@consiliency/agent-board-schema 1.10.0 → 1.22.0

package/tests/agent_board_inbox_rpcs.test.sql

@@ -1,6 +1,13 @@
 begin;
 
-select plan(19);
+select plan(51);
+
+-- The 32 behavioral assertions below run inside a `do` block. pgTAP assertions
+-- must NOT be called via `perform` there: `perform is(...)` RUNS the assertion
+-- (incrementing the plan counter) but DISCARDS the returned TAP line, so a
+-- failure prints no `not ok` and ships green (message-board#87). Buffer each line
+-- into this temp table and emit them after the block.
+create temp table _tap (seq serial primary key, line text) on commit drop;
 
 select has_function(
   'agent_board',
@@ -231,38 +238,38 @@ begin
       'private'
     );
   v_board := v_result.board_id;
-  perform ok(v_board is not null, 'create_board returns a board id');
+  insert into _tap(line) select ok(v_board is not null, 'create_board returns a board id');
 
   select * into v_result
     from agent_board.join_board(v_board, v_board_member, 'subscribed', v_sender, '{}'::jsonb);
-  perform is(v_result.membership_state, 'subscribed', 'join_board supports subscribed state');
+  insert into _tap(line) select is(v_result.membership_state, 'subscribed', 'join_board supports subscribed state');
 
   select * into v_result
     from agent_board.join_board(v_board, v_direct_recipient, 'joined', v_sender, '{}'::jsonb);
-  perform is(v_result.membership_state, 'joined', 'join_board supports joined state');
+  insert into _tap(line) select is(v_result.membership_state, 'joined', 'join_board supports joined state');
 
   select * into v_result
     from agent_board.join_board(v_board, v_left_member, 'joined', v_sender, '{}'::jsonb);
   select * into v_result
     from agent_board.leave_board(v_board, v_left_member, '{}'::jsonb);
-  perform is(v_result.membership_state, 'left', 'leave_board marks memberships as left');
+  insert into _tap(line) select is(v_result.membership_state, 'left', 'leave_board marks memberships as left');
 
   select * into v_result
     from agent_board.register_callback_endpoint(v_direct_recipient, 'https://example.test/direct', '{}'::jsonb);
   v_direct_endpoint := v_result.endpoint_id;
-  perform is(v_result.endpoint_status, 'pending_verification', 'register_callback_endpoint starts pending verification');
+  insert into _tap(line) select is(v_result.endpoint_status, 'pending_verification', 'register_callback_endpoint starts pending verification');
 
   select * into v_result
     from agent_board.verify_callback_endpoint(v_direct_endpoint, v_direct_recipient, '{"controlProofRef":"inbox-rpcs/direct"}'::jsonb);
-  perform is(v_result.endpoint_status, 'verified', 'verify_callback_endpoint marks endpoint verified');
+  insert into _tap(line) select is(v_result.endpoint_status, 'verified', 'verify_callback_endpoint marks endpoint verified');
 
   select * into v_result
     from agent_board.subscribe_callback_endpoint(v_direct_endpoint, v_direct_recipient, 'own_inbox', 'inbox.item.delivered', null, '{}'::jsonb);
-  perform is(v_result.subscription_status, 'active', 'own-inbox callback subscription activates');
+  insert into _tap(line) select is(v_result.subscription_status, 'active', 'own-inbox callback subscription activates');
 
   select * into v_result
     from agent_board.subscribe_callback_endpoint(v_direct_endpoint, v_direct_recipient, 'own_inbox', 'inbox.item.updated', null, '{}'::jsonb);
-  perform is(v_result.subscription_status, 'active', 'own-inbox update subscription activates');
+  insert into _tap(line) select is(v_result.subscription_status, 'active', 'own-inbox update subscription activates');
 
   select * into v_result
     from agent_board.register_callback_endpoint(v_board_member, 'https://example.test/board', '{}'::jsonb);
@@ -271,7 +278,7 @@ begin
     from agent_board.verify_callback_endpoint(v_board_endpoint, v_board_member, '{"controlProofRef":"inbox-rpcs/board"}'::jsonb);
   select * into v_result
     from agent_board.subscribe_callback_endpoint(v_board_endpoint, v_board_member, 'board', 'board.post.delivered', v_board, '{}'::jsonb);
-  perform is(v_result.subscription_status, 'active', 'board callback subscription activates for active member');
+  insert into _tap(line) select is(v_result.subscription_status, 'active', 'board callback subscription activates for active member');
 
   select * into v_result
     from agent_board.register_callback_endpoint(v_outsider, 'https://example.test/outsider', '{}'::jsonb);
@@ -279,10 +286,10 @@ begin
 
   begin
     perform agent_board.subscribe_callback_endpoint(v_outsider_endpoint, v_outsider, 'board', 'board.post.delivered', v_board, '{}'::jsonb);
-    perform ok(false, 'board subscription without membership should fail');
+    insert into _tap(line) select ok(false, 'board subscription without membership should fail');
   exception
     when sqlstate 'P0002' then
-      perform ok(true, 'board subscription requires active board membership');
+      insert into _tap(line) select ok(true, 'board subscription requires active board membership');
   end;
 
   select * into v_result
@@ -299,13 +306,13 @@ begin
     );
   v_direct_message := v_result.message_id;
   v_direct_inbox := v_result.inbox_item_id;
-  perform is(v_result.callback_outbox_count, 1, 'direct delivery enqueues one own-inbox callback');
-  perform is(
+  insert into _tap(line) select is(v_result.callback_outbox_count, 1, 'direct delivery enqueues one own-inbox callback');
+  insert into _tap(line) select is(
     (select count(*)::integer from agent_board.delivery_recipients where source_message_id = v_direct_message),
     1,
     'direct delivery writes one recipient row'
   );
-  perform is(
+  insert into _tap(line) select is(
     (select count(*)::integer from agent_board.inbox_items where source_message_id = v_direct_message),
     1,
     'direct delivery writes one inbox row'
@@ -323,8 +330,8 @@ begin
       'direct-key',
       '{}'::jsonb
     );
-  perform is(v_result.message_id, v_direct_message, 'direct idempotency reuses canonical message');
-  perform is(
+  insert into _tap(line) select is(v_result.message_id, v_direct_message, 'direct idempotency reuses canonical message');
+  insert into _tap(line) select is(
     (select count(*)::integer from agent_board.callback_outbox_events where source_message_id = v_direct_message and event_category = 'inbox.item.delivered'),
     1,
     'direct idempotency does not duplicate delivered callback events'
@@ -332,8 +339,8 @@ begin
 
   select * into v_result
     from agent_board.update_inbox_item_state(v_direct_inbox, v_direct_recipient, 'read', '{}'::jsonb);
-  perform is(v_result.action_state, 'read', 'update_inbox_item_state changes action state');
-  perform is(
+  insert into _tap(line) select is(v_result.action_state, 'read', 'update_inbox_item_state changes action state');
+  insert into _tap(line) select is(
     (select count(*)::integer from agent_board.callback_outbox_events where inbox_item_id = v_direct_inbox and event_category = 'inbox.item.updated'),
     1,
     'updating inbox state enqueues one inbox.item.updated callback'
@@ -351,8 +358,8 @@ begin
       'multicast-key',
       '{}'::jsonb
     );
-  perform is(v_result.delivered_recipient_count, 2, 'multicast collapses duplicate recipients');
-  perform is(
+  insert into _tap(line) select is(v_result.delivered_recipient_count, 2, 'multicast collapses duplicate recipients');
+  insert into _tap(line) select is(
     (select count(*)::integer from agent_board.delivery_recipients where source_message_id = v_result.message_id),
     2,
     'multicast writes one recipient row per unique recipient'
@@ -371,13 +378,13 @@ begin
       '{}'::jsonb
     );
   v_board_message := v_result.message_id;
-  perform is(v_result.delivered_recipient_count, 3, 'board delivery reaches joined and subscribed members only (incl. the seeded owner-creator)');
-  perform is(
+  insert into _tap(line) select is(v_result.delivered_recipient_count, 3, 'board delivery reaches joined and subscribed members only (incl. the seeded owner-creator)');
+  insert into _tap(line) select is(
     (select count(*)::integer from agent_board.delivery_recipients where source_message_id = v_board_message and recipient_agent_id = v_left_member),
     0,
     'left board members do not receive board delivery'
   );
-  perform ok(
+  insert into _tap(line) select ok(
     exists(
       select 1
         from agent_board.callback_outbox_events
@@ -402,13 +409,13 @@ begin
       '{}'::jsonb
     );
   v_task := v_result.task_id;
-  perform is(v_result.delivered_recipient_count, 4, 'tasking counts explicit and board fan-out attempts (incl. the seeded owner-creator)');
-  perform is(
+  insert into _tap(line) select is(v_result.delivered_recipient_count, 4, 'tasking counts explicit and board fan-out attempts (incl. the seeded owner-creator)');
+  insert into _tap(line) select is(
     (select count(*)::integer from agent_board.delivery_recipients where source_task_id = v_task),
     3,
     'tasking suppresses duplicate recipient rows across explicit and board fan-out'
   );
-  perform is(
+  insert into _tap(line) select is(
     (select count(*)::integer from agent_board.inbox_items where source_task_id = v_task),
     3,
     'tasking writes one inbox row per unique recipient'
@@ -416,13 +423,13 @@ begin
 
   select * into v_result
     from agent_board.rotate_callback_signing_key(v_direct_endpoint, v_direct_recipient, '{}'::jsonb);
-  perform is(v_result.signing_key_version, 2, 'rotate_callback_signing_key bumps signing key version');
-  perform is(v_result.endpoint_status, 'pending_verification', 'signing key rotation returns endpoint to pending verification');
+  insert into _tap(line) select is(v_result.signing_key_version, 2, 'rotate_callback_signing_key bumps signing key version');
+  insert into _tap(line) select is(v_result.endpoint_status, 'pending_verification', 'signing key rotation returns endpoint to pending verification');
 
   select * into v_result
     from agent_board.disable_callback_endpoint(v_board_endpoint, v_board_member, 'test disable', '{}'::jsonb);
-  perform is(v_result.endpoint_status, 'disabled', 'disable_callback_endpoint marks endpoint disabled');
-  perform ok(
+  insert into _tap(line) select is(v_result.endpoint_status, 'disabled', 'disable_callback_endpoint marks endpoint disabled');
+  insert into _tap(line) select ok(
     exists(
       select 1
         from agent_board.callback_subscriptions
@@ -434,13 +441,13 @@ begin
 
   select * into v_result
     from agent_board.unsubscribe_callback_endpoint(v_direct_endpoint, v_direct_recipient, 'own_inbox', 'inbox.item.updated', null, '{}'::jsonb);
-  perform is(v_result.subscription_status, 'disabled', 'unsubscribe_callback_endpoint disables an active subscription');
+  insert into _tap(line) select is(v_result.subscription_status, 'disabled', 'unsubscribe_callback_endpoint disables an active subscription');
 
   select * into v_result
     from agent_board.delete_callback_endpoint(v_outsider_endpoint, v_outsider);
-  perform ok(v_result.deleted, 'delete_callback_endpoint removes owned endpoints');
+  insert into _tap(line) select ok(v_result.deleted, 'delete_callback_endpoint removes owned endpoints');
 
-  perform is(
+  insert into _tap(line) select is(
     (select count(*)::integer from agent_board.callback_delivery_attempts),
     0,
     'callback management remains metadata-only before runtime delivery exists'
@@ -448,5 +455,8 @@ begin
 end;
 $$;
 
+-- Emit the buffered TAP lines (tests 20-51) that the `do` block produced.
+select line from _tap order by seq;
+
 select * from finish();
 rollback;

package/tests/agent_board_invitepolicy.test.sql

@@ -0,0 +1,205 @@
+-- INVITEPOLICY (#90) pgTAP: a target can block a specific inviter on a specific board.
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role()
+-- (''/service_role => true, 'authenticated' => false), request.jwt.claim.sub picks the
+-- acting agent (so ACL grants do not gate these calls — behavior is under test, not ACLs).
+--
+-- The DENY assertion (blocked inviter's invite raises 42501) is the mutation pin: delete the
+-- guard line in invite_board_member and it stops raising -> the test fails. The ALLOW twins
+-- (un-blocked inviter, other inviter, service_role operator, unblock, and a merely-'left'
+-- target) guard against over-blocking, including the REJECTSEM overload (a voluntary leaver
+-- must stay re-invitable).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(21);
+
+create temp table _ip_fixture (
+  board uuid,
+  creator uuid,       -- owner (seeded by create_board); acts as inviter1
+  inviter2 uuid,      -- non-creator 'member'; a second, distinct inviter
+  target uuid,        -- the invited agent that sets a block
+  target2 uuid,       -- a different agent (actor-binding negative test)
+  leftguy uuid,       -- a 'left' member (REJECTSEM re-invite guard)
+  creator_user uuid,
+  inviter2_user uuid,
+  target_user uuid,
+  target2_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_creator_user uuid;
+  v_inviter2_user uuid;
+  v_target_user uuid;
+  v_target2_user uuid;
+  v_creator uuid := gen_random_uuid();
+  v_inviter2 uuid := gen_random_uuid();
+  v_target uuid := gen_random_uuid();
+  v_target2 uuid := gen_random_uuid();
+  v_leftguy uuid := gen_random_uuid();
+  v_board uuid;
+begin
+  v_creator_user := public.ensure_github_user('ip-creator-' || v_suffix, 'ip-creator-' || v_suffix || '@example.test', 'ip-creator-' || v_suffix, 'IP Creator');
+  v_inviter2_user := public.ensure_github_user('ip-inviter2-' || v_suffix, 'ip-inviter2-' || v_suffix || '@example.test', 'ip-inviter2-' || v_suffix, 'IP Inviter2');
+  v_target_user := public.ensure_github_user('ip-target-' || v_suffix, 'ip-target-' || v_suffix || '@example.test', 'ip-target-' || v_suffix, 'IP Target');
+  v_target2_user := public.ensure_github_user('ip-target2-' || v_suffix, 'ip-target2-' || v_suffix || '@example.test', 'ip-target2-' || v_suffix, 'IP Target2');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_creator, 'agent', 'ip-creator-' || v_suffix, 'IP Creator', 'active', v_creator_user, v_creator_user),
+    (v_inviter2, 'agent', 'ip-inviter2-' || v_suffix, 'IP Inviter2', 'active', v_inviter2_user, v_inviter2_user),
+    (v_target, 'agent', 'ip-target-' || v_suffix, 'IP Target', 'active', v_target_user, v_target_user),
+    (v_target2, 'agent', 'ip-target2-' || v_suffix, 'IP Target2', 'active', v_target2_user, v_target2_user),
+    (v_leftguy, 'agent', 'ip-leftguy-' || v_suffix, 'IP Leftguy', 'active', null, null);
+
+  -- Gate-OFF board (role_gate_enforced defaults false): creator bypasses; inviter2 needs an
+  -- active membership.
+  select board_id into v_board
+    from agent_board.create_board(v_creator, 'ip-board-' || v_suffix, 'IP Board', 'invite policy test', '{}'::jsonb, 'private');
+
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values (v_board, v_inviter2, 'joined', v_creator, 'member');
+  -- a 'left' row requires left_at (constraint board_memberships_state_left_at).
+  -- leftguy: REJECTSEM re-invite guard. target2: has a row so update_board_membership reaches
+  -- the guard in the bypass-closed regression check below.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role, left_at)
+  values (v_board, v_leftguy, 'left', v_creator, 'member', now()),
+         (v_board, v_target2, 'left', v_creator, 'member', now());
+
+  insert into _ip_fixture values
+    (v_board, v_creator, v_inviter2, v_target, v_target2, v_leftguy,
+     v_creator_user, v_inviter2_user, v_target_user, v_target2_user);
+end
+$$;
+
+-- existence -----------------------------------------------------------------
+select has_function('agent_board', 'block_board_inviter', array['uuid', 'uuid', 'uuid', 'jsonb'], 'block_board_inviter exists');
+select has_function('agent_board', 'unblock_board_inviter', array['uuid', 'uuid', 'uuid'], 'unblock_board_inviter exists');
+select has_function('agent_board', '_invite_permitted', array['uuid', 'uuid', 'uuid'], '_invite_permitted exists');
+
+-- default permissive: no block row -> permitted -----------------------------
+select is(
+  (select agent_board._invite_permitted(board, target, inviter2) from _ip_fixture),
+  true, '_invite_permitted default true with no block row');
+
+-- baseline: inviter1 (creator) may invite the target ------------------------
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select creator_user from _ip_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid)$q$,
+     board, target, creator) from _ip_fixture),
+  'baseline: creator invites target (no block)');
+
+-- target blocks inviter1 (creator) -----------------------------------------
+select set_config('request.jwt.claim.sub', (select target_user from _ip_fixture)::text, true);
+select isnt(
+  (select b.id from _ip_fixture f, agent_board.block_board_inviter(f.board, f.creator) b),
+  null, 'target blocks the creator inviter (row created)');
+
+select is(
+  (select agent_board._invite_permitted(board, target, creator) from _ip_fixture),
+  false, '_invite_permitted false for the blocked (target, creator) pair');
+
+-- THE FIX (mutation pin): the blocked inviter can no longer invite the target
+select set_config('request.jwt.claim.sub', (select creator_user from _ip_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid)$q$,
+     board, target, creator) from _ip_fixture),
+  '42501', 'target has blocked invitations from this inviter on this board',
+  'blocked inviter (creator) cannot invite the target');
+
+-- operator carve-out: service_role invites despite the block ----------------
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid)$q$,
+     board, target, creator) from _ip_fixture),
+  'service_role operator invites the target despite the block (null-actor carve-out)');
+
+-- per-inviter scope: a DIFFERENT, un-blocked inviter still succeeds ----------
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select inviter2_user from _ip_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid)$q$,
+     board, target, inviter2) from _ip_fixture),
+  'a different (un-blocked) inviter still invites the target (per-inviter scope)');
+
+-- actor-binding: a third party cannot block on the target''s behalf ---------
+select set_config('request.jwt.claim.sub', (select target2_user from _ip_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.block_board_inviter(%L::uuid, %L::uuid, %L::uuid)$q$,
+     board, creator, target) from _ip_fixture),
+  '42501', null,
+  'a third party cannot block on another target''s behalf (actor bound to session)');
+
+-- unblock lifts the block ---------------------------------------------------
+select set_config('request.jwt.claim.sub', (select target_user from _ip_fixture)::text, true);
+select is(
+  (select agent_board.unblock_board_inviter(board, creator) from _ip_fixture),
+  true, 'target unblocks the creator inviter (row removed)');
+
+select set_config('request.jwt.claim.sub', (select creator_user from _ip_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid)$q$,
+     board, target, creator) from _ip_fixture),
+  'the previously blocked inviter can invite again after unblock');
+
+select set_config('request.jwt.claim.sub', (select target_user from _ip_fixture)::text, true);
+select is(
+  (select agent_board.unblock_board_inviter(board, creator) from _ip_fixture),
+  false, 'unblock returns false when no block row exists');
+
+-- REJECTSEM guard: a merely-''left'' target (no block) stays re-invitable ----
+select set_config('request.jwt.claim.sub', (select creator_user from _ip_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid)$q$,
+     board, leftguy, creator) from _ip_fixture),
+  'a voluntary leaver (state left, no block) is still re-invitable (REJECTSEM preserved)');
+
+-- BYPASS CLOSED (#90 panel finding): update_board_membership must not re-seat an
+-- inbound-disclosure membership ('invited'/'requested') for a target that blocked the actor.
+select set_config('request.jwt.claim.sub', (select target2_user from _ip_fixture)::text, true);
+select isnt(
+  (select b.id from _ip_fixture f, agent_board.block_board_inviter(f.board, f.creator) b),
+  null, 'target2 blocks the creator (setup for the update-path bypass check)');
+
+select set_config('request.jwt.claim.sub', (select creator_user from _ip_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.update_board_membership(%L::uuid, %L::uuid, 'invited')$q$,
+     board, target2) from _ip_fixture),
+  '42501', 'target has blocked invitations from this inviter on this board',
+  'update_board_membership cannot re-seat invited for a blocking target (bypass closed)');
+
+select throws_ok(
+  (select format($q$select agent_board.update_board_membership(%L::uuid, %L::uuid, 'requested')$q$,
+     board, target2) from _ip_fixture),
+  '42501', 'target has blocked invitations from this inviter on this board',
+  'update_board_membership cannot re-seat requested for a blocking target either');
+
+-- allow-twin: an UN-blocked target can still be re-seated via update_board_membership.
+select lives_ok(
+  (select format($q$select agent_board.update_board_membership(%L::uuid, %L::uuid, 'invited')$q$,
+     board, leftguy) from _ip_fixture),
+  'update_board_membership still admits invited for an un-blocked target');
+
+-- operator carve-out: the guard sits inside the authenticated branch, so service_role is unaffected.
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  (select format($q$select agent_board.update_board_membership(%L::uuid, %L::uuid, 'invited')$q$,
+     board, target2) from _ip_fixture),
+  'service_role may re-seat invited despite the block (operator carve-out)');
+
+-- the new SECURITY DEFINER helper carries no PUBLIC EXECUTE (MBHARDEN #118) --
+select set_config('request.jwt.claim.role', '', true);
+select ok(
+  not has_function_privilege('public', 'agent_board._invite_permitted(uuid,uuid,uuid)', 'EXECUTE'),
+  '_invite_permitted carries no PUBLIC EXECUTE (class invariant)');
+
+select * from finish();
+
+rollback;

package/tests/agent_board_leaveidem.test.sql

@@ -0,0 +1,194 @@
+-- LEAVEIDEM (#81) pgTAP — terminal membership states are true no-ops; left_at and the reserved
+-- ops_* metadata namespace are not caller-controlled.
+--
+-- HAND-COUNTED plan: 20 assertions (mechanically re-counted; an earlier draft was off by one,
+-- which CI cannot catch because its grep does not see pgTAP plan diagnostics). Breakdown:
+--   3 controls | 4 LEAVEIDEM core/no-op | 2 #79 guards | 4 ops-metadata + self-promotion
+--   | 2 left_at invariants (preserve + genuine restamp) | 1 oracle guard | 4 no-regression
+--
+-- METHODOLOGY (load-bearing, and two traps this suite exists to avoid):
+--  (a) GUC-only pattern (claims set, session stays postgres) rather than `set local role
+--      authenticated`, because `_is_service_role()` EXECUTE is revoked from `authenticated`
+--      (20260512000000:603) so the control below could not run under a real SET ROLE. Both
+--      vacuous-pass controls are asserted: `_is_service_role() = false` (else every assertion
+--      silently runs the SERVICE branch) and a non-null `current_agent_id()` (else a fixture whose
+--      sub resolves no active agent yields a green throws_ok('42501') from the GATENULL guard while
+--      the tested behaviour is absent). Every throws_ok matches the MESSAGE, because 42501 is
+--      raised by six other guards in this function family.
+--  (b) `now()` is transaction_timestamp() and is CONSTANT for the whole suite, so a "was it
+--      restamped?" assertion written as now-vs-now can never fail. Every left_at assertion below
+--      therefore seeds a DISTINCT past value first and compares against that.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(22);
+
+create temp table _li (k text primary key, v text) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_o uuid; v_b uuid; v_a uuid; v_uid uuid; v_c uuid; v_cuid uuid;
+begin
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status)
+  values ('agent', 'agent'::agent_board.agent_kind, 'li-own-' || s, 'Owner', 'active') returning id into v_o;
+  insert into agent_board.boards(slug, name, created_by_agent_id, visibility, status)
+  values ('li-b-' || s, 'LI Board', v_o, 'open', 'active') returning id into v_b;
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  values (v_b, v_o, 'owner', 'joined', v_o);
+
+  v_uid := gen_random_uuid();
+  insert into auth.users(id, instance_id, aud, role, email, created_at, updated_at)
+  values (v_uid, '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated',
+          'li-' || s || '@example.test', now(), now());
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('agent', 'agent'::agent_board.agent_kind, 'li-a-' || s, 'Member', 'active', v_uid, v_uid) returning id into v_a;
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  values (v_b, v_a, 'member', 'joined', v_o);
+
+  -- an ACTIVE authenticated agent with NO membership on this board (for the oracle assertion)
+  v_cuid := gen_random_uuid();
+  insert into auth.users(id, instance_id, aud, role, email, created_at, updated_at)
+  values (v_cuid, '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated',
+          'li-c-' || s || '@example.test', now(), now());
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('agent', 'agent'::agent_board.agent_kind, 'li-c-' || s, 'Outsider', 'active', v_cuid, v_cuid) returning id into v_c;
+
+  insert into _li values ('board', v_b::text), ('owner', v_o::text), ('agent', v_a::text),
+                         ('uid', v_uid::text), ('outsider_uid', v_cuid::text);
+end
+$$;
+
+select set_config('request.jwt.claim.sub', (select v from _li where k = 'uid'), true);
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+-- 1,2 — vacuous-pass controls (see methodology (a))
+select is(agent_board._is_service_role(), false, 'CONTROL: acting on the authenticated path, not service_role');
+select isnt(agent_board.current_agent_id(), null, 'CONTROL: the actor resolves to an active agent');
+
+-- 3,4 — #81: leave_board is idempotent again (assertion 4 FAILS on main with 42501)
+select lives_ok(
+  $$ select agent_board.leave_board((select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent')) $$,
+  'first leave_board succeeds');
+select lives_ok(
+  $$ select agent_board.leave_board((select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent')) $$,
+  'LEAVEIDEM: a second leave_board is idempotent (was 42501 on main)');
+
+-- 5,6 — and it is a TRUE no-op: neither the seeded departure time nor updated_at moves.
+-- Seed a DISTINCT past left_at first (methodology (b)) so a restamp would be detectable.
+update agent_board.board_memberships
+   set left_at = timestamptz '2020-01-01 00:00:00+00', updated_at = timestamptz '2020-01-01 00:00:00+00'
+ where board_id = (select v::uuid from _li where k='board') and agent_id = (select v::uuid from _li where k='agent');
+select lives_ok(
+  $$ select agent_board.leave_board((select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent')) $$,
+  'a further leave_board on the seeded row still succeeds');
+select is(
+  (select left_at from agent_board.board_memberships
+    where board_id = (select v::uuid from _li where k='board') and agent_id = (select v::uuid from _li where k='agent')),
+  timestamptz '2020-01-01 00:00:00+00',
+  'LEAVEIDEM: the no-op does not touch the row at all (seeded left_at survives)');
+
+-- 7,8,9,10,11 — no-regression + the reserved ops_* strip on a REAL transition
+select lives_ok(
+  $$ select agent_board.join_board((select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent'), 'joined') $$,
+  'NO-REGRESSION: an agent may rejoin an OPEN board after leaving');
+select lives_ok(
+  $$ select agent_board.update_board_membership((select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent'),
+       'left', '{"ops_retained_at":"2000-01-01","note":"keepme"}'::jsonb) $$,
+  'a real transition accepts caller metadata');
+select is(
+  (select metadata->>'ops_retained_at' from agent_board.board_memberships
+    where board_id = (select v::uuid from _li where k='board') and agent_id = (select v::uuid from _li where k='agent')),
+  null,
+  'reserved ops_* metadata from a caller is STRIPPED (retention skip key not writable; FAILS on main)');
+select is(
+  (select metadata->>'note' from agent_board.board_memberships
+    where board_id = (select v::uuid from _li where k='board') and agent_id = (select v::uuid from _li where k='agent')),
+  'keepme',
+  'legitimate caller metadata is still merged (the strip is not over-broad)');
+select throws_ok(
+  $$ select agent_board.update_board_membership((select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent'), 'joined') $$,
+  '42501', 'self membership change not permitted; use the join/approval path',
+  'self promotion from a terminal state is still refused');
+
+-- ---------------------------------------------------------------------------
+-- The `removed` state on the AUTHENTICATED path — the behaviour this migration adds.
+-- ---------------------------------------------------------------------------
+reset role;
+select set_config('request.jwt.claim.sub', '', true);
+select set_config('request.jwt.claim.role', '', true);
+select lives_ok(
+  $$ select agent_board.update_board_membership((select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent'), 'removed') $$,
+  'NO-REGRESSION: service_role may still evict on behalf of an operator');
+
+-- seed a distinct past left_at on the now-`removed` row for the invariants that follow
+update agent_board.board_memberships
+   set left_at = timestamptz '2019-06-01 00:00:00+00', updated_at = timestamptz '2019-06-01 00:00:00+00'
+ where board_id = (select v::uuid from _li where k='board') and agent_id = (select v::uuid from _li where k='agent');
+
+select set_config('request.jwt.claim.sub', (select v from _li where k = 'uid'), true);
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+-- 12,13 — #79 kick-marker guard intact for a REMOVED agent (neither transition is same-state)
+select throws_ok(
+  $$ select agent_board.update_board_membership((select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent'), 'left') $$,
+  '42501', 'self membership change not permitted; use the join/approval path',
+  '#79 INTACT: a removed agent cannot launder its kick marker to left');
+select throws_ok(
+  $$ select agent_board.update_board_membership((select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent'), 'joined') $$,
+  '42501', 'self membership change not permitted; use the join/approval path',
+  '#79 INTACT: a removed agent cannot self-readmit');
+
+-- 14,15 — removed -> removed is a permitted TRUE no-op
+select lives_ok(
+  $$ select agent_board.update_board_membership((select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent'), 'removed') $$,
+  'LEAVEIDEM: removed -> removed is permitted (same-state terminal no-op)');
+select is(
+  (select updated_at from agent_board.board_memberships
+    where board_id = (select v::uuid from _li where k='board') and agent_id = (select v::uuid from _li where k='agent')),
+  timestamptz '2019-06-01 00:00:00+00',
+  'LEAVEIDEM: the no-op does NOT rewrite the row (seeded updated_at survives)');
+
+-- 16 — ORACLE GUARD: an unauthorized caller targeting an agent ALREADY in the no-op state must
+-- still get 42501. This is the assertion that distinguishes placing the early return AFTER the
+-- authorization block from placing it before.
+select set_config('request.jwt.claim.sub', (select v from _li where k = 'outsider_uid'), true);
+select throws_ok(
+  $$ select agent_board.update_board_membership((select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent'), 'removed') $$,
+  '42501', 'board membership change requires owner or admin role',
+  'the no-op path is NOT an oracle: an unauthorized caller targeting an already-removed agent still gets 42501');
+
+-- 17,18,19 — service path: control, the mutator's left_at preservation, and a genuine restamp.
+reset role;
+select set_config('request.jwt.claim.sub', '', true);
+select set_config('request.jwt.claim.role', '', true);
+select is(agent_board._is_service_role(), true, 'CONTROL: bare postgres is service_role-equivalent');
+-- The operator is deliberately NOT short-circuited by the no-op (so its p_metadata is not dropped),
+-- so it reaches the mutator — which must PRESERVE the seeded left_at on a same-state call.
+-- This is the only assertion that exercises coalesce(); it FAILS on main, which restamps.
+select lives_ok($$
+  select agent_board.update_board_membership(
+     (select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent'), 'removed') $$,
+  'operator reaches the mutator on a same-state call [call succeeds]');
+select is((select left_at from agent_board.board_memberships
+     where board_id = (select v::uuid from _li where k='board') and agent_id = (select v::uuid from _li where k='agent')),
+  timestamptz '2019-06-01 00:00:00+00',
+  'mutator PRESERVES left_at when the terminal state is unchanged (retention cutoff not restampable)');
+-- A GENUINE terminal->different-terminal transition must restamp: the kick time is the audit answer.
+update agent_board.board_memberships
+   set membership_state = 'left', left_at = timestamptz '2019-06-01 00:00:00+00'
+ where board_id = (select v::uuid from _li where k='board') and agent_id = (select v::uuid from _li where k='agent');
+select lives_ok($$
+  select agent_board.update_board_membership(
+     (select v::uuid from _li where k='board'), (select v::uuid from _li where k='agent'), 'removed') $$,
+  'a genuine left -> removed kick [call succeeds]');
+select isnt((select left_at from agent_board.board_memberships
+     where board_id = (select v::uuid from _li where k='board') and agent_id = (select v::uuid from _li where k='agent')),
+  timestamptz '2019-06-01 00:00:00+00',
+  'a genuine left -> removed kick RESTAMPS left_at (does not inherit the departure time)');
+
+select * from finish();
+rollback;