verify(P03): 4-layer verification PASS — REQ-060

---ci---
project: orca
phase: 3
milestone: v0.8
status: verify
requirements:
  covered: [REQ-060]
  partial: []
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,11 +1,11 @@
 {
-  "phase": 2,
+  "phase": 3,
   "stage": "verify",
   "milestone": "v0.8",
   "milestone_slug": "coverage-trust-hardening",
   "phase_role": "execution",
   "attempts": 0,
-  "updated_at": "2026-08-04T01:10:00Z",
+  "updated_at": "2026-08-04T01:20:00Z",
   "milestone_complete": false,
   "next_milestone": null
 }

.ciagent/PHASE3_VERIFICATION_v0.8.md

@@ -0,0 +1,51 @@
+# Phase 3 Verification — v0.8 Coverage & Trust Hardening
+
+**Phase**: P03 — Requirements-hygiene gate
+**Milestone**: v0.8
+**REQ**: REQ-060
+**Date**: 2026-08-04
+**Result**: ✅ PASS (all 4 layers)
+
+## Layer 1 — Structural ✅
+
+- `go build ./...` PASS
+- `go vet ./...` PASS
+- `cmd/verify-reqs/main.go` (~180 LOC, stdlib only) compiles + links
+- All exports resolve: `verify(roadmapPath, reqsPath) (diff []string, count int, err error)`
+- No new dependencies
+
+## Layer 2 — Behavioral ✅
+
+- `go test ./cmd/verify-reqs/...` PASS (7 golden-file tests: clean, multi-drift, default-args, malformed, missing-file, v0.2-substring-tolerant, real-repo regression)
+- `make verify-reqs` → exit 0 on the current repo (`✓ 60 requirements consistent with roadmap`)
+- T03.5 synthetic drift verification: scratch flip of REQ-053 → `make verify-reqs` exit 1 + `REQ-053: status=Pending, expected=Complete (direction=forward)`; revert → exit 0
+- `go test ./...` PASS (all 16 packages)
+- Forward + reverse assertions both exercised (golden test `TestVerify_drift` asserts `direction=reverse` for REQ-003)
+
+## Layer 3 — Security ✅
+
+- verify-reqs is a static doc-consistency checker — no network, no secrets, no input injection (markdown is parsed with `regexp` over local files only)
+- `.coreci.yml` step runs in the existing `golang:1.25` container (no new image, no new permissions)
+- No STRIDE surface added
+
+## Layer 4 — Quality ✅
+
+- Testable core (`verify()` function) + thin `main()` — follows the `cmd/orca/main.go` → `run()` pattern from T01.11
+- Golden-file test fixtures cover the substring-tolerant regex regression (v0.2 header variant)
+- GRILL condition #4 satisfied: substring-tolerant regex + reverse-direction assertion + scope note (doc-vs-doc only)
+- P0 issues: none. P1+ issues: none flagged.
+
+## Requirement Coverage
+
+| REQ | Status | Evidence |
+|-----|--------|----------|
+| REQ-060 | ✅ Complete | `cmd/verify-reqs` (T03.1) + golden tests (T03.2) + `make verify-reqs` (T03.3) + `.coreci.yml` validate hook (T03.4) + synthetic drift verification (T03.5) |
+
+## GRILL Conditions Check
+
+- **#4 (verify-reqs regex + reverse direction)**: ✅ substring-tolerant regex matches v0.2's `**COMPLETE (merged to main via v0.3)**` header (golden test `TestVerify_v0_2_substring_tolerant`); reverse-direction assertion implemented + tested; scope note documented in the commit + the verification report.
+
+## Lessons
+
+- The two-regex parser (one for REQ rows, one for milestone-complete headers) with substring tolerance is the right shape — a single strict regex would have silently exempted v0.2 (the exact drift the GRILL flagged).
+- Refactoring `main()` into a testable `verify()` function made golden-file testing trivial (no subprocess orchestration). This mirrors the T01.11 `main()→run()` pattern and should be the house style for all `cmd/` programs.