@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/tests/agent_board_signature_rls_reads.test.sql

@@ -68,9 +68,9 @@ begin
     v_author,
     'primary',
     1,
-    repeat('A', 43),
+    public.test_pubkey('sigrls-author-key'),
     'raw_ed25519_base64url',
-    'sha256:' || repeat('Q', 43),
+    public.test_key_fingerprint('sigrls-author-key'),
     'active',
     'proven'
   )
@@ -105,7 +105,7 @@ begin
     from agent_board.v_thread_feed
    where message_id = v_message
      and verification_status = 'verified'
-     and key_fingerprint = 'sha256:' || repeat('Q', 43)
+     and key_fingerprint = public.test_key_fingerprint('sigrls-author-key')
      and key_version = 1
      and algorithm = 'Ed25519';
 

package/tests/agent_board_signed_write_gateway.test.sql

@@ -57,9 +57,9 @@ begin
     v_agent,
     'primary',
     1,
-    repeat('A', 43),
+    public.test_pubkey('swg-primary'),
     'raw_ed25519_base64url',
-    'sha256:' || repeat('A', 43),
+    public.test_key_fingerprint('swg-primary'),
     'active',
     'proven'
   )
@@ -84,7 +84,7 @@ begin
         'key_id', 'primary',
         'key_version', 1,
         'algorithm', 'Ed25519',
-        'key_fingerprint', 'sha256:' || repeat('A', 43),
+        'key_fingerprint', public.test_key_fingerprint('swg-primary'),
         'verification_status', 'verified',
         'payload_digest', 'sha256:' || repeat('d', 64),
         'signature_digest', 'sha256:' || repeat('e', 64),

package/tests/agent_board_signing_challenge_pending_cap.test.sql

@@ -24,8 +24,8 @@ begin
   insert into agent_board.agent_signing_keys(
     agent_id, key_id, key_version, public_key, public_key_format, fingerprint)
   values (
-    v_agent, 'primary', 1, repeat('A', 43), 'raw_ed25519_base64url',
-    'sha256:' || repeat('Z', 43));
+    v_agent, 'primary', 1, public.test_pubkey('pcap-primary'), 'raw_ed25519_base64url',
+    public.test_key_fingerprint('pcap-primary'));
 
   set local role service_role;
 

package/tests/agent_board_signing_challenge_reaper.test.sql

@@ -25,8 +25,8 @@ begin
   insert into agent_board.agent_signing_keys(
     agent_id, key_id, key_version, public_key, public_key_format, fingerprint)
   values (
-    v_agent, 'primary', 1, repeat('A', 43), 'raw_ed25519_base64url',
-    'sha256:' || repeat('Z', 43))
+    v_agent, 'primary', 1, public.test_pubkey('reap-chal-primary'), 'raw_ed25519_base64url',
+    public.test_key_fingerprint('reap-chal-primary'))
   returning id into v_key;
 
   insert into agent_board.agent_signing_key_challenges(

package/tests/agent_board_signing_proof_rpcs.test.sql

@@ -29,9 +29,9 @@ begin
     v_agent,
     'primary',
     1,
-    repeat('A', 43),
+    public.test_pubkey('proof-rpcs-a'),
     'raw_ed25519_base64url',
-    'sha256:' || repeat('Z', 43)
+    public.test_key_fingerprint('proof-rpcs-a')
   );
 
   set local role service_role;
@@ -100,9 +100,9 @@ begin
     v_agent,
     'primary',
     1,
-    repeat('B', 43),
+    public.test_pubkey('proof-rpcs-b'),
     'raw_ed25519_base64url',
-    'sha256:' || repeat('Y', 43)
+    public.test_key_fingerprint('proof-rpcs-b')
   );
 
   set local role service_role;

package/tests/agent_board_signing_store.test.sql

@@ -50,9 +50,9 @@ begin
     v_agent,
     'primary',
     1,
-    repeat('A', 43),
+    public.test_pubkey('sigstore-primary'),
     'raw_ed25519_base64url',
-    'sha256:' || repeat('A', 43),
+    public.test_key_fingerprint('sigstore-primary'),
     'active',
     'proven'
   )
@@ -71,9 +71,9 @@ begin
       v_agent,
       'secondary',
       1,
-      repeat('B', 43),
+      public.test_pubkey('sigstore-secondary'),
       'raw_ed25519_base64url',
-      'sha256:' || repeat('B', 43)
+      public.test_key_fingerprint('sigstore-secondary')
     );
     raise exception 'duplicate key_version unexpectedly succeeded';
   exception
@@ -95,9 +95,9 @@ begin
       v_agent,
       'unproven-active',
       2,
-      repeat('C', 43),
+      public.test_pubkey('sigstore-unproven'),
       'raw_ed25519_base64url',
-      'sha256:' || repeat('C', 43),
+      public.test_key_fingerprint('sigstore-unproven'),
       'active',
       'unproven'
     );

package/tests/fixtures/isolation-substrate.sql

@@ -0,0 +1,93 @@
+-- Minimal Supabase substrate for the two-session ISOLATION harness only.
+--
+-- The pgTAP runner applies the agent_board bundle onto the DB that `supabase
+-- start` provisions (54322/postgres), which already carries GoTrue's `auth`
+-- schema, the `extensions` schema, pgcrypto, and the base roles. The isolation
+-- harness instead builds a THROWAWAY template database (specs COMMIT across
+-- sessions and cannot share the live DB), so it must self-provision the same
+-- substrate the migrations assume.
+--
+-- Rather than replay GoTrue's full ~2000-line schema (webauthn/saml/oauth/mfa +
+-- cross-schema net/role dependencies that drift with every GoTrue bump), this
+-- reproduces ONLY the surface the agent_board migrations actually touch:
+--
+--   * auth.users        FK target for agents.auth_user_id / owner_user_id, and
+--                        written by provision/ensure_github_user with 11 columns.
+--   * auth.identities    written by ensure_github_user; looked up by (provider,
+--                        provider_id).
+--   * auth.uid()/role()  read request.jwt.claim.* — the identity the RPCs gate on.
+--   * extensions.pgcrypto  extensions.digest / extensions.gen_random_bytes.
+--
+-- auth.sessions is intentionally omitted: it appears in the migrations only in a
+-- comment, never in SQL. Base ROLES (service_role/authenticated/anon) are NOT
+-- created here — they are cluster-global on the Supabase server this template is
+-- built on (both local `supabase start` and CI), so migration GRANTs resolve.
+--
+-- If a future migration touches an auth column/table not modelled here, the apply
+-- fails LOUDLY (a missing-column/relation error) — the signal to extend this file,
+-- never a silent skip. Keep it minimal and driven by real usage.
+
+create schema if not exists auth;
+create schema if not exists extensions;
+
+create extension if not exists pgcrypto with schema extensions;
+create extension if not exists "uuid-ossp" with schema extensions;
+
+-- GoTrue's auth.users, reduced to the columns the bundle inserts/reads. Everything
+-- is nullable or defaulted so the canonical 11-column provision insert succeeds.
+create table if not exists auth.users (
+  id uuid primary key,
+  instance_id uuid,
+  email text,
+  email_confirmed_at timestamptz,
+  encrypted_password text,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  raw_app_meta_data jsonb,
+  raw_user_meta_data jsonb,
+  aud text,
+  role text,
+  -- read-safety padding for common GoTrue columns a future path might SELECT
+  phone text,
+  confirmed_at timestamptz,
+  last_sign_in_at timestamptz,
+  is_sso_user boolean default false,
+  is_anonymous boolean default false
+);
+
+create table if not exists auth.identities (
+  id uuid primary key,
+  user_id uuid references auth.users(id) on delete cascade,
+  provider_id text,
+  provider text,
+  identity_data jsonb,
+  last_sign_in_at timestamptz,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  unique (provider, provider_id)
+);
+
+-- The identity helpers the bundle's RLS/RPCs gate on. Copied VERBATIM from the
+-- live Supabase auth schema (supabase/postgres:17.6) so the harness exercises the
+-- exact identity resolution production uses: coalesce the flattened
+-- `request.jwt.claim.<key>` GUC with the `request.jwt.claims` JSON blob, so either
+-- form the runtime sets resolves the caller.
+create or replace function auth.uid() returns uuid
+  language sql stable
+  as $$
+  select
+  coalesce(
+    nullif(current_setting('request.jwt.claim.sub', true), ''),
+    (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub')
+  )::uuid
+$$;
+
+create or replace function auth.role() returns text
+  language sql stable
+  as $$
+  select
+  coalesce(
+    nullif(current_setting('request.jwt.claim.role', true), ''),
+    (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'role')
+  )::text
+$$;

package/tests/fixtures/test-prereqs.sql

@@ -82,3 +82,36 @@ $$;
 
 REVOKE ALL ON FUNCTION public.ensure_github_user(text, text, text, text) FROM PUBLIC;
 GRANT EXECUTE ON FUNCTION public.ensure_github_user(text, text, text, text) TO service_role;
+
+-- ---------------------------------------------------------------------------
+-- Deterministic consistent (public_key, fingerprint) pair generators for pgTAP
+-- fixtures. MINTHARDEN (#138) installs a BEFORE INSERT OR UPDATE trigger on
+-- agent_board.agent_signing_keys asserting fingerprint = raw-byte derivation of
+-- public_key for raw_ed25519_base64url keys. Fixtures that seed keys directly must
+-- therefore use a CANONICAL key whose fingerprint MATCHES. These helpers derive a
+-- distinct canonical 43-char base64url raw-Ed25519 key from a seed (public_key =
+-- base64url(sha256(seed))) and the matching raw-byte fingerprint
+-- (sha256:base64url(sha256(raw_bytes))) — byte-identical to agent_board._raw_key_fingerprint
+-- WITHOUT depending on it (so this file still loads before the migrations). Seed on a
+-- distinct value per row (its key/agent uuid or a unique label) to avoid UNIQUE collisions.
+CREATE OR REPLACE FUNCTION public.test_pubkey(p_seed text)
+RETURNS text
+LANGUAGE sql
+IMMUTABLE
+AS $$
+  SELECT rtrim(translate(encode(extensions.digest(convert_to(p_seed, 'UTF8'), 'sha256'), 'base64'), '+/', '-_'), '=');
+$$;
+
+CREATE OR REPLACE FUNCTION public.test_key_fingerprint(p_seed text)
+RETURNS text
+LANGUAGE sql
+IMMUTABLE
+AS $$
+  SELECT 'sha256:' || rtrim(translate(encode(
+    extensions.digest(extensions.digest(convert_to(p_seed, 'UTF8'), 'sha256'), 'sha256'),
+    'base64'), '+/', '-_'), '=');
+$$;
+
+REVOKE ALL ON FUNCTION public.test_pubkey(text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.test_key_fingerprint(text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.test_pubkey(text), public.test_key_fingerprint(text) TO service_role;

package/tests/isolation/expected/claimgate_ownerless_quota.out

@@ -0,0 +1,36 @@
+Parsed test spec with 3 sessions
+
+starting permutation: sa_begin sa_acq sb_begin sb_acq sa_commit sb_commit chk
+step sa_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = 'c0a70000-0000-4000-8000-0000000000aa';
+step sa_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cg-iso-sa', now() + interval '1 hour', null, null);
+
+resource_key
+------------
+cg-iso-sa   
+(1 row)
+
+step sb_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = 'c0a70000-0000-4000-8000-0000000000aa';
+step sb_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cg-iso-sb', now() + interval '1 hour', null, null);
+ <waiting ...>
+step sa_commit: COMMIT;
+step sb_acq: <... completed>
+ERROR:  ownerless active-claim quota reached (50 per agent)
+step sb_commit: COMMIT;
+step chk: 
+  select count(*)::int as active_file_claims
+    from agent_board.claims
+   where agent_id = 'c0a70000-0000-4000-8000-0000000000bb'
+     and resource_kind = 'file'
+     and status = 'active'
+     and released_at is null
+     and lease_expires_at > now();
+
+active_file_claims
+------------------
+                50
+(1 row)
+

package/tests/isolation/expected/claimkey_renew_race.out

@@ -0,0 +1,38 @@
+Parsed test spec with 3 sessions
+
+starting permutation: ra_begin ra_renew rb_begin rb_renew ra_commit rb_commit chk
+step ra_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step ra_renew: 
+  select resource_key
+    from agent_board.renew_claim('00000000-0000-4000-8000-0000000000c1', now() + interval '2 hours');
+
+resource_key
+------------
+fpRace      
+(1 row)
+
+step rb_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rb_renew: 
+  select resource_key
+    from agent_board.renew_claim('00000000-0000-4000-8000-0000000000c2', now() + interval '2 hours');
+ <waiting ...>
+step ra_commit: COMMIT;
+step rb_renew: <... completed>
+resource_key
+------------
+  fpRace    
+(1 row)
+
+step rb_commit: COMMIT;
+step chk: 
+  select resource_key
+    from agent_board.claims
+   where lease_token in ('00000000-0000-4000-8000-0000000000c1','00000000-0000-4000-8000-0000000000c2')
+   order by resource_key;
+
+resource_key
+------------
+  fpRace    
+fpRace      
+(2 rows)
+

package/tests/isolation/expected/consent_approval_lock.out

@@ -0,0 +1,43 @@
+Parsed test spec with 3 sessions
+
+starting permutation: a_begin a_resolve w_begin w_leave a_commit w_commit chk
+step a_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_resolve: 
+  select membership_state
+    from agent_board.resolve_board_request(
+      '115b0000-0000-4000-8000-000000000001',
+      '115a0000-0000-4000-8000-000000000002',
+      'joined',
+      '115a0000-0000-4000-8000-000000000001');
+
+membership_state
+----------------
+joined          
+(1 row)
+
+step w_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step w_leave: 
+  select membership_state
+    from agent_board.update_board_membership(
+      '115b0000-0000-4000-8000-000000000001',
+      '115a0000-0000-4000-8000-000000000002',
+      'left');
+ <waiting ...>
+step a_commit: COMMIT;
+step w_leave: <... completed>
+membership_state
+----------------
+left            
+(1 row)
+
+step w_commit: COMMIT;
+step chk: 
+  select membership_state
+    from agent_board.board_memberships
+   where id = '115c0000-0000-4000-8000-0000000000aa';
+
+membership_state
+----------------
+left            
+(1 row)
+

package/tests/isolation/expected/consent_emit_actual_state.out

@@ -0,0 +1,37 @@
+Parsed test spec with 3 sessions
+
+starting permutation: m_begin m_sub b_begin b_boot m_commit b_commit chk
+step m_begin: BEGIN;
+step m_sub: 
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
+  values ('105b0000-0000-4000-8000-000000000001', '105a0000-0000-4000-8000-000000000001',
+          'subscribed', 'member', '105a0000-0000-4000-8000-000000000001');
+
+step b_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_boot: 
+  select board_id, owner_agent_id
+    from agent_board.bootstrap_board_owner_memberships()
+   where board_id = '105b0000-0000-4000-8000-000000000001';
+ <waiting ...>
+step m_commit: COMMIT;
+step b_boot: <... completed>
+board_id                            |owner_agent_id                      
+------------------------------------+------------------------------------
+105b0000-0000-4000-8000-000000000001|105a0000-0000-4000-8000-000000000001
+(1 row)
+
+step b_commit: COMMIT;
+step chk: 
+  select result_state, event_kind, provenance
+    from agent_board.board_membership_events
+   where board_id = '105b0000-0000-4000-8000-000000000001'
+     and agent_id = '105a0000-0000-4000-8000-000000000001'
+     and event_kind = 'operator_repair'
+   order by seq desc
+   limit 1;
+
+result_state|event_kind     |provenance         
+------------+---------------+-------------------
+subscribed  |operator_repair|operator-designated
+(1 row)
+

package/tests/isolation/expected/domain_reclaim_revoke_race.out

@@ -0,0 +1,40 @@
+Parsed test spec with 3 sessions
+
+starting permutation: ra_begin ra_reclaim rb_begin rb_revoke ra_commit rb_commit chk
+step ra_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step ra_reclaim: 
+  select owner_agent_id
+    from agent_board.reclaim_fleet_trust_domain(
+      'd2000000-0000-4000-8000-000000000001', 'a2000000-0000-4000-8000-000000000003',
+      'a2000000-0000-4000-8000-000000000001', 'iso operator domain reclaim');
+
+owner_agent_id                      
+------------------------------------
+a2000000-0000-4000-8000-000000000003
+(1 row)
+
+step rb_begin: 
+  BEGIN;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = 'b2000000-0000-4000-8000-000000000002';
+
+step rb_revoke: 
+  select revocation_event_id
+    from agent_board.revoke_fleet_subject(
+      'trust_domain', 'd2000000-0000-4000-8000-000000000001', 'a2000000-0000-4000-8000-000000000002',
+      'iso squatter domain revoke', jsonb_build_object('redacted', true));
+ <waiting ...>
+step ra_commit: COMMIT;
+step rb_revoke: <... completed>
+ERROR:  trust domain is not owned by current_agent_id()
+step rb_commit: COMMIT;
+step chk: 
+  select owner_agent_id, lifecycle_state
+    from agent_board.fleet_trust_domains
+   where id = 'd2000000-0000-4000-8000-000000000001';
+
+owner_agent_id                      |lifecycle_state
+------------------------------------+---------------
+a2000000-0000-4000-8000-000000000003|active         
+(1 row)
+

package/tests/isolation/expected/reactivate_revoke_race.out

@@ -0,0 +1,80 @@
+Parsed test spec with 3 sessions
+
+starting permutation: ra_begin ra_react rb_begin rb_revoke ra_commit rb_commit chk
+step ra_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step ra_react: 
+  select lifecycle_state
+    from agent_board.reactivate_fleet_machine(
+      '60000000-0000-4000-8000-000000000001', 'a0000000-0000-4000-8000-000000000001', 'iso reactivate');
+
+lifecycle_state
+---------------
+active         
+(1 row)
+
+step rb_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rb_revoke: 
+  select revocation_event_id
+    from agent_board.revoke_fleet_subject(
+      'machine', '60000000-0000-4000-8000-000000000001', 'a0000000-0000-4000-8000-000000000001',
+      'iso re-revoke', jsonb_build_object('redacted', true));
+ <waiting ...>
+step ra_commit: COMMIT;
+step rb_revoke: <... completed>
+revocation_event_id                 
+------------------------------------
+e0000000-0000-4000-8000-000000000001
+(1 row)
+
+step rb_commit: COMMIT;
+step chk: 
+  select fm.lifecycle_state,
+         (select denial_class
+            from agent_board.evaluate_fleet_sender_policy(
+              'a0000000-0000-4000-8000-000000000002', 'a0000000-0000-4000-8000-000000000003',
+              fm.id, null, 'send_direct_message', null, false)) as denial_class
+    from agent_board.fleet_machines fm
+   where fm.id = '60000000-0000-4000-8000-000000000001';
+
+lifecycle_state|denial_class   
+---------------+---------------
+revoked        |machine_revoked
+(1 row)
+
+
+starting permutation: ra_begin ra_react rb_begin rb_react ra_commit rb_commit chk
+step ra_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step ra_react: 
+  select lifecycle_state
+    from agent_board.reactivate_fleet_machine(
+      '60000000-0000-4000-8000-000000000001', 'a0000000-0000-4000-8000-000000000001', 'iso reactivate');
+
+lifecycle_state
+---------------
+active         
+(1 row)
+
+step rb_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rb_react: 
+  select lifecycle_state
+    from agent_board.reactivate_fleet_machine(
+      '60000000-0000-4000-8000-000000000001', 'a0000000-0000-4000-8000-000000000001', 'iso second reactivate');
+ <waiting ...>
+step ra_commit: COMMIT;
+step rb_react: <... completed>
+ERROR:  fleet machine is not revoked; nothing to reactivate
+step rb_commit: COMMIT;
+step chk: 
+  select fm.lifecycle_state,
+         (select denial_class
+            from agent_board.evaluate_fleet_sender_policy(
+              'a0000000-0000-4000-8000-000000000002', 'a0000000-0000-4000-8000-000000000003',
+              fm.id, null, 'send_direct_message', null, false)) as denial_class
+    from agent_board.fleet_machines fm
+   where fm.id = '60000000-0000-4000-8000-000000000001';
+
+lifecycle_state|denial_class
+---------------+------------
+active         |            
+(1 row)
+

package/tests/isolation/expected/reclaim_revoke_race.out

@@ -0,0 +1,40 @@
+Parsed test spec with 3 sessions
+
+starting permutation: ra_begin ra_reclaim rb_begin rb_revoke ra_commit rb_commit chk
+step ra_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step ra_reclaim: 
+  select owner_agent_id
+    from agent_board.reclaim_fleet_machine(
+      '61000000-0000-4000-8000-000000000001', 'a1000000-0000-4000-8000-000000000003',
+      'a1000000-0000-4000-8000-000000000001', 'iso operator reclaim');
+
+owner_agent_id                      
+------------------------------------
+a1000000-0000-4000-8000-000000000003
+(1 row)
+
+step rb_begin: 
+  BEGIN;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = 'b1000000-0000-4000-8000-000000000002';
+
+step rb_revoke: 
+  select revocation_event_id
+    from agent_board.revoke_fleet_subject(
+      'machine', '61000000-0000-4000-8000-000000000001', 'a1000000-0000-4000-8000-000000000002',
+      'iso squatter revoke', jsonb_build_object('redacted', true));
+ <waiting ...>
+step ra_commit: COMMIT;
+step rb_revoke: <... completed>
+ERROR:  machine is not owned by current_agent_id()
+step rb_commit: COMMIT;
+step chk: 
+  select owner_agent_id, lifecycle_state
+    from agent_board.fleet_machines
+   where id = '61000000-0000-4000-8000-000000000001';
+
+owner_agent_id                      |lifecycle_state
+------------------------------------+---------------
+a1000000-0000-4000-8000-000000000003|active         
+(1 row)
+

package/tests/isolation/specs/claimgate_ownerless_quota.spec

@@ -0,0 +1,77 @@
+# CLAIMGATE/SHADOW (#133) — the ownerless per-agent active-claim QUOTA is transactionally
+# serialized. The agent already holds (quota - 1) = 49 active 'file' claims. Two sessions then
+# each acquire ONE MORE ownerless claim on DISTINCT keys concurrently. The row-level uniqueness
+# index does NOT serialize them (different keys), so a naive count-before-insert would let BOTH
+# observe 49 (< 50) and BOTH insert — 51 active claims, quota bypassed.
+#
+# The shipped acquire_claim takes an actor-scoped pg_advisory_xact_lock BEFORE the count, so the
+# two acquisitions by the same actor SERIALIZE: session sb BLOCKS on sa's lock until sa commits,
+# then counts 50 (>= 50) and is DENIED (errcode 54000). Final state: exactly 50 active claims.
+#
+# WHAT THIS PINS (a TRACE): sb's acquire prints `<waiting ...>` on sa's advisory lock; after sa
+# commits, sb COMPLETES with `ERROR: ownerless active-claim quota reached`. The checker sees 50.
+#
+# MUTATION SIGNAL (verified in the PR): remove the pg_advisory_xact_lock line from acquire_claim
+# -> sb no longer waits, both count 49 and both INSERT, no error line, and the checker sees 51.
+# The golden diverges on both the missing `<waiting ...>` and the 50-vs-51 count.
+#
+# Sessions run as `authenticated` (NOT service_role — the operator carve-out exempts service_role
+# from the quota), with request.jwt.claim.sub selecting the quota agent.
+
+setup
+{
+  -- SHADOW ships the ownerless guards OFF by default; this spec pins the quota ENFORCEMENT path,
+  -- so enable the guard flag first (the state an operator/ENFORCE reaches post-census).
+  insert into agent_board.claimgate_enforcement_flags(scope_key, enabled) values ('ownerless_guards', true)
+    on conflict (scope_key) do update set enabled = true;
+  insert into auth.users (id) values ('c0a70000-0000-4000-8000-0000000000aa');
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('c0a70000-0000-4000-8000-0000000000bb', 'agent', 'agent', 'cg-quota-iso', 'CG Quota Iso', 'active',
+          'c0a70000-0000-4000-8000-0000000000aa', 'c0a70000-0000-4000-8000-0000000000aa');
+  -- seed (quota - 1) active file claims for the agent.
+  insert into agent_board.claims(agent_id, resource_kind, resource_key, lease_expires_at)
+  select 'c0a70000-0000-4000-8000-0000000000bb', 'file', 'cg-iso-seed-' || g, now() + interval '1 hour'
+    from generate_series(1, agent_board._claimgate_ownerless_quota() - 1) g;
+}
+
+teardown
+{
+  delete from agent_board.claims where agent_id = 'c0a70000-0000-4000-8000-0000000000bb';
+  delete from agent_board.agents where id = 'c0a70000-0000-4000-8000-0000000000bb';
+  delete from auth.users where id = 'c0a70000-0000-4000-8000-0000000000aa';
+  delete from agent_board.claimgate_enforcement_flags where scope_key = 'ownerless_guards';
+}
+
+# sa acquires the 50th (=quota) claim: it takes the actor advisory lock, counts 49 (< 50), inserts,
+# and holds the lock until commit.
+session "sa"
+step "sa_begin" { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = 'c0a70000-0000-4000-8000-0000000000aa'; }
+step "sa_acq"   {
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cg-iso-sa', now() + interval '1 hour', null, null);
+}
+step "sa_commit" { COMMIT; }
+
+# sb acquires a DIFFERENT-key claim: its acquire blocks on sa's advisory lock, then on sa commit
+# counts 50 (>= 50) and raises the quota error.
+session "sb"
+step "sb_begin" { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = 'c0a70000-0000-4000-8000-0000000000aa'; }
+step "sb_acq"   {
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cg-iso-sb', now() + interval '1 hour', null, null);
+}
+step "sb_commit" { COMMIT; }
+
+# checker: exactly 50 active file claims survive (sa's succeeded, sb's was denied).
+session "chk"
+step "chk" {
+  select count(*)::int as active_file_claims
+    from agent_board.claims
+   where agent_id = 'c0a70000-0000-4000-8000-0000000000bb'
+     and resource_kind = 'file'
+     and status = 'active'
+     and released_at is null
+     and lease_expires_at > now();
+}
+
+permutation "sa_begin" "sa_acq" "sb_begin" "sb_acq" "sa_commit" "sb_commit" "chk"