---
active:
  - lead-developer
  - backend-engineer
  - data-engineer
  - security-engineer
deactivated:
  - cli-engineer
  - frontend-engineer
  - network-engineer
  - devops-engineer
phase_specific:
  - release-engineer (P1 only — Dockerfile.traefik + release pipeline)
reason: |
  Orca v0.14 is the ingress bootstrap completeness milestone. The active
  roster owns the podman-traefik container + nft SNAT/DNAT + proxmox LXC
  ingress work:
  - lead-developer: coordinates phase decomposition, owns podman traefik
    reconciler (P2), nft emitter extension (P3), init/bootstrap wiring (P3,P4)
  - backend-engineer: owns Dockerfile.traefik + release pipeline (P1),
    proxmox native ingress mode (P5), floating-IP LXC provisioning (P6),
    doctor ingress (P7)
  - data-engineer: owns IngressMode schema migration (P5), node record
    updates for floating-IP LXC registration (P6)
  - security-engineer: owns nft priority collision fix (pve-firewall
    coexistence), step-ca root CA push to nodes, TLS model change
    (certResolver → dynamic tls.certificates)

  network-engineer and devops-engineer are deactivated — their territory
  (nft ruleset, container deployment) is covered by backend-engineer +
  lead-developer in this milestone. cli-engineer and frontend-engineer
  remain deactivated (no CLI framework or UI work).

  release-engineer is phase-specific for P1 (Dockerfile.traefik +
  release.sh + .coreci.yml container-publish-traefik step).

  Territory enforcement is warn mode (config.json
  personas.territory_enforcement=warn). Cross-territory fixes (e.g. a
  fix that touches both nft emitter and proxmox bootstrap) are allowed
  with a warning.

  Framework alignment (from go.mod):
  - lead-developer: cobra
  - backend-engineer: cobra, podman (CLI), pct (CLI via SSH)
  - data-engineer: modernc/sqlite
  - security-engineer: nft, step-ca, TLS
  - release-engineer: docker, .coreci.yml

  Constraint alignment:
  - All personas: offline-first, no-redundant-implementations
  - backend-engineer: API-first, error-handling, security-first,
    container-first (R-024)
  - data-engineer: schema-first, migration-safe, local-storage-only
  - security-engineer: deny-by-default, zero-trust, no-passwords (R-021),
    pve-firewall-coexistence
  - release-engineer: per-release-tagging, registry-auth