continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

docs(P00): research findings — v1.28 CLI + identity layer (11 Qs, D-228 amended)

Browse Source 
---ci---
project: acdl
phase: 0
milestone: v1.28
status: research
---/ci---
This commit is contained in:
Jon Chery
2026-08-19 22:05:24 +00:00
parent 05efb014d6
commit c629809d75
4 changed files with 505 additions and 190 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ciagent/PERSONAS.md
+100 -58
View File
@@ -1,77 +1,119 @@
---
project: acdl
milestone: v1.27
milestone: v1.28
generated_at: 2026-08-19
generator: lead-developer
verification_toolchain:
typecheck: "python3 -m py_compile core/confidence_signal.py 2>&1 | head -5 || true"
test: "bash scripts/run_regression.sh 2>&1 | tail -10 || true"
lint: "ruff check .ciagent/STATE.md 2>/dev/null || true"
typecheck: "python3 -m py_compile core/mode_resolver.py nova/cli.py 2>&1 | head -5 || true"
test: "pytest tests/test_mode_resolver.py tests/test_cli_subcommands.py -q 2>&1 | tail -15 || true"
lint: "ruff check nova/ core/lambda/nova_idp_*.py 2>/dev/null || true"
note: |
v1.27 is an NFR milestone (PO State Catalog & Ciagent Compression) —
a docs/chore milestone. Single active persona: lead-developer owns
the milestone narrative (STATE.md authoring, PROJECT/ROADMAP fixes,
archive moves, PLAN/NORTH_STAR wiring, final review + audit). No
code, no schema, no policy authoring. The pre-existing
core/confidence_signal.py LSP diagnostic is out of scope (not
touched by v1.27). Territory enforcement: warn.
v1.28 is a feature milestone (CLI Canonicalization + Identity Layer).
Four active personas: backend-engineer (Lambda/DynamoDB/KMS/CodeArtifact),
security-engineer (Argon2id/KMS/ABAC/threat model), cli-engineer
(subcommand surface/mode_resolver/argparse/CAP-034), lead-developer
(plan/review/ship/capability gate). frontend-engineer + data-engineer
deactivated (no UI, no data pipelines). The kj-binary-in-Lambda-layer
risk (D-227, RESEARCH §7) is the highest-risk item; P2 spike confirms.
---
# PERSONAS — v1.27 PO State Catalog & Ciagent Compression
# Personas — v1.28 CLI Canonicalization + Identity Layer
> Generated by the lead-developer at the end of RESEARCH. Assesses the
> project domains, activates/deactivates personas, aligns frameworks +
> territory + constraints to the actual project structure.
## Roster
## Active Roster (1)
### backend-engineer
```yaml
active: true
domain: "Lambda functions, DynamoDB, KMS integration, dual-use packaging, CodeArtifact publish, CloudFormation generation"
frameworks: ["Python 3.12", "boto3", "argparse", "pytest", "moto[dynamodb]", "CloudFormation"]
constraints: ["INV-15", "INV-16", "INV-17", "D-228", "D-229", "D-230", "NFR-5", "NFR-6", "NFR-7", "NFR-8"]
territory:
- "core/lambda/**"
- "core/metrics/**"
- "core/env.py"
- "core/outbox_writer.py"
- "terraform/bootstrap/**"
- ".gitea/workflows/publish.yml"
- ".github/workflows/publish.yml"
- ".github/actions/nova-cli/**"
```
### 1. lead-developer (active)
- **active:** true
- **phase_specific:** false
- **reason:** Owns the full v1.27 milestone narrative: STATE.md
authoring (PO-facing capability catalog, 36 entries across 10
domains + 11 invariants), archive moves (11 files to
`.ciagent/archive/` + 1 to consumer archive), PROJECT.md + ROADMAP.md
phase-status corrections, archive/README.md contents update,
PLAN.md + ROADMAP.md + NORTH_STAR.md ship-discipline wiring, final
review + audit.
- **domain:** `.ciagent/` docs (STATE.md, PROJECT.md, ROADMAP.md,
PLAN.md, NORTH_STAR.md, archive/README.md), consumer
`.ciagent/nova-blockchain-exchange/` (PROJECT.md pointer,
archive/ROADMAP-v1.26.md).
- **frameworks:** markdown, JSON (CHECKPOINT.json, config.json).
- **territory:** `.ciagent/`, `docs/`.
- **constraints:** no code changes (NFR milestone, D-220); no schema
changes; archive moves are lossless (byte-identical relocation, git
history preserves authoritative state); STATE.md is additive only.
### security-engineer
```yaml
active: true
domain: "Argon2id hashing, KMS asymmetric signing (ECDSA P-256 / ES256), ABAC policy, JWKS exposure, PAT lifecycle, threat model, DER→raw ECDSA conversion"
frameworks: ["argon2-cffi", "cryptography", "pyjwt", "kyverno-json", "JMESPath", "KMS Sign/Verify/GetPublicKey"]
constraints: ["INV-15", "INV-16", "INV-17", "NFR-5", "NFR-8", "NFR-9", "D-227", "D-231"]
territory:
- "platform/abac/**"
- "core/policy_engine.py"
- "adapters/kyverno-json/**"
- "core/lambda/nova_idp_auth.py"
- "core/lambda/nova_idp_token_vend.py"
- "core/lambda/nova_idp_jwks.py"
- "docs/threat-model.md"
```
## Deactivated (5)
### cli-engineer
```yaml
active: true
domain: "CLI subcommand surface, mode_resolver, argparse, [project.scripts] entry-point, CAP-034 AST scan, nova auth/idp subgroups, property tests"
frameworks: ["Python 3.12", "argparse", "setuptools [project.scripts]", "hypothesis", "pkgutil"]
constraints: ["INV-12", "INV-13", "INV-14", "D-226", "NFR-1", "NFR-2", "NFR-3"]
territory:
- "nova/**"
- "core/mode_resolver.py"
- "pyproject.toml"
- "tests/test_mode_resolver.py"
- "tests/test_cli_subcommands.py"
```
### backend-engineer (inactive)
- **active:** false
- **reason:** No code changes in v1.27. The pre-existing
`core/confidence_signal.py` LSP diagnostic is out of scope (not
touched by v1.27).
### lead-developer
```yaml
active: true
domain: "Phase plan, persona roster, review gates, milestone ship, capability gate (CAP-033..038), ROADMAP/STATE/PROJECT wiring"
frameworks: ["git", "Gitea Actions", "semver tagging", ".ciagent/ discipline"]
constraints: ["INV-1..17 (cross-cutting)", "v1.28 hard constraints", "NFR-6", "NFR-11"]
territory:
- ".ciagent/**"
- "PLAN.md"
- "CHECKPOINT.json"
- "STATE.md"
- "REQUIREMENTS.md"
- "ROADMAP.md"
```
### data-engineer (inactive)
- **active:** false
- **reason:** No schema, migration, or ORM changes.
### frontend-engineer
```yaml
active: false
phase_specific: false
reason: "No UI in v1.28 (CLI + JSON endpoints only). JWKS serves application/json; no HTML/CSS/JS surface."
```
### policy-engineer (inactive)
- **active:** false
- **reason:** No policy authoring. STATE.md Domain 3 catalogues
existing v1.25 + v1.26 policies (descriptive, not authoring).
### data-engineer
```yaml
active: false
phase_specific: false
reason: "No data pipelines / metrics / PowerBI work in v1.28. The metrics layer is v1.17-complete; v1.28 adds audit events but no new fact/dim tables."
```
### frontend-engineer (inactive)
- **active:** false
- **reason:** No UI. Deactivated since v1.26 (PERSONAS.md:141).
## Territory overlap notes
### blockchain-engineer (inactive)
- **active:** false
- **reason:** No chain code. The v1.26 pilot is shipped; v1.27 is
platform-side docs/chore only.
- `core/lambda/contract_ingestor.py` (dual-use refactor, REQ-329) =
backend-engineer territory. `core/lambda/nova_idp_auth.py` +
`nova_idp_token_vend.py` are **co-owned** by backend-engineer (Lambda
plumbing, DynamoDB, function URLs) + security-engineer (crypto, ABAC,
Argon2id logic inside).
- `core/mode_resolver.py` = cli-engineer. `core/policy_engine.py` =
security-engineer (the ABAC evaluation path).
- `nova/idp/setup.py` = cli-engineer (the subcommand + arg parsing) +
backend-engineer (the CloudFormation generation + deploy).
- `nova/auth/*` = cli-engineer (subcommands) + security-engineer (the
token exchange + credential storage logic).
## Territory Enforcement
## Phase-specific personas
- **Mode:** `warn` (the milestone is `.ciagent/`-only; the lead-
developer owns all writes; no cross-territory collisions expected).
None. All four active personas span the full milestone. The
security-engineer is heaviest in P2 (identity layer) + P3 (threat model);
the cli-engineer is heaviest in P1 (CLI substrate); the backend-engineer
spans P1 (CodeArtifact/layer) + P2 (Lambdas/DynamoDB).