Module roles 

RBAC role definitions and sidecar I/O.

RoleDef is the public unit of role configuration. Roles are declared in Schema::roles and persisted as roles.json in the database directory via [GraphDb::apply_schema].

Never-widen rule

• Empty role (no keys, no labels) = empty mask = sees nothing.
• Unknown role on a request = Err (never silently grant full access).
• Corrupt roles.json at open = roles poisoned; [GraphDb::mask_for_role] returns Err for any role name until the file is fixed and the DB re-opened.

Persistence

roles.json format: { "version": 1, "roles": [...] } (no write scopes) or { "version": 2, "roles": [...] } (at least one role has a write scope). Version 2 is written only when a write scope is present; version 1 is kept for forward-compat honesty — a v0.2 server can load v1 safely and the write field (absent from v1) is ignored by serde’s #[serde(default)] when a v2 sidecar is loaded by an older binary. Files are written atomically (temp → fsync → rename → dir-sync); a no-change re-apply leaves the file byte-identical.

Structs

RoleDef

A named RBAC role: resolves to a node-visibility mask at query time.

WriteScope

Write permissions granted to a role.