orca/.ciagent/PHASE1_VERIFICATION_v0.8.md

Phase 1 Verification — v0.8 Coverage & Trust Hardening

Phase: P01 — Coverage uplift round 2 Milestone: v0.8 REQ: REQ-057 Date: 2026-08-04 Result: ✅ PASS (all 4 layers)

Layer 1 — Structural ✅

• go build ./... PASS (no compile errors)
• go vet ./... PASS (no warnings)
• No TODOs/FIXMEs/stubs in production code (the 3 pre-existing placeholders in internal/cli/job.go:78, internal/engine/scheduler.go:115, internal/security/tls_config.go:90 are unchanged from v0.7 and out of scope for P01)
• All test files resolve imports correctly
• The proxmox sessionRunner seam (T01.1) is backward compatible — BootstrapProxmox callers unchanged

Layer 2 — Behavioral ✅

• go test ./... PASS (all 14 packages)
• go test -race ./... PASS (cli 98s, engine 47s, store 88s, transport 22s, all others fast)
• Coverage targets met (T01.12):
  • ≥70% floor: engine 88.9%, proxmox 87.1%, cli 76.2%, transport 93.0%, store 84.7%, jobspec 90.5%
  • ≥50% floor: audit 100.0%, certpaths 100.0%, cmd/orca 80.0%
• GRILL condition #3 escape valve NOT needed (cli hit 76.2%, above 70%)
• T01.2 (conditional peerDispatcher seam) NOT added — engine reached 88.9% via httptest + stubs
• REQ-057 covered: all 9 target packages hit their tiered floor

Layer 3 — Security ✅

• P01 is a test-only phase (the only production change is T01.1's sessionRunner interface extraction + T01.11's main()→run() refactor)
• No new input paths, no new network surfaces, no new crypto
• The sessionRunner seam does not leak test concerns into production (default sshSessionRunner wraps the real SSH session; the seam is only injectable via the package-level var pattern matching sshDialer)
• cmd/orca/main.go refactor: run() int returns exit code; main() calls os.Exit(run()) — no security impact (same behavior, testable)
• No secrets in test code (all test DBs use :memory: or temp dirs; no real credentials)

Layer 4 — Quality ✅

• Tests follow existing conventions (table-driven, t.Run subtests, t.Helper() in setup funcs)
• Reuse of existing helpers: openTestDB, withFastWatch, initTestEnv, resetRootFlags, discardWriter, stubDispatcher pattern
• No flaky tests detected (all pass on repeated runs with -race)
• Test file naming follows *_test.go convention
• No over-testing: daemon.go excluded from cli coverage (covered by internal/daemon/server_test.go)
• P0 issues: none. P1+ issues: none flagged.

Requirement Coverage

REQ	Status	Evidence
REQ-057	✅ Complete	All 9 packages hit tiered floor; go test -cover confirms; go test -race PASS

Lessons

• The sessionRunner seam pattern (package-level var + default init in entry func) is the canonical way to add testability to orca's SSH-dependent packages. Future SSH-adjacent packages should follow it.
• httptest.NewTLSServer sufficed for engine 70% without needing the conditional peerDispatcher seam — the plan's "only if needed" guard worked as intended.
• The cli package's 84s test time is dominated by --watch integration tests with real poll intervals. Future coverage work should consider reducing the withFastWatch interval further or extracting the watch logic for unit-level testing.