Jon Chery
cf0df0f157
---ci--- project: orca phase: 0 milestone: v0.12 status: specify ---/ci--- Threat-model review of entire surface incl OS (25 findings F1..F25). Adopts R-021 (no Orca credentials: human=OIDC, machine=mTLS/SPIFFE). Bundled Dex + WebAuthn (passkeys) as default password-free authenticator. Master key seal-to-OIDC + Shamir 3-of-5 recovery. 30 net-new requirements (REQ-119..REQ-148). 29 phases. Binding conditions C-29..C-38.
20 lines
897 B
JSON
20 lines
897 B
JSON
{
|
|
"phase": 0,
|
|
"stage": "ship",
|
|
"milestone": "v0.12",
|
|
"milestone_slug": "security-hardening",
|
|
"phase_role": "pre_execution",
|
|
"attempts": 0,
|
|
"updated_at": "2026-08-07T09:00:00Z",
|
|
"milestone_complete": false,
|
|
"previous_milestone": "v0.11",
|
|
"research_docs_ingested": 1,
|
|
"locked_decisions": {"D-238": "v0.12 minor", "D-239": "bundled Dex + BYO", "D-240": "WebAuthn", "D-241": "seal-to-OIDC + Shamir", "D-242": "auth-code+PKCE", "D-243": "Traefik RP ID", "D-244": "SQLite 0600 public keys", "D-245": "device-code fallback", "D-246": "credentials.json 0600", "D-247": "accept-identity-migration gate"},
|
|
"grill_verdict": "PROCEED-WITH-CONDITIONS",
|
|
"binding_conditions": ["C-29", "C-30", "C-31", "C-32", "C-33", "C-34", "C-35", "C-36", "C-37", "C-38"],
|
|
"phase_count": 29,
|
|
"load_bearing_rule": "R-021",
|
|
"threat_model_findings": 25,
|
|
"new_requirements": "REQ-119..REQ-148"
|
|
}
|