# Phase 1 Verification Report — v0.7: Register `orca cert` Command Tree

**Phase**: 1  
**Branch**: `phase/01-cert-register`  
**REQ Coverage**: REQ-053  
**Milestone**: v0.7 (Hardening & Completion)

## Structural Verification

### Files Modified
- `internal/cli/cert.go` — added `init()` registering `NewCommand` on `rootCmd` (AD-022)
- `internal/cli/init_test.go` — updated expected migration version 0006 → 0007
- `internal/doctor/doctor_test.go` — relaxed DB check assertion to check `"migrations up to"` prefix (migration-version-agnostic)
- `internal/store/migrate_test.go` — updated expected migration version 0006 → 0007

### Files Created
- `internal/cli/cert_test.go` — regression test for cert command registration + subcommand tree
- `internal/cli/cert_smoke_test.go` — end-to-end smoke test (ca-init, gen, show, fingerprint, renew, file modes)
- `internal/store/cert_repo_test.go` — 11 tests covering Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + error paths
- `internal/store/migrations/0007_certs_serial_unique.sql` — UNIQUE index on `certs.serial_hex` (I-107; migration-driven, not backfilled into 0004)

## Behavioral Verification

### Test Results
```
go test ./...               → all PASS (exit 0)
go test -race ./...         → all PASS (exit 0)
go vet ./...                → clean
make build                  → clean (v0.6.0)
```

### Coverage (store package)
- Store total: 60.5% (up from 46.9%)
- `cert_repo.go`: Insert 91.7%, Get 100%, LatestForKind 100%, PruneOlderThan 85.7%, Delete 85.7%, List/ListByNode 81.8%

### CLI Smoke Test (manual)
```
./bin/orca cert                    → prints help (was: "unknown command")
./bin/orca cert ca-init --cn X     → ✓ CA initialized, 0644/0600 modes
./bin/orca cert fingerprint --which ca → 64-char hex SHA-256
```

## Security Verification

- `orca cert show` redacts private key material (REQ-035) — verified in smoke test
- Cert file modes enforced: 0600 keys, 0644 certs (REQ-033) — verified in smoke test
- No secrets in logs — `cert.ca_init`/`cert.issued`/`cert.renewed` log events contain only fingerprints, never key bytes
- Migration 0007 is additive (UNIQUE index), backward-compatible — no data loss

## Quality Verification

- No new dependencies added (`go.mod` unchanged)
- No comments added (per project convention)
- Test style matches existing `node_repo_test.go` / `root_test.go` patterns
- All `---ci---` blocks present in commits

## Must-Haves Checklist

- [x] `internal/cli/cert.go` — `init()` with `rootCmd.AddCommand(NewCommand(slog.Default()))`
- [x] `internal/cli/cert_test.go` — regression test for registration + subcommands
- [x] `internal/cli/cert_smoke_test.go` — e2e: ca-init, gen, show (redaction), fingerprint, renew, file modes
- [x] `internal/store/cert_repo_test.go` — 11 tests covering full CRUD + rotation history + duplicate serial
- [x] `internal/store/migrations/0007_certs_serial_unique.sql` — UNIQUE index (I-107)

## Verdict

**PASS** — all 4 verification layers (structural, behavioral, security, quality) pass. REQ-053 is fully covered. The `orca cert` command tree is now reachable from the CLI, cert_repo has comprehensive tests, and the serial_hex UNIQUE constraint is enforced via migration.