orca/.ciagent/PERSONAS.md

active_personas, deactivated_personas, phase_specific, reason

active_personas	deactivated_personas	phase_specific	reason
lead-developer backend-engineer data-engineer cli-engineer security-engineer network-engineer	frontend-engineer devops-sre	cli-engineer data-engineer security-engineer network-engineer	Orca is a CLI-first, offline-first orchestration engine with no web UI and a single-binary distribution model. The v0.3 milestone is a 2-phase completion milestone (iter.Seq streaming + doctor network/db) that touches the CLI, store, doctor, transport, and security layers. The persona roster reflects this: - lead-developer: coordination, task decomposition, territory adjudication (e.g. D-039 dbPath relocation between cli-engineer territory and the doctor package). - backend-engineer: daemon health endpoint surface that the doctor network check probes; transport dispatch client reuse. - data-engineer: iter.Seq[Job|Node] on the store repos (P01) and the migration-version query + PRAGMA integrity_check in the store layer (P02). - cli-engineer: the --watch flag on `orca job list` / `orca node list` (P01) and the doctor subcommand wiring (P02). - security-engineer: mTLS client config reuse for the doctor network probe (P02) — TLS config is the security-engineer territory per v0.2. - network-engineer: the doctor /healthz probe over mTLS reuses the transport layer (P02) — connection lifecycle / peer reachability is the network-engineer territory. Deactivated: - frontend-engineer: no web UI in Orca (v0.1 onward). NOT relevant to v0.3. - devops-sre: no container/cloud integrations; release flow is handled by CoreCI (not a persona territory). Phase-specific (v0.3): - cli-engineer: P01 (--watch flag is a CLI surface) + P02 (doctor subcommand wiring). - data-engineer: P01 (iter.Seq on store repos) + P02 (migration version + integrity check in store layer). - security-engineer: P02 only (mTLS client config for doctor network probe). - network-engineer: P02 only (mTLS /healthz probe over transport).

Personas: Orca

Roster

lead-developer

• Domain: coordination
• Frameworks: cobra
• Constraints: boundary-enforcement, offline-first, no-redundant-implementations
• Territory: **/*.go, cmd/**, internal/**
• Active: true

backend-engineer

• Domain: backend
• Frameworks: cobra, net/http
• Constraints: API-first, error-handling, minimal-dependencies, security-first
• Territory: **/api/**, **/*_handler*, **/*_handler.go, internal/daemon/**
• Active: true
• Reason: Owns the daemon health endpoints (/healthz, /readyz) that the P02 doctor network check probes. The transport dispatch client (reused by doctor) lives in internal/transport but the handler surface is backend-engineer territory.

data-engineer

• Domain: data
• Frameworks: modernc/sqlite, iter
• Constraints: schema-first, migration-safe, local-storage-only, no-goroutine-leak
• Territory: **/store/**, **/model.go, **/migration*, migrations/**, internal/store/migrations/**
• Active: true
• Reason: Owns the iter.Seq[Job|Node] implementations on JobRepo/NodeRepo (P01) and the MigrationVersion query + PRAGMA integrity_check helper (P02). Added iter to frameworks and no-goroutine-leak to constraints (the iter.Seq polling loop must not leak — see RESEARCH_v0.3.md D-032). Territory confirmed against actual file structure: internal/store/ holds all repos + migrations/ subdir with 0001..0005_*.sql.

cli-engineer (custom)

• Domain: CLI/UX
• Frameworks: cobra, pflag
• Constraints: discoverable-help, consistent-flag-naming, human-readable-output, machine-readable-json-flag, signal-handling
• Territory: cmd/**, internal/cli/**, internal/commands/**
• Active: true
• Reason: Orca is CLI-first; this persona ensures CLI quality and discoverability. For v0.3 P01 it owns the --watch flag on orca job list / orca node list (signal.NotifyContext cancellation, table refresh vs streaming JSON). For P02 it owns the internal/cli/doctor.go subcommand wiring (replacing NetworkStub/DBStub calls). Added signal-handling to constraints (ctrl-c propagation to iter.Seq is a P01 correctness requirement). Territory confirmed: internal/cli/ holds all Cobra commands.

security-engineer (custom)

• Domain: security
• Frameworks: crypto/tls, crypto/x509, slog
• Constraints: no-panic-in-production, structured-audit-logging, no-secret-in-logs, input-validation, least-privilege
• Territory: **/auth/**, **/audit/**, internal/security/**, internal/transport/** (TLS config only)
• Active: true
• Reason: mTLS, audit logging, and input validation are first-class concerns. For v0.3 P02, the doctor network check reuses security.ClientTLSConfig (via transport.NewMTLSClient) to build the mTLS client that probes peer /healthz. The TLS-config portion of internal/transport/** remains security-engineer territory.
• Phase scope: P02 only (mTLS client config for doctor network probe). P01 has no security surface.

network-engineer (custom, NEW in v0.2)

• Domain: networking
• Frameworks: net/http, crypto/tls (via internal/security), iter
• Constraints: connection-resilience, retry-with-backoff, graceful-disconnect, context-propagation, bounded-probe-timeout
• Territory: **/transport/**, **/engine/dispatcher*, **/engine/peer*, internal/engine/dispatcher.go, internal/engine/peer.go, internal/transport/**
• Active: true
• Reason: Owns the transport layer and peer-to-peer connection lifecycle. For v0.3 P02, the doctor network check is a read-only mTLS /healthz probe that reuses transport.MTLSClient — the connection lifecycle (dial, per-probe 3s timeout, handshake) is network-engineer territory. Added bounded-probe-timeout to constraints (doctor must not stall on one slow peer — RESEARCH_v0.3.md D-038). Territory confirmed: internal/transport/ holds mtls.go, dispatch.go, retry.go, idempotency.go, handshake_log.go.
• Phase scope: P02 only (doctor network probe reuses transport layer).

frontend-engineer

• Active: false
• Reason: No web UI in Orca (v0.1 onward). NOT relevant to v0.3 — v0.3 adds no UI surface. Confirmed deactivated.

devops-sre

• Active: false
• Reason: No container/cloud integrations. Release flow is handled by CoreCI (not a persona territory). Confirmed deactivated.

Territory Enforcement

• Mode: warn (per config.json)
• Behavior: Out-of-territory file changes log a warning but do not block.
• Rationale: Allows flexibility during early development; tighten to strict post-v0.1. For v0.3, the main territory-overlap risk is D-039 (moving dbPath from internal/cli to internal/certpaths) which crosses cli-engineer and the shared-infra concern — lead-developer adjudicates.

Phase-Specific Personas (v0.3)

Persona	Active in	Reason
cli-engineer	P01, P02	P01: --watch flag is a CLI surface (signal handling, table/JSON render). P02: doctor subcommand wiring in internal/cli/doctor.go.
data-engineer	P01, P02	P01: `iter.Seq[Job
security-engineer	P02	mTLS client config reuse for the doctor network probe. P01 has no security surface.
network-engineer	P02	mTLS /healthz probe over the transport layer (connection lifecycle, per-probe timeout). P01 has no network surface.

In full-autonomy mode, all personas are auto-accepted and the phase-scope assignments are applied automatically when a phase is committed.

v0.3 vs v0.2 Persona Diff

Change	Rationale
data-engineer frameworks: added iter	P01 introduces iter.Seq[T] on the store repos — a new stdlib framework surface for this persona.
data-engineer constraints: added no-goroutine-leak	The iter.Seq polling loop must not leak goroutines (inline pull loop, defer ticker.Stop, rows.Close on every path — RESEARCH D-032).
cli-engineer constraints: added signal-handling	P01 requires signal.NotifyContext for ctrl-c propagation to iter.Seq (D-031).
network-engineer constraints: added bounded-probe-timeout	P02 doctor network check must bound each peer probe (3s) so one slow peer doesn't stall diagnostics (D-038).
network-engineer phase scope: was P02-only (v0.2), now P02-only (v0.3)	Same persona, different phase content — v0.3 P02 is doctor network, not multi-node dispatch.
security-engineer phase scope: was P01+P02 (v0.2), now P02-only (v0.3)	v0.3 has no new cert/CA work; security surface is limited to reusing the existing mTLS client config in doctor.
frontend-engineer	Remains deactivated (no UI in v0.3).
devops-sre	Remains deactivated (CoreCI handles release).

Migration from v0.2

• backend-engineer territory unchanged: internal/daemon/** still owns HTTP handlers. The /healthz endpoint that the doctor network check probes is backend-engineer territory; the probing client is network-engineer.
• data-engineer territory expanded scope: still owns internal/store/** but now adds the iter.Seq polling implementations (P01) and a public MigrationVersion query (P02).
• security-engineer territory unchanged: internal/security/** + the TLS config portion of internal/transport/**. The doctor network check calls into security.ClientTLSConfig indirectly via transport.NewMTLSClient — no new security-engineer files, just reuse.
• cli-engineer territory unchanged: internal/cli/**. P01 modifies job.go and node.go; P02 modifies doctor.go. The dbPath relocation (D-039) moves a 5-line function out of internal/cli/node.go into internal/certpaths — cli-engineer territory loses one function, shared infra gains it.