Jon Chery ed91d68fbf feat(P10): observability expansion — metrics + security headers (REQ-159) ...

New metrics:
- orca_jobs_running / orca_jobs_failed / orca_jobs_complete (gauges)
- orca_audit_chain_head (gauge, chain integrity)
- orca_drift_events_total, orca_ssh_errors_total (counters)
- orca_txn_apply_total, orca_txn_rollback_total (counters)
- orca_acl_denials_total (counter)

Security headers on metrics + healthz endpoints:
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY

New file: docs/metrics.md (Prometheus reference + scrape config)

---ci---
project: orca
phase: 10
milestone: v0.13
status: complete
requirements:
  covered: [159]
---/ci---

2026-08-10 13:44:04 +00:00

..

acl

fix(P06): ACL rewrite to OIDC claims (REQ-145, REQ-122, F1)

2026-08-07 11:03:42 +00:00

audit

test(P03): coverage uplift — engine/transport/proxmox/audit ≥50% + dispatch.go EOF fix (REQ-055)

2026-08-04 00:18:58 +00:00

backup

fix(P02): input validation + injection hardening — 11 vectors (REQ-150)

2026-08-07 19:28:01 +00:00

cache

fix(P09): migration + operational safety — job stop, retention, logs cap (REQ-158)

2026-08-10 13:37:28 +00:00

certpaths

feat(P0a1): multi-namespace path resolver + config demotion + known_hosts flock + CA migration spec (v0.9 P0a1)

2026-08-05 16:38:26 +00:00

cli

feat(P10): observability expansion — metrics + security headers (REQ-159)

2026-08-10 13:44:04 +00:00

cluster

feat(P10): lead rules + step-ca integration (REQ-076)

2026-08-05 18:48:46 +00:00

config

feat(P06): auth init-idp real + auth register + doctor oidc (REQ-155)

2026-08-10 11:55:01 +00:00

daemon

fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)

2026-08-07 20:33:39 +00:00

doctor

fix(P01): bump go toolchain to 1.25.12 + fix pre-existing test bugs (REQ-149)

2026-08-07 19:07:17 +00:00

drift

fix(P25): drift event authentication (REQ-140, F18)

2026-08-07 11:33:20 +00:00

emit

feat(P00): deprecation sweep + bash tooling gate + render contract + doc banners (v0.9 P00)

2026-08-05 16:26:26 +00:00

emitter

feat(P03): wire scheduler into job run + fix jobspec parser (REQ-151, REQ-152)

2026-08-07 19:59:31 +00:00

engine

fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)

2026-08-10 12:27:05 +00:00

identity

fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)

2026-08-10 13:11:07 +00:00

jobspec

feat(P03): wire scheduler into job run + fix jobspec parser (REQ-151, REQ-152)

2026-08-07 19:59:31 +00:00

migration

fix(P22): migration safety (REQ-137, F19, C-34)

2026-08-07 11:31:26 +00:00

model

feat(P05): drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)

2026-08-07 05:17:01 +00:00

ns

fix(P02): namespace path traversal (REQ-120, F4)

2026-08-07 10:55:18 +00:00

osdetect

feat(P03): doctor os + doctor proxmox + audit logging

2026-08-03 19:59:51 +00:00

paths

feat(P02): ACL — SPIFFE + token identities, deny-by-default

2026-08-07 04:38:00 +00:00

proxmox

fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)

2026-08-10 13:11:07 +00:00

runtime

fix(P02): input validation + injection hardening — 11 vectors (REQ-150)

2026-08-07 19:28:01 +00:00

scheduler

feat(P03): wire scheduler into job run + fix jobspec parser (REQ-151, REQ-152)

2026-08-07 19:59:31 +00:00

seal

feat(P05): seal/audit CLI + chain race fix + key zeroing (REQ-154)

2026-08-07 21:06:39 +00:00

secrets

feat(P05): seal/audit CLI + chain race fix + key zeroing (REQ-154)

2026-08-07 21:06:39 +00:00

security

fix(P24): known_hosts tightening + transport hardening (REQ-139, F15, F25)

2026-08-07 11:32:25 +00:00

spec/schema

feat(P06): task groups — multi-process services, multiple systemd units per alloc

2026-08-05 18:20:05 +00:00

sshpush

fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)

2026-08-10 13:11:07 +00:00

stepca

fix(P13): step-ca /tmp hardening (REQ-128, F10)

2026-08-07 11:22:07 +00:00

storage

feat(P09): Syncthing storage replication + conflict resolution (REQ-081; gates C-02, C-14)

2026-08-05 18:38:49 +00:00

store

fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)

2026-08-10 12:27:05 +00:00

transport

feat(P10): observability expansion — metrics + security headers (REQ-159)

2026-08-10 13:44:04 +00:00

txn

fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)

2026-08-07 20:33:39 +00:00

webauthn

fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)

2026-08-10 12:27:05 +00:00