docs(P00): specify v0.9 re-architecture milestone — PRD adopted, REQ-061..090, supersession table

Adopts the v0.9/v1.0 PRD (.ciagent/PRD_v0.9.md) that supersedes the shipped
v0.1-v0.8 architecture. The re-architecture is justified by a six-part
evidence basis recorded in the PROJECT.md Supersession Table:
operational daemon failure, external step-ca mandate, multi-tenancy
requirement, WASM workload requirement, SSH-push deployment target,
and vision correction.

Appends 30 net-new requirements (REQ-061..REQ-090) to REQUIREMENTS.md,
the v0.9 (13 phases) + v1.0 (19 phases) reordered plan to ROADMAP.md,
the AD-series supersession table to PROJECT.md + ARCHITECTURE.md, and
reactivates security-engineer + network-engineer + devops-engineer
personas (implements grill C-05).

---ci---
project: orca
phase: 0
milestone: v0.9
status: specify
---/ci---

.ciagent/ROADMAP.md

@@ -184,3 +184,153 @@ tag.
 The vision ("minimalist, offline-first, CLI-first orchestration
 engine") is unchanged. v0.8 closes the coverage debt left by v0.7's
 50% floor and the trust-surface gaps explicitly deferred in v0.6.
+
+## Milestone v0.9: Re-architecture Foundation & Workloads
+
+**Scope**: This milestone SUPERSPEDES the shipped v0.1–v0.8 architecture per
+the adopted PRD (`.ciagent/PRD_v0.9.md`). The re-architecture is justified on
+six grounds recorded in the PROJECT.md Supersession Table: (1) the v0.8 daemon
+model is operationally failing, (2) step-ca is externally mandated, (3)
+multi-tenancy is a hard product requirement, (4) WASM is a hard workload
+requirement, (5) SSH-push is the only viable deployment target, (6) vision
+correction. The 16 load-bearing rules (R-001…R-016) are invariants. The
+ci-griller reviewed the re-architecture adversarially; the user overrode the
+Re-architecture Justification REPLAN with the six-part evidence basis; the
+19 binding conditions (C-01..C-19) and 10 phase challenges (PC-01..PC-10)
+from `GRILL_v0.9.md` are adopted as execution gates. 30 net-new requirements
+(REQ-061..REQ-090) derive from `IDEATION_v0.9.md`.
+
+**Milestone type**: feature (P01..P10 ship `feat` phases; P00/P0X are
+chore/docs).
+
+- [ ] Phase 0: Pre-execution (specify → clarify → research → ideate → plan → grill) — tag `v0.8.0` (shipped; this is the phase you are reading)
+- [ ] Phase P00: Deprecation sweep + migration-ordering decision + txn-design spike + hermetic test-infra bootstrap + persona reactivation + doc banners (REQ-072, REQ-085, REQ-088, REQ-089, REQ-090; gates C-03 ✅, C-05, C-06, C-15..C-18) — tag `v0.8.1`
+- [ ] Phase P0a1: Multi-namespace path resolver + config HCL demotion + known_hosts flock (REQ-063, REQ-069, REQ-070, REQ-071; gate C-07) — tag `v0.8.2`
+- [ ] Phase P0a2: Namespace CRUD + inheritance engine (REQ-082) — tag `v0.8.3`
+- [ ] Phase P0b: Markdown jobspec parser + dispatcher + fuzz (REQ-064, REQ-067) — tag `v0.8.4`
+- [ ] Phase P0c: Job/Service/DaemonSet schemas + emitter interface (REQ-074) — tag `v0.8.5`
+- [ ] Phase P01: SSH-push transport + host-path volumes (REQ-073) — tag `v0.8.6`
+- [ ] Phase P02: Service block + checks + restart + Traefik emitter (REQ-077; gate C-10) — tag `v0.8.7`
+- [ ] Phase P03: Update stanza (rolling/canary) — tag `v0.8.8`
+- [ ] Phase P04: Lifecycle hooks (systemd ExecStop) — tag `v0.8.9`
+- [ ] Phase P05: Constraints & affinity (CEL) + CLI-side scheduler (REQ-083) — tag `v0.8.10`
+- [ ] Phase P06: Task groups (multi-process services) — tag `v0.8.11`
+- [ ] Phase P07a: Process + podman runtimes (REQ-078) — tag `v0.8.12`
+- [ ] Phase P07b: wasmtime runtime (REQ-078; **gate C-01** — CGO eval) — tag `v0.8.13`
+- [ ] Phase P07c: pve-vm + pve-ct runtimes (REQ-078; extends REQ-076) — tag `v0.8.14`
+- [ ] Phase P08: Socket plumbing (R-007) — tag `v0.8.15`
+- [ ] Phase P09: Storage replication via Syncthing (REQ-081; **gates C-02, C-14**) — tag `v0.8.16`
+- [ ] Phase P10: Lead rules + migration (REQ-076 step-ca integration) — tag `v0.8.17`
+- [ ] Phase P0X: Ship + audit (REQ-062 coverage gate; REQ-068 deprecation warnings) — tag `v0.8.18`
+
+**Milestone tag**: `v0.8.18` (final phase patch = milestone release per
+feature-milestone progressive-patch rule). Per-phase tags: `v0.8.1`…`v0.8.18`.
+Tags run on the previous minor's patch line (v0.8.x) per branch-strategy.md.
+The milestone branch label uses the milestone number
+(`milestone/v0.9-rearchitecture`); no separate minor tag.
+
+### Per-phase REQ coverage (v0.9)
+
+- **P00** — Deprecation/migration/test-infra/persona/docs foundation (REQ-072, REQ-085, REQ-088, REQ-089, REQ-090)
+- **P0a1** — Path resolver + config demotion + known_hosts flock (REQ-063, REQ-069, REQ-070, REQ-071)
+- **P0a2** — Namespace inheritance resolver (REQ-082)
+- **P0b** — Markdown parser + adapter + fuzz (REQ-064, REQ-067)
+- **P0c** — Schemas + emitter interface (REQ-074)
+- **P01** — SSH-push transport (REQ-073)
+- **P02** — Service + Traefik emitter (REQ-077)
+- **P05** — CLI-side scheduler (REQ-083)
+- **P07a/b/c** — Runtime abstraction (REQ-078) + step-ca integration (REQ-076)
+- **P09** — Syncthing replication (REQ-081)
+- **P0X** — Coverage gate (REQ-062) + deprecation warnings (REQ-068)
+
+### v0.9 is a DIRECTION CHANGE — first in the project's history
+
+Every prior milestone (v0.1–v0.8) explicitly said "the vision is unchanged;
+this milestone is not a direction change." v0.9 is the first milestone that
+reverses the vision's anti-patterns (daemon-on-every-node, internal CA,
+HCL-canonical, single-namespace, no-container-runtime, no-SPIFFE). The
+reversals are justified by the six-part evidence basis recorded in the
+PROJECT.md Supersession Table.
+
+## Milestone v1.0: Production Hardening
+
+**Scope**: ship a cluster that operators can run. Builds on the v0.9
+re-architecture foundation with the production-grade subsystems:
+secrets, transactions, ACL/SPIFFE, backup/restore, drain, recovery, and
+the v0.8→v1.0 migration.
+
+**Milestone type**: feature (multiple `feat` phases).
+
+- [ ] Phase 0: Pre-execution (specify → clarify → research → plan → grill) — tag `v0.9.0`
+- [ ] Phase P00: CLI cache layer (REQ-062 cache floor; R-008) — tag `v0.9.1`
+- [ ] Phase P01: Metrics endpoint (hand-rolled text exposition) — tag `v0.9.2`
+- [ ] Phase P01.5: SPIFFE SVID minting spike (REQ-076; **gate C-08** — if spike fails, fall back to mTLS identity) — tag `v0.9.3`
+- [ ] Phase P02: ACL (SPIFFE + token identities) — tag `v0.9.4`
+- [ ] Phase P03: Secrets subsystem (REQ-080; **gate C-19** threat model) — tag `v0.9.5`
+- [ ] Phase P04: Backup/restore (tar + signed) — tag `v0.9.6`
+- [ ] Phase P05: Drain + daemon drain-and-stop (REQ-061) — tag `v0.9.7`
+- [ ] Phase P06: Alloc history (CLI-side SQLite retention; REQ-071 cache DB) — tag `v0.9.8`
+- [ ] Phase P07: Recovery (`orca restore`) — tag `v0.9.9`
+- [ ] Phase P08: Integration tests — expand hermetic harness (REQ-087) — tag `v0.9.10`
+- [ ] Phase P09: Collector + aggregator (opt-in; **gates C-11, C-12, C-14**) — tag `v0.9.11`
+- [ ] Phase P10: Transactional plane (REQ-075, REQ-079; **gate C-09** orca-pull.sh failure contract) — tag `v0.9.12`
+- [ ] Phase P11: `orca job lint` (REQ-084) — tag `v0.9.13`
+- [ ] Phase P12: `orca job verify` (dry-run txn through lead) — tag `v0.9.14`
+- [ ] Phase P13: `orca ns` subcommands (full surface) + deprecation warnings (REQ-068) — tag `v0.9.15`
+- [ ] Phase P14a: v0.8→v1.0 data migration (REQ-066; **gate C-07** CA migration spec) — tag `v0.9.16`
+- [ ] Phase P14b: Daemon cutover + running-allocation adoption — tag `v0.9.17`
+- [ ] Phase P14c: Mixed-version tolerance + no-orca-on-server enforcement (REQ-065, REQ-086; implements C-13) — tag `v0.9.18`
+- [ ] Phase P15: README quickstart (REQ-089) — tag `v0.9.19`
+- [ ] Phase P15.5: Threat model + security review (**gate C-19**) — tag `v0.9.20`
+- [ ] Phase P16: Final review + ship + audit — **v1.0.0 release** — tag `v0.9.21`
+
+**Milestone tag**: `v1.0.0` (the v1.0.0 release tag is the production-ready cut;
+per-phase patches run on the v0.9.x line per branch-strategy.md). Per-phase
+tags: `v0.9.0`…`v0.9.21`.
+
+### Per-phase REQ coverage (v1.0)
+
+- **P00** — CLI cache (R-008)
+- **P01.5** — SPIFFE spike (REQ-076; C-08)
+- **P03** — Secrets (REQ-080; C-19)
+- **P05** — Drain + daemon stop (REQ-061)
+- **P06** — Alloc history (REQ-071 cache DB)
+- **P08** — Integration tests (REQ-087)
+- **P10** — Transactional plane (REQ-075, REQ-079; C-09)
+- **P11** — Job lint (REQ-084)
+- **P13** — ns subcommands + deprecation warnings (REQ-068)
+- **P14a/b/c** — Migration (REQ-066, REQ-065, REQ-086; C-07, C-13)
+- **P15** — README (REQ-089)
+- **P15.5** — Threat model (C-19)
+
+### Risk register (from grill, for ongoing monitoring)
+
+- **step-ca single-instance SPOF** (mitigation: C-12 doc; v1.x HA via systemd failover)
+- **master.key passphrase-less 0600** (mitigation: C-19 threat model; consider OS keyring in v1.x)
+- **wasmtime CGO breaks cross-compile** (mitigation: C-01 spike; fallback to podman/process primary)
+- **bash control plane drift** (mitigation: C-15..C-18 render-format contract + bats gate)
+- **daemon cutover orphans running allocs** (mitigation: P14b split; test adoption)
+- **27→35+ phase scope** (mitigation: C-04 sizing; three-milestone split if exceeded — current count v0.9=18 + v1.0=22 = 40 phases; **C-04 sizing must run before v0.9 P00 execution to determine whether to split into v0.9+v0.10+v1.0**)
+
+## Deferred to v1.x (out of scope for v1.0)
+
+- `sqlite-wal-shared` state backend (R-009 abstractions ship in v1.0; backend in v1.x)
+- `git` state backend
+- `file+flock` state backend
+- `orca cluster setup-shared` UX
+- HA `step-ca` (active/passive via systemd)
+- Journald log shipping (optional centralized audit)
+- Network policy (`nftables` snippets)
+- GPU / TPU constraints
+
+## Deferred to v2.x (out of scope for v1.x)
+
+- Full Nomad-HCL parser with no conversion round-trip
+- Nomad-API subset for migrating existing Nomad fleets
+- Nomad driver bridge
+- Helm-equivalent templating (probably never)
+- Service mesh beyond Traefik
+- CRDs / Operators / Plugin model
+- Leader-elected Raft coordinator
+- External CA / Let's Encrypt / cert transparency
+- Online-only features (HSTS, OCSP stapling, telemetry)