Jon Chery a6ceb13491 fix(A): bootstrap plumbing — init creates SSH key + known_hosts + master key (REQ-164) ...

Fixes UAT issues 1, 8, 9, 12C, 13:
- orca init: generates SSH keypair (GenerateOrLoadSSHKey), creates
  empty known_hosts (0600), generates master key (GenerateMasterKey +
  SaveMasterKey). All were missing from runInit — every downstream
  SSH/secrets/cluster operation failed on a fresh init.
- TOFUHostKeyCallbackPath: creates known_hosts file if it doesn't exist
  (defense-in-depth alongside init)
- Linux bootstrap: replaces buggy inline TOFU with
  proxmox.TOFUHostKeyCallbackPath (first-connect key capture works)
- --type flag help: includes "linux" (was "localhost or proxmox")
- doctor network: SSH exec probe (was HTTP /healthz to :8443 — no
  daemon in SSH-push model R-001)

---ci---
project: orca
milestone: v0.12.18
phase: A
status: complete
requirements:
  covered: [164]
---/ci---

2026-08-10 16:02:19 +00:00

..

acl

fix(P06): ACL rewrite to OIDC claims (REQ-145, REQ-122, F1)

2026-08-07 11:03:42 +00:00

audit

test(P03): coverage uplift — engine/transport/proxmox/audit ≥50% + dispatch.go EOF fix (REQ-055)

2026-08-04 00:18:58 +00:00

backup

fix(P02): input validation + injection hardening — 11 vectors (REQ-150)

2026-08-07 19:28:01 +00:00

cache

fix(P09): migration + operational safety — job stop, retention, logs cap (REQ-158)

2026-08-10 13:37:28 +00:00

certpaths

feat(P0a1): multi-namespace path resolver + config demotion + known_hosts flock + CA migration spec (v0.9 P0a1)

2026-08-05 16:38:26 +00:00

cli

fix(A): bootstrap plumbing — init creates SSH key + known_hosts + master key (REQ-164)

2026-08-10 16:02:19 +00:00

cluster

feat(P10): lead rules + step-ca integration (REQ-076)

2026-08-05 18:48:46 +00:00

config

feat(P06): auth init-idp real + auth register + doctor oidc (REQ-155)

2026-08-10 11:55:01 +00:00

daemon

fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)

2026-08-07 20:33:39 +00:00

doctor

fix(A): bootstrap plumbing — init creates SSH key + known_hosts + master key (REQ-164)

2026-08-10 16:02:19 +00:00

drift

fix(P25): drift event authentication (REQ-140, F18)

2026-08-07 11:33:20 +00:00

emit

feat(P00): deprecation sweep + bash tooling gate + render contract + doc banners (v0.9 P00)

2026-08-05 16:26:26 +00:00

emitter

feat(P03): wire scheduler into job run + fix jobspec parser (REQ-151, REQ-152)

2026-08-07 19:59:31 +00:00

engine

fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)

2026-08-10 12:27:05 +00:00

identity

fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)

2026-08-10 13:11:07 +00:00

jobspec

feat(P03): wire scheduler into job run + fix jobspec parser (REQ-151, REQ-152)

2026-08-07 19:59:31 +00:00

linux

fix(A): bootstrap plumbing — init creates SSH key + known_hosts + master key (REQ-164)

2026-08-10 16:02:19 +00:00

migration

fix(P22): migration safety (REQ-137, F19, C-34)

2026-08-07 11:31:26 +00:00

model

feat(P05): drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)

2026-08-07 05:17:01 +00:00

ns

fix(P02): namespace path traversal (REQ-120, F4)

2026-08-07 10:55:18 +00:00

osdetect

feat(P03): doctor os + doctor proxmox + audit logging

2026-08-03 19:59:51 +00:00

paths

feat(P02): ACL — SPIFFE + token identities, deny-by-default

2026-08-07 04:38:00 +00:00

proxmox

fix(A): bootstrap plumbing — init creates SSH key + known_hosts + master key (REQ-164)

2026-08-10 16:02:19 +00:00

runtime

fix(P02): input validation + injection hardening — 11 vectors (REQ-150)

2026-08-07 19:28:01 +00:00

scheduler

feat(P03): wire scheduler into job run + fix jobspec parser (REQ-151, REQ-152)

2026-08-07 19:59:31 +00:00

seal

feat(P05): seal/audit CLI + chain race fix + key zeroing (REQ-154)

2026-08-07 21:06:39 +00:00

secrets

feat(P05): seal/audit CLI + chain race fix + key zeroing (REQ-154)

2026-08-07 21:06:39 +00:00

security

fix(P24): known_hosts tightening + transport hardening (REQ-139, F15, F25)

2026-08-07 11:32:25 +00:00

spec/schema

feat(P06): task groups — multi-process services, multiple systemd units per alloc

2026-08-05 18:20:05 +00:00

sshpush

fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)

2026-08-10 13:11:07 +00:00

stepca

fix(P13): step-ca /tmp hardening (REQ-128, F10)

2026-08-07 11:22:07 +00:00

storage

feat(P09): Syncthing storage replication + conflict resolution (REQ-081; gates C-02, C-14)

2026-08-05 18:38:49 +00:00

store

fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)

2026-08-10 12:27:05 +00:00

transport

feat(P10): observability expansion — metrics + security headers (REQ-159)

2026-08-10 13:44:04 +00:00

txn

fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)

2026-08-07 20:33:39 +00:00

webauthn

fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)

2026-08-10 12:27:05 +00:00