# Changelog

All notable changes to orca are documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## v0.13 milestone (in progress) — tag line v0.12.x

The v0.13 milestone is **Production Hardening Round 2 + UAT Plan**.
Three deep codebase sweeps (security, reliability, feature/doc claims)
surfaced ~60 gaps beyond v0.12. v0.13 closes all critical/high/medium
findings and delivers the UAT plan + signoff script that gates the
v1.0.0 cut.

**Load-bearing architectural changes**:
- **R-022** — `orca job run` deploys to remote nodes via the scheduler →
  emitter → SSH-push pipeline. The local `exec.CommandContext` path is
  removed (P03).
- **R-023** — Zero-trust enforcement is operationally wired: `acl.Check`
  is invoked on every daemon handler + sshpush + txn apply path;
  `acl.json` is 0600; audit `actor` carries OIDC sub/SVID; WebAuthn
  registration requires auth; `cluster seal`/`unseal` + `doctor audit`/
  `doctor modes` CLI commands exist (P04, P05).

### v0.13 phase commits (v0.11.29..HEAD)

- `ed91d68` — feat(P10): observability expansion — metrics + security headers (REQ-159)
- `531b369` — fix(P09): migration + operational safety — job stop, retention, logs cap (REQ-158)
- `3a3ea74` — fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)
- `0358efe` — fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)
- `978334a` — feat(P06): auth init-idp real + auth register + doctor oidc (REQ-155)
- `9e83238` — feat(P05): seal/audit CLI + chain race fix + key zeroing (REQ-154)
- `5232fcb` — fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)
- `cf3d98e` — feat(P03): wire scheduler into job run + fix jobspec parser (REQ-151, REQ-152)
- `4b70e31` — fix(P02): input validation + injection hardening — 11 vectors (REQ-150)
- `b0158c9` — fix(P01): bump go toolchain to 1.25.12 + fix pre-existing test bugs (REQ-149)
- `7479cd1` — docs(checkpoint): P0 shipped — v0.12.0 tagged
- `1a2dd1a` — docs(P00): incorporate grill binding conditions C-44..C-49
- `437d9b2` — docs(P00): grill v0.13 — CONDITIONAL PROCEED (6 binding conditions C-44..C-49)
- `82bfab1` — docs(P00): create phase plans — 14 phases, 15 REQs, vertical slices
- `a2a651e` — docs(P00): ideation results — 15 accepted (REQ-149..REQ-163), 0 skipped
- `3f5e5de` — docs(P00): research findings — threat model round 3 (~60 gaps, F26-F101)
- `7a60b35` — docs(P00): clarify v0.13 — 7 decisions resolved (D-248..D-254)
- `8071793` — docs(init): validate specification — v0.13 Production Hardening Round 2 + UAT Plan

### v0.13 phase summary

- **P0** — Pre-execution: specify → clarify → research → ideate → plan → grill (tag `v0.12.0`)
- **P01** — Toolchain & dependency vulns: Go 1.25.12 bump, 24 stdlib vulns closed, govulncheck triage (REQ-149)
- **P02** — Input validation & injection hardening: 11 vectors closed (`orca logs --job` RCE, tar-slip, sudoers injection, pprof loopback, txn/nft ID validation, drain allocID, cluster_compat, podman image, nft TrustedProbes, sudoers user/role) (REQ-150)
- **P03** — Scheduler/deployment wiring + jobspec parser: `orca job run` wires scheduler → emitter → SSH-push; `schedule:`/`timeout:` parsed by markdown jobspec (REQ-151, REQ-152)
- **P04** — ACL enforcement + WebAuthn registration auth: `acl.Check` wired into daemon + sshpush + txn apply; WebAuthn registration requires auth; audit actor carries OIDC sub/SVID (REQ-153)
- **P05** — Seal/audit CLI + chain race fix + key zeroing: `orca cluster seal`/`unseal`, `orca doctor audit`, `orca doctor modes` CLI commands; audit hash-chain race fix; master key zeroed on exit (REQ-154)
- **P06** — auth init-idp real + auth register + doctor oidc: real Dex deployment, `orca auth register` browser flow, `orca doctor oidc` health check (REQ-155)
- **P07** — Concurrency safety: SQLite WAL, flock on known_hosts, cache thread-safety, atomic writes (REQ-156)
- **P08** — Transport & SSH safety: typed dial errors, IPv6 support, connect timeouts, signal handling (REQ-157)
- **P09** — Migration & operational safety: `orca job stop` via SSH, DB retention check, logs cap (REQ-158)
- **P10** — Observability & metrics: metrics endpoint expansion, security headers (REQ-159)
- **P11** — Doc drift round 2 (this phase, REQ-160)

## v0.12 milestone — COMPLETE (tag line v0.11.x)

The v0.12 milestone is **Security Hardening (Zero-Trust Identity)**.
Comprehensive security hardening across the entire attack surface
including the OS, plus adoption of a zero-trust identity model. 25
threat-model findings (F1..F25) closed. R-021 adopted: no Orca-issued
credentials — human identity is exclusively external (OIDC), machine
identity is exclusively mTLS/SPIFFE.

**Milestone release**: `v0.11.28` (29 phases, tags `v0.11.0`..`v0.11.28`).

### v0.12 phase highlights

- Command injection fix (REQ-119, F3)
- Namespace path traversal fix (REQ-120, F4)
- Txn apply path allowlist (REQ-121, F5)
- OIDC client + bundled Dex (REQ-144; BYO-IdP override)
- WebAuthn connector for Dex / passkeys (REQ-148)
- ACL rewrite to OIDC claims + enforcement (REQ-145, REQ-122, F1)
- Remove all password/token paths (REQ-146, R-021, C-34)
- Master key seal-to-OIDC + Shamir 3-of-5 recovery (REQ-147, C-35)
- Daemon auth hardening (REQ-123, REQ-124, F6, F24)
- Audit log tamper-evidence (REQ-125, F2)
- SVID chain validation (REQ-126, F9)
- Backup symlink validation (REQ-127, F7)
- step-ca /tmp hardening (REQ-128, F10)
- Master key rotation (REQ-129, F12, C-30)
- File-mode audit expansion (REQ-130, F13)
- aggregate.sh JSON injection + drift-gate fix (REQ-131, F11, F18)
- install.sh checksum+GPG verification (REQ-132, F14)
- nftables ruleset hardening (REQ-133, F21)
- sudoers hardening (REQ-134, F22)
- System user consistency (REQ-135, F23)
- SQLite file-mode + at-rest encryption (REQ-136, F8, C-31)
- Migration safety + identity migration (REQ-137, F19, C-34)
- Legacy CA/mTLS/daemon + step-ca password-provisioner deletion (REQ-138, F16)
- known_hosts tightening + transport hardening (REQ-139, F15, F25)
- Drift event authentication (REQ-140, F18)
- Security integration test suite (REQ-141, C-33)
- Zero-trust + OIDC + WebAuthn + threat-model docs (REQ-142)
- Final review + ship + audit (REQ-143)

## v0.11 milestone — COMPLETE (tag line v0.10.x)

The v0.11 milestone is **Production Hardening**. See the git log and
ROADMAP for the full phase list.

## v0.1 milestone — COMPLETE

Initial CLI skeleton, node management, task execution, state
persistence, audit log, health checks, and CoreCI release flow.

- `e1b5385` — feat(P06): CoreCI release flow with .coreci.yml and tea integration
- `07b8ad2` — ship(P05): health checks merged into milestone
- `b06458d` — docs(P05): verification - 4 layers pass
- `708d983` — feat(P05): health check daemon with /healthz, /readyz, /v1/* handlers
- `30c523c` — ship(P04): state persistence merged into milestone
- `759b1b5` — docs(P04): verification - 4 layers pass
- `b25e074` — feat(P04): audit log + persistence hardening
- `bb6b5b3` — ship(P03): task exec merged into milestone
- `857f756` — docs(P03): verification - 4 layers pass
- `f9a9873` — feat(P03): task execution engine with HCL specs, jobs, tasks, WaitDelay
- `78334f1` — ship(P02): node mgmt merged into milestone
- `c7dbcef` — docs(P02): verification - 4 layers pass
- `9580f34` — feat(P02): node management with SQLite-backed registry
- `46e929e` — chore(P01): source .env in trigger_coreci.sh for GITEA_TOKEN
- `503923b` — ship(P01): cli skeleton merged into milestone
- `e3f6e1d` — docs(P01): verification - 4 layers pass
- `aa3ccce` — feat(P01): CLI skeleton with Cobra, subcommand stubs, pre-push hook
- `c203895` — docs(P00): create 6 phase plans with wave ordering
- `65eb2e6` — docs(P00): research findings - architecture + personas
- `6f34f17` — docs(P00): ideation - 30 ideas accepted (3 tiers)
- `bc7ce1c` — docs(P00): clarify ambiguities (full autonomy, 10 decisions)
- `55aae53` — chore(P00): rename orch-engine to orca, configure gitea + coreci (v0.1)
- `0cba1aa` — chore(P00): set autonomy level to full
- `e2e77e7` — chore(P00): quick task - populate config.json with backlog reference
- `8c086de` — chore(config): populate ciagent config with standard settings
- `8774008` — docs(init): validate specification

Generated by make changelog. Do not edit by hand.