fix(cli#125): write the UUID username (not the numeric id) as TRACEBLOC_CLIENT_ID

[saadqbal]

Closes #125.

The bug

A freshly-provisioned client (tracebloc client create --credential-file …, the RFC-0001 installer flow) deploys but crash-loops on auth:

Authentication failed
Unable to log in with provided credentials

client create wrote the numeric dashboard id as TRACEBLOC_CLIENT_ID:

"TRACEBLOC_CLIENT_ID=" + strconv.Itoa(pc.ID)   // e.g. "1052"

But TRACEBLOC_CLIENT_ID is the auth username, not a display id. The chain:

cred TRACEBLOC_CLIENT_ID
  → install-client-helm.sh   TB_CLIENT_ID → values clientId
  → chart secrets.yaml       CLIENT_ID = clientId
  → jobs-manager pod env     CLIENT_ID
  → controller.py:545        username = os.getenv("CLIENT_ID") → POST api-token-auth {username, password}
  → backend                  authenticates EdgeDevice by its username

The backend's EdgeDevice.username is a UUID (str(uuid.uuid4())), never the numeric id — so the pod sent username="1052", matched no user, and auth always failed. Password + everything else were correct.

The fix

Write pc.Username (the UUID) as TRACEBLOC_CLIENT_ID in both credential-file paths (mint + adopt). The numeric id becomes display-only — the printed credential now shows the username as client id and the number as dashboard id (a human reference at ai.tracebloc.io/clients, never an installer input).

Tests

Both existing credential-file tests codified the bug (TestClientCreate_CredentialFileMint asserted id=="5", ..._CredentialFileAdopt asserted id=="8" — the numeric ids, while the mocks carry distinct usernames u-5/u-8). Updated to require the username, so they now guard the invariant. TestClientCreate_AnchorMint additionally asserts the username is printed as the client id. Full suite green.

Follow-ups

• Cut CLI v0.5.1 from main once this lands (v0.5.0 shipped the bug).
• Revert client PR #293 (skip-verify for minted creds) — verify_credentials was a correct canary that #293 masked; restoring it, the installer e2e on dev should go green and the pod should authenticate.

Refs: RFC-0001 backend#830, installer credential handoff #838.

---

Note

Medium Risk
Wrong credentials broke all new RFC-0001 installs; the change is small but sits on the critical provisioning→auth path for every new client.

Overview
Fixes client crash-loops after tracebloc client create --credential-file by aligning TRACEBLOC_CLIENT_ID with what the jobs-manager pod actually sends to api-token-auth as the login username.

Mint and adopt credential-file paths now set TRACEBLOC_CLIENT_ID from pc.Username (the EdgeDevice UUID) instead of strconv.Itoa(pc.ID). When credentials are printed to the terminal, client id shows that username and the numeric id is labeled dashboard id only.

Tests that previously expected the numeric id in the env file and stdout were updated to require the username (u-5 / u-8), locking in the installer invariant.

^{Reviewed by Cursor Bugbot for commit 9fe85c5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 31 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#142 — feat(averaging): centroid clustering merge — KMeans/MiniBatchKMeans (Confirm installer client#303 pre-flight still works with a hidden client list #141) · author: @divyasinghds · no reviewer assigned
• averaging-service#143 — chore(release): promote develop → staging (week of 2026-07-06) · author: @aptracebloc · no reviewer assigned
• averaging-service#144 — feat(averaging): linear coefficient merge → registry; retire legacy ladder (Cat 2, RFC-0001 Rev 8: simplify CLI client surface (remove use, hide list, delete owns teardown) #139) · author: @divyasinghds · no reviewer assigned
• averaging-service#145 — feat(averaging): NearestCentroid / LDA / QDA merges (Cat 1 extras, e2e-verify client delete teardown against a throwaway k3d cluster #140) · author: @divyasinghds · no reviewer assigned
• backend#900 — RFC-GlobalMeta-PerRow-Storage · author: @saqlainsyed007 · no reviewer assigned
• backend#926 — chore(release): promote develop → staging (week of 2026-07-06) · author: @aptracebloc · reviewer: @saadqbal
• backend#927 — feat(validators): schema check for tabular/text/token classification (#924 G2) · author: @divyasinghds · no reviewer assigned
• backend#931 — feat(validators): generic all-category checks + validation matrix (#924 Phase 0/G12) · author: @divyasinghds · no reviewer assigned
• backend#932 — docs(rfc): RFC 0001 — layered pre-merge review pipeline (stop the Bugbot trickle) · author: @saadqbal · no reviewer assigned
• cli#124 — chore(release): promote develop → main (week of 2026-07-06) · author: @aptracebloc · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[aptracebloc]

Looks good!