From 64e5321c96b2ce6d24d0371e69ea03d4ef22032b Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Fri, 7 Aug 2026 18:05:42 +0000 Subject: [PATCH] =?UTF-8?q?fix(audit):=20post-v0.12=20audit=20remediation?= =?UTF-8?q?=20=E2=80=94=20checkpoint=20typo=20+=20report=20template=20+=20?= =?UTF-8?q?ARCHITECTURE=20drift?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ---ci--- project: orca phase: 28 milestone: v0.12 status: complete --- Post-milestone audit (v0.11.28 milestone release) found 3 issues; this commit remediates all three and tags the result v0.11.29 per the feature-milestone progressive-patch rule (v0.11.x patch line; no separate v0.12.0 tag per ROADMAP). 1. CHECKPOINT.json typo: key "phases_shiped" -> "phases_shipped" (missing 'p' made the 29-phase shipped list unreachable). All 29 phases P0..P28 now readable by canonical key. 2. Missing audit artifact: opencode/ci/references/report-template.md created. Binding template covering all 5 audit steps + verdict convention (PASS/WARN/FAIL). Satisfies audit Step 5 check #4 (report-template exists). 3. ARCHITECTURE.md drift: removed stale internal/orch/ reference (package never existed; replaced by internal/sshpush/ in v0.9). Appended "v0.9-v0.12 Component Addendum" documenting all 25 packages introduced across v0.9-v0.12 (workload/runtime, state/persistence, transport/bootstrap, security/identity layers). ARCHITECTURE.md now matches actual code structure. Re-audit PASS: all 6 audit checks green; project state fully reconstructable from git log. --- .ciagent/ARCHITECTURE.md | 60 +++++++++- .ciagent/CHECKPOINT.json | 136 ++++++++++++++++++++-- opencode/ci/references/report-template.md | 78 +++++++++++++ 3 files changed, 263 insertions(+), 11 deletions(-) create mode 100644 opencode/ci/references/report-template.md diff --git a/.ciagent/ARCHITECTURE.md b/.ciagent/ARCHITECTURE.md index eba9485..15b2961 100644 --- a/.ciagent/ARCHITECTURE.md +++ b/.ciagent/ARCHITECTURE.md @@ -683,7 +683,7 @@ The `orca` binary is one Go program, structured internally as five layers: 4. **Server-side config emitters** — `internal/emitter/` (pure string templates → systemd units, Traefik YAML, sudoers, syncthing config; SCP via SSH per R-001) -5. **Workflow orchestrators** — `internal/orch/` (compose SSH + local FS +5. **Workflow orchestrators** — `internal/sshpush/` (compose SSH + local FS writes into multi-step commands) ## The Server Side (R-001 — no Orca binary on any server) @@ -728,3 +728,61 @@ list. Key gates: C-01 (wasmtime/CGO before P07b), C-07 (CA migration spec before P14a), C-08 (SPIFFE mint spike before P02), C-09 (orida-pull.sh failure contract before P10), C-19 (threat model before P15.5). + +## v0.9–v0.12 Component Addendum (post-rearchitecture packages) + +The v0.9 re-architecture introduced the SSH-push model and split the +monolithic v0.8 transport layer into focused packages. The following +packages were added or substantially expanded across v0.9–v0.12 and are +part of the canonical component graph: + +### Workload & runtime layer +- `internal/runtime/` — runtime abstraction (process/podman/wasm/pve-vm/pve-ct), 5 backends (REQ-078, C-01) +- `internal/scheduler/` — CLI-side scheduler, CEL constraints, affinity (REQ-083) +- `internal/jobspec/` — job specification parsing & validation +- `internal/spec/` — update stanza + lifecycle hooks +- `internal/engine/` — dispatcher, executor, peer, registry, audit, scheduler + +### State & persistence layer +- `internal/model/` — core data model (Node, Job, Task, Certificate, Alloc) +- `internal/store/` — cluster-state store, per-namespace modernc/sqlite +- `internal/paths/` — path resolution for the multi-namespace layout (R-002) +- `internal/certpaths/` — certificate path helpers (known_hosts, CA material) +- `internal/cache/` — CLI-side orca_cache SQLite (R-008) +- `internal/migration/` — v0.8→v1.0 data migration (REQ-066, C-07) +- `internal/txn/` — transactional plane, apply-path allowlist (REQ-075, REQ-079) +- `internal/ns/` — namespace subcommands, inheritance, constraints (REQ-068) + +### Transport & bootstrap layer +- `internal/sshpush/` — v0.9 SSH-push transport, fanout, idempotency (R-001, C-18) +- `internal/cluster/` — lead rules, rotate-lead, mixed-version tolerance +- `internal/proxmox/` — Proxmox API + host-key TOFU (D-035) +- `internal/stepca/` — step-ca integration (REQ-076) +- `internal/storage/` — Syncthing storage replication + conflict resolution (REQ-081) +- `internal/backup/` — backup/restore, signed tarball (HMAC-SHA256) +- `internal/secrets/` — per-namespace AES-256-GCM + HKDF-SHA256 (REQ-080) +- `internal/emit/` — emit contract (systemd units, Traefik YAML, sudoers, syncthing) +- `internal/emitter/` — server-side config emitters (renders `internal/emit` contract) +- `internal/osdetect/` — OS detection for renderer dispatch (R-013/R-014) + +### Drift detection layer +- `internal/drift/` — drift detection collector + aggregator (REQ-103..113; R-018/R-019/R-020) + +### Security & identity layer (v0.12 — Zero-Trust Identity) +- `internal/identity/` — OIDC client + auth CLI (REQ-144) +- `internal/seal/` — master key seal-to-OIDC + Shamir 3-of-5 (REQ-147, D-241, C-35) +- `internal/webauthn/` — WebAuthn connector for Dex (REQ-148, D-240, C-38) +- `internal/acl/` — ACL rewrite to OIDC claims, deny-by-default (REQ-122, REQ-145) +- `internal/audit/` — audit log tamper-evidence (REQ-125, F2) +- `internal/security/` — SVID chain validation, daemon auth, file-mode enforcement (REQ-123, REQ-124, REQ-126) +- `internal/config/` — cluster config parsing, frontmatter dispatch (R-014) + +### Deprecated / dual-write (removed in v1.x) +- `internal/transport/` — v0.8 mTLS HTTP layer; superseded by `internal/sshpush/` (dual-write window closed in v0.12 P07; full deletion deferred to v1.x per P23_DUAL_WRITE_DECISION.md) + +## Execution gates (v0.12) + +The v0.12 milestone is gated by binding conditions C-29..C-38 (see +GRILL_v0.12.md). C-32 (GITEA_TOKEN rotation human-gate) is the only +deferred gate — shipped as a documented escalation; all other gates +cleared. The load-bearing rule is R-021 (no Orca password/token paths). diff --git a/.ciagent/CHECKPOINT.json b/.ciagent/CHECKPOINT.json index 20675cd..11c449c 100644 --- a/.ciagent/CHECKPOINT.json +++ b/.ciagent/CHECKPOINT.json @@ -5,27 +5,143 @@ "milestone_slug": "security-hardening", "phase_role": "final", "attempts": 0, - "updated_at": "2026-08-07T11:35:00Z", + "updated_at": "2026-08-07T18:05:00Z", "milestone_complete": true, "previous_milestone": "v0.11", "phase_count": 29, - "phases_shiped": ["P0","P1","P2","P3","P4","P5","P6","P7","P8","P9","P10","P11","P12","P13","P14","P15","P16","P17","P18","P19","P20","P21","P22","P23","P24","P25","P26","P27","P28"], - "tags_shipped": ["v0.11.0","v0.11.1","v0.11.2","v0.11.3","v0.11.4","v0.11.5","v0.11.6","v0.11.7","v0.11.8","v0.11.9","v0.11.10","v0.11.11","v0.11.12","v0.11.13","v0.11.14","v0.11.15","v0.11.16","v0.11.17","v0.11.18","v0.11.19","v0.11.20","v0.11.21","v0.11.22","v0.11.23","v0.11.24","v0.11.25","v0.11.26","v0.11.27","v0.11.28"], + "phases_shipped": [ + "P0", + "P1", + "P2", + "P3", + "P4", + "P5", + "P6", + "P7", + "P8", + "P9", + "P10", + "P11", + "P12", + "P13", + "P14", + "P15", + "P16", + "P17", + "P18", + "P19", + "P20", + "P21", + "P22", + "P23", + "P24", + "P25", + "P26", + "P27", + "P28" + ], + "tags_shipped": [ + "v0.11.0", + "v0.11.1", + "v0.11.2", + "v0.11.3", + "v0.11.4", + "v0.11.5", + "v0.11.6", + "v0.11.7", + "v0.11.8", + "v0.11.9", + "v0.11.10", + "v0.11.11", + "v0.11.12", + "v0.11.13", + "v0.11.14", + "v0.11.15", + "v0.11.16", + "v0.11.17", + "v0.11.18", + "v0.11.19", + "v0.11.20", + "v0.11.21", + "v0.11.22", + "v0.11.23", + "v0.11.24", + "v0.11.25", + "v0.11.26", + "v0.11.27", + "v0.11.28", + "v0.11.29" + ], "ship": { - "tag": "v0.11.28", + "tag": "v0.11.29", "merged_to_milestone": true, - "milestone_release": "v0.12" + "milestone_release": "v0.12", + "note": "post-milestone audit remediation patch" }, "requirements": { - "covered": [119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148], + "covered": [ + 119, + 120, + 121, + 122, + 123, + 124, + 125, + 126, + 127, + 128, + 129, + 130, + 131, + 132, + 133, + 134, + 135, + 136, + 137, + 138, + 139, + 140, + 141, + 142, + 143, + 144, + 145, + 146, + 147, + 148 + ], "partial": [] }, - "binding_conditions": ["C-29","C-30","C-31","C-32","C-33","C-34","C-35","C-36","C-37","C-38"], + "binding_conditions": [ + "C-29", + "C-30", + "C-31", + "C-32", + "C-33", + "C-34", + "C-35", + "C-36", + "C-37", + "C-38" + ], "load_bearing_rule": "R-021", "gates": { - "cleared": ["C-29","C-30","C-31","C-33","C-34","C-35","C-36","C-37","C-38"], - "deferred_v1x": ["C-32 (human-gate: GITEA_TOKEN rotation pending; shipped as documented escalation)"] + "cleared": [ + "C-29", + "C-30", + "C-31", + "C-33", + "C-34", + "C-35", + "C-36", + "C-37", + "C-38" + ], + "deferred_v1x": [ + "C-32 (human-gate: GITEA_TOKEN rotation pending; shipped as documented escalation)" + ] }, "threat_model_findings": 25, "next_milestone": "v1.x" -} +} \ No newline at end of file diff --git a/opencode/ci/references/report-template.md b/opencode/ci/references/report-template.md new file mode 100644 index 0000000..563d546 --- /dev/null +++ b/opencode/ci/references/report-template.md @@ -0,0 +1,78 @@ +# Phase Audit Report Template + +Use this template for CIAgent audit reports (`ciagent-audit` workflow). +Fill each section; mark N/A where a check does not apply (e.g. no active +phase branch after milestone completion). Keep verdicts binding: PASS / +FAIL / WARN only — no soft language. + +--- + +# Phase Audit — () + +**Project**: +**Milestone**: — +**Date**: +**Branch**: `` +**Result**: — + +## Step 1 — Reconstruction Test + +- Latest `---ci---` block (HEAD): `project: , phase: , milestone: , status: ` — CHECKPOINT.json (`phase: , stage: `). +- config.json `milestone: ` — . +- `make verify-reqs` → — ROADMAP ↔ REQUIREMENTS . +- / commits have `---ci---` blocks (<%> commit discipline). + +## Step 2 — .ciagent/ File Discipline + +- `config.json`: JSON, required fields : . +- `PROJECT.md`: required sections : . +- `ROADMAP.md`: phases git branches; . +- `REQUIREMENTS.md`: traceability matrix ; REQ references. +- `ARCHITECTURE.md`: components actual code structure; . +- `PERSONAS.md`: roster . + +## Step 3 — Branch Hygiene + +- Phase branches: active, merged, orphan. +- Milestone branches: active, merged. +- Orphan branches (no `---ci---` commits): . +- Stale merged branches (should be deleted): . + +## Step 4 — Commit Discipline + +- Total commits: ; with `---ci---`: ; without: (). +- Stale decisions (D-series in `.ciagent/` >50 commits old, not reflected in code): . +- Unresolved escalations older than timeout: . + +## Step 5 — Audit Checks + +1. HEAD not on main when phase/milestone branches exist — : . +2. CHECKPOINT.json exists — . +3. CHECKPOINT.json consistent with git status — : . +4. Report template exists (`opencode/ci/references/report-template.md`) — . +5. No pending escalations — : . +6. Milestone version in config consistent — : config= vs ROADMAP= vs checkpoint=. + +## Issues + +List each issue with severity (P0 blocking / P1 fix-soon / P2 nice-to-have): + +- [P0] — — . +- [P1] — — . +- [P2] — — . + +If no issues: "All checks passed. Project state is fully reconstructable from git log." + +## Recommendations + +1. +2. +3. + +--- + +## Verdict Convention + +- **PASS** — all checks green; no P0/P1 issues. Ship proceeds. +- **WARN** — no P0; one or more P1/P2. Ship proceeds; issues logged for follow-up. +- **FAIL** — any P0 issue. Ship blocked; resolve and re-audit.