Free persona id outside STABLE map

The corpus prior

Agents name personas after the domain brief — promoter, booker, finance_clerk. That is natural product language. Demo auth (/__test__/authenticate with role=) and assignment-aware seeds only share principal UUIDs for a closed STABLE key set. The corpus prior is “id = role name in English.”

Wrong shape

persona promoter "Promoter":
  default_workspace: my_holds

# seeds assign rows to a1000000-… requester UUID
# authenticate role=promoter → random or non-matching principal

Empty “My Holds” with full tables in SQL.

Right shape

persona requester "Promoter":   # id = STABLE key; title = domain word
  default_workspace: my_holds

Use STABLE keys: member, manager, admin, requester, approver, finance, ops_engineer, employee, … (full list on demo_ops / knowledge demo_identity). Human titles stay free. Assignment FKs use the matching a1000000-… UUIDs. Validate warns when a non-STABLE id has default_workspace and the app uses current_user filters (#1630).

Why this matters here

Without this prior, every first-principles multi-persona demo reinvents dual identity (auth User vs domain User vs seed UUID). #1626/#1627/#1630 made the STABLE map explicit; agents still invent free ids unless the KG says so at authoring time.