acdl/.ciagent/PERSONAS.md

project, milestone, generated_at, generator, verification_toolchain

project	milestone	generated_at	generator	verification_toolchain
acdl	v1.1	2026-07-21	lead-developer	typecheck test build note terraform validate && python3 -m py_compile platform/**/*.py && python3 -m jsonschema schemas/*.schema.json scripts/verify_phaseNN.sh terraform init ACDL has no package.json. The execute/verify/ship workflows substitute `terraform validate` + `python -m py_compile` + JSON Schema validation (`python -m jsonschema` or `ajv`) for npm run typecheck, a per-phase verify script for npm test, and `terraform init` for npm run build. This override is documented here as the single source of truth; the ci-* agents read PERSONAS.md before running verification commands.

ACDL — Persona Roster (project-level, v1.1)

Active personas

lead-developer

• Domain: coordination
• Active: true
• Phase-specific: false
• Frameworks: (none)
• Constraints: pragmatic, battle-tested defaults, no-cross-territory-edits, vision-is-source-of-truth-for-why
• Territory: .ciagent/**, scripts/verify_phase*.sh, README.md, docs/** (meta only — not architecture authoring), .gitignore
• Reason: Owns CIAgent metadata, cross-phase verification scripts, and the v1.1 phase orchestration. Resolves the 11 open decisions (D-038) and arbitrates persona conflicts.

backend-engineer

• Domain: backend
• Active: true
• Phase-specific: false
• Frameworks: python, json-schema, gitea-actions, act_runner, bash, yaml
• Constraints: contract-schema-first, fail-fast-with-reason-codes, no-long-lived-credentials, severity-to-penalty-mapping-immutable
• Territory: platform/confidence_signal.py, platform/contract_resolver.py, platform/outbox/**, schemas/** (contract + IR + PolicyCheckResult), contracts/** (sample contracts), .gitea/workflows/** (pipeline)
• Reason: Owns the contract schema, contract→IR resolution, the confidence signal (6 inputs + severity mapping), the DynamoDB outbox writer, and the central pipeline workflow.

platform-engineer (custom)

• Domain: infra
• Active: true
• Phase-specific: false
• Frameworks: terraform, aws-iam, aws-s3, aws-dynamodb, oidc, json-schema
• Constraints: ir-is-substrate-agnostic, adapter-is-only-substrate-specific-code, state-in-s3+dynamodb-single-region, oidc-only-no-long-lived-keys (waiver D-034 for bootstrap), terraform-plan-only-in-spike
• Territory: adapters/terraform/**, modules-ir/**, terraform/** (state backend, provider config), platform/registry/**
• Reason: Owns the Target Stack IR, the L1/L2 IR-typed modules, the Terraform adapter, the AWS OIDC bootstrap, and the state backend. The IR is substrate-agnostic; the adapter is the only substrate-specific code (the binding constraint per §12).

security-engineer (custom)

• Domain: security
• Active: true
• Phase-specific: false
• Frameworks: aws-iam, oidc, checkov, json-schema
• Constraints: least-privilege, separation-of-duties-identity-distinctness, no-secrets-in-skill-markdown, audit-chain-extends-not-tears-up, critical-finding-hard-overrides-confidence
• Territory: platform/hitl_matrix_design.md, platform/audit_ledger_design.md, adapters/terraform/policy/** (Checkov adapter → PolicyCheckResult), platform/separation_of_duties.py
• Reason: Owns the HITL matrix design, separation-of-duties (DynamoDB identity-distinctness), the audit ledger design (S3 Object Lock + JWS + chain), and the Checkov→PolicyCheckResult adapter. Enforces the "Safety is Computed, Not Assumed" + "Audit truth lives outside the repository" vision tenets.

frontend-engineer

• Domain: frontend
• Active: true
• Phase-specific: false
• Frameworks: vanilla-js, dom-api, fetch-api
• Constraints: no-frameworks, single-file, fetch-from-same-origin-raw-url, relative-url-for-audit-json
• Territory: evidence-ui/** (the timeline UI; pushed to acdl-evidence)
• Reason: Owns the evidence timeline UI (index.html). Carried over from v1.0; the UI continues to render the audit stream. The v1.1 spike writes events to the DynamoDB outbox; the UI continues to read audit.json published to acdl-evidence.

Deactivated personas

infra-stub-engineer (custom, v1.0 only)

• Domain: backend
• Active: false
• Reason: Owned L1 stub modules (modules/l1/**) in the v1.0 demo. The demo is archived to demo/ in Phase 06; real L1 modules (modules-ir/l1/**) are owned by platform-engineer (substrate-agnostic IR + Terraform adapter). The stub engineer is no longer needed.
• Phase-specific: false (was v1.0)
• Territory (would have been): demo/modules/l1/**

data-engineer

• Domain: data
• Active: false
• Reason: No ORM/persistence framework. The v1.1 outbox is DynamoDB but accessed via boto3 calls inside platform/outbox/** (owned by backend-engineer); the audit ledger is S3 Object Lock + JWS (owned by security-engineer). No schema-migration layer, no ORM, no data-engineer territory.
• Phase-specific: false
• Frameworks: (would have been: drizzle, prisma)
• Constraints: (would have been: schema-first, type-safe-orm)
• Territory: (would have been: **/db/**, **/migrations/**)

Phase-specific overrides

Phase	Personas active	Notes
06 archive-demo-and-reorient	lead-developer, frontend-engineer (demo UI move only)	backend/platform/security idle
07 architecture-v1-finalization	lead-developer, backend-engineer (schemas), security-engineer (HITL/ledger/SoD), platform-engineer (IR)	frontend idle
08 aws-oidc-bootstrap	platform-engineer (lead), security-engineer (trust policy review)	backend/frontend idle
09 v1-spike-ir-and-l1-and-adapter	platform-engineer (lead), backend-engineer (IR schema co-author)	security/frontend idle
10 v1-spike-l2-and-contract-e2e	platform-engineer (L2 + adapter), backend-engineer (contract→IR + confidence + outbox), security-engineer (Checkov→PolicyCheckResult), frontend-engineer (evidence event surfaces in timeline)	Full roster

Domain priority (used by TaskDecomposer)

coordination → security → platform → backend → frontend

Rationale: in v1.1, the security/architecture commitments (IR, confidence, HITL, ledger, SoD) are the binding constraints; the platform layer materializes them; backend wires the pipeline; frontend surfaces the evidence. The spike's correctness depends on the security + platform layers being right before backend wiring.

Conflict resolutions (lead-developer arbitration)

• backend-engineer vs platform-engineer over schemas/ir.schema.json: platform-engineer owns the IR (it is substrate-agnostic but infra-shaped); backend-engineer owns the contract schema and the contract→IR resolution (contract is the consumer surface). Co-authoring is expected; conflict goes to lead-developer.
• backend-engineer vs security-engineer over platform/confidence_signal.py: security-engineer owns the severity→penalty mapping + critical-override semantics; backend-engineer owns the 6-input weighted sum + per-env thresholds. The confidence signal is co-owned; conflicts go to lead-developer.
• platform-engineer vs security-engineer over adapters/terraform/policy/**: security-engineer owns the Checkov→PolicyCheckResult adapter (policy is a security concern); platform-engineer owns the Terraform adapter (substrate translation). No overlap.
• lead-developer vs any: lead-developer owns .ciagent/** + docs/** meta + verification scripts; persona engineers do not edit CIAgent metadata or the vision/architecture source docs.

Territory enforcement mode

warn — config.json has no personas.territory_enforcement field, so the default per execute.md is warn. Cross-territory edits are logged in the commit message but do not fail the task. The spike's small scope means co-authoring across territories is likely; warn keeps it frictionless.