docs(P00): research findings + persona assessment
---ci--- project: acdl phase: 0 milestone: v1.30 status: research ---/ci---
This commit is contained in:
CIAgent
+71
-227
@@ -1,267 +1,111 @@
|
||||
---
|
||||
project: acdl
|
||||
milestone: v1.28
|
||||
generated_at: 2026-08-19
|
||||
generator: lead-developer
|
||||
verification_toolchain:
|
||||
typecheck: "python3 -m py_compile core/mode_resolver.py nova/cli.py 2>&1 | head -5 || true"
|
||||
test: "pytest tests/test_mode_resolver.py tests/test_cli_subcommands.py -q 2>&1 | tail -15 || true"
|
||||
lint: "ruff check nova/ core/lambda/nova_idp_*.py 2>/dev/null || true"
|
||||
note: |
|
||||
v1.28 is a feature milestone (CLI Canonicalization + Identity Layer).
|
||||
Four active personas: backend-engineer (Lambda/DynamoDB/KMS/CodeArtifact),
|
||||
security-engineer (Argon2id/KMS/ABAC/threat model), cli-engineer
|
||||
(subcommand surface/mode_resolver/argparse/CAP-034), lead-developer
|
||||
(plan/review/ship/capability gate). frontend-engineer + data-engineer
|
||||
deactivated (no UI, no data pipelines). The kj-binary-in-Lambda-layer
|
||||
risk (D-227, RESEARCH §7) is the highest-risk item; P2 spike confirms.
|
||||
---
|
||||
|
||||
# Personas — v1.28 CLI Canonicalization + Identity Layer
|
||||
|
||||
## Roster
|
||||
|
||||
### backend-engineer
|
||||
```yaml
|
||||
active: true
|
||||
domain: "Lambda functions, DynamoDB, KMS integration, dual-use packaging, CodeArtifact publish, CloudFormation generation"
|
||||
frameworks: ["Python 3.12", "boto3", "argparse", "pytest", "moto[dynamodb]", "CloudFormation"]
|
||||
constraints: ["INV-15", "INV-16", "INV-17", "D-228", "D-229", "D-230", "NFR-5", "NFR-6", "NFR-7", "NFR-8"]
|
||||
territory:
|
||||
- "core/lambda/**"
|
||||
- "core/metrics/**"
|
||||
- "core/env.py"
|
||||
- "core/outbox_writer.py"
|
||||
- "terraform/bootstrap/**"
|
||||
- ".gitea/workflows/publish.yml"
|
||||
- ".github/workflows/publish.yml"
|
||||
- ".github/actions/nova-cli/**"
|
||||
```
|
||||
|
||||
### security-engineer
|
||||
```yaml
|
||||
active: true
|
||||
domain: "Argon2id hashing, KMS asymmetric signing (ECDSA P-256 / ES256), ABAC policy, JWKS exposure, PAT lifecycle, threat model, DER→raw ECDSA conversion"
|
||||
frameworks: ["argon2-cffi", "cryptography", "pyjwt", "kyverno-json", "JMESPath", "KMS Sign/Verify/GetPublicKey"]
|
||||
constraints: ["INV-15", "INV-16", "INV-17", "NFR-5", "NFR-8", "NFR-9", "D-227", "D-231"]
|
||||
territory:
|
||||
- "platform/abac/**"
|
||||
- "core/policy_engine.py"
|
||||
- "adapters/kyverno-json/**"
|
||||
- "core/lambda/nova_idp_auth.py"
|
||||
- "core/lambda/nova_idp_token_vend.py"
|
||||
- "core/lambda/nova_idp_jwks.py"
|
||||
- "docs/threat-model.md"
|
||||
```
|
||||
|
||||
### cli-engineer
|
||||
```yaml
|
||||
active: true
|
||||
domain: "CLI subcommand surface, mode_resolver, argparse, [project.scripts] entry-point, CAP-034 AST scan, nova auth/idp subgroups, property tests"
|
||||
frameworks: ["Python 3.12", "argparse", "setuptools [project.scripts]", "hypothesis", "pkgutil"]
|
||||
constraints: ["INV-12", "INV-13", "INV-14", "D-226", "NFR-1", "NFR-2", "NFR-3"]
|
||||
territory:
|
||||
- "nova/**"
|
||||
- "core/mode_resolver.py"
|
||||
- "pyproject.toml"
|
||||
- "tests/test_mode_resolver.py"
|
||||
- "tests/test_cli_subcommands.py"
|
||||
```
|
||||
|
||||
### lead-developer
|
||||
```yaml
|
||||
active: true
|
||||
domain: "Phase plan, persona roster, review gates, milestone ship, capability gate (CAP-033..038), ROADMAP/STATE/PROJECT wiring"
|
||||
frameworks: ["git", "Gitea Actions", "semver tagging", ".ciagent/ discipline"]
|
||||
constraints: ["INV-1..17 (cross-cutting)", "v1.28 hard constraints", "NFR-6", "NFR-11"]
|
||||
territory:
|
||||
- ".ciagent/**"
|
||||
- "PLAN.md"
|
||||
- "CHECKPOINT.json"
|
||||
- "STATE.md"
|
||||
- "REQUIREMENTS.md"
|
||||
- "ROADMAP.md"
|
||||
```
|
||||
|
||||
### frontend-engineer
|
||||
```yaml
|
||||
active: false
|
||||
phase_specific: false
|
||||
reason: "No UI in v1.28 (CLI + JSON endpoints only). JWKS serves application/json; no HTML/CSS/JS surface."
|
||||
```
|
||||
|
||||
### data-engineer
|
||||
```yaml
|
||||
active: false
|
||||
phase_specific: false
|
||||
reason: "No data pipelines / metrics / PowerBI work in v1.28. The metrics layer is v1.17-complete; v1.28 adds audit events but no new fact/dim tables."
|
||||
```
|
||||
|
||||
## Territory overlap notes
|
||||
|
||||
- `core/lambda/contract_ingestor.py` (dual-use refactor, REQ-329) =
|
||||
backend-engineer territory. `core/lambda/nova_idp_auth.py` +
|
||||
`nova_idp_token_vend.py` are **co-owned** by backend-engineer (Lambda
|
||||
plumbing, DynamoDB, function URLs) + security-engineer (crypto, ABAC,
|
||||
Argon2id logic inside).
|
||||
- `core/mode_resolver.py` = cli-engineer. `core/policy_engine.py` =
|
||||
security-engineer (the ABAC evaluation path).
|
||||
- `nova/idp/setup.py` = cli-engineer (the subcommand + arg parsing) +
|
||||
backend-engineer (the CloudFormation generation + deploy).
|
||||
- `nova/auth/*` = cli-engineer (subcommands) + security-engineer (the
|
||||
token exchange + credential storage logic).
|
||||
|
||||
## Phase-specific personas
|
||||
|
||||
None. All four active personas span the full milestone. The
|
||||
security-engineer is heaviest in P2 (identity layer) + P3 (threat model);
|
||||
the cli-engineer is heaviest in P1 (CLI substrate); the backend-engineer
|
||||
spans P1 (CodeArtifact/layer) + P2 (Lambdas/DynamoDB).
|
||||
|
||||
---
|
||||
|
||||
# Personas — v1.29 Reposplit + Identity Layer Bring-Live
|
||||
|
||||
```yaml
|
||||
project: acdl
|
||||
milestone: v1.29
|
||||
milestone: v1.30
|
||||
generated_at: 2026-08-20
|
||||
generator: lead-developer
|
||||
verification_toolchain:
|
||||
typecheck: "python3 -m py_compile nova/idp/setup.py core/lambda/nova_idp_setup.py 2>&1 | head -5 || true"
|
||||
test: "pytest tests/test_idp_auth.py tests/test_kms_roundtrip.py -q 2>&1 | tail -15 || true"
|
||||
lint: "ruff check nova/idp/ core/lambda/nova_idp_setup.py 2>/dev/null || true"
|
||||
typecheck: "python3 -m py_compile scripts/render_pptx.py 2>&1 | head -5 || true"
|
||||
test: "bash scripts/check_leadership_deck.sh 2>&1 | tail -20; echo \"exit=$?\""
|
||||
lint: "python3 -c \"import pptx; print('python-pptx', pptx.__version__)\" 2>&1"
|
||||
note: |
|
||||
v1.29 is a feature milestone (Reposplit + Identity Layer Bring-Live).
|
||||
Pure ops/devops focus — Terraform modules are authored out-of-band in
|
||||
nova-platform-ops; CIAgent in acdel delivers publish.yml, Gitea scrub,
|
||||
CFN archive + CLI terraform-delegation, operator guide, consumer bump.
|
||||
Five active personas: backend-engineer (publish.yml ECR image, Lambda
|
||||
zip, GitHub Releases), security-engineer (kj static build verification,
|
||||
KMS round-trip tests, ABAC E2E, M1.5 gate), cli-engineer (nova idp
|
||||
setup --apply terraform delegation, CFN archive), data-engineer
|
||||
(DynamoDB import references, outbox bootstrap docs), lead-developer
|
||||
(plan/review/ship, Gitea scrub, decisions, operator guide, milestone
|
||||
wiring). frontend-engineer deactivated (no UI).
|
||||
```
|
||||
v1.30 is a single-shot presentation artifact milestone (Leadership
|
||||
Deck). Four active personas: lead-developer (coordination + STATE.md
|
||||
CAP-042 + PROJECT.md D-241), backend-engineer (render_pptx.py
|
||||
extension + PPTX render + python-pptx install), ci-doc-writer
|
||||
(custom, phase-specific — Marp markdown deck authoring), ci-cli-
|
||||
engineer (custom — smoke-test script). frontend-engineer +
|
||||
data-engineer + security-engineer deactivated (no UI, no data
|
||||
pipelines, no runtime security surface — the deck is a static
|
||||
artifact). The render_pptx.py extension (D-242) is the only code
|
||||
change; it is a narrow prerequisite, not a REQ-372 deliverable.
|
||||
---
|
||||
|
||||
# Personas — v1.30 Single-shot Leadership Deck
|
||||
|
||||
## Roster
|
||||
|
||||
### lead-developer
|
||||
```yaml
|
||||
active: true
|
||||
domain: "Milestone plan, persona roster, Gitea scrub (REQ-367), decisions D-232..240 (REQ-368), operator guide (P4), milestone ship, STATE/ROADMAP/PROJECT wiring, covered-reference REQ tracking"
|
||||
frameworks: ["git", "Gitea Actions", "GitHub Actions", "semver tagging", ".ciagent/ discipline", "Terraform (reference only)"]
|
||||
constraints: ["D-232 (forge parity abandoned)", "D-235 (tag-pin handoff)", "D-236 (cutover shape)", "D-238 (KJ-LOCKSTEP)", "OPER-PRIV", "TFM-HITL", "v1.29 hard constraints"]
|
||||
domain: "Milestone coordination, STATE.md CAP-042, PROJECT.md D-241 record, ship discipline"
|
||||
frameworks: []
|
||||
constraints: ["pragmatic", "battle-tested defaults", "D-241", "D-242", "D-243"]
|
||||
territory:
|
||||
- ".ciagent/**"
|
||||
- "PLAN.md"
|
||||
- "CHECKPOINT.json"
|
||||
- "STATE.md"
|
||||
- "REQUIREMENTS.md"
|
||||
- "ROADMAP.md"
|
||||
- "PROJECT.md"
|
||||
- "CLARIFY.md"
|
||||
- "RESEARCH.md"
|
||||
- "docs/operator-guide-platform-ops.md"
|
||||
- ".github/workflows/ci.yml"
|
||||
- "scripts/sync_workflows.py"
|
||||
- "pyproject.toml"
|
||||
- "README.md"
|
||||
- ".ciagent/STATE.md"
|
||||
- ".ciagent/PROJECT.md"
|
||||
- ".ciagent/CHECKPOINT.json"
|
||||
- ".ciagent/REQUIREMENTS.md"
|
||||
- ".ciagent/ROADMAP.md"
|
||||
reason: "Owns the ship-wave records (CAP-042, D-241) and milestone coordination. The deck is a single-shot artifact; the lead-developer ensures the STATE.md/PROJECT.md records are appended correctly at ship."
|
||||
```
|
||||
|
||||
### backend-engineer
|
||||
```yaml
|
||||
active: true
|
||||
domain: "publish.yml ECR container image build (CGO_ENABLED=0 static kj), Lambda zip + layer wheel + Python wheel attach to GitHub Releases, ECR push with tag v1.29.x-kj-<sha>, kj-version.txt read, Dockerfile for lambda:3.12-al2023 base"
|
||||
frameworks: ["Python 3.12", "GitHub Actions", "Docker", "ECR", "Go (CGO_ENABLED=0 build)", "file(1)", "sha256sum"]
|
||||
constraints: ["KJ-STATIC", "D-239 (ECR tag format)", "D-235 (tag-pin handoff)", "REQ-354 criteria 1-4"]
|
||||
domain: "scripts/render_pptx.py extension (path arg + custom output + footer textbox), PPTX render, python-pptx install"
|
||||
frameworks: ["Python 3.11", "python-pptx 1.0.2", "pip"]
|
||||
constraints: ["D-242", "narrow extension only", "no new renderer", "S&P theme tokens only in source"]
|
||||
territory:
|
||||
- ".github/workflows/publish.yml"
|
||||
- "platform/abac/kj-version.txt"
|
||||
- "core/lambda/nova_idp_token_vend.py"
|
||||
- "core/lambda/nova_idp_auth.py"
|
||||
- "core/lambda/nova_idp_jwks.py"
|
||||
- "tests/test_idp_auth.py"
|
||||
- "tests/test_kms_roundtrip.py"
|
||||
- "scripts/render_pptx.py"
|
||||
- "docs/presentations/nova-leadership-deck.pptx"
|
||||
reason: "Owns the narrow render_pptx.py extension (D-242) and the PPTX render. Frameworks overridden from fastify/hono (default) to python-pptx (actual project dependency for this milestone). The extension is a non-REQ-372 prerequisite per spec §3.3 Edge 2."
|
||||
```
|
||||
|
||||
### security-engineer
|
||||
### ci-doc-writer
|
||||
```yaml
|
||||
active: true
|
||||
domain: "kj static-link audit (file(1) asserts statically linked + no shared library), KMS round-trip test against alias/nova-oidc-signing, ABAC E2E (sign-up→sign-in→token-vend→verify, INV-17 fail-closed), M1.5 verification gate tests (8-item spike), KJ-LOCKSTEP digest-equality verification"
|
||||
frameworks: ["KMS Sign/Verify/GetPublicKey", "kyverno-json", "jose", "file(1)", "readelf", "pytest", "moto[dynamodb]"]
|
||||
constraints: ["KJ-STATIC", "KJ-LOCKSTEP", "INV-17 (ABAC fail-closed)", "INV-18 (JWKS-EDGE-ONLY)", "ABAC-FAIL-CLOSED", "ARGON", "KF (KMS asymmetric)"]
|
||||
phase_specific: true
|
||||
domain: "Marp markdown deck authoring (7 slides, speaker notes, [1] citations, S&P theme)"
|
||||
frameworks: ["Marp", "Markdown"]
|
||||
constraints: ["REQ-372.1", "REQ-372.3", "REQ-372.4", "REQ-372.6", "REQ-372.7", "REQ-372.9", "REQ-372.12", "D-241", "D-243"]
|
||||
territory:
|
||||
- "platform/abac/**"
|
||||
- "platform/abac/kj-version.txt"
|
||||
- "adapters/kyverno-json/policies/token-vend.policy"
|
||||
- "tests/test_kms_roundtrip.py"
|
||||
- "tests/test_idp_auth.py"
|
||||
- "tests/test_abac_e2e.py"
|
||||
- "docs/threat-model.md"
|
||||
- "docs/presentations/nova-leadership-deck-marp.md"
|
||||
reason: "Custom persona for presentation authoring. Created for P1 (the deck is the primary deliverable). Removed after P1 ships. The deck is hand-authored against the Slide Content Map in PROJECT.md §v1.30 — NOT a compression (D-241)."
|
||||
```
|
||||
|
||||
### cli-engineer
|
||||
### ci-cli-engineer
|
||||
```yaml
|
||||
active: true
|
||||
domain: "nova idp setup --apply terraform delegation (REQ-369 AC 2), CFN archive to docs/archive/nova-idp-cfn-v1.28.md (REQ-369 AC 3), which terraform detection + CFN fallback deprecation warning"
|
||||
frameworks: ["Python 3.12", "argparse", "subprocess", "importlib", "shutil.which"]
|
||||
constraints: ["REQ-369", "D-235 (tag-pin handoff)"]
|
||||
domain: "Smoke-test script (bash, runnable on demand, NOT a CI gate)"
|
||||
frameworks: ["Bash", "grep", "awk", "wc"]
|
||||
constraints: ["REQ-372.8", "not a CI gate", "exit 0 on pass", "non-zero on fail"]
|
||||
territory:
|
||||
- "nova/idp/setup.py"
|
||||
- "core/lambda/nova_idp_setup.py"
|
||||
- "docs/archive/nova-idp-cfn-v1.28.md"
|
||||
- "nova/idp/__init__.py"
|
||||
- "scripts/check_leadership_deck.sh"
|
||||
reason: "Custom persona for the smoke-test script. Owns the 6 assertions (a–f): file exists, slide count=7, word bands, footer string, S&P colors only, PPTX exists. Pure bash — no python dependency (keeps it runnable without the python-pptx install)."
|
||||
```
|
||||
|
||||
### data-engineer
|
||||
```yaml
|
||||
active: true
|
||||
phase_specific: false
|
||||
domain: "DynamoDB table import references (nova-contracts, nova-change-requests, nova-outbox, nova-users, nova-sessions, nova-pats) documented in operator guide, PITR restore procedure, audit outbox bootstrap"
|
||||
frameworks: ["DynamoDB", "AWS CLI (reference)"]
|
||||
constraints: ["REQ-361 (import idempotency, covered-reference)", "JWKS-ROTATION"]
|
||||
territory:
|
||||
- "docs/operator-guide-platform-ops.md"
|
||||
- ".ciagent/ARCHITECTURE.md"
|
||||
reason: |
|
||||
Re-activated for v1.29: the operator guide (P4) documents DynamoDB PITR
|
||||
restore, table imports, and the audit outbox bootstrap — data-engineer
|
||||
owns the data-layer sections of the guide. The Terraform import itself
|
||||
is out-of-band (nova-platform-ops), but the operator-facing docs are
|
||||
in-acdl.
|
||||
```
|
||||
## Deactivated
|
||||
|
||||
### frontend-engineer
|
||||
```yaml
|
||||
active: false
|
||||
phase_specific: false
|
||||
reason: "No UI in v1.29 (pure ops/devops focus). JWKS serves application/json via CloudFront; no HTML/CSS/JS surface."
|
||||
reason: "ACDL has no frontend (no package.json); the deck is markdown (ci-doc-writer territory). Already deactivated in config.json personas[3]."
|
||||
```
|
||||
|
||||
## Territory overlap notes
|
||||
### data-engineer
|
||||
```yaml
|
||||
active: false
|
||||
reason: "No schema/migration/data-pipeline work in v1.30. The milestone is a single-shot presentation artifact."
|
||||
```
|
||||
|
||||
- `.github/workflows/publish.yml` (REQ-354) = backend-engineer (ECR
|
||||
image build, Dockerfile, Lambda zip) + lead-developer (Gitea scrub
|
||||
removes the `.gitea/workflows/publish.yml` mirror in P2, D-232).
|
||||
- `nova/idp/setup.py` (REQ-369) = cli-engineer (the `--apply` delegation
|
||||
+ `which terraform` detection) + backend-engineer (the CFN archive
|
||||
content — the CFN template is backend-engineer territory from v1.28).
|
||||
- `platform/abac/kj-version.txt` = security-engineer (KJ-STATIC audit
|
||||
reads + verifies the SHA) + backend-engineer (publish.yml reads the
|
||||
SHA to embed in the ECR tag).
|
||||
- `docs/operator-guide-platform-ops.md` (P4) = lead-developer (cutover
|
||||
gates, cost section, artifact-mirror fallback) + data-engineer (PITR
|
||||
restore, DynamoDB imports) + security-engineer (KMS rotation, JWKS
|
||||
reachability, PAT revocation).
|
||||
### security-engineer
|
||||
```yaml
|
||||
active: false
|
||||
reason: "No runtime security surface in v1.30. The deck is a static artifact; the existing security posture (ABAC, KMS, JWKS) is referenced in slide content, not modified. Security review of the deck content is handled by the verify stage (no secrets, no publish.yml integration)."
|
||||
```
|
||||
|
||||
## Phase-specific personas
|
||||
## Phase-specific persona lifecycle
|
||||
|
||||
None. All five active personas span the full milestone. The
|
||||
backend-engineer is heaviest in P1 (publish pipeline); the
|
||||
lead-developer is heaviest in P2 (Gitea scrub + decisions) + P4
|
||||
(operator guide) + P6 (final ship); the cli-engineer is heaviest in P3
|
||||
(CFN archive + TF delegation); the security-engineer is heaviest in P1
|
||||
(M1.5 gate tests) + P4 (operator guide security sections); the
|
||||
data-engineer is heaviest in P4 (operator guide data sections).
|
||||
- **ci-doc-writer**: created for P1, removed after P1 ships. The deck
|
||||
source is the deliverable; no further presentation authoring in P2
|
||||
(final review only).
|
||||
- All other personas persist through P2 (final review + ship).
|
||||
|
||||
## Territory enforcement
|
||||
|
||||
- **Mode:** `warn` (per `config.json personas.territory_enforcement`).
|
||||
- **Note:** v1.30 has a small, non-overlapping territory surface.
|
||||
`lead-developer` owns `.ciagent/STATE.md` + `.ciagent/PROJECT.md`;
|
||||
`backend-engineer` owns `scripts/render_pptx.py` + the PPTX;
|
||||
`ci-doc-writer` owns the markdown source; `ci-cli-engineer` owns
|
||||
the smoke-test script. No territory conflicts expected.
|
||||
Reference in New Issue
Block a user