fix(identity): enforce exact human migration requests and workload separation

[adrianwebb]

Outcome

Prevent stale or substituted human identity migration plans and cross-kind principal collisions.

Work authority

• Work item / Issue: Identity migration: principal mapping, federation operations and authorization #279
• Proposal / decision: User-approved Identity, SSO and Explicit Federation plan
• Assignment / checkpoint: Safe existing-account migration
• Actor: Codex
• Human authority: adrianwebb
• Agent / capacity provider: Codex desktop
• Exact base ref: staging b5afb24
• Exact head ref: codex/identity-mapping-boundaries 2dd4988

Contributor mode:

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Make human mapping symmetric with accepted workload registration before any live migration. Lock both identity kinds; bind inventory and request digests; reject workload ID/subject collisions, including revoked records. Preserve exact issuer strings and valid opaque subjects.

Changes and commits

2dd4988 updates planner/transaction and focused tests. No network work occurs inside the migration lock. No public account-linking endpoint or fallback authentication path.

Verification

• Eight focused local tests and independent build pass; real PostgreSQL test is selected in required Actions (no local database).
• Actions pending: stale status, changed request, revoked workload collision, noop, rollback.

Risk and rollback

Maintenance-only API changes; no live call site. Disposable and downstream migration callers must supply the new request digest and workload inventory. Revert before adoption; after live migration use coordinated database/application recovery, never an old writer on incompatible state.

Completion summary

Implementation ready for automated checks; live migration remains separately gated.

AGPL committer authorization

Base-owned workflow validates authenticated PR author; no credential sharing or spoofed attribution.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.