Jon Chery b0158c96e9 fix(P01): bump go toolchain to 1.25.12 + fix pre-existing test bugs (REQ-149) ...

Toolchain:
- go.mod: go 1.25.0 -> 1.25.12 (closes 24 stdlib vulns: archive/tar,
  crypto/tls, crypto/x509, net/http, net/url, encoding/pem, os)
- go mod tidy clean; make build + test + lint pass

Pre-existing test bugs fixed (surfaced by toolchain bump):
- acl_test.go: KindToken always denies (R-021); tests updated to KindOidc
- acl.go: parseIdentity defaults to KindOidc (was KindToken, making
  acl grant/check CLI path non-functional for non-spiffe identities)
- init_test.go: migration version updated to 0008 (was 0007, stale since v0.12)
- doctor.go: CertCA now checks CA cert exists (was only checking file modes,
  passing when no CA present)
- scenarios_test.go: ACL integration test uses KindOidc + acl.json 0600

---ci---
project: orca
phase: 1
milestone: v0.13
status: complete
requirements:
  covered: [149]
---/ci---

2026-08-07 19:07:17 +00:00

..

acl

fix(P06): ACL rewrite to OIDC claims (REQ-145, REQ-122, F1)

2026-08-07 11:03:42 +00:00

audit

test(P03): coverage uplift — engine/transport/proxmox/audit ≥50% + dispatch.go EOF fix (REQ-055)

2026-08-04 00:18:58 +00:00

backup

fix(P12): backup symlink validation (REQ-127, F7)

2026-08-07 11:21:19 +00:00

cache

feat(P00): CLI cache layer (R-008) — orca_cache SQLite + cache CLI

2026-08-07 04:17:25 +00:00

certpaths

feat(P0a1): multi-namespace path resolver + config demotion + known_hosts flock + CA migration spec (v0.9 P0a1)

2026-08-05 16:38:26 +00:00

cli

fix(P01): bump go toolchain to 1.25.12 + fix pre-existing test bugs (REQ-149)

2026-08-07 19:07:17 +00:00

cluster

feat(P10): lead rules + step-ca integration (REQ-076)

2026-08-05 18:48:46 +00:00

config

feat(P0a1): multi-namespace path resolver + config demotion + known_hosts flock + CA migration spec (v0.9 P0a1)

2026-08-05 16:38:26 +00:00

daemon

fix(P09): daemon auth hardening (REQ-123, REQ-124, F6, F24)

2026-08-07 11:16:16 +00:00

doctor

fix(P01): bump go toolchain to 1.25.12 + fix pre-existing test bugs (REQ-149)

2026-08-07 19:07:17 +00:00

drift

fix(P25): drift event authentication (REQ-140, F18)

2026-08-07 11:33:20 +00:00

emit

feat(P00): deprecation sweep + bash tooling gate + render contract + doc banners (v0.9 P00)

2026-08-05 16:26:26 +00:00

emitter

fix(P18): nftables ruleset hardening (REQ-133, F21)

2026-08-07 11:27:33 +00:00

engine

feat(P05): drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)

2026-08-07 05:17:01 +00:00

identity

fix(P13): step-ca /tmp hardening (REQ-128, F10)

2026-08-07 11:22:07 +00:00

jobspec

feat(P06): task groups — multi-process services, multiple systemd units per alloc

2026-08-05 18:20:05 +00:00

migration

fix(P22): migration safety (REQ-137, F19, C-34)

2026-08-07 11:31:26 +00:00

model

feat(P05): drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)

2026-08-07 05:17:01 +00:00

ns

fix(P02): namespace path traversal (REQ-120, F4)

2026-08-07 10:55:18 +00:00

osdetect

feat(P03): doctor os + doctor proxmox + audit logging

2026-08-03 19:59:51 +00:00

paths

feat(P02): ACL — SPIFFE + token identities, deny-by-default

2026-08-07 04:38:00 +00:00

proxmox

fix(P20): system user consistency (REQ-135, F23)

2026-08-07 11:29:56 +00:00

runtime

fix(P01): command injection in podman/wasm runtimes (REQ-119, F3)

2026-08-07 10:49:08 +00:00

scheduler

feat(P05): CLI-side scheduler + CEL constraints + affinity (REQ-083)

2026-08-05 18:02:51 +00:00

seal

feat(P08): master key seal-to-OIDC + Shamir 3-of-5 (REQ-147, D-241, C-35)

2026-08-07 11:14:01 +00:00

secrets

feat(P03): secrets subsystem (REQ-080) — AES-256-GCM + HKDF-SHA256 per-ns

2026-08-07 04:47:33 +00:00

security

fix(P24): known_hosts tightening + transport hardening (REQ-139, F15, F25)

2026-08-07 11:32:25 +00:00

spec/schema

feat(P06): task groups — multi-process services, multiple systemd units per alloc

2026-08-05 18:20:05 +00:00

sshpush

fix(P99): P0 heredoc command injection + ROADMAP/REQUIREMENTS reconciliation

2026-08-05 19:02:54 +00:00

stepca

fix(P13): step-ca /tmp hardening (REQ-128, F10)

2026-08-07 11:22:07 +00:00

storage

feat(P09): Syncthing storage replication + conflict resolution (REQ-081; gates C-02, C-14)

2026-08-05 18:38:49 +00:00

store

fix(P21): SQLite file-mode 0600 (REQ-136, F8, C-31)

2026-08-07 11:30:56 +00:00

transport

feat(P01): metrics endpoint — hand-rolled Prometheus text exposition

2026-08-07 04:24:57 +00:00

txn

fix(P03): txn apply path allowlist (REQ-121, F5)

2026-08-07 10:56:25 +00:00

webauthn

feat(P05): WebAuthn connector for Dex (REQ-148, D-240, C-38)

2026-08-07 11:02:07 +00:00