Jon Chery
288607b3fa
---ci--- project: acdl phase: 0 milestone: v1.1 status: specify decisions: - D-034 temporary long-lived AWS key waiver (used once in Phase 08, rotated) - D-035 milestone v1.1 (feature), ship tag v1.2.0 - D-036 spike picks l1-s3 + l2-static-asset - D-037 demo archived to demo/ - D-038 open decisions resolved (accept recommendations + decide rest) ---/ci--- Ingest docs/vision.md (6 tenets, anti-goals, signals of success) and docs/architecture.md v0.2 (4 layers + 6 cross-cutting concerns incl. the substrate abstraction) as the source of truth for why/how. Reframe the project from the v1.0 stub demo (tag v1.1.0, archived to demo/ in Phase 06) to the real Agentic Cloud Delivery Platform. - config.json: milestone v1.1, status specify - PROJECT.md: vision + 4-layer/6-concern model + 11 open-decision resolutions (W1.A/B, W2.A, BA.A accepted; W3.D/E, BA.B-F, OpenTofu decided) + D-034..D-038 - ARCHITECTURE.md: target architecture (IR, confidence, ledger, HITL, SoD, substrate abstraction) + v1.1 spike scope (l1-s3 + l2-static-asset) - REQUIREMENTS.md: add REQ-16..REQ-28 + traceability - ROADMAP.md: add v1.1 Phases 06-10 (archive, arch-finalize, OIDC, IR+L1, L2+contract-e2e) - PERSONAS.md: add platform-engineer + security-engineer (custom), retire infra-stub-engineer, update territories + verification toolchain (terraform validate + jsonschema) - PLAN.md: v1.1 specify plan
118 lines
7.9 KiB
Markdown
118 lines
7.9 KiB
Markdown
---
|
|
project: acdl
|
|
milestone: v1.1
|
|
generated_at: 2026-07-21
|
|
generator: lead-developer
|
|
verification_toolchain:
|
|
typecheck: "terraform validate && python3 -m py_compile platform/**/*.py && python3 -m jsonschema schemas/*.schema.json"
|
|
test: "scripts/verify_phaseNN.sh"
|
|
build: "terraform init"
|
|
note: |
|
|
ACDL has no package.json. The execute/verify/ship workflows substitute
|
|
`terraform validate` + `python -m py_compile` + JSON Schema validation
|
|
(`python -m jsonschema` or `ajv`) for npm run typecheck, a per-phase
|
|
verify script for npm test, and `terraform init` for npm run build.
|
|
This override is documented here as the single source of truth; the
|
|
ci-* agents read PERSONAS.md before running verification commands.
|
|
---
|
|
|
|
# ACDL — Persona Roster (project-level, v1.1)
|
|
|
|
## Active personas
|
|
|
|
### lead-developer
|
|
- **Domain:** coordination
|
|
- **Active:** true
|
|
- **Phase-specific:** false
|
|
- **Frameworks:** (none)
|
|
- **Constraints:** pragmatic, battle-tested defaults, no-cross-territory-edits, vision-is-source-of-truth-for-why
|
|
- **Territory:** `.ciagent/**`, `scripts/verify_phase*.sh`, `README.md`, `docs/**` (meta only — not architecture authoring), `.gitignore`
|
|
- **Reason:** Owns CIAgent metadata, cross-phase verification scripts, and the v1.1 phase orchestration. Resolves the 11 open decisions (D-038) and arbitrates persona conflicts.
|
|
|
|
### backend-engineer
|
|
- **Domain:** backend
|
|
- **Active:** true
|
|
- **Phase-specific:** false
|
|
- **Frameworks:** python, json-schema, gitea-actions, act_runner, bash, yaml
|
|
- **Constraints:** contract-schema-first, fail-fast-with-reason-codes, no-long-lived-credentials, severity-to-penalty-mapping-immutable
|
|
- **Territory:** `platform/confidence_signal.py`, `platform/contract_resolver.py`, `platform/outbox/**`, `schemas/**` (contract + IR + PolicyCheckResult), `contracts/**` (sample contracts), `.gitea/workflows/**` (pipeline)
|
|
- **Reason:** Owns the contract schema, contract→IR resolution, the confidence signal (6 inputs + severity mapping), the DynamoDB outbox writer, and the central pipeline workflow.
|
|
|
|
### platform-engineer (custom)
|
|
- **Domain:** infra
|
|
- **Active:** true
|
|
- **Phase-specific:** false
|
|
- **Frameworks:** terraform, aws-iam, aws-s3, aws-dynamodb, oidc, json-schema
|
|
- **Constraints:** ir-is-substrate-agnostic, adapter-is-only-substrate-specific-code, state-in-s3+dynamodb-single-region, oidc-only-no-long-lived-keys (waiver D-034 for bootstrap), terraform-plan-only-in-spike
|
|
- **Territory:** `adapters/terraform/**`, `modules-ir/**`, `terraform/**` (state backend, provider config), `platform/registry/**`
|
|
- **Reason:** Owns the Target Stack IR, the L1/L2 IR-typed modules, the Terraform adapter, the AWS OIDC bootstrap, and the state backend. The IR is substrate-agnostic; the adapter is the only substrate-specific code (the binding constraint per §12).
|
|
|
|
### security-engineer (custom)
|
|
- **Domain:** security
|
|
- **Active:** true
|
|
- **Phase-specific:** false
|
|
- **Frameworks:** aws-iam, oidc, checkov, json-schema
|
|
- **Constraints:** least-privilege, separation-of-duties-identity-distinctness, no-secrets-in-skill-markdown, audit-chain-extends-not-tears-up, critical-finding-hard-overrides-confidence
|
|
- **Territory:** `platform/hitl_matrix_design.md`, `platform/audit_ledger_design.md`, `adapters/terraform/policy/**` (Checkov adapter → PolicyCheckResult), `platform/separation_of_duties.py`
|
|
- **Reason:** Owns the HITL matrix design, separation-of-duties (DynamoDB identity-distinctness), the audit ledger design (S3 Object Lock + JWS + chain), and the Checkov→PolicyCheckResult adapter. Enforces the "Safety is Computed, Not Assumed" + "Audit truth lives outside the repository" vision tenets.
|
|
|
|
### frontend-engineer
|
|
- **Domain:** frontend
|
|
- **Active:** true
|
|
- **Phase-specific:** false
|
|
- **Frameworks:** vanilla-js, dom-api, fetch-api
|
|
- **Constraints:** no-frameworks, single-file, fetch-from-same-origin-raw-url, relative-url-for-audit-json
|
|
- **Territory:** `evidence-ui/**` (the timeline UI; pushed to `acdl-evidence`)
|
|
- **Reason:** Owns the evidence timeline UI (`index.html`). Carried over from v1.0; the UI continues to render the audit stream. The v1.1 spike writes events to the DynamoDB outbox; the UI continues to read `audit.json` published to `acdl-evidence`.
|
|
|
|
## Deactivated personas
|
|
|
|
### infra-stub-engineer (custom, v1.0 only)
|
|
- **Domain:** backend
|
|
- **Active:** false
|
|
- **Reason:** Owned L1 stub modules (`modules/l1/**`) in the v1.0 demo. The demo is archived to `demo/` in Phase 06; real L1 modules (`modules-ir/l1/**`) are owned by platform-engineer (substrate-agnostic IR + Terraform adapter). The stub engineer is no longer needed.
|
|
- **Phase-specific:** false (was v1.0)
|
|
- **Territory (would have been):** `demo/modules/l1/**`
|
|
|
|
### data-engineer
|
|
- **Domain:** data
|
|
- **Active:** false
|
|
- **Reason:** No ORM/persistence framework. The v1.1 outbox is DynamoDB but accessed via boto3 calls inside `platform/outbox/**` (owned by backend-engineer); the audit ledger is S3 Object Lock + JWS (owned by security-engineer). No schema-migration layer, no ORM, no data-engineer territory.
|
|
- **Phase-specific:** false
|
|
- **Frameworks:** (would have been: drizzle, prisma)
|
|
- **Constraints:** (would have been: schema-first, type-safe-orm)
|
|
- **Territory:** (would have been: `**/db/**`, `**/migrations/**`)
|
|
|
|
## Phase-specific overrides
|
|
|
|
| Phase | Personas active | Notes |
|
|
|-------|------------------|-------|
|
|
| 06 archive-demo-and-reorient | lead-developer, frontend-engineer (demo UI move only) | backend/platform/security idle |
|
|
| 07 architecture-v1-finalization | lead-developer, backend-engineer (schemas), security-engineer (HITL/ledger/SoD), platform-engineer (IR) | frontend idle |
|
|
| 08 aws-oidc-bootstrap | platform-engineer (lead), security-engineer (trust policy review) | backend/frontend idle |
|
|
| 09 v1-spike-ir-and-l1-and-adapter | platform-engineer (lead), backend-engineer (IR schema co-author) | security/frontend idle |
|
|
| 10 v1-spike-l2-and-contract-e2e | platform-engineer (L2 + adapter), backend-engineer (contract→IR + confidence + outbox), security-engineer (Checkov→PolicyCheckResult), frontend-engineer (evidence event surfaces in timeline) | Full roster |
|
|
|
|
## Domain priority (used by TaskDecomposer)
|
|
|
|
`coordination → security → platform → backend → frontend`
|
|
|
|
Rationale: in v1.1, the security/architecture commitments (IR, confidence,
|
|
HITL, ledger, SoD) are the binding constraints; the platform layer
|
|
materializes them; backend wires the pipeline; frontend surfaces the
|
|
evidence. The spike's correctness depends on the security + platform layers
|
|
being right before backend wiring.
|
|
|
|
## Conflict resolutions (lead-developer arbitration)
|
|
|
|
- `backend-engineer` vs `platform-engineer` over `schemas/ir.schema.json`: platform-engineer owns the IR (it is substrate-agnostic but infra-shaped); backend-engineer owns the contract schema and the contract→IR resolution (contract is the consumer surface). Co-authoring is expected; conflict goes to lead-developer.
|
|
- `backend-engineer` vs `security-engineer` over `platform/confidence_signal.py`: security-engineer owns the severity→penalty mapping + critical-override semantics; backend-engineer owns the 6-input weighted sum + per-env thresholds. The confidence signal is co-owned; conflicts go to lead-developer.
|
|
- `platform-engineer` vs `security-engineer` over `adapters/terraform/policy/**`: security-engineer owns the Checkov→PolicyCheckResult adapter (policy is a security concern); platform-engineer owns the Terraform adapter (substrate translation). No overlap.
|
|
- `lead-developer` vs any: lead-developer owns `.ciagent/**` + `docs/**` meta + verification scripts; persona engineers do not edit CIAgent metadata or the vision/architecture source docs.
|
|
|
|
## Territory enforcement mode
|
|
|
|
`warn` — config.json has no `personas.territory_enforcement` field, so the
|
|
default per execute.md is `warn`. Cross-territory edits are logged in the
|
|
commit message but do not fail the task. The spike's small scope means
|
|
co-authoring across territories is likely; `warn` keeps it frictionless. |