Jon Chery 8d1cdceb5c feat(P15.5): threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118) ...

Sub-wave 1: internal/emitter/nft.go (nftables emitter, DNAT :443→127.0.0.1:8443, rate-limit, SYN-flood filter); Traefik static config 127.0.0.1:8443 binding (D-220); orca doctor nft; orca nft CLI (show/diff/doctor/country-block/rate-limit).
Sub-wave 2: docs/threat-model.md (R-017 trust boundary, R-020 deadlock, D-234 secret exclusion, orca user blast radius, step-ca SPOF); orca doctor mTLS (chain verification + live handshake probe, C5).

---ci---
project: orca
phase: 15.5
milestone: v0.11
status: execute
---/ci---

2026-08-07 08:35:06 +00:00

..

acl_test.go

feat(P02): ACL — SPIFFE + token identities, deny-by-default

2026-08-07 04:38:00 +00:00

acl.go

feat(P02): ACL — SPIFFE + token identities, deny-by-default

2026-08-07 04:38:00 +00:00

audit_test.go

test(cli): coverage uplift to ≥70% excl daemon.go (T01.6, REQ-057)

2026-08-04 01:43:38 +00:00

audit.go

ship: v0.1 Foundation milestone complete (#1)

2026-06-03 20:08:57 +00:00

backup_test.go

feat(P04): backup/restore — signed tarball (HMAC-SHA256)

2026-08-07 04:55:27 +00:00

backup.go

feat(P07): recovery (orca restore) — verified restore + alloc protection

2026-08-07 05:47:01 +00:00

cache_test.go

feat(P00): CLI cache layer (R-008) — orca_cache SQLite + cache CLI

2026-08-07 04:17:25 +00:00

cache.go

feat(P00): CLI cache layer (R-008) — orca_cache SQLite + cache CLI

2026-08-07 04:17:25 +00:00

cert_smoke_test.go

fix(P01): register orca cert command tree + cert_repo tests (REQ-053)

2026-08-04 00:05:10 +00:00

cert_test.go

fix(P01): register orca cert command tree + cert_repo tests (REQ-053)

2026-08-04 00:05:10 +00:00

cert.go

feat(P13): ns subcommands (inherit, set-constraint) + deprecation warnings (REQ-068)

2026-08-07 07:47:28 +00:00

cluster_compat.go

feat(P14b,P14c): daemon cutover + rotate-lead (REQ-114) + mixed-version tolerance (REQ-065, REQ-086, C-13)

2026-08-07 08:18:12 +00:00

cluster.go

feat(P14b,P14c): daemon cutover + rotate-lead (REQ-114) + mixed-version tolerance (REQ-065, REQ-086, C-13)

2026-08-07 08:18:12 +00:00

collector_test.go

feat(P09): collector + aggregator (C-11/C-12/C-14) + drift aggregation (REQ-107)

2026-08-07 06:14:16 +00:00

collector.go

feat(P09): collector + aggregator (C-11/C-12/C-14) + drift aggregation (REQ-107)

2026-08-07 06:14:16 +00:00

cutover_rotate_compat_test.go

feat(P14b,P14c): daemon cutover + rotate-lead (REQ-114) + mixed-version tolerance (REQ-065, REQ-086, C-13)

2026-08-07 08:18:12 +00:00

cutover.go

feat(P14b,P14c): daemon cutover + rotate-lead (REQ-114) + mixed-version tolerance (REQ-065, REQ-086, C-13)

2026-08-07 08:18:12 +00:00

daemon_test.go

feat(P13): ns subcommands (inherit, set-constraint) + deprecation warnings (REQ-068)

2026-08-07 07:47:28 +00:00

daemon.go

feat(P00): deprecation sweep + bash tooling gate + render contract + doc banners (v0.9 P00)

2026-08-05 16:26:26 +00:00

deprecation_test.go

feat(P13): ns subcommands (inherit, set-constraint) + deprecation warnings (REQ-068)

2026-08-07 07:47:28 +00:00

doctor_nft_test.go

feat(P15.5): threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118)

2026-08-07 08:35:06 +00:00

doctor_nft.go

feat(P15.5): threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118)

2026-08-07 08:35:06 +00:00

doctor_test.go

test(cli): coverage uplift to ≥70% excl daemon.go (T01.6, REQ-057)

2026-08-04 01:43:38 +00:00

doctor.go

feat(P15.5): threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118)

2026-08-07 08:35:06 +00:00

drain_test.go

feat(P05): drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)

2026-08-07 05:17:01 +00:00

drain.go

feat(P05): drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)

2026-08-07 05:17:01 +00:00

drift_test.go

feat(P10b): drift detection (R-018/R-019/R-020, REQ-103..113)

2026-08-07 07:17:41 +00:00

drift.go

feat(P10b): drift detection (R-018/R-019/R-020, REQ-103..113)

2026-08-07 07:17:41 +00:00

init_test.go

fix(P01): register orca cert command tree + cert_repo tests (REQ-053)

2026-08-04 00:05:10 +00:00

init.go

feat(P01): orca init full bootstrap + schema 0006

2026-08-03 19:47:59 +00:00

job_lint_test.go

feat(P11,P12): orca job lint (REQ-084) + orca job verify (dry-run txn)

2026-08-07 07:29:44 +00:00

job_lint.go

feat(P11,P12): orca job lint (REQ-084) + orca job verify (dry-run txn)

2026-08-07 07:29:44 +00:00

job_test.go

test(cli): coverage uplift to ≥70% excl daemon.go (T01.6, REQ-057)

2026-08-04 01:43:38 +00:00

job_verify_test.go

feat(P11,P12): orca job lint (REQ-084) + orca job verify (dry-run txn)

2026-08-07 07:29:44 +00:00

job_verify.go

feat(P11,P12): orca job lint (REQ-084) + orca job verify (dry-run txn)

2026-08-07 07:29:44 +00:00

job.go

feat(P13): ns subcommands (inherit, set-constraint) + deprecation warnings (REQ-068)

2026-08-07 07:47:28 +00:00

logs_test.go

feat(P06): alloc history (REQ-071) + logs --all-nodes (REQ-117)

2026-08-07 05:36:30 +00:00

logs.go

feat(P06): alloc history (REQ-071) + logs --all-nodes (REQ-117)

2026-08-07 05:36:30 +00:00

metrics_test.go

feat(P01): metrics endpoint — hand-rolled Prometheus text exposition

2026-08-07 04:24:57 +00:00

metrics.go

feat(P01): metrics endpoint — hand-rolled Prometheus text exposition

2026-08-07 04:24:57 +00:00

namespace_test.go

feat(P14b,P14c): daemon cutover + rotate-lead (REQ-114) + mixed-version tolerance (REQ-065, REQ-086, C-13)

2026-08-07 08:18:12 +00:00

nft_test.go

feat(P15.5): threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118)

2026-08-07 08:35:06 +00:00

nft.go

feat(P15.5): threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118)

2026-08-07 08:35:06 +00:00

node_capacity_test.go

test(cli): coverage uplift to ≥70% excl daemon.go (T01.6, REQ-057)

2026-08-04 01:43:38 +00:00

node_capacity.go

docs(milestone): complete scheduling-streaming (v0.3)

2026-08-01 20:06:47 +00:00

node_test.go

test(cli): --host-key-fingerprint non-proxmox validation (T02.11, REQ-058)

2026-08-04 12:04:28 +00:00

node.go

feat(P00): CLI cache layer (R-008) — orca_cache SQLite + cache CLI

2026-08-07 04:17:25 +00:00

ns_test.go

feat(P13): ns subcommands (inherit, set-constraint) + deprecation warnings (REQ-068)

2026-08-07 07:47:28 +00:00

ns.go

feat(P13): ns subcommands (inherit, set-constraint) + deprecation warnings (REQ-068)

2026-08-07 07:47:28 +00:00

osdetect_test.go

feat(P03): doctor os + doctor proxmox + audit logging

2026-08-03 19:59:51 +00:00

osdetect.go

feat(P03): doctor os + doctor proxmox + audit logging

2026-08-03 19:59:51 +00:00

peer_setup.go

feat(P10b): drift detection (R-018/R-019/R-020, REQ-103..113)

2026-08-07 07:17:41 +00:00

recovery_test.go

feat(P07): recovery (orca restore) — verified restore + alloc protection

2026-08-07 05:47:01 +00:00

recovery.go

feat(P07): recovery (orca restore) — verified restore + alloc protection

2026-08-07 05:47:01 +00:00

root_test.go

feat(P02): HCL config file parsing — internal/config package (REQ-054)

2026-08-04 00:09:33 +00:00

root.go

feat(P00): deprecation sweep + bash tooling gate + render contract + doc banners (v0.9 P00)

2026-08-05 16:26:26 +00:00

rotate_lead.go

feat(P14b,P14c): daemon cutover + rotate-lead (REQ-114) + mixed-version tolerance (REQ-065, REQ-086, C-13)

2026-08-07 08:18:12 +00:00

secrets_test.go

feat(P03): secrets subsystem (REQ-080) — AES-256-GCM + HKDF-SHA256 per-ns

2026-08-07 04:47:33 +00:00

secrets.go

feat(P03): secrets subsystem (REQ-080) — AES-256-GCM + HKDF-SHA256 per-ns

2026-08-07 04:47:33 +00:00

status_test.go

test(cli): coverage uplift to ≥70% excl daemon.go (T01.6, REQ-057)

2026-08-04 01:43:38 +00:00

status.go

ship: v0.1 Foundation milestone complete (#1)

2026-06-03 20:08:57 +00:00

txn_test.go

feat(P10a): transactional plane (REQ-075, REQ-079; C-09, C-23)

2026-08-07 06:28:34 +00:00

txn.go

feat(P10a): transactional plane (REQ-075, REQ-079; C-09, C-23)

2026-08-07 06:28:34 +00:00

upgrade_test.go

feat(P14a): v0.8→v1.0 data migration (REQ-066, C-07) + orca upgrade (REQ-115, C-25, C-27)

2026-08-07 08:00:10 +00:00

upgrade.go

feat(P14a): v0.8→v1.0 data migration (REQ-066, C-07) + orca upgrade (REQ-115, C-25, C-27)

2026-08-07 08:00:10 +00:00

version_test.go

test(cli): coverage uplift to ≥70% excl daemon.go (T01.6, REQ-057)

2026-08-04 01:43:38 +00:00

version.go

ship: v0.1 Foundation milestone complete (#1)

2026-06-03 20:08:57 +00:00

watch_test.go

docs(milestone): complete scheduling-streaming (v0.3)

2026-08-01 20:06:47 +00:00

workload_test.go

fix(P06): workloadToTaskSpecs command split + runnable examples

2026-08-05 21:23:32 +00:00