acdl/.ciagent/PERSONAS.md

project, milestone, generated_at, generator, verification_toolchain

project	milestone	generated_at	generator	verification_toolchain
acdl	v1.28	2026-08-19	lead-developer	typecheck test lint note python3 -m py_compile core/mode_resolver.py nova/cli.py 2>&1 | head -5 || true pytest tests/test_mode_resolver.py tests/test_cli_subcommands.py -q 2>&1 | tail -15 || true ruff check nova/ core/lambda/nova_idp_*.py 2>/dev/null || true v1.28 is a feature milestone (CLI Canonicalization + Identity Layer). Four active personas: backend-engineer (Lambda/DynamoDB/KMS/CodeArtifact), security-engineer (Argon2id/KMS/ABAC/threat model), cli-engineer (subcommand surface/mode_resolver/argparse/CAP-034), lead-developer (plan/review/ship/capability gate). frontend-engineer + data-engineer deactivated (no UI, no data pipelines). The kj-binary-in-Lambda-layer risk (D-227, RESEARCH §7) is the highest-risk item; P2 spike confirms.

Personas — v1.28 CLI Canonicalization + Identity Layer

Roster

backend-engineer

active: true
domain: "Lambda functions, DynamoDB, KMS integration, dual-use packaging, CodeArtifact publish, CloudFormation generation"
frameworks: ["Python 3.12", "boto3", "argparse", "pytest", "moto[dynamodb]", "CloudFormation"]
constraints: ["INV-15", "INV-16", "INV-17", "D-228", "D-229", "D-230", "NFR-5", "NFR-6", "NFR-7", "NFR-8"]
territory:
  - "core/lambda/**"
  - "core/metrics/**"
  - "core/env.py"
  - "core/outbox_writer.py"
  - "terraform/bootstrap/**"
  - ".gitea/workflows/publish.yml"
  - ".github/workflows/publish.yml"
  - ".github/actions/nova-cli/**"

security-engineer

active: true
domain: "Argon2id hashing, KMS asymmetric signing (ECDSA P-256 / ES256), ABAC policy, JWKS exposure, PAT lifecycle, threat model, DER→raw ECDSA conversion"
frameworks: ["argon2-cffi", "cryptography", "pyjwt", "kyverno-json", "JMESPath", "KMS Sign/Verify/GetPublicKey"]
constraints: ["INV-15", "INV-16", "INV-17", "NFR-5", "NFR-8", "NFR-9", "D-227", "D-231"]
territory:
  - "platform/abac/**"
  - "core/policy_engine.py"
  - "adapters/kyverno-json/**"
  - "core/lambda/nova_idp_auth.py"
  - "core/lambda/nova_idp_token_vend.py"
  - "core/lambda/nova_idp_jwks.py"
  - "docs/threat-model.md"

cli-engineer

active: true
domain: "CLI subcommand surface, mode_resolver, argparse, [project.scripts] entry-point, CAP-034 AST scan, nova auth/idp subgroups, property tests"
frameworks: ["Python 3.12", "argparse", "setuptools [project.scripts]", "hypothesis", "pkgutil"]
constraints: ["INV-12", "INV-13", "INV-14", "D-226", "NFR-1", "NFR-2", "NFR-3"]
territory:
  - "nova/**"
  - "core/mode_resolver.py"
  - "pyproject.toml"
  - "tests/test_mode_resolver.py"
  - "tests/test_cli_subcommands.py"

lead-developer

active: true
domain: "Phase plan, persona roster, review gates, milestone ship, capability gate (CAP-033..038), ROADMAP/STATE/PROJECT wiring"
frameworks: ["git", "Gitea Actions", "semver tagging", ".ciagent/ discipline"]
constraints: ["INV-1..17 (cross-cutting)", "v1.28 hard constraints", "NFR-6", "NFR-11"]
territory:
  - ".ciagent/**"
  - "PLAN.md"
  - "CHECKPOINT.json"
  - "STATE.md"
  - "REQUIREMENTS.md"
  - "ROADMAP.md"

frontend-engineer

active: false
phase_specific: false
reason: "No UI in v1.28 (CLI + JSON endpoints only). JWKS serves application/json; no HTML/CSS/JS surface."

data-engineer

active: false
phase_specific: false
reason: "No data pipelines / metrics / PowerBI work in v1.28. The metrics layer is v1.17-complete; v1.28 adds audit events but no new fact/dim tables."

Territory overlap notes

• core/lambda/contract_ingestor.py (dual-use refactor, REQ-329) = backend-engineer territory. core/lambda/nova_idp_auth.py + nova_idp_token_vend.py are co-owned by backend-engineer (Lambda plumbing, DynamoDB, function URLs) + security-engineer (crypto, ABAC, Argon2id logic inside).
• core/mode_resolver.py = cli-engineer. core/policy_engine.py = security-engineer (the ABAC evaluation path).
• nova/idp/setup.py = cli-engineer (the subcommand + arg parsing) + backend-engineer (the CloudFormation generation + deploy).
• nova/auth/* = cli-engineer (subcommands) + security-engineer (the token exchange + credential storage logic).

Phase-specific personas

None. All four active personas span the full milestone. The security-engineer is heaviest in P2 (identity layer) + P3 (threat model); the cli-engineer is heaviest in P1 (CLI substrate); the backend-engineer spans P1 (CodeArtifact/layer) + P2 (Lambdas/DynamoDB).