Files

T

Jon Chery 0b58286ca2 feat(P04): --pprof opt-in on orca daemon (REQ-056, I-308)

Separate *http.Server + *http.ServeMux (AD-024), default disabled.
Operator opts in via --pprof <addr>. WARN logged on startup. All pprof
handlers explicitly registered on dedicated mux (no DefaultServeMux
side-effect). I-308 deferred since v0.2 now implemented. 6 new tests.

---ci---
project: orca
phase: 4
milestone: v0.7
status: verify
requirements:
  covered: [REQ-056]
  partial: []
---/ci---

2026-08-04 00:22:17 +00:00

2.9 KiB

Raw Blame History

Phase 4 Verification Report — v0.7: --pprof Opt-in on orca daemon

Phase: 4
Branch: phase/04-pprof-daemon
REQ Coverage: REQ-056
Milestone: v0.7 (Hardening & Completion)

Structural Verification

Files Created

internal/daemon/pprof.go — StartPprof(addr, log) (*http.Server, error): dedicated mux + server, disabled by default, WARN log
internal/daemon/pprof_test.go — 5 tests (disabled, enabled, shutdown, mux isolation, full server lifecycle)
internal/cli/daemon_test.go — TestDaemonPprofFlag (flag registration + default)

Files Modified

internal/daemon/server.go — PprofAddr in Options, pprofServer field, NewServer starts pprof, Shutdown stops both
internal/cli/daemon.go — --pprof flag, PprofAddr in daemon.Options, conditional startup output line

Behavioral Verification

Test Results

go test ./...               → all PASS (exit 0)
go test -race ./internal/daemon/... ./internal/cli/... → all PASS
go vet ./...                → clean
make build                  → clean

CLI Verification

./bin/orca daemon --help → shows --pprof string flag (default "")

Live Smoke Test

--pprof 127.0.0.1:16060 → WARN logged, /debug/pprof/ returns 200, /debug/pprof/cmdline 200, /debug/pprof/heap 200
/healthz on pprof listener → 404 (mux isolation confirmed, AD-024)
Clean shutdown stops both servers

Security Verification

pprof on a separate *http.Server + *http.ServeMux, never on the mTLS daemon listener (AD-024) — verified by TestStartPprof_MuxIsolated (/healthz returns 404 on pprof mux)
Default disabled — no pprof listener unless --pprof is explicitly set
WARN log on startup: "unauthenticated, operator-only — do not expose publicly"
No import _ "net/http/pprof" side-effect registration on DefaultServeMux — all handlers explicitly registered on the dedicated mux

Quality Verification

No new dependencies (stdlib net/http, net/http/pprof, log/slog, time only)
No comments added (per project convention)
go.mod unchanged
Test style matches existing server_test.go

Must-Haves Checklist

internal/daemon/pprof.go — StartPprof with dedicated mux, all pprof handlers
internal/daemon/server.go — PprofAddr in Options, pprofServer field, lifecycle integration
internal/cli/daemon.go — --pprof flag, passed to Options, conditional startup output
internal/daemon/pprof_test.go — 5 tests (disabled, enabled, shutdown, mux isolation, lifecycle)
internal/cli/daemon_test.go — flag registration test
AD-024: pprof mux separate from mTLS daemon mux (verified by test)

Verdict

PASS — all 4 verification layers pass. REQ-056 is fully covered. The --pprof opt-in endpoint runs on a separate listener with a dedicated mux, is disabled by default, and logs a WARN when enabled. I-308 (deferred since v0.2) is now implemented.

2.9 KiB Raw Blame History