Jon Chery
fc94326b0e
P00 — Re-architecture Foundation (deprecation/migration/test-infra/persona/docs). Deprecation sweep (REQ-068, REQ-072, REQ-089): - Add // Deprecated: doc comments to internal/daemon (R-001), internal/transport (REQ-073), internal/security/ca.go+csr.go (D-101/REQ-076), internal/engine/ dispatcher.go+peer.go (CLI-side scheduler), internal/cli/daemon.go. - orca daemon emits slog.Warn deprecation banner on every run (ungated); fires R-001 + v0.10-P05 drain-and-stop + v0.10-P14 deletion. - orca cert and orca node join (mTLS path) emit deprecation warnings; proxmox SSH path (the v0.9 replacement) does not warn. - Add --no-deprecation-warnings global flag on root command (PersistentPreRunE) for orca upgrade migrations. - 12 new daemon/cert/node deprecation tests in internal/cli/daemon_test.go (cli coverage 81.9%, warnDeprecated 100%). - Add DEPRECATED banners to v0.8 sections of ARCHITECTURE.md (verified the v0.9 supersession section + Supersession Table from prior turn are present). Bash tooling gate (grill C-06, C-15, C-16, C-17, C-18): - scripts/tests/test_helper.bash + example_test.bash — bats framework + helpers. - scripts/lib/orca-log.sh — slog-compatible JSON logging to syslog (C-17). - scripts/orca-verify-render.sh — render-contract validator skeleton (C-16). - scripts/tests/orca-log_test.bash + orca-verify-render_test.bash — 20 bats tests total (happy + failure paths per C-15). - .shellcheckrc — project shellcheck config. - Makefile: test-bash + lint-bash targets (graceful skip if tools missing); wired into test + lint targets. - internal/emit/contract.go + contract_test.go — versioned JSON render contract (orca.emit/v1) between Go emitters and bash appliers (C-16). - .ciagent/BASH_CAPABILITY_MAP_v0.9.md — maps shipped internal/transport capabilities to bash-side equivalents or accepted drops (C-18). - D-186 recorded in PROJECT.md: bash exempt from Go coverage gate; compensating control is bats + shellcheck + shfmt (C-06). verify-reqs: 90 requirements consistent. Build/test/lint/fmt all green. 20 bats tests pass. Go tests pass. No v0.8 code deleted — only marked deprecated (deletion deferred to v0.10-P14 per REQ-090 dual-write window). ---ci--- project: orca phase: P00 milestone: v0.9 status: execute ---/ci---
3.8 KiB
3.8 KiB
Bash Capability Map — v0.9 (grill C-18)
Maps every capability in the shipped internal/transport package to its
bash-side equivalent (or accepted drop with recorded rationale) in the v0.9
re-architecture. The grill (C-18) required this mapping so capability
regressions are visible, not silent.
| Shipped capability (internal/transport) | Bash-side equivalent | Status | Rationale |
|---|---|---|---|
Retry with exponential backoff (retry.go: 100ms start, ×2, cap 5s, max 5 attempts) |
orca-retry() function in scripts/lib/orca-retry.sh (to be written in v0.9-P01 SSH-push transport phase, REQ-073) |
planned (v0.9-P01) | SSH dial/exec failures need the same bounded retry. The pattern is transport-agnostic; the Go retry logic is extracted into the new internal/sshpush/ package and a bash-side helper mirrors it for the lead-applier scripts. |
Idempotency keys (idempotency.go: in-memory sync.Map of keys, X-Orca-Idempotency-Key header) |
Content-addressed filenames — skip SCP if the target hash already exists on the peer | planned (v0.9-P01) | SSH-push doesn't have HTTP headers; idempotency is achieved by content-addressing the rendered file (<hash>.unit) and skipping if the peer already has it. The bash applier checks test -f /run/orca/<hash> before applying. |
Structured mTLS failure logging (handshake_log.go: slog JSON per mTLS failure) |
orca_log_error via scripts/lib/orca-log.sh (C-17, shipped in this phase P00) |
dropped (mTLS removed by R-001) | The v0.9 re-architecture removes mTLS daemon-to-daemon transport entirely (R-001). SSH failures are logged via the new orca_log_* functions which emit the same slog-compatible JSON field set (ts, level, actor, action, resource, result, error) to syslog. The mTLS-specific handshake-log fields (cipher suite, TLS version, cert SAN) have no SSH equivalent and are dropped — the SSH error message is captured in the error field instead. |
TLS 1.3 + AEAD cipher allowlist (mtls.go: MinVersion=tls.VersionTLS13, CipherSuites limited) |
SSH's own cipher config (/etc/ssh/sshd_config Ciphers, MACs, KexAlgorithms) managed by the operator |
dropped (transport replaced) | R-001 replaces mTLS HTTP with SSH. SSH's transport security is governed by the peer's sshd_config, not the orca binary. The CLI's SSH client (golang.org/x/crypto/ssh, already a dep) uses Go's default modern SSH cipher set. The PRD does not require orca to manage sshd_config cipher policy in v0.9. |
mTLS client/server handshake (mtls.go: MTLSClient, daemon-side SubmitHandler) |
ssh.Dial + ssh.PublicKeys auth (CLI-side internal/sshpush/, REQ-073) |
replaced (v0.9-P01) | The daemon-to-daemon mTLS handshake is replaced by CLI-to-server SSH. The CLI holds an Ed25519 key (cluster/orca_ssh_key, D-037) and authenticates to each peer's sshd. TOFU host-key handling (proxmox.TOFUHostKeyCallback, v0.8 REQ-058) is reused for all peers, not just Proxmox. |
Net-new capabilities in v0.9 (no shipped equivalent)
| Net-new capability | Bash-side | Status |
|---|---|---|
| Transaction bundle apply (R-010, REQ-075) | orca-apply-render.sh (v0.10-P10) |
planned |
| Drift detection (R-010) | orca-drift.sh (v0.10-P10) |
planned |
| Per-node state collection | orca-collect.sh (v0.10-P09) |
planned |
| Lead aggregation | orca-aggregate.sh (v0.10-P09) |
planned |
| Credential cleanup (5-min shred) | orca-cleanup-credentials.sh (v0.10) |
planned |
| Render-bundle validation (C-16) | orca-verify-render.sh (shipped this phase P00) |
✅ shipped |
| Structured logging (C-17) | orca-log.sh (shipped this phase P00) |
✅ shipped |
Review cadence
This map is reviewed at each phase that introduces or modifies a bash script. The security-engineer persona reviews the SSH trust surface; the devops-engineer persona reviews the bash tooling gate (C-15..C-18).