docs(P00): research findings — threat model round 3 (~60 gaps, F26-F101)
Three deep codebase sweeps (security, reliability, feature/doc):
- Critical: job run runs locally (scheduler dead code), jobspec parser
drops schedule/timeout, verify-reqs bypassed, logs --job RCE, pprof
bypass, tar-slip, WebAuthn unauthenticated registration
- High: 8 injection vectors, Go 1.25.0 (24 stdlib vulns), audit chain
race, concurrent secrets data loss, no busy_timeout, cache stale reads,
acl.Check zero calls, mTLS claim false, docs missing 25 subcommands
- Medium: key zeroing, cache DB mode, writeAtomic consolidation, WebAuthn
session mutex, IPv6, SSH timeouts, DB retention, logs unbounded
R-022 (scheduler wiring) and R-023 (zero-trust enforcement) adopted as
load-bearing architectural changes. ARCHITECTURE.md updated with deltas.
PERSONAS.md updated (security-engineer added, uat-engineer phase-specific).
---ci---
project: orca
phase: 0
milestone: v0.13
status: research
---/ci---
Jon Chery
3f5e5de729