coreci/orca
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 91 Wiki Activity

chore(P13): final review + audit — v0.13 milestone complete

Browse Source 
All 15 v0.13 requirements (REQ-149..REQ-163) marked complete.
All 14 phases shipped (P0..P13, tags v0.12.0..v0.12.12).
163 requirements consistent with roadmap (verify-reqs passes).
ROADMAP.md marks v0.13 COMPLETE.
All Go tests pass. Build clean.

Milestone deliverables:
- R-022: orca job run deploys to remote nodes via scheduler+emitter+SSH-push
- R-023: zero-trust enforcement wired (acl.Check on every request path)
- 11 injection vectors fixed
- Go toolchain bumped to 1.25.12 (24 stdlib vulns closed)
- Audit chain race fixed (BEGIN IMMEDIATE)
- Concurrency safety (SQLite busy_timeout, flock, cache invalidation)
- Transport safety (typed errors, IPv6, SSH timeouts, signal handler)
- Migration safety (job stop real systemctl, backup+atomic-rename)
- Observability (7 new metrics, security headers)
- Doc drift fixed (README, cli.md, CHANGELOG, verify-reqs regex)
- --type linux SSH-join for Ubuntu workers
- docs/uat.md (3-host topology, 35-claim matrix)
- scripts/uat-signoff.sh (35 assertions, idempotent, v1.0 gate)
- scripts/uat-smoke.sh (13 CI assertions)

v1.0.0 production-ready tag stays deferred for UAT signoff.
Operator runs scripts/uat-signoff.sh, pastes output, CI agent cuts v1.0.0.

---ci---
project: orca
phase: 13
milestone: v0.13
status: complete
requirements:
  covered: [149,150,151,152,153,154,155,156,157,158,159,160,161,162,163]
---/ci---
This commit is contained in:
Jon Chery
2026-08-10 14:37:33 +00:00
parent 52e17aefbf
commit c0ba30824e
4 changed files with 44 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ciagent/ROADMAP.md
+15 -15
View File
@@ -549,7 +549,7 @@ The v1.0.0 production-ready tag stays deferred for post-v0.12 UAT
- External CA / Let's Encrypt / cert transparency
- Online-only features (HSTS, OCSP stapling, telemetry)
## Milestone v0.13: Production Hardening Round 2 + UAT Plan — IN PROGRESS
## Milestone v0.13: Production Hardening Round 2 + UAT Plan — **COMPLETE**
**Scope**: final production hardening round before the v1.0.0
production-ready tag. Three deep codebase sweeps (security, reliability,
@@ -579,20 +579,20 @@ signoff script that gates the v1.0.0 cut.
### Phases (14 total: P0 + P01..P12 + P13 final)
- [ ] Phase P0: Pre-execution (SPECIFY→CLARIFY→RESEARCH→IDEATE→PLAN→GRILL) — tag `v0.12.0`
- [ ] Phase P01: Toolchain & dependency vulns (REQ-149) — tag `v0.12.1`
- [ ] Phase P02: Input validation & injection hardening (REQ-150) — tag `v0.12.2`
- [ ] Phase P03: Scheduler/deployment wiring + jobspec parser (REQ-151, REQ-152) — tag `v0.12.3`
- [ ] Phase P04: ACL enforcement + WebAuthn registration auth (REQ-153) — tag `v0.12.4`
- [ ] Phase P05: Seal/audit CLI + chain race + key zeroing (REQ-154) — tag `v0.12.5`
- [ ] Phase P06: auth init-idp real + auth register (REQ-155) — tag `v0.12.6`
- [ ] Phase P07: Concurrency safety (REQ-156) — tag `v0.12.7`
- [ ] Phase P08: Transport & SSH safety (REQ-157) — tag `v0.12.8`
- [ ] Phase P09: Migration & operational safety (REQ-158) — tag `v0.12.9`
- [ ] Phase P10: Observability & metrics (REQ-159) — tag `v0.12.10`
- [ ] Phase P11: Doc drift round 2 (REQ-160) — tag `v0.12.11`
- [ ] Phase P12: `--type linux` + UAT plan + signoff script (REQ-161, REQ-162, REQ-163) — tag `v0.12.12`
- [ ] Phase P13: Final review + ship + audit (milestone release) — tag `v0.12.13` = **v0.13 milestone release**
- [x] Phase P0: Pre-execution (SPECIFY→CLARIFY→RESEARCH→IDEATE→PLAN→GRILL) — tag `v0.12.0`
- [x] Phase P01: Toolchain & dependency vulns (REQ-149) — tag `v0.12.1`
- [x] Phase P02: Input validation & injection hardening (REQ-150) — tag `v0.12.2`
- [x] Phase P03: Scheduler/deployment wiring + jobspec parser (REQ-151, REQ-152) — tag `v0.12.3`
- [x] Phase P04: ACL enforcement + WebAuthn registration auth (REQ-153) — tag `v0.12.4`
- [x] Phase P05: Seal/audit CLI + chain race + key zeroing (REQ-154) — tag `v0.12.5`
- [x] Phase P06: auth init-idp real + auth register (REQ-155) — tag `v0.12.6`
- [x] Phase P07: Concurrency safety (REQ-156) — tag `v0.12.7`
- [x] Phase P08: Transport & SSH safety (REQ-157) — tag `v0.12.8`
- [x] Phase P09: Migration & operational safety (REQ-158) — tag `v0.12.9`
- [x] Phase P10: Observability & metrics (REQ-159) — tag `v0.12.10`
- [x] Phase P11: Doc drift round 2 (REQ-160) — tag `v0.12.11`
- [x] Phase P12: `--type linux` + UAT plan + signoff script (REQ-161, REQ-162, REQ-163) — tag `v0.12.12`
- [x] Phase P13: Final review + ship + audit (milestone release) — tag `v0.12.13` = **v0.13 milestone release**
**Milestone tag**: `v0.12.13` (final phase patch = milestone release per
feature-milestone rule; no separate `v0.13.0` tag). Per-phase tags: