orca/CHANGELOG.md

Changelog

All notable changes to orca are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

v0.13 milestone (in progress) — tag line v0.12.x

The v0.13 milestone is Production Hardening Round 2 + UAT Plan. Three deep codebase sweeps (security, reliability, feature/doc claims) surfaced ~60 gaps beyond v0.12. v0.13 closes all critical/high/medium findings and delivers the UAT plan + signoff script that gates the v1.0.0 cut.

Load-bearing architectural changes:

• R-022 — orca job run deploys to remote nodes via the scheduler → emitter → SSH-push pipeline. The local exec.CommandContext path is removed (P03).
• R-023 — Zero-trust enforcement is operationally wired: acl.Check is invoked on every daemon handler + sshpush + txn apply path; acl.json is 0600; audit actor carries OIDC sub/SVID; WebAuthn registration requires auth; cluster seal/unseal + doctor audit/ doctor modes CLI commands exist (P04, P05).

v0.13 phase commits (v0.11.29..HEAD)

• ed91d68 — feat(P10): observability expansion — metrics + security headers (REQ-159)
• 531b369 — fix(P09): migration + operational safety — job stop, retention, logs cap (REQ-158)
• 3a3ea74 — fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)
• 0358efe — fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)
• 978334a — feat(P06): auth init-idp real + auth register + doctor oidc (REQ-155)
• 9e83238 — feat(P05): seal/audit CLI + chain race fix + key zeroing (REQ-154)
• 5232fcb — fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)
• cf3d98e — feat(P03): wire scheduler into job run + fix jobspec parser (REQ-151, REQ-152)
• 4b70e31 — fix(P02): input validation + injection hardening — 11 vectors (REQ-150)
• b0158c9 — fix(P01): bump go toolchain to 1.25.12 + fix pre-existing test bugs (REQ-149)
• 7479cd1 — docs(checkpoint): P0 shipped — v0.12.0 tagged
• 1a2dd1a — docs(P00): incorporate grill binding conditions C-44..C-49
• 437d9b2 — docs(P00): grill v0.13 — CONDITIONAL PROCEED (6 binding conditions C-44..C-49)
• 82bfab1 — docs(P00): create phase plans — 14 phases, 15 REQs, vertical slices
• a2a651e — docs(P00): ideation results — 15 accepted (REQ-149..REQ-163), 0 skipped
• 3f5e5de — docs(P00): research findings — threat model round 3 (~60 gaps, F26-F101)
• 7a60b35 — docs(P00): clarify v0.13 — 7 decisions resolved (D-248..D-254)
• 8071793 — docs(init): validate specification — v0.13 Production Hardening Round 2 + UAT Plan

v0.13 phase summary

• P0 — Pre-execution: specify → clarify → research → ideate → plan → grill (tag v0.12.0)
• P01 — Toolchain & dependency vulns: Go 1.25.12 bump, 24 stdlib vulns closed, govulncheck triage (REQ-149)
• P02 — Input validation & injection hardening: 11 vectors closed (orca logs --job RCE, tar-slip, sudoers injection, pprof loopback, txn/nft ID validation, drain allocID, cluster_compat, podman image, nft TrustedProbes, sudoers user/role) (REQ-150)
• P03 — Scheduler/deployment wiring + jobspec parser: orca job run wires scheduler → emitter → SSH-push; schedule:/timeout: parsed by markdown jobspec (REQ-151, REQ-152)
• P04 — ACL enforcement + WebAuthn registration auth: acl.Check wired into daemon + sshpush + txn apply; WebAuthn registration requires auth; audit actor carries OIDC sub/SVID (REQ-153)
• P05 — Seal/audit CLI + chain race fix + key zeroing: orca cluster seal/unseal, orca doctor audit, orca doctor modes CLI commands; audit hash-chain race fix; master key zeroed on exit (REQ-154)
• P06 — auth init-idp real + auth register + doctor oidc: real Dex deployment, orca auth register browser flow, orca doctor oidc health check (REQ-155)
• P07 — Concurrency safety: SQLite WAL, flock on known_hosts, cache thread-safety, atomic writes (REQ-156)
• P08 — Transport & SSH safety: typed dial errors, IPv6 support, connect timeouts, signal handling (REQ-157)
• P09 — Migration & operational safety: orca job stop via SSH, DB retention check, logs cap (REQ-158)
• P10 — Observability & metrics: metrics endpoint expansion, security headers (REQ-159)
• P11 — Doc drift round 2 (this phase, REQ-160)

v0.12 milestone — COMPLETE (tag line v0.11.x)

The v0.12 milestone is Security Hardening (Zero-Trust Identity). Comprehensive security hardening across the entire attack surface including the OS, plus adoption of a zero-trust identity model. 25 threat-model findings (F1..F25) closed. R-021 adopted: no Orca-issued credentials — human identity is exclusively external (OIDC), machine identity is exclusively mTLS/SPIFFE.

Milestone release: v0.11.28 (29 phases, tags v0.11.0..v0.11.28).

v0.12 phase highlights

• Command injection fix (REQ-119, F3)
• Namespace path traversal fix (REQ-120, F4)
• Txn apply path allowlist (REQ-121, F5)
• OIDC client + bundled Dex (REQ-144; BYO-IdP override)
• WebAuthn connector for Dex / passkeys (REQ-148)
• ACL rewrite to OIDC claims + enforcement (REQ-145, REQ-122, F1)
• Remove all password/token paths (REQ-146, R-021, C-34)
• Master key seal-to-OIDC + Shamir 3-of-5 recovery (REQ-147, C-35)
• Daemon auth hardening (REQ-123, REQ-124, F6, F24)
• Audit log tamper-evidence (REQ-125, F2)
• SVID chain validation (REQ-126, F9)
• Backup symlink validation (REQ-127, F7)
• step-ca /tmp hardening (REQ-128, F10)
• Master key rotation (REQ-129, F12, C-30)
• File-mode audit expansion (REQ-130, F13)
• aggregate.sh JSON injection + drift-gate fix (REQ-131, F11, F18)
• install.sh checksum+GPG verification (REQ-132, F14)
• nftables ruleset hardening (REQ-133, F21)
• sudoers hardening (REQ-134, F22)
• System user consistency (REQ-135, F23)
• SQLite file-mode + at-rest encryption (REQ-136, F8, C-31)
• Migration safety + identity migration (REQ-137, F19, C-34)
• Legacy CA/mTLS/daemon + step-ca password-provisioner deletion (REQ-138, F16)
• known_hosts tightening + transport hardening (REQ-139, F15, F25)
• Drift event authentication (REQ-140, F18)
• Security integration test suite (REQ-141, C-33)
• Zero-trust + OIDC + WebAuthn + threat-model docs (REQ-142)
• Final review + ship + audit (REQ-143)

v0.11 milestone — COMPLETE (tag line v0.10.x)

The v0.11 milestone is Production Hardening. See the git log and ROADMAP for the full phase list.

v0.1 milestone — COMPLETE

Initial CLI skeleton, node management, task execution, state persistence, audit log, health checks, and CoreCI release flow.

• e1b5385 — feat(P06): CoreCI release flow with .coreci.yml and tea integration
• 07b8ad2 — ship(P05): health checks merged into milestone
• b06458d — docs(P05): verification - 4 layers pass
• 708d983 — feat(P05): health check daemon with /healthz, /readyz, /v1/* handlers
• 30c523c — ship(P04): state persistence merged into milestone
• 759b1b5 — docs(P04): verification - 4 layers pass
• b25e074 — feat(P04): audit log + persistence hardening
• bb6b5b3 — ship(P03): task exec merged into milestone
• 857f756 — docs(P03): verification - 4 layers pass
• f9a9873 — feat(P03): task execution engine with HCL specs, jobs, tasks, WaitDelay
• 78334f1 — ship(P02): node mgmt merged into milestone
• c7dbcef — docs(P02): verification - 4 layers pass
• 9580f34 — feat(P02): node management with SQLite-backed registry
• 46e929e — chore(P01): source .env in trigger_coreci.sh for GITEA_TOKEN
• 503923b — ship(P01): cli skeleton merged into milestone
• e3f6e1d — docs(P01): verification - 4 layers pass
• aa3ccce — feat(P01): CLI skeleton with Cobra, subcommand stubs, pre-push hook
• c203895 — docs(P00): create 6 phase plans with wave ordering
• 65eb2e6 — docs(P00): research findings - architecture + personas
• 6f34f17 — docs(P00): ideation - 30 ideas accepted (3 tiers)
• bc7ce1c — docs(P00): clarify ambiguities (full autonomy, 10 decisions)
• 55aae53 — chore(P00): rename orch-engine to orca, configure gitea + coreci (v0.1)
• 0cba1aa — chore(P00): set autonomy level to full
• e2e77e7 — chore(P00): quick task - populate config.json with backlog reference
• 8c086de — chore(config): populate ciagent config with standard settings
• 8774008 — docs(init): validate specification

Generated by make changelog. Do not edit by hand.