Files

T

Jon Chery 04d9dccd41 fix(P01): register orca cert command tree + cert_repo tests (REQ-053)

The `orca cert` command (ca-init, gen, show, renew, fingerprint) was
fully implemented in internal/cli/cert.go but never registered on
rootCmd — unreachable from the CLI. Added init() registration (AD-022).
Added cert_test.go (regression) + cert_smoke_test.go (e2e). Added
cert_repo_test.go (11 tests) + migration 0007 (UNIQUE serial_hex, I-107).

---ci---
project: orca
phase: 1
milestone: v0.7
status: verify
requirements:
  covered: [REQ-053]
  partial: []
---/ci---

2026-08-04 00:05:10 +00:00

3.2 KiB

Raw Blame History

Phase 1 Verification Report — v0.7: Register `orca cert` Command Tree

Phase: 1
Branch: phase/01-cert-register
REQ Coverage: REQ-053
Milestone: v0.7 (Hardening & Completion)

Structural Verification

Files Modified

internal/cli/cert.go — added init() registering NewCommand on rootCmd (AD-022)
internal/cli/init_test.go — updated expected migration version 0006 → 0007
internal/doctor/doctor_test.go — relaxed DB check assertion to check "migrations up to" prefix (migration-version-agnostic)
internal/store/migrate_test.go — updated expected migration version 0006 → 0007

Files Created

internal/cli/cert_test.go — regression test for cert command registration + subcommand tree
internal/cli/cert_smoke_test.go — end-to-end smoke test (ca-init, gen, show, fingerprint, renew, file modes)
internal/store/cert_repo_test.go — 11 tests covering Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + error paths
internal/store/migrations/0007_certs_serial_unique.sql — UNIQUE index on certs.serial_hex (I-107; migration-driven, not backfilled into 0004)

Behavioral Verification

Test Results

go test ./...               → all PASS (exit 0)
go test -race ./...         → all PASS (exit 0)
go vet ./...                → clean
make build                  → clean (v0.6.0)

Coverage (store package)

Store total: 60.5% (up from 46.9%)
cert_repo.go: Insert 91.7%, Get 100%, LatestForKind 100%, PruneOlderThan 85.7%, Delete 85.7%, List/ListByNode 81.8%

CLI Smoke Test (manual)

./bin/orca cert                    → prints help (was: "unknown command")
./bin/orca cert ca-init --cn X     → ✓ CA initialized, 0644/0600 modes
./bin/orca cert fingerprint --which ca → 64-char hex SHA-256

Security Verification

orca cert show redacts private key material (REQ-035) — verified in smoke test
Cert file modes enforced: 0600 keys, 0644 certs (REQ-033) — verified in smoke test
No secrets in logs — cert.ca_init/cert.issued/cert.renewed log events contain only fingerprints, never key bytes
Migration 0007 is additive (UNIQUE index), backward-compatible — no data loss

Quality Verification

No new dependencies added (go.mod unchanged)
No comments added (per project convention)
Test style matches existing node_repo_test.go / root_test.go patterns
All ---ci--- blocks present in commits

Must-Haves Checklist

internal/cli/cert.go — init() with rootCmd.AddCommand(NewCommand(slog.Default()))
internal/cli/cert_test.go — regression test for registration + subcommands
internal/cli/cert_smoke_test.go — e2e: ca-init, gen, show (redaction), fingerprint, renew, file modes
internal/store/cert_repo_test.go — 11 tests covering full CRUD + rotation history + duplicate serial
internal/store/migrations/0007_certs_serial_unique.sql — UNIQUE index (I-107)

Verdict

PASS — all 4 verification layers (structural, behavioral, security, quality) pass. REQ-053 is fully covered. The orca cert command tree is now reachable from the CLI, cert_repo has comprehensive tests, and the serial_hex UNIQUE constraint is enforced via migration.

3.2 KiB Raw Blame History

Phase 1 Verification Report — v0.7: Register orca cert Command Tree