Files

T

Jon Chery 1cc965e23b docs(specify): adopt R-017..R-020, D-215..D-237, REQ-099..REQ-118 for v0.11

SPECIFY stage: adopt 5 research docs into authoritative ciagent files.
- PRD_v0.11.md: new file extending R-series 16->20 (R-017 ingress hybrid, R-018/R-019/R-020 drift detection)
- PROJECT.md: append D-215..D-237 (23 new decisions, no collisions with D-001..D-206)
- REQUIREMENTS.md: append REQ-099..REQ-118 (20 net-new; ingress 099-102, drift 103-113, CLI 114-118)
- ROADMAP.md: update v0.11 section (fold ingress into P15.5 per Q3=A, expand P09/P10, add CLI REQs to P05/P06/P14a/P14b per Q2=C)

---ci---
project: orca
phase: 0
milestone: v0.11
status: specify
---/ci---

2026-08-07 03:37:24 +00:00

3.1 KiB

Raw Permalink Blame History

PRD v0.11 Extension: Production Hardening

Status: This file EXTENDS (does not supersede) PRD_v0.9.md. The 16 load-bearing rules R-001…R-016 remain in effect; this file adds R-017…R-020, adopted per operator decision Q1=A (2026-08-07) after ingestion of 5 research documents covering ingress hardening, drift detection, platform-engineer positioning, strategic framing, and the systemd Path unit implementation.

New load-bearing rules (R-017…R-020)

ID	Rule
R-017	Cluster ingress default is the hybrid: Traefik binds on `127.0.0.1:8443` (and `127.0.0.1:8080` for HTTP). Public `:443` / `:80` traffic is DNAT'd via nftables to Traefik. Cross-node cluster mesh stays on the cluster-internal private IP. Operators can opt out with `orca cluster config --public-binding=...`. Workloads can opt in to pure iptables with `service { ingress: native }`. In all cases, mTLS termination is unchanged: Traefik holds the certs.
R-018	Default drift detection cadence is 60s. Operators can tune per-path: critical_paths (5s default, systemd Path units enabled), standard_paths (30s default), file_watch_paths (systemd Path units, event-driven, R-001-clean).
R-019	Drift detector is a BACKSTOP. Primary failure detection is: systemd (`Type=notify`) for process state, Traefik health checks for routing state, step-ca cert notifications for cert expiry, Syncthing completion events for replication state. Drift detector exists to catch config divergence, not workload failures.
R-020	Hard gate: applier refuses new txns if pre-flight consistency check fails. Drift must be resolved before new state is committed. Auto-remediation is enabled by default for critical config paths but disabled for systemd unit files (require operator approval). Override: `--force` flag + per-namespace scoping (a drifted peer in ns-A does not block ns-B).

Relationship to R-001…R-016

R-017…R-020 are extensions, not reversals. They are compatible with:

R-001 (no Orca binary on servers) — systemd Path units are OS-native; nftables is OS-native; no Orca daemon introduced.
R-006 (mTLS by default; Traefik load-bearing) — R-017 preserves Traefik as the mTLS termination point; only the binding address changes.
R-007 (sockets by default) — unchanged; R-017 is about the public-ingress edge, not inter-workload sockets.
R-010 (transactional control plane) — R-018/R-019/R-020 refine the txn plane's drift-detection contract (C-09).

New D-series (D-215…D-237)

D-215…D-226 (ingress hybrid, doc 1) and D-227…D-237 (drift detection, doc 5) are recorded in PROJECT.md § v0.11 Clarified Decisions. No collisions with existing D-series (ends at D-206).

Milestone scope

v0.11 "Production Hardening" — 23 phases (P00…P16). Research adds scope to P09 (drift-event aggregation), P10 (drift detection + transactional plane), and P15.5 (ingress hybrid + threat model). Five net-new CLI commands (orca cluster rotate-lead, orca upgrade, orca job migrate, orca logs --all-nodes, orca doctor mTLS) are folded into existing phases per operator decision Q2=C. No new phases added (Q3=A folds ingress into P15.5).

3.1 KiB Raw Permalink Blame History