@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/tests/agent_board_rolereset.test.sql

@@ -0,0 +1,351 @@
+-- MBROLERESET pgTAP: role is NOT identity.
+--
+-- Closes #79 on two axes:
+--   (1) agent_board._upsert_board_membership_state clamps `role` to the
+--       board_memberships.role table default ('member') on any transition whose
+--       ORIGIN is a non-active state (requested|invited|left|removed) and whose
+--       TARGET is joined|subscribed. UPDATE branch only -- the INSERT branch already
+--       omits `role` and takes the table default, so a no-prior-row entry needs no clamp.
+--   (2) agent_board.grant_board_role refuses a grant onto a non-active membership:
+--       a membership_state filter in the PRE-CHECK (P0002) *and* mirrored into the
+--       UPDATE (the TOCTOU half, which no serial test can reach -- asserted structurally).
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role()
+-- (''/service_role => true, 'authenticated' => false) and request.jwt.claim.sub picks
+-- the acting agent. Fixture style mirrors agent_board_roomown.test.sql.
+--
+-- Methodology notes that are load-bearing here (each has produced a false result in
+-- this repo before):
+--   * every negative assertion goes through throws_ok -- the runner fails on ANY line
+--     containing 'ERROR:', so a bare uncaught raise fails the file even when expected.
+--   * an authenticated block carries an explicit _is_service_role() = false control;
+--     `set role` alone leaves session_user = postgres, so the service branch would
+--     satisfy every assertion vacuously.
+--   * both a DENY and an ALLOW are asserted -- a fail-closed bug is invisible to a
+--     "is it locked down?" check.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(23);
+
+create temp table _rr_fixture (
+  open_board uuid,
+  priv_board uuid,
+  owner_agent uuid,
+  owner_user uuid,
+  admin_agent uuid,
+  requester uuid,
+  invitee uuid,
+  fresh uuid,
+  lockout_board uuid,
+  lockout_owner uuid,
+  lockout_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_owner uuid := gen_random_uuid();
+  v_owner_user uuid;
+  v_admin uuid := gen_random_uuid();
+  v_requester uuid := gen_random_uuid();
+  v_invitee uuid := gen_random_uuid();
+  v_fresh uuid := gen_random_uuid();
+  v_lockout_owner uuid := gen_random_uuid();
+  v_lockout_user uuid;
+  v_open uuid;
+  v_priv uuid;
+  v_lockout uuid;
+begin
+  v_owner_user := public.ensure_github_user('rr-owner-' || v_suffix, 'rr-owner-' || v_suffix || '@example.test', 'rr-owner-' || v_suffix, 'RR Owner');
+  v_lockout_user := public.ensure_github_user('rr-lock-' || v_suffix, 'rr-lock-' || v_suffix || '@example.test', 'rr-lock-' || v_suffix, 'RR Lockout');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_owner, 'agent', 'rr-owner-' || v_suffix, 'RR Owner', 'active', v_owner_user, v_owner_user),
+    (v_lockout_owner, 'agent', 'rr-lock-' || v_suffix, 'RR Lockout', 'active', v_lockout_user, v_lockout_user),
+    (v_admin, 'agent', 'rr-admin-' || v_suffix, 'RR Admin', 'active', null, null),
+    (v_requester, 'agent', 'rr-req-' || v_suffix, 'RR Requester', 'active', null, null),
+    (v_invitee, 'agent', 'rr-inv-' || v_suffix, 'RR Invitee', 'active', null, null),
+    (v_fresh, 'agent', 'rr-fresh-' || v_suffix, 'RR Fresh', 'active', null, null);
+
+  -- Board OPEN: hosts repro B (owner self-leave -> self-rejoin) because join_board's
+  -- self path only admits a stranger on an 'open' board.
+  select board_id into v_open
+    from agent_board.create_board(v_owner, 'rr-open-' || v_suffix, 'RR Open', 'rolereset open', '{}'::jsonb, 'open');
+
+  -- Board PRIVATE: hosts the per-origin clamp matrix, driven service_role so the
+  -- transition itself is never the thing under test.
+  select board_id into v_priv
+    from agent_board.create_board(v_owner, 'rr-priv-' || v_suffix, 'RR Private', 'rolereset private', '{}'::jsonb, 'private');
+
+  -- Board LOCKOUT: a board whose sole owner will self-leave and rejoin as member,
+  -- to pin the documented no-RPC-recovery limitation.
+  select board_id into v_lockout
+    from agent_board.create_board(v_lockout_owner, 'rr-lock-' || v_suffix, 'RR Lockout', 'sole owner', '{}'::jsonb, 'open');
+
+  -- Elevated non-owner memberships whose roles must NOT survive re-entry.
+  -- board_memberships_state_left_at (20260515000000:21-25): left/removed REQUIRE a
+  -- non-null left_at; requested/invited/joined/subscribed REQUIRE null. Seed distinct
+  -- PAST timestamps -- now() is transaction_timestamp() and constant for the whole
+  -- transaction, so any later "was this restamped?" comparison written now-vs-now
+  -- could not fail.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role, left_at)
+  values
+    (v_priv, v_admin, 'removed', v_owner, 'admin', timestamptz '2019-06-01'),
+    (v_priv, v_requester, 'requested', v_owner, 'admin', null),
+    (v_priv, v_invitee, 'invited', v_owner, 'admin', null);
+
+  insert into _rr_fixture values
+    (v_open, v_priv, v_owner, v_owner_user, v_admin, v_requester, v_invitee, v_fresh,
+     v_lockout, v_lockout_owner, v_lockout_user);
+end
+$$;
+
+-- 1. The clamp's target value is the table default, and it is still 'member'. -------
+-- The clamp hardcodes 'member' (reading information_schema.column_default at runtime
+-- would yield the quoted EXPRESSION "'member'::text", not the value). This assertion is
+-- the other half of that contract: a future `alter ... set default` turns the suite red
+-- instead of silently diverging from the hardcoded clamp.
+select is(
+  (select column_default from information_schema.columns
+    where table_schema = 'agent_board' and table_name = 'board_memberships' and column_name = 'role'),
+  '''member''::text',
+  'board_memberships.role default is still ''member'' (the value the clamp hardcodes)');
+
+-- 2. Redemption presets can never cross a non-active -> active edge. ---------------
+-- _redeem_invite_for_agent raw-inserts role=preset_role (admin max). If preset_membership_state
+-- could be 'invited', the target's later acceptance would travel invited->joined THROUGH the
+-- mutator and the clamp would erase the preset. The CHECK forbids it; pin that.
+select is(
+  (select count(*)::int from information_schema.check_constraints cc
+     join information_schema.constraint_column_usage ccu on ccu.constraint_name = cc.constraint_name
+    where ccu.table_schema = 'agent_board'
+      and ccu.table_name = 'board_invite_tokens'
+      and ccu.column_name = 'preset_membership_state'
+      and cc.check_clause like '%joined%'
+      and cc.check_clause like '%subscribed%'
+      and cc.check_clause not like '%invited%'),
+  1,
+  'board_invite_tokens.preset_membership_state is constrained to joined|subscribed, so a REDEEMED row is active on arrival and never crosses the clamp (a fresh token grant to a left agent is a separate, intentional path)');
+
+-- 3. Redemption bypasses the mutator entirely, so the clamp cannot reach its preset. -
+select ok(
+  (select pg_get_functiondef(p.oid) not like '%_upsert_board_membership_state%'
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_redeem_invite_for_agent'
+    limit 1),
+  '_redeem_invite_for_agent raw-inserts and never calls the mutator (admin preset survives)');
+
+-- 4. create_board's owner seed is a raw insert and is likewise unreachable by the clamp.
+select is(
+  (select role from agent_board.board_memberships bm join _rr_fixture f on bm.board_id = f.priv_board and bm.agent_id = f.owner_agent),
+  'owner',
+  'create_board owner seed still lands ''owner'' (raw insert, clamp must not reach it)');
+
+-- ==================================================================================
+-- The clamp matrix. Driven as service_role so the TRANSITION is never what is under
+-- test -- only the resulting role. Per the ruling, service_role gets NO exemption:
+-- an operator re-activating an evicted agent gets the default role like anyone else.
+-- ==================================================================================
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- 5. removed -> joined clamps (this is repro A's second half).
+select agent_board.update_board_membership(priv_board, admin_agent, 'joined') from _rr_fixture;
+select is(
+  (select role from agent_board.board_memberships bm join _rr_fixture f on bm.board_id = f.priv_board and bm.agent_id = f.admin_agent),
+  'member',
+  'removed -> joined clamps role to the table default (a re-admitted admin is not admin)');
+
+-- 6. requested -> joined clamps.
+select agent_board.update_board_membership(priv_board, requester, 'joined') from _rr_fixture;
+select is(
+  (select role from agent_board.board_memberships bm join _rr_fixture f on bm.board_id = f.priv_board and bm.agent_id = f.requester),
+  'member',
+  'requested -> joined clamps role to the table default');
+
+-- 7. invited -> subscribed clamps. Deliberately targets SUBSCRIBED, not joined: the
+-- invariant covers entry into BOTH active states, and an implementation that clamps only
+-- 'joined' would pass a joined-only matrix while a stale role survived via subscribed.
+select agent_board.update_board_membership(priv_board, invitee, 'subscribed') from _rr_fixture;
+select is(
+  (select role from agent_board.board_memberships bm join _rr_fixture f on bm.board_id = f.priv_board and bm.agent_id = f.invitee),
+  'member',
+  'invited -> SUBSCRIBED clamps role to the table default (subscribed is not a clamp hole)');
+
+-- 8. left -> subscribed clamps. Second subscribed-target origin.
+select agent_board.update_board_membership(priv_board, admin_agent, 'left') from _rr_fixture;
+-- Re-elevate role ONLY (state and left_at untouched) so the next transition's origin is
+-- a genuine non-active row carrying a non-default role.
+update agent_board.board_memberships bm set role = 'admin'
+  from _rr_fixture f where bm.board_id = f.priv_board and bm.agent_id = f.admin_agent;
+select agent_board.update_board_membership(priv_board, admin_agent, 'subscribed') from _rr_fixture;
+select is(
+  (select role from agent_board.board_memberships bm join _rr_fixture f on bm.board_id = f.priv_board and bm.agent_id = f.admin_agent),
+  'member',
+  'left -> SUBSCRIBED clamps role to the table default');
+
+-- 9. ACTIVE -> ACTIVE NO-REGRESSION. The one edge the clamp must NOT fire on: an
+-- already-active membership changing between joined and subscribed keeps its role,
+-- including 'owner'. Without this the clamp would silently demote every owner who
+-- toggles subscription.
+select agent_board.update_board_membership(priv_board, owner_agent, 'subscribed') from _rr_fixture;
+select is(
+  (select role from agent_board.board_memberships bm join _rr_fixture f on bm.board_id = f.priv_board and bm.agent_id = f.owner_agent),
+  'owner',
+  'joined -> subscribed on an ACTIVE membership PRESERVES owner (active->active is not clamped)');
+
+-- 10. No-prior-row entry takes the table default via the INSERT branch, with no clamp
+-- involved. Recorded so the INSERT branch is never "fixed" to write role explicitly.
+select agent_board.join_board(open_board, fresh, 'joined') from _rr_fixture;
+select is(
+  (select role from agent_board.board_memberships bm join _rr_fixture f on bm.board_id = f.open_board and bm.agent_id = f.fresh),
+  'member',
+  'first-time join lands ''member'' via the table default (INSERT branch omits role)');
+
+-- ==================================================================================
+-- grant_board_role: the second axis.
+-- ==================================================================================
+
+-- 11. ALLOW control: a grant onto an ACTIVE membership still works and really changes
+-- the role. A DENY-only suite cannot tell "correctly filtered" from "broken for everyone".
+-- invitee is ACTIVE (subscribed) on priv_board after assertion 7, and owner_agent still
+-- holds 'owner' there after the active->active no-regression at 9, so the ceiling permits admin.
+select lives_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin', %L::uuid)$q$, priv_board, invitee, owner_agent) from _rr_fixture),
+  'service_role: grant_board_role onto an ACTIVE (subscribed) membership still succeeds');
+
+-- 11b. ...and it REALLY CHANGED THE ROLE. lives_ok alone is not an ALLOW control: an
+-- implementation that correctly refuses non-active grants but silently no-ops ACTIVE ones
+-- passes lives_ok. Read the role back.
+select is(
+  (select role from agent_board.board_memberships bm join _rr_fixture f on bm.board_id = f.priv_board and bm.agent_id = f.invitee),
+  'admin',
+  'the ALLOW grant actually wrote the role (lives_ok alone would pass against a silent no-op)');
+
+-- 12. REPRO A (first half): grant_board_role onto a NON-ACTIVE membership is refused.
+-- Today this SUCCEEDS and writes role onto the removed row -- the live WHERE clause is
+-- board_id+agent_id only, so it MATCHES. That is the #79 re-arm.
+select agent_board.update_board_membership(priv_board, requester, 'removed') from _rr_fixture;
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin', %L::uuid)$q$, priv_board, requester, owner_agent) from _rr_fixture),
+  'P0002',
+  'grantee has no membership on this board',
+  'grant_board_role onto a REMOVED membership raises P0002 (the #79 re-arm is closed)');
+
+-- 13. The pre-check must not have become a no-row oracle: an agent with NO row at all
+-- raises the same P0002, so a removed grantee is not distinguishable from an absent one.
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'member', %L::uuid)$q$, priv_board, fresh, owner_agent) from _rr_fixture),
+  'P0002',
+  'grantee has no membership on this board',
+  'a no-row grantee raises the SAME P0002 as a removed one (no error-code oracle)');
+
+-- 14. The removed row's role was not mutated by the refused grant.
+select is(
+  (select role from agent_board.board_memberships bm join _rr_fixture f on bm.board_id = f.priv_board and bm.agent_id = f.requester),
+  'member',
+  'the refused grant left the removed row''s role untouched');
+
+-- 15. STRUCTURAL: the mirrored UPDATE-side predicate is present in the shipped body.
+-- No serial test can reach this path -- a pre-check-only implementation passes every
+-- behavioural assertion above, because the UPDATE is never reached with a non-active row
+-- unless an eviction lands between the pre-check and the UPDATE (the TOCTOU window).
+-- Both review seats flagged this independently; assert the predicate structurally.
+select ok(
+  (select (
+     select count(*) from regexp_matches(
+       pg_get_functiondef(p.oid),
+       'membership_state\s+in\s*\(\s*''joined''\s*,\s*''subscribed''\s*\)',
+       'g')) >= 2
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'grant_board_role'
+    limit 1),
+  'grant_board_role carries the active-state predicate TWICE (pre-check + UPDATE, the TOCTOU half)');
+
+-- 16. STRUCTURAL: the clamp lives in the mutator, not in a trigger. A BEFORE UPDATE
+-- trigger on board_memberships would also fire for the four raw-insert seeders and
+-- erase create_board's owner seed and ROOMLINK's admin preset.
+select is(
+  (select count(*)::int from pg_trigger t
+     join pg_class c on c.oid = t.tgrelid
+     join pg_namespace n on n.oid = c.relnamespace
+    where n.nspname = 'agent_board' and c.relname = 'board_memberships'
+      and not t.tgisinternal),
+  0,
+  'no user trigger on board_memberships (the clamp is mutator-sited, never a trigger)');
+
+-- 17. STRUCTURAL: the mutator's superseding comment no longer claims it never writes role.
+select ok(
+  (select obj_description(p.oid, 'pg_proc') not like '%never writes%'
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_upsert_board_membership_state'
+    limit 1),
+  'the mutator''s comment was re-issued and no longer contradicts the body');
+
+-- ==================================================================================
+-- REPRO B + the authenticated principal. From here the caller is a real authenticated
+-- agent, NOT service_role.
+-- ==================================================================================
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select owner_user from _rr_fixture)::text, true);
+
+-- 18. The vacuity control. Without this, every assertion below could pass through the
+-- service branch while proving nothing: `set role` does not change session_user, so
+-- _is_service_role() would return TRUE and the authenticated path would never execute.
+select is(agent_board._is_service_role(), false,
+  'control: the authenticated block really is NOT service_role (assertions below are not vacuous)');
+
+-- 19. REPRO B: the owner self-leaves the OPEN board...
+select lives_ok(
+  (select format($q$select agent_board.leave_board(%L::uuid, %L::uuid)$q$, open_board, owner_agent) from _rr_fixture),
+  'the owner can self-leave the open board');
+
+-- 20. ...and self-rejoining returns them at the DEFAULT role, not owner. join_board
+-- excludes only 'removed' from self-join, so 'left' was the strictly safer attacker
+-- state and the whole re-arm chain routed around a reset-on-removal fix.
+select agent_board.join_board(open_board, owner_agent, 'joined') from _rr_fixture;
+select is(
+  (select role from agent_board.board_memberships bm join _rr_fixture f on bm.board_id = f.open_board and bm.agent_id = f.owner_agent),
+  'member',
+  'owner self-leave -> self-rejoin on an OPEN board returns at ''member'', not ''owner'' (#79 repro B closed)');
+
+-- 21. SOLE-OWNER LOCKOUT: grant_board_role cannot recover it. _grant_within_ceiling is
+-- checked UNCONDITIONALLY -- no service_role bypass -- so an operator must nominate a
+-- grantor that already holds rank, and in a sole-owner lockout none exists.
+-- NOTE (CR correction): this does NOT mean "no RPC recovery" exists, as an earlier draft
+-- of this suite and the CHANGELOG both claimed. bootstrap_board_owner_memberships IS a
+-- service_role RPC and raw-inserts joined/owner for a creator with no ACTIVE membership,
+-- so leave-again + bootstrap is a genuine RPC recovery path. Assertion 22 proves it.
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select agent_board.leave_board(lockout_board, lockout_owner) from _rr_fixture;
+select agent_board.join_board(lockout_board, lockout_owner, 'joined') from _rr_fixture;
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'owner', %L::uuid)$q$, lockout_board, lockout_owner, lockout_owner) from _rr_fixture),
+  '42501',
+  'grant exceeds grantor role or board authority ceiling',
+  'sole-owner lockout has NO grant_board_role recovery even as service_role (ceiling has no service bypass)');
+
+-- 22. The REAL recovery path, exercised as an RPC rather than asserted by hand. An earlier
+-- draft did `update ... set role='owner'` and then read it back, which is tautological -- it
+-- proved SQL works, not that a recovery path exists. Leave again so the creator has no ACTIVE
+-- membership, then call bootstrap_board_owner_memberships(); it raw-inserts joined/owner.
+select agent_board.leave_board(lockout_board, lockout_owner) from _rr_fixture;
+select agent_board.bootstrap_board_owner_memberships();
+select is(
+  (select role from agent_board.board_memberships bm
+     join _rr_fixture f on bm.board_id = f.lockout_board and bm.agent_id = f.lockout_owner
+    where bm.membership_state in ('joined','subscribed')),
+  'owner',
+  'RPC recovery EXISTS: leave-again + bootstrap_board_owner_memberships restores an active owner');
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+select finish();
+
+rollback;

package/tests/agent_board_roomdeleg.test.sql

@@ -9,7 +9,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(11);
+select plan(12);
 
 create temp table _roomdeleg_fixture (
   board uuid,
@@ -98,8 +98,10 @@ select throws_ok(
 
 -- 4. owner (Alice) flips false->true (pinned to a single assertion) -----------------
 select set_config('request.jwt.claim.sub', (select alice_user from _roomdeleg_fixture)::text, true);
-select is(
-  (select role_gate_enforced from agent_board.set_board_role_gate((select board from _roomdeleg_fixture), true)),
+select lives_ok($$
+  select agent_board.set_board_role_gate((select board from _roomdeleg_fixture), true) $$,
+  'set_board_role_gate: the owner flips the gate [call succeeds]');
+select is((select role_gate_enforced from agent_board.boards where id = (select board from _roomdeleg_fixture)),
   true, 'set_board_role_gate: the owner flips role_gate_enforced false->true');
 
 -- === Part B: the flipped gate restricts invite/resolve (gate now ON) ==============

package/tests/agent_board_roomdeleg_lane_b.test.sql

@@ -0,0 +1,144 @@
+-- ROOMDELEG-2 / Lane B (#59): self-service delegation POLICY writer for an
+-- authenticated root. (The minter opening is deferred to #138 — this suite asserts it
+-- stays service_role-only.)
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role()
+-- (''/service_role => true, 'authenticated' => false) and request.jwt.claim.sub picks
+-- the acting agent (auth.uid() -> agents.auth_user_id -> current_agent_id()).
+--
+-- Every property is mutation-oriented: the self-service CLAMPS (signing-key pinned,
+-- child cap bounded, TTL capped, depth pinned), the scope_attestation PROVENANCE stamp,
+-- the strict actor binding, and the EXECUTE grant class (policy writer open to
+-- authenticated; minter NOT). Allow-side assertions use lives_ok(...) + a separate state
+-- read (never is((select ... from rpc(...)))), so an allow that silently raises cannot
+-- pass as green (#113).
+
+begin;
+select plan(19);
+
+-- A non-all-'A' 43-char base64url raw-Ed25519 key (matches the mint's key regex).
+create temporary table _lb_fx (
+  root uuid,
+  root_user uuid,
+  other uuid,
+  other_user uuid,
+  pubkey text
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_root uuid := gen_random_uuid();
+  v_other uuid := gen_random_uuid();
+  v_root_user uuid;
+  v_other_user uuid;
+begin
+  v_root_user  := public.ensure_github_user('lb-root-'  || v_suffix, 'lb-root-'  || v_suffix || '@example.test', 'lb-root-'  || v_suffix, 'LB Root');
+  v_other_user := public.ensure_github_user('lb-other-' || v_suffix, 'lb-other-' || v_suffix || '@example.test', 'lb-other-' || v_suffix, 'LB Other');
+
+  -- Both are TRUE lineage roots (parent null, not delegated children).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_root,  'agent', 'lb-root-'  || v_suffix, 'LB Root',  'active', v_root_user,  v_root_user),
+    (v_other, 'agent', 'lb-other-' || v_suffix, 'LB Other', 'active', v_other_user, v_other_user);
+
+  insert into _lb_fx values (
+    v_root, v_root_user, v_other, v_other_user,
+    -- 43 base64url chars, not all-'A'
+    'Bcdefghijklmnopqrstuvwxyz0123456789ABCDEFGH');
+end
+$$;
+
+-- ---------------------------------------------------------------------------
+-- Existence
+-- ---------------------------------------------------------------------------
+select has_function('agent_board', 'upsert_delegation_policy',
+  array['uuid','text','jsonb','integer','interval','boolean'], 'upsert_delegation_policy exists');
+select has_column('agent_board', 'delegation_policies', 'scope_attestation', 'delegation_policies.scope_attestation exists');
+
+-- ===========================================================================
+-- SELF-SERVICE PATH (authenticated root == actor)
+-- ===========================================================================
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select root_user from _lb_fx)::text, true);
+
+-- M3: the self-service write stamps scope_attestation='self_declared' (advisory).
+-- M1: require_child_signing_key is PINNED true even though false was requested.
+-- M2a: max_active_children null is CLAMPED to the non-null default (5).
+-- M6a: child_ttl_ceiling 12h is accepted and stored; max_depth pinned 1.
+select lives_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', jsonb_build_array('scope:a'), null, interval '12 hours', false) $$,
+    (select root from _lb_fx)),
+  'self-service upsert_delegation_policy lives');
+
+select is((select scope_attestation from agent_board.delegation_policies where root_agent_id = (select root from _lb_fx) and revoked_at is null order by created_at desc limit 1),
+  'self_declared', 'M3: self-service scopes are stamped self_declared');
+select is((select require_child_signing_key from agent_board.delegation_policies where root_agent_id = (select root from _lb_fx) and revoked_at is null order by created_at desc limit 1),
+  true, 'M1: require_child_signing_key pinned true (requested false ignored)');
+select is((select max_active_children from agent_board.delegation_policies where root_agent_id = (select root from _lb_fx) and revoked_at is null order by created_at desc limit 1),
+  5, 'M2a: null max_active_children clamped to non-null default 5');
+select is((select max_depth from agent_board.delegation_policies where root_agent_id = (select root from _lb_fx) and revoked_at is null order by created_at desc limit 1),
+  1, 'max_depth pinned 1');
+select is((select child_ttl_ceiling from agent_board.delegation_policies where root_agent_id = (select root from _lb_fx) and revoked_at is null order by created_at desc limit 1),
+  interval '12 hours', 'M6: within-cap ttl (12h) stored');
+
+-- M2b/M2c: out-of-range child cap rejected (both ends).
+select throws_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', jsonb_build_array('scope:a'), 26) $$, (select root from _lb_fx)),
+  '22023', null, 'M2b: max_active_children 26 (> 25) rejected');
+select throws_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', jsonb_build_array('scope:a'), 0) $$, (select root from _lb_fx)),
+  '22023', null, 'M2c: max_active_children 0 (< 1) rejected');
+
+-- M6b: over-cap ttl rejected.
+select throws_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', jsonb_build_array('scope:a'), 5, interval '90 days') $$, (select root from _lb_fx)),
+  '22023', null, 'M6b: child_ttl_ceiling 90 days (> 24h) rejected');
+
+-- M4 (policy writer): an authenticated caller cannot write UNDER A DIFFERENT ROOT.
+select set_config('request.jwt.claim.sub', (select other_user from _lb_fx)::text, true);
+select throws_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', jsonb_build_array('scope:a')) $$, (select root from _lb_fx)),
+  '42501', null, 'M4: authenticated OTHER cannot upsert policy under a different root');
+
+-- ===========================================================================
+-- OPERATOR PATH (service_role): trusted — scopes operator_vetted, caps as supplied.
+-- ===========================================================================
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+select lives_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', jsonb_build_array('scope:a'), null, interval '8 hours', false) $$, (select root from _lb_fx)),
+  'operator upsert_delegation_policy lives');
+select is((select scope_attestation from agent_board.delegation_policies where root_agent_id = (select root from _lb_fx) and revoked_at is null order by created_at desc limit 1),
+  'operator_vetted', 'operator scopes are operator_vetted');
+select is((select require_child_signing_key from agent_board.delegation_policies where root_agent_id = (select root from _lb_fx) and revoked_at is null order by created_at desc limit 1),
+  false, 'operator require_child_signing_key=false honored (trusted)');
+
+-- ===========================================================================
+-- M5 — EXECUTE grant class. The POLICY writer is executable by authenticated
+-- (not anon). The MINTER is DEFERRED: it must remain service_role-only — assert
+-- authenticated does NOT gain EXECUTE, proving the narrowing held (opening it needs
+-- child-key PoP + raw-byte fingerprint first, tracked in #138).
+-- ===========================================================================
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+select ok(has_function_privilege('authenticated',
+  'agent_board.upsert_delegation_policy(uuid, text, jsonb, integer, interval, boolean)', 'EXECUTE'),
+  'M5: authenticated may EXECUTE upsert_delegation_policy');
+select ok(not has_function_privilege('anon',
+  'agent_board.upsert_delegation_policy(uuid, text, jsonb, integer, interval, boolean)', 'EXECUTE'),
+  'M5: anon may NOT EXECUTE upsert_delegation_policy');
+select ok(not has_function_privilege('authenticated',
+  'agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean)', 'EXECUTE'),
+  'M5: mint_delegated_child stays service_role-only — authenticated has NO EXECUTE (deferred to #138)');
+select ok(not has_function_privilege('anon',
+  'agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean)', 'EXECUTE'),
+  'M5: anon may NOT EXECUTE mint_delegated_child');
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+select * from finish();
+rollback;

package/tests/agent_board_roomlink.test.sql

@@ -22,7 +22,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(34);
+select plan(38);
 
 create temp table _lf (
   board uuid,
@@ -187,10 +187,20 @@ select throws_ok(
 select set_config('request.jwt.claim.role', '', true);
 select set_config('request.jwt.claim.sub', '', true);
 
+-- Persisted-role reader (message-board#113): allow-side redeem assertions read the seated role
+-- from the table via this getter, not from the RPC return in a bare select -- so an over-refusing
+-- gate surfaces as a NAMED `not ok` from the paired lives_ok instead of aborting the file.
+create function pg_temp.rl_role(ag uuid) returns text language sql as $$
+  select role from agent_board.board_memberships bm join _lf f on bm.board_id = f.board and bm.agent_id = ag
+   where bm.membership_state in ('joined','subscribed') limit 1;
+$$;
+
 -- === C. redeem basics ================================================== (3)
 -- 9
-select is(
-  (select role from agent_board._redeem_invite_for_agent((select code_member from _lf), (select carol from _lf))),
+select lives_ok($$
+  select agent_board._redeem_invite_for_agent((select code_member from _lf), (select carol from _lf)) $$,
+  'redeem seats Carol [call succeeds]');
+select is(pg_temp.rl_role((select carol from _lf)),
   'member', 'redeem seats Carol with the member role');
 -- 10
 select is(
@@ -204,8 +214,10 @@ select is(
 
 -- === D. idempotency + exhaustion (maxed link) ========================== (5)
 -- 12
-select is(
-  (select role from agent_board._redeem_invite_for_agent((select code_maxed from _lf), (select frank from _lf))),
+select lives_ok($$
+  select agent_board._redeem_invite_for_agent((select code_maxed from _lf), (select frank from _lf)) $$,
+  'first redeem of the maxed link seats Frank [call succeeds]');
+select is(pg_temp.rl_role((select frank from _lf)),
   'member', 'first redeem of the maxed link seats Frank');
 -- 13
 select is(
@@ -227,8 +239,10 @@ select throws_ok(
 
 -- === E. no-downgrade (rank-max) ======================================== (2)
 -- 17
-select is(
-  (select role from agent_board._redeem_invite_for_agent((select code_member from _lf), (select dave from _lf))),
+select lives_ok($$
+  select agent_board._redeem_invite_for_agent((select code_member from _lf), (select dave from _lf)) $$,
+  'redeeming a member link as Dave [call succeeds]');
+select is(pg_temp.rl_role((select dave from _lf)),
   'admin', 'redeeming a member link never downgrades Dave''s existing admin role (R-LINK-1)');
 -- 18
 select is(
@@ -294,8 +308,10 @@ select throws_ok(
 
 -- === L. public redeem happy path ======================================= (1)
 -- 27
-select is(
-  (select role from agent_board.redeem_invite_link((select code_public from _lf))),
+select lives_ok($$
+  select agent_board.redeem_invite_link((select code_public from _lf)) $$,
+  'the public redeem_invite_link succeeds [call succeeds]');
+select is(pg_temp.rl_role((select carol from _lf)),
   'member', 'the public redeem_invite_link resolves the actor via current_agent_id() and seats Carol');
 select set_config('request.jwt.claim.role', '', true);
 select set_config('request.jwt.claim.sub', '', true);