@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.12.0",
+  "packageVersion": "1.22.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 82,
-  "aggregateSha256": "f6248b647fc1de859d68650ad8f9e88964820642da712893476429a4edb341f9",
+  "migrationCount": 113,
+  "aggregateSha256": "fb690d702458562b331aed192580f1568018d9d007368c8b9edd45d35d18ad96",
   "migrations": [
     {
       "order": 0,
@@ -786,6 +786,285 @@
       "sourceRef": "message-board",
       "bytes": 11567,
       "sha256": "a4d935614f970a946f27a5925c0166e1d41510a82078e559fb769f4ea39afc2e"
+    },
+    {
+      "order": 82,
+      "id": "20260731000100_agent_board_agentsdir_column_scope",
+      "filename": "20260731000100_agent_board_agentsdir_column_scope.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 5715,
+      "sha256": "e05ddbbcf778828dbc4ba2631a5a288567d361371a60373c7e9090b718aa7433"
+    },
+    {
+      "order": 83,
+      "id": "20260801000100_agent_board_leaveidem_terminal_noop",
+      "filename": "20260801000100_agent_board_leaveidem_terminal_noop.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 17467,
+      "sha256": "72b20a3a365d0c84969cd1129cbc04578ee487a70e28a4245171c2abc68ec779"
+    },
+    {
+      "order": 84,
+      "id": "20260802000100_agent_board_rolereset_reentry_clamp",
+      "filename": "20260802000100_agent_board_rolereset_reentry_clamp.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 12983,
+      "sha256": "d04f596cdc97dc2ddc83348ee49c48888b334d12c31394586e7058409fa48cce"
+    },
+    {
+      "order": 85,
+      "id": "20260803000100_agent_board_rowid_total_order",
+      "filename": "20260803000100_agent_board_rowid_total_order.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 56061,
+      "sha256": "a3c58ff1f55d3134c6096d10bf56df09db573938e7b4b92c13b7389451dd4c3c"
+    },
+    {
+      "order": 86,
+      "id": "20260804000100_agent_board_hygiene_actor_binding_rls",
+      "filename": "20260804000100_agent_board_hygiene_actor_binding_rls.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 10114,
+      "sha256": "3feac0b5002bbff56c89adc3b9f071e21e1bb5ab2c4eea1571cfb61f254caa88"
+    },
+    {
+      "order": 87,
+      "id": "20260806000100_agent_board_consent_substrate",
+      "filename": "20260806000100_agent_board_consent_substrate.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 17238,
+      "sha256": "91ba2ec5885dfcaaa138ab3da3665a6779b6149147045773dfcbb707cfd9db07"
+    },
+    {
+      "order": 88,
+      "id": "20260807000100_agent_board_consent_emission",
+      "filename": "20260807000100_agent_board_consent_emission.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 31140,
+      "sha256": "b6fb6f8254169d4fc3ab8016ab2f9ec2a2800c800178aebb602ff1db4aa0e7ee"
+    },
+    {
+      "order": 89,
+      "id": "20260808000100_agent_board_rejectsem",
+      "filename": "20260808000100_agent_board_rejectsem.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 7879,
+      "sha256": "945a719e127573816cb9d18e318cf0778a99f3b0f8239b8e6ae0f8e62b04d919"
+    },
+    {
+      "order": 90,
+      "id": "20260809000100_agent_board_consent_gating",
+      "filename": "20260809000100_agent_board_consent_gating.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 26782,
+      "sha256": "666e413ae1474e5e00de4d2bf2e7f7733f6ad149c91c3ef9a938e049115e387c"
+    },
+    {
+      "order": 91,
+      "id": "20260810000100_agent_board_consent_locking",
+      "filename": "20260810000100_agent_board_consent_locking.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 25104,
+      "sha256": "d027468d3adb8563563f4fac4b13140013b68f28f39abe37c1de487c7fd36978"
+    },
+    {
+      "order": 92,
+      "id": "20260811000100_agent_board_retention_metadata_revoke",
+      "filename": "20260811000100_agent_board_retention_metadata_revoke.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 1476,
+      "sha256": "8d08dc986d532862d6593fe49b2e38e7447e57006360cae3406127c820ec19d6"
+    },
+    {
+      "order": 93,
+      "id": "20260812000100_agent_board_pubexec_class_revoke",
+      "filename": "20260812000100_agent_board_pubexec_class_revoke.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 2946,
+      "sha256": "34dabae96c11ab7fce68d71f1aa782eccef1bce5de4ad0567013d73949815606"
+    },
+    {
+      "order": 94,
+      "id": "20260813000100_agent_board_invitepolicy_block",
+      "filename": "20260813000100_agent_board_invitepolicy_block.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 18997,
+      "sha256": "8ee82c196483bf7d80091a46f6189328934fda2345947aea905505e37090719d"
+    },
+    {
+      "order": 95,
+      "id": "20260814000100_agent_board_obsgate_thread_post_policy",
+      "filename": "20260814000100_agent_board_obsgate_thread_post_policy.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 11686,
+      "sha256": "b36433d8aa78413b3d1e5119c45f8a24d37de053d03f4c4fd47b449814c4becb"
+    },
+    {
+      "order": 96,
+      "id": "20260815000100_agent_board_obsgate2_authoring_gates",
+      "filename": "20260815000100_agent_board_obsgate2_authoring_gates.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 14033,
+      "sha256": "7e76aa13aef8450aba50eb08d9da66b75a55457f41e3c92662137a1f6d7e2850"
+    },
+    {
+      "order": 97,
+      "id": "20260816000100_agent_board_obsgate3_task_lifecycle",
+      "filename": "20260816000100_agent_board_obsgate3_task_lifecycle.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 6623,
+      "sha256": "921cc40511e4070c61f7b164a7528362a9662da2b902252a3e92091f01ebf0fd"
+    },
+    {
+      "order": 98,
+      "id": "20260817000100_agent_board_obsgate4_claims_lifecycle",
+      "filename": "20260817000100_agent_board_obsgate4_claims_lifecycle.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 12334,
+      "sha256": "6dd2d7928df2dff87c61b52e7edb75c5ec781fec5a85dd7c4273dadfd162f8ef"
+    },
+    {
+      "order": 99,
+      "id": "20260818000100_agent_board_fleet_machines_rls_correlation",
+      "filename": "20260818000100_agent_board_fleet_machines_rls_correlation.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 2354,
+      "sha256": "f8bca2d75755589a1fa72d0c30ca799bd20db776d73a3a5e27832e112b57ea5d"
+    },
+    {
+      "order": 100,
+      "id": "20260819000100_agent_board_resolve_noop_retire",
+      "filename": "20260819000100_agent_board_resolve_noop_retire.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 7804,
+      "sha256": "68bcb6d1b7e8ee8424e6d1d13a5a7d2c7d4554f348cc2cbf946ec95999517ac5"
+    },
+    {
+      "order": 101,
+      "id": "20260820000100_agent_board_roomdeleg_lane_b",
+      "filename": "20260820000100_agent_board_roomdeleg_lane_b.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 11822,
+      "sha256": "2b10b8507b9bc704e9419b93d6d5d0af6d24f0ceef28c3eaa520516158f6c3e2"
+    },
+    {
+      "order": 102,
+      "id": "20260821000100_agent_board_claimgate_claimkey",
+      "filename": "20260821000100_agent_board_claimgate_claimkey.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 20128,
+      "sha256": "caf8a83d4f39fc0a3d76d5b97077f0c3cf281305e47c50d370e940497a211022"
+    },
+    {
+      "order": 103,
+      "id": "20260822000100_agent_board_mint_harden",
+      "filename": "20260822000100_agent_board_mint_harden.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 33756,
+      "sha256": "67585b17791598391515e63fa680c35cedaf27edc7ba3296f98242b925b9f490"
+    },
+    {
+      "order": 104,
+      "id": "20260822000200_agent_board_mint_harden_fingerprint_backfill",
+      "filename": "20260822000200_agent_board_mint_harden_fingerprint_backfill.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 10716,
+      "sha256": "8bfd8e1bde5dbe85f21f5e0eb6c8f34462d16b92a763977ad9930539ac259698"
+    },
+    {
+      "order": 105,
+      "id": "20260823000100_agent_board_fleet_machine_hijack",
+      "filename": "20260823000100_agent_board_fleet_machine_hijack.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 5078,
+      "sha256": "73dcb65af8f8c754e2c6cc1c29f8649619a7653519a36a6b3acddf1a344a2bee"
+    },
+    {
+      "order": 106,
+      "id": "20260824000100_agent_board_claimgate_shadow",
+      "filename": "20260824000100_agent_board_claimgate_shadow.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 25078,
+      "sha256": "da42126b6cf40b0b044513313b0921394cd25de13426b16bcebd09bbcf5310a1"
+    },
+    {
+      "order": 107,
+      "id": "20260825000100_agent_board_claimgate_enforce",
+      "filename": "20260825000100_agent_board_claimgate_enforce.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 37587,
+      "sha256": "7264c8ff93f366238788f1a68c72a7ca0651da6e1b0cd9e27516e9acc01e6d3f"
+    },
+    {
+      "order": 108,
+      "id": "20260826000100_agent_board_fleet_machine_reactivation",
+      "filename": "20260826000100_agent_board_fleet_machine_reactivation.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 23827,
+      "sha256": "fe437413046fba73b5306f1e21de81116369989a5d6e934a57c83c91bd5abb4b"
+    },
+    {
+      "order": 109,
+      "id": "20260828000100_agent_board_delegation_cap_ceiling",
+      "filename": "20260828000100_agent_board_delegation_cap_ceiling.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 25838,
+      "sha256": "b9556374b6e512cc4f2ffc6a6d80d2abceca9ae1963e0f0ecdcd0485f6580e9e"
+    },
+    {
+      "order": 110,
+      "id": "20260829000100_agent_board_fleet_machine_reclaim",
+      "filename": "20260829000100_agent_board_fleet_machine_reclaim.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 26058,
+      "sha256": "6ba17d49d5ef9ced3824f4f7ef7dbb40dd9ac3564576dad8b479545b2bab3b19"
+    },
+    {
+      "order": 111,
+      "id": "20260830000100_agent_board_delegation_sole_writer",
+      "filename": "20260830000100_agent_board_delegation_sole_writer.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 2927,
+      "sha256": "26f5febc3c63f665eeb6eca2909d72187f16bae2c2643065e8ddb7c919086a86"
+    },
+    {
+      "order": 112,
+      "id": "20260831000100_agent_board_fleet_domain_reclaim",
+      "filename": "20260831000100_agent_board_fleet_domain_reclaim.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 25051,
+      "sha256": "8d24ec4d682969a5d9339aec0573fad65ee95993dce2f8dca214906549b5ebe8"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -37,9 +37,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE forward migrations (migrationCount = prior 80 + 2 = 82)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM forward migrations (migrationCount = prior 112 + 1 = 113)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(82);
+    expect(manifest.migrationCount).toBe(113);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -105,6 +105,41 @@ describe('manifest integrity', () => {
       // MEMBSTATE (#75): update_board_membership gains an authorization model (it previously
       // had none) — self-service transitions only, owner/admin for another agent's row.
       '20260730000200_agent_board_membstate_authz.sql',
+      // AGENTSDIR (#80): agent_board.agents column read posture — `authenticated` may select only
+      // the directory columns; identity-linkage columns + metadata are withheld. Grants only.
+      '20260731000100_agent_board_agentsdir_column_scope.sql',
+      // LEAVEIDEM (#81): terminal membership states are true no-ops; left_at is preserved and
+      // the reserved ops_* metadata namespace is stripped from caller input.
+      '20260801000100_agent_board_leaveidem_terminal_noop.sql',
+      // ROLERESET (#79): role is not identity — the mutator clamps role to the table default on
+      // any non-active -> joined|subscribed re-entry (UPDATE branch only, never a trigger), and
+      // grant_board_role refuses a grant onto a non-active membership (pre-check P0002 + the
+      // mirrored UPDATE predicate that closes the TOCTOU window).
+      '20260802000100_agent_board_rolereset_reentry_clamp.sql',
+      // MBROWID: one authoritative membership row per (board_id, agent_id) — total-order reads
+      // (created_at desc, id desc) with duplicate-aware active-row selection, and the R-LINK-7
+      // bootstrap guard that suppresses a removed creator without breaking 'left' recovery.
+      '20260803000100_agent_board_rowid_total_order.sql',
+      // MBHYGIENE (#76): actor bound through _resolved_actor_agent_id in the addressing
+      // resolvers; RLS on schema_version as bundle-level defense in depth; and the two dead
+      // callback policy arms rewritten from an inner join through RLS-filtered
+      // callback_endpoints to a separate exists(...).
+      '20260804000100_agent_board_hygiene_actor_binding_rls.sql',
+      // MBCONSENT-A (#82/#89/#90): the consent SUBSTRATE only -- ledger, anti-forge
+      // rules, privilege posture, the two frozen predicates, backfill. No route changes.
+      '20260806000100_agent_board_consent_substrate.sql',
+      // MBCONSENT-B(a): emission only. Every membership transition writes one ledger
+      // event; nothing reads the predicate yet, so no call that succeeds can start failing.
+      '20260807000100_agent_board_consent_emission.sql',
+      // MBCONSENT-B(i) (#89): a refusal is not an eviction -- resolve_board_request
+      // writes `left`, so one rejection is no longer a permanent self-unrecoverable bar.
+      '20260808000100_agent_board_rejectsem.sql',
+      // MBCONSENT-B(ii) (#82, #108): route gating -- the change that closes the hole.
+      // NOT inert: calls that succeed today begin failing, by design.
+      '20260809000100_agent_board_consent_gating.sql',
+      // MBCONSENT-B(iii) (#109/#110 + the gating race): validate and mutate the SAME
+      // row. The sink gains an optional row identity and event kind.
+      '20260810000100_agent_board_consent_locking.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }
@@ -167,3 +202,79 @@ describe('plan / check postures + exit codes (SemVer contract)', () => {
     expect(EXIT).toEqual({ exact: 0, behind: 10, ahead: 11, divergent: 12, error: 13 });
   });
 });
+
+// BACKFILL PRESENCE. The pgTAP suite proves the backfill STATEMENT's semantics by re-running
+// it, so it would stay green if the migration's copy were deleted -- and the migration's own
+// backfill is a no-op under that harness anyway, because the runner applies migrations to an
+// EMPTY schema and there are no pre-existing rows to annotate. Semantics and presence are two
+// different claims and pgTAP can only make the first. This makes the second, by reading the
+// shipped file.
+describe('MBCONSENT-A backfill presence', () => {
+  const sql = readFileSync(
+    new URL('../migrations/20260806000100_agent_board_consent_substrate.sql', import.meta.url),
+    'utf8',
+  );
+  const stripped = sql.replace(/^\s*--.*$/gm, '');
+
+  it('ships a backfill that annotates pre-existing non-active memberships', () => {
+    expect(stripped).toMatch(/insert\s+into\s+agent_board\.board_membership_events/i);
+    expect(stripped).toMatch(/'backfill_neutral'/);
+    expect(stripped).toMatch(/membership_state\s+in\s*\(\s*'requested'\s*,\s*'invited'\s*\)/i);
+  });
+
+  it('deduplicates per subject, so duplicate pending rows cannot emit one event each', () => {
+    const idx = stripped.indexOf("'backfill_neutral'");
+    expect(idx).toBeGreaterThan(-1);
+    const head = stripped.slice(Math.max(0, idx - 400), idx);
+    expect(head).toMatch(/distinct\s+on\s*\(\s*bm\.board_id\s*,\s*bm\.agent_id\s*\)/i);
+  });
+
+  it('guards the backfill with not-exists so re-application is idempotent', () => {
+    const idx = stripped.indexOf("'backfill_neutral'");
+    expect(stripped.slice(idx)).toMatch(/not\s+exists\s*\(/i);
+  });
+
+  it('correlates the not-exists guard on BOTH subject keys', () => {
+    // A guard that compares the wrong pair (e.g. e.agent_id = bm.board_id) still contains a
+    // `not exists (` token and still reads plausibly, but re-application duplicates every row.
+    // The pgTAP idempotency test exercises a hand-copied statement, so only this sees the
+    // shipped one.
+    const idx = stripped.indexOf("'backfill_neutral'");
+    const tail = stripped.slice(idx, idx + 1400);
+    expect(tail).toMatch(/e\.board_id\s*=\s*bm\.board_id/i);
+    expect(tail).toMatch(/e\.agent_id\s*=\s*bm\.agent_id/i);
+  });
+
+  it('annotates as board-authored, never as consent', () => {
+    const idx = stripped.indexOf("'backfill_neutral'");
+    const tail = stripped.slice(idx, idx + 800);
+    expect(tail).toMatch(/'board-authored'/);
+    expect(tail).not.toMatch(/'target-authored'|'operator-designated'/);
+  });
+
+  // These two are not style points -- losing either ABORTS THE MIGRATION on deploy, because a
+  // board-authored event requires actor <> subject and the anti-forge CHECK enforces it.
+  it('takes the actor from the BOARD creator, not the membership row', () => {
+    const idx = stripped.indexOf("'backfill_neutral'");
+    const tail = stripped.slice(idx, idx + 800);
+    // b.created_by_agent_id (the board's creator). bm.created_by_agent_id is whoever created
+    // the MEMBERSHIP row, which can be the subject -- producing board-authored with
+    // actor = subject, which the CHECK rejects.
+    expect(tail).toMatch(/\bb\.created_by_agent_id\b/);
+    expect(tail).not.toMatch(/'board-authored',\s*\n?\s*bm\.created_by_agent_id/);
+  });
+
+  it('joins boards on the membership row board_id', () => {
+    // Breaking this join silently drops the production backfill while the pgTAP copy and every
+    // looser regex stay green -- the specific mutation the review named.
+    const idx = stripped.indexOf("'backfill_neutral'");
+    const tail = stripped.slice(idx, idx + 1200);
+    expect(tail).toMatch(/join\s+agent_board\.boards\s+b\s+on\s+b\.id\s*=\s*bm\.board_id/i);
+  });
+
+  it('excludes rows where the board creator IS the subject', () => {
+    const idx = stripped.indexOf("'backfill_neutral'");
+    const tail = stripped.slice(idx, idx + 1200);
+    expect(tail).toMatch(/b\.created_by_agent_id\s*<>\s*bm\.agent_id/);
+  });
+});