orca/.ciagent/PHASE1_VERIFICATION_v0.6.md

Phase 1 Verification — Orca v0.6 P01

Phase: P01 — orca init Full Bootstrap + Schema 0006 REQ Coverage: REQ-047, REQ-048, REQ-049 Verification date: 2026-08-03 Result: ✅ PASS (all 4 layers)

Structural Verification

• ✅ go build ./... — PASS (no compile errors)
• ✅ go vet ./... — PASS (no vet warnings)
• ✅ gofmt -l . — PASS (all changed Go files formatted)
• ✅ make lint — PASS (golangci-lint clean)
• ✅ Migration 0006 follows existing naming convention (0006_*.sql)
• ✅ model.Node struct follows existing field/tag conventions
• ✅ NodeRepo methods follow existing error-wrapping + scanner pattern

Behavioral Verification

REQ-047: orca init auto-provisions CA + server cert + DB + localhost node

• ✅ TestInit_FullBootstrap: init creates namespace dir, CA (ca.crt 0644 + ca.key 0600), server cert, DB (migrations 0001..0006), localhost node
• ✅ TestInit_IdempotentReRun: re-running init does NOT regenerate CA/server cert (D-036), does NOT duplicate localhost node, refreshes last_seen, preserves id + joined_at
• ✅ E2E smoke test: orca init → CA provisioned (fp shown), server cert provisioned (fp shown), DB initialized, localhost node registered

REQ-048: orca init registers localhost node with auto-detected OS

• ✅ TestInit_FullBootstrap: localhost node has kind=localhost, non-empty os, address=localhost:8443
• ✅ TestParseOSReleaseID_* (10 tests): ubuntu, debian, alpine, pve, quoted/unquoted values, missing ID, empty content, comments, unknown ID returned verbatim
• ✅ TestDetectOS_* (3 tests): reads /etc/os-release, falls back to /usr/lib/os-release, falls back to "linux"
• ✅ E2E smoke test: OS detected: ubuntu (this host is Ubuntu 24.04)

REQ-049: Node schema extension (kind + os columns, migration 0006)

• ✅ TestMigrationVersion: version = "0006_node_kind_os.sql"
• ✅ TestNodeRepo_KindOS_RoundTrip: insert with kind/os → get returns them correctly
• ✅ TestNodeRepo_NullKindOS_EmptyString: NULL columns → "" in Go struct (no nil-deref)
• ✅ TestNodeRepo_GetByName: found by name, ErrNotFound for missing
• ✅ TestNodeRepo_UpdateLastSeenAndOS: refreshes last_seen + os, preserves id + joined_at (D-036)
• ✅ Existing node tests still pass (backward compatible)
• ✅ TestDBCheck_IntegrityOK: doctor db check reports migration 0006

Security Verification

• ✅ CA key file mode 0600 enforced (TestInit_FullBootstrap checks mode)
• ✅ CA cert + server cert mode 0644 enforced (via security.WriteCert/writeAtomic)
• ✅ No secrets in logs (init output shows fingerprint prefixes, not full keys)
• ✅ --json output excludes private key material (only fingerprints)
• ✅ No new external dependencies (P1 is pure Go stdlib + existing deps)

Quality Verification

• ✅ go test -race -count=1 ./internal/store/... ./internal/cli/... ./internal/model/... ./internal/doctor/... — all PASS
• ✅ Test coverage: init idempotency, osdetect parsing (10 cases), kind/os round-trip, NULL handling, GetByName, UpdateLastSeenAndOS, namespace dir creation, JSON output
• ✅ Error wrapping with fmt.Errorf("...: %w", err) (REQ-018 convention)
• ✅ context.Context propagation in all new I/O (REQ-017)
• ✅ No goroutine leaks (init is synchronous; no new goroutines)
• ✅ D-036 idempotency verified: 2× init run, no duplicate node, no cert regen

Must-Have Checklist

• internal/store/migrations/0006_node_kind_os.sql
• internal/model/node.go — Kind + OS fields + NodeKind constants
• internal/store/node_repo.go — extended for kind/os + GetByName + UpdateLastSeenAndOS
• internal/store/node_repo_test.go — new tests for kind/os + helpers
• internal/cli/osdetect.go — detectOS() from /etc/os-release
• internal/cli/osdetect_test.go — 13 parsing + detection tests
• internal/cli/init.go — full bootstrap sequence
• internal/cli/init_test.go — idempotency + bootstrap tests
• internal/cli/namespace_test.go — updated for new JSON format
• internal/doctor/doctor_test.go — updated for migration 0006
• internal/store/migrate_test.go — updated for migration 0006

Escalations

None. All 4 verification layers pass cleanly.