Jon Chery
3f5e5de729
Three deep codebase sweeps (security, reliability, feature/doc): - Critical: job run runs locally (scheduler dead code), jobspec parser drops schedule/timeout, verify-reqs bypassed, logs --job RCE, pprof bypass, tar-slip, WebAuthn unauthenticated registration - High: 8 injection vectors, Go 1.25.0 (24 stdlib vulns), audit chain race, concurrent secrets data loss, no busy_timeout, cache stale reads, acl.Check zero calls, mTLS claim false, docs missing 25 subcommands - Medium: key zeroing, cache DB mode, writeAtomic consolidation, WebAuthn session mutex, IPv6, SSH timeouts, DB retention, logs unbounded R-022 (scheduler wiring) and R-023 (zero-trust enforcement) adopted as load-bearing architectural changes. ARCHITECTURE.md updated with deltas. PERSONAS.md updated (security-engineer added, uat-engineer phase-specific). ---ci--- project: orca phase: 0 milestone: v0.13 status: research ---/ci---
1.9 KiB
1.9 KiB
active:
- lead-developer
- backend-engineer
- data-engineer
- security-engineer deactivated:
- cli-engineer
- frontend-engineer
- network-engineer
- devops-engineer phase_specific:
- uat-engineer (P12 only) reason: | Orca v0.13 is a production-hardening milestone. The active roster is trimmed to the four personas that own the hardening work:
- lead-developer: coordinates phase decomposition, owns scheduler wiring (R-022) and jobspec parser fixes (P03)
- backend-engineer: owns ACL enforcement wiring (R-023), injection hardening (P02), transport/SSH safety (P08), concurrency (P07)
- data-engineer: owns SQLite busy_timeout, audit chain race fix, migration safety, DB retention (P05, P07, P09)
- security-engineer: owns toolchain vulns (P01), seal/audit CLI (P05), auth init-idp (P06), key zeroing, WebAuthn reg auth (P04)
network-engineer and devops-engineer are deactivated — their territory (nft ruleset, collector scripts) is covered by backend-engineer in this milestone. cli-engineer and frontend-engineer remain deactivated (no CLI framework or UI work).
uat-engineer is phase-specific for P12 (UAT plan + signoff script).
Territory enforcement is warn mode (config.json personas.territory_enforcement=warn). Cross-territory fixes (e.g. a fix that touches both daemon handlers and SQLite) are allowed with a warning.
Framework alignment (from go.mod):
- lead-developer: cobra
- backend-engineer: cobra, connectrpc
- data-engineer: modernc/sqlite
- security-engineer: go-webauthn, go-jose, x/crypto
- uat-engineer: bash, bats
Constraint alignment:
- All personas: offline-first, no-redundant-implementations
- backend-engineer: API-first, error-handling, security-first
- data-engineer: schema-first, migration-safe, local-storage-only
- security-engineer: deny-by-default, zero-trust, no-passwords (R-021)
- uat-engineer: idempotent, read-only, claim-coverage