Jon Chery
b925fda3aa
7 research topics: nft SNAT masquerade syntax, pve-firewall coexistence (priority collision fix), podman-in-LXC (fuse=1 requirement), traefik v3.3 TLS model (certResolver does not exist — use dynamic tls.certificates), pct create floating-IP syntax, podman restart persistence (podman-restart.service), SELinux :Z omission. Key findings that change the plan: - nft postrouting: ip saddr 127.0.0.0/8 oifname != lo masquerade - nft first-apply: pre-create table before nft -f - pve-firewall: shift orca input/forward to priority -10 - LXC features: nesting=1,keyctl=1,fuse=1 (fuse=1 for fuse-overlayfs) - traefik TLS: drop certResolver: orca, use dynamic tls.certificates - podman: --restart=unless-stopped + enable podman-restart.service - volumes: omit :Z flag, use :ro on both mounts ---ci--- project: orca phase: 0 milestone: v0.14 status: research ---/ci---
2.3 KiB
2.3 KiB
active:
- lead-developer
- backend-engineer
- data-engineer
- security-engineer deactivated:
- cli-engineer
- frontend-engineer
- network-engineer
- devops-engineer phase_specific:
- release-engineer (P1 only — Dockerfile.traefik + release pipeline) reason: | Orca v0.14 is the ingress bootstrap completeness milestone. The active roster owns the podman-traefik container + nft SNAT/DNAT + proxmox LXC ingress work:
- lead-developer: coordinates phase decomposition, owns podman traefik reconciler (P2), nft emitter extension (P3), init/bootstrap wiring (P3,P4)
- backend-engineer: owns Dockerfile.traefik + release pipeline (P1), proxmox native ingress mode (P5), floating-IP LXC provisioning (P6), doctor ingress (P7)
- data-engineer: owns IngressMode schema migration (P5), node record updates for floating-IP LXC registration (P6)
- security-engineer: owns nft priority collision fix (pve-firewall coexistence), step-ca root CA push to nodes, TLS model change (certResolver → dynamic tls.certificates)
network-engineer and devops-engineer are deactivated — their territory (nft ruleset, container deployment) is covered by backend-engineer + lead-developer in this milestone. cli-engineer and frontend-engineer remain deactivated (no CLI framework or UI work).
release-engineer is phase-specific for P1 (Dockerfile.traefik + release.sh + .coreci.yml container-publish-traefik step).
Territory enforcement is warn mode (config.json personas.territory_enforcement=warn). Cross-territory fixes (e.g. a fix that touches both nft emitter and proxmox bootstrap) are allowed with a warning.
Framework alignment (from go.mod):
- lead-developer: cobra
- backend-engineer: cobra, podman (CLI), pct (CLI via SSH)
- data-engineer: modernc/sqlite
- security-engineer: nft, step-ca, TLS
- release-engineer: docker, .coreci.yml
Constraint alignment:
- All personas: offline-first, no-redundant-implementations
- backend-engineer: API-first, error-handling, security-first, container-first (R-024)
- data-engineer: schema-first, migration-safe, local-storage-only
- security-engineer: deny-by-default, zero-trust, no-passwords (R-021), pve-firewall-coexistence
- release-engineer: per-release-tagging, registry-auth