coreci-chat/.ciagent/PERSONAS.md

Persona Roster

Active personas for CoreCI Chat v0.1 M2 (MCP Layer & Day 1 Adapters):

Persona	Active	Phase-Specific	Reason
backend-engineer	yes	no	Owns the MCP broker gateway (packages/mcp), adapter router, write-method blocklist, rate limiter, SSE stream manager, OpenAI↔MCP translator, Proxmox/GitHub/Gitea adapters. The bulk of M2.
data-engineer	yes	no	Owns the mcp_adapters table + RLS policies, the CI Postgres 16 container setup (Wave 0), and the RLS verification against real Postgres (replaces M1's PGlite-only verification).
frontend-engineer	yes	no	Owns the Settings → Adapters configuration UI and the Test-Call UI in the M1 dashboard. Server components read via the API gateway (never bypass RLS); client components consume the SSE stream.
lead-developer	yes	no	Coordinates wave decomposition (F/G/H/I/J), resolves territory disputes (e.g., who owns the translator module — backend vs data), makes final architectural calls.
general	no	—	Not needed; the specialized personas cover M2.
security-engineer	yes	no (custom)	M2 has heavy security surface: INV-7 at the broker (load-bearing), write-method blocklist per adapter, defense-in-depth SSH (broker + Relay Agent), fine-grained PAT scope validation (D-006), Gitea version-aware scope validation. Owns the security review for Waves F/H specifically.
go-engineer	yes	yes (Wave H only)	Reactivated for M2 Wave H (SSH adapter integration with M1 Relay Agent). Adds the tool_call WebSocket message type to the Go agent, integrates the adapter with M1's CheckCommand hook. Removed after Wave H ships; apps/relay-agent/** territory reverts to backend-engineer for M2 follow-up. M3 may reactivate for chat-driven SSH execution.

Framework Alignment (overrides from package.json — M2)

M1 package.json + go.mod exist. M2 additions:

• backend-engineer: frameworks: [next, node, typescript, model-context-protocol, openai-api, axios, ulid]
• data-engineer: frameworks: [postgres, knex|prisma, node, typescript, docker, pg-rls]
• frontend-engineer: frameworks: [next, react, typescript, tailwind, eventsource]
• security-engineer: frameworks: [node, typescript, postgres-rls, openai-fine-grained-pat, pve-auditor, go-seccomp]
• go-engineer: frameworks: [go, gorilla-websocket, systemd, os-exec]

Territory Alignment (M2)

M1 territories carried forward. M2 additions:

• backend-engineer:
  • apps/control-plane/** (M1 + M2 routes)
  • packages/auth/**, packages/audit/**, packages/secrets/**, packages/config/**, packages/runtime/**
  • packages/mcp/** (NEW M2 — broker, registry, router, rate-limiter, stream-manager, translator)
  • packages/mcp/adapters/proxmox/** (NEW)
  • packages/mcp/adapters/github/** (NEW)
  • packages/mcp/adapters/gitea/** (NEW)
  • packages/mcp/adapters/ssh/** (NEW — TS module only; Go agent territory is go-engineer)
• data-engineer:
  • packages/db/**
  • apps/control-plane/lib/db/**
  • migrations: packages/db/migrations/** (M1 + M2 mcp_adapters migration)
  • CI Postgres 16 setup: .gitea/workflows/** or docker-compose.ci.yml (Wave 0 — Gitea Actions, the repo's forge)
• frontend-engineer:
  • apps/dashboard/**
  • apps/control-plane/app/(dashboard)/** (M1 + M2 Settings→Adapters + Test-Call UI)
  • apps/control-plane/app/api/mcp/stream/** (SSE Route Handler — shared with backend)
• security-engineer:
  • packages/mcp/write-blocklist/** (NEW M2 — per-adapter write-method blocklist)
  • packages/mcp/adapters/ssh/whitelist-check/** (NEW M2 — broker-side SSH whitelist validation, layer 1)
  • packages/auth/rbac/**, packages/audit/**, packages/secrets/**, packages/db/rls/**
  • tests: tests/security/**, tests/pen/**
• go-engineer (Wave H only):
  • apps/relay-agent/** (M2 additions: tool_call WebSocket message handler, adapter integration)
  • apps/relay-agent/whitelist/** (M1, G-004 contract — read-only for M2; verify no signature change)

Constraint Alignment

Shared across all personas (from PROJECT.md Constraints + spec §5):

• Read-only by default; 100% of write-action requests rejected at MCP gateway (M2) and Relay Agent (M1 whitelist hook).
• BYOM mandatory; 100% of inference outbound to customer endpoint.
• Multi-tenancy isolation via Postgres RLS; cross-tenant queries return empty.
• Audit immutability; append-only; write failure halts.
• Secret handling; every credential via SecretProvider; no env vars, config files, or DB columns for tenant secrets.
• RBAC enforced at API gateway from the first endpoint.
• Branch discipline: writes only on phase/NN-*; ---ci--- blocks in every commit.

Persona-specific:

• security-engineer: must sign off on Wave A (RLS + audit + secrets) and Wave D (whitelist hook) before those waves ship. Blocks the wave ship on a P0/P1 finding.
• go-engineer: the install script must be modular (detect-OS/install-binary/write-systemd-unit/register-target as separate functions) per PO kickoff note. A single monolithic install.sh is a P0 finding.
• frontend-engineer: server components read via the API gateway (never bypass RLS); client components subscribe to the status WebSocket fan-out.

Phase-Specific Personas

• go-engineer: active for Wave H (SSH adapter integration) only. After Wave H ships, the persona is removed from the roster and the apps/relay-agent/** territory reverts to backend-engineer for any M2 follow-up. M3 may reactivate a Go persona for chat-driven SSH execution.

Notes

• This file is consumed by the EXECUTE workflow for persona assignment and territory enforcement.
• M2 reactivates go-engineer for Wave H (SSH adapter plugs into M1's CheckCommand hook). The go-engineer must NOT change the CheckCommand(cmd string) error signature or the whitelist JSON schema (M1 G-004 contract lock) — any change requires a documented migration with a compatibility shim.
• M2 security-engineer must sign off on Wave F (broker write-method blocklist, INV-7 at broker) and Wave H (SSH defense-in-depth: broker layer 1 + Relay Agent layer 2) before those waves ship. Blocks the wave ship on a P0/P1 finding.
• M2 flagged risks from RESEARCH (must be addressed in PLAN/GRILL):
  1. R-001: implement synthetic initialize/initialized handshake for in-process adapters (conformance artifact).
  2. R-002: PVEAuditor introspection is a PVE gap — broker validates "token works for reads," not "token lacks writes." Document in UI; broker write-method blocklist is the load-bearing boundary.
  3. R-004: GitHub fine-grained PAT scope introspection is a GitHub gap — best-effort + per-invocation 403 handling.
  4. R-005: Gitea docs didn't fetch (JS-required) — verify against a running Gitea instance during Wave I.
  5. R-003: cross-layer SSH test asserting both broker (layer 1) and Relay Agent (layer 2) reject non-whitelisted commands.
  6. R-006: 30s stream-not-opened timeout to cancel orphan adapter calls.
  7. R-009: Wave 0 must replace M1's placeholder RLS assertions with real RLS WITH CHECK assertions gated on DB_MODE=pg.