Platform name-only Person edit API is live for Sales integration

Production handoff

Platform has deployed PATCH /api/identity/v1/person/{person_id}/name to https://platform.sguildswim.com. Platform commit 3a7c70c is live in Vercel production. Sales may begin the Workbench integration from its server layer.

The deployed route requires the shared Platform operator session, authorizes that session for the Sales app under ADR-0036, and requires X-Tenant-Id: tnt_sguild. Platform verified that admin@sguildswim.com is a production SuperAdmin, so the current operator account is authorized for this route. Workload tokens and browser-held service credentials are not accepted.

The request requires expected_updated_at plus at least one of given_name, family_name, or display_name. Name fields accept strings up to 200 characters or null. Unknown keys, including status and is_test_data, fail closed. A stale concurrency token returns HTTP 409 with the current canonical Person in data.person. A no-op returns success without emitting an event.

Merged input IDs resolve through one canonical alias hop. Platform mutates only the canonical row and returns the canonical person_id. Changed writes update the Person and publish person.updated in the same transaction, with changed_fields limited to the name fields that actually changed.

Operator attribution

The Person named in the route is the potential client whose submitted name is being corrected. The authenticated Better Auth account is the operator. The transactional identity audit records the operator user ID, requested and canonical Person IDs, changed field names, request ID, outcome, and timestamp. It does not retain submitted name values or the session cookie.

The existing event-envelope contract allows a human actor only when that operator has a canonical Person ID. The current operator identity is a Better Auth user, so person.updated.actor remains system:platform; human attribution is retained in the transactional identity audit. This preserves the existing event contract without inventing a fake operator Person or adding a new event type.

Verification

Platform's full test suite passed with 343 unit tests, 32 identity integration scenarios, and 3 geography integration scenarios. TypeScript, focused ESLint, audit guardrails, and diff checks passed. The production route was verified through the canonical hostname and returned the expected 401 NO_SESSION response without a forwarded operator session, proving the new route is live and protected without mutating Person data during the smoke check.

The request and response contract, validation rules, conflict shape, alias behavior, audit fields, and authorization behavior are documented in Platform at docs/person-name-edit-api.md.

Platform position

This is an additive implementation under existing Person name mutability, person.updated, alias-resolution rules, ADR-0009 transactional publication, and ADR-0036 operator authorization. It does not require a new ADR, event type, or Identity Contract version.

References

• 2026-08-03-sales-platform-person-name-edit-api
• Platform commit 3a7c70c
• Platform docs/person-name-edit-api.md
• ADR-0009
• ADR-0036
• contracts/identity/README.md
• contracts/event-envelope/README.md