Jon Chery
3f5e5de729
Three deep codebase sweeps (security, reliability, feature/doc): - Critical: job run runs locally (scheduler dead code), jobspec parser drops schedule/timeout, verify-reqs bypassed, logs --job RCE, pprof bypass, tar-slip, WebAuthn unauthenticated registration - High: 8 injection vectors, Go 1.25.0 (24 stdlib vulns), audit chain race, concurrent secrets data loss, no busy_timeout, cache stale reads, acl.Check zero calls, mTLS claim false, docs missing 25 subcommands - Medium: key zeroing, cache DB mode, writeAtomic consolidation, WebAuthn session mutex, IPv6, SSH timeouts, DB retention, logs unbounded R-022 (scheduler wiring) and R-023 (zero-trust enforcement) adopted as load-bearing architectural changes. ARCHITECTURE.md updated with deltas. PERSONAS.md updated (security-engineer added, uat-engineer phase-specific). ---ci--- project: orca phase: 0 milestone: v0.13 status: research ---/ci---
28 lines
543 B
JSON
28 lines
543 B
JSON
{
|
|
"phase": 0,
|
|
"stage": "research",
|
|
"milestone": "v0.13",
|
|
"milestone_slug": "production-hardening-2",
|
|
"phase_role": "pre_execution",
|
|
"attempts": 0,
|
|
"updated_at": "2026-08-07T19:00:00Z",
|
|
"milestone_complete": false,
|
|
"previous_milestone": "v0.12",
|
|
"phase_count": 14,
|
|
"phases_shipped": [],
|
|
"tags_shipped": [],
|
|
"requirements": {
|
|
"covered": [],
|
|
"partial": []
|
|
},
|
|
"binding_conditions": [
|
|
"C-39",
|
|
"C-40",
|
|
"C-41",
|
|
"C-42",
|
|
"C-43"
|
|
],
|
|
"load_bearing_rule": "R-022",
|
|
"next_milestone": "v1.0"
|
|
}
|