Jon Chery
dc67522b8c
Layer 1 (Structural): scripts/backfill_releases.sh is mode 755,
171 lines, parses cleanly under 'bash -n'. .gitignore has '.env' on
line 11 (alongside '.env.local'). .ciagent/PHASE7_SECURITY_AUDIT.md
exists, 57 lines / 2574 bytes.
Layer 2 (Behavioral): idempotency path is EXISTING=$(tea releases list
...) | awk + 'grep -qx $TAG' skip branch (lines 52, 82-85). Error
paths: ': ${GITEA_TOKEN:?GITEA_TOKEN is required}' on line 37 exits
non-zero with a clear message when .env is missing; 'command -v'
guards on lines 38-40 exit 1 with 'err' for missing tea/go/tar.
Tarball naming on line 101 is orca-${TAG}-${OS}-${ARCH}.tar.gz,
matches the orca-<tag>-<os>-<arch>.tar.gz convention.
Layer 3 (Security): .env is sourced from a list of well-known paths
(lines 24-32) via 'set -a' ... '. file' ... 'set +a', so the token
is exported into the script's environment. The script never echoes
$ GITEA_TOKEN and never passes it as a CLI argument to 'tea' — the
'tea releases create' invocation on lines 161-165 carries --repo,
--title, --note-file, --asset, but no --token flag (tea reads it
from its own config). .gitignore now excludes .env (forward fix).
The pre-existing secret leak in 0cba1aa (verified: 'git show
--stat 0cba1aa' lists '.env | 2 ++') is documented in
PHASE7_SECURITY_AUDIT.md as P0 for human remediation out-of-band;
the existing token still works and the backfill ran successfully,
so the leak does not block this verify.
Layer 4 (Quality): 'go build ./...' exits 0 (clean). 'go vet ./...'
exits 0 (clean). Both P07 execute commits use 'fix(P07):' Conventional
Commits prefixes, and their ---ci--- blocks parse correctly (project,
phase, milestone, status, version, requirements.covered,
requirements.partial all present and well-formed).
Result: PASS on all 4 layers. Phase 7 is verified.
---ci---
project: orca
phase: 7
milestone: v0.1
status: verify
version: v0.1.7
requirements:
covered: [REQ-007]
partial: []
---/ci---
Orca
Offline/CLI-first orchestration engine inspired by HashiCorp Nomad, far simpler than Kubernetes.
Status
v0.1: Foundation — see .ciagent/ROADMAP.md for the 6-phase plan.
Pillars
- Simplicity — single binary, minimal dependencies
- AI-first — CLI designed for both humans and AI agents
- Offline-first — no cloud dependencies
- CLI-first — primary interface is the command line
- Security before features — NFRs ship before new functionality
- Bug fixes before features — stability is paramount
- NFRs before features — observability and auditability first
Quickstart
# Build
make build
# Run
./bin/orca version
./bin/orca --help
# Initialize local state
./bin/orca init
Subcommands
| Command | Description | Status |
|---|---|---|
orca version |
Print version info | ✅ Phase 1 |
orca init |
Initialize local orca state | ✅ Phase 1 (stub) |
orca status |
Show orca daemon status | ✅ Phase 1 (stub) |
orca node |
Node management (join, leave, list) |
Phase 2 |
orca job |
Job management (run, list, stop, logs) |
Phase 3 |
Development
make build # Build binary to ./bin/orca
make test # Run tests with race detection
make lint # Run golangci-lint
make fmt # Format code
make release # Build + create Gitea release (Phase 6)
Architecture
See .ciagent/ARCHITECTURE.md for full architecture details.
License
MIT — see LICENSE.