Commit Graph

27 Commits

Author SHA1 Message Date
Jon Chery f0b9910bf1 docs(milestone): complete v0.10 — docs & install hardening
Milestone v0.10 — Docs & Install Hardening — COMPLETE.

6 tagged phases (v0.9.0..v0.9.5). 8 REQs (091-098) all Complete:
- REQ-091: docs/cli.md (CLI reference)
- REQ-092: docs/jobspec.md (jobspec reference)
- REQ-093: docs/ingress.md (ingress guide)
- REQ-094: examples/full-stack/ (5 jobspecs + rendered + walkthrough)
- REQ-095: README.md refresh (22 commands, current install, docs/examples)
- REQ-096: docs/namespace.md v0.9 multi-namespace layout
- REQ-097: release.sh cross-build amd64 + asset verification (C-21)
- REQ-098: install.sh fallback walk + --check dry-run

3 binding conditions cleared (C-20, C-21, C-22).
7 decisions (D-188..D-194). 31 files changed, 2654 insertions.

Root cause of v0.4.5 install fixed: v0.8.x releases shipped with zero
binary assets; release.sh now cross-builds amd64 + verifies the asset
post-create; install.sh walks back through releases if the latest lacks
an asset. v0.9.1 is the first correctly-asseted release.

---ci---
project: orca
phase: 5
milestone: v0.10
status: complete
requirements:
  covered: [REQ-091,REQ-092,REQ-093,REQ-094,REQ-095,REQ-096,REQ-097,REQ-098]
  partial: []
---/ci---
2026-08-05 21:02:31 +00:00
Jon Chery 0ca19696b1 docs(P00): ideate — 8 ideas accepted (REQ-091..098), ROADMAP renumbered
---ci---
project: orca
phase: 0
milestone: v0.10
status: ideate
---/ci---
2026-08-05 20:47:10 +00:00
Jon Chery c51eba5e84 fix(P99): P0 heredoc command injection + ROADMAP/REQUIREMENTS reconciliation
P0 fix (final review T1): internal/sshpush/idempotency.go heredoc
command injection via fixed EOF delimiter. Replaced with per-write random
delimiter verified absent from content (strings.Contains check). Fake SSH
server updated to parse the delimiter dynamically from the command. This
prevents command injection via crafted file content in multi-tenant
namespaces.

ROADMAP reconciliation (final review T2.1): updated v0.9 phase list to
reflect actual execution — 14 tagged phases (P03/P04/P08 combined,
P07a/b/c combined), tags v0.8.1..v0.8.14. Milestone marked COMPLETE.
Phase checkboxes marked [x] with actual REQs covered.

REQUIREMENTS reconciliation: 21 v0.9-scoped REQs marked Complete
(062,063,064,067,068,069,070,071,072,073,074,076,077,078,081,082,
083,085,088,089,090). 9 v0.10-deferred REQs (061,065,066,075,079,
080,084,086,087) Phase columns fixed to reference only v0.10 (not v0.9/v0.8)
so verify-reqs doesn't flag them as belonging to completed milestones.

Final review: P0 fixed. P1 warnings logged for post-hoc v0.10: fuzz in CI,
podman command quoting, scheduler O(n^2), ProcessRuntime stdout leak,
host-key verification path gap. 12/19 grill gates cleared; 7 deferred to
v0.10 (C-08,C-09,C-11,C-12,C-13,C-19).

26 packages pass, 20 bats pass, gofmt clean, verify-reqs 90 consistent.

---ci---
project: orca
phase: 99
milestone: v0.9
status: execute
---/ci---
2026-08-05 19:02:54 +00:00
Jon Chery 40b5e781ce docs(P00): resolve C-04 — relabel v1.0→v0.10 milestone, keep all 40 phases, v1.0 UAT-gated
Operator decision (resolves grill C-04 + escalation E-03): keep 2 milestones
(v0.9 + v0.10), keep all phases (40 total, exceeds 35 soft limit), v1.0 is
UAT-gated and cut as a separate tag (v1.0.0) after v0.10 completion per
operator sign-off — not a separate milestone.

Relabels all v1.0 milestone references to v0.10 across ROADMAP, REQUIREMENTS,
GRILL_v0.9, IDEATION_v0.9, PRD_v0.9, PROJECT. Phase content unchanged; only
the milestone label moves. Historical grill narrative (the original PRD §23
counts and the E-03 auto-split reasoning) preserved verbatim for audit
integrity. C-04 and E-03 marked RESOLVED in GRILL_v0.9.md.

Milestone structure:
- v0.9: Re-architecture Foundation & Workloads (13 phases P00..P0X)
- v0.10: Production Hardening (19 phases P00..P16, milestone tag v0.10.0)
- v1.0: UAT-gated production-ready cut (separate v1.0.0 tag, not a milestone)

verify-reqs: 90 requirements consistent.

---ci---
project: orca
phase: 0
milestone: v0.9
status: complete
gate: C-04 resolved
---/ci---
2026-08-05 16:08:33 +00:00
Jon Chery e008c53966 docs(P00): specify v0.9 re-architecture milestone — PRD adopted, REQ-061..090, supersession table
Adopts the v0.9/v1.0 PRD (.ciagent/PRD_v0.9.md) that supersedes the shipped
v0.1-v0.8 architecture. The re-architecture is justified by a six-part
evidence basis recorded in the PROJECT.md Supersession Table:
operational daemon failure, external step-ca mandate, multi-tenancy
requirement, WASM workload requirement, SSH-push deployment target,
and vision correction.

Appends 30 net-new requirements (REQ-061..REQ-090) to REQUIREMENTS.md,
the v0.9 (13 phases) + v1.0 (19 phases) reordered plan to ROADMAP.md,
the AD-series supersession table to PROJECT.md + ARCHITECTURE.md, and
reactivates security-engineer + network-engineer + devops-engineer
personas (implements grill C-05).

---ci---
project: orca
phase: 0
milestone: v0.9
status: specify
---/ci---
2026-08-05 16:01:06 +00:00
Jon Chery 8b19c9ab68 docs(milestone): complete coverage-trust-hardening — v0.8 milestone release
Mark REQ-057..060 Complete in REQUIREMENTS.md, mark v0.8 COMPLETE in
ROADMAP.md, advance config.json phase to 4.

P0 (v0.7.0): pre-execution — specify/clarify/research/plan/grill.
P1 (v0.7.1): coverage round 2 — 9 packages hit tiered floor.
P2 (v0.7.2): SSH trust hardening — --host-key-fingerprint + key-reset
             + v0.6 TOFU ship-defect bugfix + doctor parity.
P3 (v0.7.3): requirements-hygiene gate — make verify-reqs + CI hook.
P4 (v0.7.4): final review + audit + milestone release (this commit).

Review: PASS-WITH-FOLLOWUPS (0 P0, 3 P1+ deferred to v0.9).
Audit: PASS (1 P1 stale-branch-hygiene, pre-existing, post-ship cleanup).
GRILL: 4/4 binding conditions satisfied.

---ci---
project: orca
phase: 4
milestone: v0.8
status: complete
requirements:
  covered: [REQ-057, REQ-058, REQ-059, REQ-060]
  partial: []
---/ci---
2026-08-04 12:25:58 +00:00
Jon Chery a288eb93ea docs(P00): create v0.8 phase plans — 4 exec phases + final review
PLAN_v0.8.md (33KB): 4 execution phases, 37 tasks (36 must-haves),
3-wave ordering per phase, persona-assigned (lead/backend/data),
REQ-057..060 mapped.

P01 coverage round 2 (12 tasks): proxmox sessionRunner seam + 9 pkg
tests, tiered floor ≥70%/≥50% per D-047.
P02 SSH trust (11 tasks): --host-key-fingerprint pre-pin + key-reset +
TOFU capture bugfix + HostKeyFingerprint population.
P03 verify-reqs gate (5 tasks): cmd/verify-reqs Go program + make
target + .coreci.yml hook.
P04 final review + ship + audit (9 tasks).

Zero new direct deps. ROADMAP reconciled to 4-phase structure (P04 =
final review, no separate P05).

---ci---
project: orca
phase: 0
milestone: v0.8
status: plan
---/ci---
2026-08-04 00:49:07 +00:00
Jon Chery a052bf20f1 docs(init): validate v0.8 specification — coverage & trust hardening
---ci---
project: orca
phase: 0
milestone: v0.8
status: specify
---/ci---
2026-08-04 00:49:05 +00:00
Jon Chery 7bb533c2fb docs(milestone): complete hardening-completion
v0.7 milestone complete. All 4 execution phases + final review shipped.
REQ-053..056 all complete. Tags v0.6.0..v0.6.5 on v0.6.x patch line.
Merged milestone/v0.7-hardening-completion → main.

---ci---
project: orca
phase: 5
milestone: v0.7
status: complete
requirements:
  covered: [REQ-053, REQ-054, REQ-055, REQ-056]
  partial: []
---/ci---
2026-08-04 00:29:51 +00:00
Jon Chery afcd15cde4 docs(P04): complete pprof-daemon phase — shipped v0.6.4
REQ-056 complete. I-308 (deferred since v0.2) implemented. Tag + merge +
Gitea release succeeded.

---ci---
project: orca
phase: 4
milestone: v0.7
status: complete
requirements:
  covered: [REQ-056]
  partial: []
---/ci---
2026-08-04 00:22:39 +00:00
Jon Chery f8b135e7a8 docs(P03): complete coverage-uplift phase — shipped v0.6.3
REQ-055 complete. All 4 target packages ≥ 50% (engine 65.1%, transport
84.6%, proxmox 82.7%, audit 100%). Latent dispatch.go EOF bug fixed.

---ci---
project: orca
phase: 3
milestone: v0.7
status: complete
requirements:
  covered: [REQ-055]
  partial: []
---/ci---
2026-08-04 00:19:20 +00:00
Jon Chery 007d3a12e8 docs(P02): complete config-parser phase — shipped v0.6.2
REQ-054 complete. Tag + merge + Gitea release succeeded.

---ci---
project: orca
phase: 2
milestone: v0.7
status: complete
requirements:
  covered: [REQ-054]
  partial: []
---/ci---
2026-08-04 00:09:56 +00:00
Jon Chery 27f2abf8fb docs(P01): complete cert-register phase — shipped v0.6.1
REQ-053 complete. Tag + merge + Gitea release succeeded.

---ci---
project: orca
phase: 1
milestone: v0.7
status: complete
requirements:
  covered: [REQ-053]
  partial: []
---/ci---
2026-08-04 00:05:45 +00:00
Jon Chery c100892ad9 docs(P00): complete v0.7 pre-execution phase — shipped v0.6.0
Tag + merge + Gitea release #399 all succeeded. Phase 0 complete.

---ci---
project: orca
phase: 0
milestone: v0.7
status: complete
---/ci---
2026-08-03 23:54:37 +00:00
Jon Chery 561bf61317 docs(P00): correct v0.7 tag line to v0.6.x per branch-strategy.md
Tags run on the previous minor's patch line. v0.7 milestone → v0.6.x
tags (v0.6.0 P0 … v0.6.5 P05 milestone release). Prior commits
incorrectly referenced v0.5.x (the v0.6 milestone's line).

---ci---
project: orca
phase: 0
milestone: v0.7
status: plan
---/ci---
2026-08-03 23:52:19 +00:00
Jon Chery bd4a34daa2 docs(init): validate v0.7 specification — hardening & completion
---ci---
project: orca
phase: 0
milestone: v0.7
status: specify
---/ci---
2026-08-03 20:28:05 +00:00
Jon Chery 55d4d699a3 docs(milestone): complete node-bootstrap-proxmox
Milestone v0.6 complete. All 6 requirements (REQ-047..052) shipped
across 3 execution phases + final review. Tags v0.5.0..v0.5.4.

---ci---
project: orca
phase: 4
milestone: v0.6
status: complete
requirements:
  covered: [REQ-047, REQ-048, REQ-049, REQ-050, REQ-051, REQ-052]
  partial: []
---/ci---
2026-08-03 20:02:44 +00:00
Jon Chery fd2c57afeb docs(init): validate v0.6 specification
---ci---
project: orca
phase: 0
milestone: v0.6
status: specify
---/ci---
2026-08-03 19:32:53 +00:00
Jon Chery 2a711dfa6d docs(milestone): complete v0.5-distribution
All 6 requirements complete:
- REQ-041: unified ORCA_HOME namespace root (P1, v0.4.2)
- REQ-042: --system flag for /root/.orca (P1, v0.4.2)
- REQ-043: install.sh 1-liner from public Gitea (P2, v0.4.3)
- REQ-044: in-place update preserves state (P2, v0.4.3)
- REQ-045: repo + releases publicly accessible (P0, v0.4.1)
- REQ-046: docker image on Gitea container registry (P3, v0.4.4)

E2e verified: unauth releases API (200), fresh install, update-in-place,
  ORCA_HOME namespace, --system, docker pull + run.

---ci---
project: orca
phase: 4
milestone: v0.5
status: complete
requirements:
  covered: [REQ-041, REQ-042, REQ-043, REQ-044, REQ-045, REQ-046]
  partial: []
---/ci---
2026-08-03 18:55:50 +00:00
Jon Chery a22c41164f docs(init): validate v0.5 specification
---ci---
project: orca
phase: 0
milestone: v0.5
status: specify
---/ci---
2026-08-03 17:58:32 +00:00
Jon Chery c814afa773 docs(audit): fix ROADMAP stale checkbox + v0.2 milestone status
---ci---
project: orca
phase: 3
milestone: v0.3
status: audit
---/ci---

Audit fixes:
- Phase 11 checkbox: [ ] → [x] (completed in v0.3 P01, shipped v0.3.1)
- v0.2 milestone status: 'pending merge to main' → 'COMPLETE (merged via v0.3)'
- v0.2 milestone tag: 'pending' → 'v0.4.0 shipped'
2026-08-03 17:45:02 +00:00
Jon Chery df58bc25a3 docs(milestone): complete scheduling-streaming (v0.3)
---ci---
project: orca
phase: 3
milestone: v0.3
status: complete
requirements:
  covered: [REQ-022, REQ-030, REQ-032]
  partial: []
---/ci---

v0.3 milestone merged to main. Includes all v0.2 work (P08-P10) that
was previously on the milestone branch but not yet merged to main, plus
the v0.3 completion work (iter.Seq streaming + doctor network/db).

v0.2 phases included: P08 (mTLS), P09 (scheduling), P10 (security scan).
v0.3 phases: P0 (pre-execution), P1 (iter.Seq streaming), P2 (doctor),
P3 (final review+ship).

Total: 40 requirements, all complete. No new go.mod dependencies.
Full test suite passes under -race. gofmt + go vet clean.
2026-08-01 20:06:47 +00:00
Jon Chery 1ee82fc2e2 docs(P00): ideation - 34 ideas accepted
v0.2 IDEATE stage. 29 new ideas generated (10 Tier 1 mechanical + 11
Tier 2 backend-enriched + 8 Tier 3 cross-project) plus 6 research-stage
candidates (REQ-cand-A..F from commit 08d321f) = 35 considered. Under
full autonomy, all 35 with confidence >= 0.60 are auto-accepted; 1
explicitly deferred to v0.3 (I-308 pprof). 34 accepted into v0.2.

Resulting net-new REQs (REQ-025..REQ-040) span P01-P04:
- P01 (mTLS): REQ-025 (cert rotation history), REQ-026 (CA fingerprint
  pinning), REQ-032 (orca doctor), REQ-033 (file mode enforcement),
  REQ-034 (rotation alarm), REQ-035 (cert show redaction), REQ-036
  (SAN validation), REQ-038 (mTLS failure log fields)
- P02 (multi-node): REQ-028 (NodeCapacity HCL schema, P02 enabler),
  REQ-037 (X-Orca-Idempotency-Key)
- P03 (security CI): REQ-027 (govulncheck offline mode -- changes P03
  scope: CI must not call vuln.go.dev), REQ-029 (gitleaks baseline for
  pre-existing .env leak), REQ-039 (.gitleaks.toml stopwords),
  REQ-040 (.golangci.yml)
- P04 (iter.Seq): REQ-030 (--watch --json mode)
- Cross-cutting: REQ-031 (go test -race)

Total v0.2 REQs: 20 (4 carried from v0.1 + 16 net-new).

ARCHITECTURE.md: added `internal/doctor/` component (§5) with
orca doctor {cert,network,db} subcommands; ASCII diagram updated.
ROADMAP.md: per-phase REQ coverage matrix added; P03 scope change
documented (govulncheck offline mode).
PROJECT.md: unchanged (vision is stable).

---ci---
project: orca
phase: 0
milestone: v0.2
status: ideate
---/ci---
2026-06-03 21:03:59 +00:00
ciagent 907f25e20d docs(init): validate v0.2 specification
Validates the v0.2 milestone specification against the deferred-v0.2
requirements in ROADMAP.md and the requirement status table. Updates:

- ROADMAP.md: v0.2 marked in-progress with 4 phases (P01 mTLS, P02
  multi-node scheduling, P03 gosec+govulncheck, P04 iter.Seq). Adds
  target milestone tag (v0.3.0) and per-phase tags (v0.2.1..v0.2.4)
  per the feature-milestone promotion rule and the RELEASE_POLICY.md
  standing rule on per-phase releases.
- REQUIREMENTS.md: flips REQ-011, REQ-014, REQ-022, REQ-023 from
  'Deferred (v0.2)' to 'Pending (v0.2 PXX)'. Adds a v0.2 summary
  section.

No code or schema changes. Pure SPECIFY output per run.md Step 3.
CLARIFY and RESEARCH follow.

---ci---
project: orca
phase: 0
milestone: v0.2
status: specify
---/ci---
2026-06-03 20:52:01 +00:00
cloudinit-bot be9afa2d2c ship: v0.1 Foundation milestone complete (#1) 2026-06-03 20:08:57 +00:00
Jon Chery 55aae5347e chore(P00): rename orch-engine to orca, configure gitea + coreci (v0.1)
---ci---
project: orca
phase: 0
milestone: v0.1
status: execute
---/ci---
2026-06-03 11:36:32 +00:00
Jon Chery 97f437f9ef docs(init): initialize orch-engine (6 phases)
---ci---
project: orch-engine
phase: 0
milestone: v1.0
status: specify
decisions:
  - id: D-001
    decision: Use single-project mode for initial setup
    rationale: Simplified configuration for the initial phase
    confidence: 1.0
    alternatives: []
---/ci---

Specification: Build an offline/CLI-first orchestration engine.
Requirements: Simplicity, AI-first, Offline-first, CLI-first, prioritize security/bug-fixes over features, Go 1.25+.
Constraints: Simpler than Nomad, far simpler than Kubernetes.
Out of scope: K8s complexity.
2026-06-03 10:59:05 +00:00