Module roles 

RBAC role definitions and sidecar I/O.

RoleDef is the public unit of role configuration. Roles are declared in Schema::roles and persisted as roles.json in the database directory via [GraphDb::apply_schema].

Never-widen rule

• Empty role (no keys, no labels) = empty mask = sees nothing.
• Unknown role on a request = Err (never silently grant full access).
• Corrupt roles.json at open = roles poisoned; [GraphDb::mask_for_role] returns Err for any role name until the file is fixed and the DB re-opened.

Persistence

roles.json format: { "version": 1, "roles": [...] }. Written atomically (temp → fsync → rename → dir-sync) only when roles change; a no-change re-apply leaves the file byte-identical.

Structs

RoleDef

A named RBAC role: resolves to a node-visibility mask at query time.