orca SSH keypair (Ed25519, D-037)
-//  2. SSH dial with password auth + TOFU host-key capture (D-035)
-//  3. Deploy the orca pubkey to ~orca/.ssh/authorized_keys
-//  4. Create the `orca` Linux system user (config-overridable name)
-//  5. Create the OrcaOperator PVE role with least-privilege privileges
-//  6. Create the orca@pam PVE user (maps to the Linux system user)
-//  7. Assign the OrcaOperator role to orca@pam on path /
-//  8. Write /etc/sudoers.d/orca with NOEXEC on pct/qm, no NOEXEC on
-//     apt-get/dpkg, and pvesh EXCLUDED (AD-020: pvesh can bypass NOEXEC
-//     via the API execute endpoint)
-//  9. Validate the sudoers file with visudo -cf
-//  10. Return the node metadata for the caller to persist
-//
-// All steps are idempotent (D-036): re-running the bootstrap on an
-// already-configured host is a no-op. The password is never persisted
-// (D-031) — it is used only for the initial SSH auth and pubkey
-// deployment; subsequent orca→Proxmox access uses the deployed SSH key.
-package proxmox
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"log/slog"
-	"net"
-	"os"
-	"strings"
-	"time"
-
-	"golang.org/x/crypto/ssh"
-	"golang.org/x/crypto/ssh/knownhosts"
-
-	"git.cloudinit.dev/coreci/orca/internal/certpaths"
-	"git.cloudinit.dev/coreci/orca/internal/security"
-)
-
-// DefaultProxmoxUser is the default Linux system user created on the
-// Proxmox host. Overridable via Options.ProxmoxUser.
-const DefaultProxmoxUser = "orca"
-
-// DefaultProxmoxRole is the default PVE custom role created for the
-// orca user. Overridable via Options.ProxmoxRole.
-const DefaultProxmoxRole = "OrcaOperator"
-
-// DefaultSSHPort is the default SSH port for Proxmox hosts.
-const DefaultSSHPort = 22
-
-// OrcaOperatorPrivileges is the least-privilege privilege set for the
-// OrcaOperator PVE role (D-033). Space-separated per pveum --privs
-// syntax. VM.Audit covers CTs as well (both live under /vms/{vmid}).
-const OrcaOperatorPrivileges = "VM.Audit Datastore.AllocateSpace SDN.Use"
-
-// Options configures a Proxmox bootstrap run.
-type Options struct {
-	// Host is the Proxmox host address (IP or hostname, no port).
-	Host string
-	// SSHUser is the initial SSH username (default "root").
-	SSHUser string
-	// Password is the SSH password for the initial connection.
-	// NEVER persisted (D-031). The caller must zero this after use.
-	Password string
-	// ProxmoxUser is the Linux system user to create on the host
-	// (default "orca"). Config-overridable.
-	ProxmoxUser string
-	// ProxmoxRole is the PVE custom role to create (default
-	// "OrcaOperator"). Config-overridable.
-	ProxmoxRole string
-	// SSHPort is the SSH port (default 22).
-	SSHPort int
-	// HostKeyFingerprint is the operator-pinned SSH host key fingerprint
-	// in `SHA256:base64` form (REQ-058, D-044). When non-empty, the
-	// bootstrap dialer uses a pinned-host-key callback instead of the
-	// TOFU known_hosts capture path. Empty falls back to TOFU.
-	HostKeyFingerprint string
-	// Logger receives audit-log entries. If nil, slog.Default() is used.
-	Logger *slog.Logger
-}
-
-// Result is the outcome of a successful bootstrap.
-type Result struct {
-	// NodeName is the name to use for the node in the orca registry
-	// (typically the host address).
-	NodeName string
-	// NodeAddress is the orca daemon address on the Proxmox host
-	// (host:8443 — the orca daemon port).
-	NodeAddress string
-	// HostKeyFingerprint is the SHA-256 fingerprint of the captured
-	// SSH host key (for operator verification).
-	HostKeyFingerprint string
-}
-
-// BootstrapProxmox runs the full SSH bootstrap sequence on a remote
-// Proxmox VE 8/9 host. All steps are idempotent. Returns a Result
-// describing the node to register, or an error if any step fails.
-func BootstrapProxmox(ctx context.Context, opts Options) (*Result, error) {
-	if opts.Host == "" {
-		return nil, fmt.Errorf("proxmox bootstrap: host is required")
-	}
-	if opts.Password == "" {
-		return nil, fmt.Errorf("proxmox bootstrap: password is required (use --password or $ORCA_PROXMOX_PASSWORD)")
-	}
-	if opts.SSHUser == "" {
-		opts.SSHUser = "root"
-	}
-	if opts.ProxmoxUser == "" {
-		opts.ProxmoxUser = DefaultProxmoxUser
-	}
-	if opts.ProxmoxRole == "" {
-		opts.ProxmoxRole = DefaultProxmoxRole
-	}
-	if opts.SSHPort == 0 {
-		opts.SSHPort = DefaultSSHPort
-	}
-	log := opts.Logger
-	if log == nil {
-		log = slog.Default()
-	}
-
-	// Step 1: Generate or load the orca SSH keypair (D-037).
-	// The key is deployed to the remote host's authorized_keys in step 3.
-	_, pubLine, err := security.GenerateOrLoadSSHKey(certpaths.Dir())
-	if err != nil {
-		return nil, fmt.Errorf("ssh key: %w", err)
-	}
-
-	// Step 2: SSH dial with password auth + host-key verification (D-035,
-	// REQ-058). When opts.HostKeyFingerprint is set (D-044), use a pinned
-	// callback that fails closed on mismatch (AD-028); otherwise use the
-	// TOFU known_hosts capture callback (D-035). The TOFU wrapper fixes
-	// the v0.6 ship-defect where knownhosts.New returned KeyError{Want:[]}
-	// on first connect WITHOUT writing the captured key, so the first
-	// `orca node join --type proxmox` always failed.
-	sshAddr := fmt.Sprintf("%s:%d", opts.Host, opts.SSHPort)
-	var capturedHostKey ssh.PublicKey
-	var hostKeyCallback ssh.HostKeyCallback
-	if opts.HostKeyFingerprint != "" {
-		cb, err := pinnedHostKeyCallback(opts.HostKeyFingerprint, &capturedHostKey)
-		if err != nil {
-			return nil, fmt.Errorf("host-key fingerprint: %w", err)
-		}
-		hostKeyCallback = cb
-	} else {
-		cb, err := TOFUHostKeyCallback(sshAddr, &capturedHostKey)
-		if err != nil {
-			return nil, fmt.Errorf("tofu host-key callback: %w", err)
-		}
-		hostKeyCallback = cb
-	}
-
-	sshConfig := &ssh.ClientConfig{
-		User:            opts.SSHUser,
-		Auth:            []ssh.AuthMethod{ssh.Password(opts.Password)},
-		HostKeyCallback: hostKeyCallback,
-		Timeout:         10 * time.Second,
-	}
-
-	dialCtx, dialCancel := context.WithTimeout(ctx, 15*time.Second)
-	defer dialCancel()
-	conn, err := sshDialer.DialContext(dialCtx, "tcp", sshAddr, sshConfig)
-	if err != nil {
-		return nil, fmt.Errorf("ssh dial %s: %w", sshAddr, err)
-	}
-	defer conn.Close()
-
-	if sessionRunner == nil {
-		sessionRunner = &sshSessionRunner{client: conn}
-	}
-
-	hostKeyFP := ""
-	if capturedHostKey != nil {
-		hostKeyFP = security.SSHFingerprintSHA256(capturedHostKey)
-	}
-
-	log.Info("proxmox.ssh_connected",
-		slog.String("event", "proxmox.ssh_connected"),
-		slog.String("host", opts.Host),
-		slog.String("ssh_user", opts.SSHUser),
-		slog.String("host_key_fingerprint", hostKeyFP),
-	)
-
-	// Step 3: Deploy orca pubkey to ~orca/.ssh/authorized_keys (idempotent).
-	if err := deployPubKey(opts.ProxmoxUser, string(pubLine)); err != nil {
-		return nil, fmt.Errorf("deploy pubkey: %w", err)
-	}
-
-	// Step 4: Create orca Linux system user (idempotent).
-	if err := createLinuxUser(opts.ProxmoxUser); err != nil {
-		return nil, fmt.Errorf("create user %s: %w", opts.ProxmoxUser, err)
-	}
-
-	// Step 5: Create OrcaOperator PVE role (idempotent).
-	if err := createPVERole(opts.ProxmoxRole); err != nil {
-		return nil, fmt.Errorf("create PVE role %s: %w", opts.ProxmoxRole, err)
-	}
-
-	// Step 6: Create orca@pam PVE user (idempotent).
-	if err := createPVEUser(opts.ProxmoxUser); err != nil {
-		return nil, fmt.Errorf("create PVE user %s@pam: %w", opts.ProxmoxUser, err)
-	}
-
-	// Step 7: Assign OrcaOperator role to orca@pam on path / (idempotent).
-	if err := assignPVEACL(opts.ProxmoxUser, opts.ProxmoxRole); err != nil {
-		return nil, fmt.Errorf("assign ACL: %w", err)
-	}
-
-	// Step 8: Write /etc/sudoers.d/orca (AD-020: NOEXEC on pct/qm,
-	// no NOEXEC on apt-get/dpkg, pvesh EXCLUDED).
-	if err := writeSudoers(opts.ProxmoxUser); err != nil {
-		return nil, fmt.Errorf("write sudoers: %w", err)
-	}
-
-	// Step 9: Validate sudoers with visudo -cf.
-	if err := validateSudoers(); err != nil {
-		return nil, fmt.Errorf("validate sudoers: %w", err)
-	}
-
-	log.Info("proxmox.bootstrap_ok",
-		slog.String("event", "proxmox.bootstrap_ok"),
-		slog.String("host", opts.Host),
-		slog.String("proxmox_user", opts.ProxmoxUser),
-		slog.String("proxmox_role", opts.ProxmoxRole),
-	)
-
-	return &Result{
-		NodeName:           opts.Host,
-		NodeAddress:        opts.Host + ":8443",
-		HostKeyFingerprint: hostKeyFP,
-	}, nil
-}
-
-// sshDialer is the dialer used by BootstrapProxmox. It's a package-level
-// variable so tests can override it with a fake SSH server.
-var sshDialer sshDialerType = defaultSSHDialer{}
-
-// pinnedHostKeyCallback returns an ssh.HostKeyCallback that pins the
-// server's host key to the operator-supplied SHA256:base64 fingerprint
-// (REQ-058, AD-028). It validates the `SHA256:` prefix up front (D-045)
-// and fails closed on any mismatch. The capturedKey out-param records
-// the verified server key so the caller can populate Result.
-func pinnedHostKeyCallback(expectedSHA256Base64 string, capturedKey *ssh.PublicKey) (ssh.HostKeyCallback, error) {
-	if !strings.HasPrefix(expectedSHA256Base64, "SHA256:") {
-		return nil, fmt.Errorf("pinnedHostKeyCallback: fingerprint must be SHA256:-prefixed (D-045), got %q", expectedSHA256Base64)
-	}
-	return func(_ string, _ net.Addr, key ssh.PublicKey) error {
-		got := security.SSHFingerprintSHA256(key)
-		if got != expectedSHA256Base64 {
-			return fmt.Errorf("REQ-058 host-key fingerprint mismatch: pinned=%s server=%s", expectedSHA256Base64, got)
-		}
-		if capturedKey != nil {
-			*capturedKey = key
-		}
-		return nil
-	}, nil
-}
-
-// TOFUHostKeyCallback returns an ssh.HostKeyCallback that wraps the
-// standard knownhosts.New verifier with TOFU first-connect capture
-// (D-035). On a host-unknown KeyError{Want:[]} it writes the
-// server-presented key to certpaths.KnownHostsPath() atomically
-// (security.WriteAtomic, AD-029) and allows the dial to proceed; on a
-// mismatch (Want non-empty) it fails closed (MITM detection). The
-// capturedKey out-param records the verified/captured server key so
-// the caller can populate Result. This fixes the v0.6 ship-defect
-// where knownhosts.New returned KeyError{Want:[]} on first connect
-// WITHOUT writing the captured key, so the first
-// `orca node join --type proxmox` always failed.
-//
-// Exported so the doctor proxmox probe (T02.9) can reuse the same
-// capture-fix wrapper for parity (GRILL condition #2).
-func TOFUHostKeyCallback(addr string, capturedKey *ssh.PublicKey) (ssh.HostKeyCallback, error) {
-	cb, err := knownhosts.New(certpaths.KnownHostsPath())
-	if err != nil {
-		return nil, err
-	}
-	return func(hostname string, remote net.Addr, key ssh.PublicKey) error {
-		err := cb(hostname, remote, key)
-		if err == nil {
-			if capturedKey != nil {
-				*capturedKey = key
-			}
-			return nil
-		}
-		var keyErr *knownhosts.KeyError
-		if errors.As(err, &keyErr) && len(keyErr.Want) == 0 {
-			line := knownhosts.Line([]string{knownhosts.Normalize(addr)}, key)
-			path := certpaths.KnownHostsPath()
-			existing, readErr := os.ReadFile(path)
-			if readErr != nil && !os.IsNotExist(readErr) {
-				return fmt.Errorf("tofu read known_hosts: %w", readErr)
-			}
-			if len(existing) > 0 && !bytes.HasSuffix(existing, []byte("\n")) {
-				existing = append(existing, '\n')
-			}
-			updated := append(existing, []byte(line)...)
-			if writeErr := security.WriteAtomic(path, 0o600, updated); writeErr != nil {
-				return fmt.Errorf("tofu write known_hosts: %w", writeErr)
-			}
-			if capturedKey != nil {
-				*capturedKey = key
-			}
-			return nil
-		}
-		return err
-	}, nil
-}
-
-type sshDialerType interface {
-	DialContext(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*ssh.Client, error)
-}
-
-type defaultSSHDialer struct{}
-
-func (defaultSSHDialer) DialContext(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
-	return ssh.Dial(network, addr, config)
-}
-
-type sessionRunnerType interface {
-	CombinedOutput(cmd string) ([]byte, error)
-}
-
-var sessionRunner sessionRunnerType
-
-type sshSessionRunner struct {
-	client *ssh.Client
-}
-
-func (r *sshSessionRunner) CombinedOutput(cmd string) ([]byte, error) {
-	session, err := r.client.NewSession()
-	if err != nil {
-		return nil, fmt.Errorf("new session: %w", err)
-	}
-	defer session.Close()
-	return session.CombinedOutput(cmd)
-}
-
-// runRemote runs a command over the SSH connection and returns its
-// combined output. Returns an error if the command exits non-zero.
-func runRemote(cmd string) ([]byte, error) {
-	out, err := sessionRunner.CombinedOutput(cmd)
-	if err != nil {
-		return out, fmt.Errorf("run %q: %w (output: %s)", cmd, err, strings.TrimSpace(string(out)))
-	}
-	return out, nil
-}
-
-// deployPubKey appends the orca public key to the remote user's
-// authorized_keys file, creating the .ssh dir if needed. Idempotent:
-// if the key is already present, it is not re-appended.
-func deployPubKey(user, pubLine string) error {
-	pubLine = strings.TrimSpace(pubLine)
-	if pubLine == "" {
-		return fmt.Errorf("deployPubKey: empty pub line")
-	}
-	home := "/home/" + user
-	if user == "root" {
-		home = "/root"
-	}
-	sshDir := home + "/.ssh"
-	authFile := sshDir + "/authorized_keys"
-	// Create .ssh dir, touch authorized_keys, set modes, append key if absent.
-	cmd := fmt.Sprintf(
-		"mkdir -p %s && touch %s && chmod 0700 %s && chmod 0600 %s && grep -qF '%s' %s || echo '%s' >> %s",
-		sshDir, authFile, sshDir, authFile, pubLine, authFile, pubLine, authFile,
-	)
-	if _, err := runRemote(cmd); err != nil {
-		return err
-	}
-	return nil
-}
-
-// createLinuxUser creates the orca system user if it doesn't already
-// exist. Idempotent: `id -u` check before `useradd`.
-func createLinuxUser(user string) error {
-	cmd := fmt.Sprintf("id -u %s 2>/dev/null || useradd -m -s /bin/bash %s", user, user)
-	if _, err := runRemote(cmd); err != nil {
-		return err
-	}
-	return nil
-}
-
-// createPVERole creates the OrcaOperator PVE role if it doesn't exist.
-// Idempotent: probes `pveum role list` before `pveum role add`.
-func createPVERole(role string) error {
-	cmd := fmt.Sprintf(
-		"pveum role list 2>/dev/null | grep -q '^%s' || pveum role add %s --privs '%s'",
-		role, role, OrcaOperatorPrivileges,
-	)
-	if _, err := runRemote(cmd); err != nil {
-		return err
-	}
-	return nil
-}
-
-// createPVEUser creates the orca@pam PVE user if it doesn't exist.
-// Idempotent: probes `pveum user list` before `pveum user add`.
-// Uses @pam realm (AD-019) since orca creates a Linux system user.
-func createPVEUser(user string) error {
-	pveUserID := user + "@pam"
-	cmd := fmt.Sprintf(
-		"pveum user list 2>/dev/null | grep -q '%s' || pveum user add %s -comment 'Orca automation user'",
-		pveUserID, pveUserID,
-	)
-	if _, err := runRemote(cmd); err != nil {
-		return err
-	}
-	return nil
-}
-
-// assignPVEACL assigns the OrcaOperator role to orca@pam on path /
-// (cluster-wide). `pveum acl modify` is idempotent (creates or updates).
-func assignPVEACL(user, role string) error {
-	pveUserID := user + "@pam"
-	cmd := fmt.Sprintf("pveum acl modify / -user %s -role %s", pveUserID, role)
-	if _, err := runRemote(cmd); err != nil {
-		return err
-	}
-	return nil
-}
-
-// sudoersContent returns the /etc/sudoers.d/orca file content (AD-020).
-// NOEXEC on pct/qm (blocks shell escapes); no NOEXEC on apt-get/dpkg
-// (they need exec for maintainer scripts); pvesh EXCLUDED (API execute
-// bypasses NOEXEC). File must be mode 0440 per sudo requirements.
-func sudoersContent(user string) string {
-	return fmt.Sprintf(`# /etc/sudoers.d/orca — Managed by orca; do not edit manually.
-# Least-privilege allowlist for the orca PVE operator user.
-# NOPASSWD: non-interactive SSH automation. NOEXEC: blocks shell escapes.
-# pvesh is EXCLUDED (AD-020: pvesh can bypass NOEXEC via API execute).
-%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/pct
-%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/qm
-%s ALL=(root) NOPASSWD: /usr/bin/apt-get
-%s ALL=(root) NOPASSWD: /usr/bin/dpkg
-`, user, user, user, user)
-}
-
-// writeSudoers writes the /etc/sudoers.d/orca file on the remote host
-// with mode 0440. Uses a heredoc via cat to avoid quoting issues.
-func writeSudoers(user string) error {
-	content := sudoersContent(user)
-	// Write via cat heredoc, then chmod 0440.
-	cmd := fmt.Sprintf("cat > /etc/sudoers.d/%s <<'ORCA_SUDOERS_EOF'\n%s\nORCA_SUDOERS_EOF\nchmod 0440 /etc/sudoers.d/%s",
-		user, content, user)
-	if _, err := runRemote(cmd); err != nil {
-		return err
-	}
-	return nil
-}
-
-// validateSudoers runs `visudo -cf` on the sudoers file. Aborts the
-// bootstrap if validation fails (prevents a broken sudoers from
-// locking the orca user out of sudo).
-func validateSudoers() error {
-	cmd := "visudo -cf /etc/sudoers.d/orca"
-	out, err := runRemote(cmd)
-	if err != nil {
-		return fmt.Errorf("visudo validation failed: %w (output: %s)", err, strings.TrimSpace(string(out)))
-	}
-	if !strings.Contains(string(out), "parsed OK") {
-		return fmt.Errorf("visudo validation did not report OK: %s", strings.TrimSpace(string(out)))
-	}
-	return nil
-}
-
-// ResetHostKey removes all known_hosts entries for the given host from
-// certpaths.KnownHostsPath() (REQ-059, D-046, AD-029). It rewrites the
-// file atomically via security.WriteAtomic. LOCAL ONLY — it does NOT
-// touch the remote host's authorized_keys (D-046). The next connect
-// re-pins the host key via TOFU (T02.6) or the --host-key-fingerprint
-// pinned path (T02.5).
-//
-// A line matches when its first whitespace-delimited field (the host
-// pattern, normalized via knownhosts.Normalize) equals the normalized
-// target host. Comment/blank lines are preserved.
-func ResetHostKey(host string) error {
-	if host == "" {
-		return fmt.Errorf("ResetHostKey: host is required")
-	}
-	path := certpaths.KnownHostsPath()
-	existing, err := os.ReadFile(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil // nothing to reset
-		}
-		return fmt.Errorf("ResetHostKey: read known_hosts: %w", err)
-	}
-	target := knownhosts.Normalize(host)
-	var kept []byte
-	removed := 0
-	for _, line := range strings.Split(string(existing), "\n") {
-		trimmed := strings.TrimSpace(line)
-		if trimmed == "" || strings.HasPrefix(trimmed, "#") {
-			kept = append(kept, []byte(line+"\n")...)
-			continue
-		}
-		fields := strings.Fields(trimmed)
-		if len(fields) == 0 {
-			kept = append(kept, []byte(line+"\n")...)
-			continue
-		}
-		if knownhosts.Normalize(fields[0]) == target {
-			removed++
-			continue
-		}
-		kept = append(kept, []byte(line+"\n")...)
-	}
-	if removed == 0 {
-		return nil
-	}
-	// Ensure the kept buffer ends with exactly one trailing newline.
-	kept = bytes.TrimRight(kept, "\n")
-	if len(kept) > 0 {
-		kept = append(kept, '\n')
-	}
-	if err := security.WriteAtomic(path, 0o600, kept); err != nil {
-		return fmt.Errorf("ResetHostKey: rewrite known_hosts: %w", err)
-	}
-	return nil
-}