# Orca Threat Model (v0.12)

## Overview

Orca is a minimalist, offline-first, CLI-first orchestration engine.
v0.12 adopts a **zero-trust identity model** (R-021): no Orca-issued
credentials. Human identity is exclusively OIDC; machine identity is
exclusively mTLS/SPIFFE.

## R-021 — No Orca Credentials

Orca never issues, stores, or accepts human-identity credentials.
- Human identity: OIDC (external IdP or bundled Dex + WebAuthn)
- Machine identity: mTLS + SPIFFE SVIDs
- No passwords, no Orca-issued tokens, no CA-key passphrases

## STRIDE Analysis

| Component | Spoofing | Tampering | Repudiation | Info Disclosure | DoS | Elevation |
|-----------|----------|-----------|-------------|-----------------|-----|-----------|
| OIDC client | mitigated by JWKS verification | — | mitigated by ID token | — | — | — |
| WebAuthn connector | mitigated by public-key auth | — | mitigated by signed assertions | — | — | — |
| ACL | mitigated by deny-by-default + OIDC claims | — | mitigated by audit log | — | — | mitigated by least-privilege perms |
| Master key seal | — | mitigated by AES-256-GCM + Shamir | — | mitigated by 0600 + sealing | — | — |
| SSH-push transport | mitigated by key auth + TOFU/pin | — | mitigated by audit | — | mitigated by rate limiting (v1.x) | — |
| Daemon (deprecated) | mitigated by mandatory mTLS | — | mitigated by audit | mitigated by body limits | mitigated by body limits | mitigated by ACL |
| Backup/restore | — | mitigated by HMAC signature | — | mitigated by symlink validation | — | — |
| Audit log | — | mitigated by hash chain + append-only trigger | — | — | — | — |
| Drift detection | mitigated by per-peer HMAC | — | — | — | — | — |
| nftables ingress | — | — | — | — | mitigated by conntrack + rate limit | — |
| sudoers | — | — | — | — | — | mitigated by NOEXEC + least-privilege |

## OS Surface

Orca writes to: `/etc/orca/`, `/etc/traefik/orca*`, `/etc/systemd/system/orca-*`,
`/etc/nftables.d/orca*`, `/etc/syncthing/orca*`, `/etc/sudoers.d/orca`.
All via SSH-push (key auth, no passwords). The `orca` system user is
`nologin` (no shell access). Scripts run as root only for file writes
to `/etc/` (the operator pre-stages the SSH key; no password flows).

## Residual Risks

- Legacy CA/mTLS/daemon dual-write window (v1.x closure)
- SQLite unencrypted at rest (0600 file mode; CGO-free SQLCipher is v1.x)
- Master key compromise compromises all historical secrets (no forward secrecy)
- IdP loss: Shamir 3-of-5 recovery; if quorum unavailable, unrecoverable by design
- Transport rate limiting + typed errors (v1.x)