STAR WARS TEAM DEMO — REVIEW PACKAGE — 17 October 2026

Status: Applied and verified locally after the user explicitly confirmed this local dev environment is isolated from real payroll. Remote dev has not been changed. DryRun remains the safe runner default; isolation confirmation is still required on each future target.

Scope: AFORBES employee0901633 becomes Leia Organa/Jedi Council General. The two existing active hierarchy subordinates0140765 and9053433 become Luke Skywalker/Jedi Knight and Ahsoka Tano/Padawan Mentor. The package changes three existing Employee and Users display-name records, matching Personal known-as/initials/name fields and three exclusively occupied position titles. It fictionalises the names and both displayed telephone fields on the two existing next-of-kin records; it creates no contact records. The shared OD5400 department has three outside employees, so its description remains unchanged. IDs, employee numbers, company/dept/position keys, manager links, login usernames/passwords and security remain intact.

Next-of-kin numbers use NANPA's fictional non-working555-0100..0199 range: +12025550101 and+12025550102. Official source: https://nanpa.com/numbering/555-line-numbers. The third mapping reserves+12025550103 but no missing contact is created. The package sends no calls, SMS or emails.

Target prerequisites and side effects:
- Existing native triggers remain enabled. On the inspected local database payroll integrationF and its sync queues are enabled. A name-only Employee update can run payroll, leave and privilege helpers; it cannot be treated as a harmless text edit without transactional checks.
- Apply/Rollback/Rehearse require explicit IsolationConfirmed: all payroll/sync services, scheduled jobs, dirty-read consumers and other dispatchers for this target must be isolated. Existing queued work can read live names later; preserving queue rows alone does not establish isolation.
- A transaction holds exclusive locks on SYNC_IP_LOG and PW_Upload_Changes, remembers all existing queue IDs, removes only new rows attributable to these three employees and asserts existing scoped queue rows are byte-exact unchanged before commit. Queue locks can briefly block local queue workers; identity sequences can develop gaps. No existing queued work is cleared, authorised, exported or sent. No integration setting or trigger is disabled.
- Exact ordered JSON snapshots preserve null/empty distinctions and every unaffected column across Employee, Personal, Users, Posi, NextOfKn, User_Access_To, Lv_Emp, Lv_Xact, PW_Master, Occ_Hist, Movements and linked staff requisitions. Any business/security mutation aborts and rolls back the whole operation. Unknown custom leave-award SQL aborts; only the three reviewed read-only SELECT definitions are allow-listed by SHA256.
- The existing position-title trigger updates one related open staff-requisition display title. Its original title is backed up and restored by the package. Statuses, approvals and all other requisition fields must remain unchanged or the transaction aborts. Native audit entries, Employee ChangeBy and native position User_Name/User_Date stamps are expected; their original values are retained in the private backup for review. Rollback remains a native audited change; it does not erase audit history or force old timestamps.

Backup and restore:
A single additive dbo.__Codex_StarWarsTeam_20261017 table stores per-target original/demo display JSON, exact identity keys and original Employee ChangeBy and position metadata inside that target database only. The public package contains no original staff names or contacts. No permissions are added. Backups are captured once before the first successful apply, never overwritten on rerun; drift causes a closed failure. Do not export this private backup table. Restore reads that target's own before-values and refuses unexpected current names or identities. It restores display/contact fields only and retains the backup table. Keep this package outside application source and release folders.

Execution:
Set HRF_SQL_CONNECTION_STRING securely in the PowerShell process, or supply ConnectionString securely. Do not put credentials in the package or transcript.

Read-only scope review:
.\Run-StarWarsTeamDemo.ps1 -Mode DryRun -ExpectedDatabase Dev_AlexForbes_HR -ExpectedMachine BRENDANDESKTOP

Only after target isolation is independently confirmed:
.\Run-StarWarsTeamDemo.ps1 -Mode Rehearse -ExpectedDatabase Dev_AlexForbes_HR -ExpectedMachine BRENDANDESKTOP -AllowDemoChanges -IsolationConfirmed
.\Run-StarWarsTeamDemo.ps1 -Mode Apply -ExpectedDatabase Dev_AlexForbes_HR -ExpectedMachine BRENDANDESKTOP -AllowDemoChanges -IsolationConfirmed
.\Run-StarWarsTeamDemo.ps1 -Mode Verify -ExpectedDatabase Dev_AlexForbes_HR -ExpectedMachine BRENDANDESKTOP

Deliberate restore (also needs an isolated target):
.\Run-StarWarsTeamDemo.ps1 -Mode Rollback -ExpectedDatabase Dev_AlexForbes_HR -ExpectedMachine BRENDANDESKTOP -AllowDemoChanges -IsolationConfirmed

For later dev replay, use the dev server's exact ExpectedDatabase/ExpectedMachine and its own secure connection string; publish prerequisites first and confirm its isolation. Original values and local IDs are not transported: employee/company keys are resolved on each target, and hierarchy/position/contact drift fails closed. Do not run all SQL files blindly; the runner selects only named.sql scripts in the required order. Rehearse runs apply plus the retained restore path in an outer transaction and then rolls back every demo/backup change.

A fresh sign-in may be required to refresh cached signed-in/MSS names and titles. This package does not invalidate sessions automatically. The earlier480-interaction analytics seed is untouched; its existing user join will display Leia after a successful rename. Any contact or payroll fields not explicitly included in this requested display demo are preserved; this is not a complete de-identification of the entire database.

Validation completed locally: the retained Rehearse path applied, verified, restored and rolled back its outer transaction successfully. After source review, Apply committed15 intended display records, removed only14 new transaction-owned queue entries, and passed all12 exact business/security and existing-queue snapshots. The next Apply reported0 requested changes and0 new queues. Native verification passed all3 names, users, personal records and position titles plus both existing contact rows. No remote server was changed.

