docs(P00): ideation - 34 ideas accepted

v0.2 IDEATE stage. 29 new ideas generated (10 Tier 1 mechanical + 11
Tier 2 backend-enriched + 8 Tier 3 cross-project) plus 6 research-stage
candidates (REQ-cand-A..F from commit 08d321f) = 35 considered. Under
full autonomy, all 35 with confidence >= 0.60 are auto-accepted; 1
explicitly deferred to v0.3 (I-308 pprof). 34 accepted into v0.2.

Resulting net-new REQs (REQ-025..REQ-040) span P01-P04:
- P01 (mTLS): REQ-025 (cert rotation history), REQ-026 (CA fingerprint
  pinning), REQ-032 (orca doctor), REQ-033 (file mode enforcement),
  REQ-034 (rotation alarm), REQ-035 (cert show redaction), REQ-036
  (SAN validation), REQ-038 (mTLS failure log fields)
- P02 (multi-node): REQ-028 (NodeCapacity HCL schema, P02 enabler),
  REQ-037 (X-Orca-Idempotency-Key)
- P03 (security CI): REQ-027 (govulncheck offline mode -- changes P03
  scope: CI must not call vuln.go.dev), REQ-029 (gitleaks baseline for
  pre-existing .env leak), REQ-039 (.gitleaks.toml stopwords),
  REQ-040 (.golangci.yml)
- P04 (iter.Seq): REQ-030 (--watch --json mode)
- Cross-cutting: REQ-031 (go test -race)

Total v0.2 REQs: 20 (4 carried from v0.1 + 16 net-new).

ARCHITECTURE.md: added `internal/doctor/` component (§5) with
orca doctor {cert,network,db} subcommands; ASCII diagram updated.
ROADMAP.md: per-phase REQ coverage matrix added; P03 scope change
documented (govulncheck offline mode).
PROJECT.md: unchanged (vision is stable).

---ci---
project: orca
phase: 0
milestone: v0.2
status: ideate
---/ci---

.ciagent/ARCHITECTURE.md

@@ -20,6 +20,10 @@ and a **dispatcher** for multi-node job execution.
 │  │   └── orca node list --watch         # NEW iter.Seq (P04)                │
 │  ├── orca job {run,list,stop,logs}                                         │
 │  │   └── orca job list --watch          # NEW iter.Seq (P04)                │
+│  ├── orca doctor                       # NEW (P01) — diagnostics            │
+│  │   ├── orca doctor cert                                                   │
+│  │   ├── orca doctor network                                                │
+│  │   └── orca doctor db                                                     │
 │  └── orca daemon                                                           │
 ├─────────────────────────────────────────────────────────────────────────────┤
 │  Daemon Layer (net/http over h2c, mTLS in P01)                              │
@@ -67,6 +71,7 @@ and a **dispatcher** for multi-node job execution.
 - **v0.1 subcommands**: `version`, `init`, `status`, `node`, `job`, `daemon`
 - **v0.2 additions (P01)**: `orca cert {init,join,renew,show}`
 - **v0.2 additions (P04)**: `--watch` flag on `orca job list` and `orca node list`
+- **v0.2 additions (P01)**: `orca doctor` subcommand (see §5 below)
 - **Output**: Human-readable by default; `--json` flag for machine consumption
 - **Discovery**: All subcommands self-document via Cobra's auto-generated help
 - **Watch semantics (P04)**: `--watch` consumes `iter.Seq[Job|Node]`, exits on
@@ -135,7 +140,27 @@ and a **dispatcher** for multi-node job execution.
     hot-swap (no restart required)
 - **Audit Logger**: `slog.NewJSONHandler(os.Stderr, ...)` with structured fields
 
-### 5. State Store (`internal/store`)
+### 5. Doctor (`internal/doctor`, NEW in P01)
+
+- **Purpose**: operator-facing diagnostics; runs read-only checks against
+  the local state and reports PASS/WARN/FAIL.
+- **Subcommands**:
+  - `orca doctor` — runs all checks
+  - `orca doctor cert` — cert/CA health (file modes, expiry windows, SAN
+    presence, fingerprint pinning match — see REQ-026, REQ-033,
+    REQ-034, REQ-036)
+  - `orca doctor network` — peer reachability over mTLS (per-peer handshake
+    sanity, last-seen delta)
+  - `orca doctor db` — SQLite integrity check (`PRAGMA integrity_check`)
+    + migration version
+- **Output**: human-readable by default; `--json` for machine consumption
+- **No state changes**: doctor is strictly read-only. It can be run
+  while the daemon is down (where possible) or while it's up.
+- **Initial implementation in P01** (cert checks only); `network` and
+  `db` checks land in subsequent phases as their state becomes
+  available.
+
+### 6. State Store (`internal/store`)
 
 - **Driver**: `modernc.org/sqlite` (pure Go, CGO-free)
 - **Location**: `~/.orca/orca.db` (user-mode) or `/var/lib/orca/orca.db` (system-mode)