---
active_personas:
  - lead-developer
  - backend-engineer
  - data-engineer
deactivated_personas:
  - cli-engineer
  - security-engineer
  - devops-engineer
  - network-engineer
  - frontend-engineer
phase_specific: []
reason: |
  Orca v0.7 is an NFR hardening & completion milestone. The work is CLI
  registration (cert command), a new internal/config package, test
  coverage uplift across engine/transport/proxmox/audit, and an opt-in
  pprof endpoint on the daemon. No schema changes, no new security
  surface, no packaging/distribution, no UI.

  Roster changes vs v0.6:
  - data-engineer: RETAINED — owns cert_repo tests + store coverage.
  - security-engineer: DEACTIVATED — v0.7 adds no new security surface
    (pprof is operator-only, addr-gated; cert registration exposes
    existing security code, does not add new).
  - cli-engineer: DEACTIVATED — merged into lead-developer for v0.7
    (the cert registration is a 1-line AddCommand; config --config flag
    is root-command wiring, not a new CLI subsystem).
  - devops-engineer: DEACTIVATED — no packaging/distribution in v0.7.
---

# Personas: Orca

## Roster

### lead-developer
- **Domain**: coordination
- **Frameworks**: `cobra`
- **Constraints**: `boundary-enforcement`, `offline-first`, `no-redundant-implementations`
- **Territory**: `**/*.go`, `cmd/**`, `internal/**`
- **Active**: true
- **Reason**: Coordination across P01/P02/P03. SSH/bootstrap touches security + cli + store + doctor — territory overlaps need adjudication (proxmox package boundary, doctor Proxmox check scaffolding).

### backend-engineer
- **Domain**: backend
- **Frameworks**: `cobra`, `net/http`, `golang.org/x/crypto/ssh`
- **Constraints**: `API-first`, `error-handling`, `minimal-dependencies`, `security-first`, `idempotent-bootstrap`
- **Territory**: `**/api/**`, `**/*_handler*`, `**/*_handler.go`, `internal/daemon/**`, `internal/proxmox/**`, `internal/cli/init.go`
- **Active**: true
- **Reason**: Owns the `orca init` full-bootstrap orchestration (CA + cert + db + localhost node, idempotent) and the `internal/proxmox/bootstrap.go` SSH session sequence (dial, deploy pubkey, useradd, pveum, sudoers, visudo validate). Added `idempotent-bootstrap` constraint (D-036 — re-run must be skip-and-refresh) and `golang.org/x/crypto/ssh` to frameworks.

### data-engineer
- **Domain**: data
- **Frameworks**: `modernc/sqlite`, `iter`
- **Constraints**: `schema-first`, `migration-safe`, `local-storage-only`, `no-goroutine-leak`, `nullable-column-handling`
- **Territory**: `**/store/**`, `**/model.go`, `**/migration*`, `migrations/**`, `internal/store/migrations/**`, `internal/model/node.go`
- **Active**: true
- **Reason**: Reactivated for v0.6. Owns migration `0006_node_kind_os.sql` (REQ-049 — nullable `kind`/`os` columns, backward-compatible) and `NodeRepo` schema extension (Insert/Get/List/Watch/scanNode column additions + new `GetByName`/`UpdateLastSeenAndOS` helpers). Added `nullable-column-handling` constraint (NULL → `""` in Go struct, not nil-deref).

### cli-engineer
- **Domain**: CLI/UX
- **Frameworks**: `cobra`, `pflag`
- **Constraints**: `discoverable-help`, `consistent-flag-naming`, `human-readable-output`, `machine-readable-json-flag`, `signal-handling`, `password-flag-redaction`
- **Territory**: `cmd/**`, `internal/cli/**`, `internal/commands/**`
- **Active**: true
- **Reason**: Owns `orca init` multi-step bootstrap output UX (progress lines per step), `orca node join --type/--host/--user/--password/--proxmox-user/--proxmox-role` flag wiring, and `doctor os`/`doctor proxmox` subcommand wiring. Added `password-flag-redaction` constraint (D-031 — `--password` never echoed, prefer `$ORCA_PROXMOX_PASSWORD`, zero after use).

### security-engineer
- **Domain**: security
- **Frameworks**: `crypto/tls`, `crypto/x509`, `crypto/ed25519`, `golang.org/x/crypto/ssh`, `slog`
- **Constraints**: `no-panic-in-production`, `structured-audit-logging`, `no-secret-in-logs`, `input-validation`, `least-privilege`, `tofu-host-key-pinning`, `noexec-sudoers`
- **Territory**: `**/auth/**`, `**/audit/**`, `internal/security/**`, `internal/transport/**` (TLS config only), `internal/proxmox/**` (SSH + sudoers + PVE role)
- **Active**: true
- **Reason**: Reactivated for v0.6. Owns `internal/security/sshkey.go` (Ed25519 keygen, 0600/0644 mode enforcement per REQ-033 spirit), TOFU host-key pinning via `knownhosts.New`, sudoers least-privilege design (NOEXEC on pct/qm, exclude pvesh, no NOEXEC on apt-get/dpkg), password redaction (D-031), and audit logging of all bootstrap/join actions (REQ-052). Added `tofu-host-key-pinning` and `noexec-sudoers` constraints. Co-owns `internal/proxmox/**` with backend-engineer (security owns SSH auth + sudoers content; backend owns the session orchestration).

### devops-engineer
- **Active**: false (v0.6)
- **Reason**: Deactivated — v0.6 has no install.sh, Dockerfile, .coreci.yml, or release-pipeline surface. The Proxmox SSH bootstrap is backend + security work, not devops. Was active in v0.5 (distribution milestone).

### network-engineer
- **Active**: false (v0.6)
- **Reason**: v0.6 has no transport/mTLS surface. SSH is point-to-point bootstrap, not the mTLS mesh network-engineer owns.

### frontend-engineer
- **Active**: false (v0.6)
- **Reason**: No web UI in Orca (unchanged from v0.1 onward).

## Territory Enforcement

- **Mode**: `warn` (per `config.json`)
- **Behavior**: Out-of-territory file changes log a warning but do not block.
- **Key overlaps in v0.6** (lead-developer adjudicates):
  - `internal/proxmox/bootstrap.go` — security-engineer (SSH auth, sudoers, PVE role) + backend-engineer (session orchestration, error handling). Boundary: security package exposes `BootstrapProxmox(ctx, opts) error`; the function lives in `internal/proxmox` but imports `internal/security` for SSH key handling.
  - `internal/doctor/doctor.go` `Proxmox()` — reuses `internal/proxmox` SSH client (security) but check scaffolding clones `doctor.Network()` pattern. Backend-engineer adjudicates (network-engineer deactivated).
  - `internal/store/node_repo.go` — data-engineer territory, but the `UpdateLastSeenAndOS` caller is `internal/cli/init.go` (backend). Standard repo-consumer boundary.

## v0.6 vs v0.5 Persona Diff

| Change | Rationale |
|--------|-----------|
| `data-engineer` reactivated | Owns migration 0006 + NodeRepo schema extension (kind/os columns). |
| `security-engineer` reactivated | Owns SSH keygen, TOFU host-key, sudoers, PVE role — first-class security surface. |
| `devops-engineer` deactivated | v0.6 has no packaging/distribution surface. |
| `network-engineer` remains deactivated | No transport/mTLS surface. |
| `frontend-engineer` remains deactivated | No web UI. |