@consiliency/agent-board-schema 1.12.0 → 1.23.0

package/tests/agent_board_authbound_boundary.test.sql

@@ -42,7 +42,7 @@ begin
   values (v_credential, v_agent, extensions.digest('authbound-refresh-' || v_suffix, 'sha256'), 1, 'authbound', now() + interval '1 day');
 
   insert into agent_board.agent_signing_keys(agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
-  values (v_agent, 'primary', 1, repeat('A', 43), 'raw_ed25519_base64url', 'sha256:' || repeat('A', 43), 'active', 'proven')
+  values (v_agent, 'primary', 1, public.test_pubkey('authbound-' || v_suffix), 'raw_ed25519_base64url', public.test_key_fingerprint('authbound-' || v_suffix), 'active', 'proven')
   returning id into v_key;
 
   insert into _agent_board_authbound_fixture(user_id, agent_id, credential_id, signing_key_id)
@@ -98,6 +98,14 @@ $$;
 
 select pass('current_agent_id honors agent_credential_id revocation before JWT expiry');
 
+-- #118 (MBHARDEN): _signed_write_actor_id is now revoked from authenticated — it is an
+-- internal-only helper whose only callers are SECURITY DEFINER signed_* RPCs that run as the
+-- owner. Its fail-closed LOGIC (raise actor_mismatch on a missing/mismatched gateway actor)
+-- is role-independent, so exercise it as the owner rather than as authenticated (which would
+-- now hit permission-denied before reaching the logic under test). The remaining assertions
+-- below are role-agnostic catalog reads.
+reset role;
+
 select throws_like(
   $$select agent_board._signed_write_actor_id(
     '{}'::jsonb,

package/tests/agent_board_claimgate_enforce.test.sql

@@ -0,0 +1,464 @@
+-- CLAIMGATE Phase 3 — ENFORCE (#133): per-kind GATED fleet-authority denial + renew re-auth
+-- + max-lease horizon. Fleet-graph authority ONLY (NEGATIVE RULE: no board-admin fallback).
+--
+-- Fixtures are built as the postgres superuser (RLS bypassed); each enforcement probe runs
+-- `set local role authenticated` with request.jwt.claim.sub selecting the actor. Per-kind flags
+-- are toggled between phases via `reset role` (service_role-only table). Every DENY is a verified
+-- FLIP against the OFF/authorized twin — a green suite alone proves nothing (repo rules #2/#3).
+--
+-- Allow-side assertions use lives_ok + a separate state read (never `is((select … from rpc()))`,
+-- which aborts the txn on a raise instead of failing — #113). Lease tokens are stashed via
+-- set_config under `reset role` (postgres) to avoid claims RLS on the read.
+--
+-- SAME-FLAG PIN (Phase 2): only enforce_machine is ON, and BOTH acquire-denies-unauthorized AND
+-- renew-denies-revoked-binding deny under that one flag — if renew read a different scope_key it
+-- would be off and the revoked renew would succeed (red). PREDICATE-BEFORE-SWEEP PIN (Phase 10):
+-- a denied enforced acquire leaves a seeded expired-but-active row STILL active (the sweep is
+-- below the deny) — moving the predicate after the sweep flips that assertion.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public;
+
+begin;
+
+select plan(43);
+
+do $$
+declare
+  u_owner uuid; u_bound uuid; u_worker uuid; u_nonbound uuid; u_ap uuid;
+begin
+  u_owner    := public.ensure_github_user('ce-owner',    'ce-owner@example.test',    'ce-owner',    'CE Owner');
+  u_bound    := public.ensure_github_user('ce-bound',    'ce-bound@example.test',    'ce-bound',    'CE Bound');
+  u_worker   := public.ensure_github_user('ce-worker',   'ce-worker@example.test',   'ce-worker',   'CE Worker');
+  u_nonbound := public.ensure_github_user('ce-nonbound', 'ce-nonbound@example.test', 'ce-nonbound', 'CE NonBound');
+  u_ap       := public.ensure_github_user('ce-ap',       'ce-ap@example.test',       'ce-ap',       'CE ActorParam');
+
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    ('ce000000-0000-4000-8000-0000000000a1', 'agent', 'agent', 'ce-owner',    'CE Owner',      'active', u_owner,    u_owner),
+    ('ce000000-0000-4000-8000-0000000000a2', 'agent', 'agent', 'ce-bound',    'CE Bound',      'active', u_bound,    u_bound),
+    ('ce000000-0000-4000-8000-0000000000a4', 'agent', 'agent', 'ce-worker',   'CE Worker',     'active', u_worker,   u_worker),
+    ('ce000000-0000-4000-8000-0000000000a3', 'agent', 'agent', 'ce-nonbound', 'CE NonBound',   'active', u_nonbound, u_nonbound),
+    ('ce000000-0000-4000-8000-0000000000a8', 'agent', 'agent', 'ce-ap',       'CE ActorParam', 'active', u_ap,       u_ap);
+
+  -- Domain D1 (active), owner A_owner.
+  insert into agent_board.fleet_trust_domains(id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state)
+  values ('ce000000-0000-4000-8000-0000000000d1', 'ce-d1', 'CE Domain 1', 'tailnet', 'ce000000-0000-4000-8000-0000000000a1', 'active');
+
+  -- Machines owned by A_owner: M1 (bound + worker + ap live here) plus horizon-test machines.
+  insert into agent_board.fleet_machines(id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint, lifecycle_state)
+  values
+    ('ce000000-0000-4000-8000-0000000000f1', 'ce000000-0000-4000-8000-0000000000d1', 'ce000000-0000-4000-8000-0000000000a1', 'M1',   'fpM1',   'active'),
+    ('ce000000-0000-4000-8000-0000000000f5', 'ce000000-0000-4000-8000-0000000000d1', 'ce000000-0000-4000-8000-0000000000a1', 'Mhz',  'fpMhz',  'active'),
+    ('ce000000-0000-4000-8000-0000000000f6', 'ce000000-0000-4000-8000-0000000000d1', 'ce000000-0000-4000-8000-0000000000a1', 'Mhz2', 'fpMhz2', 'active'),
+    ('ce000000-0000-4000-8000-0000000000f7', 'ce000000-0000-4000-8000-0000000000d1', 'ce000000-0000-4000-8000-0000000000a1', 'Mhz3', 'fpMhz3', 'active'),
+    ('ce000000-0000-4000-8000-0000000000f8', 'ce000000-0000-4000-8000-0000000000d1', 'ce000000-0000-4000-8000-0000000000a1', 'Mpromo', 'fpPromo', 'active');
+
+  -- Harness H1 (active) on M1 with a worker repo-scope (fpR1).
+  insert into agent_board.fleet_harness_registrations(id, machine_id, harness_kind, harness_label, lifecycle_state)
+  values ('ce000000-0000-4000-8000-0000000000e1', 'ce000000-0000-4000-8000-0000000000f1', 'claude', 'H1', 'active');
+  insert into agent_board.fleet_repo_scopes(id, harness_registration_id, repo_slug, repo_fingerprint, scope_role, lifecycle_state)
+  values ('ce000000-0000-4000-8000-00000000ab01', 'ce000000-0000-4000-8000-0000000000e1', 'repo1', 'fpR1', 'worker', 'active');
+
+  -- Bindings on M1: A_bound (machine-level; revoked in phase 2), A_worker (repo scope; revoked in
+  -- phase 3), A_ap (machine-level; NEVER revoked — the actor-parameterized probe uses it).
+  insert into agent_board.fleet_machine_agents(id, machine_id, agent_id, repo_scope_id, lifecycle_state)
+  values
+    ('ce000000-0000-4000-8000-00000000ac02', 'ce000000-0000-4000-8000-0000000000f1', 'ce000000-0000-4000-8000-0000000000a2', null,                                    'active'),
+    ('ce000000-0000-4000-8000-00000000ac04', 'ce000000-0000-4000-8000-0000000000f1', 'ce000000-0000-4000-8000-0000000000a4', 'ce000000-0000-4000-8000-00000000ab01',  'active'),
+    ('ce000000-0000-4000-8000-00000000ac08', 'ce000000-0000-4000-8000-0000000000f1', 'ce000000-0000-4000-8000-0000000000a8', null,                                    'active');
+
+  perform set_config('_ce.owner',    u_owner::text,    true);
+  perform set_config('_ce.bound',     u_bound::text,     true);
+  perform set_config('_ce.worker',    u_worker::text,    true);
+  perform set_config('_ce.nonbound',  u_nonbound::text,  true);
+  perform set_config('_ce.ap',        u_ap::text,        true);
+end
+$$;
+
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+-- =====================================================================================
+-- PHASE 1 — per-kind OFF (default: no flag rows) -> unauthorized claim SUCCEEDS (shadow).
+-- Unknown fingerprints (authority false); with the kind's flag OFF, acquire blocks NOTHING.
+-- =====================================================================================
+select set_config('request.jwt.claim.sub', current_setting('_ce.nonbound'), true);
+select lives_ok($$
+  select agent_board.acquire_claim(null, 'machine', 'off-unknown-m', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, 'OFF default: an unauthorized MACHINE claim succeeds (blocks nothing)');
+select lives_ok($$
+  select agent_board.acquire_claim(null, 'repository', 'off-unknown-r', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, 'OFF default: an unauthorized REPOSITORY claim succeeds (blocks nothing)');
+select lives_ok($$
+  select agent_board.acquire_claim(null, 'repo_file', 'off-unknown-r:path', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, 'OFF default: an unauthorized REPO_FILE claim succeeds (blocks nothing)');
+
+-- =====================================================================================
+-- PHASE 2 — ONLY enforce_machine ON. The SAME single flag gates BOTH acquire-deny and renew-
+-- deny (same-flag consistency pin). Plus authorized-acquire, authorized-renew, OFF-renew, and
+-- release-stays-ownership-only.
+-- =====================================================================================
+reset role;
+insert into agent_board.claimgate_enforcement_flags(scope_key, enabled) values ('enforce_machine', true)
+  on conflict (scope_key) do update set enabled = true;
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+-- acquire: unauthorized machine DENIED (flip vs Phase 1's OFF success).
+select set_config('request.jwt.claim.sub', current_setting('_ce.nonbound'), true);
+select throws_ok($$
+  select agent_board.acquire_claim(null, 'machine', 'fpM1', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, '42501', null, 'enforce_machine ON: an unauthorized MACHINE acquire is DENIED (flip)');
+
+-- acquire: authorized machine SUCCEEDS (A_bound is actively bound to fpM1).
+select set_config('request.jwt.claim.sub', current_setting('_ce.bound'), true);
+select lives_ok($$
+  select agent_board.acquire_claim(null, 'machine', 'fpM1', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, 'enforce_machine ON: the actively-bound actor CAN acquire fpM1');
+reset role;
+select set_config('_ce.mtok',
+  (select lease_token::text from agent_board.claims
+     where resource_kind = 'machine' and resource_key = 'fpM1'
+       and agent_id = 'ce000000-0000-4000-8000-0000000000a2' and status = 'active'), true);
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', current_setting('_ce.bound'), true);
+
+-- renew: authorized actor (binding still active) renews fine.
+select lives_ok($$
+  select agent_board.renew_claim(current_setting('_ce.mtok')::uuid, now() + interval '2 hours')
+$$, 'enforce_machine ON: the still-bound owner renews fine');
+
+-- revoke A_bound's binding, then renew is re-authorized and DENIED under the SAME enforce_machine flag.
+reset role;
+update agent_board.fleet_machine_agents set lifecycle_state = 'revoked', revoked_at = now()
+ where id = 'ce000000-0000-4000-8000-00000000ac02';
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', current_setting('_ce.bound'), true);
+select throws_ok($$
+  select agent_board.renew_claim(current_setting('_ce.mtok')::uuid, now() + interval '2 hours')
+$$, '42501', null, 'enforce_machine ON: a REVOKED binding cannot RENEW (re-auth flip; SAME flag as acquire)');
+
+-- flag OFF -> the revoked binding renews again (shadow); pins the OFF direction on renew.
+reset role;
+update agent_board.claimgate_enforcement_flags set enabled = false where scope_key = 'enforce_machine';
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', current_setting('_ce.bound'), true);
+select lives_ok($$
+  select agent_board.renew_claim(current_setting('_ce.mtok')::uuid, now() + interval '2 hours')
+$$, 'enforce_machine OFF: the revoked binding renews again (shadow, blocks nothing)');
+
+-- release stays OWNERSHIP-ONLY: with enforce_machine ON again and the binding revoked, the owner
+-- of the claim ROW still releases it (release never re-auths fleet authority).
+reset role;
+update agent_board.claimgate_enforcement_flags set enabled = true where scope_key = 'enforce_machine';
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', current_setting('_ce.bound'), true);
+select lives_ok($$
+  select agent_board.release_claim(current_setting('_ce.mtok')::uuid)
+$$, 'release stays OWNERSHIP-ONLY: the revoked-binding owner still releases (no fleet re-auth)');
+
+-- =====================================================================================
+-- PHASE 3 — repository + repo_file ON: unauthorized deny + authorized succeed + repo renew re-auth.
+-- =====================================================================================
+reset role;
+insert into agent_board.claimgate_enforcement_flags(scope_key, enabled) values
+  ('enforce_repository', true), ('enforce_repo_file', true)
+  on conflict (scope_key) do update set enabled = true;
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+select set_config('request.jwt.claim.sub', current_setting('_ce.nonbound'), true);
+select throws_ok($$
+  select agent_board.acquire_claim(null, 'repository', 'fpR1', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, '42501', null, 'enforce_repository ON: an unauthorized REPOSITORY acquire is DENIED');
+select throws_ok($$
+  select agent_board.acquire_claim(null, 'repo_file', 'fpR1:secret.txt', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, '42501', null, 'enforce_repo_file ON: an unauthorized REPO_FILE acquire is DENIED');
+
+select set_config('request.jwt.claim.sub', current_setting('_ce.worker'), true);
+select lives_ok($$
+  select agent_board.acquire_claim(null, 'repository', 'fpR1', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, 'enforce_repository ON: the active worker-scope actor CAN acquire fpR1');
+select lives_ok($$
+  select agent_board.acquire_claim(null, 'repo_file', 'fpR1:src/db.sql', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, 'enforce_repo_file ON: the active worker-scope actor CAN acquire fpR1:src/db.sql');
+reset role;
+select set_config('_ce.rtok',
+  (select lease_token::text from agent_board.claims
+     where resource_kind = 'repository' and resource_key = 'fpR1'
+       and agent_id = 'ce000000-0000-4000-8000-0000000000a4' and status = 'active'), true);
+-- revoke A_worker's binding (its whole repo authority flows through this one edge).
+update agent_board.fleet_machine_agents set lifecycle_state = 'revoked', revoked_at = now()
+ where id = 'ce000000-0000-4000-8000-00000000ac04';
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', current_setting('_ce.worker'), true);
+select throws_ok($$
+  select agent_board.renew_claim(current_setting('_ce.rtok')::uuid, now() + interval '2 hours')
+$$, '42501', null, 'enforce_repository ON: a REVOKED repo binding cannot RENEW (re-auth flip)');
+
+-- =====================================================================================
+-- PHASE 4 — ACCEPTANCE: all 3 flags ON -> an unauthorized claim of EACH kind denies
+-- (the roadmap's final exit criterion: verified deny for machine, repository, AND repo_file).
+-- =====================================================================================
+-- (enforce_machine + enforce_repository + enforce_repo_file are all ON now.)
+select set_config('request.jwt.claim.sub', current_setting('_ce.nonbound'), true);
+select throws_ok($$
+  select agent_board.acquire_claim(null, 'machine', 'accept-unknown-m', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, '42501', null, 'ACCEPTANCE (all 3 ON): unauthorized MACHINE denied');
+select throws_ok($$
+  select agent_board.acquire_claim(null, 'repository', 'accept-unknown-r', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, '42501', null, 'ACCEPTANCE (all 3 ON): unauthorized REPOSITORY denied');
+select throws_ok($$
+  select agent_board.acquire_claim(null, 'repo_file', 'accept-unknown-r:p', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, '42501', null, 'ACCEPTANCE (all 3 ON): unauthorized REPO_FILE denied');
+
+-- =====================================================================================
+-- PHASE 5 — MAX-LEASE HORIZON (default 30d, operator-configurable): CLAMP on acquire + renew.
+-- =====================================================================================
+-- over-horizon acquire is CLAMPED to now()+30d (authorized owner; enforce_machine ON).
+select set_config('request.jwt.claim.sub', current_setting('_ce.owner'), true);
+select lives_ok($$
+  select agent_board.acquire_claim(null, 'machine', 'fpMhz', now() + interval '60 days', null, null, '{}'::jsonb)
+$$, 'horizon: an over-horizon (60d) authorized acquire is allowed (clamped, not rejected)');
+select ok(
+  (select lease_expires_at from agent_board.claims
+     where resource_kind = 'machine' and resource_key = 'fpMhz'
+       and agent_id = 'ce000000-0000-4000-8000-0000000000a1' and status = 'active')
+    between now() + interval '29 days' and now() + interval '31 days',
+  'horizon: the 60d lease is CLAMPED to ~30d (the max horizon)');
+
+-- within-horizon acquire is UNCHANGED.
+select lives_ok($$
+  select agent_board.acquire_claim(null, 'machine', 'fpMhz2', now() + interval '10 days', null, null, '{}'::jsonb)
+$$, 'horizon: a within-horizon (10d) acquire is allowed');
+select ok(
+  (select lease_expires_at from agent_board.claims
+     where resource_kind = 'machine' and resource_key = 'fpMhz2'
+       and agent_id = 'ce000000-0000-4000-8000-0000000000a1' and status = 'active')
+    between now() + interval '9 days' and now() + interval '11 days',
+  'horizon: a within-horizon 10d lease is NOT clamped');
+
+-- operator override: a 5-day horizon clamps a 60d acquire to ~5d.
+reset role;
+insert into agent_board.claimgate_settings(key, value) values ('max_lease_horizon', '5 days')
+  on conflict (key) do update set value = excluded.value;
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', current_setting('_ce.owner'), true);
+select lives_ok($$
+  select agent_board.acquire_claim(null, 'machine', 'fpMhz3', now() + interval '60 days', null, null, '{}'::jsonb)
+$$, 'horizon override: with a 5d override, a 60d acquire is allowed (clamped)');
+select ok(
+  (select lease_expires_at from agent_board.claims
+     where resource_kind = 'machine' and resource_key = 'fpMhz3'
+       and agent_id = 'ce000000-0000-4000-8000-0000000000a1' and status = 'active')
+    between now() + interval '4 days' and now() + interval '6 days',
+  'horizon override: the configurable 5d override is respected (clamped to ~5d)');
+-- WRITE-TIME validation (panel should-fix): a malformed or non-positive horizon override must
+-- fail the operator's WRITE (not raise/clamp-into-the-past in the hot path). CHECK guards it.
+-- Run as postgres (the settings table is service_role-writable) so the CHECK — not a missing
+-- grant — is what rejects.
+reset role;
+select throws_ok($$
+  insert into agent_board.claimgate_settings(key, value) values ('max_lease_horizon', '-5 days')
+$$, '23514', null, 'settings CHECK: a NEGATIVE horizon override is rejected at write time');
+select throws_ok($$
+  insert into agent_board.claimgate_settings(key, value) values ('max_lease_horizon', 'not-an-interval')
+$$, '22007', null, 'settings CHECK: a MALFORMED horizon override is rejected at write time');
+
+-- remove the override (back to the 30d default) and capture fpMhz3's token for the renew-horizon test.
+reset role;
+delete from agent_board.claimgate_settings where key = 'max_lease_horizon';
+select set_config('_ce.htok',
+  (select lease_token::text from agent_board.claims
+     where resource_kind = 'machine' and resource_key = 'fpMhz3'
+       and agent_id = 'ce000000-0000-4000-8000-0000000000a1' and status = 'active'), true);
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', current_setting('_ce.owner'), true);
+
+-- horizon on RENEW: a 60d renew is clamped to ~30d (default restored).
+select lives_ok($$
+  select agent_board.renew_claim(current_setting('_ce.htok')::uuid, now() + interval '60 days')
+$$, 'horizon: a 60d RENEW is allowed (clamped)');
+select ok(
+  (select lease_expires_at from agent_board.claims
+     where resource_key = 'fpMhz3' and status = 'active')
+    between now() + interval '29 days' and now() + interval '31 days',
+  'horizon: the 60d renew is CLAMPED to ~30d on renew too');
+
+-- =====================================================================================
+-- PHASE 6 — task-renew stays OWNERSHIP-ONLY (no re-auth, NO horizon clamp) even with fleet
+-- flags ON. A directly-seeded task claim (agent = A_owner) is renewed with a 60d lease: it is
+-- neither re-authorized (task is not predicate-gated) nor clamped (horizon is fleet-only).
+-- =====================================================================================
+reset role;
+insert into agent_board.claims(id, agent_id, resource_kind, resource_key, lease_expires_at, lease_token)
+values ('ce000000-0000-4000-8000-00000000c101', 'ce000000-0000-4000-8000-0000000000a1', 'task',
+        '11111111-2222-4333-8444-555555555555', now() + interval '1 hour', gen_random_uuid());
+select set_config('_ce.tasktok',
+  (select lease_token::text from agent_board.claims where id = 'ce000000-0000-4000-8000-00000000c101'), true);
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', current_setting('_ce.owner'), true);
+select lives_ok($$
+  select agent_board.renew_claim(current_setting('_ce.tasktok')::uuid, now() + interval '60 days')
+$$, 'task-renew stays OWNERSHIP-ONLY: renews fine with all fleet flags ON');
+select ok(
+  (select lease_expires_at from agent_board.claims where id = 'ce000000-0000-4000-8000-00000000c101')
+    > now() + interval '59 days',
+  'task-renew is NOT horizon-clamped (horizon is fleet-kind-only): the 60d lease stands');
+
+-- =====================================================================================
+-- PHASE 7 — FAIL-CLOSED ON UNKNOWN: an unknown machine fingerprint denies when enforced
+-- (even for a fleet participant — A_owner owns other machines but not this fingerprint).
+-- =====================================================================================
+select set_config('request.jwt.claim.sub', current_setting('_ce.owner'), true);
+select throws_ok($$
+  select agent_board.acquire_claim(null, 'machine', 'fp-not-in-the-graph', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, '42501', null, 'fail-closed: an UNKNOWN machine fingerprint denies when enforced');
+
+-- =====================================================================================
+-- PHASE 8 — ACTOR-PARAMETERIZED predicate: _can_claim_resource_for computes an ARBITRARY
+-- actor's authority, distinct from the session actor's. Session = A_nonbound (unauthorized);
+-- the param actor A_ap is still bound to fpM1.
+-- =====================================================================================
+-- The two _for probes run as postgres — _for is granted to service_role ONLY (an RLS-bypass
+-- authority oracle; the panel must-fix revoked it from authenticated).
+reset role;
+select is(
+  (select agent_board._can_claim_resource_for('ce000000-0000-4000-8000-0000000000a8', 'machine', 'fpM1')),
+  true, 'actor-param: _for(A_ap, machine, fpM1) returns A_ap''s authority (true) though the session actor differs');
+select is(
+  (select agent_board._can_claim_resource_for('ce000000-0000-4000-8000-0000000000a3', 'machine', 'fpM1')),
+  false, 'actor-param: _for(A_nonbound, machine, fpM1) returns A_nonbound''s authority (false)');
+-- the session wrapper resolves to the SESSION actor (A_nonbound), not the param actor.
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', current_setting('_ce.nonbound'), true);
+select is(
+  (select agent_board._can_claim_resource('machine', 'fpM1')),
+  false, 'actor-param: the session wrapper (A_nonbound) resolves to the SESSION actor (false), not A_ap');
+
+-- LEAST-PRIVILEGE (panel must-fix): _can_claim_resource_for is an RLS-bypass fleet-authority
+-- oracle — granted to service_role ONLY, NEVER authenticated. Mutation-pinned: re-granting it to
+-- authenticated flips the first assertion (the wrapper still works either way, so grant is the pin).
+select ok(
+  not has_function_privilege('authenticated', 'agent_board._can_claim_resource_for(uuid, text, text)', 'EXECUTE'),
+  'least-privilege: authenticated CANNOT execute _can_claim_resource_for (no fleet-authority oracle)');
+select ok(
+  has_function_privilege('service_role', 'agent_board._can_claim_resource_for(uuid, text, text)', 'EXECUTE'),
+  'least-privilege: service_role CAN execute _can_claim_resource_for (operator census path)');
+
+-- =====================================================================================
+-- PHASE 9 — CATALOG-DERIVED COMPLETENESS: enforcement disposition for every catalog kind.
+-- With all 3 fleet flags ON, exactly machine/repository/repo_file are kind-enforced; the 4
+-- non-fleet kinds are NEVER kind-enforced. A new kind added to the constraint fails + names itself.
+-- =====================================================================================
+select is(
+  (select array_agg(k order by k) from (
+     select unnest(array['task','file','repo_file','repository','machine','tool','custom']) as k
+   ) kinds where agent_board._claimgate_kind_enforced(k)),
+  array['machine','repo_file','repository']::text[],
+  'completeness: exactly the 3 fleet kinds are kind-enforceable (machine/repository/repo_file)');
+select is(
+  (select count(*)::int from (
+     select unnest(array['task','file','tool','custom']) as k
+   ) kinds where agent_board._claimgate_kind_enforced(k)),
+  0, 'completeness: the 4 non-fleet kinds are NEVER kind-enforced (positively asserted)');
+select is(
+  (select array_agg(distinct m[1] order by m[1])
+     from pg_constraint c
+    cross join lateral regexp_matches(pg_get_constraintdef(c.oid), '''([a-z_]+)''', 'g') as m
+    where c.conname = 'claims_resource_kind_check'
+      and c.conrelid = 'agent_board.claims'::regclass),
+  array['custom','file','machine','repo_file','repository','task','tool']::text[],
+  'completeness: the catalog kind set is exactly the 7 the enforcement mapping covers');
+
+-- =====================================================================================
+-- PHASE 10 — PREDICATE-BEFORE-SWEEP/CONFLICT (error-code PRECEDENCE pin). The deny raise
+-- rolls back its own writes (a committed-state check of the sweep is NOT a valid pin — the
+-- savepoint undoes it regardless of order). Instead we pin the OBSERVABLE precedence: with a
+-- LIVE conflicting claim on 'fpconflict', an unauthorized enforced acquire must raise 42501
+-- (the predicate deny), NOT 23505 (the conflict check). OFF -> the same acquire reaches the
+-- conflict and raises 23505 (proving the key genuinely conflicts). Moving the predicate below
+-- the sweep/conflict flips the ON case to 23505 -> assertion fails (real mutation pin).
+-- =====================================================================================
+reset role;
+insert into agent_board.claims(id, agent_id, resource_kind, resource_key, lease_expires_at)
+values ('ce000000-0000-4000-8000-00000000c201', 'ce000000-0000-4000-8000-0000000000a1', 'machine',
+        'fpconflict', now() + interval '1 hour');  -- a LIVE (unexpired) active claim.
+update agent_board.claimgate_enforcement_flags set enabled = false where scope_key = 'enforce_machine';
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', current_setting('_ce.nonbound'), true);
+select throws_ok($$
+  select agent_board.acquire_claim(null, 'machine', 'fpconflict', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, '23505', null, 'precedence: enforce_machine OFF -> the acquire reaches the CONFLICT check (23505, key genuinely conflicts)');
+
+reset role;
+update agent_board.claimgate_enforcement_flags set enabled = true where scope_key = 'enforce_machine';
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', current_setting('_ce.nonbound'), true);
+select throws_ok($$
+  select agent_board.acquire_claim(null, 'machine', 'fpconflict', now() + interval '1 hour', null, null, '{}'::jsonb)
+$$, '42501', null, 'precedence: enforce_machine ON -> the DENY (42501) precedes the sweep/conflict (not 23505)');
+
+-- =====================================================================================
+-- PHASE 11 — PROMOTION-READINESS gate (_claimgate_promotion_blockers). Verifies the roadmap
+-- "reconcile before enforcement" (:346) + "zero non-canonical at flip" (:352) exit criteria WITHOUT
+-- mutating any lease. Seed one claim per blocker reason, assert each surfaces with the right flags,
+-- then reconcile (delete) them and assert they no longer block. Scoped by claim_id (other phases'
+-- claims also block machine — the operator reconciles ALL; here we pin the mechanism deterministically).
+--   c301 UNAUTHORIZED : nonbound holds an active 'fp-promo-unauth' (unknown fp -> not authorized).
+--   c302 OVER_HORIZON : A_owner holds fpPromo (owner-authorized, canonical) with a 60d lease.
+--   c303 NON_CANONICAL: A_ap holds 'machine:fp-promo-nc' (legacy-prefixed -> canonicalizes away; the
+--                       raw key also fails _for's parse, so it reads unauthorized too — both flags).
+-- =====================================================================================
+reset role;
+insert into agent_board.claims(id, agent_id, resource_kind, resource_key, lease_expires_at) values
+  ('ce000000-0000-4000-8000-00000000c301', 'ce000000-0000-4000-8000-0000000000a3', 'machine', 'fp-promo-unauth',      now() + interval '1 hour'),
+  ('ce000000-0000-4000-8000-00000000c302', 'ce000000-0000-4000-8000-0000000000a1', 'machine', 'fpPromo',              now() + interval '60 days'),
+  ('ce000000-0000-4000-8000-00000000c303', 'ce000000-0000-4000-8000-0000000000a8', 'machine', 'machine:fp-promo-nc',  now() + interval '1 hour');
+
+-- One aggregate assertion pins ALL three clauses AND their flag columns: a mutation removing the
+-- unauthorized clause drops c301, removing the over-horizon clause drops c302, and zeroing the
+-- non_canonical column flips c303's 'nc' -> the JSON mismatches.
+select is(
+  (select jsonb_object_agg(claim_id::text,
+            jsonb_build_object('u', unauthorized, 'h', over_horizon, 'nc', non_canonical))
+     from agent_board._claimgate_promotion_blockers('machine')
+    where claim_id in ('ce000000-0000-4000-8000-00000000c301',
+                       'ce000000-0000-4000-8000-00000000c302',
+                       'ce000000-0000-4000-8000-00000000c303')),
+  jsonb_build_object(
+    'ce000000-0000-4000-8000-00000000c301', jsonb_build_object('u', true,  'h', false, 'nc', false),
+    'ce000000-0000-4000-8000-00000000c302', jsonb_build_object('u', false, 'h', true,  'nc', false),
+    'ce000000-0000-4000-8000-00000000c303', jsonb_build_object('u', true,  'h', false, 'nc', true)),
+  'promotion gate: each seeded claim surfaces with exactly its blocker reason (unauthorized / over-horizon / non-canonical)');
+
+-- Reconcile (release/expire) the three, then they no longer block == the runbook's "empty == safe" step.
+delete from agent_board.claims where id in (
+  'ce000000-0000-4000-8000-00000000c301','ce000000-0000-4000-8000-00000000c302','ce000000-0000-4000-8000-00000000c303');
+select is(
+  (select count(*)::int from agent_board._claimgate_promotion_blockers('machine')
+    where claim_id in ('ce000000-0000-4000-8000-00000000c301',
+                       'ce000000-0000-4000-8000-00000000c302',
+                       'ce000000-0000-4000-8000-00000000c303')),
+  0, 'promotion gate: reconciling the seeded blockers empties them from the set (safe-to-flip proof)');
+
+-- #118 least-privilege: the promotion gate is an operator census/oracle — service_role ONLY.
+select ok(
+  not has_function_privilege('authenticated', 'agent_board._claimgate_promotion_blockers(text)', 'EXECUTE'),
+  'least-privilege: authenticated CANNOT execute _claimgate_promotion_blockers (operator-only oracle)');
+
+reset role;
+select * from finish();
+
+rollback;