orca/.ciagent/PERSONAS.md

active_personas, deactivated_personas, phase_specific, reason

active_personas	deactivated_personas	phase_specific	reason
lead-developer backend-engineer cli-engineer data-engineer security-engineer	devops-engineer network-engineer frontend-engineer		Orca v0.6 is a bootstrap-ergonomics + heterogeneous-nodes milestone. The work is schema (migration 0006), security (SSH keygen, TOFU, sudoers, PVE role), CLI (init full bootstrap, node join --type proxmox, doctor os/proxmox), and backend orchestration (proxmox SSH bootstrap sequence). No devops (no install/docker/release), no network (no transport/mTLS), no frontend (no UI). Roster changes vs v0.5: - data-engineer: REACTIVATED — owns migration 0006 + NodeRepo schema extension. - security-engineer: REACTIVATED — owns SSH keygen, TOFU host-key, sudoers, PVE role. - devops-engineer: DEACTIVATED — v0.6 has no packaging/distribution surface.

Personas: Orca

Roster

lead-developer

• Domain: coordination
• Frameworks: cobra
• Constraints: boundary-enforcement, offline-first, no-redundant-implementations
• Territory: **/*.go, cmd/**, internal/**
• Active: true
• Reason: Coordination across P01/P02/P03. SSH/bootstrap touches security + cli + store + doctor — territory overlaps need adjudication (proxmox package boundary, doctor Proxmox check scaffolding).

backend-engineer

• Domain: backend
• Frameworks: cobra, net/http, golang.org/x/crypto/ssh
• Constraints: API-first, error-handling, minimal-dependencies, security-first, idempotent-bootstrap
• Territory: **/api/**, **/*_handler*, **/*_handler.go, internal/daemon/**, internal/proxmox/**, internal/cli/init.go
• Active: true
• Reason: Owns the orca init full-bootstrap orchestration (CA + cert + db + localhost node, idempotent) and the internal/proxmox/bootstrap.go SSH session sequence (dial, deploy pubkey, useradd, pveum, sudoers, visudo validate). Added idempotent-bootstrap constraint (D-036 — re-run must be skip-and-refresh) and golang.org/x/crypto/ssh to frameworks.

data-engineer

• Domain: data
• Frameworks: modernc/sqlite, iter
• Constraints: schema-first, migration-safe, local-storage-only, no-goroutine-leak, nullable-column-handling
• Territory: **/store/**, **/model.go, **/migration*, migrations/**, internal/store/migrations/**, internal/model/node.go
• Active: true
• Reason: Reactivated for v0.6. Owns migration 0006_node_kind_os.sql (REQ-049 — nullable kind/os columns, backward-compatible) and NodeRepo schema extension (Insert/Get/List/Watch/scanNode column additions + new GetByName/UpdateLastSeenAndOS helpers). Added nullable-column-handling constraint (NULL → "" in Go struct, not nil-deref).

cli-engineer

• Domain: CLI/UX
• Frameworks: cobra, pflag
• Constraints: discoverable-help, consistent-flag-naming, human-readable-output, machine-readable-json-flag, signal-handling, password-flag-redaction
• Territory: cmd/**, internal/cli/**, internal/commands/**
• Active: true
• Reason: Owns orca init multi-step bootstrap output UX (progress lines per step), orca node join --type/--host/--user/--password/--proxmox-user/--proxmox-role flag wiring, and doctor os/doctor proxmox subcommand wiring. Added password-flag-redaction constraint (D-031 — --password never echoed, prefer $ORCA_PROXMOX_PASSWORD, zero after use).

security-engineer

• Domain: security
• Frameworks: crypto/tls, crypto/x509, crypto/ed25519, golang.org/x/crypto/ssh, slog
• Constraints: no-panic-in-production, structured-audit-logging, no-secret-in-logs, input-validation, least-privilege, tofu-host-key-pinning, noexec-sudoers
• Territory: **/auth/**, **/audit/**, internal/security/**, internal/transport/** (TLS config only), internal/proxmox/** (SSH + sudoers + PVE role)
• Active: true
• Reason: Reactivated for v0.6. Owns internal/security/sshkey.go (Ed25519 keygen, 0600/0644 mode enforcement per REQ-033 spirit), TOFU host-key pinning via knownhosts.New, sudoers least-privilege design (NOEXEC on pct/qm, exclude pvesh, no NOEXEC on apt-get/dpkg), password redaction (D-031), and audit logging of all bootstrap/join actions (REQ-052). Added tofu-host-key-pinning and noexec-sudoers constraints. Co-owns internal/proxmox/** with backend-engineer (security owns SSH auth + sudoers content; backend owns the session orchestration).

devops-engineer

• Active: false (v0.6)
• Reason: Deactivated — v0.6 has no install.sh, Dockerfile, .coreci.yml, or release-pipeline surface. The Proxmox SSH bootstrap is backend + security work, not devops. Was active in v0.5 (distribution milestone).

network-engineer

• Active: false (v0.6)
• Reason: v0.6 has no transport/mTLS surface. SSH is point-to-point bootstrap, not the mTLS mesh network-engineer owns.

frontend-engineer

• Active: false (v0.6)
• Reason: No web UI in Orca (unchanged from v0.1 onward).

Territory Enforcement

• Mode: warn (per config.json)
• Behavior: Out-of-territory file changes log a warning but do not block.
• Key overlaps in v0.6 (lead-developer adjudicates):
  • internal/proxmox/bootstrap.go — security-engineer (SSH auth, sudoers, PVE role) + backend-engineer (session orchestration, error handling). Boundary: security package exposes BootstrapProxmox(ctx, opts) error; the function lives in internal/proxmox but imports internal/security for SSH key handling.
  • internal/doctor/doctor.go Proxmox() — reuses internal/proxmox SSH client (security) but check scaffolding clones doctor.Network() pattern. Backend-engineer adjudicates (network-engineer deactivated).
  • internal/store/node_repo.go — data-engineer territory, but the UpdateLastSeenAndOS caller is internal/cli/init.go (backend). Standard repo-consumer boundary.

v0.6 vs v0.5 Persona Diff

Change	Rationale
data-engineer reactivated	Owns migration 0006 + NodeRepo schema extension (kind/os columns).
security-engineer reactivated	Owns SSH keygen, TOFU host-key, sudoers, PVE role — first-class security surface.
devops-engineer deactivated	v0.6 has no packaging/distribution surface.
network-engineer remains deactivated	No transport/mTLS surface.
frontend-engineer remains deactivated	No web UI.