@consiliency/agent-board-schema 1.12.0 → 1.23.0

package/tests/agent_board_delegation_cap_ceiling.test.sql

@@ -0,0 +1,303 @@
+-- DELEGCAPCEILING (#142) pgTAP — operator delegation caps are a DURABLE hard ceiling
+-- that a self-service (authenticated) root cannot loosen. Every property is
+-- mutation-oriented (CLAUDE.md rule #2):
+--
+--   * PRESERVATION: a self-service upsert leaves the operator_* ceiling columns UNCHANGED
+--     and inserts NO shadow row (positive exemption, rule #1) — mutate the upsert to drop
+--     the preserve and operator_max/op_ttl flip.
+--   * MINT CAP CLAMP: under an operator max_active_children=1, a self-service mint mints at
+--     most 1 (the effective cap is min(self, operator, 25), NOT 25) — mutate the mint clamp
+--     back to least(coalesce(self,25),25) and the throw disappears.
+--   * MINT TTL CLAMP: under an operator child_ttl_ceiling=2h, a self-service child is clamped
+--     to <=2h — mutate the mint clamp to ignore operator_child_ttl_ceiling and it jumps to 24h.
+--   * REQUIRE DURABILITY (invariant 4): an operator require=true is not relaxed to false by
+--     self-service (the self-pin), so a keyless self-service mint is refused — mutate the pin
+--     (true -> coalesce(p_require,true)) and both the state read and the keyless-mint throw flip.
+--   * OPERATOR LATITUDE (invariant 5): the operator path is unaffected — it honors the stored
+--     caps and can still set/loosen its own ceiling.
+--   * NO REGRESSION: a root with no operator policy self-services bounded only by the global
+--     25/24h ceiling.
+--   * EXECUTE class: CREATE OR REPLACE (no DROP) kept the ACL — mint stays service_role-only,
+--     upsert stays authenticated-executable (neither re-opened to PUBLIC/anon).
+--
+-- Allow-side assertions use lives_ok(...) + a separate state read (never
+-- is((select ... from rpc(...)))) so an allow that silently raises cannot pass green (#113).
+-- Runs as postgres; request.jwt.claim.role toggles _is_service_role() (''/service_role => true,
+-- 'authenticated' => false) and request.jwt.claim.sub picks the acting agent. Mints run as
+-- service_role with p_self_service=true simulating the EF-forwarded authenticated call (the EF
+-- binds root==session; that binding is tested in the EF suite).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(40);
+
+create temp table _cf (
+  owner_id uuid,
+  cap uuid, cap_user uuid, cap_child uuid,
+  ttl uuid, ttl_user uuid,
+  req uuid, req_user uuid,
+  none uuid, none_user uuid,
+  lat uuid, lat_user uuid,
+  k1 text, k2 text, k3 text, k4 text
+) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  u_owner uuid;
+  v_cap uuid := gen_random_uuid();
+  v_ttl uuid := gen_random_uuid();
+  v_req uuid := gen_random_uuid();
+  v_none uuid := gen_random_uuid();
+  v_lat uuid := gen_random_uuid();
+  v_cap_child uuid := gen_random_uuid();
+  v_cap_user uuid; v_ttl_user uuid; v_req_user uuid; v_none_user uuid; v_lat_user uuid;
+begin
+  u_owner := public.ensure_github_user('cf-own-'||s, 'cf-own-'||s||'@example.test', 'cf-own-'||s, 'CF Owner');
+  -- Each self-servicing root needs its own auth user (current_agent_id maps auth.uid ->
+  -- agents.auth_user_id; the acting sub is set to this user id).
+  v_cap_user  := public.ensure_github_user('cf-cap-' ||s, 'cf-cap-' ||s||'@example.test', 'cf-cap-' ||s, 'CF Cap');
+  v_ttl_user  := public.ensure_github_user('cf-ttl-' ||s, 'cf-ttl-' ||s||'@example.test', 'cf-ttl-' ||s, 'CF Ttl');
+  v_req_user  := public.ensure_github_user('cf-req-' ||s, 'cf-req-' ||s||'@example.test', 'cf-req-' ||s, 'CF Req');
+  v_none_user := public.ensure_github_user('cf-none-'||s, 'cf-none-'||s||'@example.test', 'cf-none-'||s, 'CF None');
+  v_lat_user  := public.ensure_github_user('cf-lat-' ||s, 'cf-lat-' ||s||'@example.test', 'cf-lat-' ||s, 'CF Lat');
+
+  -- All roots are TRUE lineage roots (parent null, not delegated children).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_cap,  'agent', 'cf-cap-' ||s, 'CF Cap',  'active', v_cap_user,  u_owner),
+    (v_ttl,  'agent', 'cf-ttl-' ||s, 'CF Ttl',  'active', v_ttl_user,  u_owner),
+    (v_req,  'agent', 'cf-req-' ||s, 'CF Req',  'active', v_req_user,  u_owner),
+    (v_none, 'agent', 'cf-none-'||s, 'CF None', 'active', v_none_user, u_owner),
+    (v_lat,  'agent', 'cf-lat-' ||s, 'CF Lat',  'active', v_lat_user,  u_owner);
+
+  -- A pre-created child agent to hang root_cap's single preloaded live grant on
+  -- (delegation_grants.child_agent_id is a unique FK to agents).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id)
+  values (v_cap_child, 'agent', 'cf-cap-child-'||s, 'CF Cap Child', 'active', u_owner);
+
+  insert into _cf values (
+    u_owner,
+    v_cap, v_cap_user, v_cap_child,
+    v_ttl, v_ttl_user,
+    v_req, v_req_user,
+    v_none, v_none_user,
+    v_lat, v_lat_user,
+    -- Distinct canonical 43-char base64url raw keys (one per key-inserting mint).
+    rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '='),
+    rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '='),
+    rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '='),
+    rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '='));
+end
+$$;
+
+-- ---------------------------------------------------------------------------
+-- Existence of the operator-ceiling columns.
+-- ---------------------------------------------------------------------------
+select has_column('agent_board', 'delegation_policies', 'operator_max_active_children',
+  'delegation_policies.operator_max_active_children exists');
+select has_column('agent_board', 'delegation_policies', 'operator_child_ttl_ceiling',
+  'delegation_policies.operator_child_ttl_ceiling exists');
+
+-- ===========================================================================
+-- A. Operator max=1 is a DURABLE ceiling: survives a self-service widen, and the
+--    self-service MINT is clamped to 1 (not 25).
+-- ===========================================================================
+-- Operator establishes the cap (service_role path).
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', '[]'::jsonb, 1, interval '8 hours', false) $$,
+    (select cap from _cf)),
+  'A: operator upsert (max_active_children=1) lives');
+select is((select operator_max_active_children from agent_board.delegation_policies where root_agent_id = (select cap from _cf) and revoked_at is null order by created_at desc limit 1),
+  1, 'A: operator establishes operator_max_active_children=1');
+
+-- Root self-services a widen to 25 (authenticated path).
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select cap_user from _cf)::text, true);
+select lives_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', '[]'::jsonb, 25, interval '24 hours', false) $$,
+    (select cap from _cf)),
+  'A: self-service upsert (widen to 25) lives');
+select is((select operator_max_active_children from agent_board.delegation_policies where root_agent_id = (select cap from _cf) and revoked_at is null order by created_at desc limit 1),
+  1, 'A: operator_max_active_children=1 SURVIVES the self-service overwrite (durable ceiling)');
+select is((select max_active_children from agent_board.delegation_policies where root_agent_id = (select cap from _cf) and revoked_at is null order by created_at desc limit 1),
+  25, 'A: self-service wrote its OWN cap (25) into max_active_children');
+select is((select scope_attestation from agent_board.delegation_policies where root_agent_id = (select cap from _cf) and revoked_at is null order by created_at desc limit 1),
+  'self_declared', 'A: the row flipped to self_declared');
+select is((select count(*) from agent_board.delegation_policies where root_agent_id = (select cap from _cf) and revoked_at is null),
+  1::bigint, 'A: no shadow row inserted — the single latest-unrevoked row was updated in place');
+
+-- Preload ONE live grant on root_cap so the effective cap of 1 is already reached.
+insert into agent_board.delegation_grants(child_agent_id, root_agent_id, parent_agent_id, delegation_policy_id, granted_scopes, grant_expires_at)
+select _cf.cap_child, _cf.cap, _cf.cap, dp.id, '[]'::jsonb, now() + interval '1 hour'
+  from agent_board.delegation_policies dp, _cf
+ where dp.root_agent_id = _cf.cap and dp.revoked_at is null;
+
+-- Self-service mint: effective cap = min(self 25, operator 1, global 25) = 1. With one live
+-- grant it is refused. The mutation reverting the mint clamp to least(coalesce(self,25),25)=25
+-- lets the mint through (25 > 1) and this throw disappears.
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select throws_ok(
+  (select format($$ select agent_board.mint_delegated_child(%L::uuid, %L, '[]'::jsonb, null, null, true) $$,
+     cap, 'cf-sscap-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _cf),
+  '42501', 'max_active_children: root has reached its active delegated-child ceiling',
+  'A: self-service mint clamps max_active_children to the operator ceiling of 1 (stored 25 NOT trusted)');
+
+-- Operator path (p_self_service=false) honors the stored 25 and mints despite the 1 live grant
+-- (operator latitude). require=true after the self-service pin, so supply a key.
+select lives_ok(
+  (select format($$ create temp table _a_opcap as select * from agent_board.mint_delegated_child(%L::uuid, %L, '[]'::jsonb, %L, null, false) $$,
+     cap, 'cf-opcap-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), k1) from _cf),
+  'A: operator mint honors the stored 25 (1 live grant < 25 => mints; latitude)');
+select is((select count(*) from _a_opcap), 1::bigint,
+  'A: operator cap mint produced exactly one child (not a silent zero-row pass)');
+
+-- ===========================================================================
+-- B. Operator child_ttl_ceiling=2h is a DURABLE ceiling: a self-service child is
+--    clamped to <=2h; the operator path keeps its latitude.
+-- ===========================================================================
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', '[]'::jsonb, null, interval '2 hours', false) $$,
+    (select ttl from _cf)),
+  'B: operator upsert (child_ttl_ceiling=2h) lives');
+select is((select operator_child_ttl_ceiling from agent_board.delegation_policies where root_agent_id = (select ttl from _cf) and revoked_at is null order by created_at desc limit 1),
+  interval '2 hours', 'B: operator establishes operator_child_ttl_ceiling=2h');
+
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select ttl_user from _cf)::text, true);
+select lives_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', '[]'::jsonb, null, interval '24 hours', false) $$,
+    (select ttl from _cf)),
+  'B: self-service upsert (child_ttl_ceiling=24h) lives');
+select is((select operator_child_ttl_ceiling from agent_board.delegation_policies where root_agent_id = (select ttl from _cf) and revoked_at is null order by created_at desc limit 1),
+  interval '2 hours', 'B: operator_child_ttl_ceiling=2h SURVIVES the self-service overwrite');
+select is((select child_ttl_ceiling from agent_board.delegation_policies where root_agent_id = (select ttl from _cf) and revoked_at is null order by created_at desc limit 1),
+  interval '24 hours', 'B: self-service wrote its OWN child_ttl_ceiling (24h)');
+
+-- Self-service mint: TTL ceiling = min(self 24h, operator 2h, global 24h) = 2h.
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  (select format($$ create temp table _b_ssttl as select * from agent_board.mint_delegated_child(%L::uuid, %L, '[]'::jsonb, %L, null, true) $$,
+     ttl, 'cf-ssttl-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), k2) from _cf),
+  'B: self-service mint under the 2h operator ceiling lives');
+select ok(
+  (select grant_expires_at <= now() + interval '2 hours' + interval '1 minute' from _b_ssttl),
+  'B: self-service child TTL clamped to the 2h operator ceiling (stored 24h NOT trusted)');
+
+-- Operator path honors the stored 24h ceiling (NOT clamped to the 2h operator ceiling: latitude).
+select lives_ok(
+  (select format($$ create temp table _b_opttl as select * from agent_board.mint_delegated_child(%L::uuid, %L, '[]'::jsonb, %L, null, false) $$,
+     ttl, 'cf-opttl-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), k3) from _cf),
+  'B: operator mint under the same policy lives');
+select ok(
+  (select grant_expires_at > now() + interval '3 hours' from _b_opttl),
+  'B: operator path honors the stored 24h ceiling (not clamped to the 2h operator ceiling; latitude)');
+
+-- ===========================================================================
+-- C. Operator require_child_signing_key=true is durable: self-service cannot relax it
+--    to false (self-pin), so a keyless self-service mint is refused (invariant 4).
+-- ===========================================================================
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', '[]'::jsonb, null, interval '8 hours', true) $$,
+    (select req from _cf)),
+  'C: operator upsert (require_child_signing_key=true) lives');
+select is((select require_child_signing_key from agent_board.delegation_policies where root_agent_id = (select req from _cf) and revoked_at is null order by created_at desc limit 1),
+  true, 'C: operator require_child_signing_key=true established');
+
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select req_user from _cf)::text, true);
+select lives_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', '[]'::jsonb, null, interval '8 hours', false) $$,
+    (select req from _cf)),
+  'C: self-service upsert requesting require=false lives');
+select is((select require_child_signing_key from agent_board.delegation_policies where root_agent_id = (select req from _cf) and revoked_at is null order by created_at desc limit 1),
+  true, 'C: require_child_signing_key stays true — self-service cannot relax an operator true (pinned)');
+
+-- A keyless self-service mint is refused because the policy still requires a key.
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select throws_ok(
+  (select format($$ select agent_board.mint_delegated_child(%L::uuid, %L, '[]'::jsonb, null, null, true) $$,
+     req, 'cf-ssreq-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _cf),
+  '22023', 'a child public key is required when the delegation policy requires a signing key',
+  'C: keyless self-service mint refused — the operator require=true survived (invariant 4)');
+
+-- ===========================================================================
+-- D. No operator policy => the operator ceiling is NULL and self-service is bounded
+--    only by the global 25/24h ceiling (no regression).
+-- ===========================================================================
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select none_user from _cf)::text, true);
+select lives_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', '[]'::jsonb, 10, interval '12 hours', false) $$,
+    (select none from _cf)),
+  'D: first-ever self-service upsert (no operator policy) lives');
+select is((select operator_max_active_children from agent_board.delegation_policies where root_agent_id = (select none from _cf) and revoked_at is null order by created_at desc limit 1),
+  null, 'D: operator_max_active_children is NULL (no operator ceiling)');
+select is((select operator_child_ttl_ceiling from agent_board.delegation_policies where root_agent_id = (select none from _cf) and revoked_at is null order by created_at desc limit 1),
+  null, 'D: operator_child_ttl_ceiling is NULL (no operator ceiling)');
+
+-- Self-service mint bounded by the root's own 12h ceiling (min(self 12h, no-operator, 24h)=12h).
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  (select format($$ create temp table _d_ss as select * from agent_board.mint_delegated_child(%L::uuid, %L, '[]'::jsonb, %L, null, true) $$,
+     none, 'cf-ssnone-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), k4) from _cf),
+  'D: self-service mint with no operator policy lives');
+select ok(
+  (select grant_expires_at <= now() + interval '12 hours' + interval '1 minute'
+      and grant_expires_at  > now() + interval '11 hours' from _d_ss),
+  'D: self-service child honors the root''s own 12h ceiling (bounded by self/global only)');
+
+-- ===========================================================================
+-- E. Operator WRITER latitude: an operator can still set AND loosen its own ceiling.
+-- ===========================================================================
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', '[]'::jsonb, 1, interval '8 hours', false) $$,
+    (select lat from _cf)),
+  'E: operator upsert sets a tight ceiling (max=1) — lives');
+select is((select operator_max_active_children from agent_board.delegation_policies where root_agent_id = (select lat from _cf) and revoked_at is null order by created_at desc limit 1),
+  1, 'E: operator ceiling established at 1');
+select lives_ok(
+  format($$ select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', '[]'::jsonb, 25, interval '8 hours', false) $$,
+    (select lat from _cf)),
+  'E: operator upsert loosens its own ceiling (max=25) — lives');
+select is((select operator_max_active_children from agent_board.delegation_policies where root_agent_id = (select lat from _cf) and revoked_at is null order by created_at desc limit 1),
+  25, 'E: operator can loosen its OWN ceiling to 25 (writer latitude)');
+select is((select scope_attestation from agent_board.delegation_policies where root_agent_id = (select lat from _cf) and revoked_at is null order by created_at desc limit 1),
+  'operator_vetted', 'E: an operator rewrite re-stamps operator_vetted');
+
+-- ===========================================================================
+-- F. EXECUTE class — CREATE OR REPLACE (no DROP) preserved the ACL; neither function
+--    re-opened to PUBLIC/anon.
+-- ===========================================================================
+select ok(not has_function_privilege('authenticated',
+  'agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean)', 'EXECUTE'),
+  'F: mint_delegated_child stays service_role-only (authenticated has NO EXECUTE after recreate)');
+select ok(not has_function_privilege('anon',
+  'agent_board.upsert_delegation_policy(uuid, text, jsonb, integer, interval, boolean)', 'EXECUTE'),
+  'F: anon has NO EXECUTE on upsert_delegation_policy');
+select ok(has_function_privilege('authenticated',
+  'agent_board.upsert_delegation_policy(uuid, text, jsonb, integer, interval, boolean)', 'EXECUTE'),
+  'F: authenticated retains EXECUTE on upsert_delegation_policy after recreate');
+select ok(has_function_privilege('service_role',
+  'agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean)', 'EXECUTE'),
+  'F: service_role retains EXECUTE on mint_delegated_child');
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+select * from finish();
+rollback;

package/tests/agent_board_delegation_enforcement.test.sql

@@ -13,20 +13,22 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(18);
+select plan(21);
 
 create temp table _deleg_fx (
-  owner_id uuid, r1 uuid, r2 uuid, r3 uuid,
+  owner_id uuid, r1 uuid, r2 uuid, r3 uuid, r4 uuid,
   child_a uuid, child_b uuid, exp_a timestamptz,
-  slug_c text, ca_pubkey text
+  slug_c text, pol4 uuid, ca_pubkey text
 ) on commit drop;
 
 do $$
 declare
   s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
-  u_owner uuid; u_r1 uuid; u_r2 uuid; u_r3 uuid;
+  u_owner uuid; u_r1 uuid; u_r2 uuid; u_r3 uuid; u_r4 uuid;
   v_r1 uuid := gen_random_uuid(); v_r2 uuid := gen_random_uuid(); v_r3 uuid := gen_random_uuid();
+  v_r4 uuid := gen_random_uuid();
   v_pol1 uuid := gen_random_uuid(); v_pol2 uuid := gen_random_uuid(); v_pol3 uuid := gen_random_uuid();
+  v_pol4 uuid := gen_random_uuid();
   v_ca uuid; v_cb uuid; v_exp_a timestamptz;
   -- Real (random) 43-char base64url Ed25519 public keys, generated caller-side.
   v_ca_pubkey text := rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '=');
@@ -36,6 +38,7 @@ begin
   u_r1 := public.ensure_github_user('deleg-r1-'||s, 'deleg-r1-'||s||'@example.test', 'deleg-r1-'||s, 'R1');
   u_r2 := public.ensure_github_user('deleg-r2-'||s, 'deleg-r2-'||s||'@example.test', 'deleg-r2-'||s, 'R2');
   u_r3 := public.ensure_github_user('deleg-r3-'||s, 'deleg-r3-'||s||'@example.test', 'deleg-r3-'||s, 'R3');
+  u_r4 := public.ensure_github_user('deleg-r4-'||s, 'deleg-r4-'||s||'@example.test', 'deleg-r4-'||s, 'R4');
 
   -- Root R1: root_minted policy, allowed_scopes=[a,b], ceiling 8h, max 2 children.
   insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
@@ -56,6 +59,16 @@ begin
   insert into agent_board.delegation_policies(id, root_agent_id, mode, allowed_scopes, child_ttl_ceiling, require_child_signing_key)
   values (v_pol3, v_r3, 'root_minted', jsonb_build_array('scope:a'), interval '8 hours', true);
 
+  -- Root R4: root_minted, UNCAPPED (max_active_children null), no child signing key
+  -- required -> exercises the "policy unrevoked" mint gate. Starts unrevoked so the
+  -- ALLOW twin mints; the DENY revokes v_pol4 in-test. Uncapped is load-bearing: with
+  -- no ceiling, the unrevoked mint cannot raise max_active_children, so the DENY throw
+  -- can only come from the revocation (see the mutation-pin rationale in the test body).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_r4, 'agent', 'deleg-r4-'||s, 'R4', 'active', u_r4, u_owner);
+  insert into agent_board.delegation_policies(id, root_agent_id, mode, allowed_scopes, child_ttl_ceiling, require_child_signing_key)
+  values (v_pol4, v_r4, 'root_minted', jsonb_build_array('scope:a'), interval '8 hours', false);
+
   -- Happy child-a (scope:a), enrolling the caller-supplied public key. Grant #1.
   select child_agent_id, grant_expires_at into v_ca, v_exp_a
     from agent_board.mint_delegated_child(v_r1, 'deleg-ca-'||s, jsonb_build_array('scope:a'), v_ca_pubkey);
@@ -69,12 +82,12 @@ begin
   select child_agent_id into v_cb
     from agent_board.mint_delegated_child(v_r1, 'deleg-cb-'||s, jsonb_build_array('scope:a'), v_cb_pubkey, interval '30 days');
 
-  insert into _deleg_fx values (u_owner, v_r1, v_r2, v_r3, v_ca, v_cb, v_exp_a, 'deleg-cc-'||s, v_ca_pubkey);
+  insert into _deleg_fx values (u_owner, v_r1, v_r2, v_r3, v_r4, v_ca, v_cb, v_exp_a, 'deleg-cc-'||s, v_pol4, v_ca_pubkey);
 end
 $$;
 
 -- Function existence.
-select has_function('agent_board', 'mint_delegated_child', array['uuid','text','jsonb','text','interval'], 'mint_delegated_child exists');
+select has_function('agent_board', 'mint_delegated_child', array['uuid','text','jsonb','text','interval','boolean'], 'mint_delegated_child exists');
 select has_function('agent_board', 'renew_delegated_grant', array['uuid','interval'], 'renew_delegated_grant exists');
 
 -- Happy mint: grant row shape.
@@ -170,6 +183,42 @@ select throws_ok(
   (select format($q$select agent_board.renew_delegated_grant(%L::uuid)$q$, child_a) from _deleg_fx),
   '42501', null, 'renew raises once the root is inactive (grant cannot outlive root authority)');
 
+-- Mint-time "root principal active" gate (message-board#87): the bound set in the
+-- header requires an active root at MINT, not only at renew. R1 is now suspended,
+-- so a fresh mint must be rejected by the principal-active gate. The exact errmsg
+-- pins this to that gate (it fires before max_active_children, which would also
+-- raise 42501) — proving root-active is enforced at mint, not incidentally caught.
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), %L)$q$,
+     r1, 'deleg-inact-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), ca_pubkey) from _deleg_fx),
+  '42501',
+  'principal_inactive: root agent principal is not fully active',
+  'mint rejects when the root principal is inactive (root-active gate holds at mint, not just renew)');
+
+-- Mint-time "policy unrevoked" gate (message-board#91): the bound set in the header
+-- requires the governing delegation_policies row to be unrevoked. The policy SELECT
+-- filters `revoked_at is null`, so a revoked policy makes the root's policy not-found
+-- and the "no active delegation policy for root agent" gate fires (42501). R4 is an
+-- independent, active, UNCAPPED root_minted root, so:
+--   ALLOW twin: while v_pol4 is unrevoked, a fresh mint succeeds — proving the fixture
+--   is otherwise sound and the DENY below can only come from the revocation (this pair
+--   distinguishes "revoked" from "no policy at all", since both share the errmsg).
+--   DENY: after revoking v_pol4, the same mint is rejected. The 4-arg exact-errmsg pin
+--   excludes the other 42501 gates (mode/principal/scope/max_active_children).
+select lives_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'))$q$,
+     r4, 'deleg-pa-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _deleg_fx),
+  'mint succeeds while the governing delegation policy is unrevoked (policy-unrevoked ALLOW twin)');
+select lives_ok(
+  (select format($q$update agent_board.delegation_policies set revoked_at = now() where id = %L::uuid$q$, pol4) from _deleg_fx),
+  'revoke the R4 delegation policy');
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'))$q$,
+     r4, 'deleg-pr-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _deleg_fx),
+  '42501',
+  'no active delegation policy for root agent',
+  'mint rejects when the governing delegation policy is revoked (policy-unrevoked gate holds at mint)');
+
 select finish();
 
 rollback;

package/tests/agent_board_delegation_policies.test.sql

@@ -5,7 +5,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(16);
+select plan(26);
 
 create temp table _deleg_fixture (
   board uuid,
@@ -50,6 +50,11 @@ begin
 end
 $$;
 grant select on _deleg_fixture to authenticated;
+-- #152: the sole-writer runtime-deny below reads owner_agent from this fixture while
+-- `set local role service_role` is active (to prove a raw service_role INSERT is denied),
+-- so service_role needs SELECT on the fixture too — otherwise the fixture read (not the
+-- insert) raises and ABORTS the whole file, truncating the run (CLAUDE.md #3).
+grant select on _deleg_fixture to service_role;
 
 -- delegation_policies shape -------------------------------------------------
 select has_table('agent_board', 'delegation_policies', 'delegation_policies table exists');
@@ -115,6 +120,107 @@ select is(
   (select max_grantable_role from agent_board.board_authority_ceilings c where c.board_id = (select board from _deleg_fixture)),
   'admin', 'the owner-set ceiling was upserted to admin');
 
+-- =====================================================================
+-- #152 SOLE-WRITER: upsert_delegation_policy is the ONLY write door to
+-- delegation_policies. service_role's direct INSERT/UPDATE grant is revoked
+-- (20260830000100) so an operator cannot set caps via raw SQL (which would
+-- leave the #142 operator_* ceiling NULL and let a later self-service widen
+-- escape it). SELECT is KEPT.
+--
+-- EC-4-style catalog assertions (self-maintaining; a regression re-grant names
+-- itself): has_table_privilege folds in PUBLIC + role inheritance, so the
+-- mutation-pin (re-grant insert,update to service_role in the migration) flips
+-- exactly the two grant assertions and the runtime-deny throws_ok. The allow-side
+-- lives_ok blocks are a REGRESSION GUARD that the owner-privileged definer path
+-- still functions after the revoke -- they do NOT flip under that mutation (the
+-- function runs as the table OWNER regardless of service_role's grant), and that is
+-- expected, not a coverage gap (CLAUDE.md #2: never claim a property a mutation
+-- cannot break as pinned).
+-- =====================================================================
+
+-- The set_board_authority_ceiling block above left request.jwt.claim.* set
+-- (set_config(...,true) persists for the txn; `reset role` does NOT clear GUCs).
+-- Restore the operator context: role=service_role => auth.role()='service_role'
+-- => _is_service_role() true => operator branch of upsert_delegation_policy.
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- Catalog: the closed grant asserted POSITIVELY (false), plus SELECT asserted true
+-- (proves the revoke did not over-reach and drop read access).
+select is(has_table_privilege('service_role', 'agent_board.delegation_policies', 'INSERT'), false,
+  '#152: service_role has NO direct INSERT on delegation_policies (sole-writer)');
+select is(has_table_privilege('service_role', 'agent_board.delegation_policies', 'UPDATE'), false,
+  '#152: service_role has NO direct UPDATE on delegation_policies (sole-writer)');
+select is(has_table_privilege('service_role', 'agent_board.delegation_policies', 'SELECT'), true,
+  '#152: service_role RETAINS direct SELECT on delegation_policies');
+
+-- LOAD-BEARING INVARIANT (Fable, #152): with service_role's direct grant revoked, the
+-- ONLY thing keeping the write path alive is that upsert_delegation_policy is SECURITY
+-- DEFINER AND owned by the delegation_policies table owner (so it writes on the owner's
+-- implicit privileges). If it were flipped to SECURITY INVOKER, or reowned to a role
+-- without table privilege, EVERY write path (operator + self-service) fails closed in
+-- production — a total write outage. The pgTAP session user IS the table owner, so
+-- invoker==owner MASKS the break here (all allow-side assertions still pass); only these
+-- catalog assertions catch it.
+--   * prosecdef (SECURITY DEFINER) IS mutation-pinned: `alter function ... security invoker`
+--     flips assertion 20 alone (verified: "failed 1 test of 26", allow-side stays green),
+--     which is the whole point — the invoker break is otherwise silent under the owner session.
+--   * The owner-OID equality is a STRUCTURAL TRIPWIRE, NOT in-harness mutation-pinnable
+--     (CLAUDE.md #2 honest labeling, not a covered claim): postgres cannot reassign the
+--     function's owner to any role that BOTH it can SET ROLE to AND that holds CREATE on
+--     agent_board — `alter function ... owner to service_role/authenticated` is rejected
+--     ("permission denied for schema agent_board") and supabase_admin is not SET ROLE-able.
+--     Postgres's own ownership rules thus enforce the invariant; this assertion is the
+--     named tripwire for a FUTURE migration that recreates the function under a different
+--     owner. Its real write consequence (owner CAN write despite the revoke) is behaviorally
+--     covered by the allow-side lives_ok below, which pass only BECAUSE the revoke is in place.
+select is(
+  (select prosecdef from pg_proc
+    where oid = 'agent_board.upsert_delegation_policy(uuid,text,jsonb,integer,interval,boolean)'::regprocedure),
+  true, '#152: upsert_delegation_policy is SECURITY DEFINER (sole-writer invariant)');
+select is(
+  (select proowner from pg_proc
+    where oid = 'agent_board.upsert_delegation_policy(uuid,text,jsonb,integer,interval,boolean)'::regprocedure),
+  (select relowner from pg_class where oid = 'agent_board.delegation_policies'::regclass),
+  '#152: upsert_delegation_policy owner = delegation_policies table owner (definer writes on owner privileges)');
+
+-- Runtime proof the raw-SQL door is actually shut: a direct INSERT executed AS
+-- service_role raises 42501. The re-grant mutation flips this to a live insert.
+set local role service_role;
+select throws_ok(
+  (select format($q$insert into agent_board.delegation_policies(root_agent_id) values (%L::uuid)$q$, owner_agent) from _deleg_fixture),
+  '42501', null,
+  '#152: a raw service_role INSERT into delegation_policies is denied (function is the sole writer)');
+reset role;
+
+-- Allow-side regression guard: the definer path is UNBROKEN by the revoke.
+-- Operator branch establishes the operator ceiling. #113: run the mutating RPC under
+-- lives_ok, then read state separately (never assert on a bare RPC value expression).
+select lives_ok(
+  (select format($q$select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', '[]'::jsonb, 3, interval '4 hours', true)$q$, owner_agent) from _deleg_fixture),
+  '#152: operator upsert_delegation_policy still succeeds after the revoke (definer runs as table owner)');
+select is(
+  (select operator_max_active_children
+     from agent_board.delegation_policies dp join _deleg_fixture f on dp.root_agent_id = f.owner_agent
+    where dp.revoked_at is null order by dp.created_at desc limit 1),
+  3, '#152: operator upsert established the operator ceiling (operator_max_active_children=3)');
+
+-- Self-service branch (role=authenticated, sub=owner_user => _is_service_role() false)
+-- still writes and PRESERVES the operator ceiling (#142): a widen to 25 does NOT
+-- overwrite operator_max_active_children (stays 3).
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select owner_user from _deleg_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.upsert_delegation_policy(%L::uuid, 'root_minted', '[]'::jsonb, 25, interval '24 hours', true)$q$, owner_agent) from _deleg_fixture),
+  '#152: self-service upsert_delegation_policy still succeeds after the revoke');
+select is(
+  (select operator_max_active_children
+     from agent_board.delegation_policies dp join _deleg_fixture f on dp.root_agent_id = f.owner_agent
+    where dp.revoked_at is null order by dp.created_at desc limit 1),
+  3, '#152: self-service upsert PRESERVED the operator ceiling (still 3, not widened to 25)');
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
 select finish();
 
 rollback;

package/tests/agent_board_enroll_federated_identity.test.sql

@@ -47,7 +47,7 @@ begin
 
   insert into _p values (
     'https://fed-ok-'||s||'.test', 'message-board', 'portal|'||s, 'fed-agent-'||s,
-    jsonb_build_object('sub', 'portal|'||s, 'act', jsonb_build_object('sub', 'act|'||s), 'name', 'Fed '||s),
+    jsonb_build_object('iss','https://fed-ok-'||s||'.test','aud','message-board','sub', 'portal|'||s, 'act', jsonb_build_object('sub', 'act|'||s), 'name', 'Fed '||s),
     'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0',
     'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
@@ -162,7 +162,7 @@ select is(
 -- Provider / scope / kind rejection matrix still raises ------------------------------
 select throws_ok(
   (select format($q$select agent_board.enroll_federated_identity('https://nope.test',%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
-     aud, sub, claim::text, 'x-'||slug, pub1, fp1) from _p),
+     aud, sub, (claim || jsonb_build_object('iss','https://nope.test'))::text, 'x-'||slug, pub1, fp1) from _p),
   '42501', null, 'unknown (issuer,audience) is rejected');
 select throws_ok(
   (select format($q$select agent_board.enroll_federated_identity(%L,%L,NULL,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
@@ -198,7 +198,7 @@ begin
     into v_agent, v_kid, v_kver, v_handle
     from agent_board.enroll_federated_identity(
       'https://fed-b1-'||s||'.test','message-board','portal|'||s,
-      jsonb_build_object('sub','portal|'||s), 'b1-'||s, v_pub,'raw_ed25519_base64url', v_fp,
+      jsonb_build_object('iss','https://fed-b1-'||s||'.test','aud','message-board','sub','portal|'||s), 'b1-'||s, v_pub,'raw_ed25519_base64url', v_fp,
       true, null, 'agent', '{board:send}', '{}') e;
   insert into _b1 values (v_agent, v_kid, v_kver, v_handle);
 end $$;

package/tests/agent_board_enroll_pop_binding.test.sql

@@ -15,7 +15,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(18);
+select plan(20);
 
 -- Client<->DB fingerprint round-trip (B2 raw-byte scheme): the DB derivation over the
 -- DECODED 32 key bytes must equal the constant an independent tool (Node crypto,
@@ -41,7 +41,7 @@ begin
   values ('https://fed-pop-'||s||'.test', 'message-board', true, true, '{board:send}', '{}', '{agent,human}');
   insert into _p values (
     'https://fed-pop-'||s||'.test', 'message-board', 'portal|'||s,
-    jsonb_build_object('sub','portal|'||s,'act',jsonb_build_object('sub','act|'||s)),
+    jsonb_build_object('iss','https://fed-pop-'||s||'.test','aud','message-board','sub','portal|'||s,'act',jsonb_build_object('sub','act|'||s)),
     'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk', 'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA');
 end
@@ -58,7 +58,17 @@ select is(
   (select claim->'act'->>'sub' from _p),
   'the act.sub is captured (audit-only) in the enrollment claim snapshot');
 
--- Duplicate fingerprint: re-enrolling key 1 raises (dedup on the UNIQUE index).
+-- Exact replay: rotating presentation claims do not create a second identity.
+select lives_ok(
+  (select format($q$create temp table _exact_replay as select * from agent_board.enroll_federated_identity(%L,%L,%L,(%L::jsonb || '{"iat":200,"exp":9999999999,"jti":"rotated"}'::jsonb),%L,%L,'raw_ed25519_base64url',%L,true,%L,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-ok', pub1, fp1, 'act|present') from _p),
+  'an exact stable-input replay with rotating JWT presentation claims succeeds');
+select is(
+  (select agent_id from _exact_replay),
+  (select a.id from agent_board.agents a where a.handle='pop-ok'),
+  'exact replay returns the original server-assigned identity');
+
+-- A replay mutation (slug and independent actor_sub) fails closed with 23505.
 select throws_ok(
   (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-dup', pub1, fp1) from _p),