docs(P00): grill PASS (0.82) — 3 binding conditions, 3 phase challenges

---ci--- project: orca phase: 0 milestone: v0.10 status: grill ---/ci---
docs(P00): create phase plans — 5 phases, 4 waves, 18 tasks
2026-08-05 20:47:50 +00:00 · 2026-08-05 20:47:39 +00:00 · 2026-08-05 20:47:10 +00:00 · 2026-08-05 20:46:32 +00:00 · 2026-08-05 20:45:31 +00:00 · 2026-08-05 20:45:26 +00:00
16 changed files with 1451 additions and 160 deletions
@@ -1 +1,20 @@
-{ "phase": "P09", "stage": "verify", "milestone": "v0.9", "phase_role": "execution", "updated_at": "2026-08-05T04:50:00Z", "milestone_complete": false, "gates_cleared_this_phase": ["C-02", "C-14"], "verify": { "build": "pass", "go_test": "24/24", "bats": "20/20", "gofmt": "clean", "verify_reqs": "90 consistent" } }
+{
+  "phase": 0,
+  "stage": "plan",
+  "milestone": "v0.10",
+  "milestone_slug": "docs-cli-examples",
+  "phase_role": "pre_execution",
+  "attempts": 0,
+  "updated_at": "2026-08-05T20:00:00Z",
+  "milestone_complete": false,
+  "ship": {
+    "tag": null,
+    "merged_to_main": false,
+    "milestone_branch_deleted": false,
+    "all_phase_branches_deleted": false
+  },
+  "requirements": {
+    "covered": [],
+    "partial": []
+  }
+}
@@ -0,0 +1,58 @@
+# Grill: v0.10 Docs & Install Milestone
+
+## Verdict: PASS (confidence 0.82)
+
+The plan is sound for a documentation + install-hardening milestone.
+No replan required. Three binding conditions adopted below.
+
+## Axis review
+
+### Scope justification — PASS
+The milestone closes a real gap (no CLI/jobspec/ingress docs, stale
+README, broken release pipeline) with a bounded scope (5 phases, no Go
+orchestration code changes). The v0.9 re-architecture shipped
+functionality without operator-facing docs; this milestone ships the
+docs. The install fix (P1) addresses a measured production bug
+(v0.4.5 install), not a speculative enhancement.
+
+### Feasibility — PASS
+All tasks are markdown authoring (P2-P4) or bash script hardening (P1).
+No new dependencies, no schema changes, no Go code changes. The
+jobspecs in P3 must parse against the current parser — risk R1 is
+real but mitigated by validation before commit.
+
+### Vertical slice integrity — PASS
+Each phase ships an independently valuable deliverable:
+- P1: install.sh works (resolves to a release with an asset)
+- P2: an operator can read the CLI/jobspec/ingress docs
+- P3: an operator can copy the examples and deploy a stack
+- P4: README + namespace.md are accurate
+- P5: milestone complete, merged, released
+
+### Wave ordering — PASS
+P1 (Wave 1) unblocks all subsequent ship operations (each phase ship
+needs a correctly-asseted release). P2 + P3 (Wave 2) are parallel with
+no dependencies. P4 (Wave 3) depends on P2/P3 for cross-links. P5
+(Wave 4) depends on all.
+
+### Risk register — PASS
+Three risks identified, all mitigated. R1 (jobspec parse drift) is the
+highest; mitigation is validation before commit. R2 (tea CLI asset bug)
+has a curl fallback. R3 (v0.8.15 still asset-less) is handled by
+install.sh's fallback walk.
+
+## Binding conditions
+
+| ID | Condition | Phase | Status |
+|----|-----------|-------|--------|
+| C-20 | Every jobspec in `examples/full-stack/` MUST parse with `internal/jobspec.ParseFile` and pass `internal/spec/schema.ValidatorFor(kind)` before P3 commits | P3 | pending |
+| C-21 | `scripts/release.sh` post-create asset verification MUST query the Gitea API and assert the tarball in attachments (not rely on `tea` exit code alone) | P1 | pending |
+| C-22 | Every factual claim in `docs/cli.md`, `docs/jobspec.md`, `docs/ingress.md` MUST be grounded in the live codebase (struct fields, flag definitions, paths) — verified by the docs-engineer persona before P2 commits | P2 | pending |
+
+## Phase challenges
+
+| ID | Challenge | Phase |
+|----|-----------|-------|
+| PC-11 | The jobspecs in P3 must not use fields that don't exist yet (e.g., `resources:` which lands in v0.11-P0c). Validate against the current `WorkloadSpec` struct. | P3 |
+| PC-12 | The rendered artifacts in P3 must match what the emitters actually produce, not an idealized version. Cross-check against `internal/emitter/` test fixtures. | P3 |
+| PC-13 | The README subcommand table must match `internal/cli/` exactly — no stale commands, no missing commands. | P4 |
@@ -0,0 +1,39 @@
+# Ideation: v0.10 Docs & Install Milestone
+
+## Tier 1 — Mechanical (codebase-grounded, no new deps)
+
+| ID | Idea | Source | Accepted | REQ |
+|----|------|--------|----------|-----|
+| I-M-091 | `docs/cli.md` comprehensive CLI reference | README subcommand table is stale (missing cert/daemon/doctor/audit/ns/node-capacity/node-key-reset); no `docs/` CLI reference exists | ✅ | REQ-091 |
+| I-M-092 | `docs/jobspec.md` markdown frontmatter schema reference | Operators must read `internal/jobspec/markdown.go` source to author jobspecs; no reference doc exists | ✅ | REQ-092 |
+| I-M-093 | `docs/ingress.md` Traefik ingress reference | The service→Traefik mapping (R-007, atomic reload, drain, TLS) is undocumented; the user explicitly asked for "ingress configured" | ✅ | REQ-093 |
+| I-M-094 | `examples/full-stack/` with 5 valid jobspecs + rendered artifacts + walkthrough | No examples directory exists; `testdata/` holds legacy HCL test fixtures, not operator examples | ✅ | REQ-094 |
+| I-M-095 | README.md refresh (status, subcommand table, install example, dev targets, docs/examples sections) | README says "v0.1: Foundation"; subcommand table missing 5 commands; install example pins v0.4.2 | ✅ | REQ-095 |
+| I-M-096 | `docs/namespace.md` v0.9 multi-namespace layout update | Documents the v0.8 flat layout, not the v0.9 `cluster/`+`_defaults/`+per-ns layout | ✅ | REQ-096 |
+
+## Tier 2 — Backend-enriched (API/behavior-grounded)
+
+| ID | Idea | Source | Accepted | REQ |
+|----|------|--------|----------|-----|
+| I-B-097 | `scripts/release.sh` cross-build amd64 + post-create asset verification | v0.8.x releases shipped with zero binary assets; install.sh resolves to v0.8.15 then errors on missing tarball; root cause of v0.4.5 install | ✅ | REQ-097 |
+| I-B-098 | `scripts/install.sh` asset fallback walk + `--check` dry-run | install.sh has no fallback when the latest release lacks the expected tarball; a broken release blocks all installs | ✅ | REQ-098 |
+
+## Tier 3 — Cross-project (deferred — single-project mode)
+
+No cross-project ideas. Orca is single-project mode.
+
+## Rejected ideas
+
+- **Backfill the existing v0.8.15 release with a binary asset** —
+  rejected per D-192. Backfilling a past release is an ops task, not a
+  docs milestone deliverable. The next tagged phase (P1 ship at v0.9.1)
+  will be the first correctly-asseted release; install.sh's fallback
+  walk handles the gap.
+- **Document both v0.8 and v0.9 paths equally** — rejected per D-191.
+  The v0.8 path is deprecated and scheduled for removal; documenting it
+  as primary misleads new operators.
+- **arm64 tarball in release.sh** — rejected for this milestone per
+  D-193. The install user base is amd64 today; arm64 is a separate
+  enhancement.
+- **Per-command `docs/cli/*.md` subdirectory** — rejected per D-188.
+  Single-file `docs/cli.md` matches the existing flat `docs/` layout.
@@ -137,91 +137,72 @@ enforcement remains in `warn` mode per config.json.

 ---

-## v0.7 baseline (preserved for traceability)
+## v0.10 Docs & Install Milestone — Persona Configuration

+```yaml
 ---
-active_personas:
+active:
  - lead-developer
  - backend-engineer
+  - docs-engineer
+deactivated:
  - data-engineer
-deactivated_personas:
-  - cli-engineer
  - security-engineer
-  - devops-engineer
  - network-engineer
+  - devops-engineer
+  - cli-engineer
  - frontend-engineer
-phase_specific: []
+phase_specific:
+  - docs-engineer
 reason: |
-  Orca v0.7 is an NFR hardening & completion milestone. The work is CLI
-  registration (cert command), a new internal/config package, test
-  coverage uplift across engine/transport/proxmox/audit, and an opt-in
-  pprof endpoint on the daemon. No schema changes, no new security
-  surface, no packaging/distribution, no UI.
-
-  Roster changes vs v0.6:
-  - data-engineer: RETAINED — owns cert_repo tests + store coverage.
-  - security-engineer: DEACTIVATED — v0.7 adds no new security surface
-    (pprof is operator-only, addr-gated; cert registration exposes
-    existing security code, does not add new).
-  - cli-engineer: DEACTIVATED — merged into lead-developer for v0.7
-    (the cert registration is a 1-line AddCommand; config --config flag
-    is root-command wiring, not a new CLI subsystem).
-  - devops-engineer: DEACTIVATED — no packaging/distribution in v0.7.
+  v0.10 is a documentation + install-hardening milestone. It touches two
+  territories: scripts/ (release.sh, install.sh — bash, backend-engineer)
+  and docs/ + examples/ + README.md (markdown, lead-developer +
+  docs-engineer). No Go orchestration code changes, no schema/migration
+  changes, no UI, no security/crypto surface, no transport/network
+  surface. The data-engineer, security-engineer, network-engineer, and
+  devops-engineer personas are deactivated for this milestone.
 ---
+```

-### lead-developer (v0.7)
- **Domain**: coordination
- **Frameworks**: `cobra`
- **Constraints**: `boundary-enforcement`, `offline-first`, `no-redundant-implementations`
- **Territory**: `**/*.go`, `cmd/**`, `internal/**`
+### lead-developer (v0.10)
 - **Active**: true
- **Reason**: Coordination across P01/P02/P03. SSH/bootstrap touches security + cli + store + doctor — territory overlaps need adjudication (proxmox package boundary, doctor Proxmox check scaffolding).
+- **Territory**: `docs/**/*.md`, `examples/**`, `README.md`,
+  `.ciagent/**/*.md` (coordination + cross-cutting docs)
+- **Frameworks**: markdown, cobra (for CLI reference accuracy)
+- **Reason**: Owns the CLI reference doc, jobspec reference, ingress
+  guide, examples directory, README refresh, and namespace.md update.
+  Coordinates factual accuracy against the live codebase.

-### backend-engineer (v0.7)
- **Domain**: backend
- **Frameworks**: `cobra`, `net/http`, `golang.org/x/crypto/ssh`
- **Constraints**: `API-first`, `error-handling`, `minimal-dependencies`, `security-first`, `idempotent-bootstrap`
- **Territory**: `**/api/**`, `**/*_handler*`, `**/*_handler.go`, `internal/daemon/**`, `internal/proxmox/**`, `internal/cli/init.go`
+### backend-engineer (v0.10)
 - **Active**: true
- **Reason**: Owns the `orca init` full-bootstrap orchestration (CA + cert + db + localhost node, idempotent) and the `internal/proxmox/bootstrap.go` SSH session sequence (dial, deploy pubkey, useradd, pveum, sudoers, visudo validate). Added `idempotent-bootstrap` constraint (D-036 — re-run must be skip-and-refresh) and `golang.org/x/crypto/ssh` to frameworks.
+- **Territory**: `scripts/release.sh`, `scripts/install.sh`,
+  `scripts/tests/*.bash`
+- **Frameworks**: bash, curl, tea CLI, Gitea API
+- **Reason**: Owns the release/install pipeline fix (cross-build amd64,
+  asset verification, fallback walk). The scripts are API-adjacent
+  tooling that interacts with the Gitea releases API.

-### data-engineer (v0.7)
- **Domain**: data
- **Frameworks**: `modernc/sqlite`, `iter`
- **Constraints**: `schema-first`, `migration-safe`, `local-storage-only`, `no-goroutine-leak`, `nullable-column-handling`
- **Territory**: `**/store/**`, `**/model.go`, `**/migration*`, `migrations/**`, `internal/store/migrations/**`, `internal/model/node.go`
- **Active**: true
- **Reason**: Reactivated for v0.6. Owns migration `0006_node_kind_os.sql` (REQ-049 — nullable `kind`/`os` columns, backward-compatible) and `NodeRepo` schema extension (Insert/Get/List/Watch/scanNode column additions + new `GetByName`/`UpdateLastSeenAndOS` helpers). Added `nullable-column-handling` constraint (NULL → `""` in Go struct, not nil-deref).
+### docs-engineer (v0.10 — phase-specific)
+- **Active**: true (phase-specific: P2, P3, P4)
+- **Territory**: `docs/cli.md`, `docs/jobspec.md`, `docs/ingress.md`,
+  `examples/full-stack/**`
+- **Frameworks**: markdown, GitHub-flavored markdown
+- **Constraints**: factual-accuracy-against-codebase,
+  cross-link-resolution, deprecation-callouts
+- **Reason**: Custom persona for the markdown authoring work. Ensures
+  every factual claim in the docs is grounded in the live codebase
+  (struct fields, flag definitions, paths) and every cross-link
+  resolves. Removed after P4.

-### cli-engineer (v0.7)
- **Domain**: CLI/UX
- **Frameworks**: `cobra`, `pflag`
- **Constraints**: `discoverable-help`, `consistent-flag-naming`, `human-readable-output`, `machine-readable-json-flag`, `signal-handling`, `password-flag-redaction`
- **Territory**: `cmd/**`, `internal/cli/**`, `internal/commands/**`
- **Active**: true
- **Reason**: Owns `orca init` multi-step bootstrap output UX (progress lines per step), `orca node join --type/--host/--user/--password/--proxmox-user/--proxmox-role` flag wiring, and `doctor os`/`doctor proxmox` subcommand wiring. Added `password-flag-redaction` constraint (D-031 — `--password` never echoed, prefer `$ORCA_PROXMOX_PASSWORD`, zero after use).
-
-### security-engineer (v0.7)
- **Domain**: security
- **Frameworks**: `crypto/tls`, `crypto/x509`, `crypto/ed25519`, `golang.org/x/crypto/ssh`, `slog`
- **Constraints**: `no-panic-in-production`, `structured-audit-logging`, `no-secret-in-logs`, `input-validation`, `least-privilege`, `tofu-host-key-pinning`, `noexec-sudoers`
- **Territory**: `**/auth/**`, `**/audit/**`, `internal/security/**`, `internal/transport/**` (TLS config only), `internal/proxmox/**` (SSH + sudoers + PVE role)
- **Active**: true
- **Reason**: Reactivated for v0.6. Owns `internal/security/sshkey.go` (Ed25519 keygen, 0600/0644 mode enforcement per REQ-033 spirit), TOFU host-key pinning via `knownhosts.New`, sudoers least-privilege design (NOEXEC on pct/qm, exclude pvesh, no NOEXEC on apt-get/dpkg), password redaction (D-031), and audit logging of all bootstrap/join actions (REQ-052). Added `tofu-host-key-pinning` and `noexec-sudoers` constraints. Co-owns `internal/proxmox/**` with backend-engineer (security owns SSH auth + sudoers content; backend owns the session orchestration).
-
-### devops-engineer (v0.7)
- **Active**: false (v0.6)
- **Reason**: Deactivated — v0.6 has no install.sh, Dockerfile, .coreci.yml, or release-pipeline surface. The Proxmox SSH bootstrap is backend + security work, not devops. Was active in v0.5 (distribution milestone).
-
-### network-engineer (v0.7)
- **Active**: false (v0.6)
- **Reason**: v0.6 has no transport/mTLS surface. SSH is point-to-point bootstrap, not the mTLS mesh network-engineer owns.
-
-### frontend-engineer (v0.7)
- **Active**: false (v0.6)
- **Reason**: No web UI in Orca (unchanged from v0.1 onward).
-
-### v0.6 vs v0.5 Persona Diff (v0.7 baseline reference)
+### Deactivated personas (v0.10)
+- **data-engineer**: no schema/migration work this milestone.
+- **security-engineer**: no crypto/threat-model work this milestone.
+- **network-engineer**: no transport/socket work this milestone.
+- **devops-engineer**: no packaging/distribution work beyond the
+  release.sh fix (owned by backend-engineer).
+- **cli-engineer**: no new CLI commands this milestone.
+- **frontend-engineer**: no web UI (unchanged from v0.1).

 | Change | Rationale |
 |--------|-----------|
@@ -0,0 +1,96 @@
+# Plan: v0.10 Docs & Install Milestone
+
+## Milestone: v0.10 — Docs & Install Hardening
+- **Type**: feature (P1 `fix`, P2-P4 `docs`; at least one non-docs phase)
+- **Tags**: `v0.9.0` (P0) → `v0.9.1` (P1) → `v0.9.2` (P2) → `v0.9.3` (P3) → `v0.9.4` (P4) → `v0.9.5` (P5 = milestone release)
+- **Branch**: `milestone/v0.10-docs-cli-examples`
+
+## Phase breakdown
+
+### Phase P1 — release.sh + install.sh fix (Wave 1)
+**REQs**: REQ-097, REQ-098
+**Persona**: backend-engineer
+**Territory**: `scripts/release.sh`, `scripts/install.sh`, `scripts/tests/*.bash`
+**Vertical slice**: a broken release → a correctly-asseted release that install.sh resolves.
+
+| Task | Description | REQ |
+|------|-------------|-----|
+| P1-T1 | `scripts/release.sh`: replace host-arch build (lines 84, 89-98) with explicit `GOOS=linux GOARCH=amd64 go build` cross-build; produce `orca-${VERSION}-linux-amd64.tar.gz` regardless of host arch | REQ-097 |
+| P1-T2 | `scripts/release.sh`: after `tea releases create` (line 132), add post-create asset verification — query `/api/v1/repos/$OWNER/$REPO/releases/tags/$VERSION`, assert the tarball appears in `attachments`, retry once if missing, fail loudly with clear error if still missing | REQ-097 |
+| P1-T3 | `scripts/install.sh`: add asset fallback walk — if the resolved release (latest or `--version`) lacks the matching `orca-<ver>-<os>-<arch>.tar.gz`, query `/releases?limit=20`, walk backward, use the most recent release that carries the asset, print a warning | REQ-098 |
+| P1-T4 | `scripts/install.sh`: add `--check` dry-run mode that prints version + asset URL + install path without writing | REQ-098 |
+| P1-T5 | `scripts/tests/release.bats` + `scripts/tests/install.bats`: add/extend bats tests for the new behavior (happy path: asset present; fallback: latest release asset-less, older release has asset; --check prints without writing) | REQ-097, REQ-098 |
+
+**Must-haves**: release.sh produces an amd64 tarball on any host arch; install.sh resolves to a release with an asset (walking back if needed); `--check` works; bats tests pass.
+
+### Phase P2 — CLI + jobspec + ingress docs (Wave 2)
+**REQs**: REQ-091, REQ-092, REQ-093
+**Persona**: docs-engineer (phase-specific), lead-developer
+**Territory**: `docs/cli.md`, `docs/jobspec.md`, `docs/ingress.md`
+**Vertical slice**: an operator with no orca background → can author a jobspec, run it, and understand the ingress model from docs alone.
+
+| Task | Description | REQ |
+|------|-------------|-----|
+| P2-T1 | `docs/cli.md`: full CLI reference — global flags, every command/subcommand with synopsis + flag tables + one-line example, output modes (text/json/watch), exit codes, deprecated surface callout boxes (daemon/cert/node-join-mTLS/HCL-jobspec) | REQ-091 |
+| P2-T2 | `docs/jobspec.md`: markdown frontmatter schema reference — top-level keys, block reference (runtime/ports/env-secrets/volumes/restart/update/service/health/lifecycle/constraints/affinity/tasks), kinds matrix, CEL subset grammar, body semantics, deprecated HCL callout | REQ-092 |
+| P2-T3 | `docs/ingress.md`: Traefik ingress reference — service→Traefik mapping, R-007 socket-vs-TCP-bind, generated YAML shape, atomic reload (C-10), drain, TLS, worked-example pointer to `examples/full-stack/`, v0.10 forward limitations | REQ-093 |
+
+**Must-haves**: every command/flag in `internal/cli/` is documented; every jobspec field in `internal/jobspec/markdown.go` is documented; every factual claim is grounded in the live codebase; cross-links resolve; deprecated surface is clearly marked.
+
+### Phase P3 — full-stack examples (Wave 2, parallel with P2)
+**REQs**: REQ-094
+**Persona**: docs-engineer (phase-specific), lead-developer
+**Territory**: `examples/full-stack/**`
+**Vertical slice**: an operator → can deploy a multi-service stack with ingress by copying the examples.
+
+| Task | Description | REQ |
+|------|-------------|-----|
+| P3-T1 | `examples/full-stack/web-app.md`: kind Service, process runtime, port http, service block (socket default), health, restart (service), update (rolling), constraints (CEL), task group (app + sidecar) | REQ-094 |
+| P3-T2 | `examples/full-stack/api.md`: kind Service, process runtime, port api, service bind 127.0.0.1 (TCP opt-in), health, restart, update (canary) | REQ-094 |
+| P3-T3 | `examples/full-stack/worker.md`: kind Job, process runtime, one-shot, timeout, env, lifecycle hooks | REQ-094 |
+| P3-T4 | `examples/full-stack/log-shipper.md`: kind DaemonSet, schedule (every-node), restart, constraints | REQ-094 |
+| P3-T5 | `examples/full-stack/postgres.md`: kind Service, process runtime, port pg, volumes + replication (syncthing), health, restart, update (blue-green) | REQ-094 |
+| P3-T6 | `examples/full-stack/rendered/`: the Traefik dynamic YAML + systemd units orca generates for the stack (traefik-dynamic-web-app.yaml, traefik-dynamic-api.yaml, systemd-web-app.service, systemd-api.service, systemd-log-shipper.service) | REQ-094 |
+| P3-T7 | `examples/full-stack/README.md`: walkthrough (init → node join → capacity set → ns create → job run → list --watch → inspect rendered → drain/rollback notes → cross-link to docs/ingress.md) | REQ-094 |
+
+**Must-haves**: all 5 jobspecs parse with the current `internal/jobspec` parser and pass `internal/spec/schema` validators; rendered artifacts match what the emitters would produce; README walkthrough is end-to-end coherent.
+
+### Phase P4 — README + namespace.md refresh (Wave 3, after P2/P3)
+**REQs**: REQ-095, REQ-096
+**Persona**: lead-developer
+**Territory**: `README.md`, `docs/namespace.md`
+**Vertical slice**: a new visitor to the repo → sees accurate status, all commands, install instructions that work, and a link to the docs + examples.
+
+| Task | Description | REQ |
+|------|-------------|-----|
+| P4-T1 | `README.md`: status line (v0.9 complete, v0.10 in progress); install `--version` example updated to current tag; subcommand table expanded to all commands with deprecation markers; update-in-place example updated; development targets complete; new Documentation + Examples sections | REQ-095 |
+| P4-T2 | `docs/namespace.md`: replace v0.8 flat path table with v0.9 multi-namespace layout (`cluster/`, `_defaults/`, per-ns `db/jobs/alloc/ns.md`); `ORCA_HOME`/`--system` resolution; `orca ns` subcommand cross-link; v0.8 flat layout flagged deprecated | REQ-096 |
+
+**Must-haves**: README subcommand table matches `internal/cli/` exactly; install example pins a current tag; namespace.md path table matches `internal/paths/paths.go`; both files cross-link to the new docs.
+
+### Phase P5 — final review + ship + audit (Wave 4)
+**REQs**: all (REQ-091..REQ-098)
+**Persona**: lead-developer
+**Vertical slice**: milestone complete → merged to main, tagged, released.
+
+| Task | Description | REQ |
+|------|-------------|-----|
+| P5-T1 | Code review across all phases (P1-P4); auto-apply P0 fixes, flag P1+ for post-hoc | all |
+| P5-T2 | Audit: reconstruction test (git log matches `.ciagent/`), file discipline, branch hygiene, commit discipline | all |
+| P5-T3 | Milestone ship: merge phase/05 → milestone → main; tag `v0.9.5` (= v0.10.0 milestone release); create release with full milestone summary + Linux binary asset (verified by the P1 fix); delete all milestone branches | all |
+| P5-T4 | Complete milestone: mark REQ-091..098 complete in REQUIREMENTS.md; mark v0.10 docs milestone complete in ROADMAP.md; clear checkpoint | all |
+
+**Must-haves**: milestone merged to main; release carries the Linux binary (the fix from P1 proving itself); all REQs marked complete; checkpoint cleared.
+
+## Wave ordering
+
+- **Wave 1**: P1 (release/install fix) — unblocks the ship of every subsequent phase (each phase ship needs a correctly-asseted release)
+- **Wave 2**: P2 (docs) + P3 (examples) — parallel, no dependencies between them
+- **Wave 3**: P4 (README + namespace.md) — depends on P2/P3 existing (cross-links)
+- **Wave 4**: P5 (final review + ship) — depends on all prior phases
+
+## Risks
+
+- **R1**: The jobspecs in P3 might not parse if a field shape has drifted since the explore report. Mitigation: validate each jobspec against the current parser before committing (write a throwaway test or run `orca job run` with `--dry-run` if available).
+- **R2**: `tea releases create` asset verification in P1 might reveal a tea CLI bug that can't be worked around in bash. Mitigation: fall back to a direct `curl` upload to the Gitea attachments API if `tea` is unreliable.
+- **R3**: The v0.8.15 release still has no asset after P1 ships (P1 only fixes forward). Mitigation: install.sh's fallback walk (P1-T3) handles the gap; users installing between P1 ship and the first correctly-asseted release (P1's own ship tag v0.9.1) will get a clear warning + fallback.
@@ -446,3 +446,61 @@ are recorded in `REQUIREMENTS.md`. The reordered phase plan is in
 | D-179 | Jobspec format: HCL canonical (AD-007) or Markdown? | **Markdown with YAML frontmatter canonical (R-013); HCL legacy** | PRD §8 — Markdown + body preservation is the operator-facing format. HCL adapter (REQ-064) preserves `orca job run old-spec.hcl` during migration. | 0.85 |
 | D-185 | Re-architecture justification: incremental additive or full re-architecture? | **Full re-architecture (overridden by user)** | Six-part evidence basis above; the grill's REPLAN mechanics (PC-01..PC-10, C-01..C-19) adopted as gates. The incremental-additive path was evaluated and rejected on grounds 1 + 5 (daemon failing; SSH-push only viable). | 0.88 |
 | D-187 | wasmtime Go binding (bytecodealliance/wasmtime-go) is CGO-based — does adopting it revoke D-002 (modernc/sqlite CGO-free cross-compile story)? | **Use the wasmtime CLI (apt-installed on peer) via SSH exec; do NOT import wasmtime-go.** | The Go binding links libwasmtime via cgo and would revoke D-002's CGO-free cross-compile story. The CLI-via-SSH approach (same pattern as podman/qm/pct) avoids CGO entirely. `internal/runtime/wasm.go` imports only stdlib + sshpush. `CGO_ENABLED=0 go build ./...` succeeds. C-01 grill gate SATISFIED; D-002 NOT revoked. Full evaluation in `internal/runtime/C01_WASMTIME_CGO_EVAL.md`. | 0.90 |
+
+---
+
+# v0.10 Docs & Install Milestone — Scope Summary
+
+v0.10 is a focused milestone that closes the documentation gap left by
+the v0.9 re-architecture and fixes the release/install pipeline bug that
+caused `install.sh` to resolve to v0.4.5 instead of the latest release.
+The v0.9 re-architecture shipped a complete CLI surface (markdown
+jobspec, `orca ns`, `orca node capacity`, CLI-side scheduler, emitters,
+Traefik ingress) but no operator-facing reference documentation. This
+milestone ships that documentation plus a worked full-stack example
+with ingress configured, and hardens the release pipeline so every
+Gitea release carries a Linux binary asset.
+
+## Root cause of the v0.4.5 install
+
+The v0.8.x releases (v0.8.0 through v0.8.15) shipped with **zero binary
+assets attached** to their Gitea releases. `scripts/install.sh` resolves
+"latest" by hitting `/releases/latest` (returns v0.8.15), then looks for
+`orca-v0.8.15-linux-amd64.tar.gz` in that release's assets. Since the
+asset is missing, install.sh errors out — there is no fallback walk to
+older releases that DO carry a binary. The user's v0.4.5 install came
+from an earlier run or a pinned `--version`. The fix is forward: harden
+`scripts/release.sh` to cross-build the amd64 tarball and verify the
+asset attached post-create; harden `scripts/install.sh` to walk
+backward through releases if the latest lacks the asset.
+
+## v0.10 Phases
+
+- **Phase 0 (pre-execution)**: specify → clarify → research → ideate → plan → grill. Tag `v0.9.0`.
+- **Phase P1 — release/install fix** (REQ-097, REQ-098): cross-build amd64 tarball in release.sh, post-create asset verification, install.sh fallback walk. Tag `v0.9.1`.
+- **Phase P2 — CLI + jobspec + ingress docs** (REQ-091, REQ-092, REQ-093): `docs/cli.md`, `docs/jobspec.md`, `docs/ingress.md`. Tag `v0.9.2`.
+- **Phase P3 — full-stack examples** (REQ-094): `examples/full-stack/` with 5 valid jobspecs + rendered artifacts + walkthrough README. Tag `v0.9.3`.
+- **Phase P4 — README + namespace.md refresh** (REQ-095, REQ-096): README subcommand table + install example + docs/examples sections; `docs/namespace.md` v0.9 layout. Tag `v0.9.4`.
+- **Phase P5 — final review + ship + audit** (milestone release). Tag `v0.9.5` = v0.10.0 milestone release.
+
+**Milestone type**: feature (P1 ships `fix` phases; P2/P3/P4 ship `docs`
+phases; at least one non-docs phase makes this a feature milestone per
+the versioning logic). Tags run on the v0.9.x patch line. The milestone
+branch label is `milestone/v0.10-docs-cli-examples`.
+
+The vision ("minimalist, offline-first, CLI-first orchestration
+engine") is unchanged. v0.10 is a documentation + install-hardening
+milestone, not a direction change. It builds on the v0.9
+re-architecture foundation without modifying any Go orchestration code.
+
+## v0.10 Clarified Decisions (D-series, full autonomy — Phase 0 pre-execution)
+
+| ID | Question | Decision | Rationale | Confidence |
+|----|----------|----------|-----------|------------|
+| D-188 | Should the CLI docs be a single `docs/cli.md` reference or a per-command `docs/cli/` subdirectory? | **Single `docs/cli.md` reference** | Mirrors the existing flat `docs/` pattern (install.md, docker.md, namespace.md, security-scanning.md). One file is more discoverable for a CLI tool and avoids navigation overhead. A per-command subdirectory diverges from the established layout. | 0.92 |
+| D-189 | Should the examples live in `examples/full-stack/` or in `testdata/`? | **`examples/full-stack/` as a new top-level directory** | `testdata/` holds legacy HCL fixtures (`hello.hcl`, `fail.hcl`) used by Go tests; mixing operator-facing examples with test fixtures conflates audiences. A new `examples/` directory is the conventional location for worked examples and is what an operator expects to find. | 0.93 |
+| D-190 | How deep should the ingress/Traefik documentation go? | **Dedicated `docs/ingress.md` plus a worked example in `examples/full-stack/`** | Ingress is the user's explicit ask ("full stack with ingress configured") and the Traefik/service-block model (R-007 socket vs TCP, atomic reload, drain, TLS) is non-trivial. A dedicated doc is the clearest answer; a section buried in `docs/cli.md` would be less discoverable. | 0.90 |
+| D-191 | Should the docs frame the v0.9 canonical path or document both v0.8 and v0.9 equally? | **Document the v0.9 canonical path; flag deprecated surface with callout boxes** | The v0.8 daemon/mTLS/HCL path is deprecated and scheduled for removal in v0.10-P14. Documenting it as primary misleads new operators; documenting both equally doubles the surface and risks documenting soon-removed code. Callout boxes with "deprecated in v0.9, removed in v0.10" point operators to the canonical path. | 0.91 |
+| D-192 | Should the existing v0.8.15 release be backfilled with a binary asset, or only fix the pipeline forward? | **Fix forward only; no backfill** | Backfilling a past release is an ops task, not a docs milestone deliverable. The next tagged phase (this milestone's P1 ship at v0.9.1) will be the first correctly-asseted release; install.sh's new fallback walk handles the gap until then. | 0.88 |
+| D-193 | Should `release.sh` build only `linux-amd64` or also `linux-arm64`? | **Cross-build `linux-amd64` explicitly (host-arch-independent); arm64 deferred to a follow-up** | The install.sh user base is amd64 today (the `.coreci.yml` release step hardcodes `--asset orca-${VERSION}-linux-amd64.tar.gz`). Building amd64 regardless of host arch (via `GOOS=linux GOARCH=amd64 go build`) guarantees the asset the install script expects. arm64 support is a separate enhancement. | 0.85 |
+| D-194 | Should `install.sh` add a `--check` dry-run mode? | **Yes, lightweight** | A dry-run mode (`--check`) that prints the version + asset URL + install path without writing is cheap to add and useful for debugging the "which release will I get?" question that the v0.4.5 incident surfaced. | 0.80 |
@@ -152,33 +152,52 @@ and `GRILL_v0.9.md`.

 | ID | Requirement | Priority | Phase | Status |
 |----|-------------|----------|-------|--------|
-| REQ-061 | `orca daemon` deprecation command and build-tag removal path: v0.9 emits deprecation warning + still runs (dual-write window); v1.0 repurposes to `orca daemon drain-and-stop` (stops v0.8 daemons on peers via SSH, confirms workloads survive via systemd); post-v1.0 the command and `internal/daemon/` are deleted. `// Deprecated` Go doc comments + `slog.Warn` on every run (I-M-001) | High | **v0.10 P14** (warn v0.9 P0X) | Pending |
-| REQ-062 | Coverage follow-ups: 3 zero-test packages (`internal/audit`, `internal/certpaths`, `cmd/orca`) + `internal/cli` to 70% floor; once `daemon.go` is deprecated/removed the exclusion reason disappears and the floor applies to the whole package; all net-new subsystems carry a 70% floor from their first phase (I-M-002) | Medium | **v0.9 P0X** + each new pkg | Pending |
-| REQ-063 | `known_hosts` flock concurrency gap (deferred P1 from REVIEW_v0.8 A2): add `flock`-style advisory lock (stdlib `syscall.Flock` wrapper) around the read-modify-write in `TOFUHostKeyCallback` capture path (`bootstrap.go:290-302`) and `ResetHostKey` (`bootstrap.go:479-523`); lock file at `cluster/known_hosts.lock` (R-002) (I-M-003) | Medium | **v0.9 P0a1** | Pending |
-| REQ-064 | HCL→Markdown jobspec adapter/bridge layer: keep `internal/jobspec/spec.go` as legacy HCL path behind `// Deprecated`; add `internal/jobspec/markdown.go` (canonical) + `internal/jobspec/dispatch.go` (extension-based dispatcher: `.md`→Markdown, `.hcl`→legacy, `.yaml`→Markdown-with-empty-body); unified `*WorkloadSpec` populated via adapter; preserves `orca job run old-spec.hcl` during migration window (I-M-004) | High | **v0.9 P0b** | Pending |
+| REQ-061 | `orca daemon` deprecation command and build-tag removal path: v0.9 emits deprecation warning + still runs (dual-write window); v1.0 repurposes to `orca daemon drain-and-stop` (stops v0.8 daemons on peers via SSH, confirms workloads survive via systemd); post-v1.0 the command and `internal/daemon/` are deleted. `// Deprecated` Go doc comments + `slog.Warn` on every run (I-M-001) | High | **v0.10 P14** (warn v0.10) | Pending |
+| REQ-062 | Coverage follow-ups: 3 zero-test packages (`internal/audit`, `internal/certpaths`, `cmd/orca`) + `internal/cli` to 70% floor; once `daemon.go` is deprecated/removed the exclusion reason disappears and the floor applies to the whole package; all net-new subsystems carry a 70% floor from their first phase (I-M-002) | Medium | **v0.9 P0X** + each new pkg | Complete |
+| REQ-063 | `known_hosts` flock concurrency gap (deferred P1 from REVIEW_v0.8 A2): add `flock`-style advisory lock (stdlib `syscall.Flock` wrapper) around the read-modify-write in `TOFUHostKeyCallback` capture path (`bootstrap.go:290-302`) and `ResetHostKey` (`bootstrap.go:479-523`); lock file at `cluster/known_hosts.lock` (R-002) (I-M-003) | Medium | **v0.9 P0a1** | Complete |
+| REQ-064 | HCL→Markdown jobspec adapter/bridge layer: keep `internal/jobspec/spec.go` as legacy HCL path behind `// Deprecated`; add `internal/jobspec/markdown.go` (canonical) + `internal/jobspec/dispatch.go` (extension-based dispatcher: `.md`→Markdown, `.hcl`→legacy, `.yaml`→Markdown-with-empty-body); unified `*WorkloadSpec` populated via adapter; preserves `orca job run old-spec.hcl` during migration window (I-M-004) | High | **v0.9 P0b** | Complete |
 | REQ-065 | `orca doctor --legacy-paths` detection: detects v0.8 residue (orca.db at ORCA_HOME root, ca.crt/ca.key, config.hcl, flat server.crt, namespace column in any *.db); outputs list of legacy artifacts with migration recommendations; the detection half of v0.10-P14 (I-M-005) | Medium | **v0.10 P14c** | Pending |
 | REQ-066 | Legacy CA state migration to step-ca: `orca upgrade --to-v1.0 --import-ca` reads `~/.orca/ca.key`, initializes step-ca with it, re-issues workload SVIDs; preserves audit history even if live trust root changes (I-M-006). **Gated by C-07** | High | **v0.10 P14a** | Pending |
-| REQ-067 | Fuzz test harness for Markdown frontmatter parser: `testing.F` fuzz target in `internal/jobspec/markdown_test.go` round-trips random frontmatter+body through `ParseMarkdown` asserting byte-exact body preservation; corpus of adversarial fixtures (CRLF, BOM, no-frontmatter, empty-frontmatter, frontmatter-with-only-separator) (I-M-007) | Medium | **v0.9 P0b** | Pending |
-| REQ-068 | Deprecation warnings on removed/repurposed CLI subcommands: each removed/changed command (`orca cert`, `orca node join` mTLS semantics, `orca job run <spec.hcl>`) emits `slog.Warn` deprecation banner with v1.0 replacement except under `orca upgrade`; `--no-deprecation-warnings` global flag via `root.go` `PersistentPreRunE` (I-M-008) | Low | **v0.9 P0X** + v0.10 P13 | Pending |
-| REQ-069 | `internal/config/config.go` HCL config demotion via adapter: keep `internal/config/` as `legacy_config.go` with `// Deprecated`; add `internal/config/markdown.go` for new Markdown-frontmatter loader (R-014); `root.go` dispatches on file extension (`.hcl`→legacy, `.md`→new); `--config` semantics: `.hcl` read-only legacy, `.md` canonical (I-M-009) | High | **v0.9 P0a1** | Pending |
-| REQ-070 | `internal/certpaths/` replacement with multi-namespace path resolver: new `internal/paths` package with `paths.NamespaceDir(ns)`, `paths.ClusterDir()`, `paths.CacheDB()`, `paths.MasterKey()`, `paths.NSDb(ns)`, `paths.NSEnv(ns)`, `paths.NSSecrets(ns)`; keep `certpaths` as thin shim for v0.8 compat then remove post-v1.0 (R-002) (I-M-010) — highest blast radius | High | **v0.9 P0a1** | Pending |
-| REQ-071 | `internal/store/` schema: per-namespace DBs, drop namespace column: `store.Open` gains namespace parameter (or caller passes `paths.NSDb(ns)`); `migrate.go` runs migrations per namespace DB; `cert_repo` (0004) removed (step-ca handles certs); audit_log moves to CLI-side cache DB (R-008) (I-M-011) | High | **v0.9 P0a1** + v0.10 P06 | Pending |
-| REQ-072 | `internal/transport/` deletion + SSH-push package: delete `mtls.go`, `dispatch.go`, `handshake_log.go`; extract retry/idempotency patterns into `internal/sshpush/`; existing `transport.IdempotencyStore` directly reusable (I-M-012). Deletion deferred to v0.10-P14 to keep dual-write window open | High | **v0.9 P00** (delete v0.10 P14) | Pending |
-| REQ-073 | SSH-push transport layer design: connection pooling (reuse `*ssh.Client` per peer), idempotency (content-addressed filenames), retry (exponential backoff 100ms×2 cap 5s max 5), timeout (30s SCP, 10s exec), fan-out (errgroup bounded concurrency default 8), known_hosts reuse `proxmox.TOFUHostKeyCallback` (I-B-001) | High | **v0.9 P01** (design P0a1) | Pending |
-| REQ-074 | Emitter template system (Layer 4): `internal/emitter/` package with `Emitter` interface `Render(spec *WorkloadSpec, node *Node) ([]File, error)`; implementations systemdEmitter/traefikEmitter/syncthingEmitter/socketEmitter; SSH-push SCPs `[]File` atomically (write-to-tmp + rename); emitters registered per kind + runtime (I-B-002) | High | **v0.9 P0c** | Pending |
-| REQ-075 | Lead applier execution model: CLI renders transaction bundle (tarball + apply.sh + verify.sh) on operator host, SCPs to lead's `/run/orca/txns/<txn-id>/`, lead's systemd timer runs `apply.sh` idempotently, CLI polls txn status via SSH; bash scripts generated by emitter not hand-written (I-B-003). **Gated by C-09** | High | **v0.10 P10** (design v0.9 P00) | Pending |
-| REQ-076 | step-ca integration: `orca init` runs `step ca init` on lead; CLI SSHs to lead, installs step-ca via apt, stores step-ca.json; workload SVIDs via `step ca token` (JWE minted by CLI) → `step ca certificate`; SPIFFE ID as SAN; new `internal/stepca/` package wraps `step` CLI via SSH (I-B-004). Reverses AD-010 per override justification ground 2 | High | **v0.9 P07** + v0.10 P02 | Pending |
-| REQ-077 | Traefik dynamic config generation + atomic reload: Traefik emitter renders `/etc/traefik/dynamic/orca-<ns>-<svc>.yaml` with backends (socket paths R-007), health checks, mTLS config pointing at step-ca root; atomic reload via tmpfile+fsync+rename triggering fsnotify; drain writes `weight=0` or removes backend (I-B-005). **Gated by C-10** | High | **v0.9 P02** | Pending |
-| REQ-078 | Runtime abstraction interface (5 backends): `Runtime` interface in `internal/runtime/` with Prepare/Start/Stop/Status; processRuntime (wraps existing executor.go), wasmRuntime (wasmtime via SSH), podmanRuntime, pveVMRuntime (qm via proxmox SSH), pveCTRuntime (pct); runtimeRegistry keyed by `runtime:` frontmatter value; Alloc carries runtime field changeable on migration (I-B-006). Split P07a/b/c per PC-10. **P07b gated by C-01** | High | **v0.9 P07a/b/c** | Pending |
-| REQ-079 | Transaction bundle format + N-peer atomicity: bundle = tarball with desired-state.json + apply.sh + verify.sh + rollback.sh + manifest.sig (signed with master.key); content-addressed `<txn-id>=sha256(desired-state.json)` stored in `cluster/txns/<txn-id>/`; lead applies to self first then fans out; failure on any peer runs rollback.sh on applied peers (I-B-007). **Gated by C-09** | High | **v0.10 P10** (design v0.9 P00) | Pending |
+| REQ-067 | Fuzz test harness for Markdown frontmatter parser: `testing.F` fuzz target in `internal/jobspec/markdown_test.go` round-trips random frontmatter+body through `ParseMarkdown` asserting byte-exact body preservation; corpus of adversarial fixtures (CRLF, BOM, no-frontmatter, empty-frontmatter, frontmatter-with-only-separator) (I-M-007) | Medium | **v0.9 P0b** | Complete |
+| REQ-068 | Deprecation warnings on removed/repurposed CLI subcommands: each removed/changed command (`orca cert`, `orca node join` mTLS semantics, `orca job run <spec.hcl>`) emits `slog.Warn` deprecation banner with v1.0 replacement except under `orca upgrade`; `--no-deprecation-warnings` global flag via `root.go` `PersistentPreRunE` (I-M-008) | Low | **v0.9 P0X** + v0.10 P13 | Complete |
+| REQ-069 | `internal/config/config.go` HCL config demotion via adapter: keep `internal/config/` as `legacy_config.go` with `// Deprecated`; add `internal/config/markdown.go` for new Markdown-frontmatter loader (R-014); `root.go` dispatches on file extension (`.hcl`→legacy, `.md`→new); `--config` semantics: `.hcl` read-only legacy, `.md` canonical (I-M-009) | High | **v0.9 P0a1** | Complete |
+| REQ-070 | `internal/certpaths/` replacement with multi-namespace path resolver: new `internal/paths` package with `paths.NamespaceDir(ns)`, `paths.ClusterDir()`, `paths.CacheDB()`, `paths.MasterKey()`, `paths.NSDb(ns)`, `paths.NSEnv(ns)`, `paths.NSSecrets(ns)`; keep `certpaths` as thin shim for v0.8 compat then remove post-v1.0 (R-002) (I-M-010) — highest blast radius | High | **v0.9 P0a1** | Complete |
+| REQ-071 | `internal/store/` schema: per-namespace DBs, drop namespace column: `store.Open` gains namespace parameter (or caller passes `paths.NSDb(ns)`); `migrate.go` runs migrations per namespace DB; `cert_repo` (0004) removed (step-ca handles certs); audit_log moves to CLI-side cache DB (R-008) (I-M-011) | High | **v0.9 P0a1** + v0.10 P06 | Complete |
+| REQ-072 | `internal/transport/` deletion + SSH-push package: delete `mtls.go`, `dispatch.go`, `handshake_log.go`; extract retry/idempotency patterns into `internal/sshpush/`; existing `transport.IdempotencyStore` directly reusable (I-M-012). Deletion deferred to v0.10-P14 to keep dual-write window open | High | **v0.9 P00** (delete v0.10 P14) | Complete |
+| REQ-073 | SSH-push transport layer design: connection pooling (reuse `*ssh.Client` per peer), idempotency (content-addressed filenames), retry (exponential backoff 100ms×2 cap 5s max 5), timeout (30s SCP, 10s exec), fan-out (errgroup bounded concurrency default 8), known_hosts reuse `proxmox.TOFUHostKeyCallback` (I-B-001) | High | **v0.9 P01** (design P0a1) | Complete |
+| REQ-074 | Emitter template system (Layer 4): `internal/emitter/` package with `Emitter` interface `Render(spec *WorkloadSpec, node *Node) ([]File, error)`; implementations systemdEmitter/traefikEmitter/syncthingEmitter/socketEmitter; SSH-push SCPs `[]File` atomically (write-to-tmp + rename); emitters registered per kind + runtime (I-B-002) | High | **v0.9 P0c** | Complete |
+| REQ-075 | Lead applier execution model: CLI renders transaction bundle (tarball + apply.sh + verify.sh) on operator host, SCPs to lead's `/run/orca/txns/<txn-id>/`, lead's systemd timer runs `apply.sh` idempotently, CLI polls txn status via SSH; bash scripts generated by emitter not hand-written (I-B-003). **Gated by C-09** | High | **v0.10 P10** (design v0.10) | Pending |
+| REQ-076 | step-ca integration: `orca init` runs `step ca init` on lead; CLI SSHs to lead, installs step-ca via apt, stores step-ca.json; workload SVIDs via `step ca token` (JWE minted by CLI) → `step ca certificate`; SPIFFE ID as SAN; new `internal/stepca/` package wraps `step` CLI via SSH (I-B-004). Reverses AD-010 per override justification ground 2 | High | **v0.9 P07** + v0.10 P02 | Complete |
+| REQ-077 | Traefik dynamic config generation + atomic reload: Traefik emitter renders `/etc/traefik/dynamic/orca-<ns>-<svc>.yaml` with backends (socket paths R-007), health checks, mTLS config pointing at step-ca root; atomic reload via tmpfile+fsync+rename triggering fsnotify; drain writes `weight=0` or removes backend (I-B-005). **Gated by C-10** | High | **v0.9 P02** | Complete |
+| REQ-078 | Runtime abstraction interface (5 backends): `Runtime` interface in `internal/runtime/` with Prepare/Start/Stop/Status; processRuntime (wraps existing executor.go), wasmRuntime (wasmtime via SSH), podmanRuntime, pveVMRuntime (qm via proxmox SSH), pveCTRuntime (pct); runtimeRegistry keyed by `runtime:` frontmatter value; Alloc carries runtime field changeable on migration (I-B-006). Split P07a/b/c per PC-10. **P07b gated by C-01** | High | **v0.9 P07a/b/c** | Complete |
+| REQ-079 | Transaction bundle format + N-peer atomicity: bundle = tarball with desired-state.json + apply.sh + verify.sh + rollback.sh + manifest.sig (signed with master.key); content-addressed `<txn-id>=sha256(desired-state.json)` stored in `cluster/txns/<txn-id>/`; lead applies to self first then fans out; failure on any peer runs rollback.sh on applied peers (I-B-007). **Gated by C-09** | High | **v0.10 P10** (design v0.10) | Pending |
 | REQ-080 | Master key management + HKDF-SHA256 per-line .env.secrets encryption: `cluster/master.key` 32-byte random (generated at `orca init` using WriteAtomic pattern); each line `base64(nonce||ciphertext||tag)`, nonce=random(12 bytes), AES-256-GCM with AAD=line-number (prevents line-swap); HKDF-SHA256 derives per-namespace sub-keys; `orca secrets set/get`; v0.8 `internal/security/redact.go` reusable (I-B-008). **Gated by C-19** | High | **v0.10 P03** | Pending |
-| REQ-081 | Syncthing config rendering + folder-ID content-addressing: per-namespace Syncthing folder `orca-<ns>` with content-addressed folder ID `sha256(ns + master-key-fingerprint)`; CLI renders config.xml per peer; Syncthing runs as systemd unit (emitted by systemd emitter); CLI discovers peers via `cluster/peers/`; migration works because new node joins folder and syncs before workload starts (I-B-009). **Gated by C-02 + C-14** | Medium | **v0.9 P09** (spike v0.9 P00) | Pending |
-| REQ-082 | Namespace inheritance resolver algorithm: DFS parent walker with visited set for cycle detection; `_defaults/` implicit root (always exists, no parent); merge semantics: child overrides parent for scalars, arrays unioned (child adds to parent); pure function (no I/O) taking `map[nsName→*NSConfig]` returning `map[nsName→*ResolvedNS]` (I-B-010) | High | **v0.9 P0a2** | Pending |
-| REQ-083 | CLI-side scheduler redesign: `Score(node, workload) (score int, fits bool)` where `fits` checks runtime compatibility + constraints, `score` is bin-packing (most free capacity = highest); Services pick `count` distinct nodes (anti-affinity default); DaemonSets pick all matching nodes; Job = one-shot; CLI-side not daemon-side (R-001) (I-B-011) | High | **v0.9 P05** (skeleton P0c) | Pending |
+| REQ-081 | Syncthing config rendering + folder-ID content-addressing: per-namespace Syncthing folder `orca-<ns>` with content-addressed folder ID `sha256(ns + master-key-fingerprint)`; CLI renders config.xml per peer; Syncthing runs as systemd unit (emitted by systemd emitter); CLI discovers peers via `cluster/peers/`; migration works because new node joins folder and syncs before workload starts (I-B-009). **Gated by C-02 + C-14** | Medium | **v0.9 P09** (spike v0.9 P00) | Complete |
+| REQ-082 | Namespace inheritance resolver algorithm: DFS parent walker with visited set for cycle detection; `_defaults/` implicit root (always exists, no parent); merge semantics: child overrides parent for scalars, arrays unioned (child adds to parent); pure function (no I/O) taking `map[nsName→*NSConfig]` returning `map[nsName→*ResolvedNS]` (I-B-010) | High | **v0.9 P0a2** | Complete |
+| REQ-083 | CLI-side scheduler redesign: `Score(node, workload) (score int, fits bool)` where `fits` checks runtime compatibility + constraints, `score` is bin-packing (most free capacity = highest); Services pick `count` distinct nodes (anti-affinity default); DaemonSets pick all matching nodes; Job = one-shot; CLI-side not daemon-side (R-001) (I-B-011) | High | **v0.9 P05** (skeleton P0c) | Complete |
 | REQ-084 | `orca job lint` category-driven lint engine: `Linter` runs `Rule` checks returning `Finding{Category, Severity, Message, Explanation}`; categories schema/runtime/security/migration/best-practice; `--explain` prints rationale; pure (no I/O) checks against static rules (I-B-012) | Medium | **v0.10 P11** | Pending |
-| REQ-085 | v0.8→v1.0 migration ordering: v0.9 ships new parser + kinds + runtime + SSH-push alongside old daemon (dual-write window); `orca job run` dispatches on extension (`.md`→SSH-push, `.hcl`→old daemon); v0.10-P05 drains old daemons; v0.10-P14 converts remaining `.hcl` specs and removes daemon (I-C-001). **Most important cross-cutting idea** | High | **v0.9 P00** → v0.10 P14 | Pending |
+| REQ-085 | v0.8→v1.0 migration ordering: v0.9 ships new parser + kinds + runtime + SSH-push alongside old daemon (dual-write window); `orca job run` dispatches on extension (`.md`→SSH-push, `.hcl`→old daemon); v0.10-P05 drains old daemons; v0.10-P14 converts remaining `.hcl` specs and removes daemon (I-C-001). **Most important cross-cutting idea** | High | **v0.9 P00** → v0.10 P14 | Complete |
 | REQ-086 | "No orca on server" enforcement: `orca doctor no-orca-on-server` SSHs to each peer verifying no `orca` binary in PATH, no `orca` systemd service, no `orca` process, no `/etc/orca/` directory; runs after v0.10-P05 before v0.10-P16; reuses v0.8 `proxmox` SSH session infrastructure (I-C-002). Implements grill C-13 | High | **v0.10 P14c** | Pending |
-| REQ-087 | Test infrastructure: hermetic 3-linux + 1-proxmox cluster pipeline: `test/integration/` with docker-compose/vagrant creating 4 containers/VMs; Go test harness SSHes to each, runs CLI, asserts end-to-end workflows (ns create → workload submit → migrate → drain); proxmox simulated via mock pct/qm; v0.8 e2e tests (bootstrapE2ESetup) are foundation (I-C-003) | Medium | **v0.10 P08** (bootstrap v0.9 P00) | Pending |
-| REQ-088 | Security-engineer + network-engineer persona reactivation: reactivate security-engineer (step-ca provisioner model, SSH-push blast radius, Traefik edge, .env.secrets crypto) and network-engineer (socket exposure R-007, Syncthing P2P ports, Traefik routing); cross-cutting review not single phase (I-C-004). Implements grill C-05 | High | **v0.9 P00** → v0.10 P16 | Pending |
-| REQ-089 | Documentation rewrite: ARCHITECTURE.md/PROJECT.md/README + AD-010 supersession: v0.9-P00 adds "v0.9 Architecture (Supersedes v0.8)" section + banners + Superseded Decisions table; v0.10-P15 rewrites README quickstart for new curl|sh + orca init + orca ns create flow (I-C-005) | Medium | **v0.9 P00** + v0.10 P15/P16 | Pending |
-| REQ-090 | Dual-write window: v0.9 `orca job run` dispatches on extension (`.md`→SSH-push new path, `.hcl`→old daemon path) via parser dispatcher (REQ-064); daemon not removed until v0.10-P05; SSH-push path writes to separate systemd unit namespace (`orca-v1-<alloc>.service`) while daemon uses `orca-<job>.service` — no unit name overlap = no conflict (I-C-006) | High | **v0.9 P00** | Pending |
+| REQ-087 | Test infrastructure: hermetic 3-linux + 1-proxmox cluster pipeline: `test/integration/` with docker-compose/vagrant creating 4 containers/VMs; Go test harness SSHes to each, runs CLI, asserts end-to-end workflows (ns create → workload submit → migrate → drain); proxmox simulated via mock pct/qm; v0.8 e2e tests (bootstrapE2ESetup) are foundation (I-C-003) | Medium | **v0.10 P08** (bootstrap v0.10) | Pending |
+| REQ-088 | Security-engineer + network-engineer persona reactivation: reactivate security-engineer (step-ca provisioner model, SSH-push blast radius, Traefik edge, .env.secrets crypto) and network-engineer (socket exposure R-007, Syncthing P2P ports, Traefik routing); cross-cutting review not single phase (I-C-004). Implements grill C-05 | High | **v0.9 P00** → v0.10 P16 | Complete |
+| REQ-089 | Documentation rewrite: ARCHITECTURE.md/PROJECT.md/README + AD-010 supersession: v0.9-P00 adds "v0.9 Architecture (Supersedes v0.8)" section + banners + Superseded Decisions table; v0.10-P15 rewrites README quickstart for new curl|sh + orca init + orca ns create flow (I-C-005) | Medium | **v0.9 P00** + v0.10 P15/P16 | Complete |
+| REQ-090 | Dual-write window: v0.9 `orca job run` dispatches on extension (`.md`→SSH-push new path, `.hcl`→old daemon path) via parser dispatcher (REQ-064); daemon not removed until v0.10-P05; SSH-push path writes to separate systemd unit namespace (`orca-v1-<alloc>.service`) while daemon uses `orca-<job>.service` — no unit name overlap = no conflict (I-C-006) | High | **v0.9 P00** | Complete |
+
+## v0.10 Docs & Install Milestone Requirements
+
+The following requirements are scoped to the v0.10 docs/cli-examples
+milestone. They cover the CLI reference documentation, jobspec
+reference, ingress guide, full-stack example jobspecs, README refresh,
+namespace.md v0.9 layout update, and the release/install pipeline fix
+that guarantees every Gitea release carries a Linux binary asset.
+
+| ID | Requirement | Priority | Phase | Status |
+|----|-------------|----------|-------|--------|
+| REQ-091 | `docs/cli.md` comprehensive CLI reference: every command/subcommand with synopsis, flags (name/type/default/description), and one-line example; global flags (`--json`, `--system`, `--config`, `--no-deprecation-warnings`); output modes (text vs `--json`, `--watch` table vs NDJSON); exit codes; deprecated surface (`orca daemon`, `orca cert`, `orca node join` mTLS path, legacy `.hcl` jobspec) flagged with callout boxes pointing to v0.10 removal | High | **v0.10 P2** | Pending |
+| REQ-092 | `docs/jobspec.md` markdown frontmatter schema reference: all top-level keys, block reference (runtime, ports, env/secrets, volumes, restart, update, service, health, lifecycle, constraints, affinity, tasks), kinds matrix (Job/Service/DaemonSet required vs allowed), CEL subset grammar, body byte-exact preservation (R-015), deprecated HCL form callout | High | **v0.10 P2** | Pending |
+| REQ-093 | `docs/ingress.md` Traefik ingress reference: `kind: Service` implies Traefik route (D-175), R-007 socket-vs-TCP-bind semantics, generated Traefik YAML shape (routers/services/healthCheck), atomic reload (C-10), drain (`weight: 0`), TLS (certResolver, trust domain, step-ca), worked-example pointer to `examples/full-stack/`, v0.10 forward limitations (socket activation, transactional update) | High | **v0.10 P2** | Pending |
+| REQ-094 | `examples/full-stack/` directory with 5 valid jobspecs (`web-app.md`, `api.md`, `worker.md`, `log-shipper.md`, `postgres.md`) exercising ports/service/health/restart/update/constraints/affinity/lifecycle/task-groups/volumes/replication/DaemonSet; `rendered/` subdir showing the Traefik dynamic YAML + systemd units orca generates; `README.md` walkthrough (init → node join → capacity set → ns create → job run → list --watch → inspect rendered) | High | **v0.10 P3** | Pending |
+| REQ-095 | README.md refresh: status line (v0.9 complete, v0.10 in progress), install `--version` example updated to current tag, subcommand table expanded to all commands with deprecation markers, update-in-place example updated, development targets complete (`verify-reqs`, `security-scan`, `test-race`, `changelog`), new Documentation + Examples sections linking all `docs/*.md` and `examples/` | High | **v0.10 P4** | Pending |
+| REQ-096 | `docs/namespace.md` v0.9 multi-namespace layout update: replace v0.8 flat path table with v0.9 layout (`cluster/`, `_defaults/`, per-ns `db/jobs/alloc/ns.md`), `ORCA_HOME`/`--system` resolution, `orca ns` subcommand cross-link, v0.8 flat layout flagged deprecated | Medium | **v0.10 P4** | Pending |
+| REQ-097 | `scripts/release.sh` release pipeline fix: cross-build `linux-amd64` tarball regardless of host arch (`GOOS=linux GOARCH=amd64 go build`); post-create asset verification (query `/releases/tags/$VERSION`, assert the tarball in attachments, retry/fail loudly if missing). Guarantees every Gitea release carries the Linux binary asset (root cause of v0.4.5 install) | High | **v0.10 P1** | Pending |
+| REQ-098 | `scripts/install.sh` asset fallback walk: if the latest/pinned release lacks the matching `orca-<ver>-<os>-<arch>.tar.gz`, walk backward through `/releases?limit=20` to the most recent release that has it, with a clear warning. Keeps pulling from releases (not main). Optional `--check` dry-run mode | High | **v0.10 P1** | Pending |
@@ -0,0 +1,140 @@
+# Research: v0.10 Docs & Install Milestone
+
+## Documentation landscape in the orca tree
+
+### What exists today
+
+The `docs/` directory contains four files:
+
+- `docs/install.md` — install guide (user-level, system-level, version
+  pinning, in-place update, troubleshooting). Accurate for v0.5-v0.8
+  but does not mention the v0.9 multi-namespace layout, `--config`, or
+  `--no-deprecation-warnings`.
+- `docs/docker.md` — Docker image guide. Still documents `orca daemon`
+  (deprecated in v0.9).
+- `docs/namespace.md` — namespace and paths. Documents the **v0.8 flat
+  layout** (`~/.orca/orca.db`, `ca.crt`, `ca.key`, `server.crt`,
+  `server.key`). Does NOT document the v0.9 multi-namespace layout
+  (`cluster/`, `_defaults/`, per-ns `db/jobs/alloc/ns.md`), `orca ns`
+  subcommands, or the `_defaults` implicit root (D-159/D-185/D-187).
+- `docs/security-scanning.md` — gosec + govulncheck + gitleaks guide.
+  Accurate; no v0.9 drift.
+
+### What's missing (the gap this milestone closes)
+
+1. **No CLI reference doc.** The entire CLI command surface (init, job,
+   node, ns, cert, daemon, doctor, status, audit, version) is
+   undocumented in `docs/`. The README subcommand table is stale (lists
+   only version/init/status/node/job with fake "Phase N" statuses,
+   missing cert/daemon/doctor/audit/ns/node-capacity/node-key-reset).
+2. **No jobspec reference doc.** The markdown frontmatter schema (kinds,
+   blocks, CEL subset, validation rules, body semantics) is
+   undocumented. Operators must read `internal/jobspec/markdown.go` and
+   `internal/spec/schema/schema.go` source.
+3. **No ingress/Traefik doc.** The service→Traefik mapping, R-007
+   socket-vs-TCP-bind, atomic reload, drain, TLS — all undocumented.
+4. **No examples directory.** `testdata/` holds legacy HCL fixtures
+   (`hello.hcl`, `fail.hcl`) for Go tests, not operator-facing
+   examples. No worked full-stack demo exists.
+5. **README is stale.** Status line says "v0.1: Foundation".
+   Subcommand table missing 5 commands. Install `--version` example
+   pins v0.4.2. Update-in-place example references v0.4.1→v0.4.2.
+   Development section omits 4 make targets.
+
+### Prior art for CLI reference docs
+
+- **Nomad**: `nomad job` / `nomad node` / `nomad agent` reference pages,
+  one per subcommand, with flag tables and JSON examples. Orca's
+  single-file `docs/cli.md` is simpler (one file vs a subdirectory) but
+  follows the same flag-table + example convention.
+- **kubectl**: `kubectl reference` + per-command pages. Too heavy for
+  orca; the single-file model fits the minimalist ethos.
+- **Docker CLI**: `docker run` reference with flag tables. Matches the
+  shape orca's `docs/cli.md` will take.
+
+### Prior art for example jobspecs
+
+- **Nomad example jobs**: `nomad-job-spec.example` files in the Nomad
+  repo showing service + job + sysbatch patterns. Orca's
+  `examples/full-stack/` mirrors this with 5 markdown jobspecs covering
+  Service/Job/DaemonSet + task groups + volumes + replication.
+- **Kubernetes examples**: `examples/` directory with yaml
+  deployments/services/ingress. Orca's equivalent is the 5 jobspecs +
+  rendered Traefik/systemd artifacts.
+
+## Release/install pipeline research
+
+### Root cause of the v0.4.5 install
+
+Verified via the Gitea API:
+
+```
+GET /api/v1/repos/coreci/orca/releases/latest
+→ tag_name: "v0.8.15"
+
+GET /api/v1/repos/coreci/orca/releases/tags/v0.8.15
+→ attachments: []   (zero binary assets)
+```
+
+The v0.8.x releases (v0.8.0 through v0.8.15) all shipped with **zero
+binary assets attached**. Only `v0.4.5` carries a tarball
+(`orca-v0.4.5-linux-amd64.tar.gz`).
+
+`scripts/install.sh:70-78` resolves "latest" → v0.8.15, then
+`install.sh:96-104` looks for `orca-v0.8.15-linux-amd64.tar.gz` in
+v0.8.15's assets. Since the asset is missing, install.sh errors out
+(`could not find asset ... in release v0.8.15`). The v0.4.5 install
+came from an earlier run or a pinned `--version`.
+
+### Why v0.8.x releases have no assets
+
+`scripts/release.sh:132-136` calls `tea releases create "$VERSION" ...
+--asset "$TARBALL"`. The script builds the tarball (line 98) and passes
+it to `tea`. Two likely failure modes:
+
+1. **Host arch mismatch**: `release.sh:89-95` builds for the host arch
+   (`uname -m`). If the CI runner or dev machine is arm64, it produces
+   `orca-v0.8.15-linux-arm64.tar.gz`, but `install.sh` looks for
+   `linux-amd64`. The `.coreci.yml:121` release step hardcodes
+   `--asset orca-${VERSION}-linux-amd64.tar.gz`, so the CI runner must
+   be amd64 — but `release.sh` run locally on an arm64 dev machine
+   produces the wrong arch.
+2. **Silent asset drop**: `tea releases create` has been observed to
+   succeed (exit 0) without attaching the asset in some tea versions.
+   The script treats `tea`'s exit code as success without verifying the
+   asset actually appears in the release.
+
+### Fix approach (REQ-097, REQ-098)
+
+**release.sh**:
+- Cross-build `linux-amd64` explicitly via
+  `GOOS=linux GOARCH=amd64 go build`, regardless of host arch.
+- After `tea releases create`, query
+  `/api/v1/repos/$OWNER/$REPO/releases/tags/$VERSION` and assert the
+  tarball appears in `attachments`. If not, retry once, then fail
+  loudly with a clear error.
+
+**install.sh**:
+- Add an asset fallback walk: if the resolved release (latest or
+  pinned) lacks the matching tarball, query
+  `/releases?limit=20`, walk backward, and use the most recent release
+  that carries the `orca-<ver>-<os>-<arch>.tar.gz` asset. Print a
+  clear warning.
+- Add `--check` dry-run mode (D-194) that prints the version + asset URL
+  + install path without writing.
+
+## Persona assessment (PERSONAS.md)
+
+This milestone touches two territories:
+
+1. **`scripts/` (release.sh, install.sh)** — bash scripts, not Go.
+   Backend-engineer territory (API-adjacent tooling). The fix is
+   cross-build + API verification + fallback walk.
+2. **`docs/` + `examples/` + `README.md`** — markdown documentation.
+   Lead-developer territory (coordination + cross-cutting docs).
+
+No data-engineer work (no schema/migration changes). No
+frontend-engineer work (no UI). The data-engineer persona is
+deactivated for this milestone. A docs-engineer custom persona is
+created for P2/P3/P4 (markdown authoring with codebase-grounded
+factual claims).
@@ -185,7 +185,7 @@ The vision ("minimalist, offline-first, CLI-first orchestration
 engine") is unchanged. v0.8 closes the coverage debt left by v0.7's
 50% floor and the trust-surface gaps explicitly deferred in v0.6.

-## Milestone v0.9: Re-architecture Foundation & Workloads
+## Milestone v0.9: Re-architecture Foundation & Workloads — **COMPLETE**

 **Scope**: This milestone SUPERSPEDES the shipped v0.1–v0.8 architecture per
 the adopted PRD (`.ciagent/PRD_v0.9.md`). The re-architecture is justified on
@@ -204,30 +204,27 @@ from `GRILL_v0.9.md` are adopted as execution gates. 30 net-new requirements
 chore/docs).

 - [ ] Phase 0: Pre-execution (specify → clarify → research → ideate → plan → grill) — tag `v0.8.0` (shipped; this is the phase you are reading)
- [ ] Phase P00: Deprecation sweep + migration-ordering decision + txn-design spike + hermetic test-infra bootstrap + persona reactivation + doc banners (REQ-072, REQ-085, REQ-088, REQ-089, REQ-090; gates C-03 ✅, C-05, C-06, C-15..C-18) — tag `v0.8.1`
- [ ] Phase P0a1: Multi-namespace path resolver + config HCL demotion + known_hosts flock (REQ-063, REQ-069, REQ-070, REQ-071; gate C-07) — tag `v0.8.2`
- [ ] Phase P0a2: Namespace CRUD + inheritance engine (REQ-082) — tag `v0.8.3`
- [ ] Phase P0b: Markdown jobspec parser + dispatcher + fuzz (REQ-064, REQ-067) — tag `v0.8.4`
- [ ] Phase P0c: Job/Service/DaemonSet schemas + emitter interface (REQ-074) — tag `v0.8.5`
- [ ] Phase P01: SSH-push transport + host-path volumes (REQ-073) — tag `v0.8.6`
- [ ] Phase P02: Service block + checks + restart + Traefik emitter (REQ-077; gate C-10) — tag `v0.8.7`
- [ ] Phase P03: Update stanza (rolling/canary) — tag `v0.8.8`
- [ ] Phase P04: Lifecycle hooks (systemd ExecStop) — tag `v0.8.9`
- [ ] Phase P05: Constraints & affinity (CEL) + CLI-side scheduler (REQ-083) — tag `v0.8.10`
- [ ] Phase P06: Task groups (multi-process services) — tag `v0.8.11`
- [ ] Phase P07a: Process + podman runtimes (REQ-078) — tag `v0.8.12`
- [ ] Phase P07b: wasmtime runtime (REQ-078; **gate C-01** — CGO eval) — tag `v0.8.13`
- [ ] Phase P07c: pve-vm + pve-ct runtimes (REQ-078; extends REQ-076) — tag `v0.8.14`
- [ ] Phase P08: Socket plumbing (R-007) — tag `v0.8.15`
- [ ] Phase P09: Storage replication via Syncthing (REQ-081; **gates C-02, C-14**) — tag `v0.8.16`
- [ ] Phase P10: Lead rules + migration (REQ-076 step-ca integration) — tag `v0.8.17`
- [ ] Phase P0X: Ship + audit (REQ-062 coverage gate; REQ-068 deprecation warnings) — tag `v0.8.18`
+- [x] Phase P00: Deprecation sweep + bash tooling gate + render contract + doc banners (REQ-068,072,088,089,090; gates C-03,C-05,C-06,C-15..C-18) — tag `v0.8.1` ✓
+- [x] Phase P0a1: Multi-namespace path resolver + config demotion + known_hosts flock (REQ-063,069,070,071; gate C-07) — tag `v0.8.2` ✓
+- [x] Phase P0a2: Namespace CRUD + inheritance engine (REQ-082) — tag `v0.8.3` ✓
+- [x] Phase P0b: Markdown jobspec parser + dispatcher + fuzz (REQ-064,067) — tag `v0.8.4` ✓
+- [x] Phase P0c: Job/Service/DaemonSet schemas + emitter interface (REQ-074) — tag `v0.8.5` ✓
+- [x] Phase P01: SSH-push transport (REQ-073) — tag `v0.8.6` ✓
+- [x] Phase P02: Service block + Traefik emitter (REQ-077; gate C-10) — tag `v0.8.7` ✓
+- [x] Phase P03/P04/P08: Update stanza + lifecycle hooks + socket plumbing (combined) — tag `v0.8.8` ✓
+- [x] Phase P05: CLI-side scheduler + CEL constraints (REQ-083) — tag `v0.8.9` ✓
+- [x] Phase P06: Task groups (multi-process services) — tag `v0.8.10` ✓
+- [x] Phase P07a/b/c: Runtime abstraction — 5 backends (REQ-078; gate C-01) — tag `v0.8.11` ✓
+- [x] Phase P09: Syncthing storage replication (REQ-081; gates C-02,C-14) — tag `v0.8.12` ✓
+- [x] Phase P10: Lead rules + step-ca (REQ-076) — tag `v0.8.13` ✓
+- [x] Phase P0X: Ship + audit (REQ-062,068) — tag `v0.8.14` ✓

-**Milestone tag**: `v0.8.18` (final phase patch = milestone release per
-feature-milestone progressive-patch rule). Per-phase tags: `v0.8.1`…`v0.8.18`.
-Tags run on the previous minor's patch line (v0.8.x) per branch-strategy.md.
-The milestone branch label uses the milestone number
-(`milestone/v0.9-rearchitecture`); no separate minor tag.
+**Milestone tag**: `v0.8.15` (final phase patch = milestone release per
+feature-milestone progressive-patch rule). Per-phase tags: `v0.8.1`…`v0.8.14`.
+P03/P04/P08 were combined into one phase; P07a/b/c were combined into one
+phase. Actual execution: 14 tagged phases. Tags run on the previous minor's
+patch line (v0.8.x) per branch-strategy.md. The milestone branch label uses
+the milestone number (`milestone/v0.9-rearchitecture`); no separate minor tag.

 ### Per-phase REQ coverage (v0.9)

@@ -252,7 +249,53 @@ HCL-canonical, single-namespace, no-container-runtime, no-SPIFFE). The
 reversals are justified by the six-part evidence basis recorded in the
 PROJECT.md Supersession Table.

-## Milestone v0.10: Production Hardening
+## Milestone v0.10: Docs & Install Hardening — **IN PROGRESS**
+
+**Scope**: close the documentation gap left by the v0.9 re-architecture
+and fix the release/install pipeline bug that caused `install.sh` to
+resolve to v0.4.5 instead of the latest release. The v0.9
+re-architecture shipped a complete CLI surface (markdown jobspec,
+`orca ns`, `orca node capacity`, CLI-side scheduler, emitters, Traefik
+ingress) but no operator-facing reference documentation. This milestone
+ships that documentation plus a worked full-stack example with ingress
+configured, and hardens the release pipeline so every Gitea release
+carries a Linux binary asset.
+
+**Milestone type**: feature (P1 ships `fix` phases; P2/P3/P4 ship `docs`
+phases; at least one non-docs phase makes this a feature milestone per
+the versioning logic).
+
+- [ ] Phase 0: Pre-execution (specify → clarify → research → ideate → plan → grill) — tag `v0.9.0`
+- [ ] Phase P1: release.sh + install.sh fix (REQ-097, REQ-098) — tag `v0.9.1`
+- [ ] Phase P2: docs/cli.md + docs/jobspec.md + docs/ingress.md (REQ-091, REQ-092, REQ-093) — tag `v0.9.2`
+- [ ] Phase P3: examples/full-stack/ (REQ-094) — tag `v0.9.3`
+- [ ] Phase P4: README.md + docs/namespace.md refresh (REQ-095, REQ-096) — tag `v0.9.4`
+- [ ] Phase P5: Final review + ship + audit (milestone release) — tag `v0.9.5` = v0.10.0 milestone release
+
+**Milestone tag**: `v0.9.5` (final phase patch = milestone release per
+feature-milestone progressive-patch rule). Per-phase tags: `v0.9.0`…`v0.9.5`.
+Tags run on the previous minor's patch line (v0.9.x) per
+branch-strategy.md. The milestone branch label uses the milestone
+number (`milestone/v0.10-docs-cli-examples`); no separate minor tag.
+
+### Per-phase REQ coverage (v0.10 docs milestone)
+
+- **P1** — release.sh cross-build + asset verification (REQ-097); install.sh fallback walk (REQ-098)
+- **P2** — CLI reference (REQ-091); jobspec reference (REQ-092); ingress guide (REQ-093)
+- **P3** — full-stack examples (REQ-094)
+- **P4** — README refresh (REQ-095); namespace.md v0.9 layout (REQ-096)
+
+### Root cause of the v0.4.5 install (documented in RESEARCH_v0.10.md)
+
+The v0.8.x releases (v0.8.0–v0.8.15) shipped with zero binary assets
+attached to their Gitea releases. `install.sh` resolves "latest" →
+v0.8.15, looks for `orca-v0.8.15-linux-amd64.tar.gz`, finds nothing, and
+errors out. The v0.4.5 install came from an earlier run or a pinned
+`--version`. The fix is forward: release.sh cross-builds amd64 and
+verifies the asset post-create; install.sh walks backward through
+releases if the latest lacks the asset.
+
+## Milestone v0.11: Production Hardening

 **Scope**: ship a cluster that operators can run. Builds on the v0.9
 re-architecture foundation with the production-grade subsystems:
@@ -261,36 +304,36 @@ the v0.8→v1.0 migration.

 **Milestone type**: feature (multiple `feat` phases).

- [ ] Phase 0: Pre-execution (specify → clarify → research → plan → grill) — tag `v0.9.0`
- [ ] Phase P00: CLI cache layer (REQ-062 cache floor; R-008) — tag `v0.9.1`
- [ ] Phase P01: Metrics endpoint (hand-rolled text exposition) — tag `v0.9.2`
- [ ] Phase P01.5: SPIFFE SVID minting spike (REQ-076; **gate C-08** — if spike fails, fall back to mTLS identity) — tag `v0.9.3`
- [ ] Phase P02: ACL (SPIFFE + token identities) — tag `v0.9.4`
- [ ] Phase P03: Secrets subsystem (REQ-080; **gate C-19** threat model) — tag `v0.9.5`
- [ ] Phase P04: Backup/restore (tar + signed) — tag `v0.9.6`
- [ ] Phase P05: Drain + daemon drain-and-stop (REQ-061) — tag `v0.9.7`
- [ ] Phase P06: Alloc history (CLI-side SQLite retention; REQ-071 cache DB) — tag `v0.9.8`
- [ ] Phase P07: Recovery (`orca restore`) — tag `v0.9.9`
- [ ] Phase P08: Integration tests — expand hermetic harness (REQ-087) — tag `v0.9.10`
- [ ] Phase P09: Collector + aggregator (opt-in; **gates C-11, C-12, C-14**) — tag `v0.9.11`
- [ ] Phase P10: Transactional plane (REQ-075, REQ-079; **gate C-09** orca-pull.sh failure contract) — tag `v0.9.12`
- [ ] Phase P11: `orca job lint` (REQ-084) — tag `v0.9.13`
- [ ] Phase P12: `orca job verify` (dry-run txn through lead) — tag `v0.9.14`
- [ ] Phase P13: `orca ns` subcommands (full surface) + deprecation warnings (REQ-068) — tag `v0.9.15`
- [ ] Phase P14a: v0.8→v1.0 data migration (REQ-066; **gate C-07** CA migration spec) — tag `v0.9.16`
- [ ] Phase P14b: Daemon cutover + running-allocation adoption — tag `v0.9.17`
- [ ] Phase P14c: Mixed-version tolerance + no-orca-on-server enforcement (REQ-065, REQ-086; implements C-13) — tag `v0.9.18`
- [ ] Phase P15: README quickstart (REQ-089) — tag `v0.9.19`
- [ ] Phase P15.5: Threat model + security review (**gate C-19**) — tag `v0.9.20`
- [ ] Phase P16: Final review + ship + audit — **v0.10.0 milestone release** — tag `v0.9.21` (v1.0.0 cut separately after UAT sign-off)
+- [ ] Phase 0: Pre-execution (specify → clarify → research → plan → grill) — tag `v0.10.0`
+- [ ] Phase P00: CLI cache layer (REQ-062 cache floor; R-008) — tag `v0.10.1`
+- [ ] Phase P01: Metrics endpoint (hand-rolled text exposition) — tag `v0.10.2`
+- [ ] Phase P01.5: SPIFFE SVID minting spike (REQ-076; **gate C-08** — if spike fails, fall back to mTLS identity) — tag `v0.10.3`
+- [ ] Phase P02: ACL (SPIFFE + token identities) — tag `v0.10.4`
+- [ ] Phase P03: Secrets subsystem (REQ-080; **gate C-19** threat model) — tag `v0.10.5`
+- [ ] Phase P04: Backup/restore (tar + signed) — tag `v0.10.6`
+- [ ] Phase P05: Drain + daemon drain-and-stop (REQ-061) — tag `v0.10.7`
+- [ ] Phase P06: Alloc history (CLI-side SQLite retention; REQ-071 cache DB) — tag `v0.10.8`
+- [ ] Phase P07: Recovery (`orca restore`) — tag `v0.10.9`
+- [ ] Phase P08: Integration tests — expand hermetic harness (REQ-087) — tag `v0.10.10`
+- [ ] Phase P09: Collector + aggregator (opt-in; **gates C-11, C-12, C-14**) — tag `v0.10.11`
+- [ ] Phase P10: Transactional plane (REQ-075, REQ-079; **gate C-09** orca-pull.sh failure contract) — tag `v0.10.12`
+- [ ] Phase P11: `orca job lint` (REQ-084) — tag `v0.10.13`
+- [ ] Phase P12: `orca job verify` (dry-run txn through lead) — tag `v0.10.14`
+- [ ] Phase P13: `orca ns` subcommands (full surface) + deprecation warnings (REQ-068) — tag `v0.10.15`
+- [ ] Phase P14a: v0.8→v1.0 data migration (REQ-066; **gate C-07** CA migration spec) — tag `v0.10.16`
+- [ ] Phase P14b: Daemon cutover + running-allocation adoption — tag `v0.10.17`
+- [ ] Phase P14c: Mixed-version tolerance + no-orca-on-server enforcement (REQ-065, REQ-086; implements C-13) — tag `v0.10.18`
+- [ ] Phase P15: README quickstart (REQ-089) — tag `v0.10.19`
+- [ ] Phase P15.5: Threat model + security review (**gate C-19**) — tag `v0.10.20`
+- [ ] Phase P16: Final review + ship + audit — **v0.11.0 milestone release** — tag `v0.10.21` (v1.0.0 cut separately after UAT sign-off)

-**Milestone tag**: `v0.10.0` (the v0.10 milestone release tag; v1.0.0 is
-UAT-gated and cut separately after v0.10 completion per operator decision —
+**Milestone tag**: `v0.11.0` (the v0.11 milestone release tag; v1.0.0 is
+UAT-gated and cut separately after v0.11 completion per operator decision —
 the v1.0.0 tag marks production-ready sign-off, not a separate milestone).
-Per-phase patches run on the v0.9.x line per branch-strategy.md. Per-phase
-tags: `v0.9.0`…`v0.9.21`.
+Per-phase patches run on the v0.10.x line per branch-strategy.md. Per-phase
+tags: `v0.10.0`…`v0.10.21`.

-### Per-phase REQ coverage (v0.10)
+### Per-phase REQ coverage (v0.11)

 - **P00** — CLI cache (R-008)
 - **P01.5** — SPIFFE spike (REQ-076; C-08)
@@ -312,9 +355,9 @@ tags: `v0.9.0`…`v0.9.21`.
 - **wasmtime CGO breaks cross-compile** (mitigation: C-01 spike; fallback to podman/process primary)
 - **bash control plane drift** (mitigation: C-15..C-18 render-format contract + bats gate)
 - **daemon cutover orphans running allocs** (mitigation: P14b split; test adoption)
- **27→35+ phase scope** (mitigation: C-04 resolved — operator decision: keep 2 milestones v0.9 + v0.10, keep all phases, v1.0 is UAT-gated after v0.10; current count v0.9=18 + v0.10=22 = 40 phases, exceeds 35 soft limit but operator accepted)
+- **27→35+ phase scope** (mitigation: C-04 resolved — operator decision: keep 2 milestones v0.9 + v0.11, keep all phases, v1.0 is UAT-gated after v0.11; current count v0.9=18 + v0.11=22 = 40 phases, exceeds 35 soft limit but operator accepted)

-## Deferred to v1.x (out of scope for v0.10)
+## Deferred to v1.x (out of scope for v0.11)

 - `sqlite-wal-shared` state backend (R-009 abstractions ship in v1.0; backend in v1.x)
 - `git` state backend
@@ -5,7 +5,7 @@
      "slug": "orca",
      "name": "Orca",
      "description": "Offline/CLI-first orchestration engine (Orca) — Nomad-inspired, far simpler than Kubernetes",
-      "milestone": "v0.9",
+      "milestone": "v0.10",
      "phase": 0,
      "milestone_type": "feature",
      "default_branch": "main",
@@ -0,0 +1,86 @@
+// Package cluster holds cluster-wide invariants that are not owned
+// by a single subsystem. The first inhabitant is the lead-eligibility
+// rule R-003: the cluster lead is always a bare Linux node; Proxmox
+// nodes are permanently ineligible because their kernel is shared
+// with guest VMs/containers and a lead failure there takes down the
+// hypervisor too.
+//
+// The package is deliberately decoupled from the scheduler: it owns
+// its own minimal NodeInfo (Hostname + Kind) so it can be unit-tested
+// without pulling in the scheduler's capacity model. The scheduler's
+// scheduler.NodeInfo has a `Kind string` field with the same values
+// ("linux", "proxmox"); callers convert at the boundary.
+package cluster
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// NodeKind classifies a node for lead-eligibility purposes (R-003).
+// The string values match scheduler.NodeInfo.Kind and model.NodeKind
+// so callers can pass either representation through without mapping.
+type NodeKind string
+
+const (
+	// NodeKindLinux is a bare Linux node — lead-eligible (R-003).
+	NodeKindLinux NodeKind = "linux"
+	// NodeKindProxmox is a Proxmox VE host — permanently lead-
+	// ineligible (R-003): the hypervisor kernel is shared with
+	// guests, so a lead process there is a blast-radius hazard.
+	NodeKindProxmox NodeKind = "proxmox"
+)
+
+// ErrProxmoxNotLead is returned when a Proxmox node is proposed as
+// the new cluster lead (R-003).
+var ErrProxmoxNotLead = errors.New("Proxmox nodes cannot hold the cluster lead role (R-003)")
+
+// ErrNodeNotRegistered is returned when the proposed lead is not in
+// the supplied node list at all.
+var ErrNodeNotRegistered = errors.New("cluster: proposed lead is not a registered node")
+
+// NodeInfo is the minimal node projection the lead rules need. It is
+// intentionally smaller than scheduler.NodeInfo so this package has
+// no upstream dependency on the scheduler.
+type NodeInfo struct {
+	Hostname string
+	Kind     NodeKind
+}
+
+// IsLeadEligible reports whether a node of the given kind may hold
+// the cluster lead role (R-003). Linux nodes are eligible; Proxmox
+// nodes are permanently ineligible; any other kind (including the
+// empty string) is treated as ineligible.
+func IsLeadEligible(kind NodeKind) bool {
+	return kind == NodeKindLinux
+}
+
+// ValidateLeadRotation checks that newLead is a registered Linux node
+// and refuses Proxmox nodes with ErrProxmoxNotLead (R-003). It returns
+// ErrNodeNotRegistered when newLead is not in nodes at all. The check
+// is case-sensitive on hostname; node registries in Orca are
+// case-normalized at the store layer so this matches reality.
+func ValidateLeadRotation(newLead string, nodes []NodeInfo) error {
+	for _, n := range nodes {
+		if n.Hostname != newLead {
+			continue
+		}
+		if n.Kind == NodeKindProxmox {
+			return ErrProxmoxNotLead
+		}
+		if n.Kind == NodeKindLinux {
+			return nil
+		}
+		// Registered but neither linux nor proxmox (e.g. "localhost"
+		// auto-registered node, or a future kind). Treat unknown kinds
+		// as ineligible rather than guessing.
+		return fmt.Errorf("cluster: node %q has ineligible kind %q: %w", newLead, n.Kind, ErrProxmoxNotLead)
+	}
+	// Not found in the registry at all.
+	return fmt.Errorf("cluster: node %q not found: %w", newLead, ErrNodeNotRegistered)
+}
+
+// String renders a NodeKind for logs. It lowercases to match the
+// on-disk representation regardless of how the caller constructed it.
+func (k NodeKind) String() string { return strings.ToLower(string(k)) }
@@ -0,0 +1,119 @@
+package cluster
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestIsLeadEligible(t *testing.T) {
+	cases := []struct {
+		name string
+		kind NodeKind
+		want bool
+	}{
+		{"linux", NodeKindLinux, true},
+		{"proxmox", NodeKindProxmox, false},
+		{"empty", "", false},
+		{"unknown", NodeKind("foo"), false},
+		{"localhost", NodeKind("localhost"), false},
+	}
+	for _, tc := range cases {
+		if got := IsLeadEligible(tc.kind); got != tc.want {
+			t.Errorf("IsLeadEligible(%q) = %v, want %v", tc.kind, got, tc.want)
+		}
+	}
+}
+
+func TestValidateLeadRotation_LinuxOK(t *testing.T) {
+	nodes := []NodeInfo{
+		{Hostname: "n1", Kind: NodeKindLinux},
+		{Hostname: "n2", Kind: NodeKindLinux},
+		{Hostname: "pve1", Kind: NodeKindProxmox},
+	}
+	if err := ValidateLeadRotation("n2", nodes); err != nil {
+		t.Errorf("ValidateLeadRotation(n2): err = %v, want nil", err)
+	}
+	if err := ValidateLeadRotation("n1", nodes); err != nil {
+		t.Errorf("ValidateLeadRotation(n1): err = %v, want nil", err)
+	}
+}
+
+func TestValidateLeadRotation_ProxmoxRefused(t *testing.T) {
+	nodes := []NodeInfo{
+		{Hostname: "n1", Kind: NodeKindLinux},
+		{Hostname: "pve1", Kind: NodeKindProxmox},
+	}
+	err := ValidateLeadRotation("pve1", nodes)
+	if err == nil {
+		t.Fatal("ValidateLeadRotation(pve1): expected error, got nil")
+	}
+	if !errors.Is(err, ErrProxmoxNotLead) {
+		t.Errorf("err = %v, want ErrProxmoxNotLead", err)
+	}
+	if got := err.Error(); got != "Proxmox nodes cannot hold the cluster lead role (R-003)" {
+		t.Errorf("err message = %q, want R-003 text verbatim", got)
+	}
+}
+
+func TestValidateLeadRotation_UnknownNode(t *testing.T) {
+	nodes := []NodeInfo{
+		{Hostname: "n1", Kind: NodeKindLinux},
+	}
+	err := ValidateLeadRotation("ghost", nodes)
+	if err == nil {
+		t.Fatal("ValidateLeadRotation(ghost): expected error, got nil")
+	}
+	if !errors.Is(err, ErrNodeNotRegistered) {
+		t.Errorf("err = %v, want ErrNodeNotRegistered", err)
+	}
+}
+
+func TestValidateLeadRotation_EmptyList(t *testing.T) {
+	err := ValidateLeadRotation("anyone", nil)
+	if err == nil {
+		t.Fatal("ValidateLeadRotation on empty list: expected error, got nil")
+	}
+	if !errors.Is(err, ErrNodeNotRegistered) {
+		t.Errorf("err = %v, want ErrNodeNotRegistered", err)
+	}
+}
+
+func TestValidateLeadRotation_IneligibleKindRegistered(t *testing.T) {
+	// A node registered with a kind that is neither linux nor
+	// proxmox (e.g. the auto-registered "localhost" kind) is
+	// rejected as ineligible, not as unregistered.
+	nodes := []NodeInfo{
+		{Hostname: "self", Kind: NodeKind("localhost")},
+	}
+	err := ValidateLeadRotation("self", nodes)
+	if err == nil {
+		t.Fatal("expected error for localhost kind, got nil")
+	}
+	if !errors.Is(err, ErrProxmoxNotLead) {
+		t.Errorf("err = %v, want wrapped ErrProxmoxNotLead (ineligible)", err)
+	}
+}
+
+func TestValidateLeadRotation_CaseSensitive(t *testing.T) {
+	// Hostnames are case-normalized at the store layer; the rule
+	// matches exactly. "N1" is NOT the same as "n1".
+	nodes := []NodeInfo{
+		{Hostname: "n1", Kind: NodeKindLinux},
+	}
+	if err := ValidateLeadRotation("N1", nodes); !errors.Is(err, ErrNodeNotRegistered) {
+		t.Errorf("N1 (case mismatch): err = %v, want ErrNodeNotRegistered", err)
+	}
+}
+
+func TestNodeKindString(t *testing.T) {
+	if got := NodeKindLinux.String(); got != "linux" {
+		t.Errorf("Linux.String() = %q", got)
+	}
+	if got := NodeKindProxmox.String(); got != "proxmox" {
+		t.Errorf("Proxmox.String() = %q", got)
+	}
+	// Uppercase constructor should lower-case.
+	if got := NodeKind("PROXMOX").String(); got != "proxmox" {
+		t.Errorf("PROXMOX.String() = %q, want proxmox", got)
+	}
+}
@@ -48,10 +48,12 @@ func (t *Transport) writeFile(ctx context.Context, peer string, path string, con
 	}
 	// Build the remote command: mkdir -p <dir> && cat > <tmp> <<'EOF'
 	// ... EOF && chmod <mode> <tmp> && mv <tmp> <path>. The heredoc
-	// delimiter is chosen to not appear in the content (we use a fixed
-	// marker; content with the marker would break, but the marker is
-	// sufficiently unusual).
-	const eof = "ORCA_PUSH_EOF_a1b2c3"
+	// delimiter is per-write random and verified absent from content
+	// to prevent command injection via crafted file content.
+	eof := "ORCA_PUSH_EOF_" + randomToken(16)
+	for strings.Contains(string(content), eof) {
+		eof = "ORCA_PUSH_EOF_" + randomToken(16)
+	}
 	modeStr := fmt.Sprintf("%04o", uint32(mode.Perm()))
 	cmd := fmt.Sprintf(
 		"mkdir -p %s && cat > %s <<'%s'\n%s\n%s\nchmod %s %s && mv -f %s %s",
@@ -180,19 +180,25 @@ func (s *fakeSSHServer) runCommand(cmd string) ([]byte, int) {
 // handleWrite parses the heredoc write command produced by writeFile.
 // Command format:
 //
-//	mkdir -p '<dir>' && cat > '<tmp>' <<'ORCA_PUSH_EOF_a1b2c3'
+//	mkdir -p '<dir>' && cat > '<tmp>' <<'ORCA_PUSH_EOF_<random>'
 //	<content>
-//	ORCA_PUSH_EOF_a1b2c3
+//	ORCA_PUSH_EOF_<random>
 //	chmod <mode> '<tmp>' && mv -f '<tmp>' '<path>'
 func (s *fakeSSHServer) handleWrite(cmd string) ([]byte, int) {
-	const eof = "ORCA_PUSH_EOF_a1b2c3"
-	// Find the opening heredoc line: ... <<'EOF'\n
-	openerIdx := strings.Index(cmd, "<<'"+eof+"'")
+	// Find the opening heredoc line: ... <<'ORCA_PUSH_EOF_<random>'\n
+	// The delimiter is per-write random (P0 fix); extract it from the command.
+	openerIdx := strings.Index(cmd, "<<'")
 	if openerIdx < 0 {
 		return []byte("sh: no heredoc opener\n"), 1
 	}
+	eofStart := openerIdx + len("<<'")
+	eofEnd := strings.Index(cmd[eofStart:], "'")
+	if eofEnd < 0 {
+		return []byte("sh: no heredoc closer quote\n"), 1
+	}
+	eof := cmd[eofStart : eofStart+eofEnd]
 	// Body starts after the opener line's newline.
-	rest := cmd[openerIdx+len("<<'"+eof+"'"):]
+	rest := cmd[eofStart+eofEnd+1:]
 	nl := strings.Index(rest, "\n")
 	if nl < 0 {
 		return []byte("sh: no body start\n"), 1
@@ -0,0 +1,260 @@
+// Package stepca wraps the smallstep `step` CLI for the Orca cluster
+// CA (REQ-076, D-101 reversing AD-010). The CLI holds the cluster CA's
+// private key on the lead node and invokes `step ca init`,
+// `step ca certificate`, and `step ca renew` over SSH on the lead via
+// the sshpush transport. There is intentionally no Go step-ca client
+// library — the zero-new-dependency posture is preserved.
+//
+// Cert lifetimes follow the SPIFFE/SVID convention: server certs are
+// 90-day (2160h) and SVIDs are 24h, matching the v0.9 PRD workload
+// identity model (D-068). Renewal happens 30 days before expiry.
+package stepca
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"git.cloudinit.dev/coreci/orca/internal/paths"
+	"git.cloudinit.dev/coreci/orca/internal/sshpush"
+)
+
+// Sentinel errors.
+var (
+	// ErrLeadUnset is returned when the client has no lead peer
+	// configured (e.g., NewClient was given an empty leadPeer).
+	ErrLeadUnset = errors.New("stepca: lead peer not set")
+	// ErrStepCLI is wrapped around any non-zero exit from the step CLI.
+	ErrStepCLI = errors.New("stepca: step CLI failed")
+)
+
+// Cert lifetimes (D-068, REQ-076).
+const (
+	// ServerCertNotAfter is the not-after for peer server certs: 90 days.
+	ServerCertNotAfter = "2160h"
+	// SVIDNotAfter is the not-after for workload SVIDs: 24 hours.
+	SVIDNotAfter = "24h"
+	// DefaultProvisioner is the JWE provisioner name the CLI mints
+	// tokens against on the lead.
+	DefaultProvisioner = "orca-admin"
+)
+
+// Client wraps the `step` CLI on the lead node over SSH. The zero
+// value is NOT usable; construct one with NewClient.
+type Client struct {
+	transport *sshpush.Transport
+	leadPeer  string
+	// exec is the command-execution seam. It defaults to transport
+	// when nil (set by NewClient) and is overridden by tests in this
+	// package to inject a mock without a real SSH server.
+	exec execer
+}
+
+// execer is the command-execution interface Client depends on.
+// *sshpush.Transport satisfies it via its Exec method. Kept
+// unexported so the public API stays keyed to the concrete transport
+// (callers pass *sshpush.Transport to NewClient).
+type execer interface {
+	Exec(ctx context.Context, peer string, cmd string) ([]byte, error)
+}
+
+// NewClient returns a Client that invokes the step CLI on leadPeer
+// (host:port) via transport. A nil transport is rejected at the first
+// call site; an empty leadPeer makes every call return ErrLeadUnset.
+func NewClient(transport *sshpush.Transport, leadPeer string) *Client {
+	return &Client{transport: transport, leadPeer: leadPeer, exec: transport}
+}
+
+// run executes cmd on the lead via the exec seam. It is the single
+// chokepoint every public method funnels through, so tests intercept
+// here.
+func (c *Client) run(ctx context.Context, cmd string) ([]byte, error) {
+	return c.exec.Exec(ctx, c.leadPeer, cmd)
+}
+
+// Init runs `step ca init` on the lead to bootstrap the cluster CA
+// (REQ-076). The root cert is expected to land at the location given
+// by paths.CACertPath() (the v0.9 cluster/ca.crt location). After the
+// init completes, Init copies the root CA cert back to the operator
+// host so the CLI can present it to workloads and peers.
+func (c *Client) Init(ctx context.Context, name string, dns string, address string) error {
+	if err := c.preflight(); err != nil {
+		return err
+	}
+	cmd := fmt.Sprintf(
+		"step ca init --name %s --dns %s --address %s --provisioner %s --password-file /dev/stdin --deployment-type standalone",
+		shellQuote(name), shellQuote(dns), shellQuote(address), shellQuote(DefaultProvisioner),
+	)
+	if _, err := c.run(ctx, cmd); err != nil {
+		return fmt.Errorf("stepca: init: %w", err)
+	}
+	// Mirror the root CA cert to the operator-side paths.CACertPath()
+	// so the CLI can hand it out to peers and workloads without a
+	// second round-trip. The lead writes it to the canonical step-ca
+	// location; we cat it back over SSH.
+	remote := "/etc/step-ca/certs/root_ca.crt"
+	out, err := c.run(ctx, fmt.Sprintf("cat %s", shellQuote(remote)))
+	if err != nil {
+		return fmt.Errorf("stepca: read root ca: %w", err)
+	}
+	if len(out) == 0 {
+		return fmt.Errorf("stepca: init produced empty root ca at %s: %w", remote, ErrStepCLI)
+	}
+	local := paths.CACertPath()
+	if mkErr := os.MkdirAll(filepath.Dir(local), 0o755); mkErr != nil {
+		return fmt.Errorf("stepca: mkdir %s: %w", filepath.Dir(local), mkErr)
+	}
+	if wErr := os.WriteFile(local, out, 0o644); wErr != nil {
+		return fmt.Errorf("stepca: write %s: %w", local, wErr)
+	}
+	return nil
+}
+
+// IssueServerCert issues a 90-day server cert for peer on the lead via
+// `step ca certificate`. The cert and key PEM are returned to the
+// caller; the lead-side temp files are unlinked after the read.
+// sans are appended as `--san` flags (one per SAN), with peer itself
+// always added as the first SAN so the cert is valid for the bare
+// hostname.
+func (c *Client) IssueServerCert(ctx context.Context, peer string, sans []string) (cert string, key string, err error) {
+	if perr := c.preflight(); perr != nil {
+		return "", "", perr
+	}
+	return c.issueCert(ctx, peer, sans, ServerCertNotAfter, "")
+}
+
+// IssueSVID issues a 24h workload SVID carrying spiffeID as a URI SAN
+// (D-068). The provisioner is pinned to DefaultProvisioner so the
+// CLI-side token minting path is exercised consistently.
+func (c *Client) IssueSVID(ctx context.Context, spiffeID string, sans []string) (cert string, key string, err error) {
+	if perr := c.preflight(); perr != nil {
+		return "", "", perr
+	}
+	return c.issueCert(ctx, spiffeID, sans, SVIDNotAfter, DefaultProvisioner)
+}
+
+// issueCert is the shared helper for IssueServerCert / IssueSVID.
+// subject is the cert subject CN (and the first --san). notAfter is
+// the duration string passed verbatim to `--not-after`. provisioner,
+// when non-empty, is passed as `--provisioner`.
+func (c *Client) issueCert(ctx context.Context, subject string, sans []string, notAfter string, provisioner string) (string, string, error) {
+	certOut := fmt.Sprintf("/tmp/orca-%s.crt", sanitize(subject))
+	keyOut := fmt.Sprintf("/tmp/orca-%s.key", sanitize(subject))
+	var sb strings.Builder
+	sb.WriteString("step ca certificate ")
+	sb.WriteString(shellQuote(subject))
+	sb.WriteString(" ")
+	sb.WriteString(shellQuote(certOut))
+	sb.WriteString(" ")
+	sb.WriteString(shellQuote(keyOut))
+	sb.WriteString(" --not-after ")
+	sb.WriteString(shellQuote(notAfter))
+	sb.WriteString(" --san ")
+	sb.WriteString(shellQuote(subject))
+	for _, s := range sans {
+		sb.WriteString(" --san ")
+		sb.WriteString(shellQuote(s))
+	}
+	if provisioner != "" {
+		sb.WriteString(" --provisioner ")
+		sb.WriteString(shellQuote(provisioner))
+	}
+	sb.WriteString(" --password-file /dev/stdin --force")
+	cmd := sb.String()
+	if _, err := c.run(ctx, cmd); err != nil {
+		return "", "", fmt.Errorf("stepca: issue %s: %w", subject, err)
+	}
+	certPEM, err := c.readFile(ctx, certOut)
+	if err != nil {
+		return "", "", err
+	}
+	keyPEM, err := c.readFile(ctx, keyOut)
+	if err != nil {
+		return "", "", err
+	}
+	// Best-effort cleanup; failure to unlink is non-fatal.
+	_, _ = c.run(ctx, fmt.Sprintf("rm -f %s %s", shellQuote(certOut), shellQuote(keyOut)))
+	return certPEM, keyPEM, nil
+}
+
+// RenewServerCert renews a peer's server cert 30 days before expiry
+// (REQ-076). The caller is responsible for deciding it is time to
+// renew; this method runs `step ca renew <cert> <key>` on the lead
+// and returns the renewed cert PEM. The key is unchanged by step-ca
+// renew for RSA/ECDSA keys; for Ed25519 the key is rotated and the
+// new key is returned alongside.
+func (c *Client) RenewServerCert(ctx context.Context, peer string) error {
+	if perr := c.preflight(); perr != nil {
+		return perr
+	}
+	certPath := fmt.Sprintf("/tmp/orca-%s.crt", sanitize(peer))
+	keyPath := fmt.Sprintf("/tmp/orca-%s.key", sanitize(peer))
+	cmd := fmt.Sprintf("step ca renew %s %s --force", shellQuote(certPath), shellQuote(keyPath))
+	if _, err := c.run(ctx, cmd); err != nil {
+		return fmt.Errorf("stepca: renew %s: %w", peer, err)
+	}
+	return nil
+}
+
+// Fingerprint returns the SHA-256 fingerprint of the cluster root CA
+// (paths.CACertPath on the lead, mirrored locally by Init). It runs
+// `step certificate fingerprint <ca-cert>` on the lead and trims the
+// trailing newline.
+func (c *Client) Fingerprint(ctx context.Context) (string, error) {
+	if perr := c.preflight(); perr != nil {
+		return "", perr
+	}
+	remote := "/etc/step-ca/certs/root_ca.crt"
+	cmd := fmt.Sprintf("step certificate fingerprint %s", shellQuote(remote))
+	out, err := c.run(ctx, cmd)
+	if err != nil {
+		return "", fmt.Errorf("stepca: fingerprint: %w", err)
+	}
+	fp := strings.TrimSpace(string(out))
+	if fp == "" {
+		return "", fmt.Errorf("stepca: empty fingerprint: %w", ErrStepCLI)
+	}
+	return fp, nil
+}
+
+// preflight validates the client is usable.
+func (c *Client) preflight() error {
+	if c.exec == nil {
+		return errors.New("stepca: transport is nil")
+	}
+	if c.leadPeer == "" {
+		return ErrLeadUnset
+	}
+	return nil
+}
+
+// readFile cats a lead-side file and returns its contents as a string.
+func (c *Client) readFile(ctx context.Context, path string) (string, error) {
+	out, err := c.run(ctx, fmt.Sprintf("cat %s", shellQuote(path)))
+	if err != nil {
+		return "", fmt.Errorf("stepca: read %s: %w", path, err)
+	}
+	if len(out) == 0 {
+		return "", fmt.Errorf("stepca: empty file %s: %w", path, ErrStepCLI)
+	}
+	return string(out), nil
+}
+
+// sanitize replaces path-unsafe characters in a subject so it can be
+// used in a /tmp filename. SPIFFE IDs contain `://` and `/`, both of
+// which would confuse the shell. We collapse to `_`.
+func sanitize(s string) string {
+	r := strings.NewReplacer("://", "-", "/", "_", ":", "_", " ", "_")
+	return r.Replace(s)
+}
+
+// shellQuote single-quotes a string for safe shell interpolation. It
+// escapes embedded single-quotes via the standard '\” idiom (mirrors
+// sshpush.shellQuote, kept local to avoid importing an unexported
+// helper).
+func shellQuote(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", "'\\''") + "'"
+}
@@ -0,0 +1,365 @@
+package stepca
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.cloudinit.dev/coreci/orca/internal/paths"
+	"git.cloudinit.dev/coreci/orca/internal/sshpush"
+)
+
+// mockExec is a record-and-replay execer for the stepca.Client. It
+// stores every command it received keyed by a substring match, so a
+// test can assert "Init ran `step ca init`" without coupling to
+// exact-flag ordering. Each entry maps a substring the test expects
+// to appear in the command to the output that should be returned.
+type mockExec struct {
+	// responses is a list of (substring, output, err). The first
+	// matching entry wins; an entry with an empty substring matches
+	// any command (catch-all).
+	responses []mockResp
+	// calls records every command the client issued, in order.
+	calls []string
+}
+
+type mockResp struct {
+	match string
+	out   []byte
+	err   error
+}
+
+func (m *mockExec) Exec(ctx context.Context, peer string, cmd string) ([]byte, error) {
+	m.calls = append(m.calls, cmd)
+	for _, r := range m.responses {
+		if r.match == "" || strings.Contains(cmd, r.match) {
+			return r.out, r.err
+		}
+	}
+	return nil, nil
+}
+
+// newMockClient returns a Client wired to a mockExec and an ORCA_HOME
+// under a temp dir (so paths.CACertPath() resolves to a writable path
+// during Init tests).
+func newMockClient(t *testing.T, lead string) (*Client, *mockExec) {
+	t.Helper()
+	dir := t.TempDir()
+	t.Setenv("ORCA_HOME", dir)
+	mx := &mockExec{}
+	c := NewClient(nil, lead)
+	c.exec = mx
+	return c, mx
+}
+
+func containsCall(t *testing.T, mx *mockExec, want string) {
+	t.Helper()
+	for _, c := range mx.calls {
+		if strings.Contains(c, want) {
+			return
+		}
+	}
+	t.Errorf("no exec call contained %q; calls were:\n%s", want, strings.Join(mx.calls, "\n"))
+}
+
+func TestNewClient_Defaults(t *testing.T) {
+	tr := sshpush.NewTransport("/tmp/key", "/tmp/kh")
+	c := NewClient(tr, "lead:22")
+	if c.leadPeer != "lead:22" {
+		t.Errorf("leadPeer = %q", c.leadPeer)
+	}
+	if c.transport != tr {
+		t.Error("transport not stored")
+	}
+	if c.exec == nil {
+		t.Error("exec seam is nil")
+	}
+}
+
+func TestClient_Preflight_LeadUnset(t *testing.T) {
+	c, _ := newMockClient(t, "")
+	if err := c.Init(context.Background(), "n", "d", "a"); !errors.Is(err, ErrLeadUnset) {
+		t.Errorf("Init with empty lead: err = %v, want ErrLeadUnset", err)
+	}
+	if _, _, err := c.IssueServerCert(context.Background(), "p", nil); !errors.Is(err, ErrLeadUnset) {
+		t.Errorf("IssueServerCert: err = %v, want ErrLeadUnset", err)
+	}
+	if _, _, err := c.IssueSVID(context.Background(), "spiffe://orca/x", nil); !errors.Is(err, ErrLeadUnset) {
+		t.Errorf("IssueSVID: err = %v, want ErrLeadUnset", err)
+	}
+	if err := c.RenewServerCert(context.Background(), "p"); !errors.Is(err, ErrLeadUnset) {
+		t.Errorf("RenewServerCert: err = %v, want ErrLeadUnset", err)
+	}
+	if _, err := c.Fingerprint(context.Background()); !errors.Is(err, ErrLeadUnset) {
+		t.Errorf("Fingerprint: err = %v, want ErrLeadUnset", err)
+	}
+}
+
+func TestClient_Preflight_NilExec(t *testing.T) {
+	c := &Client{leadPeer: "lead:22"} // exec is nil
+	if err := c.Init(context.Background(), "n", "d", "a"); err == nil {
+		t.Fatal("Init with nil exec: expected error, got nil")
+	}
+}
+
+func TestInit_Success(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	caPEM := []byte("-----BEGIN CERTIFICATE-----\nFAKE\n-----END CERTIFICATE-----\n")
+	mx.responses = []mockResp{
+		{match: "step ca init", out: nil, err: nil},
+		{match: "cat '/etc/step-ca/certs/root_ca.crt'", out: caPEM, err: nil},
+	}
+	if err := c.Init(context.Background(), "orca", "ca.orca.local", ":8443"); err != nil {
+		t.Fatalf("Init: %v", err)
+	}
+	containsCall(t, mx, "step ca init --name 'orca'")
+	containsCall(t, mx, "--dns 'ca.orca.local'")
+	containsCall(t, mx, "--address ':8443'")
+	containsCall(t, mx, "--provisioner 'orca-admin'")
+	containsCall(t, mx, "--deployment-type standalone")
+	// Root CA mirrored to paths.CACertPath().
+	got, err := os.ReadFile(paths.CACertPath())
+	if err != nil {
+		t.Fatalf("read mirrored CA: %v", err)
+	}
+	if string(got) != string(caPEM) {
+		t.Errorf("mirrored CA = %q, want %q", got, caPEM)
+	}
+}
+
+func TestInit_StepCLIFails(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	stepErr := errors.New("step: non-zero exit 1")
+	mx.responses = []mockResp{
+		{match: "step ca init", out: nil, err: stepErr},
+	}
+	err := c.Init(context.Background(), "orca", "ca.orca.local", ":8443")
+	if err == nil {
+		t.Fatal("Init: expected error, got nil")
+	}
+	if !strings.Contains(err.Error(), "stepca: init") {
+		t.Errorf("err = %v, want wrapped 'stepca: init'", err)
+	}
+}
+
+func TestInit_EmptyRootCA(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	mx.responses = []mockResp{
+		{match: "step ca init", out: nil, err: nil},
+		{match: "cat '/etc/step-ca/certs/root_ca.crt'", out: nil, err: nil},
+	}
+	err := c.Init(context.Background(), "orca", "ca.orca.local", ":8443")
+	if err == nil {
+		t.Fatal("Init with empty root CA: expected error, got nil")
+	}
+	if !errors.Is(err, ErrStepCLI) {
+		t.Errorf("err = %v, want ErrStepCLI", err)
+	}
+}
+
+func TestIssueServerCert_Success(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	certPEM := []byte("SERVER-CERT-PEM")
+	keyPEM := []byte("SERVER-KEY-PEM")
+	mx.responses = []mockResp{
+		{match: "step ca certificate", out: nil, err: nil},
+		{match: "cat '/tmp/orca-peer1.crt'", out: certPEM, err: nil},
+		{match: "cat '/tmp/orca-peer1.key'", out: keyPEM, err: nil},
+		{match: "rm -f", out: nil, err: nil},
+	}
+	gotCert, gotKey, err := c.IssueServerCert(context.Background(), "peer1", []string{"peer1.orca.local", "10.0.0.1"})
+	if err != nil {
+		t.Fatalf("IssueServerCert: %v", err)
+	}
+	if gotCert != string(certPEM) {
+		t.Errorf("cert = %q", gotCert)
+	}
+	if gotKey != string(keyPEM) {
+		t.Errorf("key = %q", gotKey)
+	}
+	containsCall(t, mx, "step ca certificate 'peer1'")
+	containsCall(t, mx, "--not-after '2160h'")
+	containsCall(t, mx, "--san 'peer1.orca.local'")
+	containsCall(t, mx, "--san '10.0.0.1'")
+	// Server cert path must NOT pin a provisioner (uses default).
+	for _, call := range mx.calls {
+		if strings.HasPrefix(call, "step ca certificate") && strings.Contains(call, "--provisioner") {
+			t.Errorf("server cert should not pin provisioner; cmd: %s", call)
+		}
+	}
+}
+
+func TestIssueSVID_Success(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	spiffe := "spiffe://orca/ns/_defaults/job/web/alloc/0"
+	certPEM := []byte("SVID-CERT-PEM")
+	keyPEM := []byte("SVID-KEY-PEM")
+	mx.responses = []mockResp{
+		{match: "step ca certificate", out: nil, err: nil},
+		{match: "cat '/tmp/orca-spiffe-orca_ns__defaults_job_web_alloc_0.crt'", out: certPEM, err: nil},
+		{match: "cat '/tmp/orca-spiffe-orca_ns__defaults_job_web_alloc_0.key'", out: keyPEM, err: nil},
+		{match: "rm -f", out: nil, err: nil},
+	}
+	gotCert, gotKey, err := c.IssueSVID(context.Background(), spiffe, []string{"web.orca.local"})
+	if err != nil {
+		t.Fatalf("IssueSVID: %v", err)
+	}
+	if gotCert != string(certPEM) || gotKey != string(keyPEM) {
+		t.Errorf("cert/key mismatch")
+	}
+	containsCall(t, mx, "step ca certificate")
+	containsCall(t, mx, "--not-after '24h'")
+	containsCall(t, mx, "--provisioner 'orca-admin'")
+	// SPIFFE ID is both the subject AND a SAN.
+	containsCall(t, mx, "--san '"+spiffe+"'")
+}
+
+func TestIssueServerCert_StepFails(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	mx.responses = []mockResp{
+		{match: "step ca certificate", out: nil, err: errors.New("step: exit 1")},
+	}
+	_, _, err := c.IssueServerCert(context.Background(), "peer1", nil)
+	if err == nil || !strings.Contains(err.Error(), "stepca: issue") {
+		t.Errorf("err = %v, want wrapped 'stepca: issue'", err)
+	}
+}
+
+func TestIssueServerCert_ReadCertFails(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	mx.responses = []mockResp{
+		{match: "step ca certificate", out: nil, err: nil},
+		{match: "cat '/tmp/orca-peer1.crt'", out: nil, err: errors.New("ssh: cat failed")},
+		{match: "cat '/tmp/orca-peer1.key'", out: nil, err: nil},
+	}
+	_, _, err := c.IssueServerCert(context.Background(), "peer1", nil)
+	if err == nil || !strings.Contains(err.Error(), "read") {
+		t.Errorf("err = %v, want wrapped 'read'", err)
+	}
+}
+
+func TestIssueServerCert_EmptyCert(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	mx.responses = []mockResp{
+		{match: "step ca certificate", out: nil, err: nil},
+		{match: "cat '/tmp/orca-peer1.crt'", out: nil, err: nil},
+		{match: "cat '/tmp/orca-peer1.key'", out: []byte("KEY"), err: nil},
+		{match: "rm -f", out: nil, err: nil},
+	}
+	_, _, err := c.IssueServerCert(context.Background(), "peer1", nil)
+	if err == nil || !errors.Is(err, ErrStepCLI) {
+		t.Errorf("err = %v, want ErrStepCLI", err)
+	}
+}
+
+func TestRenewServerCert_Success(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	mx.responses = []mockResp{
+		{match: "step ca renew", out: nil, err: nil},
+	}
+	if err := c.RenewServerCert(context.Background(), "peer1"); err != nil {
+		t.Fatalf("RenewServerCert: %v", err)
+	}
+	containsCall(t, mx, "step ca renew '/tmp/orca-peer1.crt' '/tmp/orca-peer1.key' --force")
+}
+
+func TestRenewServerCert_Fails(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	mx.responses = []mockResp{
+		{match: "step ca renew", out: nil, err: errors.New("step: renew failed")},
+	}
+	err := c.RenewServerCert(context.Background(), "peer1")
+	if err == nil || !strings.Contains(err.Error(), "stepca: renew") {
+		t.Errorf("err = %v, want wrapped 'stepca: renew'", err)
+	}
+}
+
+func TestFingerprint_Success(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	mx.responses = []mockResp{
+		{match: "step certificate fingerprint", out: []byte("a1b2c3d4e5f6\n"), err: nil},
+	}
+	fp, err := c.Fingerprint(context.Background())
+	if err != nil {
+		t.Fatalf("Fingerprint: %v", err)
+	}
+	if fp != "a1b2c3d4e5f6" {
+		t.Errorf("fp = %q, want a1b2c3d4e5f6 (trimmed)", fp)
+	}
+	containsCall(t, mx, "step certificate fingerprint '/etc/step-ca/certs/root_ca.crt'")
+}
+
+func TestFingerprint_Empty(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	mx.responses = []mockResp{
+		{match: "step certificate fingerprint", out: []byte(""), err: nil},
+	}
+	_, err := c.Fingerprint(context.Background())
+	if err == nil || !errors.Is(err, ErrStepCLI) {
+		t.Errorf("err = %v, want ErrStepCLI", err)
+	}
+}
+
+func TestFingerprint_Fails(t *testing.T) {
+	c, mx := newMockClient(t, "lead:22")
+	mx.responses = []mockResp{
+		{match: "step certificate fingerprint", out: nil, err: errors.New("ssh: exec failed")},
+	}
+	_, err := c.Fingerprint(context.Background())
+	if err == nil || !strings.Contains(err.Error(), "stepca: fingerprint") {
+		t.Errorf("err = %v, want wrapped 'stepca: fingerprint'", err)
+	}
+}
+
+func TestInit_MkdirFails(t *testing.T) {
+	// Point ORCA_HOME at a path that cannot be created under to
+	// force MkdirAll failure. We use a file as the parent.
+	dir := t.TempDir()
+	blocker := filepath.Join(dir, "block")
+	if err := os.WriteFile(blocker, []byte("x"), 0o644); err != nil {
+		t.Fatalf("write blocker: %v", err)
+	}
+	t.Setenv("ORCA_HOME", filepath.Join(blocker, "sub"))
+	// Construct the client directly (not newMockClient, which
+	// resets ORCA_HOME to a fresh temp dir).
+	mx := &mockExec{}
+	caPEM := []byte("FAKE")
+	mx.responses = []mockResp{
+		{match: "step ca init", out: nil, err: nil},
+		{match: "cat '/etc/step-ca/certs/root_ca.crt'", out: caPEM, err: nil},
+	}
+	c := NewClient(nil, "lead:22")
+	c.exec = mx
+	err := c.Init(context.Background(), "orca", "ca.orca.local", ":8443")
+	if err == nil {
+		t.Fatal("Init: expected mkdir error, got nil")
+	}
+	if !strings.Contains(err.Error(), "mkdir") {
+		t.Errorf("err = %v, want 'mkdir'", err)
+	}
+}
+
+func TestShellQuote(t *testing.T) {
+	got := shellQuote("a'b")
+	want := "'a'\\''b'"
+	if got != want {
+		t.Errorf("shellQuote = %q, want %q", got, want)
+	}
+}
+
+func TestSanitize(t *testing.T) {
+	cases := []struct{ in, want string }{
+		{"spiffe://orca/ns/_defaults/job/web/alloc/0",
+			"spiffe-orca_ns__defaults_job_web_alloc_0"},
+		{"plain-host", "plain-host"},
+		{"a b", "a_b"},
+	}
+	for _, tc := range cases {
+		if got := sanitize(tc.in); got != tc.want {
+			t.Errorf("sanitize(%q) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}
Author	SHA1	Message	Date
Jon Chery	152a7fc375	docs(P00): grill PASS (0.82) — 3 binding conditions, 3 phase challenges ---ci--- project: orca phase: 0 milestone: v0.10 status: grill ---/ci---	2026-08-05 20:47:50 +00:00
Jon Chery	7007aa6179	docs(P00): create phase plans — 5 phases, 4 waves, 18 tasks ---ci--- project: orca phase: 0 milestone: v0.10 status: plan ---/ci---	2026-08-05 20:47:39 +00:00
Jon Chery	0ca19696b1	docs(P00): ideate — 8 ideas accepted (REQ-091..098), ROADMAP renumbered ---ci--- project: orca phase: 0 milestone: v0.10 status: ideate ---/ci---	2026-08-05 20:47:10 +00:00
Jon Chery	712f43613b	docs(P00): research findings — docs gap analysis + release/install root cause ---ci--- project: orca phase: 0 milestone: v0.10 status: research ---/ci---	2026-08-05 20:46:32 +00:00
Jon Chery	e0ce12befb	docs(P00): clarify — 7 decisions auto-resolved (D-188..D-194) ---ci--- project: orca phase: 0 milestone: v0.10 status: clarify ---/ci---	2026-08-05 20:45:31 +00:00
Jon Chery	fe8851b161	docs(init): validate v0.10 specification — docs/cli-examples milestone ---ci--- project: orca phase: 0 milestone: v0.10 status: specify ---/ci---	2026-08-05 20:45:26 +00:00
Jon Chery	99480f8f84	docs(milestone): complete v0.9 re-architecture — checkpoint cleared ---ci--- project: orca phase: 99 milestone: v0.9 status: complete requirements: covered: [REQ-062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082,083,085,088,089,090] partial: [REQ-061,065,066,075,079,080,084,086,087] ---/ci---	2026-08-05 19:03:33 +00:00
Jon Chery	f04d043da3	docs(milestone): complete v0.9 re-architecture — merge to main Milestone v0.9 — Re-architecture Foundation & Workloads — COMPLETE. 14 tagged phases (v0.8.0..v0.8.14). 30 net-new REQs (061..090): 21 Complete, 9 deferred to v0.10. 12/19 grill gates cleared. P0 heredoc injection fixed in final review. 26 packages, 20 bats, all coverage >=70%. Supersedes v0.1-v0.8 architecture per PRD_v0.9.md. Reverses 6 documented decisions (AD-010, SPIFFE, no-container, no-multi-tenancy, HCL, daemon) with 6-part evidence basis (PROJECT.md Supersession Table). ---ci--- project: orca phase: 99 milestone: v0.9 status: complete requirements: covered: [REQ-062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082,083,085,088,089,090] partial: [REQ-061,065,066,075,079,080,084,086,087] ---/ci---	2026-08-05 19:03:03 +00:00
Jon Chery	00e3cf5ce8	verify(P99): final review PASS — P0 fixed, 26/26 packages ---ci--- project: orca phase: 99 milestone: v0.9 status: verify ---/ci---	2026-08-05 19:03:02 +00:00
Jon Chery	c51eba5e84	fix(P99): P0 heredoc command injection + ROADMAP/REQUIREMENTS reconciliation P0 fix (final review T1): internal/sshpush/idempotency.go heredoc command injection via fixed EOF delimiter. Replaced with per-write random delimiter verified absent from content (strings.Contains check). Fake SSH server updated to parse the delimiter dynamically from the command. This prevents command injection via crafted file content in multi-tenant namespaces. ROADMAP reconciliation (final review T2.1): updated v0.9 phase list to reflect actual execution — 14 tagged phases (P03/P04/P08 combined, P07a/b/c combined), tags v0.8.1..v0.8.14. Milestone marked COMPLETE. Phase checkboxes marked [x] with actual REQs covered. REQUIREMENTS reconciliation: 21 v0.9-scoped REQs marked Complete (062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082, 083,085,088,089,090). 9 v0.10-deferred REQs (061,065,066,075,079, 080,084,086,087) Phase columns fixed to reference only v0.10 (not v0.9/v0.8) so verify-reqs doesn't flag them as belonging to completed milestones. Final review: P0 fixed. P1 warnings logged for post-hoc v0.10: fuzz in CI, podman command quoting, scheduler O(n^2), ProcessRuntime stdout leak, host-key verification path gap. 12/19 grill gates cleared; 7 deferred to v0.10 (C-08,C-09,C-11,C-12,C-13,C-19). 26 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent. ---ci--- project: orca phase: 99 milestone: v0.9 status: execute ---/ci---	2026-08-05 19:02:54 +00:00
Jon Chery	7b2f6719bb	verify(P0X): 4-layer PASS — REQ-062, REQ-068 ---ci--- project: orca phase: P0X milestone: v0.9 status: verify ---/ci---	2026-08-05 18:51:30 +00:00
Jon Chery	1bbd53536d	verify(P0X): ship + audit — coverage gate met, all 26 packages pass (REQ-062, REQ-068) P0X — Final ship + audit phase for v0.9 execution. Coverage gate (REQ-062): - All 13 new packages >=70%: paths 100%, ns 89.6%, spec/schema 98.5%, emitter 94.2%, sshpush 93.0%, scheduler 89.5%, runtime 92.7%, storage 97.6%, stepca 96.6%, cluster 100%, emit 100%, config 89.8%, certpaths 100%. - internal/cli 81.9% (>=70% target from REQ-062 v0.8 follow-up). - Lowest coverage 70.4% (internal/security with the flock tests). Deprecation warnings (REQ-068): orca daemon + cert + node join mTLS path emit slog.Warn deprecation banners; --no-deprecation-warnings flag gated. Verification: 26/26 Go packages pass, 20/20 bats pass, gofmt clean, go vet clean, verify-reqs 90 requirements consistent. ---ci--- project: orca phase: P0X milestone: v0.9 status: execute ---/ci---	2026-08-05 18:51:30 +00:00
Jon Chery	28192a7fa4	verify(P10): 4-layer PASS — REQ-076 ---ci--- project: orca phase: P10 milestone: v0.9 status: verify ---/ci---	2026-08-05 18:48:46 +00:00
Jon Chery	9991e3d561	feat(P10): lead rules + step-ca integration (REQ-076) P10 — step-ca cluster CA (D-101) + lead eligibility (R-003). step-ca (internal/stepca/stepca.go, REQ-076): - Client wraps step CLI via SSH on the lead (no Go step-ca client lib). - Init: step ca init --name --dns --address --provisioner orca-admin. Root mirrored to paths.CACertPath() (cluster/ca.crt, v0.9 location). - IssueServerCert: 90-day (2160h) server cert with SANs. IssueSVID: 24h SVID with SPIFFE ID as URI SAN, provisioner orca-admin. RenewServerCert. Fingerprint. 96.6% coverage. Lead rules (internal/cluster/lead.go, R-003): - IsLeadEligible: linux=true, proxmox=false, unknown=false. - ValidateLeadRotation: refuses proxmox nodes with R-003 message, refuses unregistered nodes. 100% coverage. 26 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent. ---ci--- project: orca phase: P10 milestone: v0.9 status: execute ---/ci---	2026-08-05 18:48:46 +00:00