coreci-chat/.ciagent/PERSONAS.md

Persona Roster

Active personas for CoreCI Chat v0.1 M1:

Persona	Active	Phase-Specific	Reason
backend-engineer	yes	no	Owns API gateway, RBAC, audit, secret manager, BYOM routing, Trigger.dev bootstrap, Postgres RLS — the bulk of M1.
data-engineer	yes	no	Owns Postgres schema, migrations, RLS policies, audit hash-chain. RLS + append-only audit are data-engineering territory.
frontend-engineer	yes	no	Owns the Next.js dashboard (Wave E): agent status, green/yellow/red, last 100 log lines, BYOM config form, RBAC user/role management UI.
lead-developer	yes	no	Coordinates wave decomposition, resolves territory disputes (e.g., who owns the withTenant helper — data vs backend), makes final architectural calls.
general	no	—	Not needed; the four specialized personas cover M1.
security-engineer	yes	no (custom)	M1 has heavy security surface: RBAC enforcement, RLS, audit immutability, secret manager, SSH whitelist hook, cross-tenant pen test. The default four personas lack a dedicated security lens; this custom persona owns the security review for Waves A/D specifically.
go-engineer	yes	yes (Wave D only)	Custom persona for the Go Relay Agent (Wave D). The default four personas are TS/web-oriented; Go systemd+WebSocket+whitelist work needs a Go-specific territory. Removed after Wave D ships.

Framework Alignment (overrides from package.json — to be set when the monorepo is created)

These will be finalized at Wave A start once package.json + go.mod exist. Preliminary:

• backend-engineer: frameworks: [next, node, typescript, trigger.dev, workos-sdk, aws-sdk]
• data-engineer: frameworks: [postgres, knex|prisma, node, typescript]
• frontend-engineer: frameworks: [next, react, typescript, tailwind]
• security-engineer: frameworks: [node, typescript, postgres-rls, aws-kms, go-seccomp]
• go-engineer: frameworks: [go, gorilla-websocket, systemd]

Territory Alignment (overrides to match actual file structure)

Preliminary globs, to be refined after Wave A scaffolds the monorepo:

• backend-engineer:
  • apps/control-plane/**
  • packages/auth/**
  • packages/audit/**
  • packages/secrets/**
  • packages/config/**
  • packages/runtime/**
• data-engineer:
  • packages/db/**
  • apps/control-plane/lib/db/**
  • migrations: packages/db/migrations/**
• frontend-engineer:
  • apps/dashboard/**
  • apps/control-plane/app/(dashboard)/**
• security-engineer:
  • packages/auth/rbac/**
  • packages/audit/**
  • packages/secrets/**
  • packages/db/rls/**
  • tests: tests/security/**, tests/pen/**
• go-engineer (Wave D only):
  • apps/relay-agent/**
  • scripts/install.sh, scripts/install/*
  • apps/relay-agent/whitelist/**

Constraint Alignment

Shared across all personas (from PROJECT.md Constraints + spec §5):

• Read-only by default; 100% of write-action requests rejected at MCP gateway (M2) and Relay Agent (M1 whitelist hook).
• BYOM mandatory; 100% of inference outbound to customer endpoint.
• Multi-tenancy isolation via Postgres RLS; cross-tenant queries return empty.
• Audit immutability; append-only; write failure halts.
• Secret handling; every credential via SecretProvider; no env vars, config files, or DB columns for tenant secrets.
• RBAC enforced at API gateway from the first endpoint.
• Branch discipline: writes only on phase/NN-*; ---ci--- blocks in every commit.

Persona-specific:

• security-engineer: must sign off on Wave A (RLS + audit + secrets) and Wave D (whitelist hook) before those waves ship. Blocks the wave ship on a P0/P1 finding.
• go-engineer: the install script must be modular (detect-OS/install-binary/write-systemd-unit/register-target as separate functions) per PO kickoff note. A single monolithic install.sh is a P0 finding.
• frontend-engineer: server components read via the API gateway (never bypass RLS); client components subscribe to the status WebSocket fan-out.

Phase-Specific Personas

• go-engineer: active for Wave D only. After Wave D ships, the persona is removed from the roster and the apps/relay-agent/** territory reverts to backend-engineer for any M1 follow-up. M2 reactivates a Go persona for the SSH adapter.

Notes

• This file is consumed by the EXECUTE workflow for persona assignment and territory enforcement.
• Framework + territory globs will be re-validated at Wave A start against the actual package.json / go.mod and committed as a follow-up to the Wave A plan commit.