Jon Chery
d7d6961261
Audit fix: PERSONAS.md body roster updated for v0.7 (was stale v0.6 content). Review P1-004: daemon --addr now uses cmd.Flags().Changed() to detect explicit flag, so config listen_addr only applies when --addr was not explicitly passed (correct flag>env>file>default precedence). Review P1-001: migration 0007 now dedups existing duplicate serial_hex rows before creating the UNIQUE index (backward-compat with v0.6 DBs that accumulated duplicates before the constraint existed). ---ci--- project: orca phase: 5 milestone: v0.7 status: execute requirements: covered: [REQ-053, REQ-054, REQ-055, REQ-056] partial: [] ---/ci---
97 lines
5.2 KiB
Markdown
97 lines
5.2 KiB
Markdown
---
|
|
active_personas:
|
|
- lead-developer
|
|
- backend-engineer
|
|
- data-engineer
|
|
deactivated_personas:
|
|
- cli-engineer
|
|
- security-engineer
|
|
- devops-engineer
|
|
- network-engineer
|
|
- frontend-engineer
|
|
phase_specific: []
|
|
reason: |
|
|
Orca v0.7 is an NFR hardening & completion milestone. The work is CLI
|
|
registration (cert command), a new internal/config package, test
|
|
coverage uplift across engine/transport/proxmox/audit, and an opt-in
|
|
pprof endpoint on the daemon. No schema changes, no new security
|
|
surface, no packaging/distribution, no UI.
|
|
|
|
Roster changes vs v0.6:
|
|
- data-engineer: RETAINED — owns cert_repo tests + store coverage.
|
|
- security-engineer: DEACTIVATED — v0.7 adds no new security surface
|
|
(pprof is operator-only, addr-gated; cert registration exposes
|
|
existing security code, does not add new).
|
|
- cli-engineer: DEACTIVATED — merged into lead-developer for v0.7
|
|
(the cert registration is a 1-line AddCommand; config --config flag
|
|
is root-command wiring, not a new CLI subsystem).
|
|
- devops-engineer: DEACTIVATED — no packaging/distribution in v0.7.
|
|
---
|
|
|
|
# Personas: Orca
|
|
|
|
## Roster
|
|
|
|
### lead-developer
|
|
- **Domain**: coordination
|
|
- **Frameworks**: `cobra`
|
|
- **Constraints**: `boundary-enforcement`, `offline-first`, `no-redundant-implementations`
|
|
- **Territory**: `**/*.go`, `cmd/**`, `internal/**`
|
|
- **Active**: true
|
|
- **Reason**: Coordination across P01/P03/P04. Owns cert command registration (P01), engine/transport/audit test coverage (P03), and pprof daemon integration (P04). Adjudicates territory overlaps between config (backend) and CLI wiring (lead).
|
|
|
|
### backend-engineer
|
|
- **Domain**: backend
|
|
- **Frameworks**: `cobra`, `hashicorp/hcl/v2`
|
|
- **Constraints**: `API-first`, `error-handling`, `minimal-dependencies`, `no-package-level-state`
|
|
- **Territory**: `**/config/**`, `**/api/**`, `**/*_handler*`, `internal/daemon/**` (non-pprof), `internal/cli/root.go` (config flag wiring)
|
|
- **Active**: true
|
|
- **Reason**: Owns `internal/config` package (P02 — HCL config file parsing, Load + MergeOverrides with flag>env>file>default precedence per D-039). No package-level state (AD-023). Config is a pure function passed explicitly to consumers.
|
|
|
|
### data-engineer
|
|
- **Domain**: data
|
|
- **Frameworks**: `modernc/sqlite`, `iter`
|
|
- **Constraints**: `schema-first`, `migration-safe`, `local-storage-only`
|
|
- **Territory**: `**/store/**`, `**/model.go`, `**/migration*`, `migrations/**`, `internal/store/migrations/**`
|
|
- **Active**: true
|
|
- **Reason**: Owns `cert_repo_test.go` (P01 companion — 11 tests covering Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + duplicate serial) and migration 0007 (UNIQUE index on `certs.serial_hex`). Co-owns `internal/proxmox/ssh_session_test.go` + `bootstrap_test.go` extension (P03 — transport/proxmox coverage).
|
|
|
|
### cli-engineer
|
|
- **Active**: false (v0.7)
|
|
- **Reason**: Deactivated — merged into lead-developer for v0.7. The cert registration is a 1-line AddCommand; the `--config` flag is root-command wiring; pprof is a daemon flag. No new CLI subsystem requiring a dedicated CLI persona.
|
|
|
|
### security-engineer
|
|
- **Active**: false (v0.7)
|
|
- **Reason**: Deactivated — v0.7 adds no new security surface. pprof is operator-only, addr-gated (AD-024); cert registration exposes existing security code, does not add new. The config package handles paths only (no secrets). Existing security constraints (file modes, redaction) are exercised by P01 smoke tests but not extended.
|
|
|
|
### devops-engineer
|
|
- **Active**: false (v0.7)
|
|
- **Reason**: Deactivated — v0.7 has no packaging/distribution/release surface. Was active in v0.5 (distribution milestone).
|
|
|
|
### network-engineer
|
|
- **Active**: false (v0.7)
|
|
- **Reason**: Deactivated — v0.7 has no transport/mTLS surface changes. P03 adds tests for existing transport code but no new network surface.
|
|
|
|
### frontend-engineer
|
|
- **Active**: false (v0.7)
|
|
- **Reason**: No web UI in Orca (unchanged from v0.1 onward).
|
|
|
|
## Territory Enforcement
|
|
|
|
- **Mode**: `warn` (per `config.json`)
|
|
- **Behavior**: Out-of-territory file changes log a warning but do not block.
|
|
- **Key overlaps in v0.7** (lead-developer adjudicates):
|
|
- `internal/cli/root.go` — backend-engineer (config flag + context wiring) + lead-developer (existing root command). Boundary: backend owns `--config` flag + `configFromCtx`; lead owns all other root command behavior.
|
|
- `internal/cli/daemon.go` — lead-developer (pprof flag + config listen_addr wiring) + backend-engineer (config consumption). Boundary: lead owns the daemon command; backend's config package is consumed, not modified.
|
|
- `internal/store/migrations/` — data-engineer owns all migrations. No overlap in v0.7.
|
|
|
|
## v0.7 vs v0.6 Persona Diff
|
|
|
|
| Change | Rationale |
|
|
|--------|-----------|
|
|
| `data-engineer` retained | Owns cert_repo tests + migration 0007 + proxmox/transport test coverage. |
|
|
| `security-engineer` deactivated | v0.7 adds no new security surface (pprof is operator-only, cert registration exposes existing code). |
|
|
| `cli-engineer` deactivated | Merged into lead-developer (cert registration is 1-line; config flag is root wiring). |
|
|
| `devops-engineer` remains deactivated | No packaging/distribution in v0.7. |
|
|
| `network-engineer` remains deactivated | No transport/mTLS surface changes. |
|
|
| `frontend-engineer` remains deactivated | No web UI. | |