Import pipeline operator enrollment

roles/pipeline/README.md

@@ -90,6 +90,7 @@ group before the remaining configuration-bearing dependencies run.
 | --- | --- |
 | `dnd_pipeline_runtime_user` | `narratio` |
 | `dnd_pipeline_runtime_group` | `narratio` |
+| `dnd_pipeline_operator_users` | `[]` |
 | `dnd_pipeline_config_directory_mode` | `0755` |
 | `dnd_pipeline_config_file_mode` | `0644` |
 
@@ -259,8 +260,8 @@ inspection shows enabled sources, inferred dependencies, and generated family
 members; the diff shows the overlay's profile selections without modifying
 managed files.
 
-Storage and publishing, operator selection and group-membership management,
-scheduling, and end-to-end external execution remain deferred.
+Storage and publishing, scheduling, and end-to-end external execution remain
+deferred.
 
 ### Shared execution filesystem
 
@@ -269,27 +270,30 @@ scheduling, and end-to-end external execution remain deferred.
 `narratio:narratio` mode `2775` **setgid** directories. Their access and
 default ACLs retain owner and group write access plus world read/traverse access
 for newly created content. The pipeline may run as `narratio` or as a human
-account already in the selected runtime group; the production role neither
-selects people nor manages their group membership. For example, a consumer
-play can manage its selected operator separately:
+account in the selected runtime group. Consumers can enroll selected existing
+human accounts through the role interface:
 
 ```yaml
-- name: Add the selected operator to the pipeline group
-  become: true
-  ansible.builtin.user:
-    name: "{{ pipeline_operator }}"
-    groups:
-      - "{{ dnd_pipeline_runtime_group }}"
-    append: true
+dnd_pipeline_operator_users:
+  - eric
+  - alice
 ```
 
+Every selected account must already exist; the role does not create human
+accounts or manage their identity and login policy. Enrollment adds the
+selected runtime group without replacing other supplementary groups. Removing
+or omitting a name later does not revoke membership. A newly enrolled operator
+must begin a new login session before the operating system exposes the added
+supplementary group to that session.
+
 Configuration, transcripts, caches, generated artifacts, campaign data,
 prompts, and logs are non-secret D&D content. Credentials use the restricted
 `/usr/local/etc/narratio/secrets` subtree, owned by the selected runtime user
 and group with mode `0750`; managed files use mode `0640`. Runtime-group
-membership authorizes use of these shared credentials, while the subtree grants
-no world access. Ordinary configuration remains world-readable and contains
-only reference names.
+membership, including enrollment through `dnd_pipeline_operator_users`,
+authorizes use of these shared credentials, while the subtree grants no world
+access. Ordinary configuration remains world-readable and contains only
+reference names.
 
 ### Managed credentials