fix(#764, #775): run workspace package suites in CI; land the role-holders audit row

[Weegy]

Closes #764. Closes #775. Two findings from the same review wave — both small, both sharp, one branch.

#764 — three test suites ran nowhere

npm run test in CI globs only middleware/test/**. The workspace packages' own suites — canvas-core (vitest), conductor-core (vitest, 99 tests), plugin-api (node:test) — ran in no workflow at all. Twice proven non-hypothetical:

• Conductor: run cancellation + approval hardening (strict approvals, role governance, timeout lint) #759 broke two conductor-core tests (fixture warning + a published-schema drift that would make consumers reject valid graphs) while every required check stayed green — a reviewer caught it by hand.
• feat(#343): adopt Lume icon + state-as-glyph specs (additive, gate-re… #725's 15 canvas-core validator tests were only ever executed manually during review.

New step in the middleware job runs all three. @omadia/plugin-ui-helpers is deliberately absent and documented in the step comment: it declares a test script but contains zero test files, so including it fails on "no test files found" — and papering over that with --passWithNoTests would create a permanently-green no-op, the exact failure family this repo keeps finding (#640 guard-skip, #752 absent ratchet). If it gains tests, add it.

#775 — the baton-move audit trail was empty

The auditRoleChange closure passed the session sub (an email under local auth) as actor.id; admin_audit.actor_id is a uuid column, so every insert threw. Loud in the log, invisible in the trail — the entire point of #759.

Fix, per the issue's own sketch:

• the conductor entry additionally threads req.session.omadia_user_id (a real uuid) as actorUserId;
• the mapping is an exported, testable roleChangeAuditEntry() in adminAuditLog.ts: uuid → actor_id only when the session carries one; the sub always → the free-text actor_email (the adminUsers routes' precedent, and for the 'operator' fallback the only place the actor survives at all);
• the index.ts closure is now one line delegating to the mapper.

Proof, at the layer where the bug lived

The defect was a database-level cast failure, so unit tests alone cannot prove the fix:

• 3 mapper unit tests (email→email-slot, uuid threading, operator fallback preserved).
• The existing route test now proves the uuid threading end-to-end: the harness session carries omadia_user_id, and the deep-equal asserts it arrives in the entry.
• A pg-gated suite (roleChangeAudit775.pg.test.ts) runs the mapper output through the real AdminAuditLog.record against the real migration DDL — read from src/auth/migrations/0002_admin_audit.sql, not copied, because a hand-duplicated schema could drift and green-light what production rejects. Verified 2/2 against an ephemeral postgres:16-alpine.
• Its second case pins the regression permanently: the OLD mapping must keep failing on the real column with invalid input syntax for type uuid. That is the mutation check promoted to a test — anyone reverting the closure reproduces exactly that insert.

Mutation evidence

• Removing the uuid-threading line → the extended route test goes red (1 fail).
• Reverting the closure to the old inline mapping → reproduces the insert the pg suite asserts the database refuses.

Verification

Full middleware suite 7048 tests / 0 fail after extending the one existing expectation that legitimately gained the new field; typecheck:test ratchet: no regressions; lint clean. Blast radius: one CI step (additive), one closure in index.ts (now one line), one additive entry field in conductor/routes.ts, one exported mapper + tests.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}