@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/tests/agent_board_obsgate2.test.sql

@@ -0,0 +1,153 @@
+-- OBSGATE-2 (#123) pgTAP: the board posting rule now applies to every thread-authoring RPC,
+-- not just post_message. An observer with board-thread access cannot create tasks, delegate
+-- tasks, add artifacts, raise conflicts, or raise escalations into a board-linked thread; a
+-- non-observer member, board-less threads, and service_role are unaffected.
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role(),
+-- request.jwt.claim.sub picks the actor.
+--
+-- The DENY assertions are the mutation pins (each raises 42501 via _current_agent_can_post_to_
+-- thread). delegate_task is pinned to prove the TRANSITIVE close through create_task. The ALLOW
+-- twins guard against over-block/regression, including the internal create_tasking_delivery path.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(11);
+
+create temp table _o2_fixture (
+  board uuid,
+  member_agent uuid,
+  observer_agent uuid,
+  board_thread uuid,
+  boardless_thread uuid,
+  parent_task uuid,
+  member_user uuid,
+  observer_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_member_user uuid;
+  v_observer_user uuid;
+  v_creator uuid := gen_random_uuid();
+  v_member uuid := gen_random_uuid();
+  v_observer uuid := gen_random_uuid();
+  v_board uuid;
+  v_board_thread uuid := gen_random_uuid();
+  v_boardless_thread uuid := gen_random_uuid();
+  v_parent_task uuid;
+begin
+  v_member_user := public.ensure_github_user('o2-member-' || v_suffix, 'o2-member-' || v_suffix || '@example.test', 'o2-member-' || v_suffix, 'O2 Member');
+  v_observer_user := public.ensure_github_user('o2-observer-' || v_suffix, 'o2-observer-' || v_suffix || '@example.test', 'o2-observer-' || v_suffix, 'O2 Observer');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_creator, 'agent', 'o2-creator-' || v_suffix, 'O2 Creator', 'active', null, null),
+    (v_member, 'agent', 'o2-member-' || v_suffix, 'O2 Member', 'active', v_member_user, v_member_user),
+    (v_observer, 'agent', 'o2-observer-' || v_suffix, 'O2 Observer', 'active', v_observer_user, v_observer_user);
+
+  select board_id into v_board
+    from agent_board.create_board(v_creator, 'o2-board-' || v_suffix, 'O2 Board', 'obsgate2 test', '{}'::jsonb, 'private');
+
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board, v_member, 'joined', v_creator, 'member'),
+    (v_board, v_observer, 'joined', v_creator, 'observer');
+
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values
+    (v_board_thread, 'coordination', v_member, 'O2 board thread'),
+    (v_boardless_thread, 'coordination', v_member, 'O2 board-less thread');
+
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', v_member_user::text, true);
+  -- Fan a board message so the board thread is stamped and the observer gains thread access.
+  perform agent_board.post_board_message(v_board_thread, v_member, v_board, 'seed', 'seed body');
+  -- The member seeds a parent task (non-observer, permitted) for the delegate_task test.
+  select task_id into v_parent_task
+    from agent_board.create_task(v_board_thread, v_member, 'parent task', 'd');
+
+  insert into _o2_fixture values
+    (v_board, v_member, v_observer, v_board_thread, v_boardless_thread, v_parent_task, v_member_user, v_observer_user);
+end
+$$;
+
+-- DENY (mutation pins): an observer cannot author into the board thread by any door ----------
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select observer_user from _o2_fixture)::text, true);
+
+select throws_ok(
+  (select format($q$select agent_board.create_task(%L::uuid, %L::uuid, 'obs task', 'd')$q$,
+     board_thread, observer_agent) from _o2_fixture),
+  '42501', 'thread posting requires a non-observer board role',
+  'observer cannot create_task in a board thread');
+
+select throws_ok(
+  (select format($q$select agent_board.delegate_task(%L::uuid, %L::uuid, 'obs deleg', 'd', %L::uuid)$q$,
+     parent_task, observer_agent, member_agent) from _o2_fixture),
+  '42501', 'thread posting requires a non-observer board role',
+  'observer cannot delegate_task into a board thread (transitive via create_task)');
+
+select throws_ok(
+  (select format($q$select agent_board.add_artifact(%L::uuid, 'https://x.test/a', 'url', 'external_url', %L::uuid)$q$,
+     observer_agent, board_thread) from _o2_fixture),
+  '42501', 'thread posting requires a non-observer board role',
+  'observer cannot add_artifact to a board thread');
+
+select throws_ok(
+  (select format($q$select agent_board.raise_conflict(%L::uuid, %L::uuid, 'obs conflict')$q$,
+     board_thread, observer_agent) from _o2_fixture),
+  '42501', 'thread posting requires a non-observer board role',
+  'observer cannot raise_conflict in a board thread');
+
+select throws_ok(
+  (select format($q$select agent_board.raise_escalation(%L::uuid, %L::uuid, 'obs escalation')$q$,
+     board_thread, observer_agent) from _o2_fixture),
+  '42501', 'thread posting requires a non-observer board role',
+  'observer cannot raise_escalation in a board thread');
+
+-- ALLOW twins: a non-observer member is unaffected ------------------------------------------
+select set_config('request.jwt.claim.sub', (select member_user from _o2_fixture)::text, true);
+
+select lives_ok(
+  (select format($q$select agent_board.create_task(%L::uuid, %L::uuid, 'member task', 'd')$q$,
+     board_thread, member_agent) from _o2_fixture),
+  'a member may create_task in a board thread');
+
+select lives_ok(
+  (select format($q$select agent_board.add_artifact(%L::uuid, 'https://x.test/b', 'url', 'external_url', %L::uuid)$q$,
+     member_agent, board_thread) from _o2_fixture),
+  'a member may add_artifact to a board thread');
+
+-- thread-only (no task): also exercises the v_event no-task fix folded into this migration.
+select lives_ok(
+  (select format($q$select agent_board.raise_escalation(%L::uuid, %L::uuid, 'member escalation')$q$,
+     board_thread, member_agent) from _o2_fixture),
+  'a member may raise_escalation (thread-only) in a board thread');
+
+-- regression: the internal create_tasking_delivery -> create_task path still works for a member
+select lives_ok(
+  (select format($q$select agent_board.create_tasking_delivery(%L::uuid, %L::uuid, 'member tasking', 'd', null, %L::uuid)$q$,
+     board_thread, member_agent, board) from _o2_fixture),
+  'a member may create_tasking_delivery (internal create_task) — gate does not break the tasking path');
+
+-- board-less thread: no board link -> access-only, no role gate (no regression) --------------
+select lives_ok(
+  (select format($q$select agent_board.create_task(%L::uuid, %L::uuid, 'boardless task', 'd')$q$,
+     boardless_thread, member_agent) from _o2_fixture),
+  'a board-less thread is unaffected by the posting gate (access-only)');
+
+-- service_role carve-out --------------------------------------------------------------------
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  (select format($q$select agent_board.create_task(%L::uuid, %L::uuid, 'svc task', 'd')$q$,
+     board_thread, observer_agent) from _o2_fixture),
+  'service_role may author into a board thread regardless of role (carve-out)');
+
+select * from finish();
+
+rollback;

package/tests/agent_board_obsgate3.test.sql

@@ -0,0 +1,170 @@
+-- OBSGATE-3 (#125) pgTAP: task-lifecycle mutation on a board-thread task requires a
+-- non-observer board role OR being the task's assignee/creator. A board observer cannot
+-- mutate a task it is not a party to (append_task_event and its callers acquire_claim /
+-- resolve_conflict / resolve_escalation), but a legitimate non-member ASSIGNEE still can.
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role(),
+-- request.jwt.claim.sub picks the actor.
+--
+-- The DENY assertions are the mutation pins (append_task_event's mutate-task gate). The
+-- assignee/creator ALLOW twins are the over-block guards — the whole point of the
+-- assignee-aware rule (a blanket board-role gate would lock out a non-member assignee).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(11);
+
+create temp table _o3_fixture (
+  board uuid,
+  member_agent uuid,
+  observer_agent uuid,
+  nonmember_agent uuid,
+  member_task uuid,
+  assignee_task uuid,
+  observer_task uuid,
+  boardless_task uuid,
+  conflict_id uuid,
+  escalation_id uuid,
+  member_user uuid,
+  observer_user uuid,
+  nonmember_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_member_user uuid; v_observer_user uuid; v_nonmember_user uuid;
+  v_creator uuid := gen_random_uuid();
+  v_member uuid := gen_random_uuid();
+  v_observer uuid := gen_random_uuid();
+  v_nonmember uuid := gen_random_uuid();
+  v_board uuid;
+  v_board_thread uuid := gen_random_uuid();
+  v_boardless_thread uuid := gen_random_uuid();
+  v_member_task uuid; v_assignee_task uuid; v_observer_task uuid; v_boardless_task uuid;
+  v_conflict uuid; v_escalation uuid;
+begin
+  v_member_user := public.ensure_github_user('o3-member-' || v_suffix, 'o3-member-' || v_suffix || '@example.test', 'o3-member-' || v_suffix, 'O3 Member');
+  v_observer_user := public.ensure_github_user('o3-observer-' || v_suffix, 'o3-observer-' || v_suffix || '@example.test', 'o3-observer-' || v_suffix, 'O3 Observer');
+  v_nonmember_user := public.ensure_github_user('o3-nonmember-' || v_suffix, 'o3-nonmember-' || v_suffix || '@example.test', 'o3-nonmember-' || v_suffix, 'O3 Nonmember');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_creator, 'agent', 'o3-creator-' || v_suffix, 'O3 Creator', 'active', null, null),
+    (v_member, 'agent', 'o3-member-' || v_suffix, 'O3 Member', 'active', v_member_user, v_member_user),
+    (v_observer, 'agent', 'o3-observer-' || v_suffix, 'O3 Observer', 'active', v_observer_user, v_observer_user),
+    (v_nonmember, 'agent', 'o3-nonmember-' || v_suffix, 'O3 Nonmember', 'active', v_nonmember_user, v_nonmember_user);
+
+  select board_id into v_board
+    from agent_board.create_board(v_creator, 'o3-board-' || v_suffix, 'O3 Board', 'obsgate3 test', '{}'::jsonb, 'private');
+
+  -- member is a board member; observer is an observer; nonmember is NOT on the board.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board, v_member, 'joined', v_creator, 'member'),
+    (v_board, v_observer, 'joined', v_creator, 'observer');
+
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values
+    (v_board_thread, 'coordination', v_member, 'O3 board thread'),
+    (v_boardless_thread, 'coordination', v_member, 'O3 board-less thread');
+
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', v_member_user::text, true);
+  perform agent_board.post_board_message(v_board_thread, v_member, v_board, 'seed', 'seed body');
+
+  -- member creates the board-thread tasks (non-observer, permitted by #123).
+  select task_id into v_member_task from agent_board.create_task(v_board_thread, v_member, 'member task', 'd');
+  select task_id into v_assignee_task from agent_board.create_task(v_board_thread, v_member, 'assignee task', 'd', v_nonmember);
+  select task_id into v_observer_task from agent_board.create_task(v_board_thread, v_member, 'observer-assigned task', 'd', v_observer);
+  select task_id into v_boardless_task from agent_board.create_task(v_boardless_thread, v_member, 'boardless task', 'd');
+  -- member raises a conflict + escalation on the member task (task-attached, so they append events).
+  select conflict_id into v_conflict from agent_board.raise_conflict(v_board_thread, v_member, 'c', 'other', 'medium', v_member_task);
+  select escalation_id into v_escalation from agent_board.raise_escalation(v_board_thread, v_member, 'e', 'other', 'medium', v_member_task);
+
+  insert into _o3_fixture values
+    (v_board, v_member, v_observer, v_nonmember, v_member_task, v_assignee_task, v_observer_task,
+     v_boardless_task, v_conflict, v_escalation, v_member_user, v_observer_user, v_nonmember_user);
+end
+$$;
+
+-- DENY (mutation pins): an observer cannot mutate a board-thread task it is not a party to ----
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select observer_user from _o3_fixture)::text, true);
+
+select throws_ok(
+  (select format($q$select agent_board.append_task_event(%L::uuid, %L::uuid, 'commented')$q$,
+     member_task, observer_agent) from _o3_fixture),
+  '42501', 'task mutation requires a non-observer board role, or task assignment/creation',
+  'observer cannot append_task_event to a board-thread task it is not a party to');
+
+select throws_ok(
+  (select format($q$select agent_board.acquire_claim(%L::uuid, 'custom', 'k1', now() + interval '1 hour', %L::uuid)$q$,
+     observer_agent, member_task) from _o3_fixture),
+  '42501', 'task mutation requires a non-observer board role, or task assignment/creation',
+  'observer cannot acquire_claim on a board-thread task (transitive)');
+
+select throws_ok(
+  (select format($q$select agent_board.resolve_conflict(%L::uuid, %L::uuid)$q$,
+     conflict_id, observer_agent) from _o3_fixture),
+  '42501', 'task mutation requires a non-observer board role, or task assignment/creation',
+  'observer cannot resolve_conflict on a board-thread task (transitive)');
+
+select throws_ok(
+  (select format($q$select agent_board.resolve_escalation(%L::uuid, %L::uuid)$q$,
+     escalation_id, observer_agent) from _o3_fixture),
+  '42501', 'task mutation requires a non-observer board role, or task assignment/creation',
+  'observer cannot resolve_escalation on a board-thread task (transitive)');
+
+-- ALLOW twins: the assignee/creator carve-out preserves legitimate workers -------------------
+-- A NON-board-member assignee may work their assigned task (the over-block this rule prevents).
+select set_config('request.jwt.claim.sub', (select nonmember_user from _o3_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.append_task_event(%L::uuid, %L::uuid, 'commented')$q$,
+     assignee_task, nonmember_agent) from _o3_fixture),
+  'a non-member ASSIGNEE may mutate their assigned board-thread task (carve-out)');
+
+-- An observer who is the ASSIGNEE may mutate that task (assignment authorizes it).
+select set_config('request.jwt.claim.sub', (select observer_user from _o3_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.append_task_event(%L::uuid, %L::uuid, 'commented')$q$,
+     observer_task, observer_agent) from _o3_fixture),
+  'an observer who is the assignee may mutate that task (carve-out)');
+
+-- A non-observer member may mutate any board-thread task.
+select set_config('request.jwt.claim.sub', (select member_user from _o3_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.append_task_event(%L::uuid, %L::uuid, 'commented')$q$,
+     member_task, member_agent) from _o3_fixture),
+  'a non-observer member may mutate a board-thread task');
+
+select lives_ok(
+  (select format($q$select agent_board.resolve_conflict(%L::uuid, %L::uuid)$q$,
+     conflict_id, member_agent) from _o3_fixture),
+  'a member may resolve_conflict on a board-thread task (transitive path works for a legit actor)');
+
+-- board-less task: no board link -> access-only, no role gate (no regression).
+select lives_ok(
+  (select format($q$select agent_board.append_task_event(%L::uuid, %L::uuid, 'commented')$q$,
+     boardless_task, member_agent) from _o3_fixture),
+  'a board-less task is unaffected by the mutate gate (access-only)');
+
+-- service_role carve-out.
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  (select format($q$select agent_board.append_task_event(%L::uuid, %L::uuid, 'commented')$q$,
+     member_task, observer_agent) from _o3_fixture),
+  'service_role may mutate a board-thread task regardless of role (carve-out)');
+
+-- the new SECURITY DEFINER predicate carries no PUBLIC EXECUTE (MBHARDEN #118).
+select set_config('request.jwt.claim.role', '', true);
+select ok(
+  not has_function_privilege('public', 'agent_board._current_agent_can_mutate_task(uuid)', 'EXECUTE'),
+  '_current_agent_can_mutate_task carries no PUBLIC EXECUTE (class invariant)');
+
+select * from finish();
+
+rollback;

package/tests/agent_board_obsgate4.test.sql

@@ -0,0 +1,196 @@
+-- OBSGATE-4 (#127) pgTAP: a claim on a TASK resource requires task-mutate rights (closing the
+-- squat), and a task-less resolve_conflict/resolve_escalation is gated on the board posting rule
+-- (and no longer errors on the no-task path).
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role(),
+-- request.jwt.claim.sub picks the actor.
+--
+-- DENY assertions are the mutation pins (append/_current_agent_can_mutate_task on acquire; the
+-- posting gate on task-less resolve). ALLOW twins guard over-block and prove the v_event no-task fix.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(13);
+
+create temp table _o4_fixture (
+  board uuid,
+  member_agent uuid,
+  observer_agent uuid,
+  nonmember_agent uuid,
+  member_task uuid,
+  member_task2 uuid,
+  assignee_task uuid,
+  restricted_task uuid,
+  board_thread uuid,
+  taskless_conflict uuid,
+  taskless_escalation uuid,
+  member_user uuid,
+  observer_user uuid,
+  nonmember_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_member_user uuid; v_observer_user uuid; v_nonmember_user uuid;
+  v_creator uuid := gen_random_uuid();
+  v_member uuid := gen_random_uuid();
+  v_observer uuid := gen_random_uuid();
+  v_nonmember uuid := gen_random_uuid();
+  v_board uuid;
+  v_board_thread uuid := gen_random_uuid();
+  v_member_task uuid; v_member_task2 uuid; v_assignee_task uuid; v_restricted_task uuid;
+  v_restricted_thread uuid := gen_random_uuid();
+  v_conflict uuid; v_escalation uuid;
+begin
+  v_member_user := public.ensure_github_user('o4-member-' || v_suffix, 'o4-member-' || v_suffix || '@example.test', 'o4-member-' || v_suffix, 'O4 Member');
+  v_observer_user := public.ensure_github_user('o4-observer-' || v_suffix, 'o4-observer-' || v_suffix || '@example.test', 'o4-observer-' || v_suffix, 'O4 Observer');
+  v_nonmember_user := public.ensure_github_user('o4-nonmember-' || v_suffix, 'o4-nonmember-' || v_suffix || '@example.test', 'o4-nonmember-' || v_suffix, 'O4 Nonmember');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_creator, 'agent', 'o4-creator-' || v_suffix, 'O4 Creator', 'active', null, null),
+    (v_member, 'agent', 'o4-member-' || v_suffix, 'O4 Member', 'active', v_member_user, v_member_user),
+    (v_observer, 'agent', 'o4-observer-' || v_suffix, 'O4 Observer', 'active', v_observer_user, v_observer_user),
+    (v_nonmember, 'agent', 'o4-nonmember-' || v_suffix, 'O4 Nonmember', 'active', v_nonmember_user, v_nonmember_user);
+
+  select board_id into v_board
+    from agent_board.create_board(v_creator, 'o4-board-' || v_suffix, 'O4 Board', 'obsgate4 test', '{}'::jsonb, 'private');
+
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board, v_member, 'joined', v_creator, 'member'),
+    (v_board, v_observer, 'joined', v_creator, 'observer');
+
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values (v_board_thread, 'coordination', v_member, 'O4 board thread');
+
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', v_member_user::text, true);
+  perform agent_board.post_board_message(v_board_thread, v_member, v_board, 'seed', 'seed body');
+
+  select task_id into v_member_task from agent_board.create_task(v_board_thread, v_member, 'member task', 'd');
+  select task_id into v_member_task2 from agent_board.create_task(v_board_thread, v_member, 'member task 2', 'd');
+  select task_id into v_assignee_task from agent_board.create_task(v_board_thread, v_member, 'assignee task', 'd', v_nonmember);
+  -- task-LESS conflict + escalation on the board thread (raised by the member; #123 permits).
+  select conflict_id into v_conflict from agent_board.raise_conflict(v_board_thread, v_member, 'c');
+  select escalation_id into v_escalation from agent_board.raise_escalation(v_board_thread, v_member, 'e');
+
+  -- A RESTRICTED thread the member is NOT on, board-stamped, with a task. The member holds board
+  -- send-role (so _current_agent_can_mutate_task is true via _current_agent_can_post_to_thread)
+  -- but has NO thread access — the case where mutate != access. Set up as service_role.
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, access_mode)
+  values (v_restricted_thread, 'coordination', v_creator, 'O4 restricted thread', 'restricted');
+  insert into agent_board.thread_memberships(thread_id, agent_id, role, granted_by_agent_id)
+  values (v_restricted_thread, v_creator, 'member', v_creator);
+  perform set_config('request.jwt.claim.role', 'service_role', true);
+  perform set_config('request.jwt.claim.sub', '', true);
+  perform agent_board.post_board_message(v_restricted_thread, v_creator, v_board, 'seed', 'seed');
+  select task_id into v_restricted_task from agent_board.create_task(v_restricted_thread, v_creator, 'restricted task', 'd');
+
+  insert into _o4_fixture values
+    (v_board, v_member, v_observer, v_nonmember, v_member_task, v_member_task2, v_assignee_task,
+     v_restricted_task, v_board_thread, v_conflict, v_escalation, v_member_user, v_observer_user, v_nonmember_user);
+end
+$$;
+
+-- DENY (mutation pins): a task-resource claim requires task-mutate rights -----
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select observer_user from _o4_fixture)::text, true);
+
+-- the squat: resource_kind='task', resource_key=<task id>, NO task/thread context
+select throws_ok(
+  (select format($q$select agent_board.acquire_claim(%L::uuid, 'task', %L, now() + interval '1 hour')$q$,
+     observer_agent, member_task::text) from _o4_fixture),
+  '42501', 'claiming a task resource requires a non-observer board role, or task assignment/creation',
+  'observer cannot squat a task-resource claim with no context (DoS closed)');
+
+select throws_ok(
+  (select format($q$select agent_board.acquire_claim(%L::uuid, 'task', %L, now() + interval '1 hour', null, %L::uuid)$q$,
+     observer_agent, member_task::text, board_thread) from _o4_fixture),
+  '42501', 'claiming a task resource requires a non-observer board role, or task assignment/creation',
+  'observer cannot squat a task-resource claim via the thread path either');
+
+select throws_ok(
+  (select format($q$select agent_board.acquire_claim(%L::uuid, 'task', %L, now() + interval '1 hour', %L::uuid, %L::uuid)$q$,
+     observer_agent, member_task::text, member_task, board_thread) from _o4_fixture),
+  '42501', 'claiming a task resource requires a non-observer board role, or task assignment/creation',
+  'observer cannot acquire a task-bound claim on a board-thread task');
+
+-- cross-task: the gate authorizes the LOCKED task (resource_key), not p_task_id. An assignee with
+-- mutate rights on their OWN task cannot squat a DIFFERENT task's lock by passing their task as
+-- p_task_id. (nonmember is assignee of assignee_task, but not a party to member_task2.)
+select set_config('request.jwt.claim.sub', (select nonmember_user from _o4_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.acquire_claim(%L::uuid, 'task', %L, now() + interval '1 hour', %L::uuid, %L::uuid)$q$,
+     nonmember_agent, member_task2::text, assignee_task, board_thread) from _o4_fixture),
+  '42501', NULL,
+  'an assignee cannot squat a different task''s lock via p_task_id (gate keys on resource_key)');
+
+-- restricted thread: a board member with mutate (send-role) but NO thread access cannot squat the
+-- restricted task's claim — the gate composes ACCESS + MUTATE like append_task_event (round-5 codex).
+select set_config('request.jwt.claim.sub', (select member_user from _o4_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.acquire_claim(%L::uuid, 'task', %L, now() + interval '1 hour')$q$,
+     member_agent, restricted_task::text) from _o4_fixture),
+  '42501', 'task not accessible to current agent',
+  'a board member without restricted-thread access cannot squat that task''s claim (access gate)');
+
+-- ALLOW twins -------------------------------------------------------------------------------
+select set_config('request.jwt.claim.sub', (select member_user from _o4_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.acquire_claim(%L::uuid, 'task', %L, now() + interval '1 hour', %L::uuid, %L::uuid)$q$,
+     member_agent, member_task::text, member_task, board_thread) from _o4_fixture),
+  'a member may acquire a task-resource claim');
+
+select set_config('request.jwt.claim.sub', (select nonmember_user from _o4_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.acquire_claim(%L::uuid, 'task', %L, now() + interval '1 hour', %L::uuid)$q$,
+     nonmember_agent, assignee_task::text, assignee_task) from _o4_fixture),
+  'a non-member ASSIGNEE may acquire their assigned task''s resource claim (carve-out)');
+
+-- task-less resolve: observer denied, member allowed (+ v_event no-task fix) ------------------
+select set_config('request.jwt.claim.sub', (select observer_user from _o4_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.resolve_conflict(%L::uuid, %L::uuid)$q$,
+     taskless_conflict, observer_agent) from _o4_fixture),
+  '42501', 'thread posting requires a non-observer board role',
+  'observer cannot resolve a task-less conflict on a board thread');
+
+select throws_ok(
+  (select format($q$select agent_board.resolve_escalation(%L::uuid, %L::uuid)$q$,
+     taskless_escalation, observer_agent) from _o4_fixture),
+  '42501', 'thread posting requires a non-observer board role',
+  'observer cannot resolve a task-less escalation on a board thread');
+
+select set_config('request.jwt.claim.sub', (select member_user from _o4_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.resolve_conflict(%L::uuid, %L::uuid)$q$,
+     taskless_conflict, member_agent) from _o4_fixture),
+  'a member may resolve a task-less conflict (v_event no-task fix — no 55000)');
+
+select lives_ok(
+  (select format($q$select agent_board.resolve_escalation(%L::uuid, %L::uuid)$q$,
+     taskless_escalation, member_agent) from _o4_fixture),
+  'a member may resolve a task-less escalation (v_event no-task fix)');
+
+-- scope boundary: a NON-task resource claim is not gated by OBSGATE (out of scope) -----------
+select set_config('request.jwt.claim.sub', (select observer_user from _o4_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.acquire_claim(%L::uuid, 'custom', 'o4-custom-key', now() + interval '1 hour')$q$,
+     observer_agent) from _o4_fixture),
+  'a non-task resource claim is not gated by OBSGATE-4 (coordination-authz, out of scope)');
+
+-- service_role carve-out.
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  (select format($q$select agent_board.acquire_claim(%L::uuid, 'task', %L, now() + interval '1 hour')$q$,
+     member_agent, member_task2::text) from _o4_fixture),
+  'service_role may acquire a task-resource claim regardless of role (carve-out)');
+
+select * from finish();
+
+rollback;

package/tests/agent_board_portal_offline_invariant.test.sql

@@ -53,8 +53,8 @@ begin
   -- A SECOND signing key (key_version 2; enroll auto-enrolled version 1) + a pending
   -- challenge bound to it, so the mint step below can drive PoP -> mint deterministically.
   insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
-  values (v_key, v_agent, 'primary', 2, repeat('A',43), 'raw_ed25519_base64url',
-          'sha256:'||rpad(replace(v_key::text,'-',''),43,'A'), 'active', 'proven');
+  values (v_key, v_agent, 'primary', 2, public.test_pubkey(v_key::text), 'raw_ed25519_base64url',
+          public.test_key_fingerprint(v_key::text), 'active', 'proven');
   insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at, consumed_at)
   values (v_ch, v_key, v_agent, v_ch::text, 'agent-signing-key-proof.v1:'||v_ch||':n', 'pending', now() + interval '10 minutes', null);
 
@@ -97,6 +97,17 @@ select lives_ok(
 select set_config('request.jwt.claim.role', '', true);
 select set_config('request.jwt.claim.sub', '', true);
 
+-- The send LANDED, not merely raised no exception (message-board#87): the prior
+-- lives_ok proves no error, but the header's "board writes are unaffected" claim
+-- needs the fan-out write to be observable. Assert the board post produced board
+-- delivery rows for the board — the write path executed Portal-offline.
+select ok(
+  exists(
+    select 1 from agent_board.delivery_recipients
+     where board_id = (select board from _pofx)
+       and delivery_mode = 'board'),
+  'the Portal-offline board-member send landed board delivery rows (board writes unaffected)');
+
 -- revoke: the lifecycle terminates cleanly; the agent is no longer active. ---------
 select lives_ok(
   (select format($q$select agent_board.revoke_agent(%L::uuid, 'portal-offline lifecycle test')$q$, agent) from _pofx),

package/tests/agent_board_pubexec_class.test.sql

@@ -0,0 +1,53 @@
+-- MBHARDEN / #118 — no agent_board SECURITY DEFINER function may carry a PUBLIC EXECUTE
+-- ACL. CREATE FUNCTION defaults EXECUTE to PUBLIC; a SECURITY DEFINER function runs as the
+-- schema owner, so a stray PUBLIC grant lets any authenticated caller drive owner-privileged
+-- logic. #97 closed mark_retention_metadata; 20260812000100 closes the other five.
+--
+-- Assertions are catalog-derived (the durable class invariant) plus two named pins for the
+-- genuine holes, and one over-revoke guard. Each is mutation-pinned:
+--   * removing ANY of the five revokes -> the class count becomes >= 1 -> assert 1 fails.
+--   * removing the _record_signed_write_evidence / _resolve_addressing_recipient_rows revoke
+--     -> its named assert flips to true -> fails.
+--   * "fixing" the invariant by nuking authenticated grants instead of PUBLIC -> assert 4
+--     (an intentionally authenticated SECURITY DEFINER RPC) fails.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public;
+
+begin;
+
+select plan(4);
+
+-- The class invariant. PUBLIC is the `=X` pseudo-grantee; has_function_privilege('public',…)
+-- is true ONLY when PUBLIC itself holds EXECUTE, so intentional named grants (e.g. to
+-- authenticated) do not trip this.
+select is(
+  (select count(*)::int
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and p.prosecdef
+      and has_function_privilege('public', p.oid, 'EXECUTE')),
+  0,
+  'class invariant: no agent_board SECURITY DEFINER function carries a PUBLIC EXECUTE ACL');
+
+-- Named pin: the forge hole. Authenticated must not be able to INSERT forged signed-write
+-- attestations by calling the evidence recorder directly.
+select ok(
+  not has_function_privilege('authenticated', 'agent_board._record_signed_write_evidence(text,uuid,text,jsonb,jsonb)', 'EXECUTE'),
+  'authenticated cannot execute _record_signed_write_evidence (attestation forge)');
+
+-- Named pin: the enumeration leak. Authenticated must not be able to run the actor-spoofable
+-- directory resolver directly, bypassing resolve_recipients'' session rebind.
+select ok(
+  not has_function_privilege('authenticated', 'agent_board._resolve_addressing_recipient_rows(uuid,jsonb)', 'EXECUTE'),
+  'authenticated cannot execute _resolve_addressing_recipient_rows (directory leak)');
+
+-- Over-revoke guard: the invariant targets PUBLIC, not intended named grants. A SECURITY
+-- DEFINER RPC deliberately granted to authenticated must keep working.
+select ok(
+  has_function_privilege('authenticated', 'agent_board.get_schema_version()', 'EXECUTE'),
+  'intended authenticated grant on a SECURITY DEFINER RPC is preserved');
+
+select * from finish();
+
+rollback;