Put the role labels on the right people, and stop the ceremony hiding it

[xmap]

Put the role labels on the right people, and stop the ceremony hiding it

Both 2-BM role labels were on the wrong human. a0010 was minted for the group
manager and b0010 for the admin; the commit that replaced operator-a /
operator-b with role labels attached them in SOURCE ORDER instead of by
asking which person each id already held, so alphabetical assignment inverted
them.

Nothing had broken yet, and only by luck: neither principal has
role-specific grants, both hold the same 59 commands, so the two were
interchangeable in practice. The next step in the plan was handing roles
different authority, which would have put admin on the wrong person.

The LABELS move, never the ids. An id is what the record means by a person and
what every grant already made hangs off; rewriting the vault to match the
labels would have changed who a0010 IS and orphaned anything recorded against
them. So the letters now read out of ascending order on purpose, the comment
says why, and a test pins the pairing rather than leaving it looking like a
typo somebody should tidy. The pinned event_id / correlation_id travel with
their actor id, not with the slot: they exist so a re-seed derives a
byte-identical envelope, and leaving them behind would pair one actor's stream
with another's envelope, invisibly, because both actors already exist.

WHY THE CEREMONY DID NOT CATCH IT. _seed_one_beamline_staff_actor stopped at
load_actor(...) is not None and reported exists. Presence, never content.
So a run with the correct names configured found both ids present, reported two
clean exists lines, and discarded the names without comparing them to
anything. That output was then read as evidence the rename had worked, which is
exactly backwards: it was evidence only that two ids existed.

It now reads the vault and reports MISMATCH when the configured name is not
the name already held for that id. Three properties, each pinned:

• It REPORTS and refuses to repair. Overwriting the vault is the wrong
  direction for the reason above; the remedy is to move the label.
• An absent profile row is NOT a mismatch. Warning there would fire on the
  first run of any deployment whose vault predates the profile write, and a
  guard that cries on a clean install is a guard people learn to ignore.
• Neither name is echoed. A mismatch report is something an operator pastes
  into a chat, and both sides of the comparison are personal data.

Twenty-one tests. The two new guards are mutation-proved: removing the
comparison fails the mismatch case, and treating an absent vault row as a
mismatch fails the clean-install case.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
apps/api/src/cora/api
beamline_staff_seed.py
Project Total

This report was generated by python-coverage-comment-action