coreci/orca
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 91 Wiki Activity
Files
31ccb521145d988658203026ae2b1103c2af9c4b
orca/.ciagent/ROADMAP.md
T
Jon Chery 1ee82fc2e2 docs(P00): ideation - 34 ideas accepted 
v0.2 IDEATE stage. 29 new ideas generated (10 Tier 1 mechanical + 11
Tier 2 backend-enriched + 8 Tier 3 cross-project) plus 6 research-stage
candidates (REQ-cand-A..F from commit 08d321f) = 35 considered. Under
full autonomy, all 35 with confidence >= 0.60 are auto-accepted; 1
explicitly deferred to v0.3 (I-308 pprof). 34 accepted into v0.2.

Resulting net-new REQs (REQ-025..REQ-040) span P01-P04:
- P01 (mTLS): REQ-025 (cert rotation history), REQ-026 (CA fingerprint
  pinning), REQ-032 (orca doctor), REQ-033 (file mode enforcement),
  REQ-034 (rotation alarm), REQ-035 (cert show redaction), REQ-036
  (SAN validation), REQ-038 (mTLS failure log fields)
- P02 (multi-node): REQ-028 (NodeCapacity HCL schema, P02 enabler),
  REQ-037 (X-Orca-Idempotency-Key)
- P03 (security CI): REQ-027 (govulncheck offline mode -- changes P03
  scope: CI must not call vuln.go.dev), REQ-029 (gitleaks baseline for
  pre-existing .env leak), REQ-039 (.gitleaks.toml stopwords),
  REQ-040 (.golangci.yml)
- P04 (iter.Seq): REQ-030 (--watch --json mode)
- Cross-cutting: REQ-031 (go test -race)

Total v0.2 REQs: 20 (4 carried from v0.1 + 16 net-new).

ARCHITECTURE.md: added `internal/doctor/` component (§5) with
orca doctor {cert,network,db} subcommands; ASCII diagram updated.
ROADMAP.md: per-phase REQ coverage matrix added; P03 scope change
documented (govulncheck offline mode).
PROJECT.md: unchanged (vision is stable).

---ci---
project: orca
phase: 0
milestone: v0.2
status: ideate
---/ci---
2026-06-03 21:03:59 +00:00

3.4 KiB
Raw Blame History

Roadmap: Orca

Milestone v0.1: Foundation — COMPLETE

  • Phase 0: Project Initialization & Specification
  • Phase 1: Core CLI Skeleton & Command Parsing
  • Phase 2: Basic Node Management (Join/Leave)
  • Phase 3: Simple Task Execution Engine
  • Phase 4: Local State Persistence
  • Phase 5: Basic Health Checking
  • Phase 6: CoreCI Full Release Flow

Tagged v0.2.0 (next-minor per feature-milestone promotion rule).

Deferred to v0.2 (out of scope for v0.1)

  • Multi-node scheduling (D-004 decision: single-node only in v0.1)
  • mTLS for inter-node communication (REQ-011, REQ-023)
  • gosec + govulncheck in CI pipeline (REQ-014)
  • iter.Seq streaming job lists (REQ-022)
  • Frontend / devops personas (no web UI; CoreCI handles release)

Milestone v0.2: Networking, Observability, Security Hardening — IN PROGRESS

Scope: extend v0.1 with secure cross-node transport, multi-node scheduling, richer CI security scanning, and streaming I/O.

  • Phase 8: mTLS handshake + internal CA with CSR join (Wave 1)
  • Phase 9: Multi-node scheduling & job dispatch (Wave 1)
  • Phase 10: gosec + govulncheck + gitleaks in CI (Wave 2)
  • Phase 11: iter.Seq streaming job/node lists (Wave 2)

Target milestone tag: v0.3.0 (next-minor per feature-milestone promotion rule).

Per-phase tags: v0.2.1 (P01), v0.2.2 (P02), v0.2.3 (P03), v0.2.4 (P04). Per .ciagent/RELEASE_POLICY.md, every phase tag produces a Gitea release.

Per-phase REQ coverage (post-IDEATE)

  • P01 — mTLS handshake + internal CA with CSR join (Wave 1)

    • REQ-011, REQ-023 (carried over from v0.1)
    • REQ-025 (cert rotation history), REQ-026 (CA fingerprint pinning), REQ-033 (file mode enforcement), REQ-034 (rotation alarm), REQ-035 (cert show redaction), REQ-036 (SAN validation), REQ-038 (mTLS failure log fields)
    • REQ-032 (orca doctor — initial implementation; checks CA/cert state)

  • P02 — Multi-node scheduling & job dispatch (Wave 1)

    • REQ-028 (NodeCapacity HCL schema — P02 enabler; lands first)
    • REQ-037 (X-Orca-Idempotency-Key on cross-node POST)

  • P03 — gosec + govulncheck + gitleaks in CI (Wave 2)

    • REQ-014 (carried over)
    • REQ-027 (govulncheck offline mode — new in v0.2 IDEATE, per REQ-cand-C; this changes P03's scope: CI must not call vuln.go.dev by default; resolve via pre-mirrored DB or -format json + jq wrapper. PLAN stage decides between the two options.)
    • REQ-029 (gitleaks baseline for pre-existing .env leak in history, per REQ-cand-E)
    • REQ-039 (.gitleaks.toml stopwords), REQ-040 (.golangci.yml)

  • P04 — iter.Seq streaming job/node lists (Wave 2)

    • REQ-022 (carried over)
    • REQ-030 (--watch --json streaming output mode, per REQ-cand-F)

  • Cross-cutting (P01–P04)

    • REQ-031 (go test -race enabled in CI for all v0.2 packages)

P03 scope change (vs. pre-IDEATE plan)

REQ-027 (govulncheck offline mode) adds explicit work to P03: the CI job must be configured to NOT make outbound calls to vuln.go.dev (default govulncheck behavior). Two implementation paths are viable; PLAN chooses:

  • Pre-mirror the vulnerability database inside the CoreCI image (GOVULNCHECK_DB=/path/to/local.db).
  • Use govulncheck -format json (which always exits 0) and gate merges via a wrapper that parses the JSON and returns non-zero on unsuppressed findings.

Either path keeps the offline-first invariant (REQ-003) intact.

Reference in New Issue View Git Blame Copy Permalink