orca/.ciagent/IDEATION_v0.12.md

Ideation v0.12: Security Hardening (Zero-Trust Identity)

Status: 30 ideas accepted (0 skipped, 0 modified). All from Tier 1 (mechanical analysis of the threat-model review) and Tier 2 (backend-enriched prioritization). The --ideate flag was passed; ideation ran between RESEARCH and PLAN per run.md Step 3.

Tier 1 — Mechanical analysis

2.1 Git-native pattern mining

The v0.11 milestone shipped 24 phases with a threat model in P15.5 (gate C-19). The threat model identified residual risks but did not close them -- it documented them for v1.x. The v0.12 ideation ingests that threat model as the primary signal source.

Repeated lessons (from v0.8..v0.11 ---ci--- blocks):

• "Deprecated but still load-bearing" appears 6 times across v0.8..v0.11 (legacy CA, mTLS transport, daemon, certpaths, step-ca password provisioner, hmacSHA256 dead code). The dual-write window is the single largest attack-surface expander. -> F16 / REQ-138.
• "TOFU by default, pre-pin optional" appears 4 times (v0.6 SSH join, v0.8 host-key-fingerprint, v0.11 drift scripts). TOFU is a first-connect MITM risk. -> F15 / REQ-139 (known_hosts tightening).
• "File modes checked at write, not at read" appears 3 times (v0.2 cert modes, v0.5 namespace dirs, v0.11 master key). -> F13 / REQ-130.

Low-confidence decisions (confidence < 0.85 in ---ci--- blocks):

• D-007 (mTLS for v0.1, tokens deferred) -- 0.80. v0.12 closes the token gap via OIDC (no Orca-issued tokens; the IdP issues them).
• D-028 (repo visibility flip for public releases) -- 0.85. v0.12 adds install.sh checksum verification (F14) as defense-in-depth.

Escalation types:

• release_pending (v0.8..v0.11 ship fallbacks) -- not security-relevant.
• human_validation (v0.11 C-19 threat model) -- v0.12 is the comprehensive closure of those documented risks.

Compound solutions (generalized patterns):

• The "shellQuote + regression test" pattern from v0.8 SSH trust hardening (REQ-058) generalizes to all SSH-exec interpolation sites (podman, wasm, aggregate.sh). -> F3 / REQ-119.
• The "atomic temp + chmod + fsync + rename" pattern from WriteAtomic (ca.go) generalizes to migration copyFile and backup restore. -> F19 / REQ-137.

Partial requirements: none (v0.11 shipped all REQs complete).

2.2 Coverage gap analysis

All v0.11 REQs are Complete. The v0.12 requirements are net-new from the threat model -- no pending/in_progress REQs to close.

2.3 Verification layer inversion

• Structural: internal/security/ca.go (legacy CA) documented as deprecated but still compiled and load-bearing. -> F16.
• Behavioral: internal/runtime/podman.go, wasm.go have no command-injection regression tests. -> F3.
• Security: No STRIDE analysis for the OIDC/WebAuthn data flow (new in v0.12). -> addressed by REQ-142 (docs).
• Quality: classifyDialErr substring matching is a known code smell flagged in v0.9 research. -> F25.

2.4 Architectural drift detection

• internal/acl/ exists but is not wired into any enforcement point (documented as "future" since v0.9). -> F1.
• internal/identity/spiffe.go VerifySVID skips chain validation (documented as "trust is implicit via SSH channel" in v0.11 P01.5 spike result). -> F9.
• internal/emitter/nft.go ships SYN-flood + rate-limit but no conntrack/default-deny (the v0.11 emitter met the REQ but not defense-in-depth best practice). -> F21.

2.5 Spec-driven improvement

• R-021 ("no Orca credentials") is the new spec invariant. Every existing password/token surface is a spec violation under R-021. -> F1, F12, F17, REQ-144..148.
• The v0.11 PRD's deferred-v1.x list included "master.key passphrase-less 0600 (consider OS keyring in v1.x)." v0.12 closes this via seal-to-OIDC (no passphrase, no OS keyring dependency -- OIDC is the unwrap mechanism).

Tier 2 — Backend-enriched analysis

2.6 Prioritization

Ranked by (1) severity, (2) OS-surface exposure (per user instruction "includes the operating system itself"), (3) ease of addressing:

1. F3 command injection (Critical, OS-touching, shellQuote is a well-understood fix) -> P01.
2. F4 path traversal (Critical, OS-touching, validateNamespaceName is trivial) -> P02.
3. F5 txn arbitrary paths (Critical, OS-touching, prefix allowlist) -> P03.
4. F1 ACL unenforced (Critical, foundational for OIDC authz) -> P06 (after P04/P05 identity).
5. F6 daemon no auth (High, OS-touching) -> P09.
6. F2 audit not tamper-evident (Critical, integrity) -> P10.
7. F9 SVID no chain (High, identity) -> P11.
8. F7 backup symlink (High, OS-touching) -> P12.
9. F10 step-ca /tmp (High, OS-touching) -> P13.
10. F12 master key rotation (High, crypto) -> P14.
11. F11 aggregate.sh JSON injection (High, OS-touching) -> P16.
12. F14 install.sh no checksum (High, OS-touching) -> P17.
13. F21 nftables (Medium, OS-touching) -> P18.
14. F22 sudoers (Medium, OS-touching) -> P19.
15. F23 system user (Medium, OS-touching) -> P20.
16. F8 SQLite (High, OS-touching) -> P21.
17. F19 migration (Medium, OS-touching) -> P22.
18. F16 dual-write closure (Medium, surface reduction) -> P23.
19. F15/F25 transport (Medium/Low) -> P24.
20. F18 drift auth (Medium) -> P25.
21. Integration tests (gate) -> P26.
22. Docs (gate) -> P27.
23. Final review (gate) -> P28.

The zero-trust identity work (P04 OIDC+Dex, P05 WebAuthn, P07 password removal, P08 master key seal) is wave B because it's the architectural foundation -- P06 (ACL) and P09 (daemon auth) depend on it.

2.7 Novel improvement suggestions

• WebAuthn as the bundled password-free authenticator (operator decision D-240). This is beyond pattern matching -- it's the strongest available authentication primitive and directly satisfies R-021. The go-webauthn library is mature; the custom Dex connector is ~300 LoC.
• Shamir 3-of-5 master key recovery (operator decision D-241). Standard threshold cryptography; no backdoor; documented residual risk.
• Bundled Dex (operator decision D-239). Zero-trust out of the box without external setup; BYO override preserves flexibility.

2.8 Chaos engineering ideation

• What if the OIDC provider is unavailable? -> orca cluster unseal fails; cluster runs on in-memory master key until shutdown (no new secrets operations). Shamir recovery if permanent. Doc'd.
• What if a peer's drift event is forged? -> REQ-140 (per-peer HMAC).
• What if the master key is compromised? -> REQ-129 (rotation, re-seal to OIDC). All historical secrets still compromised (no forward secrecy) -- documented residual risk.
• What if install.sh is MITM'd? -> REQ-132 (checksum+GPG).
• What if the Gitea token leaks again? -> C-32 (human-gate rotation before final ship); history scrub best-effort.

Tier 3 — Cross-project pattern transfer

Single-project mode (only orca in active_projects). No cross-project mining.

Step 3 — Merge and deduplicate

30 ideas, all unique by relatedReq (REQ-119..REQ-148). No duplicates. Sorted by severity then wave order (see Tier 2.6).

Step 4 — Interactive validation

Under autonomy.level=full + workflow.no_hitl=true, all 30 ideas are auto-accepted. The operator pre-approved the scope in the planning conversation (comprehensive coverage including OS surface, bundled Dex, WebAuthn, Shamir). 0 skipped, 0 modified.

Step 5 — Long-term document updates

• REQUIREMENTS.md: REQ-119..REQ-148 added (done).
• ROADMAP.md: v0.12 milestone section added (next).
• ARCHITECTURE.md: zero-trust identity model + OIDC data-flow to be added in P27 (docs phase) -- not in Phase 0 to avoid scope creep.
• PROJECT.md: v0.12 scope summary + D-238..D-247 added (done).

Step 6 — Ask-after-validation kickoff

The run workflow continues to PLAN -> GRILL -> ship Phase 0 -> execute P01..P27 -> final P28. No separate kickoff needed (the --ideate flag is consumed; ideas are already in REQUIREMENTS.md + ROADMAP.md).