@consiliency/agent-board-schema 1.10.0 → 1.22.0

package/tests/agent_board_fedsession_autojoin.test.sql

@@ -0,0 +1,181 @@
+-- FEDSESSION-AUTOJOIN pgTAP: enroll_federated_human auto-joins a freshly provisioned
+-- federated human to the provider's designated default board.
+--
+-- Proves: the additive default_board_id column + the service_role-only helper; a first
+-- provision with an ACTIVE designated board yields exactly one baseline 'member'/'joined'
+-- self-created membership tagged source=fedsession-autojoin; re-provision is idempotent (no
+-- duplicate); a NULL default_board_id yields no membership; an INACTIVE designated board is
+-- a non-fatal skip (the human still provisions, no membership); and a human who LEFT the
+-- board is NOT re-joined on re-provision (first-time-only). Runs as postgres
+-- (service_role-equivalent), mirroring agent_board_fedsession.test.sql.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(14);
+
+-- ---------------------------------------------------------------------------
+-- Phase 0: metadata + privileges
+-- ---------------------------------------------------------------------------
+-- 1
+select has_column('agent_board', 'identity_providers', 'default_board_id',
+  'identity_providers.default_board_id exists');
+-- 2
+select has_function('agent_board', '_fedsession_autojoin_default_board',
+  array['agent_board.identity_providers', 'uuid'],
+  '_fedsession_autojoin_default_board(identity_providers,uuid) exists');
+-- 3
+select function_privs_are('agent_board', '_fedsession_autojoin_default_board',
+  array['agent_board.identity_providers', 'uuid'], 'service_role', array['EXECUTE'],
+  'service_role may EXECUTE _fedsession_autojoin_default_board');
+-- 4
+select function_privs_are('agent_board', '_fedsession_autojoin_default_board',
+  array['agent_board.identity_providers', 'uuid'], 'authenticated', array[]::text[],
+  'authenticated may NOT EXECUTE _fedsession_autojoin_default_board');
+
+-- ---------------------------------------------------------------------------
+-- Fixtures + provisioning
+-- ---------------------------------------------------------------------------
+create temp table _aj (
+  board_active uuid, board_inactive uuid,
+  agent_h1 uuid, agent_h2 uuid, agent_h3 uuid,
+  iss1 text, sub1 text
+) on commit drop;
+grant all on table _aj to authenticated, service_role;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_owner_agent uuid;
+  v_board_active uuid; v_board_inactive uuid;
+  v_iss1 text; v_iss2 text; v_iss3 text;
+  v_sub1 text := 'aj-user1-';
+  v_h1 uuid; v_h2 uuid; v_h3 uuid;
+begin
+  v_iss1 := 'https://aj1-' || s || '.test';
+  v_iss2 := 'https://aj2-' || s || '.test';
+  v_iss3 := 'https://aj3-' || s || '.test';
+  v_sub1 := 'aj-user1-' || s;
+
+  -- A board-owner agent (created_by for the seeded boards).
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status)
+  values ('system', 'system'::agent_board.agent_kind, 'aj-owner-' || s, 'AJ Owner', 'active')
+  returning id into v_owner_agent;
+
+  -- An ACTIVE default board and an ARCHIVED (inactive) board.
+  insert into agent_board.boards(slug, name, created_by_agent_id, visibility, status)
+  values ('aj-active-' || s, 'AJ Active', v_owner_agent, 'private', 'active')
+  returning id into v_board_active;
+  insert into agent_board.boards(slug, name, created_by_agent_id, visibility, status)
+  values ('aj-inactive-' || s, 'AJ Inactive', v_owner_agent, 'private', 'archived')
+  returning id into v_board_inactive;
+
+  -- P1: default board = ACTIVE board -> provision H1 (should auto-join).
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_agent_kinds, default_board_id)
+  values (v_iss1, 'message-board', true, true, '{human}', v_board_active);
+  select e.agent_id into v_h1 from agent_board.enroll_federated_human(
+    v_iss1, 'message-board', v_sub1,
+    jsonb_build_object('sub', v_sub1, 'email_verified', false), 'H1') e;
+
+  -- P2: default board NULL -> provision H2 (no auto-join).
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_agent_kinds, default_board_id)
+  values (v_iss2, 'message-board', true, true, '{human}', null);
+  select e.agent_id into v_h2 from agent_board.enroll_federated_human(
+    v_iss2, 'message-board', 'aj-user2-' || s,
+    jsonb_build_object('sub', 'aj-user2-' || s, 'email_verified', false), 'H2') e;
+
+  -- P3: default board = INACTIVE board -> provision H3 (no auto-join; provision still succeeds).
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_agent_kinds, default_board_id)
+  values (v_iss3, 'message-board', true, true, '{human}', v_board_inactive);
+  select e.agent_id into v_h3 from agent_board.enroll_federated_human(
+    v_iss3, 'message-board', 'aj-user3-' || s,
+    jsonb_build_object('sub', 'aj-user3-' || s, 'email_verified', false), 'H3') e;
+
+  -- Idempotent re-provision of H1 (same issuer/sub) -> must NOT add a second membership.
+  perform e.agent_id from agent_board.enroll_federated_human(
+    v_iss1, 'message-board', v_sub1,
+    jsonb_build_object('sub', v_sub1, 'email_verified', false), 'H1') e;
+
+  insert into _aj values (v_board_active, v_board_inactive, v_h1, v_h2, v_h3, v_iss1, v_sub1);
+end
+$$;
+
+-- H1 auto-joined the ACTIVE default board ------------------------------------------------
+-- 5
+select is(
+  (select count(*)::int from agent_board.board_memberships m, _aj
+    where m.board_id = _aj.board_active and m.agent_id = _aj.agent_h1),
+  1, 'H1 has exactly one membership on the active default board (idempotent after re-provision)');
+-- 6
+select is(
+  (select m.role from agent_board.board_memberships m, _aj
+    where m.board_id = _aj.board_active and m.agent_id = _aj.agent_h1),
+  'member', 'auto-join role is baseline member (never owner/admin)');
+-- 7
+select is(
+  (select m.membership_state from agent_board.board_memberships m, _aj
+    where m.board_id = _aj.board_active and m.agent_id = _aj.agent_h1),
+  'joined', 'auto-join membership_state is joined');
+-- 8
+select is(
+  (select m.created_by_agent_id from agent_board.board_memberships m, _aj
+    where m.board_id = _aj.board_active and m.agent_id = _aj.agent_h1),
+  (select agent_h1 from _aj), 'auto-join created_by is the fed-human itself (self-join)');
+-- 9
+select is(
+  (select m.metadata->>'source' from agent_board.board_memberships m, _aj
+    where m.board_id = _aj.board_active and m.agent_id = _aj.agent_h1),
+  'fedsession-autojoin', 'auto-join membership tagged source=fedsession-autojoin');
+-- 10
+select is(
+  (select count(distinct m.id)::int from agent_board.board_memberships m, _aj
+    where m.board_id = _aj.board_active and m.agent_id = _aj.agent_h1),
+  1, 'no duplicate membership rows after re-provision (idempotent)');
+
+-- NULL default board -> no auto-join -----------------------------------------------------
+-- 11
+select is(
+  (select count(*)::int from agent_board.board_memberships m, _aj
+    where m.agent_id = _aj.agent_h2),
+  0, 'H2 (provider default_board_id NULL) got NO auto-join membership');
+
+-- INACTIVE default board -> non-fatal skip -----------------------------------------------
+-- 12
+select ok((select agent_h3 is not null from _aj),
+  'H3 provisioned successfully even though its designated default board is inactive');
+-- 13
+select is(
+  (select count(*)::int from agent_board.board_memberships m, _aj
+    where m.board_id = _aj.board_inactive and m.agent_id = _aj.agent_h3),
+  0, 'inactive default board yields NO auto-join (non-fatal skip)');
+
+-- Left-respect: a human who LEFT the board is NOT re-joined on re-provision ---------------
+update agent_board.board_memberships m
+   set membership_state = 'left', left_at = now()
+  from _aj
+ where m.board_id = _aj.board_active and m.agent_id = _aj.agent_h1;
+
+do $$
+declare r record;
+begin
+  select iss1, sub1 into r from _aj;
+  perform e.agent_id from agent_board.enroll_federated_human(
+    r.iss1, 'message-board', r.sub1,
+    jsonb_build_object('sub', r.sub1, 'email_verified', false), 'H1') e;
+end
+$$;
+
+-- 14
+select is(
+  (select count(*)::int from agent_board.board_memberships m, _aj
+    where m.board_id = _aj.board_active and m.agent_id = _aj.agent_h1
+      and m.membership_state = 'joined'),
+  0, 'a fed-human who LEFT the default board is NOT re-joined on re-provision (first-time-only)');
+
+select * from finish();
+rollback;

package/tests/agent_board_fleet_domain_reclaim.test.sql

@@ -0,0 +1,419 @@
+-- #153 whole-domain squatting arbitration — reassign a squatted fleet_trust_domain's owner.
+--
+-- reclaim_fleet_trust_domain (service_role only) is the operator arbitration path for a WHOLE
+-- domain squatted by someone other than its rightful owner — the residual #150's machine-level
+-- reclaim could not cover. It reassigns fleet_trust_domains.owner_agent_id to the arbitrated new
+-- owner under a row lock; the reassignment is atomic at the domain row and post-commit every authz
+-- site (revoke_fleet_subject('trust_domain'), register_fleet_machine, set_fleet_receive_policy) reads
+-- the new owner. SERIALIZATION CAVEAT (#159): only revoke_fleet_subject('trust_domain') is locked
+-- against an in-flight reclaim here; register_fleet_machine / set_fleet_receive_policy are NOT yet
+-- serialized (tracked in #159). It writes NO fleet_revocation_events row (a trust_domain ledger row
+-- over-denies the whole domain incl. the new owner — #150 divergence rationale), and APPENDS the
+-- audit to metadata.reclaim_history.
+--
+-- These assertions pin:
+--   * reclaim reassigns owner_agent_id (state + returned prior owner) — PIN: skip the reassign ⇒
+--     (3)/(10)/(12)/(13) fail (owner stays squatter, authority does not move).
+--   * NO trust_domain revocation event is written by reclaim (7) — PIN: add a revoke-event write ⇒
+--     a row appears ⇒ (7) fails. Pins the over-deny divergence rationale.
+--   * NON-GOAL scope: a machine in the reclaimed domain KEEPS owner=squatter (8) — PIN: also
+--     reassign machine owners ⇒ (8) fails. Documents domain-vs-machine separation.
+--   * AUTHORITY BRACKET (rule #2/#3): each authority probe is bracketed by a BEFORE probe under the
+--     same authenticated principal proving current_agent_id() resolves — so an AFTER flip is a
+--     genuine authority change, not a null-actor artifact. register_fleet_machine into the domain is
+--     the reversible authority lever: squatter CAN before / CANNOT after; new owner CANNOT before /
+--     CAN after (9-12). The kill switch itself: squatter's revoke('trust_domain') is REFUSED after
+--     reclaim (13) — PIN: skip reassign ⇒ squatter still owns ⇒ not refused ⇒ (13) fails.
+--   * reclaim is operator-only: an authenticated caller (the victim) is refused 42501 (14) — PIN:
+--     remove the _is_service_role() body guard ⇒ (14) fails (body guard isolated from the ACL by a
+--     temp grant to authenticated).
+--   * reclaim validates the new owner + provenance agent exist and the domain exists (15,16,17).
+--   * REVOKED-DOMAIN RESIDUAL (documented, positive pin): reclaim of a domain the squatter already
+--     revoked SUCCEEDS + transfers owner (18,19) but the domain STAYS revoked (20) — no domain
+--     un-revoke path today. Pins the boundary positively (rule #1) rather than leaving a silent gap.
+--   * AUDIT APPEND (rule #2): a second reclaim APPENDS to reclaim_history (21) — PIN: overwrite ⇒
+--     length stays 1 ⇒ (21) fails.
+--   * CLASS (rule #1 / EC-4): reclaim_fleet_trust_domain is the ONLY function-writer of
+--     fleet_trust_domains.owner_agent_id (22) — catalog-derived, so a future owner-writer names
+--     itself. (No RPC INSERTs a domain; domains are seeded by direct table INSERT, which is not a
+--     function and cannot match.)
+--
+-- Tests run as session_user=postgres ⇒ _is_service_role() is true; probes and the authz assertion
+-- flip to role=authenticated (jwt claims) to exercise the principal / body guard.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(22);
+
+-- (1) Shape.
+select has_function(
+  'agent_board', 'reclaim_fleet_trust_domain',
+  array['uuid', 'uuid', 'uuid', 'text'],
+  'reclaim_fleet_trust_domain exists'
+);
+
+create temp table _dr_fx (
+  operator uuid,      -- arbitration actor (p_reclaimed_by); no auth mapping needed
+  squatter uuid,      -- squats the domains; owner of dom_core/dom_revoked/dom_authz
+  new_owner uuid,     -- arbitrated rightful owner
+  victim uuid,        -- used for the operator-only authz probe
+  dom_core uuid,      -- main reclaim + authority + kill-switch
+  dom_revoked uuid,   -- revoked by the squatter BEFORE reclaim (residual pin)
+  dom_authz uuid,     -- operator-only probe target
+  m_core uuid,        -- a machine in dom_core (non-goal: stays owned by squatter)
+  squatter_user uuid,
+  new_owner_user uuid,
+  victim_user uuid
+) on commit drop;
+grant all on table _dr_fx to authenticated, service_role;
+
+create temp table _dr_probe (label text, allowed boolean) on commit drop;
+grant all on table _dr_probe to authenticated, service_role;
+
+do $$
+declare
+  v_operator uuid := gen_random_uuid();
+  v_squatter uuid := gen_random_uuid();
+  v_new_owner uuid := gen_random_uuid();
+  v_victim uuid := gen_random_uuid();
+  v_dom_core uuid;
+  v_dom_revoked uuid;
+  v_dom_authz uuid;
+  v_m_core uuid;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_operator, 'agent', 'dr-operator', 'DR Operator'),
+    (v_squatter, 'agent', 'dr-squatter', 'DR Squatter'),
+    (v_new_owner, 'agent', 'dr-new-owner', 'DR New Owner'),
+    (v_victim, 'agent', 'dr-victim', 'DR Victim');
+
+  -- All three domains are squatted (owned by the squatter). dom_core + dom_authz active; dom_revoked
+  -- active now (revoked below via the squatter's own kill switch to exercise the residual).
+  insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values
+    ('dr-domain-core', 'DR Domain Core', 'tailnet', v_squatter, 'active', now()),
+    ('dr-domain-revoked', 'DR Domain Revoked', 'tailnet', v_squatter, 'active', now()),
+    ('dr-domain-authz', 'DR Domain Authz', 'tailnet', v_squatter, 'active', now());
+  select id into v_dom_core from agent_board.fleet_trust_domains where slug = 'dr-domain-core';
+  select id into v_dom_revoked from agent_board.fleet_trust_domains where slug = 'dr-domain-revoked';
+  select id into v_dom_authz from agent_board.fleet_trust_domains where slug = 'dr-domain-authz';
+
+  -- A machine the squatter owns inside dom_core (non-goal: domain reclaim must NOT reassign it).
+  select machine_id into v_m_core from agent_board.register_fleet_machine(
+    v_squatter, v_dom_core, 'dr-m-core', 'sha256:dr-m-core', 'portal', '{"redacted":true}'::jsonb);
+
+  insert into _dr_fx(operator, squatter, new_owner, victim, dom_core, dom_revoked, dom_authz, m_core)
+  values (v_operator, v_squatter, v_new_owner, v_victim, v_dom_core, v_dom_revoked, v_dom_authz, v_m_core);
+end
+$$;
+
+-- Map the squatter, new owner and victim agents to auth users so the authenticated probes/authz
+-- call resolve a principal via current_agent_id() → auth.uid().
+do $$
+declare
+  v_sfx text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_squatter_user uuid;
+  v_new_owner_user uuid;
+  v_victim_user uuid;
+begin
+  v_squatter_user := public.ensure_github_user('dr-squatter-' || v_sfx, 'dr-squatter-' || v_sfx || '@example.test', 'dr-squatter-' || v_sfx, 'DR Squatter ' || v_sfx);
+  v_new_owner_user := public.ensure_github_user('dr-newowner-' || v_sfx, 'dr-newowner-' || v_sfx || '@example.test', 'dr-newowner-' || v_sfx, 'DR New Owner ' || v_sfx);
+  v_victim_user := public.ensure_github_user('dr-victim-' || v_sfx, 'dr-victim-' || v_sfx || '@example.test', 'dr-victim-' || v_sfx, 'DR Victim ' || v_sfx);
+
+  update agent_board.agents set auth_user_id = v_squatter_user where id = (select squatter from _dr_fx);
+  update agent_board.agents set auth_user_id = v_new_owner_user where id = (select new_owner from _dr_fx);
+  update agent_board.agents set auth_user_id = v_victim_user where id = (select victim from _dr_fx);
+
+  update _dr_fx set squatter_user = v_squatter_user, new_owner_user = v_new_owner_user, victim_user = v_victim_user;
+end
+$$;
+
+------------------------------------------------------------------------------------------
+-- BEFORE authority probes (rule #2/#3 bracket): register_fleet_machine into dom_core is the
+-- reversible authority lever (requires ftd.owner_agent_id = actor). The squatter (owner) CAN; the
+-- new owner CANNOT — proving both principals resolve, so the AFTER flips below are genuine.
+------------------------------------------------------------------------------------------
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select squatter_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.register_fleet_machine((select squatter from _dr_fx), (select dom_core from _dr_fx),
+      'dr-m-sqbefore', 'sha256:dr-m-sqbefore', 'portal', '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('squatter_before', true);
+  exception when sqlstate '42501' then insert into _dr_probe values ('squatter_before', false);
+  end;
+end $$;
+select set_config('request.jwt.claim.sub', (select new_owner_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.register_fleet_machine((select new_owner from _dr_fx), (select dom_core from _dr_fx),
+      'dr-m-nobefore', 'sha256:dr-m-nobefore', 'portal', '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('new_owner_before', true);
+  exception when sqlstate '42501' then insert into _dr_probe values ('new_owner_before', false);
+  end;
+end $$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+------------------------------------------------------------------------------------------
+-- CORE: operator reclaims dom_core from the squatter to the new owner.
+------------------------------------------------------------------------------------------
+-- (2) Reclaim succeeds (allow-side lives_ok + separate state reads, #113).
+select lives_ok(
+  $$ create temp table _dr_core as
+       select * from agent_board.reclaim_fleet_trust_domain(
+         (select dom_core from _dr_fx), (select new_owner from _dr_fx),
+         (select operator from _dr_fx), 'operator arbitrated: domain belongs to new owner') $$,
+  'core: service_role reclaim of dom_core succeeds'
+);
+
+-- (3) Owner is reassigned. MUTATION PIN: skipping the owner reassignment leaves owner=squatter.
+select is(
+  (select owner_agent_id from agent_board.fleet_trust_domains where id = (select dom_core from _dr_fx)),
+  (select new_owner from _dr_fx),
+  'core: reclaim reassigns owner_agent_id to the new owner'
+);
+
+-- (4) The returned prior owner is the squatter.
+select is(
+  (select prior_owner_agent_id from _dr_core),
+  (select squatter from _dr_fx),
+  'core: reclaim returns the prior owner (the squatter)'
+);
+
+-- (5) Audit APPENDED to metadata.reclaim_history: last record has operator + prior owner.
+select ok(
+  (select (metadata -> 'reclaim_history' -> -1 ->> 'reclaimed_by') = (select operator::text from _dr_fx)
+      and (metadata -> 'reclaim_history' -> -1 ->> 'prior_owner') = (select squatter::text from _dr_fx)
+     from agent_board.fleet_trust_domains where id = (select dom_core from _dr_fx)),
+  'core: reclaim audit (reclaimed_by + prior owner) appended to metadata.reclaim_history'
+);
+
+-- (6) The audit records the prior lifecycle (active here) — makes the revoked residual visible.
+select is(
+  (select metadata -> 'reclaim_history' -> -1 ->> 'prior_lifecycle_state'
+     from agent_board.fleet_trust_domains where id = (select dom_core from _dr_fx)),
+  'active',
+  'core: reclaim audit records prior_lifecycle_state'
+);
+
+-- (7) NO trust_domain revocation event is written by reclaim (over-deny divergence rationale).
+-- MUTATION PIN: adding a fleet_revocation_events write to reclaim makes a row appear → this flips.
+select is(
+  (select count(*)::integer from agent_board.fleet_revocation_events
+     where subject_kind = 'trust_domain' and subject_id = (select dom_core from _dr_fx)),
+  0,
+  'core: reclaim writes NO trust_domain revocation event (no over-deny)'
+);
+
+-- (8) NON-GOAL: a machine in dom_core KEEPS owner=squatter (domain reclaim ≠ machine reclaim).
+-- MUTATION PIN: also reassigning machine owners in reclaim flips this to new_owner.
+select is(
+  (select owner_agent_id from agent_board.fleet_machines where id = (select m_core from _dr_fx)),
+  (select squatter from _dr_fx),
+  'non-goal: a machine in the reclaimed domain keeps owner=squatter'
+);
+
+------------------------------------------------------------------------------------------
+-- AFTER authority probes: register authority on dom_core post-reclaim, then the kill switch.
+------------------------------------------------------------------------------------------
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select squatter_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.register_fleet_machine((select squatter from _dr_fx), (select dom_core from _dr_fx),
+      'dr-m-sqafter', 'sha256:dr-m-sqafter', 'portal', '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('squatter_after', true);
+  exception when sqlstate '42501' then insert into _dr_probe values ('squatter_after', false);
+  end;
+end $$;
+select set_config('request.jwt.claim.sub', (select new_owner_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.register_fleet_machine((select new_owner from _dr_fx), (select dom_core from _dr_fx),
+      'dr-m-noafter', 'sha256:dr-m-noafter', 'portal', '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('new_owner_after', true);
+  exception when sqlstate '42501' then insert into _dr_probe values ('new_owner_after', false);
+  end;
+end $$;
+-- Kill switch: the squatter (no longer owner) tries revoke_fleet_subject('trust_domain', dom_core).
+select set_config('request.jwt.claim.sub', (select squatter_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.revoke_fleet_subject('trust_domain', (select dom_core from _dr_fx),
+      (select squatter from _dr_fx), 'squatter tries the kill switch after losing the domain',
+      '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('squatter_killswitch_denied', false);   -- reached completion → NOT denied
+  exception when sqlstate '42501' then insert into _dr_probe values ('squatter_killswitch_denied', true);
+  end;
+end $$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- (9)(10) Authority lever (register): squatter COULD before (bracket) → CANNOT after (PIN skip reassign).
+select is((select allowed from _dr_probe where label = 'squatter_before'), true,
+  'bracket: the squatter (owner) could register into dom_core before reclaim');
+select is((select allowed from _dr_probe where label = 'squatter_after'), false,
+  'squatter: loses domain authority (cannot register into dom_core) after reclaim');
+-- (11)(12) New owner: CANNOT before (bracket) → CAN after (PIN skip reassign).
+select is((select allowed from _dr_probe where label = 'new_owner_before'), false,
+  'bracket: the new owner could NOT register into dom_core before reclaim');
+select is((select allowed from _dr_probe where label = 'new_owner_after'), true,
+  'new owner: gains domain authority (can register into dom_core) after reclaim');
+-- (13) KILL SWITCH removed: the squatter's revoke('trust_domain') is refused after reclaim.
+-- MUTATION PIN: skipping the owner reassign leaves the squatter owning dom_core → revoke is NOT
+-- refused → denied=false → this flips.
+select is((select allowed from _dr_probe where label = 'squatter_killswitch_denied'), true,
+  'kill-switch: the squatter''s revoke(trust_domain) is refused (42501) after reclaim');
+
+------------------------------------------------------------------------------------------
+-- AUTHZ (dom_authz): operator-only. An authenticated caller (the victim) is refused. The BODY guard
+-- is isolated from the service_role-only grant by a temp grant to authenticated.
+------------------------------------------------------------------------------------------
+create temp table _dr_authz (denied boolean) on commit drop;
+grant all on table _dr_authz to authenticated, service_role;
+
+grant execute on function agent_board.reclaim_fleet_trust_domain(uuid, uuid, uuid, text) to authenticated;
+
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select victim_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform * from agent_board.reclaim_fleet_trust_domain(
+      (select dom_authz from _dr_fx), (select victim from _dr_fx),
+      (select victim from _dr_fx), 'victim self-reclaim attempt');
+    insert into _dr_authz values (false);   -- reached completion → NOT denied
+  exception when sqlstate '42501' then insert into _dr_authz values (true);
+  end;
+end
+$$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+revoke execute on function agent_board.reclaim_fleet_trust_domain(uuid, uuid, uuid, text) from authenticated;
+
+-- (14) MUTATION PIN: removing the _is_service_role() body guard lets the authenticated call
+-- complete → denied=false → this flips.
+select ok(
+  (select denied from _dr_authz),
+  'authz: authenticated caller (the victim) cannot reclaim (42501) — operator-only'
+);
+
+------------------------------------------------------------------------------------------
+-- VALIDATION.
+------------------------------------------------------------------------------------------
+-- (15) unknown new owner
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_trust_domain(%L::uuid, %L::uuid, %L::uuid, 'unknown new owner') $$,
+    (select dom_authz from _dr_fx), gen_random_uuid(), (select operator from _dr_fx)),
+  '22023', NULL, 'validate: reclaim to an unknown new owner raises'
+);
+-- (16) unknown provenance
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_trust_domain(%L::uuid, %L::uuid, %L::uuid, 'unknown provenance') $$,
+    (select dom_authz from _dr_fx), (select new_owner from _dr_fx), gen_random_uuid()),
+  '22023', NULL, 'validate: reclaim with an unknown reclaimed_by agent raises'
+);
+-- (17) unknown domain
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_trust_domain(%L::uuid, %L::uuid, %L::uuid, 'unknown domain') $$,
+    gen_random_uuid(), (select new_owner from _dr_fx), (select operator from _dr_fx)),
+  '22023', NULL, 'validate: reclaim of a non-existent domain raises'
+);
+
+------------------------------------------------------------------------------------------
+-- REVOKED-DOMAIN RESIDUAL (documented, positive pin): the squatter revokes dom_revoked first; the
+-- operator then reclaims it. Ownership transfers, but the domain STAYS revoked (no un-revoke path).
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform agent_board.revoke_fleet_subject('trust_domain', (select dom_revoked from _dr_fx),
+    (select squatter from _dr_fx), 'squatter revoke before arbitration', '{"redacted":true}'::jsonb);
+end
+$$;
+-- (18)
+select lives_ok(
+  $$ select * from agent_board.reclaim_fleet_trust_domain(
+       (select dom_revoked from _dr_fx), (select new_owner from _dr_fx),
+       (select operator from _dr_fx), 'reclaim a revoked-then-squatted domain') $$,
+  'revoked-residual: reclaiming a revoked domain succeeds'
+);
+-- (19)
+select is(
+  (select owner_agent_id from agent_board.fleet_trust_domains where id = (select dom_revoked from _dr_fx)),
+  (select new_owner from _dr_fx),
+  'revoked-residual: reclaim of a revoked domain still transfers ownership'
+);
+-- (20) BOUNDARY AS BEHAVIOR: the owner-transfer SUCCEEDED (owner=new_owner) AND the domain is STILL
+-- revoked — one compound assertion so the intentional residual is pinned as behavior, not inferred
+-- across two checks. PIN (mutation H): making reclaim revive the domain (lifecycle='active' on the
+-- revoked branch) flips this; skipping the reassign (owner stays squatter) also flips it.
+select ok(
+  (select owner_agent_id = (select new_owner from _dr_fx) and lifecycle_state = 'revoked'
+     from agent_board.fleet_trust_domains where id = (select dom_revoked from _dr_fx)),
+  'revoked-residual: after a successful owner-transfer the pre-revoked domain STAYS revoked (intentional boundary)'
+);
+
+------------------------------------------------------------------------------------------
+-- AUDIT APPEND (rule #2): a SECOND reclaim of dom_core APPENDS to reclaim_history.
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform * from agent_board.reclaim_fleet_trust_domain(
+    (select dom_core from _dr_fx), (select victim from _dr_fx),
+    (select operator from _dr_fx), 'second arbitration on the same domain');
+end
+$$;
+-- (21) MUTATION PIN: reverting the audit to overwrite (single-element array / flat keys) leaves
+-- reclaim_history at length 1 → this flips.
+select is(
+  (select jsonb_array_length(metadata -> 'reclaim_history') from agent_board.fleet_trust_domains where id = (select dom_core from _dr_fx)),
+  2,
+  'audit: a repeated reclaim appends to reclaim_history (prior record preserved)'
+);
+
+------------------------------------------------------------------------------------------
+-- CLASS (rule #1 / EC-4): catalog-derived — reclaim_fleet_trust_domain is the ONLY writer of
+-- fleet_trust_domains.owner_agent_id. A future owner-writer appears here BY NAME. WRITER = a
+-- function whose definition INSERTs owner_agent_id into fleet_trust_domains or UPDATEs
+-- fleet_trust_domains assigning owner_agent_id. Reads (WHERE owner_agent_id = ...) and the lifecycle
+-- -only revoke UPDATE (no owner_agent_id =) do not match. Aggregates excluded (prokind='f').
+------------------------------------------------------------------------------------------
+-- (22)
+select is(
+  (
+    select string_agg(proname, ', ' order by proname)
+      from (
+        select p.proname
+          from pg_proc p
+          join pg_namespace n on n.oid = p.pronamespace
+         where n.nspname = 'agent_board'
+           and p.prokind = 'f'
+           and (
+             pg_get_functiondef(p.oid) ~ 'insert into agent_board\.fleet_trust_domains\s*\([^)]*owner_agent_id'
+             or pg_get_functiondef(p.oid) ~ 'update agent_board\.fleet_trust_domains[^;]*owner_agent_id\s*='
+           )
+      ) writers
+  ),
+  'reclaim_fleet_trust_domain',
+  'class: reclaim_fleet_trust_domain is the only writer of fleet_trust_domains.owner_agent_id (a new writer names itself)'
+);
+
+select * from finish();
+
+rollback;